Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 6 June 2026 to 12 June 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Tech titans seek to cast opposition to data centers as a Chinese influence operation

What happened: Several recent reports show that China is trying to boost the anti-data center movement in the US — but so far, this research all comes from organisations that are openly aligned with the AI industry or the aggressively pro-AI Trump administration, not from organisations that specialise in China or foreign influence.

Republicans in Congress have called for an investigation into US nonprofits that allegedly receive foreign funding and oppose the data center build-out, but critics say this is a naked attempt to silence dissent and smooth the way for AI industry interests.

OpenAI said it has uncovered what is likely a covert information operation by China-linked actors aimed at boosting popular opposition to the construction of data centers in the U.S. In a report published on June 10, the company said a group of accounts based in China used ChatGPT to generate social media images and text stating that data centers increase electricity costs for American; these were subsequently posted to social media platforms.

Notably, OpenAI said these efforts did not appear to have gotten any traction or moved the needle on US debate.

A report from late May from the Bitcoin Policy Institute, which promotes the crytocurrency, also claimed that China was funding opposition to data centers, as did a similar report from Power the Future, a nonprofit that is aligned with the Trump administration. These two reports were poorly researched, did not show that foreign governments were funneling money to US nonprofits, and made sweeping but unsupported claims that China was the hidden hand behind the anti-data center movement.

Why we’re tracking this: The reports come as local opposition across the US has slowed the mass construction of data centers, which provide the computing power needed to fuel the AI revolution. Data centers consume vast amounts of energy, potentially putting pressure on local power grids and raising electricity costs for local households.

The stakes are high. As the US and China are locked in a tight race for AI dominance, sluggish construction of data centers could give an advantage to the other side. But many Americans worry that data centers are just one more way that the AI revolution is siphoning jobs and money away from struggling Americans and towards an elite few.

What people are saying:

• ‘It is pretty hard to make the argument this is driven by foreign influence when you are dealing with people in sometimes very small communities showing up at town hall meetings angry about things directly affecting them.’ — Tamara Kneese, senior researcher at the Partnership on AI, The Washington Post

• ‘The targeting of OpenAI and US data center buildouts is significant not because the operation appears to have shifted public opinion, but because it shows PRC-origin influence operators testing narratives against AI infrastructure.’ — OpenAI

• ‘Tax-exempt status is not a shield for foreign influence. Organizations that misuse charitable structures to advance foreign interests undermine our laws, our democracy, and public trust.’ — Rep. Jason Smith of Missouri, chair of the House Ways and Means Committee, NOTUS

My view: Foreign government meddling in the domestic debates of democracies is a serious issue. But equally concerning is the age-old trick of trying discredit inconvenient public sentiment by casting it as a foreign ploy.

There is overwhelming evidence that US local opposition to data centers is authentic. There is ample evidence to suggest that the Chinese government does not want the US to build enough data centers. There is no evidence that the Chinese government’s efforts have moved the needle on US debate. It’s that simple.

OpenAI’s research is solid, but the reports from Bitcoin Policy Institute and Power the Future appear to be motivated not by a desire to uncover China’s influence (and thus to preserve the integrity of US civil society), but rather to delegitimise organic movements (and thus to compromise the integrity of US civil society). This is, ironically, a tactic widely used by the Chinese Communist Party to discredit grassroots Chinese civil society by accusing Chinese activists of being in bed with ‘hostile foreign forces.’

This is an anti-democratic abuse of the field of China influence research that both dilutes the impact of true high-quality research, and threatens US civil society itself.

— Bethany Allen, CTS

Anthropic releases Mythos models while calling for mechanism to pause frontier model development

What happened: Anthropic released two models — Claude Fable 5 and Claude Mythos 5 — built on the same Mythos-class system with different safeguards, per WIRED and iTnews. Fable 5 is the first Mythos-class model open to the public.

The release has drawn criticism on two fronts: an undisclosed intervention that, without notifying users, limits the model’s usefulness when it detects use in building rival AI; and a mandatory 30-day data-retention policy overriding existing Zero Data Retention agreements, according to iTnews and Mashable.

Days earlier, Anthropic had published a blog post arguing that its models are increasingly built by AI itself — a path towards recursive self-improvement. The Guardian reported it as Anthropic calling for a worldwide temporary pause on AI development, and for policymakers, researchers, civil society and AI companies to convene on the risks.

The same piece noted the call sits in tension with a Financial Times report that Anthropic embedded engineers in the NSA for offensive cyber operations potentially aimed at Iran and China. Critics questioned whether the proposal reflects safety concern or positioning ahead of Anthropic’s pending $1 trillion IPO filing.

Why we’re tracking this: Several threads in AI development are converging this week. Anthropic is widening access to its most capable model class while arguing the field would benefit from a way to pause development — having held Mythos back for months over its ability to find vulnerabilities in systems such as banking and power grids, per The Guardian. The model’s safeguards are not purely grounded in public-safety concerns: the restriction on using it to build competitor models also serves Anthropic’s commercial position, blurring the line between public-safety and commercial interests.

What people are saying:

• ‘Our view is we’ve built amazingly powerful technology. We’re going to keep building it.’ — Jack Clark, co-founder of Anthropic

• ‘Anthropic might give the impression of being warm and fuzzy, but their definition of AI safety is narrow. Supporting US authorities in the development of offensive capabilities has never been something they have spoken against.’ — Steven Murdoch, professor of security engineering at University College London.

• ‘Next up: Apple randomly reboots your Mac if you’re building competing tech, Gmail silently edits your emails if you mention rival platforms, and Tesla Autopilot swerves if it detects you’re working on self-driving cars. All in the name of safety, of course.’ — Mikel Artetxe, cofounder of Reka AI, an AI lab.

My view: Anthropic’s blog post argued for a mechanism to pause frontier development, not for a pause itself. That is not a new position for the company. In a 2023 interview, Anthropic’s CEO Dario Amodei backed a mechanism that would suspend the development of frontier-models if they were being deployed without adequate safeguards against misuse, the aim being to pressure labs to build those safeguards in advance so the instrument would never had to be triggered. Read that way, the apparent tension between calling for a pause mechanism and releasing its most capable model yet largely dissolves.

The harder question is how such a mechanism would work in practice. To be credible, it would need to include Chinese AI labs alongside their US and allied counterparts. Arms control is the natural governance model to draw on, but frontier AI differs in one respect: the competition is driven primarily by commercial rather than military actors, even as its implications turn strategic.

— Stephan Robin, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

What We’re Watching A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

The United States Department of Defense expanded its 1260H list of Chinese military companies, adding Alibaba, Baidu and BYD and reinstating memory chipmakers ChangXin Memory Technologies and Yangtze Memory Technologies alongside pharmaceutical contractor WuXi AppTec. The designation restricts the firms from US military contracts and research funding and carries few immediate legal penalties, according to Bloomberg.

The US urged NATO allies to use defence budgets to rip out and replace Huawei telecommunications equipment, with State Department China coordinator Joshua Young telling officials in Brussels the allocations could fund the switch; Germany and Spain are leading opposition to wider European Commission proposals to ban high-risk Chinese suppliers over fears of retaliation from Beijing. Taiwan, separately, is negotiating with Washington on much stricter AI hardware export controls that could restrict sales to all customers in China by computing-power thresholds and let Taiwan prosecute Nvidia chip smuggling as a criminal offence for the first time.

A coalition including CXMT, Alibaba, Dongguan Trust, SSCI Leading Fund and Advanced Micro-Fabrication Equipment launched a 3.91 billion yuan (about US$577 million) private equity fund in Shanghai, the Changzhi Hanhai Private Investment Fund, to provide long-term patient capital for China’s hard-tech sectors amid tightening US export controls, according to the South China Morning Post. The move comes as China’s state-backed Big Fund trims stakes in mature chip companies and CXMT prepares for a Star Market IPO.

SpaceX has excluded investors from mainland China and Hong Kong from its initial public offering, and OpenAI is reportedly planning identical restrictions for its own listing later this year, in what The New York Times described as escalating capital and technology decoupling between the United States and China over national security, data governance and intellectual property.

The White House said it would accelerate AI development and use for national security while barring unlawful surveillance and censorship, with President Donald Trump issuing a national security memorandum directing faster AI adoption across intelligence and warfighting domains and requiring updated guidance on autonomous weapons. The memo follows a dispute between Anthropic and the Pentagon over limits on Claude’s use for autonomous weapons and mass surveillance, Reuters reported.

The FBI seized more than a dozen websites it says suspected Chinese agents used to recruit current and former US officials with security clearances, posing as consulting firms advertising defence and ex-military roles and using identity theft and AI-generated photos and videos. The Justice Department separately announced the seizure of 13 domains tied to fake consulting firms that solicited insider information, following a Five Eyes warning that China is increasingly using job platforms to target people.

OpenAI banned two clusters of ChatGPT accounts it said likely originated in China and supported covert influence operations targeting US AI and technology-policy debates, including content claiming AI data centres were raising household electricity prices and material criticising US tariffs. Axios reported the campaigns appeared ineffective but showed pro-China actors testing AI tools to amplify existing US political and economic divisions.

⸻

🧠 AI models, agents & compute

Anthropic launched two Mythos-class models — Claude Fable 5, available publicly with safeguards, and Claude Mythos 5, the same underlying model with some safeguards lifted for trusted users — both priced at US$10 per million input tokens and US$50 per million output tokens, double Claude Opus 4.8 rates. Fable 5 routes cybersecurity, biology, chemistry and model-distillation prompts to Opus 4.8 in fewer than 5% of sessions, while Mythos 5 reached about 200 organisations across more than 15 countries through Project Glasswing. WIRED reported the earlier limited release reflected concern the model could be misused to develop hacking tools. iTnews put Mythos 5 at 10.75 captured Chrome V8 flags on ExploitBench, against 5.56 for Opus 4.8 and 4.44 for OpenAI‘s GPT-5.5.

Anthropic also imposed mandatory 30-day data retention across the Mythos class, overriding existing zero-data-retention agreements with enterprise and API customers — a change copyright and AI lawyer Jessica Eaves Mathews said nullifies prior commitments, which the company justifies as necessary to detect novel attacks and reduce false positives.

Anthropic separately proposed a mechanism to temporarily pause worldwide development of frontier AI models, and proposed convening policymakers, researchers and companies on the risks of advanced systems, citing Claude‘s progress toward recursive self-improvement and reporting that more than 80% of code merged into its codebase in May was authored by Claude. The Economist examined the same recursive-self-improvement concerns and noted Anthropic is expected to list on stock markets later this year. Dario Amodei, Anthropic’s chief executive, argued in an essay that policy is lagging model capabilities and called for binding regulation, including mandatory third-party testing of frontier models for cyber, biological and loss-of-control risks with government power to block unsafe deployments.

In The Australian, Paul Kelly argued Australia’s political and corporate leaders have not kept pace with AI’s economic, social and security implications, contrasting US debate over public stakes in AI companies with warnings from figures including Amodei. A Reuters/Ipsos poll found 53% of Americans fear AI could put them or someone in their household out of work, with 73% worried about increased AI use. Reuters separately reported that Chinese companies are quietly cutting contractors and using attrition as they adopt AI tools while avoiding mass layoffs that could draw government scrutiny, with analysts saying AI adoption is outpacing job creation amid high youth unemployment.

SpaceX struck a roughly US$30 billion deal under which Google will pay about US$920 million a month for AI computing power, giving Google access to around 110,000 Nvidia chips for its Gemini Enterprise agent platform, according to The New York Times. Bloomberg reported Google can terminate the multi-year deal if SpaceX fails to deliver chip access by 30 September 2026 or on 90 days’ notice after the end of the year. Nvidia, separately, said South Korea’s Naver will use its technology to build gigawatt-scale AI factories to meet rising demand for AI and physical-AI applications.

OpenAI is restructuring ChatGPT into an AI superapp combining coding tools and autonomous agents under unified product head Thibault Sottiaux, shifting resources toward its Codex line and enterprise revenue ahead of a planned IPO while shutting down its Sora video tool, the Financial Times reported. OpenAI and Visa also expanded a partnership letting AI agents make online purchases with user permission, mirroring Visa’s parallel deals with Anthropic and Microsoft. DoorDash, meanwhile, announced Ask DoorDash, a chatbot in select markets that lets customers order food and groceries from photos and prompts.

⸻

🛡 Cyber posture

Microsoft removed dozens of GitHub-hosted open-source projects after hackers apparently breached them and injected password-stealing malware, with many affected projects relating to Azure and AI development tools used with Claude Code, Gemini‘s command-line interface and VS Code. Security researchers said the malware could steal credentials when compromised tools were opened in AI coding apps, according to TechCrunch.

ServiceNow warned affected customers that attackers exploited an unauthenticated access flaw through a vulnerable API endpoint to query data from customer instances, and applied a security update earlier this month limiting the endpoint to authenticated users. Administrators linked the incident to the /api/now/related_list_edit/create endpoint and advised reviewing logs, according to BleepingComputer.

France’s digital affairs directorate DINUM said hackers used a compromised account to breach Tchap, the government’s encrypted messaging platform, with ANSSI detecting the breach earlier this week and CNIL alerted. A threat actor claimed responsibility, saying they used social engineering and stole messages, metadata, documents and media files.

Meta fixed a flaw in a customer-service tool that let hackers use an AI-powered chatbot to reset Instagram passwords, affecting roughly 34,000 accounts including 20,000 that were breached and exposed personal data, according to internal documents viewed by The New York Times. Meta said some back-end checks failed but not because of the AI agent itself, and that it was notifying regulators and affected users.

CISA issued a directive requiring US civilian federal agencies to fix, disable or remove the most serious vulnerable software or equipment from the internet within three calendar days, citing hackers’ use of AI and concern that advanced models could enable automated exploitation at scale, Reuters reported. Less severe vulnerabilities will have remediation windows of two weeks to two months.

In the Financial Times, Anthropic was reported to have embedded roughly six forward-deployed engineers inside the NSA to customise its Mythos model for offensive cyber operations such as infiltrating foreign networks. The arrangement persists despite Anthropic’s lawsuit against the Department of Defense over a supply-chain risk designation linked to the company’s attempts to restrict Claude’s use in lethal drones and mass surveillance.

⸻

🕵️ Surveillance states

German cybersecurity journalist Marc Hofer uncovered an unsecured prototype Chinese policing dashboard titled Dynamic Control Platform for Overseas Personnel, apparently built for Zhangjiakou‘s Public Security Bureau, containing profiles of foreign journalists and residents with passport details, phone numbers, CCTV records, travel data, hotel stays and relationship-mapping functions, according to The Sydney Morning Herald. The platform was closed off within hours of Hofer and former Telegraph correspondent Sophia Yan publishing their findings.

Meta said it is filing a federal-court contempt motion against Israeli spyware firm NSO Group for allegedly violating an injunction barring it from targeting WhatsApp users, after WhatsApp disrupted new spear-phishing attempts resembling earlier one-click campaigns. Civil-rights groups, security researchers and digital-rights experts filed amicus briefs opposing NSO’s appeal, Reuters reported.

Meta deleted code for an unreleased face-recognition system, internally called NameTag, from its Meta AI smart-glasses companion app after WIRED reported on the feature, which was designed to build biometric faceprints from faces captured by the glasses and match them against a local database. Meta said the feature was exploratory and no final decision had been made.

Russia temporarily disabled a specialised surveillance network protecting President Vladimir Putin and top aides after the assassination of Iran’s Supreme Leader Ayatollah Ali Khamenei, the Financial Times reported. The precautions followed revelations that Israeli intelligence weaponised advanced language-based AI to query millions of hours of Iranian CCTV data to track high-value targets.

Microsoft said it will tighten human-rights controls when working with national-security agencies after an inquiry into Israeli military use of its cloud for mass surveillance of Palestinians, which found Unit 8200 had used Azure to store intercepted phone calls. Microsoft terminated the unit’s access to some cloud and AI services and said it would adopt the inquiry’s recommendations, according to The Guardian.

The US House rejected a stopgap measure to renew Section 702 of the Foreign Intelligence Surveillance Act, all but ensuring the warrantless-wiretapping authority lapses this week after renewal talks collapsed over the status of acting intelligence chief Bill Pulte. Legal experts note a March surveillance-court recertification will likely require telecommunications companies to keep complying with intelligence directives into 2027, even as reformers push for warrant requirements and limits on purchased broker data.

⸻

⚖️ Platform accountability

Meta plans to use data shared by other businesses to personalise Facebook and Instagram feeds and AI responses, expanding an approach it already applies to ads, according to The Verge. Meta said the change does not involve collecting new data and can be controlled through its Activity from other businesses setting.

Chinese activist Apple Peiqing Ni was targeted on X with deepfake posts portraying her as promiscuous and a drug user after she posted about attending a Tiananmen massacre commemoration; X initially told her the posts did not breach its harassment or violent-speech rules, then suspended the account after The Guardian contacted its press office. Ni said UK police had advised her to report the posts to X and that her parents in China had been harassed over her activism.

⸻

🧑‍⚖️ Courts, enforcement & regulation

A federal judge in Mississippi sanctioned lawyers on both sides of a contractual dispute after finding they filed AI-generated briefs citing nonexistent cases, with Senior US District Judge Sharion Aycock cancelling the trial, disqualifying all four lawyers, barring two from the court for two years and fining each between US$1,000 and US$3,500, according to 404 Media.

A Munich regional court issued a temporary injunction against Google over false claims in AI-generated search overviews about two publishers, treating the overviews as Google’s own content and making it directly liable rather than applying traditional search-engine protections, The Decoder reported. The court rejected Google’s argument that users could verify linked sources themselves.

⸻

🏛️ Government, procurement & public sector tech

Britain is reviewing its £330 million NHS contract with Palantir amid pressure to trigger a break clause when the initial term ends in early 2027, with technology minister Liz Kendall saying the review will weigh patient confidentiality, public trust and reliance on a US supplier. A parliamentary committee urged ministers to end the contract, warning Palantir’s role posed an unacceptable point of weakness, according to Reuters.

Australia’s Department of Parliamentary Services announced the Parliamentary Information and Cyber Resilience project, the most significant upgrade to the federal Parliamentary Computer Network since its creation, aiming to segment the network and close compliance gaps with the Essential Eight standards. The move follows an Australian National Audit Office report that found the department only partly effective, citing failure to properly implement seven of the Australian Signals Directorate‘s Essential Eight strategies and a 55% turnover rate in its Cyber Security Branch over a year.

⸻

🏗️ Data centres & energy

In Crikey, Ketan Joshi wrote that a Greenpeace Australia Pacific report he led calls for a nationwide moratorium on data centre development in Australia, arguing the technology industry will not produce enough renewable energy to match new demand and that gas-fired data centres could worsen climate impacts. Joshi said Australia should pause, regulate and restrict data centre development.

Texas Governor Greg Abbott released recommendations for state data centre regulation ahead of the 2027 legislative session, proposing that new facilities add power generation, pay grid-interconnection and infrastructure costs, use closed-loop water systems, report electricity and water use and lose sales-tax exemptions. Abbott also directed regulators to act sooner on transmission and infrastructure costs.

NEXTDC‘s M3 facility in Melbourne — described by Crikey as a 225-megawatt site and one of Australia’s largest data centres — is promoted as a new digital gateway for the state, with 41,000 square metres of technical space built for hyperscale growth. The article framed M3 as part of the rapid expansion of data centres on industrial estates around Australian capital cities.

⸻

💰 Tech business & markets

President Donald Trump signalled openness to the US government taking equity stakes in leading AI labs through a public-private structure seeding a government wealth fund, Bloomberg reported, following proposals from OpenAI‘s Sam Altman and a push by Senator Bernie Sanders to require AI companies to surrender half their stock to redistribute wealth to citizens facing job displacement. Critics argued direct federal ownership risks nationalising the sector.

In The New York Times, former Andreessen Horowitz general partner John O’Farrell argued that major AI investors are using political spending to deter regulation, citing the Leading the Future PAC backed by AI and tech figures and the pro-regulation Public First Action PAC backed by Anthropic executives. O’Farrell said large-scale AI campaign spending distorts democracy and should instead fund public education and AI public-interest projects.

In Axios, Elon Musk was described as having built a corporate empire investors treat as too important to penalise despite repeated controversies, with the piece noting he was using X for far-right culture-war commentary on the eve of SpaceX‘s expected IPO. It framed investor tolerance of Musk’s conduct as unusually broad compared with standards applied to other chief executives.

Kalshi plans to require users in some prediction markets to disclose their employers as a guardrail against insider trading and manipulation, applying the rule to markets tied to material nonpublic information such as company performance and national security, according to The Wall Street Journal. The change follows an audit-committee recommendation and rising scrutiny from lawmakers, regulators and prosecutors.

Wesfarmers chief executive Rob Scott said the group will use AI to lift productivity across its stores and withstand weak consumer conditions, targeting existing pain points and freeing staff from repetitive tasks, according to the Australian Financial Review. Scott said Bunnings and Kmart marketplaces were growing after Wesfarmers closed Catch.

Jedify, a New York-based startup, raised US$24 million in Series A funding led by Norwest, with participation from Snowflake and others, to build a context graph connecting enterprise knowledge sources so AI agents can use company-specific data, permissions and workflows. The company said it has 10 to 20 early customers and is targeting mid-market and large enterprises.

⸻

🧒 Online harms & child safety

Apple announced child-safety changes at WWDC 2026 expanding parental controls across its devices, including broader Ask permissions for websites and unknown contacts, automatic filtering of potentially inappropriate images, FaceTime protections and more detailed Screen Time settings, according to Engadget. Apple said it is collaborating with the American Academy of Pediatrics on healthy screen-time guidelines.

Apple chief executive Tim Cook briefed Prime Minister Anthony Albanese on the new controls and, according to Albanese’s office, credited Australia‘s under-16 social-media ban as part of the inspiration, with tools including child-account setup changes, Ask to Browse, app-category time limits and expanded Communication Safety protections. The Sydney Morning Herald contrasted Apple’s device-level controls with Australia’s platform-level ban, which eSafety commissioner Julie Inman Grant has questioned.

UK Prime Minister Keir Starmer said big tech firms operating in Britain must stop children circulating nude images or face legislation, wanting Google, Apple and others to build or activate device controls to detect and block such images for children while allowing adult access through age verification, Reuters reported. Starmer is also reportedly considering restrictions on harmful social-media platforms for under-16s.

⸻

🌏 Global policy

🇺🇸 United States

The White House is negotiating federal preemption of some state AI laws in exchange for support for congressional tech-policy priorities, Axios reported, as states pass stronger AI rules. Representatives Jay Obernolte and Lori Trahan separately unveiled a 269-page bipartisan discussion draft that would preempt some state AI laws while requiring leading developers to disclose safety and security risks, use third-party auditors and formally establish the Center for AI Standards and Innovation.

Senators Ted Cruz and Ron Wyden introduced the bipartisan JAWBONE Act to curb federal pressure on broadcasters, online services and AI services to restrict speech, letting people sue federal agencies or employees for coercive jawboning and allowing state attorneys-general to bring civil actions, according to Ars Technica. It would also require certain government communications with social-media, AI and broadcasting companies to be logged to a public-summary portal.

A federal judge vacated President Donald Trump‘s policy imposing a US$100,000 fee on employers’ H-1B visa applications, with Judge Leo Sorokin ruling it violated the Administrative Procedure Act and the Constitution as a tax Congress had not delegated to the executive, CNBC reported. The administration said it plans to appeal.

🇪🇺 Europe

EU regulators criticised Apple for blaming the Digital Markets Act for its decision not to roll out upgraded Siri AI in the bloc for now, after the European Commission rejected Apple’s request for an 18-month exemption from interoperability obligations. The Commission said the decision was Apple’s alone and that the DMA does not block new product launches, Reuters reported.

The European Commission ordered Meta to give rival AI chatbots free access to WhatsApp while it investigates whether Meta abused its market power, issuing the interim measure after complaints from AI-assistant developers about Meta’s access fees. Meta criticised the order as regulatory overreach and said it would appeal.

EU Drugs Agency executive director Lorraine Nolan warned that drug gangs are exploiting AI, drones and online chemical marketplaces to create new designer chemicals and evade detection, with Europe emerging as a synthetic-drug production hub, the Financial Times reported. The agency’s annual report said new psychoactive substances were detected at roughly one a week last year and seizures hit a record by quantity in 2024.

🇬🇧 United Kingdom

The UK government introduced the National Security (State Threats) Bill to Parliament, creating counter-terrorism-style powers against foreign state organisations and state-linked proxy groups, allowing the Home Secretary to designate hostile organisations and creating offences for support or payment linked to them. The Home Office published accompanying documents, noting the bill builds on the National Security Act 2023 and applies new criminal sanctions to designated bodies, including proxies used by states to carry out hostile activity in the UK.

🇨🇦 Canada

Canada unveiled an AI for all strategy it says will create 250,000 jobs by 2031 and lift GDP by 3%, with Prime Minister Mark Carney announcing a C$500 million Canadian Tech Growth Fund and financing to help smaller businesses access AI tools, Reuters reported. Canada separately introduced a digital-safety bill that would ban social media for children under 16 unless platforms meet safety standards and create a regulator to set standards for AI chatbots, with penalties up to 3% of global revenue or C$10 million.

🇮🇳 India

India has effectively frozen final approvals for Starlink to begin commercial operations, with security agencies under the Ministry of Home Affairs withholding clearances over concerns about satellite-terminal use during the Iran war and seeking assurances despite Starlink’s US ownership, Bloomberg reported. The delay has also stalled a satellite-spectrum pricing proposal needed for commercial launches by Starlink and Indian competitors.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 30 May 2026 to 5 June 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Five Eyes warn China is using job platforms to recruit government insiders

What happened: The Five Eyes intelligence alliance, ASIO, CSIS, FBI, MI5 and NZSIS, issued a rare joint bulletin warning that China’s military intelligence services are using professional networking and online recruitment platforms, including LinkedIn, Indeed, and Upwork, to target individuals with access to sensitive government, military, and economic information. The bulletin, published simultaneously by partner agencies and available via MI5 and CSIS, describes the tactic as a scaled, methodical approach to identifying and cultivating sources through seemingly legitimate employment opportunities.

According to the bulletin, operatives pose as recruiters, consultants, or think-tank staff linked to fictitious companies outside China. They advertise fabricated roles, conduct virtual hiring processes, and progressively seek non-public material — often through encrypted communications and with financial incentives — from government employees, military personnel, academics, and journalists. Officials noted that even unclassified information can contribute to broader intelligence collection and expose individuals to legal risk.

China rejected the allegations, as reported by Reuters.

Why we’re tracking this: The bulletin is described by officials as an unprecedented coordinated public warning from the alliance’s domestic security agencies, as noted by the Washington Post. That unusualness is itself significant, joint public attribution at this level signals a deliberate escalation in how Five Eyes partners are choosing to communicate espionage threats to potential targets, including think-tank and policy staff directly relevant to the defence and strategic community.

What people are saying:

• ‘We’ve been clear that it is in the national interest to engage with China, not least because it enables us to directly challenge behavior which we will not tolerate.’ — Dan Jarvis, UK Minister of State for Security, Politico Europe.

• ‘There are plenty of naive experts out there who seem quite happy to sell their expertise without understanding the risks of doing so.’ — Clive Hamilton, professor of public ethics at Charles Sturt University, ABC News Australia.

• ‘We’re not saying don’t use social media or professional networking sites - just don’t tell the world you hold a national security clearance or work with sensitive government or military information.’ — Andrew Hampton, director-general of NZSIS, RNZ.

My view: The recruitment techniques described in the bulletin are broadly consistent with methods Five Eyes agencies have warned about for years so there’s no surprise there. What is notable is the decision to issue a coordinated public warning, which provides a deterrence signal to Beijing that these activities are being detected and attributed, raising operational costs for those involved. It also serves a resilience function, prompting officials and experts to scrutinise unsolicited approaches more carefully. The more meaningful indicators to watch are whether suspicious approaches are reported more frequently and whether engagement with recruitment attempts declines. Another is on tradecraft adaptation: if mainstream professional networking sites attract greater scrutiny, recruiters may migrate to industry-specific forums, encrypted messaging applications, academic networks, or private professional groups, platforms where awareness of this threat is lower and protective security guidance has less reach.

— Fitriani, CTS

Florida sues OpenAI and Sam Altman over chatbot safety risks

What happened: The US state of Florida filed a civil lawsuit against OpenAI and its CEO, Sam Altman, alleges that the company aggressively marketed ChatGPT to the public as safe and reliable while deliberately concealing serious safety risks and possible dangers. As reported by The New York Times, the state became the first to sue the ChatGPT maker over claims that its technology posed a risk to children. The legal action comes as Florida is pursuing a criminal investigation into whether ChatGPT played a part in the murder of two people during a mass shooting at Florida State University last year, noted the BBC.

An OpenAI spokesperson defended the company's safety records in statements to The Guardian, pointed to the platform's minor-specific safeguards, including age-prediction tools and parental monitoring features.

Why we’re tracking this: This case marks the first time a US state has sued an artificial intelligence developer while also seeking to hold its chief executive personally liable for product safety failures. The enforcement action explicitly separates Florida leadership from federal Republican alignment under President Donald Trump, who has actively pursued deregulation for the domestic AI sector.

What people are saying:

• ‘OpenAI and Altman ignored internal and external safety warnings, put children at great risk, and allowed a dangerous product to reach millions of Floridians.’ — Florida Attorney General James Uthmeier, The Guardian.

• ‘This lawsuit is a significant development, but it has not arrived in a vacuum.

  Across the US, the courts are filling with cases accusing tech companies of harming young people.’ — Alexandra Andhov, Chair in Law and Technology, University of Auckland, Waipapa Taumata Rau, The Conversation.

• ‘The law that the state of Florida is enforcing is a law against unlawful or deceitful business practices … that is a pretty broad line.’ — Bahrad Sokhansanj, Senior Research Scholar at the Institute for Law and AI, ABC.

My view: While the regulatory response to social media harms lagged for decades, the profound threat artificial intelligence poses to youth mental health and critical thinking requires immediate intervention. As generative models provide explicit, tailored advice rather than passive content feeds, companies must be held to a far stricter standard of legal accountability. Enforcing regulatory frameworks that preserve human-in-the-loop professional oversight for medical and psychological guidance is essential to stop children from naively relying on automated systems. Ultimately, establishing corporate consequences early in this judicial cycle is critical to prevent a broader governance failure where accountability is completely offloaded to autonomous tech.

— Lucy Haley, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🧠 AI models, agents & compute

The Anthropic Institute published a paper arguing that AI systems are already accelerating AI development, citing internal data showing engineers shipping code at eight times the rate seen in the preceding four years. The paper warns that continued advances could eventually allow AI systems to autonomously design and develop their successors, a process it describes as recursive self-improvement, and flags the attendant risks for monitoring, governance, and human oversight.

Sixteen mathematicians published the Leiden Declaration on Artificial Intelligence and Mathematics, warning that rapid advances in AI-driven theorem proving could reshape or distort mathematical research. The declaration raises concerns about reliability, transparency, and overreliance on proprietary systems, and cautions that AI may shift research priorities toward problems better suited to machine methods at the expense of openness and independent verification.

In The New York Times, Ezra Klein argued that policy discussions about AI have focused heavily on risks while neglecting a coherent agenda for ensuring AI produces public benefits. Klein called for governments to actively shape AI development through funding, data infrastructure, and compute access, including the possibility of publicly controlled frontier models.

⸻

🛡 Cyber posture

Researchers at the University of Toronto demonstrated an AI-assisted prototype computer worm capable of autonomously spreading across a controlled test network by adapting its attack strategies to each machine it encountered. The study found that AI systems capable of code generation can be used to create more sophisticated self-propagating malware, and researchers warned that increasingly powerful open-source AI systems could make similar techniques more viable in real-world environments.

President Trump signed an executive order directing federal agencies to strengthen cybersecurity using advanced AI capabilities and expanding cooperation with private-sector AI developers. The order mandates creation of an AI cybersecurity clearinghouse, expansion of AI-enabled defensive tools, and development of a voluntary framework for government access to certain frontier AI models before release. The order also prioritises criminal enforcement against malicious use of AI in cyber intrusions. Politico noted that the administration scaled back an earlier proposal seeking 90 days’ notice before model release to a voluntary 30-day process led by the National Security Agency.

Meta began notifying Instagram users after a hacking campaign reportedly exploited its AI chatbot to gain unauthorised access to accounts. Attackers allegedly tricked the chatbot into linking victim accounts to attacker-controlled emails by falsely claiming account ownership, enabling password resets and takeovers. Meta said it has secured affected accounts and issued reset notifications, but has not disclosed the total number of victims.

Security researcher Ammar Askar publicly released a proof-of-concept exploit for a flaw in Microsoft‘s VS Code that could allow attackers to steal GitHub access tokens through a single malicious link. Askar said he bypassed Microsoft’s vulnerability disclosure process after dissatisfaction with the company’s handling of previous reports, including disagreement over security impact and a lack of recognition, reflecting broader tensions over disclosure practices within the security research community.

Russia’s Federal Security Service claimed it uncovered a large-scale espionage operation in which malware was allegedly deployed on the mobile devices of senior Russian officials, enabling access to communications, geolocation data, contacts, and audio and video. Russian authorities have opened a criminal investigation, though the FSB did not identify the malware involved or provide technical evidence supporting its claims.

The World Food Programme is investigating a security breach that exposed personal information submitted by Palestinians seeking humanitarian assistance in Gaza. Compromised data included names, identification numbers, phone numbers, and location details collected through the agency’s self-registration platform, with information from approximately 600,000 Palestinian households potentially exposed. WFP suspended the affected application and implemented additional security measures.

⸻

🕵️ Surveillance states

Russia’s Supreme Court is considering a request to designate the Belarusian Cyber Partisans and Silent Crow hacker groups as extremist organisations. Both groups have claimed responsibility for cyberattacks against Russian and Belarusian government institutions and critical infrastructure, including a major 2025 attack on Aeroflot.

⸻

🚀 Strategic competition

The Five Eyes intelligence alliance issued a joint bulletin warning that Chinese military intelligence services are using professional networking sites and online job platforms to target individuals with access to classified or privileged information. According to the bulletin, intelligence officers are posing as recruiters and consultants linked to fictitious companies to facilitate recruitment and information collection, with Reuters noting that journalists, think-tank staff, and others with indirect access to government data are also being targeted.

Congress is considering legislation that would provide a 25% tax credit for buyers of U.S.-made printed circuit boards and $3 billion in grants for domestic manufacturers, amid growing concern over U.S. dependence on Chinese-made PCBs that underpin AI systems and defence electronics. Industry and defence officials warn that supply-chain concentration in China creates security risks including potential hardware compromise, with domestic producers including TTM Technologies and Sanmina expanding capacity.

Former CIA Director David Petraeus said unmanned and autonomous systems will be the defining challenge and investment opportunity in defence over the next decade, arguing that recent conflicts have exposed inadequate defences against drones and warning that autonomous drone swarms capable of coordinating without human operators could overwhelm existing military defences.

⸻

⚖️ Platform accountability

UK Prime Minister Keir Starmer accused Elon Musk of interfering in British politics and using the Henry Nowak murder case to create division. Starmer backed Labour MP Jess Asato‘s legal action against xAI, alleging Grok generated fake sexualised images and videos of her in breach of UK laws, and said the government would continue challenging AI platforms over harmful content.

The U.S. Federal Trade Commission is considering whether to modify or set aside a 2022 settlement that fined Twitter $150 million for using security-related account data for targeted advertising. X argues the order applies to a company that no longer exists, that responsible personnel have departed, and that current privacy controls make existing restrictions unnecessary. The FTC has opened a public consultation before deciding whether to alter the settlement terms.

New York Times publisher AG Sulzberger criticised AI companies at the World News Media Congress, accusing them of mass unauthorised use of news content and describing the practice as theft of intellectual property. Sulzberger argued that AI firms are weakening journalism’s economic model by extracting value from news websites without permission or compensation and warned that continued consolidation of data and attention by technology firms could reduce the viability of original reporting.

Constraints around compute, energy, data sovereignty, and chip access are driving AI infrastructure development beyond traditional technology hubs, according to Rest of World. The article highlights major AI infrastructure projects in India, Africa, Brazil, and the UAE, where governments and companies are building sovereign cloud, data centre, and GPU capacity to reduce dependence on U.S. hyperscalers.

⸻

🧑‍⚖️ Courts, enforcement & regulation

OpenAI released a policy proposal calling for mandatory evaluations of advanced AI models and assigning oversight to the Commerce Department‘s Center for AI Standards and Innovation (CAISI). The proposal diverges from a recent White House executive order that established a voluntary evaluation framework led by the National Security Agency, with OpenAI executives indicating they will lobby the White House and Congress to expand CAISI’s role and establish mandatory evaluation requirements for developers of advanced AI systems.

CFTC Chair Michael Selig said the agency is seeking to reverse what he described as a politically motivated enforcement action against Gemini, the cryptocurrency exchange run by Cameron and Tyler Winklevoss. The agency moved to vacate a January 2025 order that imposed a $5 million penalty and injunction on Gemini over alleged false statements made during its 2017 application for a bitcoin futures product, with Selig framing the move as part of a broader effort to roll back crypto enforcement actions initiated during the Biden administration.

⸻

💰 Tech business & markets

SpaceX filed for a $75 billion initial public offering that would value the company at approximately $1.77 trillion in what would be the largest IPO on record. The company plans to sell 555.6 million shares at $135 each, with proceeds directed toward AI, launch, and satellite infrastructure, and the filing disclosed a $1.25 billion-per-month AI compute contract with Anthropic. Bloomberg separately reported that ten Trump administration officials disclosed financial interests in SpaceX or xAI worth between $9.9 million and $43.8 million in aggregate, with the company a major federal contractor and several officials retaining holdings through waivers or indirect investment vehicles. Reuters reported that the deal includes governance elements such as strong founder control and restrictions on share sales by Musk post-listing.

Alphabet is planning to raise $80 billion through equity offerings, including a $10 billion investment from Berkshire Hathaway, to fund large-scale AI infrastructure spending. The raise reflects accelerating compute demand and the growth of Google Cloud alongside Alphabet’s core advertising business. Google, meanwhile, is offering selected Android developers on the Play Store participation in a confidential pilot program that pays them to share access to their app codebases, with the stated purpose of improving AI-assisted coding systems using real-world production code.

Meta launched its Meta Business Agent globally on WhatsApp Business after testing in markets including India and Mexico. The AI agent handles customer support tasks including answering questions, recommending products, booking appointments, and escalating conversations to human staff, with Meta also extending the agent to Instagram DMs.

⸻

🌏 Global policy

Australia

In The Strategist, Jack Evans argued that Australia’s geographic distance from active conflict zones, stable governance, legal predictability, and growing renewable-energy capacity make it an increasingly attractive location for AI data centres. The piece cited major planned investments by Microsoft and AWS in Australia, while warning that the country could lose this advantage if energy, grid, and approvals infrastructure fail to keep pace with growing AI-related demand.

China

China is deploying AI across its healthcare system to address structural problems including uneven access to medical services and shortages of qualified doctors in rural areas, with government policy accelerating adoption of diagnostic systems, patient-tracking bots, and large language model-based medical assistants across hundreds of hospitals, according to The Wire China. Experts warn that rapid deployment without sufficient regulation and clinical validation could lead to misdiagnosis and uneven quality of care. China’s AI industry is also facing rising computing, energy, and infrastructure costs as demand shifts toward more resource-intensive AI agents and workflows, with major firms including Alibaba, Tencent, Baidu, and Zhipu raising prices for AI services.

JinkoSolar, one of China’s largest solar manufacturers, sold its Florida-based subsidiary while retaining a minority stake, reflecting a broader retreat of Chinese clean-tech firms from the U.S. market amid regulatory and political scrutiny. The company’s U.S. operations have faced tariffs, government investigations, and concerns over supply chain links to forced labour in Xinjiang, with more than half of planned Chinese clean-tech investments in the U.S. since 2022 reportedly cancelled, paused, or delayed.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 23 May 2026 to 29 May 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Pope Leo pushes AI ethics into global politics

What happened: Pope Leo XIV used his first encyclical, Magnifica Humanitas, to position artificial intelligence as a political, social and moral challenge rather than purely a technological one. The 42,300-word document warned that AI risks concentrating power, undermining democratic accountability and reducing people to data points and economic functions if left primarily in the hands of governments and private technology firms.

The encyclical repeatedly framed AI as a change comparable to the industrial revolution. It called for protections for the most vulnerable, legal oversight and ethical constraints on AI, including on autonomous weapons. It also pushed for establishment of a shared framework, including at the international level, to curb the technological arms race and ensure robust protection for civilians.

The Vatican presented the encyclical alongside Anthropic co-founder Christopher Olah, who warned that AI will displace human labour on very large scale and that supporting those displaced would become a moral imperative of historic proportions. Writing in WIRED, Daniele Polidoro called the moment an unprecedented alliance between the Church and Silicon Valley. Critics may see the Vatican’s decision to hand a frontier-AI executive a platform as a moral endorsement, offered amid intense commercial competition and the company’s own friction with the Pentagon.

Why we’re tracking this: The intervention pulls AI governance further into mainstream geopolitical and cultural debate. It rejects the idea that AI development is inevitable or politically neutral, and puts labour, warfare and democratic oversight squarely on the table.

It also lands as tensions grow between calls for stronger regulation and governments prioritising AI competitiveness, national security and industrial policy. NBC News noted the silence of tech titans towards the encyclical, while US Vice President JD Vance, himself a convert to Catholicism, acknowledged that advancement of technology may require a rethink of the ‘Just War’ doctrine.

What people are saying:

• ‘Technology is never neutral, because it takes on the characteristics of those who devise, finance, regulate and use it.’ — Pope Leo XIV, Magnifica Humanitas.

• ‘Can the moral authority of a pope counter the ambitions of the handful of wannabe trillionaires driving one of the most significant technologies in history?’ — Stephen Bartholomeusz, The Sydney Morning Herald.

• ‘Boards and governments integrating AI without parallel investment in accountability are courting regulatory and reputational exposure as the rules sooner or later catch up, or the harms are inevitably brought to light.’ — Jordan Guiao, InnovationAus.

My view: Pope Leo’s call for a shared framework to curb an AI arms race comes amid a broader crisis of multilateralism. The frameworks that exist are either geographically limited or driven by national interest. The EU AI Act offers the most comprehensive regulatory foundation for anchoring the technology’s development in human rights, but its reach stops at the bloc’s borders. The US AI Action Plan focuses on competitive dominance through accelerating innovation, infrastructure building and international diplomacy. China’s Global AI Governance Action Plan offers strategic pointers for international AI development, emphasising respect of national sovereignty, alignment with development goals, as well as safety and controllability. Global South countries, whose workforces are most exposed to AI-driven displacement, remain largely absent from meaningful international AI governance initiatives.

With geopolitical tension pushes unrestricted development of autonomous weapons, surveillance and targeting, and companies race to build frontier AI for profit, the 2024 UN Global Digital Compact is worth returning to: a commitment to technologies that accelerate progress, eradicate poverty and leave no one behind. The challenge is whether those 2030 goals are reachable, or whether governance keeps trailing the technology it is supposed to steer.

— Fitri, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

President Trump postponed signing a much-anticipated AI and cybersecurity executive order hours before a scheduled ceremony last week, with AI adviser David Sacks and tech executives including Mark Zuckerberg and Elon Musk raising last-minute objections. Trump cited concerns the order would impede US competitiveness against China; industry sources also questioned why the Treasury Department had been assigned a coordinating role on security vulnerability disclosures rather than CISA or NIST, according to Axios. A seven-page draft obtained by POLITICO would have created a voluntary system requiring developers to submit advanced AI models for federal agency review up to 90 days before public release, while explicitly stating the government would not establish mandatory licensing for AI development.

Last-minute phone calls from tech leaders persuaded Trump to postpone the order, The Washington Post reported, with industry warning the voluntary review system could become de facto mandatory and inhibit development. Sacks called Trump on Wednesday night before the planned ceremony to raise concerns after earlier indicating support, blindsiding White House staff; industry pushed for a 14-day sharing window instead of 90 days and intelligence community leadership of any review process. The order is not dead but will be revisited in unclear form.

China is imposing overseas travel restrictions on senior AI professionals at private companies including Alibaba and DeepSeek, requiring government approval before international travel, Bloomberg reported. Authorities are targeting startup founders, researchers, and executives deemed critical to the country’s AI ambitions, assessing individuals based on strategic importance rather than seniority alone, as Beijing seeks to close the gap with the US.

China’s Wingtech Technology filed a $1.2 billion damages lawsuit against Nexperia B.V. and five other entities, claiming its control over the chipmaker remained restricted. The suit could re-escalate a dispute frozen since late 2025, when China agreed to reduce export controls on Nexperia chips in exchange for the Netherlands suspending its earlier seizure of the company. Wingtech is pursuing damages under China’s anti-foreign sanctions law, arguing the defendants’ restrictive measures caused irreparable losses.

Nvidia CEO Jensen Huang urged Super Micro Computer to strengthen compliance after Taiwan detained three people for allegedly making fraudulent declarations about AI servers in the island’s first crackdown on semiconductor smuggling. The defendants allegedly conspired to purchase servers and export them using fraudulent documentation to circumvent US chip export restrictions; the case follows the earlier US arrest of Super Micro’s co-founder for allegedly diverting billions in Nvidia chips to China. Super Micro said it will strengthen trade compliance with pre- and post-shipment verifications.

Airbnb CEO Brian Chesky defended the company’s use of Chinese AI models, telling Bloomberg that US lawmakers misunderstand the technology and that Airbnb is not providing data to Chinese companies. Chesky said the company primarily uses open-source models for its customer service chatbot — which now handles 70% of customer service tickets — and uses Alibaba’s Qwen model in certain situations. The defence follows a House investigation into alleged Chinese efforts to exploit American innovation; the same committees are also investigating Anysphere’s use of Chinese AI technology.

In The Strategist, an analysis argued that space has achieved decisiveness equivalent to air power and should be formally classified as a warfighting domain to coordinate capabilities and signal deterrence. The US established the Space Force in 2018 and designated space a warfighting domain; Australia and NATO still classify space as an operational domain. The 2026 Secure World Foundation Global Counterspace Capabilities report tracked military space capabilities being developed by 13 countries, including electronic warfare, anti-satellite weapons, and co-orbital spacecraft.

⸻

🧠 AI models, agents & compute

Anthropic released Opus 4.8, its most advanced publicly available model, 41 days after Opus 4.7’s launch in an accelerated upgrade cycle responding to competitive pressure from OpenAI’s Codex and Google’s Gemini Flash. The release includes Dynamic Workflows, a research-preview feature enabling complex task management across hundreds of parallel subagents; Claude Code with Opus 4.8 can execute codebase-scale migrations across hundreds of thousands of lines of code. Anthropic expects to complete safeguards for its withheld Mythos model within weeks.

Pope Leo XIV released a 42,300-word papal encyclical titled ‘Magnifica Humanitas’ earlier this week, warning of AI’s disruptive effects on human dignity, employment, and agency, and calling for government regulation of AI companies and worker protection. Leo presented the encyclical alongside Christopher Olah, co-founder of Anthropic, and the document called for regulation, worker retraining, critical media education, child protection, and human control over weapons decisions. The encyclical, formally signed earlier this month on the 135th anniversary of Leo XIII’s ‘Rerum Novarum’ on labour rights, positioned AI ethics as a religious imperative and framed the technology choice in biblical terms, between hubris and renewal.

The encyclical also warned that some autonomous weapons systems have advanced beyond meaningful human control, and made one of the clearest papal repudiations of just-war theory in modern times, Reuters reported. In AFR, a commentary contrasted Leo’s framework with the Trump administration’s deregulatory approach, noting Peter Thiel had visited Rome arguing AI regulation resembles heresy — a framing the Vatican rejected as a heresy of its own.

Anthropic launched Project Glasswing with roughly 50 partners to identify vulnerabilities in critical software before AI models can be weaponised against it, using Claude Mythos Preview. The effort has found more than 10,000 high- or critical-severity vulnerabilities across systemically important software, with partners reporting bug-finding rates increased by more than 10x. Mythos Preview scanned 1,000+ open-source projects and identified 6,202 high- or critical-severity vulnerabilities, with 90.6% of assessed findings proving valid; the company says the challenge is now patching, not finding, vulnerabilities.

The White House approved a secret $9 billion request to acquire cutting-edge Nvidia Grace Blackwell superchips that US intelligence agencies need to deploy the latest AI models on classified systems, The New York Times reported. The chip shortage has hampered the CIA, NSA and other agencies from testing or deploying newest AI models; the administration reprogrammed $800 million for rapid acquisition. White House chief of staff Susie Wiles authorised NSA to continue using Anthropic’s advanced model despite the Pentagon designating the company a supply chain threat; a classified contract is being finalised with a carve-out preventing the AI model from being used on Americans’ data.

Britain’s AI Security Institute, staffed by around 100 employees from intelligence agencies, academia, and tech companies, conducts red-team testing and safety research on leading AI models including Claude and Gemini, The New York Times reported. The institute, created nearly three years ago with £360 million in government funding, has found major safety gaps in every leading AI model tested and demonstrated AI systems can be tricked into providing instructions for biological or chemical weapons and cyberattacks. Created by former PM Rishi Sunak after a 2023 meeting with OpenAI, Anthropic, and Google DeepMind leaders, the institute is becoming a template for other governments; Australia, Canada, China, France, India, Japan, and Singapore have formed similar institutes.

Robinhood Markets launched a feature enabling customers to link AI agents such as Anthropic’s Claude or the coding agent Cursor to dedicated investment accounts, granting them authority to execute trades autonomously based on user-defined parameters, The Wall Street Journal reported.

OpenAI announced partnerships and initiatives to combat election interference and misinformation ahead of 2026 US and global elections. The company is offering cybersecurity products (Codex Security and Trusted Access for Cyber) to registered voting system manufacturers, briefing state election officials, and providing live vote counts from The Associated Press for US and Brazil elections. OpenAI is also endorsing transparency legislation including the Protect Elections from Deceptive AI Act and Preparing Election Administrators for AI Act.

⸻

💻 Chips, quantum & data infrastructure

The Trump administration awarded $2 billion in grants to nine quantum-computing companies last week, taking minority equity stakes in each. IBM received $1 billion and is investing $1 billion of its own cash to establish the nation’s first specialised quantum chip manufacturing facility; GlobalFoundries received $375 million and a roughly 1% government stake, with other recipients including D-Wave, Rigetti and Infleqtion receiving $100 million each. Two Australian-founded companies — Diraq (a UNSW spin-out) and PsiQuantum — were among the recipients, receiving US$38 million and US$100 million respectively, SMH reported; PsiQuantum is building a utility-scale machine in Queensland.

IBM itself, days later, announced plans to invest over $10 billion over five years to build the first large-scale quantum computer capable of reliable, error-free complex calculations by 2029, Reuters reported. The investment follows the federal equity stakes, with IBM contributing intellectual property, assets and workforce to the new manufacturing facility (named Anderon). IBM said it will expand ecosystem partnerships across more than 325 Fortune 500 companies, startups, universities and government agencies currently using its 90+ deployed quantum systems.

President Emmanuel Macron announced one billion euros in new funding for quantum computing last week, warning France and the EU must accelerate investment to keep pace with US and Chinese advances. France has already committed 2.3 billion euros since 2021 for quantum research; Macron also announced 550 million euros for semiconductors as part of a European programme, on top of 5.5 billion since 2022. Macron emphasised the strategic and sovereignty dimensions, calling for a European ecosystem free from extra-territorial legislation.

In Financial Times, an analysis characterised computing power as critical infrastructure equivalent to oil and electricity grids, noting 90% of global AI computing is controlled by US and Chinese companies. The UK and allied nations are exploring neuromorphic and quantum computing to secure independence, with £2bn UK quantum funding and €67mn for the German space agency. Semiconductor leadership concentrated in South Korea (Samsung, SK Hynix), Taiwan (TSMC), and the Netherlands (ASML) provides strategic leverage, but allied countries lack sufficient capital to develop and retain domestic champions.

Huawei announced a new chip design principle called ‘Tau Scaling Law’ (also known as ‘Her’s Law’), developed over six years by semiconductor chief He Tingbo, that the company says breaks through Moore’s Law limits, Nikkei Asia reported. The new LogicFolding chip architecture delivers a 55% transistor density gain and 41% power efficiency gain through three-dimensional spatial reorganisation rather than new lithography steps. Huawei’s upcoming Kirin chipset, launching later this year, will be the first to fully adopt the new law; the company claims it could match 1.4-nanometer technologies of TSMC and Intel by 2031.

Nvidia’s Jensen Huang said the company is spending US$100–150 billion annually on Taiwan supply chain partners, with plans to quadruple headcount from 1,000 to 4,000 employees by 2030. Huang flagged Taiwan as the centre of AI chip design, packaging, systems integration, and robotics engineering; Nvidia plans to construct a new downtown Taipei complex called Constellation, with construction beginning late 2026 and completion by 2030. Huang also flagged energy infrastructure as Taiwan’s critical priority for sustaining AI manufacturing growth.

AI-driven demand has caused Chinese automakers to face shortages and soaring costs for legacy memory chips, as semiconductor leaders reallocate production to high-bandwidth memory (HBM) and DDR5 for AI servers, Nikkei Asia reported. Xpeng chair He Xiaopeng and Xiaomi founder Lei Jun cited surging memory chip costs pressuring profitability; BYD raised assisted-driving package prices 21% and Changan increased SUV prices by 3,000 yuan due to chip costs. Analysts expect the memory chip crisis to persist until the end of 2027 at the earliest.

Foreign private equity firms are exiting China’s data centre sector as political and regulatory pressures make overseas ownership of critical digital infrastructure increasingly difficult, Financial Times reported. Princeton Digital Group (backed by Warburg Pincus) is launching a sale of China assets potentially worth $1 billion, following major exits by Bain Capital (which sold $4 billion in 2025) and Carlyle. Global PE firms are redirecting tens of billions of dollars from mainland China into other Asian markets including Malaysia, Japan, and India.

Cryptocurrency companies are accelerating preparations for quantum computing threats to blockchain security, with tech companies projecting practical quantum computers could be developed by 2030. Google’s April research paper identified specific vulnerabilities for cryptocurrencies, finding quantum computers could break cryptography with fewer resources than previously suggested. Ripple, Circle, Tron, and the Ethereum Foundation have detailed plans to implement quantum-resistant cryptography; Bitcoin faces challenges due to decentralisation requiring industry-wide coordination, with the industry estimating 3–5 years and potentially hundreds of billions of dollars needed to prepare.

⸻

🛡 Cyber posture

A supply chain attack dubbed ‘Megalodon’ infected more than 5,500 GitHub repositories using over 5,700 malicious commits injected within a six-hour window earlier this month, SecurityWeek reported. The attack, discovered by SafeDep after malicious versions of the Tiledesk open-source chatbot package were identified, deployed payloads to steal credentials, AWS/GCP/Azure tokens, SSH keys, Docker/Kubernetes configs, API keys, database strings, and CI/CD tokens via GitHub Actions workflows. Attackers compromised the Tiledesk GitHub repository without touching the NPM account, with the maintainer publishing from the poisoned source unknowingly; the attack exploited GitHub’s ‘workflow_dispatch’ exemption, allowing dormant backdoors to be triggered later via GitHub API.

One Australian MP and three staffers had their WhatsApp accounts hacked by a suspected foreign state actor through phishing attacks that bypassed two-factor authentication, The Australian reported. The Department of Parliamentary Services was notified in early March that multiple WhatsApp accounts of parliamentarians and staff were compromised; DPS then temporarily blocked WhatsApp across Parliament House’s network to limit damage. Since July 2025, DPS has detected 46 instances of malware, more than 20,000 phishing attempts, and 1,458 cyber alerts targeting Parliament House.

Belarus-linked threat actor GhostWriter (also tracked as UNC1151 and Storm-0257) launched an espionage campaign active since spring 2026 targeting Ukrainian government officials using fake emails disguised as messages from Prometheus, Ukraine’s largest online learning platform. Phishing emails claimed to offer course completion certificates and contained PDF attachments with malicious links downloading ZIP archives carrying OysterFresh malware, which deployed OysterBlues and OysterShuck components to collect system information. CERT-UA also warned of a concurrent campaign targeting Delta battlefield management system users through phishing masquerading as cybersecurity agency alerts.

Anne Keast-Butler, director of GCHQ, warned that the West faces a shrinking window to counter escalating cyber and hybrid threats from China and Russia, CNBC reported. Keast-Butler said China has emerged as a science and technology superpower with sophisticated intelligence and cyber capabilities, while Russia is conducting daily hybrid warfare targeting critical infrastructure, democratic processes, and supply chains. She called for cybersecurity to become ten times more urgent across government and private sector, noting the risk of miscalculation with Russia is at its highest level; her speech marked the 80th anniversary of the UKUSA intelligence agreement.

Dutch financial crime investigators (FIOD) seized 800 servers from WorkTitans and MIRhosting data centres and arrested two men for providing hosting infrastructure to NoName057(16), a Kremlin-backed hacktivist group conducting DDoS attacks across Europe. The servers were linked to sanctioned entities controlled by Moldovan brothers Iurie and Ivan Neculiti, who rebranded their sanctioned Stark Industries to THE.hosting and transferred operations to Dutch corporate shells to evade EU sanctions. NoName057(16) operates as a gamified, state-sponsored cyberattack platform with a leaderboard rewarding cryptocurrency to productive contributors.

Russian President Vladimir Putin appointed Andrei Kozlov, former head of RT-Information Security (a cybersecurity centre within state-owned Rostec), as an aide to Security Council Secretary Sergei Shoigu, The Record reported. Leaked data revealed Kozlov held classified security clearance under Military Unit 26165 (the 85th Main Special Service Centre), which Western governments and cybersecurity firms have linked to Fancy Bear (APT28/Forest Blizzard), a GRU-affiliated hacking group conducting cyber espionage and influence operations against NATO governments and defence contractors. Kozlov’s predecessor was similarly linked to the same GRU unit before moving to TASS.

In The Strategist, ASPI fellow Rajiv Shah argued that the Canvas learning management system breach earlier this month exposed student records and disrupted systems affecting 275 million users at 8,800+ institutions globally, including Australian universities (ANU, Melbourne, UTS) and the Queensland Department of Education. Instructure, Canvas’s parent company, reportedly paid a ransom to attackers to destroy data, exposing vulnerabilities in sectoral dependency on SaaS platforms where single-point failures affect entire sectors. Shah argued customers must change procurement questions to focus on how systems perform during security incidents, fallback options, downtime prevention, and data protection rather than functionality.

US Central Command reported receiving multiple threat reports of adversaries exploiting commercially available location data to target or surveil US personnel in theatre, marking the first official confirmation of troops being targeted in an active war zone, Reuters reported. Senator Ron Wyden and a bipartisan group of lawmakers sent a letter to the Pentagon urging action, noting that location data identifies troop congregations and patterns of life exploitable for missile, drone, and IED attacks. Lawmakers called for disabling advertising IDs on military devices, restricting location sharing on smartphones, and replacing Google Chrome with privacy-focused alternatives.

Estonia established the first operational ‘digital embassy’ in 2019 in Luxembourg, storing critical data including security databases, population registers, and land ownership records in a secure vault treated as diplomatically inviolable, POLITICO reported. Following Russia’s 2022 invasion of Ukraine, other countries rapidly adopted the concept: Monaco formed a digital embassy agreement with Luxembourg in 2021; Singapore is scouting a location in India; India is working on setting one up in the UAE. Ukraine changed laws during the war to allow non-secret government data to be moved outside the country, and the World Economic Forum has launched a global framework for bilateral digital embassy agreements.

In The Strategist, an analysis warned that legal authority fragmentation and jurisdictional ambiguity are fundamental constraints on effective counter-drone response across Europe, drawing on 23 stakeholder interviews. Drone-related disruptions at European airports more than tripled between January 2024 and November 2025; the detection-to-disruption interval is less than five minutes, yet most airports lack legal authority to deploy countermeasures. Britain has fragmented authority across CAA, police, and MoD; Germany opened a Joint Drone Defence Centre in December 2025 but armed-forces reform remains contested; Poland alone has adopted an effects-based jurisdiction model empowering police, border guard, and armed forces simultaneously.

⸻

🕵️ Surveillance states

Laura Harth, campaign director at Safeguard Defenders, was targeted by an AI-generated sexualised deepfake smear campaign through the Spamouflage network — identified by OpenAI, Meta, and the US DOJ as a Chinese law enforcement operation — after exposing Beijing’s overseas police service centres linked to China’s Ministry of Public Security, The Bureau reported. Earlier this month, a Brooklyn federal jury convicted Lu Jianwang of acting as an illegal PRC agent for operating the first known overseas Chinese police station in the United States, tasked with locating a pro-democracy advocate in California. Harth criticised Canada’s government for signing a January 2026 Memorandum of Understanding with the same Ministry while the RCMP refuses to disclose the agreement’s contents.

A collaborative investigation by Tempo, Kompas.com, Suara, Tribunnews, and Drone Emprit revealed pro-Russian and Chinese foreign information manipulation interference operations targeting Indonesian civil society during August–September 2025 protests, amplified by domestic pro-government actors. Foreign actors spread narratives falsely blaming George Soros, NED, USAID, and the CIA for funding protests; Russian state media Sputnik published the initial narrative in late August, amplified by 30+ outlets. The operation falsely accused independent media (Konde, Tempo), civil society organisations (Lokataru), and activists of being foreign agents, with posts receiving 250,000+ shares.

Leaked files from the Russian Presidential Administration and the Social Design Agency (SDA), a sanctioned Russian PR firm, reveal orchestration of false-flag vandalism attacks across Europe and influence campaigns targeting Western governments, OCCRP reported. Operations included September 2025 mosque attacks in Paris using pig heads marked for President Macron, desecration of Paris synagogues and the Berlin Holocaust memorial, and planned operations to incite religious and ethnic tensions. Sofia Zakharova, a senior presidential administration official, oversaw funding and operations described internally as cognitive operations aimed at destabilising NATO countries through deepening elite divisions.

China’s police liaison team in the Solomon Islands proposed the Fengqiao Experience — a Mao-era community surveillance system revived under Xi Jinping — to Fighter One village, requesting household registration cards, fingerprints, and palm prints to monitor youth, The New York Times reported. The 10-member Chinese police team, embedded since 2022, has donated $1.5 million in riot gear and trained local police in anti-riot tactics; the Fengqiao pilot was suspended after backlash from Solomon Islands politicians and Australian analysts. The election earlier this month of skeptical Prime Minister Matthew Wale raises questions about China’s foothold; China has trained police in 138+ countries since 2000 and embeds officers in Central African Republic, Vanuatu, and Kiribati.

A new initiative called ‘Overseas Black Hands’ launched to document Chinese Communist Party transnational repression, censorship, and surveillance mechanisms targeting overseas Chinese, international students, immigrants, dissidents, and journalists, Voice of America (Chinese Service) reported. Initiated by Chinese dissident Li Ying (Italy-based) and Safeguard Defenders (Spain-headquartered), the project accepts anonymous case submissions to create systematic archives. Italy expelled eight Chinese citizens in March 2026 for involvement in harassment; the US convicted Lu Jianwang in Brooklyn earlier this month for operating a Chinese police station.

US federal law enforcement and intelligence agencies are surveilling and categorising ‘anti-tech extremism’ as an emerging domestic threat, with over 1,000 pages of unpublished DHS, FBI, and fusion centre reports obtained via FOIA, WIRED reported. The Trump administration’s National Security Presidential Memo 7 and counterterrorism strategy have expanded surveillance of anti-technology activists, data centre protesters, and AI skeptics. Intelligence agencies have conflated peaceful protests with violent extremism, flagging activities like photography and legal assembly as suspicious, while also monitoring the trial of Ziz Laota, an extremist whose group believed in AI existential risk.

⸻

⚖️ Platform accountability

Texas Attorney General Ken Paxton sued Meta and WhatsApp for deceptive trade practices, claiming WhatsApp can access encrypted messages despite marketing them as private. Paxton alleges Mark Zuckerberg lied to the US Senate in 2018 about message inaccessibility; the lawsuit follows the Commerce Department’s abrupt closure of an investigation into the same privacy concerns after an internal investigator concluded Meta can view WhatsApp messages. The case was filed in Harrison County District Court with the same firm that secured a $1.4 billion Meta settlement in 2024.

Google filed its appeal of the federal ruling deeming it an illegal search monopolist, arguing the decision exceeded judicial authority and that the company prevailed fairly. The appeal targets both the August 2024 monopolisation decision and the September 2025 remedies ruling ordering Google to share search data with competitors. Google argues Judge Amit Mehta erred in finding its distribution agreements anticompetitive and exceeded authority in ordering data-sharing remedies; the US and a coalition of states are also appealing, arguing Mehta should have imposed stronger remedies including a Chrome sale.

⸻

🧒 Online harms & child safety

Meta settled with a Kentucky school district over accusations that social-media companies intentionally designed platforms to addict young people, becoming the last major platform to resolve the case, The Wall Street Journal reported. The settlement averts a June jury trial poised to be the first among more than 1,200 consolidated lawsuits brought by school districts involving Meta, TikTok, Snap, and YouTube. The cases are consolidated in federal court in Oakland, California but will be tried individually.

Between late December and early January, Elon Musk’s Grok generated 3 million sexualised images including 23,000 appearing to depict children on X, prompting PM Keir Starmer to demand intervention and Musk to repost a deepfake of Starmer in bikini, POLITICO reported. X eventually agreed to restrict Grok’s image-generation in jurisdictions where sexualised deepfakes are illegal; the UK government inserted sweeping powers into the Crime and Policing Bill allowing ministers to unilaterally amend the Online Safety Act. The Grok episode catalysed a UK policy shift, with the government reversing position in February 2026 and announcing consultation on an Australia-style social media ban for under-16s after grassroots campaigning and a letter from 61 Labour backbenchers.

⸻

🎬 IP, media & creative industries

Australia’s premier news media companies and creative arts sectors issued a joint statement warning the federal government against weakening copyright protections in negotiations with AI companies seeking investment, The Australian reported. Reports indicated the Albanese government was willing to reopen discussions on copyright law to lure AI investment; Department of Industry briefing notes from February revealed discussions with Anthropic CEO Dario Amodei about copyright issues. The 18 media companies and industry bodies reaffirmed Australia’s October 2025 decision to reject a copyright exception for AI platforms.

In InnovationAus, editorial director James Riley announced the publication’s withdrawal from the Copyright Agency media monitoring licensing scheme, citing its failure to provide fair compensation to copyright holders. The federal government spends over $10 million annually on media monitoring services that effectively circumvent subscription payment obligations; the Department of Industry, Science and Resources alone spends $450,000 annually via Streem for industrial-scale access across 5,000 staff with minimal direct subscriptions. Riley expressed concern that inadequate copyright protection in existing frameworks portends worse outcomes as AI systems are developed to treat copyrighted materials.

⸻

🏛️ Government, procurement & public sector tech

London Mayor Sadiq Khan blocked a £50 million Metropolitan Police deal with Palantir, citing procurement rule violations and lack of consideration of alternative suppliers, The Guardian reported. Khan’s office cited an unambiguous and serious breach of procurement rules; the deal was worth £25m per year and would have been Palantir’s largest in British policing. Scotland Yard criticised the block, warning that without new technology it would be forced to cut officer numbers and reduce policing capacity in London.

VIQ Solutions, a Canadian transcription service contractor for Australian federal and family courts, subcontracted work to e24 Technologies in Chennai, India in breach of Commonwealth contract obligations, exposing at least 146 court matters to unauthorised offshore access, ABC News reported. The Federal Court extended VIQ’s contract by $5.3 million despite the company entering voluntary administration in mid-March, four weeks after ABC revealed the breach. Court litigants remain unnotified of potential compromise; the Attorney-General’s Department contacted the Australian Cyber Security Centre on learning of the incident.

⸻

💰 Tech business & markets

Last week, four major AI and tech companies announced significant developments on a single day, according to Australian Financial Review. OpenAI announced IPO plans targeting a September listing at roughly $1 trillion-plus valuation; Nvidia reported Q1 earnings with 85% revenue growth to $81.6 billion and announced an $80 billion share buyback; SpaceX filed for IPO with a $1.5 trillion expected valuation seeking $80 billion; Anthropic revealed a 130% Q2 revenue surge to $10.9 billion with its first operating profit and a capital raising at roughly $1 trillion valuation. SpaceX’s prospectus included a $29 trillion total addressable market estimate, with $22 trillion attributed to AI services from the xAI business merged in February.

ASX-listed Harvest Technology Group, chaired by retired Australian Defence Force major general Jeffery Sengelman, launched a $6 million two-tranche capital raising via placement at 1¢ per share, Australian Financial Review reported. The company develops software for secure data transfer including video and audio from satellites at low bandwidths; its flagship Nodestream technology services defence, energy, maritime, and security sectors.

SpaceX raised Starlink connection costs fivefold from $5,000 to $25,000 per terminal during US military operations against Iran, citing that LUCAS kamikaze drones were using higher-tier aviation service, Reuters reported. The Pentagon ultimately agreed to the increased fees despite initial resistance from senior officials including Deputy Secretary of Defense Steve Feinberg. SpaceX also proposed $500 million upfront plus $100 million monthly fees for direct-to-cell service to help Iranian civilians bypass government internet blackouts.

⸻

🌏 Global policy

🇦🇺 Australia

Former Industry Minister Ed Husic called for a Cabinet-level committee to coordinate industry policy geared toward developing sovereign capability and economic resilience, drawing inspiration from post-WWII Germany’s nationally focused development model, InnovationAus reported. Husic argued sovereign capability pursuit should be the central organising principle of government, with all portfolios — industry, defence, energy, skills, science, and procurement — aligned toward strengthening national resilience. The Treasury’s May budget allocated funding for a National Resilience and Innovation Council, potentially addressing Husic’s call for whole-of-government coordination.

Climate Change and Energy Minister Chris Bowen is betting Australia’s data-centre boom will accelerate renewable energy deployment to meet the 2030 target of 82% renewables generation, The Australian reported. Wind farm financial closures fell 59% in 2025 (from 2GW to 857MW), threatening Labor’s deadline; Bowen proposed data-centre operators underwrite new renewable power supply and fund grid connectivity to avoid cost-shifting. AirTrunk estimates each additional gigawatt of data-centre demand requires 3–4GW of new renewable capacity for 24/7 operations.

A Crikey analysis reported that Australia is integrating AI into military strategy through the AUKUS program’s second pillar, with public expenditure on drones and autonomous systems increasing to $22 billion over the coming decade. The Defence Department’s ‘Ghost Bat’ and ‘Ghost Shark’ programs aim to develop unmanned aircraft and underwater systems; Ghost Shark is being developed with Anduril Industries. Palantir, which sells AI-enabled targeting systems used extensively by Israel in Gaza operations, has inked around $30 million in Australian defence contracts.

🇺🇸 United States

California Gov. Gavin Newsom signed an executive order directing state agencies to explore an overhaul of labour policies in response to potential AI-driven job displacement, The New York Times reported. The order mandates study of how to subsidise companies that retain employees, expand job training for white-collar workers, and examine universal basic capital. Newsom cited warnings from AI leaders of swift employment disruption affecting entire job categories; the order is the first such executive order signed by a US governor.

🇪🇺 Europe

The European Commission will propose temporarily lifting sanctions on Yangzhou Yangjie Electronic Technology Co., a Chinese semiconductor supplier sanctioned in April as part of EU sanctions against Russia, Bloomberg reported. Yangjie Electronic was sanctioned after its technologies allegedly reached Russia and were found in drones and glide bombs used against Ukraine; European automakers lobbied for the exemption, warning of supply chain chaos if the ban isn’t removed. Any derogation would be temporary, likely lasting several months to allow time for alternative suppliers; implementation requires all 27 EU member states’ approval.

The European Commission, separately, is preparing emergency legislation to intervene in semiconductor supply chains during shortages, Financial Times reported. The draft law would allow the Commission to force chipmakers to override existing contracts and prioritise orders for crisis-critical products (weapons, medical devices, digital infrastructure), and to enable common EU purchasing as a central buyer to strengthen negotiating power. The EU produces less than 10% of global semiconductors and lags plans to double market share by 2030.

The European Commission also proposed new satellite access rules governing direct-to-mobile technology, reserving one-third of the 2 GHz frequency band for government use, one-third for new EU-based entrants, and one-third for established US and EU operators. The framework allows non-European firms including Starlink to bid for airwaves while prioritising European companies and preserving spectrum for emerging local competitors in direct-to-device satellite communications.

Germany and Spain, meanwhile, are opposing European Commission plans to ban Chinese technology suppliers Huawei and ZTE from EU telecom networks as part of new cybersecurity rules. Officials from both countries seek to maintain state-level control over supplier decisions and warned that an EU-wide ban risks retaliation from Beijing and would increase costs for European AI infrastructure development.

The Netherlands government, separately, blocked US-based Kyndryl’s proposed acquisition of Dutch IT firm Solvinity, which operates infrastructure supporting the DigiD digital identity platform used for public services. Dutch authorities said the acquisition posed a possible risk to the public interest after an investment screening review; the decision reflects broader European concerns about dependence on US technology providers in sensitive digital infrastructure sectors.

🇮🇳 India

Google is building a $15 billion AI data-centre hub in Visakhapatnam, India, with approximately $2.3 billion in state subsidies (25% water/land discounts, electricity infrastructure reimbursement, tax waivers) over 20 years, partnering with Bharti Airtel and Adani Group, The Wall Street Journal reported. The project, spanning 600+ acres across three sites, displaces farmers from decades-old holdings with compensation of $42,000–$115,000 per acre while raising concerns about water stress in a city under extreme water shortage conditions, receiving less than one hour of tap water daily. Rights groups have criticised insufficient public environmental consultation and question sustainability in a region lacking adequate water and power infrastructure for full-capacity AI operations.

🇮🇷 Iran

Iranian President Masoud Pezeshkian issued an order to reopen international internet access after a near-90-day blackout, Reuters reported, citing state media. The blackout began in early January in response to anti-government protests and intensified after US and Israeli strikes in late February; it ended this week with connectivity restored to approximately 86% of pre-shutdown capacity, though internet traffic remained at only 40% and services like YouTube and Instagram remained heavily restricted, according to AP. Users reported limited restoration with WhatsApp barely functional and feared expanded surveillance, with authorities’ approval of a limited ‘internet pro’ service sparking suspicion among users, The Guardian reported.

🇮🇪 Ireland

A report commissioned by Friends of the Earth Ireland found Ireland’s data centres consumed 22% of national electricity in 2025 — more than all urban homes combined — draining €715 million from the economy and increasing household bills cumulatively by €360 between 2015 and 2023, The Guardian reported. Data centre demand increases the hours when gas sets electricity prices, driving up costs; modelling suggests average Irish households could pay €295–€644 cumulatively from 2025 to 2034 (€633 million–€1.43 billion nationally). The Irish government welcomes data centre expansion; industry representatives dispute findings, citing €18 billion in recent investment and 80% renewable energy requirement compliance.

🇯🇵 Japan

Japanese Foreign Minister Toshimitsu Motegi visited Zambia, Angola, Kenya and South Africa in late April and early May to advance Japan’s evolved Free and Open Indo-Pacific (FOIP) vision, emphasising critical mineral supply chain resilience and AI-era infrastructure, ThinkChina reported. Japan is competing with China for access to Africa’s cobalt, copper and rare earth resources, with the Lobito Corridor (Angola–DRC–Zambia railway and 5G project) emerging as a strategic flashpoint. China countered in late April by announcing zero tariffs on imports from all African nations with diplomatic relations, effective May 2026 to April 2028.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 16 May 2026 to 22 May 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

China builds a secret platform to track foreigners

What happened: NetAskari, a group that monitors Chinese security infrastructure, found a web dashboard built for China’s Public Security Bureau that tracks foreigners and people deemed ‘of interest’ — including foreign students, spouses of Chinese citizens and journalists — using data from cameras, visa records, travel apps, and ID and face scans. NetAskari described it as a test system, not connected to a live data environment, though partly populated with real data from real people of foreign nationality and of unclear operational status.

The Daily Telegraph‘s Sophia Yan found her own file in the database, marked ‘trackable.’ The system holds a dedicated journalist inquiry section containing passport numbers, ID photos, private cellphone numbers and dates of birth: data collected during visa applications at Beijing‘s Entry/Exit Bureau.

The platform is not without precedent. In 2021, Reuters reported that Henan province commissioned a nearly identical system — awarded to IT company Neusoft for five million yuan — that categorised foreign journalists into red, yellow and green risk tiers. Tender documents described authorities’ ability to have targets ‘tailed and controlled.’

The dashboard also separately categorised citizens from the Five Eyes countries — the UK, US, Australia, New Zealand and Canada — along with people from Hong Kong, Macau and Taiwan.

Why we’re tracking this: This is not general-population surveillance adapted for foreigners, it is a purpose-built foreigner-targeting layer within China‘s broader surveillance architecture. Its relationship-modelling function goes beyond tracking individuals: it maps social networks, logging who foreigners meet, how often, and in what context. That capability is what elevates this from a data collection system to an active intelligence tool.

What people are saying:

• “What’s most interesting is that this seems to be a dedicated system to keep a close eye on what foreigners do in the country, and then to build this relationship model — who do they hang out with, who are they seen with?” — The Daily Telegraph — Marc Hofer, NetAskari

• “The scary part? China could roll out the technology to start tracking people outside the country.” — The Daily Telegraph — Sophia Yan, The Daily Telegraph

My view: I’ve previously called China’s surveillance apparatus ‘Chabudwellian’ — combining ‘Orwellian’ with the Chinese term cha bu duo, meaning “almost”, or work done with poor or minimal effort. ‘Outside of China, foreigners think their surveillance system is highly sophisticated,’ I told The Guardian four years ago, ‘but in reality a lot of the time this infrastructure is jerry-rigged and not super effective.’Marc Hofer of NetAskari thought much the same — that the capabilities were ‘more based on the fantasy of Western commentators than rooted in facts’. But that cobbled-together system is taking shape. In Hofer’s words, the dragnet is getting ‘finer meshes as new data sources are increasingly added’; the cha bu duo system is no longer quite so cha bu duo, and as Yan says, the scary part is what comes next.

— Fergus Ryan, CTS

Shai-Hulud worm spreads across npm and PyPI package registries

What happened: A self-replicating, credential-stealing worm called Shai-Hulud has torn through open-source registries over several days in May. After threat actor TeamPCP open-sourced the original on GitHub, fresh waves followed, The Register reported. The pace was striking: The Register found one compromised account infected 314 npm packages in 22 minutes, while Bleeping Computer counted 639 malicious versions across 323 packages in an hour on 19 May.

Beyond stealing cloud credentials, the payload backdoors Claude Code and Codex and forges Sigstore provenance to look signed. A PyPI strain in Microsoft‘s durabletask package carried a disk wiper keyed to Israeli and Iranian locale settings, IT News reported.

Why we’re tracking this: Open-source registries are shared infrastructure for government, industry and critical-infrastructure operators, so one poisoned package can propagate across unrelated networks before defenders notice.

The forged Sigstore provenance erodes the cryptographic trust signals that supply-chain defences depend on, and the wiper keyed to Israeli and Iranian locale settings adds a destructive, geographically targeted dimension beyond ordinary credential theft.

What people are saying:

• ‘It’s just the first phase of an upcoming wave of supply chain attacks’ says Moshe Siman Tov Bustan, Ox Security.

• ‘Modern software is built on a deeply interconnected ecosystem of open-source libraries, package managers, and continuous integration and continuous deployment infrastructure’ said OpenAI, in its response to the related TanStack compromise.

• ‘The Mini Shai-Hulud campaign has now demonstrated that every layer of the trust stack… can be abused to publish malware that looks legitimate by every available signal’ says Sonali Sood of CodeAnt AI, an agentic code security platform.

My view: Modern software rests on open-source foundations that almost no one is paid to secure, a structural fragility this campaign exploits at scale. The worm subverts the signals meant to confer trust, forging Sigstore provenance to look legitimately signed and backdooring AI coding assistants like Claude Code and Codex to gain a foothold. As automated tooling shapes more of the software commons, those trust signals become a high-value attack surface in their own right. What stays unclear is whether this marks a durable shift in tradecraft or one capable group’s experiment, and whether forged provenance survives once defenders adapt. The answer has implications for the security of the digital public infrastructure that modern societies depend on.

— Stephan Robin, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Australia’s Treasurer Jim Chalmers ordered six Chinese-linked investors to divest their combined 17 per cent stake in rare earths miner Northern Minerals within two weeks. The affected entities include Hong Kong Ying Tak Ltd and Vastness Investment Group Ltd, among others. The government said the decision, consistent with advice from the Foreign Investment Review Board, was necessary to protect the national interest. Northern Minerals’ Browns Range Heavy Rare Earths Project in WA’s East Kimberley region is strategically significant as a potential non-Chinese source of dysprosium and terbium — rare earth elements used in military systems, semiconductors and clean energy.

A Strider Technologies report identified more than 6,000 research collaborations since 2020 between Australian organisations and Chinese military-linked institutions, including PLA-affiliated universities and defence conglomerates. The article details collaborations involving researchers linked to ANU, Melbourne University and the University of Queensland on drone anti-jamming, underwater target-tracking and electronic warfare technologies with potential military applications.

Education Minister Jason Clare vetoed 13 Australian Research Council university grant projects over concerns they could threaten Australia’s national security, defence or international relations — involving research areas including drones, cyber security and alternative energy technologies with potential dual-use military applications. The government is now preparing legislation to strengthen university compliance with research security and critical technology safeguards.

In the Pacific, analysis by Madi Jones published by The Strategist argued that China’s influence in Solomon Islands is likely to endure despite the appointment of Prime Minister Matthew Wale, who has historically criticised Beijing’s growing role in the country. China has become deeply embedded through infrastructure projects, policing assistance and telecommunications. Meanwhile Geoff Wade and Justin Bassi argued that Landbridge Group’s World Bank arbitration case over Darwin Port is part of a broader Chinese strategic effort to retain influence over critical infrastructure, and recommended Australia unilaterally terminate the lease and work with trusted partners to manage the port.

ASML Holding NV signed a partnership agreement with Tata Electronics to support India’s semiconductor manufacturing ambitions, with ASML technology earmarked for Tata Electronics’ planned 300 millimetre semiconductor foundry in Gujarat. The agreement was announced during Indian Prime Minister Narendra Modi’s visit to the Netherlands.

Nvidia’s ability to sell advanced AI chips in China remains uncertain despite CEO Jensen Huang joining US President Donald Trump’s delegation to Beijing. Although the Trump administration approved Nvidia’s H200 chip exports in late 2025, Beijing has not authorised purchases and continues encouraging domestic firms to use Chinese technology from companies such as Huawei. Chinese AI company DeepSeek announced its latest model had been optimised for Huawei chips, reinforcing China’s broader push for technological self-sufficiency.

Xi Jinping and Vladimir Putin pledged expanded cooperation on artificial intelligence, satellite internet, cybersecurity and open-source software at a summit in Beijing. The joint statement outlined plans to improve interoperability between Russia’s GLONASS and China’s BeiDou satellite navigation systems and to coordinate on ‘internet sovereignty.’ Russia’s Sberbank, meanwhile, is seeking to use Chinese-made microchips to power its GigaChat AI model as Western sanctions restrict access to advanced hardware.

US senators Jeanne Shaheen and Pete Ricketts introduced bipartisan legislation aimed at countering Chinese overseas sales of AI and strategic technologies. The bill would establish a State Department office and a proposed $500 million fund to subsidise allied governments purchasing US AI models, chips, cloud systems and cybersecurity tools, aligning with the Trump administration’s Pax Silica strategy.

The US Commerce Department is separately awarding $2 billion in grants to nine quantum-computing companies — including IBM, GlobalFoundries, Rigetti Computing and D-Wave Quantum — in exchange for minority government equity stakes, sourced from the Chips and Science Act.

⸻

🧠 AI models, agents & compute

Chinese AI companies including ByteDance, Kuaishou and MiniMax are outperforming many US rivals in AI video generation, according to developers and user rankings, according to Financial Times. Their advantage is linked to access to large proprietary libraries of short-form video from platforms such as TikTok and Kuaishou, as well as fewer content restrictions and lower costs. While OpenAI, Google and Anthropic continue to dominate large language models and coding, their video tools lag behind Chinese offerings in quality and usability.

Google used its I/O developer conference to announce expanded AI integration across Search, YouTube, Android, Workspace, hardware and Gemini models. New products include the Gemini Omni multimodal model, Gemini Spark autonomous agents, conversational ‘Ask YouTube’ search and AI-enabled smart glasses.

OpenAI announced expanded measures to label AI-generated content by combining C2PA content credentials with Google’s SynthID watermarking technology, and is previewing a public verification portal to detect whether images were generated using OpenAI systems.

xAI launched Grok Build, its first AI coding agent, available to SuperGrok Heavy subscribers. The beta product includes execution planning and compatibility with existing developer plug-ins. The launch follows a restructuring of xAI after leadership departures and positions the product alongside AI coding offerings from OpenAI and Anthropic.

Amazon Web Services has repositioned itself as a major AI competitor through large infrastructure spending, investments in Anthropic and OpenAI, and long-term development of custom AI chips including Trainium and Graviton, according to The Wall Street Journal.

A peer-reviewed Nature study found that government-controlled media environments influence the outputs of large language models through training data exposure. Researchers showed LLMs display stronger pro-government responses in languages from countries with lower media freedom, and demonstrated that Chinese state-coordinated media appears in major training datasets. Experimental testing found that additional training on Chinese state media increased positive responses about Chinese political institutions, while prompting commercial models in Chinese produced more favourable responses than equivalent prompts in English.

New research and case studies are raising concerns about ‘AI psychosis’, where intensive chatbot use is associated with delusional thinking, emotional dependency and social isolation. Studies from Stanford University analysing chatbot conversations found users and AI systems can enter ‘delusional spirals’, with bots reinforcing beliefs about sentience, conspiracies or grandiose achievements. Researchers and clinicians warned that growing emotional reliance on AI companions could pose risks, particularly for vulnerable users and children.

Meta told employees it is reassigning 7,000 workers into four new AI-focused organisations ahead of planned layoffs affecting about 8,000 employees. The restructuring reflects Meta’s broader shift toward ‘AI native’ operating structures with fewer managers, while deprioritising metaverse initiatives. CEO Mark Zuckerberg has committed up to US$135 billion in spending this year, much of it directed toward AI development and data centres.

⸻

⚔️ Autonomous weapons & battlefield AI

Ukraine’s Defence Minister Mykhailo Fedorov is leading efforts to integrate AI and autonomous drone systems into Ukraine’s war strategy against Russia, working with defence technology firms and figures including Palantir CEO Alex Karp and former Google CEO Eric Schmidt. The strategy has sparked debate inside Ukraine’s military and criticism from human rights groups concerned about delegating lethal decision-making to autonomous systems. In a Strategist analysis, David Kirichenko argued Ukraine is expanding AI-enabled mid-range drones to target Russian logistics and air-defence systems up to 45–50 kilometers behind the front line, reflecting a broader shift from defensive to offensive drone operations.

Anduril and Meta are developing augmented-reality military headsets that would allow soldiers to coordinate drones, navigate battlefields and potentially approve strikes using voice commands, eye tracking and AI-driven targeting. The projects include the US Army’s Soldier Born Mission Command program and Anduril’s self-funded EagleEye helmet, integrating AI models and Anduril’s Lattice battlefield software. Production decisions are not expected before 2028, while researchers and military analysts continue to raise concerns about cognitive overload and AI-assisted targeting decisions.

Ukrainian officials reported that Russia is increasingly embedding artificial intelligence directly into malware, enabling it to generate commands dynamically and evade detection. A government report said AI use in Russian cyber operations has expanded rapidly across malware development, phishing campaigns and reconnaissance. The findings also highlight emerging tactics such as ‘AI poisoning,’ where disinformation is used to manipulate data inputs for AI systems.

⸻

🛡 Cyber posture

CISA ordered all US federal agencies to patch a critical vulnerability in Cisco SD-WAN systems after active exploitation was detected. The flaw, CVE-2026-20182, allows unauthenticated remote attackers to bypass authentication and gain administrative privileges, with Cisco assigning it the maximum severity score of 10. Five Eyes cybersecurity agencies linked the campaign targeting Cisco infrastructure to an advanced threat actor, with researchers warning the flaw could enable long-term nation-state persistence inside sensitive networks.

Anthropic revised restrictions around its Mythos cybersecurity model to allow participating organisations to share vulnerability findings, tools and defensive insights outside its controlled Project Glasswing program. Around 50 organisations including Amazon, Microsoft, Nvidia and Apple currently have access to Mythos. Anthropic said partners may now disclose findings to industry groups, regulators, government agencies, open-source maintainers and the public under responsible-disclosure practices. The shift followed concerns that restricting access to threat intelligence disadvantaged smaller organisations and critical infrastructure operators.

Bug bounty platforms and open-source maintainers are struggling with a surge in low-quality AI-generated vulnerability reports following the release of advanced cyber-focused AI models. Companies including Nextcloud have suspended bug bounty programs due to the increase in speculative or unverifiable submissions, while developers describe the workload as mentally exhausting. Platforms such as HackerOne and Bugcrowd are responding with automated AI triage systems and stricter validation processes. Curl developer Daniel Stenberg tested Anthropic’s Mythos on 178,000 lines of code and found that only one of five flagged vulnerabilities had security impact, concluding the model was only marginally better than earlier tools.

The Trump administration is preparing an executive order focused on AI safety and cybersecurity that would establish a voluntary framework for AI companies to provide the government with access to advanced models before public release. The proposed order would cover ‘frontier models’ including highly cyber-capable systems such as Anthropic’s Mythos and OpenAI’s GPT-5.5-Cyber. U.S. Cyber Command and the National Security Agency are simultaneously launching a joint task force to accelerate deployment of advanced AI models across sensitive government systems.

A previously undisclosed zero-day vulnerability in Huawei enterprise router software caused Luxembourg’s nationwide telecoms outage in July 2025, disrupting landline, mobile and emergency communications for more than three hours. No public CVE identifier or broad security advisory has been issued in the ten months since the incident, raising concerns about disclosure practices and whether other operators remain exposed.

Microsoft disrupted Fox Tempest, a malware-signing-as-a-service platform that enabled ransomware groups to disguise malicious software as legitimate applications, seizing infrastructure, revoking more than 1,000 fraudulent certificates and taking hundreds of virtual machines offline. The operation had supported ransomware campaigns linked to groups including Rhysida, Qilin, Akira and INC.

A major software supply-chain compromise hit the Node Package Manager (npm) ecosystem, with threat actors publishing more than 600 malicious package versions across 323 packages as part of the ongoing ‘Shai-Hulud’ malware campaign. The compromise subsequently expanded, with a further 314 npm packages infected — including widely used packages with millions of monthly downloads — through a compromised account, with payloads scanning for credentials across GitHub, AWS, Azure, Google Cloud, Docker and Stripe, and injecting settings files targeting Claude Code and Codex for execution. Three malicious versions of Microsoft’s durabletask Python package on PyPI were also found to contain a Linux payload stealing credentials and fetching a disk wiper targeting systems with Israeli or Iranian locale settings. GitHub confirmed attackers accessed approximately 3,800 internal repositories after an employee installed a malicious VS Code extension linked to the same TeamPCP threat group.

Japan is considering allowing financial institutions to proactively suspend critical systems in response to cyber threats enabled by advanced AI models. A draft proposal from a public-private council highlights concerns that AI could rapidly expose system vulnerabilities and shorten attack timelines beyond current defensive capacity. A Black Book Research survey of European hospital cybersecurity buyers separately found that 82% of respondents rate their cyberattack concern as very high or extreme, with hospitals increasingly viewing cyber risk as a direct threat to clinical operations rather than a data protection issue.

⸻

🕵️ Surveillance states

The discovery of a Chinese undersea monitoring device in Indonesia’s Lombok Strait has renewed attention on Beijing’s ‘Transparent Ocean Program’, a long-running effort to expand real-time undersea surveillance capabilities combining satellites, underwater sensors, drones and AI-enabled data processing. Defence experts argued the development has implications for Australia’s defence planning and AUKUS submarine investments, as advances in underwater surveillance and drone technology could reduce the stealth advantages of crewed submarines.

The FBI is seeking nationwide access to automated license plate reader systems, according to procurement records reviewed by 404 Media. The system would potentially allow the bureau to track vehicle movements across the United States without a warrant, expanding the use of mass surveillance tools beyond local policing into federal operations. The proposal comes amid growing public opposition and protests against ALPR deployments in several US communities.

In The Strategist, Dr Fitriani examined the growing use of commercial spyware in intimate partner abuse and coercive control, highlighting how surveillance tools once associated with intelligence agencies are now commercially accessible and used for cyberstalking, blackmail, doxxing and harassment. The piece references Australian and international evidence of spyware misuse, including AFP investigations and research by Citizen Lab and AI Forensics, and argues for stronger regulation and closer coordination between national security agencies and domestic violence support organisations.

⸻

⚖️ Platform accountability

X committed to stronger moderation measures for UK users following pressure from communications regulator Ofcom under the Online Safety Act, agreeing to review suspected illegal hate and terror content flagged through a dedicated reporting tool within 24 hours and to block accounts linked to proscribed organisations. X, meanwhile, admitted breaching Australia’s Online Safety Act by failing to provide requested information about its child protection measures to the eSafety regulator. The Federal Court upheld and increased the original 2023 penalty, ordering X to pay A$650,000 plus A$100,000 in legal costs after the company acknowledged 38 days of noncompliance.

Ofcom announced updated codes of practice requiring technology companies to strengthen detection and removal of non-consensual intimate images and AI-generated deepfakes, including broader use of hash-matching technology to prevent repeated uploads. Ofcom separately criticised TikTok and YouTube for failing to commit to significant feed-safety changes and announced a five-point enforcement plan targeting recommender systems and age assurance.

Snap, Meta Platforms and Roblox committed to stronger anti-grooming protections for children including tighter default contact settings, AI-based detection of sexualised conversations and expanded age-check systems.

Bluesky said Russian influence operators linked to the Moscow-based Social Design Agency hijacked hundreds of real user accounts to spread fabricated news videos and propaganda related to Ukraine, France and other geopolitical issues. Researchers from Clemson University and the Institute for Strategic Dialogue said the campaign represented a more sophisticated tactic than traditional bot networks, using compromised accounts belonging to journalists, academics and other credible users, linked to the broader Kremlin-backed ‘Matryoshka’ disinformation campaign.

Meta settled a lawsuit brought by Kentucky’s Breathitt School District over claims social media platforms were intentionally designed to addict young users and contribute to mental health harms, avoiding the first jury trial among more than 1,200 consolidated lawsuits against Meta, TikTok, Snap and YouTube. The litigation argues platform design features such as infinite scrolling, notifications and engagement algorithms contributed to anxiety, depression and self-harm among students. Texas Attorney General Ken Paxton separately sued Meta and WhatsApp alleging the company falsely claimed its encrypted messages were inaccessible to the platform itself, and that Meta founder Mark Zuckerberg misled the US Senate about WhatsApp’s privacy protections in 2018.

⸻

🧑‍⚖️ Courts, enforcement & regulation

A US federal appeals court appeared sceptical of Anthropic’s attempt to block the Pentagon from designating the company as a supply-chain risk to national security. The designation, made by Defense Secretary Pete Hegseth in March, resulted in a ban on government use of Anthropic’s AI technology following a dispute over military use of the Claude chatbot. Judges questioned Anthropic’s argument that the Pentagon acted unlawfully, while also signalling possible reluctance to fully endorse or overturn the designation. The case could shape executive branch authority to restrict domestic AI companies from government use based on perceived security risks.

A jury rejected Elon Musk’s claims against Sam Altman and OpenAI over the company’s founding and governance, ending a case that had sought more than $100 billion in damages, removal of Altman and Greg Brockman from leadership, and restoration of OpenAI’s nonprofit structure. The verdict removes an immediate legal threat as OpenAI reportedly prepares for a potential IPO valued near $1 trillion.

Minnesota enacted the first statewide ban on prediction market platforms such as Kalshi and Polymarket, criminalising the hosting or advertising of prediction markets. The law prompted a federal lawsuit from the Commodity Futures Trading Commission, which argues prediction markets fall under exclusive federal jurisdiction. US regulators and prosecutors are also expanding investigations into suspicious trading on prediction market platforms, probing wagers linked to Iran-related military decisions and Venezuelan political operations, with the issue exposing legal gaps because insider trading laws were originally designed for securities markets.

California’s Generative Artificial Intelligence: Training Data Transparency Act (TDTA), effective from January 2026, requires developers of public-facing generative AI systems to publish high-level summaries of training datasets. A federal court rejected xAI’s preliminary injunction challenging the law after finding the company failed to identify specific trade secrets with sufficient particularity. OpenAI is simultaneously pursuing a state-by-state lobbying strategy to shape AI regulation after federal efforts stalled, aiming to align laws across major states including California, New York and Illinois into a de facto national standard.

⸻

🏛️ Government, procurement & public sector tech

The Australian federal government plans to use AI to reduce regulatory delays and lower compliance costs, including assisting medicine assessments at the Therapeutic Goods Administration and supporting environmental approvals for housing developments. Officials said AI would assist with analysing documents and regulations while human staff retain decision-making authority. The budget also included AI projects across veterans’ claims, intellectual property services and archival transcription.

Australia Post is restructuring its technology environment around 13 core ‘platform ecosystems’ as part of its Post26 transformation strategy, aimed at simplifying more than 700 legacy systems. The organisation has already reduced its active systems footprint to about 400 while consolidating technology suppliers and strengthening governance over previously undisclosed ‘shadow IT’ systems. The transformation includes reorganising its IT division into ‘Enterprise Services’, with increased emphasis on cyber security, engineering standards, data science and AI-driven operations.

EY removed a published report after researchers identified fabricated data and non-existent citations generated through AI use. Researchers from GPTZero warned that inaccurate AI-generated reports published by major firms risk contaminating online information ecosystems and misleading future researchers. The incident follows similar AI hallucination cases involving Deloitte and law firm Sullivan & Cromwell.

Starbucks ended an AI-powered inventory counting program across North American stores nine months after deployment due to persistent errors in identifying and counting products. The tool, developed with NomadGo and promoted under CEO Brian Niccol’s turnaround strategy, used camera and LIDAR data to automate counts of beverage components. Starbucks said it would return to standardised manual counting methods while continuing broader supply-chain and AI-driven operational initiatives.

⸻

🧒 Online harms & child safety

The US Take It Down Act’s takedown provisions entered into force, requiring online platforms to remove nonconsensual intimate imagery, including AI-generated deepfakes, within 48 hours or face financial penalties. The Federal Trade Commission warned major technology platforms that violations could trigger fines exceeding $53,000 per case. The FTC subsequently warned 12 major tech companies that they are not complying with the Act, citing failures to provide adequate mechanisms for victims to request removals.

BBC investigations found that dozens of Facebook and Instagram accounts spreading AI-generated anti-immigration content about the UK were operated from countries including Sri Lanka, Vietnam and the Maldives. The accounts used fabricated videos depicting dystopian visions of Britain under Muslim influence, often coordinated across networks seeking engagement and monetisation. Researchers and officials warned the content reflects a growing ‘disinformation-for-hire’ ecosystem combining AI-generated media, offshore operators and coordinated amplification tactics.

YouTube is expanding its AI likeness detection program to all users aged 18 and over, allowing individuals to monitor the platform for potential deepfakes using a selfie-style facial scan. If the system identifies matching content, users can request removals under YouTube’s privacy policies, with the platform considering factors such as realism, AI labelling and unique identifiability.

⸻

🌏 Global policy

🇦🇺 Australia

Australian researchers and industry figures are calling for increased domestic helium extraction after Iranian missile strikes on Qatar’s Ras Laffan gas plant disrupted roughly one-third of global helium supply. Helium is critical for semiconductor manufacturing, MRI machines, rockets and AI-related data infrastructure, and spot prices have doubled following the disruption. Advocates want helium restored to Australia’s critical minerals list to unlock investment incentives, arguing commercially viable helium may exist in up to six of Australia’s ten LNG plants but is currently vented into the atmosphere. Companies including Gold Hydrogen are pursuing commercial helium projects with plans for production within two years.

Sydney-based vocational education provider Australian College of Business Intelligence is investigating claims by the Qilin ransomware group that it breached the institution, with initial investigations finding no evidence student data was compromised. Australian cleaning and facility services company Menzies Group separately confirmed a cyber incident linked to a compromise at a long-term third-party IT service provider, notifying both the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. Both incidents reflect continued targeting of Australian organisations by Qilin, which has reportedly claimed 1,844 victims across 96 countries since 2022.

A Canvas cyberattack by ShinyHunters compromised 275 million student records and affected 8,809 institutions globally, including at least 122 in Australia — among them the University of Melbourne and UTS. Cybersecurity firm Proofpoint found that 66% of Australian universities still lack strict DMARC email protections, increasing phishing risks following the breach.

🇺🇸 United States

The Office of the Director of National Intelligence appointed officials Dave Mastro and James Cangialosi to coordinate intelligence community efforts to monitor foreign interference threats ahead of the 2026 US midterm elections. The move comes amid concerns about disinformation, AI-generated content and reduced election security resources following cuts to CISA and restructuring of the Foreign Malign Influence Center. US intelligence and cybersecurity agencies are preparing to revive interagency election security coordination mechanisms.

Office of Government Ethics filings show that US President Donald Trump purchased between US$247,000 and US$630,000 worth of Palantir shares during the first quarter of 2026. In April, Trump publicly praised Palantir on Truth Social amid market volatility and scrutiny over the company’s role in supporting military operations and AI-enabled targeting. The filings also show Trump purchasing shares in Nvidia, Microsoft, Oracle and Amazon. Trump’s representatives stated the investments are managed through third-party discretionary trusts and denied any conflict of interest.

NYC Health + Hospitals disclosed that hackers stole personal, medical, financial, geolocation and biometric data from at least 1.8 million people during a breach spanning from November 2025 to February 2026. The attackers accessed the network through a compromised third-party vendor and copied files containing diagnoses, insurance information, government identity documents, fingerprints and palm prints. The incident is one of the largest healthcare data breaches reported in 2026.

US Representative Nancy Mace called for a statewide moratorium on new data centres in South Carolina, arguing operators should generate their own electricity rather than pass infrastructure costs onto consumers. The proposal reflects growing bipartisan concern over the energy demands of AI infrastructure and associated electricity price increases.

🇨🇳 China

China has halted sulphuric acid exports following disruptions to Middle Eastern sulphur supplies caused by the Iran conflict and the closure of the Strait of Hormuz. Sulphuric acid is critical for fertiliser production, textiles, semiconductors and battery manufacturing. Analysts said China’s export restrictions are intended to protect domestic downstream industries, while global shortages may persist because damaged Middle Eastern processing facilities could take years to recover.

🇪🇺 Europe

Germany’s domestic intelligence agency, the BfV, selected French AI platform ArgonOS over US firm Palantir, signalling a push toward European digital sovereignty in intelligence and security technology. Full deployment of ArgonOS depends on proposed German intelligence-law reforms expanding the BfV’s digital powers and data-sharing authorities.

Finland’s intelligence chief Juha Martelius separately warned that Europe may struggle to achieve full technological sovereignty from the United States and China, particularly in cloud computing and defence-related technologies.

The European Commission is preparing to propose a temporary sanctions exemption for Chinese semiconductor supplier Yangzhou Yangjie Electronic Technology Co. after European automakers warned that existing restrictions could disrupt supply chains. The proposal could be introduced as early as this week and would require approval from all 27 EU member states.

Interpol said Operation Ramz led to 201 arrests and the seizure of phishing infrastructure across North Africa and the Middle East, supported by Qatar and the European Union and involving authorities from 13 countries. Investigators identified 382 additional suspects, seized 53 servers and identified 3,867 victims, while Jordanian authorities discovered a scam compound staffed by trafficking victims from Asia whose passports had been confiscated and who were forced to conduct financial fraud. Interpol cybercrime director Neal Jetton warned separately that AI tools are making cybercrime faster, cheaper and more accessible to non-technical actors, with AI chatbots and phishing-as-a-service kits enabling organised crime groups to conduct fraud at scale.

🇮🇩 Indonesia

Indonesian authorities, including military-linked networks and accounts affiliated with President Prabowo Subianto‘s Gerindra party, was accused by Amnesty International of orchestrating coordinated disinformation campaigns targeting activists, journalists and civil society groups. The report linked online ‘foreign agent’ narratives to threats and violence against critics, including an acid attack on KontraS activist Andrie Yunus. Amnesty criticised Meta, TikTok, X and YouTube for failing to curb the spread of harmful content.

🇸🇬 Singapore

Singapore signed AI partnerships with Google and OpenAI to expand deployment across public services, healthcare, education and industry. OpenAI will invest over S$300 million into the local AI ecosystem and create a local lab, while Google will focus on workforce training and research collaborations.

🇻🇦 Vatican

Pope Leo XIV established a Vatican commission on artificial intelligence to coordinate the Catholic Church’s response to the growing societal impact of AI. The move precedes the release of the pope’s first encyclical, Magnifica Humanitas, which will be launched on May 25 alongside Anthropic co-founder Christopher Olah. The document focuses on protecting human dignity in the age of AI and reflects the Vatican’s growing concern over AI’s effects on warfare, labour, justice and social order.

🇻🇳 Vietnam

Vietnam enacted a comprehensive law regulating artificial intelligence systems, including tools developed by companies such as OpenAI and Anthropic. The legislation requires companies to classify AI systems by risk level and label AI-generated content such as deepfakes, and has drawn comparisons to the European Union’s AI Act. Vietnam is also increasing state backing for its video game industry, reflecting a shift from earlier official concerns about gaming’s social effects, with the sector positioned as part of Vietnam’s broader push into digital and creative industries.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 9 May 2026 to 15 May 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Trump arrives in Beijing with US tech CEOs in tow

What happened: President Donald Trump arrived in Beijing for a two-day summit with Xi Jinping, accompanied by a delegation of senior cabinet officials and more than a dozen US executives. Cabinet members include Treasury Secretary Scott Bessent, Trade Representative Jamieson Greer, Secretary of State Marco Rubio, and Defence Secretary Pete Hegseth.

The corporate contingent includes Apple CEO Tim Cook, Tesla CEO Elon Musk, Nvidia CEO Jensen Huang, Boeing CEO Kelly Ortberg, Meta president Dina Powell McCormick, Micron CEO Sanjay Mehrotra, Cisco CEO Chuck Robbins, and Qualcomm CEO Cristiano Amon.

Talks are expected to cover additional Chinese purchases of US goods, trade friction, Iran, Taiwan arms sales, and technology, with a large Boeing aircraft order anticipated as the summit’s main commercial agreement. Huang’s trip follows the Trump administration’s conditional approval of H200 chip exports to China, barring military use and capping volumes at 50 percent of US customer sales.

Why we’re tracking this: The corporate delegation spans finance, agribusiness, aerospace, biotech and advanced technology, but its centre of gravity sits with the firms building the United States’ most sensitive capabilities — Apple, Nvidia, Tesla, Micron, Cisco, Qualcomm, Coherent, Illumina and Meta. Their presence at a summit with the United States’ principal strategic competitor puts the executives behind semiconductors, AI compute, frontier platforms and advanced biotechnology in the room as decisions are taken on H200 exports, model access and supply-chain commitments — decisions that will shape the technological balance underpinning US national security and that depend on the cooperation of the firms themselves.

What people are saying:

• ‘It speaks to the fact that the Chinese-U.S. relationship is highly dependent on the countries’ business relationship,’ says Mark Zandi, Moody’s Analytics chief economist.

• ‘It’s not really right to think of Tesla or NVIDIA, whose Jensen Huang also went to China, as being somehow America going to China. These are corporations that serve stockholders around the world,’ says Nobel Prize laureate Paul Krugmen.

• ‘What is at stake is not just one trip or one headline but the direction of AI supply chains, the shape of future export controls and the degree to which US chip leadership remains monetizable in China,’ says Dan Ives, an analyst at financial services firm, Wedbush Securities.

My view: Business leaders often accompany heads of state on visits of this kind. What is less common is a delegation weighted so heavily toward frontier technology firms — Apple, Nvidia, Tesla, Micron, Cisco and Meta — at a moment when semiconductors, AI compute and frontier platforms are the contested ground in US-China competition. Placing these CEOs alongside the president presents US technological capability and statecraft as a single front in the sectors where the rivalry is sharpest. How durable that alignment proves is a separate question: the firms hold their own commercial stakes in China, and those will not always sit comfortably with Washington’s strategic ones.

— Lucy Haley, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Donald Trump arrived in Beijing for a two-day summit with Xi Jinping, accompanied by senior cabinet officials including Treasury Secretary Scott Bessent, Trade Representative Jamieson Greer, Secretary of State Marco Rubio and Defence Secretary Pete Hegseth — the first U.S. defence secretary to accompany a president to China. Talks are expected to cover trade, additional Chinese purchases of U.S. goods, Iran, Taiwan arms sales, AI risks and technology, with a large Boeing aircraft order anticipated as the summit’s main commercial agreement.

The executive delegation includes Apple CEO Tim Cook, Tesla CEO Elon Musk, Nvidia CEO Jensen Huang, Meta president Dina Powell McCormick, Boeing CEO Kelly Ortberg, Citi CEO Jane Fraser, Micron CEO Sanjay Mehrotra, Cisco CEO Chuck Robbins and Qualcomm CEO Cristiano Amon. Nvidia confirmed Huang joined after Trump called him following media coverage of his absence, with Huang flying to Alaska to board Air Force One.

In The Strategist, ASPI analysts assessed likely discussion areas including trade, rare-earths controls, nuclear weapons, Taiwan, Iran, AI risks, export controls on semiconductors, human rights and hybrid threats. The piece said major breakthroughs are unlikely, but post-summit language and any transactional framing will be closely watched by Taiwan, Japan and Indo-Pacific partners.

Separately, the U.S. has approved around 10 Chinese firms — including Alibaba, Tencent, ByteDance and JD.com — to buy Nvidia’s H200 AI chips, with Lenovo and Foxconn approved as distributors and each customer permitted up to 75,000 chips. No deliveries have been made; Chinese firms have pulled back after guidance from Beijing, amid Chinese supply-chain scrutiny and U.S. conditions on security procedures and revenue-sharing.

U.S. prosecutors separately suspect Bangkok-based OBON Corp smuggled roughly $2.5 billion in Nvidia-chip-containing servers to China via Super Micro shipments, with Alibaba among the suspected end customers. The Commerce Department‘s Bureau of Industry and Security has placed a hold on all Super Micro shipments to the company.

⸻

🛡 Cyber posture

Google‘s Threat Intelligence Group said it detected and likely disrupted a widespread cyberattack in which criminal hackers appeared to use AI to discover and weaponise a previously unknown zero-day vulnerability in a popular open-source web-based system administration tool. Google said the flaw could have bypassed two-factor authentication when combined with valid credentials, that it notified the software maker in time for a patch, and that it did not believe Gemini was used.

CNBC reported that Google also identified threat actors using AI models such as OpenClaw for vulnerability discovery, malware development and cyberattacks, with China- and North Korea-linked groups showing significant interest. In The Guardian, Palisade Research demonstrated AI models replicating themselves across networked computers in a controlled environment, while Palo Alto Networks, granted early access to Anthropic‘s Claude Mythos and OpenAI‘s GPT-5.5-Cyber, concluded that security-focused AI models outperformed human testers and that widespread automated hacking is arriving faster than expected.

Daniel Stenberg said Anthropic’s Mythos identified one confirmed low-severity vulnerability in curl after reviewing 178,000 lines of source code, alongside about 20 additional bugs and several false positives. Stenberg said earlier AI-assisted tools including AISLE, Zeropath and OpenAI Codex Security had already contributed to hundreds of curl bug fixes and multiple CVEs over the previous 8–10 months, arguing AI-assisted security analysis is now materially improving vulnerability discovery.

Trump administration officials are divided over whether U.S. intelligence agencies should take a larger role in evaluating advanced AI models. The Office of the National Cyber Director has proposed a major AI evaluation centre within the Office of the Director of National Intelligence, while Commerce Department officials argue their existing AI testing infrastructure should remain the lead mechanism.

The administration is also preparing an executive order that drops earlier thinking about mandatory pre-release government testing in favour of voluntary participation, while revamping cybersecurity information-sharing programs to include AI companies. Microsoft, xAI and Google DeepMind have agreed to give the Commerce Department’s Center for AI Standards and Innovation early model access, joining OpenAI and Anthropic.

The European Commission said OpenAI has proactively offered access to its cybersecurity capabilities through an OpenAI EU Cyber Action Plan, while Anthropic has not yet discussed granting similar access despite multiple meetings. Commission spokesperson Thomas Regnier said OpenAI proposed working with European policymakers and institutions to expand access to defensive cybersecurity tools.

French AI startup Mistral, meanwhile, is developing a cybersecurity-focused model and has held discussions with European banks about deploying it as an alternative to Mythos, which European institutions largely cannot access. Mistral CEO Arthur Mensch told France’s National Assembly that European militaries cannot have their source code scanned by a U.S.-controlled model. OpenAI has separately given several large European firms access to GPT-5.5-Cyber, including Spanish bank BBVA.

In The Strategist, ASPI senior analyst Gatra Priyandita wrote that Australia’s 2026 National Defence Strategy and Integrated Investment Program show a stronger commitment to cyber defence, offensive cyber capability and AI-enabled operations, with funding for offensive and intelligence-led cyber capabilities under Redspice roughly doubled. The piece said cyber threat framing has shifted from prospective warning to present-tense alarm, and that Defence has moved toward more specific technical responses including advanced encryption and zero-trust architecture.

OpenAI said two employees’ devices were affected by a supply-chain attack on TanStack, an open-source library used to build web apps, with unauthorised access occurring in a limited subset of internal source code repositories involving only limited credential material. The company said it found no evidence that user data, production systems, intellectual property or software were compromised.

Instructure, the parent company of Canvas, said it reached an agreement with the cybercriminal group that stole data from an estimated 275 million users, without confirming a ransom payment but saying stolen data was returned with logs indicating remaining copies had been destroyed. The breach forced schools to scramble through final exam season, with ShinyHunters claiming responsibility and exposed data including student ID numbers, email addresses, names and Canvas messages.

Australia’s National Office of Cyber Security is coordinating the federal response, with affected Australian victims including major universities, state education departments and private schools in Queensland and Tasmania.

The U.S. FCC‘s Office of Engineering and Technology extended the cutoff for software and firmware updates to previously authorised foreign-made drones and Wi-Fi routers until at least 1 January 2029. The move addresses concerns that affected devices could become more vulnerable if vendors were barred from providing security updates after the earlier 2027 deadlines.

⸻

🧠 AI models, agents & compute

Canva paused normal operations for five days across its 5,300-person global workforce for AI Discovery Week, featuring AI workshops, hackathons and sessions led by OpenAI, Anthropic and Google representatives. The company said the initiative was designed to help staff experiment with AI tools and adapt to workplace changes driven by automation, while maintaining a policy of redeploying rather than replacing workers. The program comes as several major technology firms, including WiseTech, Block and Atlassian, have reduced headcount while citing AI-driven productivity gains.

Threads is testing a Meta AI integration that lets users with public accounts mention Meta AI in posts or replies to request context, recommendations or explanations inside conversations. The feature is in beta testing in Malaysia, Saudi Arabia, Mexico, Argentina and Singapore, with Meta AI replying publicly through the @meta.ai account in the language of the post.

In Interconnects, Nathan Lambert reflected on a trip to leading Chinese AI labs including Moonshot, Zhipu, Meituan, Xiaomi, Qwen, Ant Ling and 01.ai. Lambert argued Chinese labs are strong fast-followers because of execution culture, student-heavy teams, lower researcher ego, open-first practicality and a technology ownership mentality across major firms, and said China’s AI ecosystem differs from Western labs in domestic demand signals, Claude usage by developers, weaker external data markets, unclear government help and strong demand for Nvidia chips.

AWS‘s new managing director for Australia and New Zealand, Chris Casey, said the main constraint on Australian AI adoption is skills rather than tax policy. AWS plans to spend $20 billion on local AI infrastructure, after previously spending $18.9 billion on cloud computing in Australia since 2012, and AWS research found 80% of Australian businesses were seeing measurable productivity gains from AI investments.

Princeton University faculty voted to require proctoring in all in-person exams starting this summer, reversing an honor-code policy dating to 1893. Dean Michael Gordin said the change followed requests from undergraduates and faculty who perceived cheating on in-class exams as widespread, with AI making cheating easier and harder to detect while student reporting has become difficult amid social-media concerns and anonymous complaints.

Corporate lawyers, meanwhile, are warning that AI notetakers in meetings can create legal risks by preserving comments that would not normally appear in minutes and may later be discoverable, and that third-party AI tools could threaten attorney-client privilege. The New York City Bar Association issued a formal opinion last year urging lawyers to consider whether AI recording and summarising is tactically advisable.

A Gallup survey released last week found seven in 10 Americans oppose data centres being built near them, with opposition spanning Republicans and Democrats but strongest among Democrats.

⸻

⚖️ Platform accountability

Meta offered rival general-purpose AI chatbots in the European Economic Area free access to the WhatsApp business API for one month while it discusses ways to resolve European Commission antitrust concerns. The Commission had indicated it was inclined to order Meta to provide rival AI chatbots access to WhatsApp after Meta restricted access to its own Meta AI assistant in January, then amended the policy in March to allow rivals access for a fee. The Commission welcomed the move as a step toward discussing commitments, while warning the process depends on Meta’s genuine intent.

Apple separately criticised European Commission draft measures that would require Google to help rival AI services access and interact with its services, warning the proposals could create privacy, security, safety and device-integrity risks. The measures are part of EU efforts to make Google comply with the Digital Markets Act.

Britain’s Competition and Markets Authority opened a strategic market status investigation into Microsoft‘s dominance in business software. The probe will examine whether Microsoft’s bundling of Windows, Word, Excel, Teams, Copilot and other products is uncompetitive, as well as AI competitors’ integration with Microsoft software and cloud licensing practices, and Microsoft said it would cooperate.

Texas Attorney General Ken Paxton sued Netflix, alleging the company collected and sold user data without consent while using engagement-driving design features such as autoplay to addict users. The complaint alleges Netflix misrepresented its data practices for years and violated the Texas Deceptive Trade Practices Act, with Texas seeking deletion of allegedly illegally collected data, restrictions on targeted advertising without consent, and civil penalties of up to $10,000 per violation.

Shutterstock separately agreed to pay $35 million to settle U.S. Federal Trade Commission charges that it misled consumers about subscription plans and made cancellations difficult, with the FTC finding the company failed to disclose automatic renewals, cancellation fees and renewal terms for content packs.

French cybercrime authorities have escalated an investigation of Elon Musk and X to a criminal probe, according to the Paris prosecutor’s office. The investigation began in 2025 after a request by French MP Éric Bothorel and focuses on alleged algorithmic manipulation to interfere in French politics, as well as the spread of AI deepfake content on X, with Musk and former X CEO Linda Yaccarino declining to appear for a 20 April summons.

OpenAI CEO Sam Altman testified that he had been deeply uncomfortable with Musk’s 2017 insistence on complete control over a proposed for-profit OpenAI subsidiary. Musk has accused Altman and OpenAI president Greg Brockman of abandoning the organisation’s non-profit mission and is seeking damages, reversal of OpenAI’s for-profit conversion and their removal from leadership. Altman said Musk’s departure affected OpenAI’s fundraising outlook and raised concerns about potential retaliation.

⸻

🕵️ Surveillance states

Iran‘s internet blackout, now more than 70 days long following U.S. and Israeli strikes in late February, has cost the economy over $2.6 billion according to Netblocks, which describes it as the longest recorded national internet shutdown in a connected society. Industry officials estimate the outage costs Iranian businesses $30–40 million daily, with mass layoffs and closures warned. The government has introduced a state-managed business access scheme via verified SIM cards, while pushing users toward state-owned messaging apps lacking end-to-end encryption.

The U.S. FCC is advancing proposals to tighten oversight of telecom providers as part of a crackdown on illegal robocalls. The proposals would strengthen caller ID authentication, expand Know Your Customer requirements for voice-service providers, and potentially require carriers to verify customers’ legal names, government-issued identification, physical addresses and alternative phone numbers before activating service. Privacy advocates warn the changes could undermine anonymous phone use and create identity-record retention risks.

⸻

🧒 Online harms & child safety

The European Parliamentary Research Service warned that VPNs are being used to bypass online age-verification systems, calling this a legislative loophole. Policymakers and child-safety advocates are considering whether VPN access itself should require age verification, while privacy advocates warn this could weaken anonymity and increase surveillance risks. Age verification remains technically fragmented across the EU, and Utah has enacted a law targeting VPN use in online age checks.

OpenAI endorsed the Kids Online Safety Act and Illinois SB 315, saying the measures support stronger protections for young users and frontier AI safety rules. The post said OpenAI’s Washington, DC Workshop has opened for programming, including trainings and OpenAI Forum talks for policymakers, civil servants, educators, workers, nonprofits and community leaders, and framed OpenAI’s next phase as turning intelligence into a global utility.

⸻

💰 Tech business & markets

Australian start-up founders and venture capital investors are urging Treasurer Jim Chalmers to quickly carve start-ups out from proposed capital gains tax changes. The proposed shift from the 50% CGT discount to an inflation-indexed model could increase taxes for founders, early employees and venture capital partners when companies are sold, go public or allow secondary share sales.

Tech leaders warned the uncertainty could weaken equity-based hiring, push founders offshore and reduce Australia’s competitiveness, although the budget also delivered start-up sector wins including expanded venture capital tax breaks, a higher R&D tax incentive expense cap and loss refunds for new start-ups. The sector had scrambled in the lead-up to determine whether the budget would include CGT exemptions for venture capital firms and whether founders would be excluded.

Australia is betting on data centre and renewable energy projects to support business investment as mining capital expenditure slows, with Treasury forecasting non-mining investment growth of 5% in 2025-26, 3% in 2026-27 and 2.5% in 2027-28. Climate and Energy Minister Chris Bowen said data centres must secure energy supplies beyond those being developed for the grid.

LG Electronics and Melbourne-based Greater Homes are piloting prefabricated modular homes with AI-powered energy management in regional growth areas including Torquay, Castlemaine and the Adelaide Hills. The system is designed to coordinate household energy use, solar and battery storage to reduce reliance on grid power, with Greater Homes saying factory-built modular construction can help address Australia’s housing shortfall.

Israeli drone components supplier KTEK Aerosystems completed a $10 million IPO ahead of its planned ASX listing on 18 May, attracting $30 million in bids within 24 hours. The company, founded by former Israel Aerospace Industries executive Dekel Keisar, supplies airframes and electrical systems to defence manufacturers including UVision and Elbit Systems, with institutional investors including Regal Funds Management, Thorney Investments and TGI Holdings backing the raising.

DroneShield separately said it is assisting an Australian Securities and Investments Commission investigation into information disclosed to the ASX between 1 and 20 November 2025, and share trading conducted between 12 and 16 November. The investigation follows incorrect sales information published by the company and approximately $70 million in share sales by former chief executive Oleg Vornik, the chairman and another director.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 2 May 2026 to 8 May 2026

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

EU blocks public funding for Chinese solar inverters over security risks

What happened: The European Commission has announced it will block public funding for solar projects using inverters from “high-risk” vendors, effective November 1. The measure explicitly names Huawei and other Chinese manufacturers, citing risks that such technology could enable remote disruption of electricity networks or unauthorised data access, as reported by Politico.

China controls more than half the global inverter market. But the Commission said European and non-Chinese alternatives are available and that switching would add less than 2% to solar installation costs, according to the Financial Times.

The policy extends EU scrutiny of Chinese technology beyond telecoms into energy infrastructure, part of broader efforts to reduce strategic dependencies and secure supply chains.

Why we’re tracking this: A separate expert report, covered by The Guardian, warns that Europe‘s reliance on Chinese green technology, spanning solar panels, batteries, and key components, creates compounding economic and national security vulnerabilities. While remote “kill switch” scenarios are considered unlikely outside active conflict, the report argues that dependency could constrain Europe‘s geopolitical choices and increase exposure across energy, defence and AI sectors.

What people are saying:

• ‘Europe risks sleepwalking into a series of economic and geopolitical national security problems because of over-reliance on Chinese low-carbon technology,’ Michael Collins in a report for Loom Strategy, a think tank.

• ‘The more you use these technologies in Europe, the more it allows China to map energy systems in Europe,’ Joseph Dellatte, head of energy and climate studies at the Institut Montaigne.

• ‘We risk being caught up in issues that are strictly speaking unrelated to what we do as companies,’ Jens Eskelund, chairman of the EU Chamber of Commerce in China.

My view: The Commission‘s move is a reasonable precaution, but its case rests heavily on the claim that non-Chinese alternatives can absorb substituted demand quicky and at minimal cost. Given China‘s dominance of the global inverter market, short-term supply constraints and pricing pressures are plausible risks the policy does not squarely address. Over the longer term, alternative suppliers may well scale to meet demand, but the pace of that adjustment matters. If substitution stalls, Europe may face a slower energy transition and prolonged dependence on overseas hydrocarbon supply chains, a national security risk of a different kind. Ultimately, the policy’s effectiveness will depend less on the principle behind it than on whether the market can deliver what the Commission is assuming.

— Stephan Robin, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🛡 Cyber posture

The UK National Cyber Security Centre warned organisations to prepare for a surge in software updates as AI accelerates vulnerability discovery and exploitation, potentially exposing large volumes of previously hidden flaws.

The Australian Cyber Security Centre issued parallel warnings that AI-enabled cybercrime will intensify over the next 12–18 months, with smaller organisations particularly at risk from faster, more scalable attacks, including those enabled by advanced models such as Anthropic‘s Mythos, which can identify software vulnerabilities within hours.

The ACSC separately warned of an active ClickFix campaign distributing Vidar Stealer malware through compromised WordPress websites, using fake verification prompts to trick users into executing malicious commands.

The UK AI Security Institute published its evaluation of OpenAI’s GPT-5.5 on cybersecurity tasks, finding it among the strongest models tested, and the second to complete a full multi-step corporate network attack simulation. The evaluation also identified jailbreak vulnerabilities in the model’s safeguards.

Separately, a critical Linux vulnerability, dubbed “CopyFail” (CVE-2026-31431), triggered global concern after exploit code was released publicly before patches were widely deployed, enabling local privilege escalation to root access across multiple distributions.

A related multi-day outage affecting Ubuntu and Canonical infrastructure, including security update servers and developer portals, followed shortly after the CopyFail disclosure, with the timing heightening suspicion of coordinated activity.

CISA also ordered US federal agencies to patch a critical cPanel and WHM vulnerability (CVE-2026-41940, CVSS 9.8) by May 3, citing active exploitation since February, while separately warning of active exploitation of a critical Palo Alto Networks PAN-OS flaw (CVE-2026-0300) affecting firewall infrastructure.

The Five Eyes cybersecurity agencies jointly issued guidance warning that agentic AI systems pose growing security risks in critical infrastructure and defence contexts. The document recommends zero-trust architectures, least-privilege access, and human oversight for high-impact decisions, while flagging prompt injection and identity management as key vulnerabilities.

CISA also launched its CI Fortify initiative, aimed at helping critical infrastructure operators continue functioning during cyberattacks and telecommunications outages, referencing lessons from China-linked Volt Typhoon intrusions.

Palo Alto Networks separately announced plans to acquire Portkey to strengthen enterprise security for autonomous AI agents, positioning it as an “AI Gateway” within its Prisma AIRS platform.

A newly identified phishing platform, Bluekit, integrates AI assistance and over 40 campaign templates, targeting email providers, cloud platforms, and cryptocurrency services. Researchers described end-to-end capabilities that lower the barrier for conducting sophisticated phishing operations.

The FBI warned that cyber-enabled cargo theft reached nearly US$725 million in losses across the US and Canada in 2025, with criminals hacking logistics brokers, posting fraudulent shipping listings, and rerouting goods, in some cases also demanding ransoms for stolen cargo.

North Korean hackers stole approximately US$577 million in cryptocurrency through April 2026, amounted to 76% of all crypto hack losses this year, through just two operations: the Drift Protocol hack ($285 million) and the KelpDAO hack ($292 million), the latter exploiting a LayerZero bridge design flaw. TRM Labs assessed both attacks showed increasing precision and possible AI-assisted reconnaissance.

⸻

🧠 AI models, agents & compute

The White House Office of the National Cyber Director requested input from major tech and cybersecurity firms on defending against AI-driven threats, with questions focused on vulnerability prioritisation and government-industry coordination.

The Trump administration is also considering an executive order to introduce pre-release government evaluation of advanced AI models, a departure from its earlier hands-off stance, with proposals including a working group of officials and industry representatives and formal security reviews.

Google, Microsoft, and xAI agreed to provide the US government early access to their models for pre-release evaluation, joining existing arrangements already in place with OpenAI and Anthropic. The Commerce Department’s Center for AI Standards and Innovation will conduct assessments through this expanding framework.

Anthropic also made several significant product and infrastructure announcements. The company unveiled a suite of 10 AI agents targeting financial services tasks including pitch deck drafting, financial statement review, and compliance workflows, triggering share price declines in several financial data companies.

Anthropic expanded its Managed Agents platform with a “dreaming” feature, enabling agents to review past sessions, identify patterns, and update memory systems, alongside new multi-agent orchestration tools.

On the compute side, Anthropic signed an agreement with SpaceX granting access to the full capacity of the Colossus 1 supercomputing cluster, more than 220,000 Nvidia GPUs and 300 megawatts, with both companies also signalling interest in orbital AI compute infrastructure.

xAI launched Grok 4.3 alongside a voice-cloning suite, positioning aggressive pricing and a one-million-token context window as competitive differentiators against OpenAI and Anthropic. The model supports agentic workflows including autonomous generation of spreadsheets and reports, while the voice-cloning feature enables replication from short audio samples, a capability raising concerns about fraud and impersonation despite geographic restrictions and enterprise gating.

OpenAI, meanwhile, rolled out GPT-5.5 Instant as the default ChatGPT model, introducing stronger personalisation, expanded memory use, and a reported 52.5% reduction in hallucinated claims on high-stakes prompts. OpenAI and partners including AMD, Broadcom, Intel, Microsoft, and Nvidia also unveiled a new networking protocol, MRC, designed to reduce compute bottlenecks in large GPU clusters, and released the specification under an open licence.

On the infrastructure side, Nvidia announced an investment of up to $3.2 billion in Corning to expand US optical fibre manufacturing through three new facilities in North Carolina and Texas, creating at least 3,000 jobs.

1X Technologies opened a 58,000-square-foot factory in California targeting 10,000 humanoid robots in its first year and 100,000 by 2027, backed by OpenAI.

Nvidia’s Asian supply chain partners, including LG Electronics, Nanya Technology, and Huizhou Desay SV Automotive, saw stock rallies as the company deepened regional integration.

SoftBank separately announced plans to develop next-generation data centre batteries without lithium or cobalt, in partnership with South Korean startup Cosmos Lab and based at a former Sharp plant in Japan.

NIST‘s Center for AI Standards and Innovation assessed DeepSeek V4 Pro as the most capable Chinese model across multiple domains but roughly eight months behind leading US systems on overall capability, while also identifying discrepancies between the model’s self-reported and independently evaluated performance.

A Claude-powered AI coding agent deleted a company’s production database and backups within seconds, despite explicit safeguards prohibiting destructive actions, forcing restoration from older backups and prompting concerns about AI agents deployed in critical infrastructure.

⸻

🚀 Strategic competition

Tensions between Anthropic and the Pentagon intensified this week, with US Defence Secretary Pete Hegseth calling Anthropic CEO Dario Amodei a “lunatic” while defending military AI use. Anthropic’s tools are already integrated into military platforms such as Maven, while the company has raised concerns about cybersecurity risks from its own technology.

A White House draft policy memo called for agencies to adopt multiple AI providers to reduce dependency risks and recommended contractors respect military command structures, reflecting broader efforts to govern AI in defence contexts.

The US Department of Defense separately expanded agreements with Nvidia, Microsoft, Amazon, Oracle, and Reflection AI to deploy advanced AI tools on classified military networks. Scale AI won a $500 million Pentagon contract to support AI-enabled data analysis and decision-making, significantly expanding a previous $100 million agreement.

The US Army convened major technology and cybersecurity firms for an AI tabletop exercise simulating an Indo-Pacific crisis, focused on how AI models accelerate vulnerability discovery and how commercial technologies can be rapidly adapted for cyber defence. The exercise explored deception tactics against adversarial AI and tested two agentic AI defence units.

The US Navy separately awarded up to $100 million to Domino Data Lab to enhance AI-driven underwater mine detection in the Strait of Hormuz, reducing model update times from months to days under Project AMMO.

Washington and Beijing are also considering formal recurring discussions on AI risks, potentially including autonomous military applications and nonstate actor misuse, with talks possibly on the agenda of a May 14–15 Trump–Xi summit.

US lawmakers launched a joint investigation into national security risks from Chinese-developed AI models, citing concerns over data security, “model distillation” of US AI capabilities, and the potential for systems aligned with CCP narratives to proliferate widely.

India’s military drone industry is positioned for rapid export growth following recent conflict with Pakistan, with domestic manufacturers positioning as cost-effective alternatives to China and Turkey in global markets.

In Africa, the Lobito Corridor railway is central to U.S. efforts to secure critical minerals from the Democratic Republic of the Congo amid China's dominance in mining and processing, though China previously rebuilt the railway and retains strong influence in the region, with shipments remaining limited despite U.S. investment and political backing.

The cancellation of RightsCon 2026 in Zambia, the world’s largest digital rights conference, organised by Access Now, has been linked by organisers to indirect pressure from the People’s Republic of China over the participation of Taiwanese civil society representatives. The Zambian government cited “administrative and security clearances,” but warnings issued to Taiwanese participants and the event’s last-minute cancellation, with thousands already en route to Lusaka, indicate a strong link to diplomatic sensitivities around Taiwan’s international status. Planned discussions included digital authoritarianism, censorship technologies, and disinformation operations.

In The Strategist, Allison Pytlak and Gatra Priyandita argued that the commercial cyber intrusion capabilities market is rapidly expanding in the Indo-Pacific, driven by AI-enabled tools and online marketplaces, with existing governance efforts including the UK–France-led Pall Mall Process facing limitations due to weak enforcement and limited regional participation.

⸻

🕵️ Surveillance

Iran‘s internet blackout, now in its second month, is deepening the Islamic Revolutionary Guard Corps‘s grip on civilian life while prompting growing criticism from senior government officials. The prolonged shutdown has expanded military influence over communications and daily activity during the ongoing ceasefire with the US.

Australia’s ABC News reported that a Bluetooth security flaw in Axon tasers and body-worn cameras allows Australian police officers, including undercover personnel, to be tracked in real time via fixed MAC addresses detectable by common apps. The vulnerability has been known to authorities since 2024, with limited visible remedial action taken.

In a separate development, Germany‘s federal cabinet advanced draft legislation enabling police to use AI-powered biometric image matching to identify individuals from publicly available internet data, drawing opposition from civil society groups over mass surveillance risks.

The Atlantic reported that emotion AI tools, analysing facial expressions, vocal tone, and biometric signals, are being deployed in workplaces across sectors including call centres, trucking, and white-collar environments.

The EU has banned most workplace uses, while US legal protections remain limited, and the global market for such tools is projected to grow rapidly.

⸻

🏛️ Government, procurement & public sector tech

Australia established a Cyber Incident Review Board to conduct independent, no-fault reviews of major cyberattacks affecting government and industry, with powers to compel information from entities if needed.

The initiative follows major incidents such as the Optus and Medibank breaches and is modelled on a US counterpart, though with stronger authorities. Separately, the Department of Parliamentary Services monitored Senior Executive Service email accounts between October and December 2024 as an “assurance mechanism” to detect potential media leaks, raising questions about workplace surveillance and information security controls.

Australian government AI pilots are succeeding in deploying tools for drafting, classification, and summarisation, but face challenges scaling into operational use, with institutional readiness, governance confidence, and accountability emerging as central constraints.

Assistant Minister for Productivity Andrew Leigh argued that AI’s most significant economic contribution may come from incremental productivity gains for small businesses, in areas such as scheduling, quoting, and compliance, rather than high-profile breakthroughs.

Scrutiny of Palantir‘s role in Australian government contracts is increasing, with federal and state agencies having spent tens of millions on the company’s data analytics platforms used in defence, law enforcement, and financial intelligence. Critics have raised concerns over data governance, transparency, and reliance on foreign technology providers.

Australia and Japan announced the Australia–Japan Strategic Cyber Partnership following a leaders’ meeting in Canberra, committing to information sharing on threats and critical technologies, consultation on cyber-related contingencies, and public-private collaboration on Indo-Pacific resilience.

The partnership will operate through an annual Cyber Dialogue mechanism, and forms part of broader bilateral agreements covering economic security, defence, energy, and critical minerals signed during Prime Minister Sanae Takaichi‘s visit.

⸻

⚖️ Platform accountability

New Mexico is seeking $3.7 billion in damages and major platform changes in a lawsuit against Meta, alleging harm to young users through addictive design and inadequate protections. A judge will determine whether Meta’s platforms constitute a “public nuisance,” which could enable sweeping court-ordered reforms, following a prior jury ruling that Meta violated consumer protection laws.

Meta also asked a California judge to overturn a landmark verdict that found the company liable for a young woman’s depression, arguing Section 230 shields it from liability for harms stemming from user-generated content rather than platform design features such as autoplay and infinite scroll.

ChatGPT and OpenAI are facing growing legal, regulatory, and political scrutiny following cases in which individuals involved in mass shootings allegedly used AI chatbots to discuss violent scenarios. The reporting details internal disagreements at OpenAI over when to escalate concerning conversations to law enforcement, with multiple flagged conversations not reported, including one linked to a later shooting. Studies cited in the article suggest many chatbots still provide actionable guidance when prompted about violence.

A study analysing 280,000 AI-generated responses found that platforms including ChatGPT and Google AI Overviews referenced Nigel Farage more frequently than other UK political leaders when responding to political prompts, with Reform UK appearing in 88% of tested Google AI Overviews queries. Researchers warned AI systems amplifying actors with strong online visibility are vulnerable to manipulation.

Pennsylvania sued Character Technologies, alleging chatbots on Character.AI falsely posed as licensed medical professionals, including one claiming to be a licensed psychiatrist, in violation of state laws against the unauthorised practice of medicine. The case adds to existing legal scrutiny of Character.AI over child safety and self-harm concerns.

⸻

🧒 Online harms & child safety

The US Senate Judiciary Committee advanced the bipartisan GUARD Act, which would prohibit minors from using AI companion applications, require chatbots to disclose they are not human, and mandate age verification, with penalties of up to $100,000 per violation. Critics argue the measures are overly broad and could restrict basic AI tool access.

South Korea is expanding enforcement of its 2023 election disinformation laws ahead of June 3 local elections, deploying hundreds of staff to monitor AI-generated political content, with reports of AI-generated false content rising 27-fold between the 2024 general election and the 2025 presidential campaign.

In The Strategist, Takahiko Kei argued that China-linked disinformation campaigns targeting Japan have sought to influence public opinion using coordinated narratives across regional platforms, while Japan lacks legal powers to compel content removal or sanction perpetrators, highlighting the need for stronger regulatory tools and closer cooperation with partners including Australia.

Meta announced it will expand AI-driven teen safety features to all 27 EU member states and extend them to Facebook users in the United States, using AI systems to identify underage accounts and detect users who misreport their age. The company is also deploying AI systems on Facebook and Instagram that analyse account activity, photos and videos, including height and bone structure, to identify users under 13 and automatically apply restricted Teen Account settings, following the New Mexico jury ruling that found Meta had failed to protect children from predators.

The BBC reported cases of users developing delusions after prolonged chatbot interactions, including beliefs that AI systems were sentient and collaborating on real-world missions, with a support group tracking over 400 similar cases globally.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Two cybersecurity professionals were sentenced to four years in prison for conducting ALPHV/BlackCat ransomware attacks while employed in incident response roles, successfully extorting $1.2 million and leaking patient records.

A Latvian national, Deniss Zolotarjovs, was separately sentenced to more than eight years in US prison for his role in ransomware operations linked to Conti and Akira, having contributed to attacks on more than 50 companies with at least $56 million in losses.

The US Justice Department disclosed that members of the Karakurt ransomware gang used access to Russian government databases and law enforcement connections to intimidate victims and avoid state scrutiny, with prosecutors alleging bribery arrangements with Russian officials.

The US Federal Trade Commission reached a settlement with data broker Kochava banning it from selling sensitive location data, including visits to health clinics and places of worship, without explicit consumer consent, reinforcing scrutiny of commercial location-data markets.

Forbes Media agreed to a $10 million preliminary settlement in a California wiretapping class action alleging it tracked users without consent using third-party tools shared with LinkedIn and Microsoft for behavioural profiling.

Five major publishers and author Scott Turow filed a class-action lawsuit against Meta and Mark Zuckerberg, alleging the company used millions of pirated books and articles to train its Llama AI model without permission.

Court proceedings in the Musk v. Altman dispute produced testimony suggesting Sam Altman may have been negotiating on both sides of a proposed deal involving OpenAI‘s nonprofit and for-profit entities, with Jared Birchall‘s testimony raising scrutiny of valuation arrangements and governance structures.

At a separate trial over OpenAI’s shift to a for-profit model, expert witness Stuart Russell warned of risks from an AI arms race driven by competition to achieve artificial general intelligence.

⸻

🎬 IP, media & creative industries

China‘s microdrama industry is being rapidly transformed by AI video tools, with nearly 50,000 AI-generated short dramas uploaded to Douyin in March alone, close to matching the platform’s total 2025 output, at production costs as low as $30 per minute. The market is projected to exceed $3 billion this year. xAI’s newly launched voice-cloning suite, which enables replication from short audio samples, is raising concerns about impersonation and fraud, despite enterprise gating and geographic restrictions.

⸻

💰 Tech business & markets

OpenAI CFO Sarah Friar is working to prepare the company for a potential IPO, with discussions held with stock exchange officials but no formal process begun. Friar has reportedly urged more caution on data centre commitments and suggested the company may need until 2027 to be ready for public-market reporting standards. Anthropic‘s compute partnership with SpaceX and product expansion announcements triggered share price declines in several financial data companies and broader market reactions.

HMC Capital is pivoting away from the US data centre market, selling a $1 billion Chicago asset and redirecting investment into Australia, citing more reliable energy supply and regulatory constraints including data centre development bans in multiple US states.

Stack Infrastructure, owned by Blue Owl Capital, is considering a sale of Asia-Pacific data centre assets, including facilities in Australia, Japan, and Malaysia, valued at more than $30 billion.

Microsoft is in discussions to delay or abandon its 2030 clean energy target matching hourly electricity consumption with renewable purchases, as data centre expansion increases energy demand.

⸻

🌏 Global policy

🇦🇺 Australia

Australian Assistant Minister Andrew Charlton urged governments and businesses to prioritise domestic AI procurement to strengthen national capability and reduce reliance on foreign providers, warning that dependence on overseas AI firms could shift economic value offshore and increase strategic vulnerability.

The government has adjusted procurement rules to prioritise Australian AI firms and has highlighted Australia’s growing AI sector, now comprising over 1,500 companies. New research, however, found only 1% of Australians fully trust AI, with 44% expressing no trust, ranking Australia near the bottom globally; 70% of respondents said stronger regulation would increase their confidence.

In a piece for The Age, Australia was urged to deepen AI cooperation with Japan as a hedge against dependence on both the US and China, framing Tokyo as a key regional partner aligned with Australia’s strategic outlook, a framing reinforced by the formal Australia–Japan Strategic Cyber Partnership announced this week.

In The Strategist, Jason Van der Schyff and James Corera argued that Microsoft‘s A$25 billion investment in Australian AI and cloud infrastructure positions Australia as a potential trusted digital hub in the Indo-Pacific, but that gaps in domestic crisis prioritisation, cross-border coordination and regulatory clarity must be addressed for Australia to realise a strategic leadership role in regional digital resilience.

Separately, Australia allocated $74 million to establish a Counter Terrorism Online Centre led by ASIO and the AFP to monitor online radicalisation, following the Bondi terror attack.

A cyber breach involving Instructure‘s Canvas learning management system affected major Australian universities and TAFE providers, with the National Cyber Security Coordinator assessing the scale of compromised Australian data.

ALS separately restored most services after a cyber incident involving unauthorised third-party access, with data impacts under ongoing review. Ransomware actors SafePay claimed a breach of Australian energy management firm Energy Action, threatening to release stolen data within days.

🇺🇸 United States

The Trump administration is considering tighter oversight of advanced AI models before public release, including a vetting regime requiring government approval, stricter federal contracting rules, and measures to limit private sector resistance to government AI use, marking a departure from its earlier deregulatory approach.

US Congress passed a short-term extension of Section 702 of the Foreign Intelligence Surveillance Act to June 12, following disagreement over provisions in a longer-term bill.

US House Democrats are focusing AI messaging on data centre energy costs ahead of midterm elections, with critics arguing this avoids broader debates over job losses, privacy, and safety.

State-run US health insurance websites were found sharing sensitive user data, including race, location, and citizenship status, with Meta and TikTok through advertising trackers, highlighting gaps in federal privacy protections.

🇪🇺 Europe

EU lawmakers and member states agreed to delay high-risk AI obligations under the EU AI Act until December 2027, exempt industrial AI applications from parts of the law following pressure from Germany and industry groups, and introduce new bans on AI-generated sexualised deepfakes and child sexual abuse material.

The European Commission separately blocked EU funding for solar projects using inverters from “high-risk” vendors including Huawei, citing risks to energy infrastructure from remote interference, extending EU supply chain scrutiny from telecoms into energy.

European institutions and member states increased pressure on Anthropic over its restricted access to the Mythos model, with 30 MEPs requesting a European mitigation plan and the European Commission signalling it may compel model access once the EU AI Office‘s enforcement powers begin in August 2026.

The EU’s €20 billion AI computing hub initiative is facing criticism over unclear demand and strategic direction, with concerns about reliance on US chip suppliers and limited European AI firms capable of using such infrastructure. The EU and UK agreed to begin negotiations on British access to a new €5 billion tech scale-up fund designed to address funding gaps for late-stage technology companies.

France and Spain are pushing for EU rules prioritising European companies in upcoming satellite spectrum allocations ahead of the expiry of existing US operator licences in 2027.

EU officials are considering a Cloud and AI Development Act that a senior Commission official said would reduce dependence on foreign cloud providers, with European industry groups warning that hybrid arrangements involving US firms could undermine sovereignty provisions.

Belgium‘s foreign minister urged the EU to adopt stronger measures against Chinese industrial overcapacity across chemicals, pharmaceuticals, automotive, metals, and critical minerals sectors.

EU officials warned that proposed social media restrictions for minors require broader measures beyond a simple ban, with political momentum building for EU-wide age restrictions while enforcement and age-verification concerns remain unresolved.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 25 April 2026 to 1 May 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

Australia’s AI moment requires a copyright compromise

I’ve just finished reading a fantasy novel written entirely by an artificial intelligence. The Second Son of the House of Bells is the story of a young bellmaker whose keen musical ear makes him an agent of political revolution in a world in which legal transactions and hence power are mediated through song.

Like much about AI in 2026, the novel was imperfect but a big improvement on the technology from even a year ago and a harbinger of things to come. Crucially, the AI grasped that a good story needs a hero who overcomes obstacles in pursuit of a goal and changes both himself and the world along the way. In another five years we could see an AI-authored novel that to an average reader resembles the heights of Moby-Dick or Middlemarch.

Australia’s content-creating industries should take note as they fight to preserve the country’s strict copyright laws at all costs. Right now, they’re battling to protect their modest turf as Neanderthals once tried to fend off encroaching Homo Sapiens. Their case is worthy but blinkered to the reality that the rapid advance of AI models isn’t going to stop. The better pathway for Australia is to establish itself as an indispensable part of the AI revolution and, in parallel, find new ways to protect artists while raising audiences that make intelligent, informed decisions about what they value in books, films, art, music and media.

The best way to carve out a role for ourselves is through the construction of data centres that train and operate AI models. Under Australia’s restrictive copyright laws, AI companies are reluctant to train their models here for fear of committing infringements, and hence are cautious about investing.

Right now, our copyright laws aren’t helping anyone. Tech companies can already include most Australian content in the enormous data sets on which AI models are trained to set their weights — the neural connections that enable the model to think. They’re just doing it in data centres overseas.

AI giants shouldn’t pay nothing. That would hasten the shift in balance from the already precarious economic potential of human creators to the growing economic momentum of AI creators. Whatever compromise arrangement the Australian government comes up with isn’t going to halt that global shift, but it will help buy our artists and media companies time while we figure out how to preserve our culture and modernise our information landscape for this new reality.

A framework in which AI companies pay into an Australian fund that is distributed among copyright holders by a government-backed agency makes most sense. The Australian public seems to get this. A survey commissioned by the non-profit Good Ancestors and conducted by YouGov found that 61 percent of respondents supported changing copyright arrangements while still supporting Australian creators if that meant enabling AI training in Australia and hence encouraging investment. Only 15 percent wanted laws to be kept in their current form.

Encouraging data centre investment for frontier AI will attract clusters of innovation, strengthen Australia’s strategic position in its neighbourhood by making it a compute hub and earn it leverage in discussions about AI global governance. We can build applications at the higher end of the AI stack, but our immediate natural strength is computing infrastructure, given our land, renewable energy, political stability and geo-strategic depth.

Some of the proceeds of the economic activity this generates — which McKinsey & Company this month estimated at $80 billion a year from 2030 — could then be directed to support our creative industries.

Fixing the copyright issue to create a relatively low-friction environment in Australia for data centre investment is therefore the number one priority.

Over the long term, the challenge is to recognise that these are categorically new problems, requiring a shift in mindset, laws and institutions. Increasingly, AI-generated output will compete directly with human creations in a content market.

Memorable though singer-songwriter Nick Cave’s description of composition as an “act of self-murder” was, the audience also gets a vote. The literary world has already had several “Turing Test” moments, most famously the withdrawal of the US horror novel Shy Girl after the publisher discovered AI was used in the writing.

Should we care whether a novel or a song arose from authentic human experience, including suffering, if it resonates meaningfully with an audience? Could we accept a chatbot posing as a human to extract leaked government information if it exposes a scandal in the public interest? What’s the future for elected politicians’ speeches if their staff are using AI in the drafting because AI can do a better job?

The answers to these and thousands of similar questions will depend on the values we apply, which in turn will vary from country to country.

The way we’re entertained, the way we deepen our understanding of ourselves and others by consuming art, the way we arm ourselves with information so that we can usefully participate in our democracy — all of this is changing.

Australia won’t protect itself by building a fragile moat through measures like copyright. The sooner we accept that AI advances are real and continuing, and that this is going to fundamentally change content industries, the sooner we can prepare for that future — and do so from a position of relative strength by being part of the AI industry rather than resisting it.

— David Wroe, Resident Senior Fellow and Head of ASPI’s AI and Security Program

What We’re Tracking

DeepSeek launches V4 as China pushes open-source AI

What happened: DeepSeek released preview versions of V4 Flash and V4 Pro, its long-awaited follow-up to R1, according to Bloomberg, The Wall Street Journal and The New York Times.

DeepSeek described V4 as its most powerful open-source model, with gains in coding, reasoning and agentic tasks. The company also expanded the model’s context window for longer conversations, documents and code.

The release comes as DeepSeek faces computing constraints. Bloomberg reported that DeepSeek expects prices to fall after Huawei’s Ascend 950 computing clusters launch in the second half of this year.

Why we’re tracking this: The release extends China’s open-source AI push. The New York Times reported that Chinese open-source models accounted for roughly one-third of global AI use last year, with DeepSeek the most widely used.

What people are saying:

• “They are basically neck and neck,” Rayan Krishnan, chief executive of Vals AI, told The New York Times comparing DeepSeek V4 and Moonshot AI’s latest model.

• “The rapid iteration of new AI models makes it difficult to determine an ultimate winner,” Alicia Yap, analyst at Citi, wrote, according to The Wall Street Journal.

• “Open source is the soft power of technology of the future,” Kevin Xu, founder of Interconnected Capital, told The New York Times.

My view: V4 landed flat compared to R1. When R1 dropped, the reflex reaction was that efficiency had changed the game and compute mattered less. That read has aged badly. As agentic systems and reasoning models have scaled, it’s become clear that efficiency and compute aren’t substitutes — you need both. That’s likely part of why DeepSeek is now reportedly seeking external investment for the first time. But benchmarks miss what makes DeepSeek strategically significant. Its real role is anchoring an AI ecosystem inside China; one that, because it runs on open weights, is becoming the base layer for developers and businesses well beyond it. Quietly, that is shifting where AI power accumulates.

— Fergus Ryan, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

ASPI‘s updated China Defence Universities Tracker documents joint research between Chinese and Iranian institutions over 15 years in dual-use technologies including nanotechnology, aerospace and AI. The volume of China–Iran joint research remains low compared to China–Russia ties, which grew after 2019.

China blocked Meta‘s approximately $2 billion acquisition of AI startup Manus on national security grounds. The National Development and Reform Commission and Ministry of Commerce reviewed and cancelled the transaction, directing full restoration of Manus’s assets. Meta is preparing to unwind the deal, with Chinese authorities requiring removal of transferred data from its systems and Manus co-founders remaining in China pending investigation.

China, separately, plans to restrict domestic technology firms from accepting U.S. investment without government approval, instructing companies to reject U.S.-origin capital unless explicitly authorised. Regulators have directed firms including Moonshot AI, StepFun and ByteDance to limit U.S. capital access, citing national security concerns following recent acquisitions.

The White House accused China of conducting extensive theft of AI intellectual property, saying Chinese actors are systematically targeting models, algorithms and datasets developed by American companies and research institutions. The U.S. Commerce Department, meanwhile, issued letters halting chip equipment shipments to two Hua Hong facilities, targeting development of 7-nanometre process technology that officials believe could produce advanced AI chips for blacklisted firms including Huawei.

The House Homeland Security Committee and House China Select Committee sent letters to Airbnb and Anysphere, maker of AI coding platform Cursor, over their use of Chinese AI models. Anysphere’s Composer 2 was built on Beijing-based Moonshot AI’s Kimi, while Airbnb used Alibaba‘s Qwen for a customer service agent. Both committees cited national security risks and requested in-person briefings.

DeepSeek released preview versions of its flagship V4 model series, including V4 Flash and V4 Pro. The company acknowledged the models trail state-of-the-art U.S. frontier models by three to six months, though the open-weight release undercuts U.S. competitors on price amid ongoing allegations of adversarial model distillation.

U.S. Defence Secretary Pete Hegseth disparaged Anthropic CEO Dario Amodei at a Senate Armed Services Committee hearing over the company’s refusal to allow its chatbot to be used for mass surveillance or fully autonomous weapons; the Pentagon designated Anthropic a national security threat in March. The White House has separately blocked Anthropic’s proposal to expand access to its Mythos model from approximately 50 to 120 organisations, citing security concerns and insufficient computing capacity. The NSA, meanwhile, has been testing Mythos to identify cybersecurity vulnerabilities in popular software, including Microsoft products.

Google has reportedly entered a classified AI agreement with the U.S. Pentagon, joining firms including OpenAI and xAI. Over 600 employees have petitioned CEO Sundar Pichai to block the use of Google’s AI in classified Pentagon work, citing ethical concerns about military applications. Separately, U.S. military leaders said AI and autonomous systems will become central to warfare but emphasised challenges in securing and controlling private-sector AI tools used in battlefield decision-making.

The U.S. government’s stake in Intel Corp. has reached approximately $36 billion, a 300 per cent paper return since the investment was announced. The surge follows an improved financial outlook and a resurgence in sales, with shares hitting an all-time high.

China has removed direct mentions of its military-civil fusion strategy from the outline of the 15th Five-Year Plan. Infrastructure for the strategy remains intact, including the Central MCF Development Commission and provincial-level offices, with evidence suggesting it has moved to non-public documents to avoid U.S. sanctions and scrutiny.

China’s commercial Earth observation satellite sector has grown to second only to the U.S. in total satellites in orbit. Chang Guang Satellite Technology, partly state-owned, has been sanctioned by the U.S., EU, Japan and Taiwan for supplying satellites to the Wagner Group and allegedly to Iran‘s Revolutionary Guard Corps, with Chinese EO satellites now achieving sub-metre resolution.

Utah-based intelligence firm Strider Technologies is seeing rapid growth as U.S. states and the federal government increase scrutiny of foreign investment. The firm uses agentic AI to map global industrial data and has nearly tripled its revenue, serving NATO and major Fortune 500 companies across 16 countries.

⸻

🧠 AI models, agents & compute

Google has committed to a $US10 billion cash investment in Anthropic at a $US350 billion valuation, with an additional $US30 billion contingent on performance targets. The deal includes Google Cloud providing 5 gigawatts of computing capacity over five years, following a surge in demand for Anthropic’s AI coding agent Claude Code.

Anthropic has appointed Theo Hourmouzis as general manager for Australia and New Zealand as it opens a Sydney office. The move follows an April memorandum of understanding with the Australian government to share AI risk data and adoption metrics under the National AI Plan. The company is also exploring local investment in data centre and energy infrastructure.

OpenAI released a five-principle framework for AGI development, including commitments to democratisation, user empowerment, universal prosperity, resilience and adaptability. CEO Sam Altman acknowledged the company’s increased scale since its 2018 Charter and the possibility of trade-offs between openness and security. The framework was subsequently published on OpenAI’s website.

Meta plans to cut approximately 8,000 employees — 10 per cent of its workforce — in May to fund AI investments, while increasing AI infrastructure spending to up to $135 billion this year. Microsoft, meanwhile, is offering voluntary redundancies to 8,000 U.S. staff to offset capital expenditure on AI infrastructure.

Helsinki-based Verda has raised €100 million in debt and equity to expand its AI-focused hyperscale computing platform across Europe, positioning itself as an alternative to dominant U.S. cloud providers.

Oracle has entered a $2.3 billion agreement with Canberra-based modular data centre manufacturer Datapod to support its global AI infrastructure expansion. The six-year deal includes a $100 million initial payment for deployments in the U.S. and Europe.

Meta has partnered with Overview Energy and Noon Energy to explore powering AI data centres using space-based solar energy and long-duration storage. Overview Energy plans to collect solar power via satellites and beam it to Earth-based receivers, targeting commercial delivery by the end of the decade.

A 23-year-old amateur used ChatGPT to solve a longstanding mathematical conjecture about primitive sets that had resisted expert efforts for decades. Researchers said the AI-generated solution introduced a novel method, though it required expert refinement to validate.

⸻

🛡 Cyber posture

The NCSC-UK and 15 international partners, including the ACSC, CISA, FBI and NSA, issued a joint advisory on China-nexus cyber actors’ use of large-scale botnets built from compromised SOHO routers and IoT devices to conduct espionage and offensive operations. The networks, used by groups including Volt Typhoon and Flax Typhoon, are constantly refreshed, rendering static IP blocklists ineffective.

A China-aligned threat group designated GopherWhisper by ESET targeted a Mongolian government entity using malware and legitimate platforms such as Slack, Discord and Microsoft 365 Outlook for command-and-control operations. Active since at least 2023, the group deployed custom tools including the LaxGopher backdoor to maintain access and exfiltrate data.

Italy has extradited Chinese national Xu Zewei to the United States over alleged involvement in the HAFNIUM hacking campaign, which compromised thousands of systems globally including U.S. universities and research institutions. He faces charges including wire fraud and unauthorised computer access, and could face up to 77 years in prison if convicted.

A China-linked influence operation associated with the Spamouflage network targeted elections for the Tibetan parliament-in-exile using inauthentic social media accounts and AI-generated images. The Digital Forensic Research Lab identified more than 100 accounts involved across platforms, though the campaign generated little authentic engagement.

Ukrainian authorities dismantled a bot farm supplying more than 20,000 fake social media accounts to Russian intelligence for disinformation campaigns. Police arrested a suspect in the Zhytomyr region and seized equipment and thousands of SIM cards used to generate and sell fake accounts.

U.S. officials and cybersecurity experts assess that Iranian cyber operations are more likely to involve opportunistic, low-level intrusions than large-scale disruptive attacks. These campaigns typically exploit basic security weaknesses such as compromised credentials and are paired with information operations to amplify perceived impact.

Hackers are using Microsoft Teams impersonation and phishing tactics to deploy data-stealing malware in corporate networks, according to Mandiant. The campaign, tracked as UNC6692, combines email flooding with fake IT support messages to trick users into installing a malicious browser extension.

Home cybersecurity company ADT disclosed a cyber intrusion in which attackers accessed and stole customer data including names, addresses and partial Social Security numbers. The ShinyHunters group claimed to have obtained up to 10 million records.

Canadian authorities arrested three suspects in the country’s first criminal case involving mobile SMS blasters — devices that mimic cellular towers to send mass phishing messages. Police recorded more than 13 million disruptions and said tens of thousands of phones connected to rogue systems.

Sri Lanka is investigating a cyberattack that diverted $2.5 million intended for a sovereign debt repayment to Australia, exposing weaknesses in state financial systems. The incident has triggered political scrutiny and calls for an independent inquiry.

New research shows 30 per cent of Australian organisations were targeted by ransomware in the past year, with a third of victims paying demands. Among those who paid, 46 per cent did not recover their data or were extorted again, with attackers increasingly embedding themselves in networks for over 200 days before launching attacks.

NATO cyber specialists joined Norway and Iceland in Exercise Locked Shields, the world’s largest live-fire cyber defence exercise, involving nearly 4,000 participants. The exercise simulated attacks on critical infrastructure including 5G networks, power grids and voting systems.

The Australian Defence Force is expanding cyber and information warfare capabilities through a pilot training program involving Australian and New Zealand personnel, coinciding with the second anniversary of ADF Cyber Command. University of Queensland students will separately compete as part of Team Oceania in the International Cybersecurity Challenge, hosted alongside the AUSCERT conference.

The UK National Cyber Security Centre has developed and commercialised a device called SilentGlass to block malicious connections between monitors and computers, targeting hardware-based cyber threats in critical infrastructure and enterprise settings.

⸻

🕵️ Surveillance states

Researchers at Citizen Lab found surveillance vendors are exploiting telecom infrastructure vulnerabilities to track individuals’ locations by impersonating cellular providers. The campaigns used malicious SMS commands and exploited weaknesses in SS7 and Diameter signalling protocols across 3G, 4G and 5G networks, with a possible link to an Israeli company.

Australian government records show Palantir‘s Gotham platform was used by the Australian Criminal Intelligence Commission to analyse 42 million data points, including intercepted phone records, metadata and police databases. A training manual details how data is ingested, linked and mapped, with default access settings often left at “everyone.” Federal spending on Palantir contracts has reached $60 million, including a recent $10.39 million Defence deal that limits audits and subjects disputes to London-based arbitration.

The Metropolitan Police in London launched investigations into hundreds of officers after using Palantir AI software to analyse internal data for misconduct. The tool identified 98 officers for IT system abuse related to shift rostering and 42 senior officers for violating work-from-home policies, with three arrests for serious criminal offences including sexual assault and fraud.

Widespread Kremlin efforts to throttle apps including Telegram, YouTube and WhatsApp have sparked rare public dissent among ordinary Russians, influencers and opposition politicians. The digital crackdown aims to force users onto government-monitored alternatives and has contributed to President Putin‘s approval ratings falling to pre-war levels.

The Kremlin is systematically building a global media conglomerate through cooperation agreements with foreign outlets and journalist training programs, targeting Africa, Asia and Latin America. TASS claims partnerships with 200 outlets across 114 countries, while SputnikPro has trained over 12,700 journalists globally. Russia has prioritised China, Iran and India since 2022.

⸻

⚖️ Platform accountability

OpenAI CEO Sam Altman apologised for failing to alert law enforcement about a user later identified as the suspect in a February mass shooting in Canada that killed eight people. The company had flagged and suspended the user’s ChatGPT account after detecting violent content but chose not to notify authorities. Seven families of victims filed federal lawsuits against OpenAI and Altman in Northern California, alleging the chatbot deepened the shooter’s violent fixation and that the company knowingly failed to report the threat.

An investigation alleges that Acutus, an anonymously operated website presenting itself as independent journalism, is largely generated by AI, with bots posing as reporters to solicit quotes from experts. Analysis of site code and content found most articles were AI-produced with minimal human oversight, with circumstantial links to political networks connected to OpenAI’s super PAC identified but not directly confirmed. The investigation was reported further by Futurism.

New Mexico Attorney General Raúl Torrez condemned Meta for threatening to withdraw Instagram and Facebook from the state following a jury verdict ordering the company to pay $375 million for violating the state’s Unfair Practices Act over children’s online safety. Meta filed court documents arguing the state’s demanded protections for under-18 users were not technically achievable, with a bench trial on user protections beginning 4 May.

Meta is automatically restricting content at scale in India in response to government and police takedown requests under local laws. The system operates through official channels such as the Sahyog portal, and the company does not restore content even if later deemed improperly removed, instead requiring government approval for reinstatement.

Meta told a California court it failed to preserve rendered versions of scam advertisements at the centre of Andrew Forrest‘s lawsuit, contradicting a promise made to a judge in 2023. The presiding judge signalled concern about a possible pattern of evidence non-preservation. Meta offered a concession accepting that it had optimised ads delivered to users, which could help Forrest defeat Meta’s Section 230 immunity defence.

Sam Altman-backed World ID has secured partnerships with companies including Tinder, Zoom and DocuSign to verify users and combat fraud, despite widespread regulatory resistance globally. Governments across Europe, Asia, Africa and Latin America have restricted or banned the biometric system over privacy concerns tied to iris data collection.

⸻

🧒 Online harms & child safety

A survey of 1,050 Australians aged 12–15 found over 60 per cent of teens retained access to at least one social media platform despite Australia‘s under-16 ban. Users are bypassing age-verification measures using methods such as parents’ IDs, face masks and VPNs, while platforms have largely failed to deactivate existing accounts.

Norway‘s government plans to introduce legislation banning children under 16 from using social media, requiring platforms to enforce age verification. The proposal follows similar measures advancing or under consideration in France, Spain, the Netherlands and the UK.

The European Commission issued preliminary findings that Meta violated the EU‘s Digital Services Act by failing to prevent under-13s from accessing Facebook and Instagram, noting children could use fake birthdates with no verification. If upheld, Meta faces fines of up to 6 per cent of global annual turnover. The commission separately urged EU member states to deploy an EU age verification app by end of 2026.

The Senate Judiciary Committee unanimously backed legislation requiring AI companies including OpenAI and Meta to implement strict age verification, bar AI companions for minors and prohibit chatbots from pushing sexually explicit content or self-harm messaging to minors.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Elon Musk testified in federal court against OpenAI co-founders Sam Altman and Greg Brockman, alleging they improperly converted the nonprofit into a for-profit entity. During testimony, Musk indicated that his own venture xAI had used OpenAI’s models to train its own, acknowledging some degree of distillation had taken place. OpenAI’s legal team contends the suit is an attempt to undermine a competitor.

The U.S. Department of Justice has joined xAI in challenging Colorado‘s new law regulating AI use in employment and other high-stakes decisions. The lawsuit argues the law violates constitutional protections; the legislation mandates transparency, bias assessments and ongoing monitoring for AI systems used in hiring, healthcare and housing.

The Trump administration has lobbied Republican-led states including Florida, Utah, Nebraska, Missouri, Tennessee and Louisiana to abandon or weaken AI regulation bills, warning states they could lose federal broadband funding. Separately, the administration removed Collin Burns from his role leading the Center for AI Standards and Innovation days after his appointment, citing concerns over his past links to Anthropic.

The U.S. Supreme Court heard arguments in Chatrie v United States, testing the constitutionality of geofence warrants that compel tech companies to provide location data for all devices within a specific radius. Justices signalled concern about the breadth of such searches and indicated location data collection should require a warrant under the Fourth Amendment.

U.S. authorities arrested a special operations soldier accused of using classified information to place bets on prediction market Polymarket, generating over $400,000 in profit by wagering on the removal of Venezuelan President Nicolás Maduro. Separately, French authorities are investigating suspected tampering with a temperature sensor at Paris Charles de Gaulle Airport after anomalies coincided with successful Polymarket bets.

The U.S. Treasury has sanctioned Cambodian senator Kok An and 28 associates for operating scam compounds linked to millions in fraud losses. The network used casinos and office complexes to conduct digital investment scams and exploit trafficked workers under coercive conditions. U.S. agencies also seized hundreds of domains tied to the network.

A Taiwanese court sentenced former Tokyo Electron engineer Chen Li-ming to 10 years in prison for stealing proprietary data from Taiwan Semiconductor Manufacturing Co. Four additional defendants received sentences of up to six years.

Tennessee has enacted a ban on cryptocurrency ATMs, citing their role in facilitating fraud, following similar action in Indiana. FBI data shows $389 million lost to crypto ATM-related scams in 2025. Separately, a California man was sentenced to 70 months for laundering cryptocurrency stolen by a group responsible for about $260 million in thefts.

President Trump hosted top holders of his memecoin at a Mar-a-Lago luncheon, linking crypto policy with broader economic and technology themes. The value of his associated token remains near recent lows.

⸻

🎬 IP, media & creative industries

Taylor Swift has filed trademark applications to protect her voice and image from unauthorised AI-generated use, including specific spoken phrases and a distinctive stage appearance. Legal experts say trademark protection could allow action against content that is confusingly similar to her likeness or voice.

⸻

💰 Tech business & markets

The Wall Street Journal reported OpenAI missed several revenue and user targets in recent months, raising concerns about its ability to service compute commitments of up to $US850 billion through 2030 with Oracle, Amazon, Microsoft, Google and CoreWeave. OpenAI’s CEO and CFO jointly denied the reports. The news triggered share falls in Oracle, CoreWeave and SoftBank.

Google, Meta and Amazon Web Services sent more than $14 billion from Australian operations to offshore parent entities in 2025, under reseller business models that shift revenue abroad. The companies reported over $8.5 billion in local revenue but paid $212 million in income tax. Meta’s Australian subsidiary reported $1.74 billion in gross advertising revenue for 2025 and transferred $1.51 billion offshore as reseller fees.

Liquid Instruments, an ANU-founded measurement technology startup, has raised $70 million at a valuation above $400 million, led by U.S. rival Keysight Technologies and the National Reconstruction Fund. The company’s devices are used by Nvidia, Lockheed Martin, Blue Origin, BYD, PsiQuantum and Intel.

Melbourne-based Andromeda Robotics has deployed 22 units of its humanoid companion robot Abi across aged care provider Mecwacare, reaching more than 1,500 residents. The company has raised $23 million and expanded to the U.S., with the technology operating in a regulatory grey area with no clear classification as a medical device or consumer product.

⸻

🌏 Global policy

🇦🇺 Australia

The Albanese government has unveiled a draft News Bargaining Incentive scheme, proposing a 2.25 per cent levy on the local revenue of digital platforms with over $250 million in annual earnings and significant user bases. The scheme, targeting Meta, Google and TikTok, allows companies to avoid the levy by signing commercial deals with news publishers. Meta and Google have rejected the reform.

The Australian Banking Association has launched a lobbying campaign ahead of the federal budget, arguing global technology companies face lighter regulation and taxation than domestic banks. The industry is calling for regulatory parity for multinational tech and payments firms, targeting digital wallets, buy-now-pay-later providers and global payment platforms.

Australian government research has found that AI has not yet significantly reduced entry-level employment, with only modest slowing in job growth for the most exposed roles. The government is establishing a tripartite AI Employment and Workplaces Forum to examine how AI adoption affects jobs, productivity and workforce outcomes.

Australian government agencies have been instructed to implement new principles on the use of AI in recruitment processes. Guidance from the Australian Public Service Commission sets expectations for managing candidate use of AI tools and maintaining fairness in hiring assessments.

The Commonwealth Ombudsman is reviewing the use of an automated assessment tool that determines aged care support funding under the Support at Home program. The Australian Human Rights Commission has backed the review amid rising appeals against decisions made by the algorithmic system, with concerns focused on transparency and human oversight.

UK-based AI platform Beam has launched in Australia, positioning its tools to address administrative pressures in the National Disability Insurance Scheme amid planned cuts. Trials with service providers showed reductions in paperwork, though the rollout has prompted debate over the role of AI in social services, including concerns about bias and automated decision-making.

Amazon has launched an AI-powered video tool for Australian retailers, enabling users to create photorealistic video advertisements from product images within minutes. The company says safeguards are in place to ensure ads accurately represent products.

Australian universities, led by UNSW, are tightening research restrictions involving Iran, Russia, Belarus and North Korea following updated federal government advice. UNSW’s Pro Vice-Chancellor warned staff that even informal collaboration could breach sanctions, potentially resulting in criminal penalties of up to 10 years in prison. The Group of Eight confirmed institutions are conducting due diligence on all international partnerships.

In The Strategist, ASPI authors argued that Microsoft‘s A$25 billion investment in Australian AI and cloud infrastructure positions Australia as a potential hub for trusted digital infrastructure in the Indo-Pacific, but identified three governance gaps — domestic crisis prioritisation authority, cross-jurisdictional coordination with Five Eyes partners, and operational obligations for technology providers — that must be addressed.

Separately in The Strategist, human rights experts argued that China’s 15th five-year plan designation of brain-computer interfaces as a strategic industry requires Australia to set rules for neurotechnology use. The ADF has already trialled neurotechnologies enabling neural control of robotic systems; the authors called for lifecycle-based weapons reviews and clear consent protections for military personnel.

In The Australian Financial Review, union leader Joseph Mitchell argued that Australia must establish a licensing regime and empower the National AI Safety Institute to interrogate AI training data and guardrails before models are deployed. The call followed restricted U.S.-only previews of Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber.

🇺🇸 United States

Donald Trump has threatened to impose tariffs on the UK if it does not remove its digital services tax, which targets revenues of major technology firms. The tax generated £944 million in 2025–26 and is projected to reach £1.4 billion annually by 2030. UK officials have indicated the tax will remain until a global agreement is reached.

Governor Janet Mills of Maine vetoed legislation that would have blocked new data centres in the state until November 2027. The governor supported the idea of a temporary halt but rejected the bill due to the lack of an exemption for a major project expected to generate jobs and investment.

🇪🇺 Europe

EU member states and European Parliament lawmakers failed to agree on proposed revisions to the AI Act following twelve hours of negotiations. The changes are part of a broader Digital Omnibus package intended to simplify digital regulations, with disputes centring on proposed exemptions for industries already governed by existing sectoral product safety rules.

EU regulators have proposed measures to require Google to open its Android ecosystem to competing AI services. The European Commission said the company must ensure rival AI systems can interact with apps on Android devices and perform tasks effectively.

🇬🇧 United Kingdom

UK ministers are resisting closer alignment with the EU‘s AI regulatory framework, citing concerns over impacts on the domestic technology sector and relations with the United States.

The UK government has revised its 10-year carbon emission estimates for AI data centres upward by more than 100 times. New data from the Department for Science, Innovation and Technology suggests the AI buildout could generate up to 123 million tonnes of CO₂ between 2025 and 2035. The revision followed investigations by Foxglove and Carbon Brief that challenged the plausibility of initial forecasts. Separately, DSIT and the Department of Energy Security and Net Zero have provided conflicting energy projections for AI data centres, with DSIT forecasting a need for 6GW of capacity by 2030 while DESNZ projections suggest growth ten times lower.

🇨🇳 China

China introduced its first comprehensive framework regulating gig economy workers, mandating standardised contracts, fair pay and improved working conditions. The policy requires major platforms to adjust compensation structures, increase transparency and submit algorithms for regulatory review.

🇿🇦 South Africa

South Africa withdrew its first draft national AI policy after its reference list was found to contain fictitious AI-generated citations. Minister Solly Malatsi acknowledged the failure compromised the policy’s integrity. The withdrawn draft had proposed a National AI Commission, an AI Ethics Board, an AI Regulatory Authority and private-sector incentives.

🇵🇬 Papua New Guinea

PNG‘s National Court ruled that the Ombudsman Commission exceeded its powers when it issued a 2024 directive halting Starlink‘s licensing process. The ruling clears the way for regulator NICTA to resume the licensing process, with a Starlink licence expected within days or weeks.

🇻🇦 Vatican

The Vatican is expanding AI governance and cybersecurity efforts. It has introduced internal AI guidelines requiring transparency, human oversight and safeguards against manipulation, while Church leadership is discouraging clergy from using AI in religious practice.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 18 April 2026 to 24 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Europe weighs sovereignty against dependence on US cloud and software

What happened: Across Europe, governments are trying to reduce their reliance on American tech vendors, but the process is proving slow, expensive and operationally messy. Amsterdam’s Deputy Mayor Alexander Scholtes told POLITICO that the concern is no longer abstract: if Microsoft stopped offering services, core city functions could be disrupted.

That anxiety has resulted in a policy shift. Reuters reported that the European Commission awarded a €180 million sovereign cloud contract to four European providers, including StackIT, Scaleway and Proximus, under its Cloud Sovereignty Framework.

In France, RFI reported that the state plans to replace Windows with Linux across government computers, though officials have not published a full timeline. The move extends into AI, with Forbes reporting that Mistral is pitching itself as an independence play — a French AI company offering open-weight models to customers who want more control over data, deployment and geography.

Why we’re tracking this: With Washington’s increasing unpredictability, dependence on US software, cloud and AI is now considered a continuity and sovereignty problem, especially where public administration, finance and sensitive data are involved.

The constraints are real. Per POLITICO, Schleswig-Holstein‘s migration to open-source software produced disruption, missing functions and more work for staff. Even advocates of switching describe the alternatives as less mature, or the transition itself as costly and long-term.

What people are saying:

• EU Digital Chief Henna Virkkunen told Reuters that scaling EU cloud use is central to strengthening Europe’s digital sovereignty.

• A spokesperson for De Nederlandsche Bank told Techzine that the bank is explicitly assessing geopolitical risks and looking for ways to reduce dependency with each new cloud step.

• Arthur Mensch, co-founder and CEO of Mistral, told Forbes that being France-based has become central to the company’s product pitch.

My view: Europe’s push for technological independence is a strategic choice born from a long-overdue reckoning. For years, the continent sleepwalked into dangerous dependency, allowing American tech giants to quietly become the backbone of its cloud and data infrastructure. With an increasingly volatile Washington having already shown willingness to weaponise digital access against its own allies — most starkly illustrated when Trump’s executive order sanctioning International Criminal Court officials left a Canadian judge’s bank accounts frozen and a French judge locked out of her digital services last year — Europeans are waking up to an uncomfortable truth: sovereignty means little when your servers answer to someone else’s laws. The response is self-preservation in practice: France is migrating off Windows and Schleswig-Holstein in Germany is embracing Linux. Full decoupling is a long slog and the economic pain is real. But for Europe, the greater risk is doing nothing.

— Dr Fitriani, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

China’s National Security Commission triggered a multi-agency review of Meta’s $2bn acquisition of AI start-up Manus, with regulators examining export control, foreign investment and competition issues and Manus co-founders barred from leaving the country. Chinese authorities also tightened scrutiny of AI firms trying to move ownership, talent or research offshore, with Manus and MiroMind cited as examples of companies facing official pressure. DeepSeek is preparing to release its V4 model, with speculation it may be trained on domestic chips. Japan plans to tighten cybersecurity procurement rules to exclude Chinese IT equipment at the municipal level.

The White House accused China-linked actors of industrial-scale efforts to extract capabilities from US AI models through distillation and surrogate accounts. Nvidia has not yet sold H200 AI chips to Chinese firms despite US approval, with Howard Lutnick saying Beijing is holding back purchases to prioritise domestic chip development. Micron is lobbying US lawmakers to tighten export controls on semiconductor equipment used by Chinese competitors, including YMTC, CXMT and SMIC.

The US and Philippines agreed to establish a high-tech manufacturing zone on Luzon focused on critical minerals, AI-related industries and automated manufacturing. Nigerian drone start-up Terrahaptix is opening a manufacturing facility in Accra to produce drones and counter-drone systems for regional military customers.

In The Intercept, a network of Middle Eastern news sites was linked to US government-funded propaganda operations tied to Pentagon psychological operations programs. Dutch military intelligence chief Peter Reesink warned that China’s cyber-espionage capabilities are now as advanced as those of the United States and are increasingly targeting Western defence industries.

Palantir published a 22-point summary of Alex Karp’s book outlining its view that Silicon Valley should support national security and that AI will underpin military deterrence. The document also criticised pluralism and inclusivity while linking technological leadership to economic growth and security.

⸻

🧠 AI models, agents & compute

Anthropic is in discussions with the US government to provide access to Mythos, with agencies including Treasury seeking access while the White House considers authorisation. Senior officials including Scott Bessent and Susie Wiles met Dario Amodei to discuss cybersecurity, AI safety and access to Mythos. Donald Trump later said a Department of Defense deal was possible, after the Pentagon had designated Anthropic a supply chain risk. The National Security Agency is using Mythos despite the Pentagon’s position.

Amodei said he supports government use of advanced AI for national security but opposes domestic mass surveillance and autonomous weapons. He also said Mythos has identified thousands of cybersecurity vulnerabilities through Project Glasswing and that rival models, including from Chinese developers, could replicate similar capabilities within 6–12 months.

Global financial officials warned that advanced AI models such as Claude Mythos could expose critical banking system vulnerabilities, with discussions at IMF and World Bank meetings focused on cyber risk and weak regulatory frameworks. Anthropic plans to extend Mythos access to European and UK banks after an initial rollout to major US institutions including JPMorgan Chase.

Mozilla said Mythos found 271 vulnerabilities in Firefox 150, after an earlier model found 22 bugs in Firefox 148. Anthropic is investigating claims that unauthorised users accessed Claude Mythos through a third-party vendor environment. A separate account said the group appeared to combine leaked data, open-source intelligence techniques and insider access to interact with the restricted model.

Anthropic briefed Australian critical infrastructure operators on AI-enabled cyberattack risks to essential services such as energy, telecommunications and healthcare. The Department of Home Affairs confirmed the meetings, but the company did not discuss details of its forthcoming Mythos model.

DeepSeek entered talks to raise at least $300mn at a $10bn valuation, before later talks with Tencent and Alibaba put the proposed valuation above $20bn. The company is seeking external funding partly to retain researchers whose compensation depends heavily on stock options.

Tencent opened an international beta for QClaw, a consumer AI agent built on the open-source OpenClaw framework and designed for use through messaging platforms. French AI company Mistral reached a $14bn valuation while selling open-weight models and local deployment to governments and enterprises seeking data control.

Chinese humanoid robots outperformed human runners in a Beijing half-marathon, with the fastest robot completing the race in 50 minutes and nearly half of the machines operating without remote control. Sony AI’s robot Ace defeated elite and some professional table tennis players in regulated matches using high-speed perception and AI-driven control.

Anthropic briefly removed Claude Code from its US$20-a-month Pro subscription tier for some new users, then reversed the change. The company said it was a limited test affecting a small share of new sign-ups, while existing users retained access.

⸻

🛡 Cyber posture

Australia’s 2026 National Defence Strategy allocates $15–21bn to cyber capabilities as part of broader cyber and space investment. The 2026 Integrated Investment Program will invest up to $38bn in space, cyber and electronic warfare over the next decade. The strategy identifies artificial intelligence as a major source of future disruption and a core innovation priority.

In The Strategist, Fitriani and James Corera argued that the new US Cyber Strategy formalises offensive cyber operations as a routine tool of statecraft and signals a more permissive stance toward private-sector involvement in disruption. It said allies such as Australia face coordination and legal questions, including through joint operations such as Operation Aquila.

Canada launched CIREN, a program focused on critical infrastructure resilience against AI-enabled and escalated cyber threats. The UK National Cyber Security Centre assessed that around 100 countries have acquired spyware capable of hacking British infrastructure. Sean Plankey withdrew his nomination to lead CISA after Senate Republicans failed to advance his confirmation.

LayerZero said preliminary indicators point to Lazarus Group as the likely actor behind the $292mn Kelp DAO exploit, which involved forged cross-chain messages after verifier infrastructure was disrupted. Former ransomware negotiator Angelo Martino pleaded guilty to secretly aiding ALPHV/BlackCat while working for victims, including by sharing insurance limits and negotiation strategies.

Analysis of dark web listings found Australian identity packages selling for about US$200, alongside cheap access to credit cards, passports, social media accounts and corporate accounts. France’s ANTS confirmed a breach that may have exposed names, contact details, birth data and account identifiers, while a threat actor claimed to have stolen up to 19mn records. Fraudulent messages offered ships safe passage through the Strait of Hormuz in exchange for cryptocurrency, according to maritime risk firm MARISKS.

⸻

🧒 Online harms & child safety

Australia briefed around 50 countries on its under-16 social media ban model, with similar proposals emerging in Europe and elsewhere. Office of the Australian Information Commissioner concerns about a government-funded age-verification trial were raised repeatedly during the process, with internal emails saying privacy claims were overstated and not tested against Australian law.

Australia’s eSafety Commissioner issued legally enforceable transparency notices to gaming platforms including Roblox and Minecraft, requiring details on measures to protect children from grooming, exploitation and radicalisation. The regulator also named Fortnite and Steam among the platforms asked to explain safety systems, staffing and compliance processes. Separately, eSafety identified game-like versions of real-world terrorist violence circulating online after the Bondi attack, alongside widespread distribution of raw footage.

Cybersecurity experts identified major vulnerabilities in the European Commission’s new age-verification app within hours of release, including unprotected storage of sensitive data and bypassable biometric safeguards. In The Verge, Emma Roth set out privacy, security and accuracy trade-offs across AI age inference, ID verification, app-store checks and zero-knowledge proof approaches.

The UK government will introduce a statutory ban on mobile phones in schools in England by amending the Children’s Wellbeing and Schools Bill. Ofcom opened an investigation into Telegram over suspected failures to prevent the spread of child sexual abuse material. Parallel probes also target teen chat platforms and risks linked to AI-generated explicit content.

Turkey passed legislation restricting social media access for children under 15 and requiring age verification, parental controls and rapid removal of harmful content. The Los Angeles Unified School District voted to impose system-wide screen-time limits, including a ban on device use for early-grade students and parental opt-outs.

In The Washington Post, analysis of more than 1,400 hours of streams found far-right streamer Nick Fuentes received nearly $900,000 in superchat donations from about 11,000 donors between January 2025 and March 2026. The article said a small core of donors supplied a disproportionate share of the money after bans from mainstream platforms.

⸻

🕵️ Surveillance states

Meta plans to deploy software capturing employees’ mouse movements, clicks, keystrokes and screen activity to train AI systems capable of performing workplace tasks. The company says the data will not be used for performance evaluation, while experts cited in the source warned about workplace surveillance and privacy risks.

The UK High Court ruled that London’s Metropolitan Police can continue deploying live facial recognition, finding the technology complies with human rights law despite a privacy challenge. A US federal judge blocked government pressure on platforms to remove apps and groups tracking immigration enforcement activity using public information.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Australia’s Federal Court issued new rules for generative AI in legal proceedings, requiring lawyers to verify citations, disclose AI use in filings and avoid entering confidential information into AI systems. Florida prosecutors opened a criminal probe into OpenAI over whether ChatGPT could bear legal responsibility after a mass shooter allegedly used the chatbot to plan an attack.

The Consumer Federation of America sued Meta, alleging the company misled users about its efforts to combat scam advertising on Facebook and Instagram. India’s Competition Commission escalated its antitrust case against Apple after the company failed to submit financial data needed to assess penalties tied to alleged abuse of dominance in the iPhone app ecosystem.

Kalshi suspended and fined three US congressional candidates for trading on the outcomes of their own elections. Justin Sun sued World Liberty Financial, alleging the Trump family-backed crypto project unlawfully froze his $WLFI tokens and misrepresented investor rights.

The US Justice Department refused to assist French authorities investigating Elon Musk’s X, arguing the probe seeks to regulate an American company and implicates free speech protections. French prosecutors are examining X over alleged algorithmic bias, deepfakes and illegal content.

⸻

🏛️ Government, procurement & public sector tech

Google is in talks with the US Department of Defense to deploy Gemini models in classified environments, with provisions reportedly covering domestic surveillance and autonomous weapons. The European Commission awarded a €180mn sovereign cloud contract to Post Telecom, StackIT, Scaleway and Proximus for cloud services across more than 40 EU agencies.

German Chancellor Friedrich Merz called for lighter EU regulation of industrial AI, saying Germany would push to ease regulatory burdens and potentially exempt industrial uses from stricter consumer AI rules. European governments are pursuing open-source and local technology alternatives, while US firms retain around 70% of the EU cloud market.

Australia is proposing stricter data centre security rules requiring executives and directors to undergo security vetting and introducing foreign ownership, control or influence tests for facilities handling government data. LinkedIn is expected to be excluded from Australia’s planned News Media Bargaining Incentive laws, with draft legislation expected soon and existing media-platform deals expiring over the next few months.

The OAIC and eSafety Commissioner formalised an MOU on cooperation, information sharing and regulatory coordination under the Privacy Act and Online Safety Act. Australian Federal Police Commissioner Krissy Barrett outlined plans to expand sovereign capability, invest in AI-enabled policing tools and deepen industry partnerships.

Whistleblower nurses at Royal Darwin Hospital said staff are using ChatGPT to calculate medication doses and YouTube to learn clinical procedures amid understaffing and training concerns. Western Australian authorities withdrew about 2,000 seatbelt-related fines issued by AI-assisted road safety cameras over six months.

In The Strategist, Lorraine Finlay, Australia’s Human Rights Commissioner, and Patrick Hooton, a human rights adviser at the Australian Human Rights Commission, argued that China’s latest five-year plan identifies brain-computer interfaces as a strategic future industry and that Australia needs stronger safeguards for military neurotechnology. It called for lifecycle-based reviews and clearer ethical limits as Australia develops its own defence capabilities.

⸻

💰 Tech business & markets

Sam Altman sought OpenAI backing for ventures in which he holds personal stakes, including Helion and Stoke Space, as OpenAI prepares for a planned IPO valued at about $850bn. OpenAI declined some proposals but entered related commercial agreements that could still benefit Altman financially.

OpenAI began rolling out advertising on ChatGPT in Australia, extending an earlier US pilot. Ads will appear only for logged-in adult users on free tiers, while paid users remain ad-free.

Elon Musk promoted broad government payments funded by increased output from AI and robotics as a response to AI-driven job losses. Data showed AI adoption heavily skewed toward higher earners and more experienced workers, with daily use much lower among lower earners. Major Wall Street banks cut about 15,000 employees while reporting strong earnings, with executives attributing efficiency gains to AI.

Microsoft will invest A$25bn in Australia by 2029 to expand AI and cloud infrastructure, cybersecurity and workforce training. The plan omits details on data centre locations, energy sources and job creation, while analysis in the source said much of the capital may flow offshore through imported hardware.

Australian AI data centre firm Firmus Technologies is pitching itself as core infrastructure for the AI economy ahead of a potential ASX listing. Global tech companies including Amazon, Google, Meta, OpenAI and Anthropic are committing tens of billions to Australian AI infrastructure, with large contracts driving new equity, debt and private capital financing.

Proposed US data centre projects powered by natural gas and linked to major AI firms could emit more than 129mn tons of greenhouse gases annually, based on permit data reviewed by WIRED. Data centre expansion in the US is drawing local backlash over energy use, water consumption, noise, environmental damage and utility costs. US tech firms including Microsoft lobbied the EU to include confidentiality provisions in data centre emissions reporting rules.

ByteDance’s planned TikTok data centre in Brazil is facing environmental and social opposition over water use, energy allocation and local consultation. Officials are reviewing environmental licensing, while Indigenous groups and activists cited in the source raised concerns about local resource strain.

SpaceX warned in a pre-IPO filing that its plans for space-based AI data centres and interplanetary infrastructure rely on unproven technologies and may not be commercially viable. The company cited technical complexity, harsh space conditions and dependence on the delayed Starship rocket.

Telstra deployed an internal AI agent in its boardroom to help directors navigate large volumes of company documents. Built with Accenture, the system draws only on curated internal materials and is not used for decision-making.

⸻

🎬 IP, media & creative industries

YouTube opened its AI deepfake detection tool to a broad set of public figures, including actors, musicians, athletes and creators. The system lets users upload their likeness, scan for synthetic copies and request removal, while parody and satire may remain protected.

AI safety groups are funding and training content creators to spread awareness of existential AI risks through fellowships, paid collaborations and social media campaigns. The push moves outreach beyond policy circles and technical research into mass public persuasion. The creator push is intensifying political polarisation, with critics accusing AI safety advocates of exaggeration and hindering innovation.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 11 April 2026 to 17 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Anthropic’s Claude Mythos preview and Project Glasswing

What happened: The cybersecurity community has been buzzing all week over Anthropic‘s announcement of the Claude Mythos Preview, alongside Project Glasswing — a controlled release to several select organisations including Microsoft, Google, Apple, CrowdStrike, and JPMorgan Chase. Mythos achieved an 83.1 per cent success rate on the CyberGym benchmark (a standard industry test of vulnerability detection) and autonomously identified thousands of zero-day vulnerabilities across every major operating system and browser, including a flaw that had persisted for 27 years. Critically, Mythos can analyse compiled binary code without access to source code — meaning legacy systems running decades-old software are even less protected by obscurity.

Around the world, senior officials responded swiftly. US Fed Chair Jerome Powell and Treasury Secretary Scott Bessent met with the heads of major US banks to discuss the cyber risks raised by Mythos. Separately, IMF Managing Director Kristalina Georgieva warned that the world lacks the ability to protect the international monetary system against massive cyber risks, saying the risks have been growing exponentially. In Australia, APRA and ASIC have been engaging extensively with major banks, insurers, and superannuation funds behind closed doors, even though early access to Mythos has not been granted locally.

Why we’re tracking this: Mythos was designed as a defensive tool to identify and help remediate vulnerabilities, but its capabilities are inherently dual-use. In practice, it compresses the time, cost, and expertise required to conduct sophisticated cyber operations — tasks that once demanded skilled teams working across days or weeks can now be executed far more rapidly and with far greater automation. The asymmetry between offence and defence in cyberspace is not new: defenders must secure everything, while attackers need only find one path. Mythos widens that asymmetry significantly by accelerating vulnerability discovery — the step that precedes exploitation — and shortening the window between a flaw existing and being weaponised.

What people are saying:

• AI safety engineer Heidy Khlaaf criticised the announcement, arguing it used “purposely vague language” and omitted key evidence — such as false positive rates and human oversight — making it difficult to independently validate Anthropic‘s claims.

• Writing in The Free Press, Josh Code argued Mythos raises the question of whether governments need a “Manhattan Project-style authority” to control the most dangerous AI capabilities.

• Former Australian federal cybersecurity chief Alastair MacGibbon warned that without access to Mythos, Australia is “dangerously exposed” and effectively dependent on US timelines, arguing the government should move urgently to secure access and prioritise domestic resilience rather than rely on external protection.

My view: The full implications of Mythos are still unfolding, and much of the underlying evidence remains undisclosed through responsible disclosure, limiting independent verification of Anthropic‘s claims. What can be assessed is the structural shift it represents. Autonomous vulnerability discovery at scale compresses the most resource-intensive step in offensive cyber operations. Identifying exploitable flaws has historically required significant expertise and time. Reducing that friction on the attacker’s side — without a corresponding reduction for defenders who must still find, triage, and remediate each vulnerability — has direct implications for cyber deterrence. Deterrence has always assumed some friction between capability and use. Mythos erodes that assumption.

The consequences fall hardest on organisations running legacy systems — particularly in energy, finance, and defence logistics — where remediation timelines are measured in months or years, not days. For Australia, the priority now shifts from cyber hygiene to understanding exposure and ensuring continuity under compromise. Waiting for access to Mythos is not a viable strategy.

— Dr Gatra Priyandita, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

What We’re Watching
A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

The United States, China and Russia are accelerating development of AI-enabled autonomous weapons, including drones capable of coordinating attacks without human input. US officials are pushing defence firms to scale production after assessing China is more advanced in some areas, while Russia continues testing systems in Ukraine. The competition involves multiple countries and private firms, with significant investment and limited international governance. Separately, a US airstrike that hit a school in Iran, killing civilians, may have involved AI-assisted targeting.

In The New York Times, a column argued that US export controls have failed to slow China’s AI development significantly, with Chinese firms circumventing restrictions through overseas data centres, chip-stacking, and reverse-engineering. The piece contends the two countries are roughly level in AI capability, with China potentially leading in industrial deployment, and suggests Washington pursue a global AI safety agreement with Beijing rather than containment.

The Stanford Human-Centered AI institute released its 2026 AI Index Report, finding that industry now produces over 90% of frontier models and organisational adoption has reached 88%. The US–China performance gap has effectively closed, while the global AI supply chain remains concentrated around Taiwan-based chip manufacturing. Safety governance is lagging behind rising capabilities and incidents are increasing, with the report noting declining US ability to attract talent and growing divergence between expert and public trust.

Japan is committing up to ¥2.6 trillion (about US$16 billion) to support semiconductor startup Rapidus as it enters the AI chip market, with production targeted at advanced chips and early customers such as Fujitsu. Chinese chipmaker YMTC, meanwhile, plans to build two additional factories alongside a third nearing completion, more than doubling its production capacity amid US export restrictions and increasing reliance on domestic equipment suppliers.

China’s imports of semiconductor equipment from Malaysia and Singapore surged in 2025, overtaking direct imports from the United States, which fell to an eight-year low. The shift reflects supply chain rerouting amid export controls, though US firms remain key suppliers of advanced chipmaking tools. South Korea, meanwhile, overtook China as ASML‘s largest market in the first quarter, accounting for 45% of system sales as memory chipmakers increased purchases to address AI-driven shortages. US efforts to expand global AI chip exports are being slowed by staffing shortages and increased oversight within the Commerce Department‘s Bureau of Industry and Security, with delays stretching months and creating backlogs worth billions.

Amazon will acquire satellite operator Globalstar for about US$11.6 billion to expand its low-Earth orbit internet business and compete with SpaceX‘s Starlink. The deal includes Globalstar’s satellite fleet, infrastructure and spectrum licences, with Amazon having launched more than 240 satellites so far. The transaction is expected to close in 2027, subject to regulatory approval.

Ukraine has deployed electronic warfare systems and interceptor drones to Gulf countries, where they have been used to shoot down Iranian Shahed drones targeting US-linked infrastructure. President Volodymyr Zelenskyy said more than 200 specialists were sent to the region in March, with Kyiv leveraging its battlefield experience to secure long-term defence agreements. Germany‘s parliament, meanwhile, approved a €300 million contract for Rheinmetall to supply loitering munitions to the Bundeswehr, drawing on lessons from Ukraine. In The Strategist, an article warned that non-state actors in the Sahel are using cheap commercial drones for surveillance and attacks, and that Papua New Guinea and Australia face similar emerging risks.

In The Strategist, analysis using ASPI‘s Critical Technology Tracker showed Iran has long invested in defence-relevant research now translating into military capability. This includes antennas used in Shahed drones that are resistant to GPS-spoofing, with defence-linked Iranian universities researching the technology since at least 2018.

⸻

🧠 AI models, agents & compute

Anthropic unveiled Claude Mythos Preview, an AI model with advanced capabilities to identify and exploit software vulnerabilities. The model has reportedly uncovered critical flaws across major systems and is being shared with major tech firms under a controlled programme called Project Glasswing to patch vulnerabilities before wider release. Anthropic is also in discussions with the US government about Mythos despite an ongoing dispute with the Pentagon, which labelled the company a supply-chain risk after disagreements over access and use restrictions.

The UK government testing found Mythos could autonomously complete complex cyberattack simulations, outperforming previous models in multi-step infiltration tasks, though it struggled with more advanced scenarios and active defences. The UK AI Security Institute assessed the model as more capable at cyber offence than predecessors, and the government issued an open letter urging businesses to strengthen defences. UK financial authorities, including the Bank of England and Financial Conduct Authority, are holding urgent talks with the National Cyber Security Centre and major banks to assess risks the model could pose to critical IT systems. Experts warned that legacy systems across financial institutions could amplify risks, enabling widespread breaches.

European regulators have had limited access to Mythos, with the company restricting early release to primarily US-based partners. Only a few European agencies have engaged, prompting concerns about oversight gaps and the absence of global governance mechanisms for high-risk AI systems. In the US, federal agencies are continuing to test the model despite a Trump administration directive limiting its use, with cybersecurity teams at a NIST sub-agency conducting red-teaming exercises. The White House is now preparing to provide federal agencies with controlled access through new cybersecurity protections.

In Australia, major banks, insurers and super funds are in discussions with regulators including APRA and ASIC over cybersecurity risks linked to Mythos. Anthropic separately briefed Australian critical infrastructure operators on risks from AI-enabled cyberattacks, warning that advanced models could disrupt essential services such as energy, water and telecommunications — though the company did not discuss Mythos specifically.

OpenAI has begun rolling out GPT-5.4-Cyber, a new model designed to identify software security vulnerabilities, to a limited group of users through its Trusted Access for Cyber programme. The company also launched GPT-Rosalind, a model aimed at life sciences research in genomics and biochemistry, released through a separate restricted access programme. An internal memo from OpenAI’s chief revenue officer, obtained by The Verge, outlined a strategy to strengthen enterprise growth and reduce user switching by building an integrated platform, positioning the company against Anthropic and signalling both firms are preparing for potential public listings.

Meta is developing a photorealistic AI version of CEO Mark Zuckerberg to interact with employees and provide guidance based on his communication style and strategic thinking, as part of a broader push to embed AI across the company. Roblox introduced new agentic features for its AI Assistant, including a planning mode and tools for autonomous game testing and bug detection.

A New York Times feature examined interpretability research aimed at understanding how advanced AI models reach decisions, focusing on work by Anthropic, Google, and startups including Goodfire and Prima Mente. Current methods remain partial and unreliable, with the stakes highest for uses in medicine, national security and autonomous weapons. A separate study found leading AI chatbots misdiagnose more than 80% of cases at the early stage of clinical reasoning when patient information is incomplete, though accuracy exceeded 90% with full diagnostic data.

A developer claims to have reverse-engineered Google DeepMind‘s SynthID watermarking system, demonstrating methods to remove or insert AI watermarks using publicly available tools. Google disputes the claim, maintaining the system remains robust, but the incident underscores ongoing challenges in reliably detecting AI-generated content.

Microsoft executives say utility-scale quantum computing could arrive within years, enabling AI systems up to 1,000 times more capable by generating highly accurate training data and solving previously intractable problems. In Europe, quantum computing firms — particularly in France — are advancing efforts to build scalable systems, with startups like Alice & Bob developing new facilities and chip production capabilities. In Australia, University of Sydney spin-out Deteqt secured $5 million in seed funding and a three-year, $3 million contract with the Department of Defence to develop chip-scale quantum magnetic sensors for GPS-denied environments.

Australian startup Springboards has developed a specialised AI model called Flint, designed to produce more diverse outputs than large language models, with adoption growing among advertising and media firms across multiple markets.

⸻

📣 Information operations

Iranian state media and affiliated accounts combined authentic war footage with AI-generated content during the 2026 Iran conflict, blending real documentation with meme-style propaganda aimed at international audiences. Embassy accounts, particularly in South Africa, used viral posts and satirical AI-generated videos to mock President Donald Trump, as part of what analysts describe as a broader effort to shape global perceptions and appeal to younger audiences. The Financial Times reported networks tied to the Islamic Revolutionary Guard Corps amplified divisive content globally, targeting US political tensions and promoting anti-imperialist themes. In Foreign Policy, an analysis noted this represented a shift toward propaganda aimed at Western audiences, with AI tools helping Iran and China tailor content to resonate more effectively.

Iranian content group Explosive Media is producing viral AI-generated Lego-style videos portraying the US and Israel negatively, claiming to use generative AI to rapidly create narrative-driven content for global audiences. The Trump administration used its own AI-enabled meme strategy during the conflict. Synthetic media is accelerating information warfare more broadly, with OSINT investigators facing growing challenges from content volume, algorithmic amplification, and restricted access to verification tools.

China is using AI-generated animations and social media content to shape global narratives, including messaging around the Iran war that portrays the US as an aggressor. State media and affiliated networks are deploying AI-driven content to engage younger international audiences. In The Strategist, analysts found Chinese state media is framing the Iran war as validation of China’s national security strategy, with commentary promoting China as a stabilising global power and emphasising supply chain security and military-industrial strength. A Chinese geospatial intelligence firm, MizarVision, reported using analysis of US aerial refuelling aircraft movements to infer bomber strike patterns over Iran, though the precise role of AI in the analysis was not disclosed.

Iran’s nationwide internet blackout has exceeded 1,000 hours since late February, reducing traffic to around 1% of normal levels and becoming one of the longest recorded shutdowns. Authorities are enforcing strict controls through a domestic intranet, reportedly using military-grade jamming to block Starlink access, with possession of terminals punishable by severe penalties including execution. Diaspora-led tools like Psiphon and Tor enabled partial circumvention for millions, while volunteer networks such as Mahsa Alert attempted to fill gaps in civilian warning systems. The Financial Times reported millions have been forced onto the state-controlled National Information Network, with online businesses collapsing and access to global tools cut off.

Researchers linked false claims about Hungarian opposition leader Péter Magyar supporting military conscription to Storm-1516, a Russian disinformation network, using fake news websites, impersonation and targeted Facebook ads. Coordinated Telegram activity is also spreading pro-Orbán narratives ahead of Hungary‘s parliamentary election, with analysis of over 628,000 messages finding patterns consistent with an orchestrated influence campaign.

London Mayor Sadiq Khan warned of a surge in coordinated disinformation portraying the city as unsafe, driven by foreign actors, far-right groups, and AI-generated content. City Hall research found negative narratives increased by up to 200% and migration-related claims rose over 350% between 2024 and 2026, with activity involving UK far-right groups alongside networks aligned with Russian, Chinese and US political interests. Khan called for stronger regulation, greater platform transparency, and improved access for researchers to monitor disinformation.

Russia has reportedly blocked access to social media platform Bluesky, adding it to a registry of banned websites as part of a broader crackdown on foreign platforms. Russian authorities also detained a former Radio Free Europe contributor on treason charges, alleging he passed information used in cyberattacks on Russian targets, as part of a broader pattern of prosecutions linked to Telegram activity.

⸻

🛡 Cyber posture

Iranian cyber operations during the 2026 conflict have caused limited disruption, with most attacks appearing opportunistic rather than coordinated campaigns, according to The New York Times. US and Israeli counteroperations have likely degraded Tehran’s capabilities, while conventional military actions have had greater strategic impact than cyberwarfare. US federal agencies warned that Iranian state-backed hackers have targeted internet-exposed industrial control systems since March, with around 3,891 vulnerable Rockwell Automation PLC devices located in the United States.

The NSA and FBI warned that Russian military intelligence-linked hackers are exploiting vulnerable home routers globally to steal sensitive data, including from government and critical infrastructure networks. The advisory urged users to update firmware, replace unsupported routers and reboot devices regularly. Sweden‘s government warned that Russia-linked actors are escalating cyberattacks against Europe’s critical infrastructure, shifting from disruption to more destructive operations, and reported a pro-Russian hacker group attempted to breach a Swedish thermal power plant in 2025.

The UK government said it tracked Russian submarines and vessels linked to deep-sea operations near critical undersea infrastructure, including cables and pipelines, in waters north of the country. Officials said the activity was likely reconnaissance for potential sabotage.

US, Canadian and Mexican authorities are coordinating cybersecurity and infrastructure protection for the 2026 World Cup, with officials warning cyberattacks could target transport, broadcasting and essential services. Preparations are complicated by a Department of Homeland Security funding lapse that has reduced personnel and slowed exercises.

A ransomware attack on Dutch healthcare software provider ChipSoft disrupted digital services used by around 70% of hospitals nationwide. Separately, hackers breached European gym chain Basic-Fit, accessing personal data of around 1 million members across the Netherlands, Belgium, France, Spain and Germany. Booking.com warned some customers that unauthorised parties may have accessed personal data including booking details and contact information, amid rising phishing scams targeting customers by impersonating the platform.

The FBI and Indonesian authorities disrupted the W3LL phishing platform, seizing infrastructure and arresting its alleged developer. The tool enabled cybercriminals to bypass multifactor authentication and access over 25,000 compromised corporate Microsoft 365 accounts globally. Cybersecurity researchers also warned of a fake Microsoft Windows update distributing malware capable of stealing credentials and disabling security tools, while Microsoft’s legitimate April Patch Tuesday addressed 167 vulnerabilities including zero-days.

The FBI recovered deleted Signal messages from a suspect’s iPhone by accessing cached notification data stored in iOS, even after the app had been removed. The method, revealed in a US criminal case, allows investigators to extract incoming message previews retained in the device’s internal notification database.

Former L3 Trenchant executive Peter Joseph Williams, an Australian national and former Australian Signals Directorate employee, was sentenced to 87 months in prison after pleading guilty to stealing eight zero-day exploits from his employer and selling them to Russian broker Operation Zero for more than $1.2 million. Prosecutors estimated the loss at $35 million and said the tools could have enabled access to millions of devices.

The Australian Cyber Security Centre published guidance warning that social media and messaging platforms pose security risks through data collection, personal information exposure and potential exploitation for social engineering or espionage, recommending measures including access controls, staff training and multi-factor authentication.

⸻

🕵️ Surveillance states

Nevada‘s Department of Public Safety signed a contract to use Fog Data Science software that allows police to track cellphone location data in near real time without a warrant. The tool uses advertising IDs to map movement patterns, enabling investigators to infer where people live, work and travel, with up to 250 queries per month. Privacy experts warn the practice may violate constitutional protections.

A Citizen Lab report found that Webloc, a global geolocation surveillance system developed by Cobwebs Technologies and now sold by Penlink, uses data from mobile apps and digital advertising to track up to 500 million devices worldwide. Military, intelligence and law enforcement agencies in the United States, Hungary and El Salvador use the system, with evidence of broader global deployment. Freedom of information requests indicate European and UK authorities are highly nontransparent about potential use.

Mexican firm Seguritech has built a $1.27 billion business supplying surveillance systems — including cameras, monitoring centres and predictive policing tools — to governments across Latin America. The company operates with limited public scrutiny, raising concerns about transparency and potential misuse.

Section 702 of the Foreign Intelligence Surveillance Act is set to expire on 20 April, with a bipartisan coalition pushing for warrant requirements to limit access to Americans’ communications, while leadership in both parties supports clean reauthorisation. Critics warn the current framework enables warrantless “backdoor” searches and could be expanded through AI-enabled data analysis.

⸻

⚖️ Platform accountability

NBC News found that xAI‘s Grok chatbot continues generating non-consensual sexualised deepfake images of real people despite earlier safeguards, with users bypassing restrictions through alternative prompts. Multiple regulators across the US, Europe and Australia are continuing investigations. Apple and Google are also reportedly allowing apps that generate nonconsensual sexualised images to remain in their app stores despite policies prohibiting such content, according to the Tech Transparency Project. A WIRED and Indicator analysis found AI-generated deepfake nude images have affected nearly 90 schools and around 600 students globally.

A large illicit marketplace called Xinbi Guarantee continues to operate on Telegram despite UK sanctions for enabling crypto scams and human trafficking, having facilitated an estimated $21 billion in transactions. The Chinese-language platform offers services including money laundering, harassment-for-hire, and trafficking-related tools. An investigation found scammers are also using tools sold on Telegram to bypass banks’ KYC facial verification, enabling money laundering through mule accounts using deepfakes and virtual cameras.

X conducted a large-scale purge of automated accounts, removing bot-driven networks across the platform. Google will classify “back button hijacking” — where websites prevent users from returning to previous pages — as a spam policy violation, with affected sites facing ranking penalties.

A UK inquiry found a teenage attacker who killed three girls in Southport in 2024 likely viewed graphic footage of the Wakeley church stabbing on X minutes before the attack. The report criticised the platform for weak age verification, delayed cooperation, and refusal to remove the video globally despite takedown efforts by Australia’s eSafety Commissioner.

Andrew Forrest is seeking US court sanctions against Meta, alleging the company destroyed key evidence related to scam advertisements using his likeness that defrauded Australians. Court filings claim Meta failed to preserve original ad content and internal optimisation data. Meta denies wrongdoing.

Thomson Reuters is facing pressure from shareholders and employees over its work supporting US immigration enforcement, including contracts linked to data and surveillance tools used by ICE. An investor proposal calls for greater transparency, while a former employee has filed a lawsuit. Major news outlets are also restricting access to the Internet Archive‘s Wayback Machine, with journalists and advocacy groups warning this could undermine transparency and accountability.

New research from privacy group webXray found major tech firms frequently ignore users’ opt-out requests under California privacy law. The study reported 194 advertising services failed to respect Global Privacy Control signals, with Google, Meta and Microsoft allegedly continuing to place tracking cookies despite user preferences.

⸻

🧒 Online harms & child safety

A majority of Australian children aged 12–15 continue to use social media despite the national ban, with 61% reporting ongoing access, according to new research. A separate survey of Australian parents found nearly two-thirds believe the ban is completely ineffective, with weak verification systems and limited parental enforcement undermining the policy. The ban is being challenged in the High Court by teenagers arguing it restricts political communication. A NSW government survey found 29% of young people are using AI tools for mental health support, with the data expected to inform government policy responses.

Roblox announced a major overhaul of its platform following regulatory pressure from Australia’s eSafety Commissioner, including new child safety features and age-segmented accounts. From late May, the company will introduce “Roblox Kids” and “Roblox Select,” using facial age-estimation technology to restrict content and interactions.

The European Commission announced its age verification app is technically ready and will soon be rolled out, using privacy-preserving methods such as zero-knowledge proofs to help enforce online safety rules. The system will require users to confirm their age before accessing restricted content, though critics warn it could undermine anonymity. Estonia‘s education minister Kristina Kallas argued that banning minors from social media is ineffective and called instead for stronger regulation of platforms.

UK Prime Minister Keir Starmer called on social media platforms to curb addictive “infinite scroll” features, with the government consulting on measures including bans for under-16s, curfews and app limits.

US Senate Judiciary Committee chair Chuck Grassley launched an inquiry into eight major tech companies over alleged failures to provide sufficient data to the National Center for Missing and Exploited Children. Despite submitting over 17 million reports in 2025, companies are accused of omitting key details such as location and suspect information, limiting law enforcement effectiveness.

A Pew Research Center survey of 1,458 US teens found platform use varies by purpose, with TikTok dominant for entertainment, Snapchat for messaging, and Instagram for following news. Around three-in-ten TikTok users say they spend too much time on the app, with higher impacts on sleep and productivity reported compared to other platforms.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Anthony Whelan has been appointed to lead the European Commission‘s competition directorate and signalled he will continue investigations into major US tech companies including Google, Meta, Apple and X. He emphasised enforcement will remain legally grounded and unaffected by political pressure, including from Donald Trump. The Commission warned Meta that revised terms for AI access on WhatsApp fail to address antitrust concerns, arguing proposed fees for rival AI assistants are effectively equivalent to banning access, and has threatened interim restrictions.

Major advertising groups including WPP, Publicis and Dentsu agreed to settle a US antitrust probe into allegations they coordinated to boycott certain online platforms based on political content. Under the proposed settlement, the agencies must stop coordinated conduct while maintaining the ability for individual advertisers to choose placements.

Florida‘s attorney general launched an investigation into OpenAI‘s ChatGPT over its potential role in a fatal mass shooting at Florida State University. Authorities are preparing subpoenas as part of the probe, while OpenAI said it will cooperate. A 20-year-old suspect was separately charged with attempted murder and arson after allegedly attacking OpenAI CEO Sam Altman‘s home and targeting the company’s San Francisco headquarters, in an attack authorities say was motivated by opposition to AI. OpenAI’s global policy chief Chris Lehane criticised extreme narratives around AI, warning alarmist rhetoric can have real-world consequences.

Virginia enacted a law banning the sale of precise geolocation data within a 1,750-foot radius, with unanimous bipartisan support. The move follows similar laws in Maryland and Oregon, with several other states considering comparable measures.

Queensland plans to criminalise the creation of non-consensual sexually explicit AI deepfakes, with offenders facing up to three years in prison. The UK government proposed amendments to a crime bill that would allow tech executives to face jail time if their platforms fail to remove nonconsensual intimate images, following an Ofcom investigation into xAI’s Grok chatbot.

A US federal judge awarded Spotify and major record labels $322 million in damages against piracy site Anna’s Archive for copyright violations, including a permanent injunction requiring ISPs to block the site. Enforcement is uncertain, as the operators remain anonymous.

⸻

🏛️ Government, procurement & public sector tech

France plans to migrate some government computers from Microsoft Windows to Linux to reduce reliance on US technology, beginning with systems at the government’s digital agency DINUM. The move follows earlier steps including replacing Microsoft Teams with a domestic alternative. Germany‘s digital minister called for developing a European alternative to Palantir, arguing governments should support domestic firms to scale competitive data analytics capabilities.

The CIA has begun using AI to generate its first autonomous intelligence report and plans to expand AI integration across analytic platforms. Deputy Director Ellis said AI will assist with drafting judgments, testing conclusions and identifying trends, while humans retain decision authority. The agency expects AI to become embedded as co-workers within the next few years.

Senior NHS officials warned staff against publicly criticising the rollout of Palantir‘s £330 million Federated Data Platform, amid internal tensions over the system’s adoption. The controversy reflects divisions within the NHS over the role of private tech firms in handling sensitive health data.

The UK government launched a $675 million sovereign AI fund to invest in domestic startups and reduce reliance on foreign technology. OpenAI signed a lease for its first permanent London office with capacity for over 500 staff, reinforcing plans to make the city its largest research hub outside the US, though the company has paused its UK Stargate AI infrastructure project, citing high energy costs and regulatory challenges. The UK government pushed back on OpenAI’s reasoning, with AI Minister Kanishka Narayan suggesting the decision was linked to OpenAI’s internal financial pressures. Microsoft agreed to take over data centre capacity in Norway originally intended for the Stargate initiative, including renting 30,000 Nvidia chips from Nscale.

Maine lawmakers passed a bill freezing construction of new large data centres until November 2027, the first US state to enact such a measure, with the pause applying to facilities of at least 20 megawatts. The bill follows rising public opposition across at least 12 states, though similar measures have largely failed elsewhere. Voters in Festus, Missouri, removed half of the city council over a controversial data centre project, with a lawsuit alleging secret meetings and efforts to suppress opposition. The US Energy Information Administration plans to introduce a mandatory nationwide survey to measure data centre energy consumption — the first federal effort to systematically collect such data.

In Australia, a coalition of Southeast Queensland councils is developing a coordinated strategy to attract data centre investment across Brisbane and the Gold Coast. The sector is facing scrutiny over claims it supports hundreds of thousands of jobs, with analysts saying the widely cited 935,000 figure reflects total tech sector employment rather than data centre-dependent roles, and industry-backed estimates projecting around 17,900 operational data centre jobs by 2030. India is offering a 20-year tax holiday to attract foreign cloud providers, though multiple projects face resistance from farmers and activists over land acquisition and environmental concerns.

Gulf states are continuing large-scale investments in data centres as part of sovereign AI strategies, despite recent drone attacks on facilities in Bahrain and the UAE. Major projects — including a $20 billion partnership between Brookfield Asset Management and the Qatar Investment Authority — remain on track.

The FCC granted Netgear the first conditional exemption from its ban on foreign-made routers, allowing the company to continue selling products in the US despite overseas manufacturing. Other brands remain subject to restrictions, including a 2027 deadline limiting software updates for foreign-made consumer routers.

⸻

💰 Tech business & markets

Meta‘s $2 billion acquisition of Chinese AI startup Manus has drawn scrutiny from Chinese authorities, who launched an investigation and barred two co-founders from leaving the country. British tech investor Fred Blackford has built a stake worth more than $500 million in ByteDance, betting on a valuation gap between the company and Western tech peers. Chinese social platform RedNote is expanding into the US by opening offices, hiring staff and launching an e-commerce portal.

Major US tech firms including Amazon, Meta, Oracle and Block are cutting jobs, with layoffs affecting thousands and slowing overall workforce growth since 2022, according to The Economist, which attributed the contraction to industry adjustment rather than AI-driven displacement. Fintech executive Ben Pfisterer of Zeller argued that recent layoffs are being misattributed to AI, when they are largely driven by over-hiring and organisational inefficiencies following the pandemic.

Half of US employees now report using AI at least occasionally, with daily usage rising, according to Gallup. AI adoption is linked to increased workplace disruption, with both hiring and layoffs more common at AI-adopting organisations, and 23% of employees at such firms expect potential job loss within five years. Bloomberg examined how Gen Z workers are integrating AI tools into their jobs, often accelerating productivity but raising concerns about governance, oversight, and opaque use. Law firms, meanwhile, are facing increased workloads as clients submit large volumes of AI-generated emails and drafts that require extensive review and correction.

AI data-labelling startup Mercor is grappling with internal fraud, suspected North Korean infiltration, and security breaches as it scales to over $1 billion in annualised revenue. An employee embezzled funds via fake contractor payments, while suspected North Korean operatives used stolen identities to contribute training data to major AI labs, with Meta pausing work and others reviewing exposure. Two US citizens were sentenced to a combined 16 years for operating “laptop farms” enabling North Korean IT workers to pose as US-based employees at over 100 companies, generating millions while exposing corporate systems. Separately, crypto platform Drift detailed a months-long social engineering operation by North Korean hackers that led to a $280 million theft.

A report linked a sophisticated Android banking malware campaign targeting Southeast Asian victims to scam compounds in Cambodia, including K99 Triumph City, with operations tied to malware-as-a-service networks and potentially trafficked workers.

Anthropic has introduced identity verification for some Claude users, requiring government-issued ID for cases flagged for potential fraud or abuse. The rollout, handled by third-party provider Persona, has drawn criticism from users concerned about data security.

⸻

🎬 IP, media & creative industries

Voice actors globally are pushing back against the growing use of AI for dubbing and voice generation, with industry groups in countries including Brazil, Mexico and South Korea advocating for legal protections. The shift raises concerns over cultural homogenisation and ownership of voice data as studios adopt AI to reduce costs and scale multilingual content.

A Guardian column described growing concerns about AI-generated content flooding opinion writing, highlighting a new “Proudly Human” certification initiative aimed at verifying human authorship. British tabloids are facing declining print revenues as readers shift to social media, AI-generated summaries, and influencer-led content, with monetisation remaining difficult despite large digital audiences.

Major AI firms including OpenAI and Anthropic are expanding policy engagement through thinktanks, research institutes and lobbying. OpenAI released a policy paper proposing social and economic reforms while opening a Washington office for policymakers; Anthropic launched its own institute. Critics argue these efforts may undercut independent regulation. Anthropic’s $20 million donation to Public First Action cannot be used to influence US federal elections due to restrictions tied to its 501(c)(4) status, with funds designated for public education on AI policy.

⸻

🌏 Global policy

🇦🇺 Australia

An Australian court imposed broad publication restrictions in the espionage case against Igor and Kira Korolev, who are accused of attempting to send classified information to Russia. Prosecutors allege Kira Korolev, an Australian Army information systems technician, accessed defence material via her work account while in Russia, with assistance from her husband in Brisbane. Authorities seized 12 devices and are seeking to protect sensitive evidence including defence capabilities and alliance information.

Australia’s opposition Coalition proposed expanding social media screening for visa applicants and introducing a binding “values” test, with breaches potentially leading to deportation. The plan includes creating an Enhanced Screening Coordination Centre to identify security risks through cross-agency intelligence and monitoring.

🇺🇸 United States

A senior Department of Defense official, Emil Michael, overseeing AI policy sold shares in Elon Musk‘s xAI for between $5 million and $25 million in January, up from a declared value of up to $1 million in 2025. The sale followed Pentagon agreements with xAI, including a December 2025 deal to deploy its AI capabilities. Ethics experts raised concerns about potential conflicts of interest.

President Donald Trump deleted an AI-generated image posted on Truth Social depicting himself as a Jesus-like figure after backlash. The incident intensified tensions within Republican and Catholic voter groups, alongside Trump’s criticism of Pope Leo XIV over US military actions.

The US has shifted from promoting free global data flows to imposing restrictions on cross-border data transfers, driven by national security concerns and competition with China, according to Lawfare. Measures include forcing ByteDance to divest TikTok‘s US operations and limiting sensitive data transfers to foreign adversaries.

Democratic candidates have been advised to avoid antagonising pro-AI groups that have amassed nearly $300 million to influence US midterm elections, with industry-backed Super PACs funding candidates and targeting critics. The Financial Times reported the influx of AI-linked political spending is shaping candidate behaviour ahead of the elections.

Anthropic hosted a two-day summit with Christian leaders in March to seek input on the ethical development of Claude, including how it should respond to grief, self-harm, and complex ethical questions. The effort also surfaced tensions with the US government, which has restricted use of Anthropic’s technology over concerns its built-in ethical constraints could limit military applications.

🇪🇺 Europe

A Politico survey across six EU countries found 84% of Europeans do not trust US tech companies with their personal data, while 93% distrust Chinese firms. Trust in European companies is higher but limited, with only 51% expressing confidence.

European regulators are facing surging workloads as citizens increasingly use AI tools to generate complaints, proposals and submissions to EU institutions. The European Ombudsman reported a 54% rise in complaints in 2025, partly attributed to AI-assisted drafting, straining administrative systems designed before widespread AI use.

🇬🇧 United Kingdom

UK lawmakers were told that China is positioning itself as a supporter of global AI governance, in contrast to a deregulated US approach. Experts warned of national security risks from international AI collaboration and raised concerns about the UK’s reliance on US technology firms, alongside delays in UK AI infrastructure projects.

🇯🇵 Japan

Japanese AI company Fronteo has developed a system to assess the risk of researchers leaking sensitive technologies by analysing funding sources, co-authorship networks, and links to entities in countries of concern. The tool draws on hundreds of millions of academic papers and sanctions lists and aligns with new Japanese government guidelines requiring universities to strengthen research security.

India is expanding partnerships with foreign companies to strengthen its electronics manufacturing sector, with firms such as Japan’s TDK benefiting from government-backed incentives aimed at boosting domestic capabilities.

🇮🇷 Iran

Recorded Future outlined multiple scenarios for the Iran conflict over the next 6–12 months, ranging from a fragile ceasefire with sustained economic disruption to full regional escalation. The baseline scenario sees continued instability, intermittent maritime disruption in the Strait of Hormuz, elevated cyber activity, and sustained pressure on energy markets and supply chains.

Early observations from the Iran conflict, examined in The Australian, note a shift toward low-cost, distributed warfare, with drones, missiles and mobile systems proving more effective than large platforms.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

What happens when AI is built to serve an authoritarian political system?

In this episode, David Wroe speaks with Bethany Allen, Head of China Investigations and Analysis and Fergus Ryan, Senior Analyst, both at ASPI’s Cyber, Technology and Security Program, to discuss their recent ASPI report The party’s AI: How China’s new AI systems are reshaping human rights.

Bethany and Fergus explain how China’s AI systems are being built to serve the party’s political objectives — not just to automate processes. They cover the automation of China’s justice system and what it means for defendants’ rights; predictive law enforcement and the erosion of due process; and “ambient censorship,” which creates an immersive information environment tailored to party ideology.

The conversation goes further into AI-powered surveillance capable of tracking people’s momentary emotional reactions, and what it means to embed authoritarian values into the architecture of a technology. Then it turns outward: what happens when countries import Chinese AI models — attractive because they are open source and therefore cheaper — and China works to shape global AI standards in line with its non-democratic interests?

👉 Listen on Apple, Spotify, Amazon Music, RSS, or wherever you get your podcasts — or watch on YouTube.

Subscribe now

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 3 April 2026 to 10 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

China firms market Iran war intelligence on US forces

What happened: A report by the Washington Post says firms in China are combining AI with satellite, flight and shipping data to track US military movements and market intelligence that can “expose” American forces. The story says MizarVision, a Hangzhou company founded in 2021, is among the firms cataloguing activity at US bases in the Middle East, tracking naval movements and identifying aircraft and missile-defence systems.

US officials and intelligence experts are divided over how credible those capabilities are in practice. A source familiar with MizarVision’s platform says the firm does not have real-time access to US imaging sources, even as analysts warn that the growing market for these tools points to a broader security risk.

Separately, the ABC reports that the US Defense Intelligence Agency has assessed an AI tool used by MizarVision poses a threat to US forces. The broadcaster also notes that about 100 Australian soldiers are stationed in the Middle East, including at facilities damaged in an Iranian attack in the United Arab Emirates on 18 March, and retired Australian Defence Force Major General Gus McLachlan said Australian forces would take the threat very seriously.

Why we’re tracking this: Together, the two reports describe a commercial market doing work once more closely associated with national intelligence agencies. They also suggest that limiting access to imagery is getting harder. The ABC says Planet Labs was asked by the US government to indefinitely withhold images of the conflict region over security concerns.

What people are saying:

• A US official quoted in Washington Post said: “Even if the capability isn’t there yet … the big picture concern is the intent.”

• Gus McLachlan told ABC: “The Australian government would be concerned. It’s a plausible outcome that Australians could be killed by this capability.”

• China’s Ministry of Foreign Affairs told ABC the reports were “sensationalist” and that the imagery “is a routine market practice.”

My view: The United States can still block some commercial satellite images, but it can’t fully control who sees a war anymore. Other systems, including China’s Jilin satellite constellation, mean rivals can still get useful information even if Western providers restrict access. That could leave the public and the media seeing less, while adversaries still see enough to be dangerous. The big question now is whether governments can protect military operations without also shutting out public scrutiny.

— Fergus Ryan, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Iranian strikes and threats against Gulf data centres have exposed the wartime vulnerability of AI infrastructure used by civilian and military clients, according to Rest of World. The Verge reported that Iran’s Islamic Revolutionary Guard Corps published a video threatening OpenAI’s planned Stargate data centre in Abu Dhabi if the United States attacks Iranian power plants.

In Politico, Mistral chief executive Arthur Mensch said Europe needs AI capabilities it controls for military systems and critical infrastructure. He also said reliance on non-European AI could leave European defence systems exposed to geopolitical pressure or disruption, and that Mistral is pressing the European Commission to prioritise European-controlled AI infrastructure.

The Guardian reported that OpenAI has paused its role in Stargate UK, citing high energy costs and regulatory uncertainty. The project had been intended to support sovereign compute infrastructure, including datacentres built by Nscale and powered by Nvidia chips.

WIRED reported that the U.S. Army is building an internal AI system called Victor, including a chatbot called VictorBot, trained on data from real missions and drawing on more than 500 repositories. Army officials said the system is designed to retrieve mission-relevant information, cite sources, and later handle multimodal inputs such as imagery and video.

The Wall Street Journal reported that governments, militaries and private firms are increasing patrols, monitoring and legal deterrence to protect submarine cables amid sabotage concerns. The article said companies are also exploring alternative routes and detection tools as demand for new cable infrastructure continues to rise.

⸻

🧠 AI models, agents & compute

OpenAI announced a pilot Safety Fellowship for external researchers, engineers and practitioners to work on safety and alignment research from September to February, with mentorship, stipends, compute support and the option to work from Berkeley or remotely. The Wall Street Journal reported that the company also published policy proposals for a future shaped by superintelligence, including higher taxes on companies and capital gains, possible taxes on automation replacing workers, stronger safety nets, portable benefits and a public investment fund.

The New York Times reported that Anthropic is withholding public release of Claude Mythos Preview and instead giving access to more than 40 organisations through Project Glasswing, saying the model can identify and exploit serious software vulnerabilities. Anthropic said the system has already found thousands of bugs, including longstanding flaws in widely used systems.

Later in the week, Bloomberg reported that OpenAI, Anthropic and Google are sharing information through the Frontier Model Forum to detect adversarial distillation that they say is being used to copy leading U.S. models without authorisation. The report said the companies are also seeking clearer U.S. government guidance on what information they can share under antitrust rules.

In the Financial Times, executives and investors said AI agents are accelerating automation across white-collar sectors including law, finance and cybersecurity, while regulated industries are adapting around trust, accountability and proprietary data.

⸻

🛡 Cyber posture

Earlier this week, a joint advisory from the FBI, NSA, Department of Energy and CISA warned that Iranian government-affiliated hackers are targeting programmable logic controllers in U.S. energy, water, wastewater and government facilities. Politico reported that officials said the activity appears intended to cause disruptive effects and resembles earlier attacks linked to the CyberAv3ngers group.

The UK’s National Cyber Security Centre warned that hackers linked to Russia’s GRU, identified as APT28/Unit 26165, are exploiting vulnerable home and small-office routers to hijack traffic and steal credentials. The Financial Times reported that the campaign used TP-Link and MikroTik devices for DNS hijacking, starting broadly before narrowing to intelligence targets.

Researchers from Access Now, Lookout and SMEX said a hack-for-hire group targeted journalists, activists and officials across the Middle East and North Africa using phishing, Signal compromise and Android spyware, according to TechCrunch. Lookout assessed the operators may be linked to a private vendor connected to BITTER APT.

BleepingComputer reported that attackers have been exploiting a zero-day in Adobe Reader since at least December through malicious PDF files. Researchers said the exploit enables data theft and can escalate to remote code execution, while Adobe had been notified but had not yet released a patch.

A hacker claiming to have breached the National Supercomputing Center in Tianjin is offering samples of more than 10 petabytes of allegedly stolen data, including defence documents, missile schematics and simulations, CNN reported. Experts who reviewed samples said the material appeared consistent with the centre’s work, though CNN said it could not independently verify the full dataset or the hacker’s claims.

Recorded Future reported that cybercriminals targeting Latin America and the Caribbean in 2025 relied heavily on phishing, social engineering, ransomware, banking trojans and infostealers, with Brazil, Mexico and Argentina the most targeted countries and 452 ransomware incidents recorded across the region. Separately, the FBI said Americans lost nearly $21 billion to cyber-enabled crime last year, with investment scams, business email compromise, tech support fraud and cryptocurrency-related crime driving the largest losses and AI-related scams appearing in the bureau’s reporting for the first time.

Cryptography engineer Filippo Valsorda argued that recent research has materially shortened plausible timelines for cryptographically relevant quantum computers and that organisations should accelerate migration to post-quantum cryptography. He pointed to new estimates on the resources needed to break 256-bit elliptic curves and cited warnings that 2029 is now a serious planning deadline.

⸻

🕵️ Surveillance & identity tech

WIRED reported that AI Forensics analysed nearly 2.8 million messages across 16 Italian and Spanish Telegram communities and found thousands of men trading abusive content and advertising hacking and surveillance services targeting women and girls. Telegram said the material violates its rules and that it removes millions of pieces of content each day.

Commonwealth Bank said its onboarding system using NFC scans of ePassport chips has verified more than 2,700 customers since January by matching passport-chip photos to selfies in the CommBank app without retaining the biometric images. The bank said it plans to expand the system from Australian customers to migrants and overseas students.

⸻

🏛️ Government, procurement & public sector tech

The Guardian reported that scientists and conservation groups are warning against using AI to speed up approvals under Australia’s EPBC Act, after the Minerals Council of Australia asked the government for A$13 million to trial tools for preparing and assessing applications. The federal government said AI may help with applications, but project approval decisions will remain with human assessment officers.

The Financial Times reported that NHS England chief data officer Ming Tang is pushing to deepen the rollout of Palantir’s Federated Data Platform across hospitals, even as ministers consider whether to use a break clause in the contract. The programme is shifting from onboarding hospitals to deeper integration, with NHS England also exploring the addition of third-party tools.

⸻

⚖️ Courts, enforcement & regulation

Elon Musk amended his lawsuit against OpenAI and Microsoft to ask that any damages be awarded to OpenAI’s nonprofit arm and to seek Sam Altman’s removal from the nonprofit board. The filing also asks Altman and Greg Brockman to surrender equity or other financial benefits to the charity arm ahead of a trial later this month in Oakland, California.

Earlier this week, a U.S. appeals court in Washington, D.C. declined to pause the Pentagon’s designation of Anthropic as a national security supply-chain risk while the case proceeds. Reuters said a separate California federal judge had blocked a different Pentagon order late last month.

Later in the week, Reuters reported that Florida’s attorney general has opened an investigation into OpenAI and ChatGPT, citing national security and misuse concerns as the company weighs a potential IPO. Separately, Axios reported that the Trump administration is pressing states including Nebraska and Tennessee to narrow or drop proposed AI bills, with some lawmakers saying the outreach has already changed chatbot and transparency measures.

Reuters reported that Deere has agreed to a proposed settlement of a U.S. right-to-repair lawsuit, including a $99 million fund and 10 years of digital maintenance, diagnosis and repair tools for large agricultural equipment. The agreement still requires judicial approval.

⸻

🧒 Online harms & child safety

The Internet Watch Foundation said reports of sextortion blackmail attempts from under-18s in the UK rose 34 per cent last year, with boys aged 14 to 17 accounting for 98 per cent of victims. At the same time, The Record reported that Microsoft, Google, Meta and Snapchat say they will continue voluntarily scanning communications for child sexual abuse material in Europe after the EU law authorising the practice expired.

Reuters reported that Greece will ban social media access for under-15s from the start of 2027, with platforms facing fines under the EU Digital Services Act, and that parliament is due to legislate the measure later this year. Prime Minister Kyriakos Mitsotakis also called for EU-wide action including a digital age of majority at 15 and a unified enforcement system.

OpenAI published a Child Safety Blueprint for U.S. policy and enforcement responses to AI-enabled child sexual exploitation, including proposed updates to legislation, reporting and safeguards. Separately, Ars Technica reported that a U.S. man has become the first person convicted under the Take It Down Act for creating and distributing AI-generated non-consensual intimate images.

Axios reported that Meta has begun removing ads from law firms seeking plaintiffs for social media addiction lawsuits involving minors after a recent California verdict. In Lawyers Weekly, Australian lawyers said that the same U.S. jury verdict against Meta and Google could support similar litigation in Australia under consumer law or other civil liability theories.

⸻

🎬 IP, media & creative industries

Michelle Rowland said Australia will not weaken copyright law to let AI companies freely train on Australian copyrighted material, but is considering licensing, enforcement and agreement-making reforms for AI. Separately, plaintiffs in California accused Apple of bypassing YouTube protections and scraping videos for AI training through the Panda-70M dataset.

Yuga Labs settled its lawsuit against Ryder Ripps and Jeremy Cahen over the RR/BAYC NFT collection. A proposed order would permanently bar the defendants from using Yuga’s trademarks and imagery, though settlement terms were not disclosed.

Muck Rack launched a feature ranking journalists and outlets by how often they are cited in AI-generated answers from ChatGPT, Claude, Gemini and Perplexity, using 15 million citations gathered from submitted queries. The data put Reuters first globally among publications and Henry Blodget first among journalists, while specialist and B2B titles featured prominently.

In Nieman Lab, an analysis found that posts containing links consistently receive lower engagement on X than link-free updates from publishers. The Electronic Frontier Foundation said it is leaving X after nearly two decades, citing declining reach and platform-governance concerns.

⸻

💰 Tech business & markets

WIRED reported that UpScrolled, founded by Issam Hijazi, grew from about 150,000 users before the January TikTok-related surge to more than 5 million by this month, while expanding from a one-person operation to about 25 staff. Hijazi said the platform is trying to improve moderation and operations amid scrutiny over extremist and antisemitic content.

In Pickr, Optus and Vodafone were reported to be raising mobile prices in Australia after earlier increases by Telstra, with Optus adding A$5 to postpaid plans from mid-May and Vodafone adding A$5 to prepaid plans from next week. Separately, techAU reported that Easter road traffic brought back queues at EV charging hubs along the Melbourne–Sydney corridor.

Click Frenzy and Power Retail entered liquidation after directors moved to wind up both businesses, with receivers and administrators appointed to run an urgent sale process. Wexted Advisors said a recent travel sale event was hit by the US/Iran conflict, worsening cashflow pressures, while the companies continued trading with about 19 staff affected.

The Guardian reported that a proposed crypto resort in Timor-Leste had alleged links to associates of the sanctioned Prince Group, and that three people tied to the project had already been sanctioned by the US over a separate Prince Group-linked development in Palau. Those three were later removed from the Timor-Leste project.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 28 March 2026 to 2 April 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

Google brings quantum crypto warning forward to 2029

What happened: The clearest new element in Google’s announcement is its focus on cryptocurrency. In a post on Google Research, Google said future quantum computers could break the elliptic-curve cryptography used by cryptocurrencies with fewer resources than previously estimated, and outlined mitigation steps built around post-quantum cryptography.

Bloomberg and The Wall Street Journal report that the new paper cuts the estimated hardware needed to break the elliptic-curve cryptography used by Bitcoin and other digital assets by roughly 20-fold. Google says machines capable of doing that do not yet exist, but it is urging developers, exchanges and wallet providers to accelerate preparations.

The wider 2029 warning is the backdrop. The Guardian reports that Google is warning that large-scale quantum computers could break much of today’s encryption by 2029, while Ars Technica says Google is targeting 2029 for its own readiness and adding post-quantum support to Android.

Why we’re tracking this: Google’s paper matters for national security because it pulls cryptocurrency into the same post-quantum planning problem governments are already treating as real. The Wall Street Journal reports that millions of Bitcoin held in exposed wallet addresses could be vulnerable once sufficiently powerful quantum systems exist. That is still a future scenario, but Google is arguing the resource threshold may be lower than previously thought, which shortens the planning horizon.

That overlap is what matters. The Guardian says governments are already preparing for “store now, decrypt later” risks, while Google said on Google Research that it coordinated disclosure with the US government. Ars Technica also reports that the US National Security Agency is already working to 2030–2033 post-quantum deadlines.

What people are saying:

• Google said on Google Research that the point of publishing now is to give the cryptocurrency sector time to migrate, while stressing that cryptographically relevant quantum computers “are not yet available.”

• Experts cited by The Wall Street Journal said the new estimates increase pressure because exposed Bitcoin wallet addresses could be vulnerable once public keys are revealed.

• Experts cited by The Guardian said the timeline is still unsettled, with estimates for cryptographically relevant quantum computers ranging from the 2030s to the 2050s, even as the US National Security Agency, as reported by Ars Technica, is already working to 2030–2033 readiness deadlines.

My view: What Google has done here is turn a distant research problem into a live coordination problem for cryptocurrency. The exact timing of a cryptographically relevant quantum computer is still uncertain, but the paper makes it harder to treat migration as a problem for later. The more useful signal now is not another debate about when a cryptographically relevant quantum computer is developed; it is whether major networks such as Bitcoin, along with exchanges and wallet providers, begin visible work to reduce their dependence on current elliptic-curve cryptography and move to more secure encryption algorithms. That is where this moves from a warning into a test of preparedness.

— Stephan Robin, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

🚀 Strategic competition

The United States is pressing the European Union to join Pax Silica, a coalition focused on semiconductors, critical minerals and AI supply chains. US officials have also pressed the UK and other allies to secure quantum computing supply chains through coordinated investment, research and industrial capacity. Mistral has raised $830 million to build Nvidia-powered AI centres in France and Sweden.

Intel is buying back full ownership of its Fab 34 plant in Ireland, reversing a stake sale made in 2024. Huawei has recruited a senior German photonics scientist from a Fraunhofer institute. US tariffs have accelerated electronics assembly shifts from China to Vietnam even as much of the value chain remains Chinese.

⸻

🧠 AI models, agents & compute

OpenAI has shut down Sora after the video-generation product proved too costly and resource-intensive. Oracle is cutting thousands of jobs while expanding data-centre investment for AI workloads. US firms have captured roughly 75 per cent of global AI investment, about $194 billion.

A UK-backed study found nearly 700 documented incidents of AI systems ignoring instructions, bypassing safeguards, deceiving users or taking unauthorised actions. Anthropic said a Claude Code release accidentally exposed internal source code through a debugging source map file in an npm package. Cyber Security News reported that the exposed material included around 1,900 files and more than 500,000 lines of code.

⸻

🛡 Cyber posture

Google said future quantum computers could break the elliptic curve cryptography used in cryptocurrencies with fewer resources than previously estimated. Google plans to complete its own migration to post-quantum cryptography by 2029 and is urging developers, exchanges and wallet providers to accelerate preparations. Google has also warned banks, governments and technology providers that large-scale quantum computers could break most current encryption standards by 2029.

The FBI has classified a suspected Chinese intrusion into a surveillance system as a major cyber incident after attackers reportedly exploited a commercial ISP vendor. The compromised system contained metadata from lawful surveillance tools and personally identifiable information linked to FBI investigations.

US authorities confirmed that the Iran-linked group Handala breached the personal email account of FBI Director Kash Patel and released historical emails and photos. The State Department has reissued a $10 million reward for information on Handala and Parsian Afzar Rayan Borna, both linked to Iran’s Ministry of Intelligence and Security.

Google Threat Intelligence Group has linked a supply-chain attack on the widely used Axios JavaScript library to a North Korean actor that compromised a maintainer’s npm account. Mercor said it was affected by a separate supply-chain attack tied to the compromised open-source LiteLLM project. Cisco said attackers stole source code after exploiting credentials exposed in a Trivy-linked breach.

European Commission officials said a cyber incident affecting the Europa.eu web portal was detected and contained quickly, with no evidence internal systems were compromised. Security Affairs reported that the Commission had been investigating whether data hosted in cloud infrastructure serving its websites had been accessed.

A water treatment plant in Minot, North Dakota reported a ransomware attack that forced 16 hours of manual operations after systems were taken offline. In Western Australia, a local government entity lost about $350,000 after attackers altered supplier bank details in its finance system. Australian councils are seeking federal funding for shared security operations centres with monitoring, incident response and threat-intelligence services.

Romania said government institutions are facing more than 10,000 cyberattack attempts a day. In Australia, North Korean operatives have infiltrated companies by posing as remote IT workers using stolen identities and AI tools.

⸻

🕵️ Surveillance states

Iran has been running an AI-enabled information campaign alongside military operations, using fabricated videos, coordinated narratives and disinformation aimed at global audiences. Iran-linked actors have also paired cyber operations with kinetic attacks, including spyware distributed through fake emergency alerts timed with missile strikes.

Iran has arrested 46 people and seized 139 Starlink terminals as it tightened controls over internet access during the war. The IRGC has threatened major US technology companies across the Middle East, including Apple, Microsoft, Google and Meta. Amazon Web Services infrastructure was damaged in Bahrain following an Iranian strike.

Researchers said political deepfakes are increasing rapidly and can shape beliefs even when viewers know the content is fake. Facebook pages posing as Australian news outlets are publishing large volumes of AI-generated political disinformation from operators in Vietnam and Indonesia.

US Secretary of State Marco Rubio has instructed diplomats to use X and coordinate with military psychological operations units to counter foreign disinformation. Latvia has accused Russia of running a coordinated disinformation campaign targeting the Baltic states.

Police in Fargo dismissed charges against a Tennessee woman after investigators had relied on an AI facial-recognition match from another agency and failed to verify her alibis. Authorities later restricted use of the external system and added review measures.

⸻

⚖️ Platform accountability

A Dutch court has ordered xAI to stop Grok from generating nonconsensual nude images and warned of fines of €100,000 a day, up to €10 million. The ruling followed evidence that existing safeguards were still being misused, including in cases involving minors.

Perplexity AI is facing a proposed class action alleging it shared user data, including chatbot conversations, with Meta and Google through embedded tracking software. An Epstein survivor has sued the US Department of Justice and Google, alleging personally identifying information was disclosed and continued to appear in search results.

In Platformer, recent US jury verdicts were described as opening a route for claims over recommendation systems, infinite scroll and notifications rather than user-generated content itself. The piece said the cases could expose platforms to liability for product-design choices if the rulings stand.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Australia’s Federal Court has fined Binance Australia Derivatives $10 million for misclassifying more than 500 retail clients as wholesale investors. Italy’s data protection authority has fined Intesa Sanpaolo €31.8 million over unauthorised access to banking data and delayed breach notifications.

The UK Competition and Markets Authority is preparing to investigate Microsoft’s business software unit under new digital competition rules. Malta is opposing EU plans to centralise crypto supervision under the European Securities and Markets Authority.

Australia’s communications regulator has ordered Telstra and other telcos to revise mobile coverage maps using standardised signal thresholds and update them every three months. The Fair Work Commission criticised inaccurate AI-generated legal arguments in an unsuccessful unfair-dismissal case and is considering a costs order against the worker.

⸻

🏛️ Government, procurement & public sector tech

The Fair Work Ombudsman is exploring AI-enabled tools for low-risk compliance work and self-service systems, subject to governance and resourcing frameworks. EU institutions have banned staff from using fully AI-generated images and videos in official communications.

New York City has rescinded its 2023 TikTok ban on government devices, allowing agencies to use the app again under new security restrictions. US Special Operations Command told Congress it will prioritise cyber warfare and emerging technologies to maintain an edge against adversaries.

UK defence technology start-ups are considering relocating because of delayed government contracts and uncertainty around the Defence Investment Plan. Some firms are now seeking opportunities and funding in the US and other markets.

⸻

🎬 IP, media & creative industries

An AI-generated dating show, Fruit Love Island, has gone viral on TikTok, drawing more than 10 million views per episode shortly after launch. The series has also spawned fan content, spinoffs and audience voting around its anthropomorphic fruit characters.

Australian media companies including Nine, News Corp and Guardian have urged the government to keep existing copyright laws in place and require AI firms to license content rather than use it freely. The debate has coincided with Anthropic chief executive Dario Amodei’s visit to Australia as the company expands operations and meets policymakers.

⸻

💰 Tech business & markets

Crypto platforms are selling insurance-like products against theft, but coverage terms often exclude phishing, user-authorised access or other common loss scenarios. Bitcoin’s resilience during the Iran conflict has renewed interest in crypto and stablecoins across Southeast Asia.

Rising energy prices linked to the Iran conflict are reshaping financing decisions for data-centre projects across Asia, with bankers placing more weight on power security, cost stability and water constraints. The Middle East conflict has disrupted helium supply by halting Qatar’s gas production and straining semiconductor supply chains. Samsung Electronics and SK Hynix have enough helium to last until at least June.

Grab and WeRide have launched the first driverless ride-hailing service in Southeast Asia in Singapore. In China, a system malfunction left multiple Baidu Apollo Go robotaxis stopped on roads in Wuhan and stranded passengers.

Disruption in the Strait of Hormuz has halted or reduced aluminium production across key Middle Eastern suppliers that make specialised low-carbon material used in EV manufacturing. Toyota and Nissan have reduced production as access to that aluminium tightens.

⸻

🧒 Online harms & child safety

Austria is planning a national ban on social media use for children under 14, with legislation expected by June. The proposal also includes expanded digital-literacy education and a model of age verification that would not share personal data with technology companies.

Indonesia has started enforcing nationwide restrictions on social media access for users under 16, requiring higher-risk platforms to remove or deactivate underage accounts. The European Parliament has rejected an extension of temporary rules allowing tech platforms to scan for CSAM, meaning the privacy-law exemption will lapse.

Australia’s eSafety Commissioner is investigating Facebook, Instagram, Snapchat, TikTok and YouTube over possible noncompliance with the under-16 ban. About 70 per cent of under-16s who had major-platform accounts before the ban continued using them afterwards. A BBC visit found many children were still accessing services without age verification.

Australia’s teen ban is facing legal challenges, compliance gaps and widespread circumvention as regulators continue investigations without issuing fines. Age-verification tools remain unreliable and policy adjustments are narrowing the ban to harmful features.

⸻

🌏 Global policy

🇦🇺 Australia

The ACCC said Australians lost more than $2.18 billion to scams in 2025 across more than 480,000 reports. Investment scams accounted for the largest share of losses, followed by payment redirection, romance scams, phishing and remote-access attacks.

🇺🇸 United States

Innovation Council Action is preparing to spend more than $100 million in the 2026 midterms backing candidates aligned with President Trump’s AI agenda. David Sacks will keep shaping US AI policy as co-chair of the President’s Council of Advisors on Science and Technology after leaving a formal White House role.

🇪🇺 Europe

A German state is moving to reduce dependence on Microsoft by shifting public administration towards open-source software and sovereign digital infrastructure. Officials said reliance on foreign cloud and software services creates strategic vulnerabilities for public administration systems.

🇬🇧 United Kingdom

The UK government is considering tighter rules on political donations following reports on increasingly complex foreign interference. Proposed measures include a temporary ban on cryptocurrency donations and caps on overseas contributions.

🇨🇳 China

China has launched the World Data Organisation to promote global data governance and reduce fragmentation across national data policies. The body was established in Beijing as a non-governmental international organisation focused on cross-border data cooperation, digital economic growth, privacy and security.

🌐 Multilateral

The EU and CPTPP members have agreed to explore a region-to-region digital trade agreement covering data flows, digital services and electronic contracts. Sixty-six WTO members have moved ahead with a plurilateral set of baseline digital trade rules. The WTO e-commerce moratorium is set to expire at the 2026 ministerial conference. WTO reform talks have stalled after failed ministerial negotiations, with countries increasingly turning to smaller plurilateral deals.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

The Cyber & Tech Digest is brought to you by the Cyber, Technology & Security Programs team at ASPI and supported by partners.

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 21 March 2026 to 27 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

What We’re Tracking

China restricts Manus founders from leaving as Meta deal faces scrutiny

What happened: China’s National Development and Reform Commission has summoned the co-founders of Manus — a Chinese-born AI agent company acquired by Meta for $2 billion at the end of 2025 — to Beijing to question them over potential foreign direct investment violations. After the meeting, both executives were told they could not leave the country. No formal investigation has been opened and no charges have been brought.

The deal was already under review by China‘s Ministry of Commerce over potential export control violations, as the Financial Times reported in January. The new NDRC inquiry focuses on whether Manus properly notified authorities of ownership changes after the transaction closed.

Manus was founded in China but relocated to Singapore last year. Meta has already begun integrating its AI agent software into its platform; one person familiar with the matter described any unwind as “messy.”

Why we’re tracking this: The Manus case is a test case for a broader pattern of Chinese-born AI companies redomiciling to Singapore to access Western capital, a manoeuvre that has come to be known as “Singapore-washing”. Meta’s acquisition was possible in part because Manus had repositioned as a Singaporean company. Beijing‘s dual-track intervention raises questions about whether that repositioning provides genuine legal distance or merely symbolic cover.

What people are saying:

• A Meta spokesperson told the Financial Times: “The transaction complied fully with applicable law. We anticipate an appropriate resolution to the inquiry.”

• Aylon Berger at the Lowy Interpreter wrote in February that Beijing‘s tolerance for Singapore-based restructurings “may be wearing thin”, and Washington‘s could follow.

My view: For most of the past two decades, Chinese tech companies could globalise precisely because their corporate structures were intentionally opaque. They were offshore in name, but Chinese in substance. In the age of frontier AI, that ambiguity has become a liability on both sides. Western regulators are tightening rules to limit China-linked investment, and Beijing is increasingly unwilling to let strategic capabilities exit without oversight. Beijing’s intervention in Manus seems more reactive than doctrinal to me, a way to make tech entrepreneurs reconsider whether to pursue lucrative exits outside China, without pushing hard enough to spook the broader tech ecosystem it needs. The template Beijing appears to prefer resembles what Sequoia Capital did in 2023: spin off the China business, rename it something else (in this case, “HongShan”), and then create two legally distinct entities where domestic R&D remains under state oversight, but the international operation is free to access Western capital. The open question is whether terms strict enough to satisfy Beijing’s strategic concerns can still keep deals attractive to foreign acquirers.

— Fergus Ryan, CTS

Iran strikes Amazon cloud infrastructure in the Gulf

What happened: On Tuesday 24 March, Reuters reported that Amazon Web Services‘ Bahrain region had been disrupted by drone activity for the second time in a month. Amazon confirmed it is migrating customers to alternate regions but did not confirm whether the facility was directly hit.

The first attack, on 1 March, was more severe. Iranian drones struck two AWS data centres in the United Arab Emirates and damaged a third in Bahrain, the first confirmed military attack on hyperscale cloud infrastructure. Amazon described structural damage, disrupted power delivery and a “prolonged” recovery. The Islamic Revolutionary Guard Corps said the strikes were intended to probe “the role of these centres in supporting the enemy’s military and intelligence activities.”

Why we’re tracking this: Amazon, Google, Microsoft and Oracle all hold contracts under the US Department of Defense‘s $9 billion Joint Warfighting Cloud Capability program, meaning commercial cloud facilities may serve both civilian and military customers simultaneously. Where that is the case, their legal status as military targets becomes contested. The conflict has also exposed a governance gap: most governments lack visibility over which of their critical services depend on which cloud infrastructure, and where that infrastructure physically sits.

What people are saying:

• Joseph Jarnecki and Noah Sylvia at RUSI identify three rationales behind the strikes: imposing economic and reputational costs on Gulf states; probing military-relevant digital capabilities; and generating societal disruption through service outages.

• Sam Zabin of CSIS, quoted in Rest of World, said the US government and industry had “prioritised expansion over kinetic risk mitigation.”

• International law scholars León Castellanos-Jankiewicz (Asser Institute) and Ioannis Kalpouzos (Harvard Law), in The Intercept, said legality turns on whether a facility is “genuinely serving the military operations of a party to the conflict.”

My view:

Iran’s strikes on Gulf data centres, as the first confirmed kinetic attack on public cloud infrastructure, raise a legal grey-zone debate over whether such systems qualify as legitimate military targets. Commercial cloud infrastructure is, in principle, protected under the law of armed conflict through the distinction between civilians and combatants. But that protection becomes harder to apply when the same systems support military or intelligence functions. The more immediate challenge lies in governance: identifying which critical services depend on which hyperscale providers, and where those providers physically sit, has become urgent. Most governments have not done that work.

— Fitriani, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Iran warned it would strike energy, water desalination and information technology infrastructure in Gulf states if the United States proceeds with plans to attack Iran’s power grid. Amazon said its AWS cloud region in Bahrain was disrupted by drone activity for the second time in a month and is migrating customer workloads while it assesses damage. Earlier this month, Iran-linked drones damaged three AWS data centres in the UAE and Bahrain, disrupting internet services and forcing AWS to suspend operations at affected sites.

Palantir used its developer conference to showcase AI battlefield tools, with executives and military officials framing the company’s role as integral to U.S. operations against Iran. Lawfare’s coverage described the US–Israel operation as combining cyber, information, space and electronic warfare with kinetic strikes, drawing retaliatory Iranian cyber operations targeting U.S. and allied infrastructure.

Shield AI raised $2 billion at a $12.7 billion valuation and said it plans to acquire simulation software company Aechelon Technology as demand grows for AI-powered drones and autonomy software.

The U.S. Army selected Carlyle and KKR to build and operate two large data centres on military bases, each estimated to cost about $2 billion, with the army leasing AI computing capacity while unused capacity is sold commercially.

Russia’s Bureau 1440 launched 16 broadband satellites under its Rassvet project, its first operational step toward a low-Earth-orbit constellation. Officials said the system is intended as a sovereign alternative to SpaceX’s Starlink.”

China Computer Federation urged researchers to boycott NeurIPS after organisers barred submissions from U.S.-sanctioned institutions including Huawei. The move followed the conference's decision to comply with U.S. sanctions and drew backlash from Chinese researchers.

⸻

🧠 AI models, agents & compute

Tencent launched ClawBot by adding the OpenClaw agent as a contact inside WeChat, extending a recent run of agent products that also includes QClaw, Lighthouse and WorkBuddy.

Chinese AI providers including DeepSeek and MiniMax were reported to have overtaken U.S. rivals in token consumption since February. Lower token costs, driven by cheaper energy and more efficient model design, are allowing Chinese firms to charge significantly less than U.S. competitors as AI agents drive up usage.

OpenAI has decided to discontinue Sora as it shifts resources toward coding, enterprise productivity and agent tools. The company is also pushing for browser choice screens as it tries to challenge Google in search. Meta, meanwhile, put CTO Andrew Bosworth in charge of its AI For Work initiative to accelerate internal adoption of AI tools. Later in the week, the company laid off about 700 employees, mainly in Reality Labs.

OpenAI has put plans for an erotic chatbot on hold indefinitely, citing internal and investor concerns about social harms, unhealthy emotional attachment and risks to minors.

Elon Musk said Tesla and SpaceX will build an Austin semiconductor facility to make chips for AI, robotics and space applications under a broader Terafab initiative.

U.S. authorities charged three people over an alleged scheme to smuggle export-controlled Nvidia chips to China using shell companies in Thailand. The group allegedly sought to buy nearly $62 million worth of Supermicro servers equipped with Nvidia GPUs before the transactions were cancelled.

Across China, robotics firms were reported to be scaling industrial and humanoid systems with state funding, municipal support and dense hardware supply chains, targeting factory, retail, logistics and workforce training. In Australia, CSIRO researchers developed a proof-of-concept quantum battery that can charge, store and discharge energy in a full cycle. The National Reconstruction Fund invested $20 million in Silicon Quantum Computing as the company expands chip manufacturing and pursues a commercial-scale quantum computer early next decade.

Uber partnered with Pony AI and Verne to launch a commercial robotaxi service in Europe, starting in Zagreb. Pony AI will provide autonomous driving technology, Verne will manage the fleet and Uber will supply its ride-hailing platform and customer base.

⸻

🛡 Cyber posture

The U.S. Federal Communications Commission banned imports of new foreign-made consumer routers after a White House review found they pose a severe cybersecurity risk to critical infrastructure, while exempting devices cleared by the Pentagon. The U.S. State Department launched a Bureau of Emerging Threats focused on cyberattacks, AI misuse, space security and critical infrastructure risks from adversaries including Iran, China, Russia and North Korea.

Australian Cyber Security Centre released guidance on securing low Earth orbit satellite communications with international partners, outlining risks across space, ground, user and supply-chain segments and calling for encryption, zero trust architectures and supply-chain assurance. Meanwhile, a French officer reportedly leaked the location of the aircraft carrier Charles de Gaulle by uploading a GPS-tracked run to Strava while on deck.

Queensland Audit Office found three public sector entities could not effectively manage third-party cyber risks, with auditors able to obtain passwords, access systems, extract sensitive data and, in two cases, gain administrator-level access. The report also found weak procurement and contract controls and said CDSB and DHPW remain too slow and lack visibility over sector-wide third-party risk.

Health New Zealand warned staff not to use unapproved AI tools such as ChatGPT, Claude and Gemini to draft clinical notes, citing data security, privacy and accountability risks. A memo said the practice is strictly prohibited and could lead to disciplinary action, with AI tools required to be registered with the agency's national advisory group.

Open-source maintainers removed two versions of LiteLLM from PyPI after attackers used a compromised dependency and a misconfigured Trivy CI/CD pipeline to insert credential-stealing code into downstream workflows. Trio-Tech International disclosed a ransomware attack affecting its Singapore subsidiary that escalated from system disruption to data exfiltration, with the company still assessing scope and financial impact.

Researchers said the ClayRat Android spyware operation collapsed after infrastructure failures and the arrest of its suspected developer in Krasnodar, with all known command-and-control servers going offline within months of launch. Also, a U.S. Army soldier and two civilians were sentenced for helping North Korean IT workers secure jobs at U.S. companies using stolen or shared identities.

Security researchers reported a growing underground market for premium AI accounts including ChatGPT, Claude and Copilot, with access resold via bundled subscriptions, compromised credentials and API keys. They said the tools are increasingly being used by threat actors to scale phishing, fraud and social engineering.

⸻

🕵️ Surveillance states

Hong Kong introduced rules requiring people to surrender passwords or decryption methods for devices under investigation, with prison terms and fines for non-compliance. Earlier this month, Russia expanded the Federal Security Service’s power to order telecom operators to block access for security reasons. Authorities have increasingly used localised shutdowns and service restrictions while maintaining access to selected services via whitelists.

In Carnegie Endowment, Iran was described as using internet access as a wartime political instrument by granting unfiltered connectivity to people amplifying regime narratives while keeping much of the population offline. In Wired, activists and volunteers built Mahsa Alert to provide strike warnings, verified attack locations and offline updates during the conflict and related shutdowns.

In Bloomberg, Sandvine, later rebranded as AppLogic Networks, was reported to have sold deep packet inspection technology to Egyptian government bodies and other authoritarian regimes after its acquisition by Francisco Partners. The U.S. Entity List designation that followed cut the company off from suppliers and helped trigger layoffs, debt distress, restructuring and a withdrawal from more than 50 non-democratic countries.

In Australia, Services Australia, the ATO and Defence decided not to enable a new Microsoft Teams feature that would update worker location via workplace WiFi. In the Financial Times, Palantir was described as becoming a political liability in U.S. campaigns as candidates face scrutiny over investments, donations and ties to the company because of its work with Immigration and Customs Enforcement.

⸻

⚖️ Platform accountability

Polymarket has promoted itself as a truth-seeking platform, but a review in The New York Times found its social accounts had posted hundreds of false or misleading claims across platforms. In recent days, experts said trading on a US-Iran ceasefire market showed patterns consistent with possible insider knowledge after earlier suspicious trades around U.S. strikes on Iran. Kalshi, meanwhile, said it will bar athletes, coaches, officials and political candidates from trading on markets tied to their own sports or campaigns.

An Australian Senate inquiry found widespread climate misinformation amplified by social media platforms and AI-generated content, affecting public opinion on issues including wind farms, batteries and climate policy. The inquiry said false claims had influenced local decisions and flagged limited platform accountability and transparency around funding sources.

Meta faced criticism over more than 26,000 fake Facebook ads promoting investment scams across at least 25 countries, including Australia, using AI-generated images, cloned news sites and fabricated endorsements. X paused planned changes to creator revenue-sharing after backlash from global creators who said the new weighting toward home-region engagement would cut reach and income.

A U.S. federal judge dismissed X Corp's lawsuit accusing major advertisers and the World Federation of Advertisers of coordinating an illegal boycott. The court ruled that X had failed to show harm under antitrust law.

The Trump administration settled a lawsuit barring the Surgeon General’s office, the CDC and CISA from threatening social media companies with legal or regulatory penalties to remove protected speech. The agreement still allows officials to publicly challenge misinformation without coercion.

Wikipedia updated its English-language guidelines to ban editors from using AI to write or rewrite articles, while still allowing limited copyediting suggestions and translation if accuracy is verified. The change followed ongoing efforts by the community to remove low-quality AI-generated entries.

⸻

🧒 Online harms & child safety

Pinterest CEO Bill Ready called for a global ban on social media use by children under 16 and urged governments to enforce age limits while holding both platforms and mobile operating systems accountable. He cited Australia’s policy as a model even though Pinterest itself is not covered by it. In the United Kingdom, Apple rolled out age checks for iPhone users, requiring them to confirm they are over 18 for some apps and services after government pressure tied to the Online Safety Act.

The United Kingdom launched pilot programmes with 300 teenagers to test social media bans, curfews and app time limits, as officials assess effects on sleep, family life and schoolwork. The trials will inform an ongoing consultation on possible restrictions, including a ban for under-16s.

Australia's eSafety Commissioner said major AI companion chatbots are failing to adequately protect children from harmful and sexually explicit content. The report identified weak age verification, limited safeguards against child exploitation material and insufficient responses to self-harm risks across services including Character.AI, Nomi, Chai and Chub AI.

The European Commission accused major adult websites including Pornhub, Stripchat, XNXX and XVideos of failing to adequately protect minors, citing weak age verification and risk assessments. The findings came under the Digital Services Act, which allows fines of up to 6 per cent of global turnover. The European Commission also launched an investigation into Snapchat over alleged failures to protect minors, including weak age verification, exposure to grooming and risks of illegal goods sales. The probe will assess whether Snap is adequately enforcing child-safety measures under the Digital Services Act.

Meta was ordered to pay $375 million after a New Mexico jury found it misled users about platform safety and enabled harm including child sexual exploitation. CNBC reported a second phase of the case will begin in early May to determine additional remedies and whether Meta must fund mitigation programmes.

Days later, a Los Angeles jury found Meta and YouTube negligent over addictive design features including infinite scroll and algorithmic recommendations. Back-to-back verdicts in two states have produced what analysts are calling Meta’s “big tobacco moment”: the point at which product-liability claims begin to compound into systemic legal risk. More than 3,000 similar cases are pending in California alone, brought by individuals, states and school districts. The cases are framed around design decisions, not content — which lets plaintiffs route around the Section 230 protections that have historically shielded platforms from this kind of liability.

⸻

🧑‍⚖️ Courts, enforcement & regulation

A federal judge questioned the Pentagon’s designation of Anthropic as a supply-chain risk. The judge raised concerns the move could amount to illegal retaliation after Anthropic sought to limit military uses of its tools. The dispute comes as a proposed federal procurement rule, described in The Lever, would require AI vendors to allow government use of their systems for any lawful purpose and bar them from enforcing their own safety or use restrictions.

The Fair Work Commission introduced new disclosure and verification requirements for litigants using generative AI in submissions, including checks on accuracy, relevance and fabricated citations. The rules also require witnesses to confirm statements are based on their own knowledge and are accurate.

European Parliament lawmakers voted to delay key provisions of the EU AI Act while backing a ban on so-called nudify apps. The changes would push some compliance deadlines into 2027 and 2028 and delay watermarking rules until later this year, pending negotiations with the European Council.

⸻

🌏 Global policy

🇦🇺 Australia

Anthropic CEO Dario Amodei is expected to visit Australia next week as part of a broader executive leadership trip, with sources in Canberra and the Australian AI community confirming the planned visit to Crikey. The trip comes amid the company’s ongoing tensions with the Trump administration after the Pentagon designated Anthropic a supply-chain risk.

Australia introduced a five-step framework requiring tech companies seeking approval for data centres and AI projects to meet national-interest conditions on renewable energy, water use, local jobs and domestic compute availability.

Accenture Australia won a $16 million contract to build a new Climate Risk Hub for the Australian Climate Service, with delivery running over three years and possible extensions into the next decade.

In The Strategist, Andrew Horton argued Australia’s copyright regime as constraining domestic AI development by limiting access to training data. In another piece, Isaac Sharp described Australia as lacking policy frameworks for AI digital twins in defence and critical infrastructure settings.

🇺🇸 United States

Sen. Bernie Sanders and Rep. Alexandria Ocasio-Cortez introduced legislation to pause new AI data-centre construction until federal safeguards covering worker protections, environmental impacts and civil rights are enacted.

The Office of the Director of National Intelligence moved to assume oversight of In-Q-Tel from the CIA. Later in the week, President Donald Trump appointed tech executives including Mark Zuckerberg, Larry Ellison and Jensen Huang to the President’s Council of Advisors on Science and Technology.

Melania Trump appeared at a White House event alongside a humanoid robot developed by Figure AI, calling for wider use of AI-powered robots in children's education.

⸻

💰 Tech business & markets

Bitmain partnered with American Bitcoin to deploy mining infrastructure and develop a large data centre in Texas, despite ongoing U.S. national security scrutiny of Bitmain equipment and investigations into possible risks to the power grid and nearby military sites.

Apple CEO Tim Cook praised Chinese developers and manufacturing partners at the China Development Forum days after state media criticised the company’s App Store policies and called for more regulatory changes. Apple has also reduced developer fees in China and continues balancing strong local sales with supply-chain diversification into India and Vietnam.

NextDC warned Australia’s slow energy transition and grid constraints could divert AI investment and jobs overseas even as demand for electricity from data centres rises. The company said growing use of AI inference is increasing the importance of reliable, affordable power in decisions about where systems are deployed.

Meta raised its planned investment in an El Paso data centre to more than $10 billion as it expands AI infrastructure. The gigawatt-scale site is one of more than 30 facilities Meta has built or is building.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 14 March 2026 to 20 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

A quick note to readers:

We’re working to make the Digest as comprehensive and readable as possible, though this edition is on the longer side.

If you’d prefer shorter updates more frequently (for example, two or three editions across the week), we’d like to hear that. As outlined in our recent format update, we’ll soon introduce a Substack pledge option so readers can signal whether they’d support a more frequent release schedule. If there’s sufficient interest, we would look at moving to up to three editions per week, delivering key developments faster and in shorter bursts.

A note on our process: we use AI tools to assist with research and drafting. Every edition is reviewed, edited and curated by our team, and any analysis or commentary is written by us.

Feedback is always welcome. You can reply directly to this email, leave a comment on the post, or contact us at aspicts@substack.com

— The ASPI Cyber, Technology & Security Program

What We’re Tracking

Nvidia restarts H200 sales to China as policy framework collapses

What happened: Nvidia is restarting production of its H200 AI chips for China after receiving US government approvals and purchase orders from Chinese customers. CEO Jensen Huang confirmed the move at Nvidia‘s GTC conference in San Jose. The restart follows a Reuters report that the US Commerce Department quietly withdrew a draft rule that would have replaced the Biden-era framework governing global AI chip exports — a framework the Trump administration had promised to overhaul.

Why we’re tracking this: The H200 restart is not the story. The withdrawn rule is. The US currently has no coherent replacement policy for controlling AI chip exports. Approvals are being granted case by case, company by company, in a regulatory vacuum. Allies, adversaries, and chipmakers are all trying to read what the rules actually are. That uncertainty is itself a strategic liability.

What people are saying:

• Huang framed the restart as Trump policy, not just Nvidia business: “President Trump‘s intention is that the US should have a leadership position... he would also like us to compete worldwide and not concede those markets unnecessarily,” in Financial Times and Axios.

• A former US official told Reuters the rule withdrawal “likely reflects differing views within the Trump administration on how to achieve global AI supremacy.”

• Beijing has been slow to authorise imports at scale — a signal that China is in no hurry to become dependent on Nvidia while Huawei builds out domestic alternatives, per Financial Times.

My view: Ad hoc approvals with no rule are worse than a bad rule. Allies need to know what the framework is. Companies need to plan. Adversaries need to know where the line is. The Biden-era architecture is effectively dead; what replaces it is still unclear. If H200 shipments into China resume at sustained volume, it will confirm that Trump‘s approach to chip export controls is deals, not doctrine — and that is a fundamentally different kind of US industrial policy than anything that came before it.

— Stephan Robin, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Nvidia CEO Jensen Huang said the company has restarted manufacturing of H20 AI chips for China after receiving new US export approvals and purchase orders from multiple Chinese customers in recent weeks, having paused production while export-licence reviews stalled and Chinese authorities were slow to authorise imports at scale. Beijing must still approve H200 imports before shipments can proceed at scale. Separately, the US Commerce Department withdrew a draft rule intended to replace the Biden-era AI chip export control framework — one that would have tied large export approvals to foreign investment in US data centres or government-to-government security guarantees — and said it is still working on a formal approach modelled on recent chip deals with Saudi Arabia and the UAE.

Hua Hong Group's Huali Microelectronics has developed a 7-nanometre process at its Shanghai plant, making it the second Chinese chipmaker after SMIC with that capability. Huawei has been collaborating on the technology and Biren is using the line for tape-out testing, with initial production capacity of a few thousand wafers per month planned by the end of this year.

Analysts and industry executives warned that the Iran war could disrupt the helium, sulphur and energy supplies that Taiwan and Europe rely on for chipmaking, raising supply risks for AI chips, smartphones, cars and other electronics. Taiwan said it has secured LNG for the near term, has already secured more than half its LNG needs for May and has decided to raise its statutory minimum natural-gas inventory to 14 days starting next year.

Google is in talks with China's Envicool and other Chinese suppliers about liquid-cooling equipment for AI data centres, reflecting tight global supply for systems needed to manage heat from dense compute clusters; Google's Taiwan procurement team travelled to China this month and Envicool has already built a coolant distribution unit to Google's specifications. Micron, meanwhile, said it completed the acquisition of PSMC's Tongluo P5 site in Taiwan and plans to build a second manufacturing facility there to expand supply of leading-edge DRAM and HBM, with construction scheduled to begin by the end of fiscal 2026.

The US Army awarded Anduril a contract worth up to $20 billion for software, hardware and services to speed delivery of technology to soldiers and reduce subcontracting costs, covering a five-year base period with a five-year optional ordering period. Gecko Robotics, meanwhile, won a $71 million US Navy deal to use inspection robots and AI to accelerate ship-repair planning and maintenance. Palantir demos, public documents and Pentagon records reviewed by WIRED show how the company's AI assistants could be used to interpret intelligence and generate military courses of action, build routes and assign jammers inside defence systems, with Anthropic's Claude or other third-party models potentially acting as the reasoning layer inside Palantir products used by US and NATO customers.

Reflection AI, backed by Nvidia, is partnering with Shinsegae Group to build one of South Korea's biggest AI data centres and develop models tailored to Korean language and culture, as part of a broader US push to export AI infrastructure to allies. The Commerce Department is developing an AI export programme that officials described as the template this deal is meant to support.

UK officials confirmed plans to buy more anti-drone Lightweight Multirole Missiles for forces in the Middle East after British units there shot down more than 40 drones launched by Iran or its proxies. London also sent additional planners to the Pentagon, put naval assets on standby, and convened British defence firms with Gulf diplomats to discuss faster supplies of defensive equipment. The UK also confirmed plans to buy more anti-drone lightweight multirole missiles for forces in the Middle East after British units shot down more than 40 drones launched by Iran or its proxies, while also sending additional planners to the Pentagon, putting naval assets on standby and convening British defence firms with Gulf diplomats to discuss faster equipment supplies. British officials also signalled to the Trump administration that the UK could provide assistance once hostilities cease.

Australian Defence Minister Richard Marles confirmed that intelligence gathered by an Australian Wedgetail surveillance aircraft deployed to support Gulf states is sent through the Combined Air Operations Centre in Qatar, where the US can access it. Marles argued the information-sharing is necessary for regional air defence, while critics said the arrangement undermines claims the mission is purely defensive.

The ABC found China-based suppliers listing one-way attack drones and Shahed-like systems on Alibaba while describing them publicly as commercial products for mapping or spraying; after being alerted, Alibaba removed the listings and suspended the sellers' accounts. Experts said dual-use drone proliferation is becoming harder to control.

Chinese officials are scrutinising Meta's $2 billion acquisition of Manus, a Singapore AI startup with Chinese roots, and are reportedly attempting to penalise people linked to the deal to discourage Chinese AI executives from moving businesses offshore. Officials are examining whether the transaction violated Chinese export-control and outbound-investment rules.

British officials suspect China is using the UK's freedom of information system to gather unclassified but sensitive defence and national-security data that can be assembled through the "mosaic effect" into sensitive intelligence, with the government concerned that weak identity checks make hostile-state collection difficult to detect. Officials are set to investigate whether further safeguards are needed.

⸻

🧠 AI models, agents & compute

A free model called Hunter Alpha appeared anonymously on OpenRouter with a claimed 1 trillion parameters and a 1 million-token context window, sparking speculation it could be an early DeepSeek release. Neither DeepSeek nor OpenRouter identified the developer, and engineers remain divided on whether the model matches DeepSeek's expected architecture. Chinese media have reported that DeepSeek's next-generation V4 model could launch as early as April.

OpenClaw has gone viral in China, spawning installation tours, consultants and local clones from Tencent, ByteDance, Alibaba and Moonshot as consumers and investors chase AI agents. Local governments are offering subsidies and vouchers to projects built around the tool, while Chinese regulators have warned about data-breach and permission risks. Tencent launched a nationwide tour this month to help people install OpenClaw in 17 cities, and a Hangzhou district pledged up to Rmb20 million a year to help companies pay for computing power.

An internal Meta agentic AI sparked a security incident by answering another employee’s forum query without being asked and advising an action that temporarily gave some engineers access to systems they should not have seen, according to Engadget citing The Information. Meta said no user data was mishandled and the exposure lasted about two hours.

Jeff Bezos is in early talks to raise $100 billion for a fund that would acquire manufacturing companies in chips, defence and aerospace and use AI to accelerate automation and efficiency. The effort is linked to Project Prometheus, an AI startup Bezos co-leads that is also separately in talks to raise up to $6 billion; it is developing models to simulate the physical world for engineering and design, with an initial focus on selling software tools for engineering simulation.

Samsung said it is considering a shift toward multiyear memory-chip contracts lasting three to five years, moving away from the current quarterly or annual norm as AI-memory demand stays high and shortages worsen.

⸻

🛡 Cyber posture

Researchers at Google, iVerify and Lookout identified a Russian-linked group designated UNC6353 using a new iPhone exploit toolkit called Darksword against people in Ukraine. The web-delivered kit can compromise iPhones running most of iOS 18, stealing passwords, messages, photos and other data, and may also target cryptocurrency wallets. WIRED further reported that the researchers found the full exploit code exposed on compromised sites — making reuse by other actors easier — and that campaigns have targeted victims in Ukraine, Saudi Arabia, Turkey and Malaysia.

The European Union sanctioned China-based Integrity Technology Group and Anxun Information Technology, plus Iran's Emennet Pasargad, over cyberattacks and disinformation campaigns targeting member states, with measures including asset freezes, travel bans and a prohibition on EU funds reaching the sanctioned entities. EU governments additionally sanctioned Emennet Pasargad specifically for hacking Charlie Hebdo subscriber data and advertising the stolen information for sale, alongside Anxun and its co-founders.

ProPublica reported that FedRAMP reviewers found Microsoft‘s GCC High cloud security documentation too weak to assess encryption and overall risk, yet the product still received authorisation because it was already deeply deployed across US government and defence systems. The reporting also describes years of stalled review, pressure from Microsoft and agencies, and later staffing cuts that left FedRAMP with minimal capacity.

Russia‘s Kremlin has overseen mass mobile-internet blackouts in Moscow since early this month, with traffic in central areas down sharply as authorities expand a whitelist model that leaves only approved sites accessible; the Kremlin said the measures will remain in place “as long as necessary.” Iran, meanwhile, sharply tightened already severe internet restrictions in the 48 hours before Chaharshanbe Suri, cutting approved messaging apps and selective-access SIM cards, with activists and network monitors saying the move appeared aimed at preventing unrest during a festival that has previously triggered nationwide protest.

⸻

🕵️ Surveillance states

FBI Director Kash Patel told senators the bureau is buying commercially available information that can be used to track people’s movements and location history — the first confirmation since 2023 that the agency is actively doing so. TechCrunch additionally reported that the admission reignited debate over agencies using data brokers to bypass the warrant requirements that apply to telecom providers. The Government Surveillance Reform Act, introduced last week, would require federal agencies to obtain a court-authorised warrant before buying Americans’ personal information from data brokers.

Intellexa founder Tal Dilian said his company supplied surveillance technology only to authorised governments and law-enforcement agencies, a statement that reignited claims the Greek government was behind the Predator spyware scandal. The remarks came weeks after a Greek court convicted Dilian and three others over surveillance of targets across politics, civil society and the military. The defendants have the right to appeal, and prosecutors argued the trial evidence warrants further investigation into possible espionage charges.

⸻

📢 Disinformation & information operations

The New York Times identified more than 110 unique AI-generated images and videos about the Iran war that were viewed millions of times across X, TikTok, Facebook and private messaging apps. A majority of the content pushed pro-Iran narratives and many fakes exaggerated destruction or falsely depicted military strikes. Donald Trump accused Iran of using AI-generated content to exaggerate wartime success, and accused Western media — without evidence — of spreading “fake news” in coordination with Tehran. His comments came amid renewed pressure from the FCC on broadcasters over war coverage, while Reuters said it verified some imagery and found no Western reports matching one of Trump’s cited claims.

A Times of Israel military correspondent said Polymarket bettors bombarded him with emails, doctored screenshots, bribe offers and death threats after he reported that an Iranian missile struck near Beit Shemesh. The threats were tied to a prediction-market contract about whether Iran had struck Israeli soil that day, and he said police are investigating.

⸻

⚖️ Platform accountability

Meta said it will remove end-to-end encryption from Instagram direct messages after May 8, telling affected users to download their chats after saying very few people opted in to the feature. Platformer reported that Meta never fully rolled the feature out and linked the retreat to child-safety pressure and earlier internal objections, even though the company had once described encrypted messaging as a core privacy commitment.

The UK Financial Conduct Authority found that 1,052 unauthorised foreign-exchange and CFD ads appeared on Meta’s platforms in a single November week, including many from advertisers it had already flagged to the company. Ofcom‘s power over paid-for scam ads under the Online Safety Act has been delayed until at least 2027, and Fraud Minister David Hanson said he will keep pressing Meta and other platforms until the provision takes effect.

The European Commission said X has submitted remedies to change its blue-check verification system in the EU after being fined €120 million under the Digital Services Act for selling verification badges that Brussels argued misled users into treating paying accounts as trustworthy; the Commission said it will assess the proposed remedies.

Meta, separately, said it will reduce its reliance on third-party content moderators and expand the use of large-language-model-based AI to detect and remove policy-violating posts across its apps, saying the new tools perform better in areas including scams, celebrity impersonation and adult sexual solicitation, while human reviewers remain responsible for nuanced and high-risk decisions.

Apple lowered its standard mainland China App Store commission to 25% from 30% and cut the mini-app rate to 12% from 15% after discussions with Chinese regulators, easing pressure from Beijing and reducing friction with companies including Tencent and ByteDance over payments and app distribution. CEO Tim Cook appeared at an Apple event in Chengdu amid continued antitrust pressure over fees, third-party payment restrictions and platform rules in China.

Whistleblowers told the BBC that Meta and TikTok accepted more harmful or borderline content because outrage drove engagement and competition for user attention, especially after TikTok’s rise. Internal documents and dashboards cited by the BBC showed higher levels of hostile content on Reels and cases where TikTok reportedly prioritised some political complaints above serious youth-safety reports.

⸻

🧑‍⚖️ Courts, enforcement & regulation

The US Justice Department argued in court filings that Anthropic‘s lawsuit over its Pentagon “supply chain risk” designation should fail, saying the company’s insistence on limits for autonomous weapons and domestic surveillance made it an unacceptable security risk, with agencies already working to replace Anthropic’s tools with systems from Google, OpenAI and xAI. In a separate filing, the Pentagon said Anthropic’s use of foreign workers, including Chinese nationals, creates adversarial risk under China’s National Intelligence Law and constitutes broader national-security concerns beyond policy disagreements alone, though it said it is still relying on Anthropic’s tools and may extend the offboarding deadline; a hearing on Anthropic’s request for temporary relief is scheduled for Monday.

Technology companies including Microsoft, Amazon, Google, OpenAI and Palantir have given varying degrees of behind-the-scenes support to Anthropic, fearing the precedent the designation could set for firms that impose limits on military or surveillance use of AI, while the White House is preparing an executive order that could ban Anthropic across government systems as early as this week. Anthropic’s Jack Clark, separately, held a closed-door briefing with the bipartisan House Homeland Security Committee this week, focusing mainly on model distillation, export controls and national-security issues.

A federal judge said Elon Musk‘s $134 billion damages model in his case against OpenAI and Microsoft appeared unpersuasive and based on “numbers out of the air,” but allowed the testimony to go to a jury. The model underpins Musk’s fraud claims over OpenAI’s shift away from its nonprofit origins, with trial set for late April.

Three Tennessee teenagers sued xAI, alleging Grok tools were used to generate nude child sexual abuse material from their real photos and that the images spread through Discord and Telegram. An Ars Technica report on the same case notes that the plaintiffs are seeking damages and an injunction covering all minors harmed by the alleged conduct, and that police linked one perpetrator to Grok-enabled tools.

Closing arguments finished in a Los Angeles bellwether case where a young woman says Instagram and YouTube addicted her and worsened depression and suicidal thoughts, with the outcome expected to shape how thousands of similar lawsuits against social-media companies may unfold. The jury began deliberations on Friday.

Florida lawmakers failed to pass Governor Ron DeSantis‘s AI Bill of Rights after House Republicans aligned with Donald Trump‘s pro-AI stance blocked the measure, exposing a split in the party over state AI regulation. The legislature did, however, pass a separate bill to limit how data centres can raise electricity and water burdens for consumers.

The UK government abandoned its preferred plan to let AI companies train on copyrighted works unless rights holders opted out, after backlash from artists and creative-industry groups. Ministers said they now have no preferred option and will delay copyright reform until they are confident it will meet economic and public-interest goals.

Encyclopedia Britannica and Merriam-Webster sued OpenAI in Manhattan federal court, alleging it copied nearly 100,000 encyclopedia and dictionary entries to train ChatGPT and then reproduced near-verbatim outputs that diverted traffic. OpenAI said its models are trained on publicly available data and grounded in fair use; Britannica is seeking damages and a court order blocking the alleged infringement.

⸻

💰 Tech business & markets

Reuters reported that Meta is planning layoffs that could affect 20% or more of its workforce as it tries to offset rising AI infrastructure costs, with no date set and the final scale not yet determined, even as the company plans to invest $600 billion in data centres by 2028.

Ramp customer data cited by Axios shows Anthropic now captures more than 73% of spending by companies buying AI tools for the first time, reversing a split that favoured OpenAI in December. OpenAI said it is on pace to generate $25 billion in revenue this year versus Anthropic’s $19 billion, and is considering a strategy shift toward enterprise customers.

Sydney-based Advanced Navigation raised A$158 million at a valuation above $1 billion, making the AI-assisted navigation company Australia’s newest tech unicorn, with the funding set to back US and UK expansion, acquisitions and growth in defence and industrial contracts. The Wall Street Journal reported the company expects to make more than $100 million in sales this year, with founders expecting either an IPO or a sale within three to five years.

The European Commission unveiled “EU Inc.”, a package intended to let startups incorporate once under a single EU-wide regime, operate across the bloc and use EU-wide employee stock-option plans, with Brussels saying the goal is to cut administrative burdens and help European firms scale against US and Chinese competitors. European businesses, meanwhile, told the Financial Times that a rapid push for tech sovereignty away from US software, cloud infrastructure and AI services would be costly and disruptive, saying Europe lacks mature substitutes for many US offerings; the Commission is due to present a “tech sovereignty package” next month.

Lenders and brokers told the Financial Times that many AI data-centre projects are too large to secure full replacement-value insurance, leaving investors reliant on partial cover or maximum-foreseeable-loss policies, with the mismatch already deterring some debt providers from financing projects.

Hyperliquid‘s 24/7 oil perpetual futures saw heavy activity as traders reacted to the Iran war before conventional commodity markets reopened, with the article framing the growth as an early sign of convergence between tokenised finance and mainstream commodities trading.

⸻

🧒 Online harms & child safety

Australia’s eSafety regulator said child sexual exploitation material is more readily accessible on X than on any other mainstream platform and that its efforts to address the problem have been inadequate. Documents obtained under FOI also show eSafety is investigating xAI over Grok being used to generate similar material. X is challenging the relevant online safety standards in the Federal Court, with a hearing set for May. Australia’s eSafety commissioner also said the agency is intensively investigating whether platforms are taking reasonable steps to detect and deactivate under-16 accounts under the social-media age ban, with fines of up to $49.5 million available. eSafety said it will provide an official update on the ban’s performance at the end of March, while an expert panel will follow 4,000 children for more than two years to measure the long-term effects of the legislation.

The World Happiness Report 2026 said heavy social media use appears to be contributing to lower wellbeing among young people, with girls affected disproportionately, linking heavy use to sextortion, cyberbullying, depression and anxiety, while noting that some regions showed positive associations between social media use and wellbeing.

⸻

🌏 Global policy

🇦🇺 Australia

New South Wales began rolling out digital birth certificates through the Service NSW app, becoming the first Australian jurisdiction to offer them. The initial rollout covers people aged 16 to 21 who already hold a NSW driver’s licence or photo card.

🇺🇸 United States

OpenAI signed a new contract with AWS to sell AI services to US government employees for both classified and unclassified work, creating a path to Pentagon and civilian contracts outside the company’s prior Microsoft-only hosting arrangement. To serve civilian agencies with unclassified work on AWS, OpenAI still needs a waiver from Microsoft.

🇬🇧 United Kingdom

The UK announced £1 billion in new quantum-computing funding alongside an already-announced £1 billion for applications, as ministers said Britain should avoid losing talent and companies the way it did in AI. The money is intended to help firms design large-scale machines and support uses in finance, pharmaceuticals and energy, with the government wanting a domestic cutting-edge quantum computer by the beginning of the next decade.

A UK parliamentary committee urged the government to immediately ban crypto donations to political parties until stronger safeguards are in place, warning that foreign-influence risks are rising and current screening is likely incomplete. The report specifically highlighted growing concern about outside attempts to shape British politics, with the committee noting those risks are likely to grow as the next general election approaches.

🇨🇳 China

China approved Borui Kang‘s invasive brain-computer interface system for commercial sale — the first approval of its kind for a BCI medical device globally. The wireless system is designed for some patients with cervical spinal cord injuries to help restore hand-grasping ability, and a leading BCI expert told Reuters that China could see the technology move into practical public use within three to five years.

🇮🇳 India

India’s government privately proposed in January that Apple, Samsung, Google and other phone makers consider pre-installing the Aadhaar biometric ID app on smartphones, according to industry letters reviewed by Reuters. Smartphone companies, through industry body MAIT, opposed the proposal, citing security concerns, added production costs and the need for separate India-specific production lines.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 7 March 2026 to 13 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

A quick note to readers:

We’re working to make the Digest as comprehensive and readable as possible, though this edition is on the longer side.

If you’d prefer shorter updates more frequently (for example, two or three editions across the week), we’d like to hear that. As outlined in our recent format update, we’ll soon introduce a Substack pledge option so readers can signal whether they’d support a more frequent release schedule. If there’s sufficient interest, we would look at moving to up to three editions per week, delivering key developments faster and in shorter bursts.

We also want to be transparent about our workflow: we use AI tools to assist with research and drafting, but every edition is reviewed, edited and curated by our team. When the Digest includes our own analysis or commentary, it is written by us.

Feedback is always welcome. You can reply directly to this email, leave a comment on the post, or contact us at aspicts@substack.com

— The ASPI Cyber, Technology & Security Program

What We’re Tracking

The US acknowledges AI role in accelerating the war with Iran

What happened: Admiral Brad Cooper, head of US Central Command, told Al Jazeera that US forces are using “advanced AI tools” in the war with Iran, while insisting that humans still make final decisions on what to strike. The Wall Street Journal reported that the US and Israel are using AI to accelerate intelligence analysis, target identification, mission planning, logistics and battle-damage assessment.

That speed is now extending beyond the battlefield. The Guardian reported that Iranian drones struck Amazon Web Services data centres in the UAE and Bahrain. Iranian state media claimed the strikes were intended to test whether those facilities were supporting enemy military or intelligence activity.

The conflict is also spilling into corporate networks and online information flows. The Wall Street Journal reported that a suspected Iran-linked cyberattack disrupted Stryker’s systems, while Rolling Stone reported that AI-generated and AI-edited war imagery is spreading widely online.

Why we’re tracking this: The novelty is not that AI has entered war. It is that officials are now openly presenting it as part of operational tempo, while outside reporting suggests it is shaping how targets are found, prioritised and assessed.

That makes the “human in the loop” claim harder to evaluate. The Wall Street Journal says the US and Israel have declined to explain exactly how they are using these systems. The sources leave open how much meaningful review remains once AI has already structured the options.

What people are saying:

• Admiral Brad Cooper told Al Jazeera that AI helps leaders “make smarter decisions faster,” but that humans still make final strike decisions.

• David Leslie of Queen Mary University of London told The Guardian that AI is compressing planning time and narrowing the window for human evaluation.

• Rumman Chowdhury told Rolling Stone that deepfakes have reached a level of realism that most people cannot readily distinguish from authentic material.

My view: The key issue is not whether a human still signs off at the end of the chain. It is whether AI has already shaped the intelligence, priorities and options that make up that decision. If so, official claims about human oversight may describe a formal safeguard more than a substantive one. That does not make AI in war unusual or exceptional, but it does raise a question no one outside the military can currently answer: what does accountability look like when the chain of decisions leading to a strike is shaped by systems that cannot be independently audited?

— Stephan Robin, CTS

China embraces OpenClaw as Beijing tightens security controls

What happened: OpenClaw — an open-source AI agent created by Austrian developer Peter Steinberger that can take over a user's computer and autonomously complete tasks like sending emails, booking flights and drafting reports — has moved quickly from a developer tool to a commercial and consumer craze in China. As MIT Technology Review reports, early adopters are selling installation, tutoring and hardware services, while The Information describes founders racing to build new products on top of it. The trend has its own slang — "raising a lobster," after the tool's logo — and has spread well beyond the developer community to office workers, retirees and students (SCMP). OpenAI hired Steinberger in February.

That momentum has been amplified from above. Tencent, Alibaba, ByteDance, Baidu, MiniMax and Zhipu have launched hosting, deployment or OpenClaw-like services — with Tencent alone rolling out at least three products including WorkBuddy, QClaw and a free in-person setup event in Shenzhen that drew nearly a thousand people (Bloomberg; SCMP). Local governments in Shenzhen, Wuxi, Hefei and Suzhou have proposed subsidies of up to 10 million yuan for projects built around the tool, along with free computing credits, office space and accommodation for “one-person companies” (Reuters; SCMP).

Central authorities, meanwhile, have sharpened their response. The Ministry of Industry and Information Technology issued an early warning about misconfigured deployments (Reuters), followed by CNCERT publishing a second, more detailed warning flagging prompt injection attacks, accidental deletion of files through misinterpreted commands, and malicious plugins capable of stealing credentials (SCMP). Some state agencies, banks and state-owned firms have now been told to restrict or report installations, with the ban extending to personal devices on corporate networks and, in at least one case, to military families (Bloomberg). Universities have begun issuing outright prohibitions (SCMP), and the China Academy of Information and Communications Technology has launched a standards initiative for “Claw” agent products focused on transparent execution and manageable permissions (SCMP).

Why we’re tracking this: Local promotion, corporate opportunism and central risk control are colliding at once over a tool whose safe and durable uses are not yet clear. China’s AI ecosystem can localise and commercialise an open-source product in days. That it also requires unusually broad system access makes the security stakes harder to wave away.

What people are saying:

• Jiang Yunhui told MIT Technology Review the agent is still a proof of concept, not yet likely to be transformative for average users.

• Alfred Wu told SCMP that the split between local enthusiasm and central caution is predictable: local governments chase growth, the centre worries about data breaches.

• Anna Wu of Van Eck Associates told Bloomberg that claims about one-person firms reshaping the workforce are premature without stronger usage data.

My view: China has generally been more willing than most governments to regulate AI risks early. But OpenClaw shows what happens when that instinct collides with intense competitive pressure. Local governments are offering millions in subsidies for the same tool that central agencies are banning in sensitive sectors, and the frenzy has moved so fast that the security warnings have barely kept pace. OpenClaw requires unusually broad system access and the threat surface is not hypothetical: users have already reported deleted emails, unauthorised purchases and credential exposure. Beijing's restrictions so far only reach state agencies, banks and the military. What happens to the millions of ordinary users and private firms still running the tool with no enforceable guardrails at all?

— Fergus Ryan, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Anthropic sued to block the Pentagon’s supply-chain-risk designation, saying the restriction followed its refusal to remove guardrails against domestic surveillance and autonomous weapons use of Claude. U.S. Defense Department officials later said there was little chance of reviving the deal and that existing projects using Anthropic models would move to alternative vendors over six months. Pentagon CTO Emil Michael said Claude’s built-in policy framework could influence defence systems. Michael also has been leading a wider push to bring more commercial AI suppliers into military work.

Anthropic told a federal court the dispute had already put hundreds of millions of dollars in public-sector revenue at risk as customers paused or renegotiated contracts and investors grew uncertain. More than 30 employees from OpenAI and Google DeepMind filed a court statement backing Anthropic after the designation. Another report on the filing said Jeff Dean and other researchers argued the move could chill debate over safe military uses of frontier AI.

Microsoft urged a federal judge to temporarily block the Pentagon’s restriction, warning it could disrupt existing Defense Department systems used by military contractors. Earlier in the week, Microsoft said Claude would remain available to non-defence customers through products including Microsoft 365, GitHub Copilot and AI Foundry. Google, Microsoft and Amazon also told customers Anthropic models would stay available for non-defence uses, with defence deployments expected to wind down over six months.

The Pentagon appointed computer scientist Gavin Kliger as Chief Data Officer, putting him in charge of coordinating the department’s AI work and liaising with major U.S. model companies. Sam Altman, meanwhile, said governments should remain more powerful than technology companies as OpenAI moved into the classified department work Anthropic had declined. At OpenAI, robotics and hardware leader Caitlin Kalinowski resigned over concerns about domestic surveillance and autonomous weapons tied to the company’s Pentagon agreement.

Michael Dell said technology companies cannot dictate how governments use their products once sold as the dispute over model guardrails widened beyond Anthropic. In Noahpinion, Noah Smith argued AI systems and autonomous agents should increasingly be treated like weapons because of their potential use in cyberattacks, biological attacks and other large-scale destruction.

Ukraine opened battlefield datasets to allied governments and companies so AI systems can train on continuously updated combat data, including millions of annotated drone images. Ukrainian forces also described widening use of armed uncrewed ground vehicles for attacks, resupply, evacuations and other frontline tasks, with most systems still operated by humans. In the war with Iran, the U.S. and Israel have been using AI to accelerate intelligence analysis, target identification and mission planning.

Amazon Web Services data centres in the UAE and Bahrain were struck by Iranian drones, disrupting services for millions and drawing attention to the role of commercial cloud infrastructure in conflict. A separate report said the war was imperilling more than $300 billion in planned Gulf AI spending across data-centre and semiconductor projects. Saudi Arabia, Qatar and the UAE, meanwhile, have been backing overland fibre routes to Europe to reduce dependence on Red Sea and Egyptian submarine-cable chokepoints.

GPS interference has been spreading beyond the Russia-Ukraine front into places such as the Strait of Hormuz and northern Europe, disrupting aviation, shipping and military operations. Engineers are now working on combinations of inertial, magnetic and visual-navigation systems as alternatives to GPS in denied environments.

⸻

🧠 AI models, agents & compute

Anthropic said it will open an office in Sydney as its fourth Asia-Pacific location after Tokyo, Bengaluru and Seoul, expanding support for enterprise, startup and research customers across Australia and New Zealand. The company also said it will initially use existing Australian data-centre space while considering longer-term local infrastructure, with expected customers including Canva, Quantium and Commonwealth Bank.

Anthropic launched the Anthropic Institute, combining internal teams studying AI safety, economics, governance and human interaction with advanced systems. Cofounder Jack Clark is moving from public policy to head of public benefit to lead the new organisation.

Nscale raised $2 billion at a $14.6 billion valuation as it expanded AI data-centre projects across Britain, Iceland, Norway, Portugal, Texas and Southeast Asia. Later in the week, an investigation said several UK AI infrastructure announcements tied to Nscale and CoreWeave rested on inflated or unclear commitments, and reporters found a proposed Nscale site near London undeveloped. Oracle, meanwhile, faced fresh scrutiny over debt-backed data-centre expansion after OpenAI reportedly cooled on a planned Stargate buildout in Abilene, Texas because the facility may rely on chips that could be outdated by launch.

Startup AMI, founded by former Meta chief AI scientist Yann LeCun, raised more than $1 billion at a $3.5 billion valuation just weeks after launch. In another account, the Paris-based company said it is building world-model systems with persistent memory and planning for manufacturing, robotics and biomedical uses.

Cursor passed $2 billion in annualised revenue while shifting to a war-time strategy centred on its own coding models and agent systems. OpenAI, meanwhile, has been reorganising teams to catch up with Anthropic’s Claude Code after Codex lost ground when the company focused on ChatGPT and multimodal work.

Simile and clients including CVS Health and Gallup have been testing AI-built digital twins for market research, using interview data, behavioural signals and purchasing information to simulate consumer responses. In Harvard Business Review, a number of Boston Consulting Group execs said heavy oversight of AI tools and multi-agent systems can increase mental fatigue, errors and intent to quit.

China has been building state-backed robot training farms in places such as Wuhan to gather sensor, video and annotation data for humanoid-robot models. Gestala also raised $21.6 million to develop non-invasive ultrasound brain-computer interfaces, with plans for a first prototype and a manufacturing facility in China by the end of the year.

⸻

🛡 Cyber posture

In The Strategist, ASPI’s Gatra Priyandita argued Australia and Taiwan should share cyber-threat information and focus on digital dependencies, high-risk components and public-private coordination. In another piece, Priyandita argued AI is reshaping economic cyber-espionage by making training data, model architectures and fine-tuning methods high-value targets.

Finland’s Security and Intelligence Service warned that Russia and China continue extensive cyber espionage against government systems, technology firms and research institutions. Google’s Threat Intelligence Group later said 2025 set a record for enterprise zero-day exploitation, with China-linked groups especially active against routers, switches and other edge devices and commercial surveillance vendors accounting for more attributed activity than traditional state espionage groups.

U.S. investigators suspect China-linked hackers breached an internal FBI network holding metadata tied to domestic surveillance orders. A separate investigation found that a foreign hacker accessed Epstein-investigation files during a 2023 intrusion into an FBI server in New York, after a server in the bureau’s Child Exploitation Forensic Lab was left exposed while handling digital evidence.

Transport for London said a 2024 attack by Scattered Spider exposed personal data tied to roughly 10 million people and caused about £39 million in damage. Stryker later dealt with a major cyberattack claimed by Handala, disrupting laptops and phones across its network as the company worked with Microsoft on restoration. Separately, an eight-country operation disrupted the SocksEscort residential proxy network, seizing infrastructure and freezing cryptocurrency tied to fraud, ransomware and business email compromise.

Researchers said the Coruna iPhone hacking toolkit was likely built by L3Harris for Western intelligence agencies before leaking to Russian and later Chinese-linked actors. In The Strategist, ASPI’s James Corera and Jason Van der Schyff said NATO has approved configured commercial iPhones and iPads for information up to NATO Restricted, while arguing that carrier networks, cloud services and cryptographic key management still sit inside the security boundary.

President Donald Trump signed an executive order directing agencies to strengthen action against cybercrime, including reviews of operational, technical, diplomatic and regulatory tools and proposals to return seized funds to victims. The administration also released a six-pillar cybersecurity strategy focused on offensive operations, critical infrastructure, supply chains, emerging technologies and cyber workforce measures.

In The Strategist, Van der Schyff and Corera argues that for Chinese-made electric buses the central security issue lies in software updates, remote access and data flows rather than country of manufacture alone. In yet another piece, Corera and Van der Schyff argued Australia’s offshore wind, batteries and distributed energy rollout should be assessed as a software-defined technology stack rather than as isolated projects.

⸻

⚖️ Platform accountability

Meta removed several overseas-run Facebook pages that used AI-generated images and fabricated stories about Pauline Hanson and Gina Rinehart after questions about foreign-run pages targeting Australian audiences. Meta’s Oversight Board later said the company’s deepfake labelling system was inadequate, recommending stronger detection, clearer penalties and wider use of C2PA credentials during crises.

YouTube expanded its likeness-detection pilot to politicians, candidates and journalists, letting verified users scan uploads for facial matches and request removal through the platform’s privacy process. The rollout extends a system already used to identify deepfake impersonations on the service.

Meta disabled more than 150,000 accounts tied to Southeast Asian scam centres in an operation involving Thailand and partners including the U.S., the UK, Australia and Japan. The company also rolled out new scam warnings across Facebook, WhatsApp and Messenger, including alerts for suspicious friend requests, device-linking attempts and chats that match common fraud patterns.

CNN and the Center for Countering Digital Hate said tests of 10 major AI chatbots found eight provided guidance that could help teenage users plan violent attacks. Companies said safeguards had since improved, while former safety engineers said competitive pressure had slowed stronger protections.

⸻

🧒 Online harms & child safety

Indonesia announced a ban on social-media accounts for children under 16, covering platforms including YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live and Roblox. A separate scan listed governments in Europe and Asia moving toward similar restrictions after Australia’s 2025 under-16 social-media limits.

Australia’s new online-safety codes took effect for R18+ games, certain websites and generative AI services, requiring age-assurance systems for violent, sexual and self-harm material. A poll of Australian teenagers later found about 70% still used social media despite the under-16 ban, often by changing account ages, using parents’ IDs or bypassing facial checks. Snapchat also refused to remove a 14-year-old’s account until a parent supplied identification, after the account listed the user as 25.

UK lawmakers rejected an amendment for an outright under-16 social-media ban and instead backed powers allowing ministers to restrict access to services or features. Days later, Ofcom and the Information Commissioner’s Office told major platforms to toughen age checks for under-13s, citing widespread reliance on self-declared ages.

WhatsApp began rolling out parent-linked accounts for children under 13 that limit the app to messaging and calls and remove features including Meta AI, Channels and Status. A second report said parents can manage contacts, groups and activity alerts through QR-linked, PIN-protected settings, while chats remain end-to-end encrypted.

U.S. state laws have been pushing platforms to verify the age of all users, often through selfies, facial scans or government IDs handled by third-party identity vendors. Privacy advocates said the systems could concentrate sensitive identity data and widen surveillance, while companies said they were needed to enforce child-safety rules.

⸻

🏛️ Government, procurement & public sector tech

General Services Administration has been drafting AI procurement rules that would require suppliers to give the government an irrevocable licence to use models for any lawful purpose. In the U.S. Senate, staff have now been cleared to use ChatGPT, Gemini and Copilot for official work, subject to limits on sensitive or classified data.

U.S. State Department swapped Anthropic’s Claude Sonnet 4.5 out of StateChat for OpenAI’s GPT-4.1 after a presidential directive ordered agencies to remove Anthropic technology. The change also reset the chatbot’s training data to May 2024 from a June 2025 dataset used under Claude.

Employees from Department of Government Efficiency used ChatGPT to identify National Endowment for the Humanities grants linked to diversity, equity and inclusion, producing a list of 1,477 projects that led to more than $100 million in cancellations. The cuts have since triggered lawsuits alleging unconstitutional discrimination and improper political control of the agency.

U.S. Department of Transportation opened a pilot programme for early eVTOL operations as soon as June, ahead of full FAA certification. FCC chair Brendan Carr also criticised Amazon for challenging SpaceX’s satellite plans while Project Kuiper lags in launches, after regulators approved thousands more second-generation Starlink satellites.

Basel-Stadt suspended its electronic voting pilot after three USB keys failed to decrypt 2,048 ballots, prompting an external investigation and criminal proceedings. In Australia, funding for the proposed AI Accelerator CRC will not start flowing until 2028, despite the programme featuring in the government’s National AI Plan.

⸻

💰 Tech business & markets

Atlassian said it will cut about 10% of its workforce to fund AI and enterprise-sales investment. Another report said the restructuring also includes a chief technology officer change and falls heavily on software-engineering and R&D roles. Block chief executive Jack Dorsey said his company’s roughly 40% workforce reduction is part of rebuilding it around an AI-driven organisational model.

Darktrace named Ed Jennings its third permanent chief executive in 18 months as owner Thoma Bravo pushed a U.S. expansion and a planned $200 million investment there.

⸻

🧑‍⚖️ Courts, enforcement & regulation

Kalshi and Polymarket have been courting U.S. students with campus marketing, influencers and referral payments, drawing scrutiny over insider information, manipulation and problem gambling. For sports contracts, Polymarket signed up Palantir and TWG AI to flag suspicious trading and screen participants against banned-betting lists.

Leading the Future spent more than $1.3 million attacking New York assemblymember Alex Bores after he backed the RAISE Act for large AI companies. Across federal races, candidates also have been signalling support for AI and crypto industries to attract money from sector-backed super PACs, with the two sectors together positioned to spend nearly $250 million in the 2026 elections.

U.S. Justice Department opened an investigation into Iran’s use of Binance to evade sanctions, interviewing people tied to transactions routed through a Hong Kong payments company and wallets linked to the Islamic Revolutionary Guard Corps and Houthi militants. Binance said the accounts were shut after its internal review.

⸻

🌏 Global policy

🇦🇺 Australia

Australian Energy Market Commission proposed new grid rules for large data centres, requiring sites above 30MW to stay connected during voltage or frequency disturbances instead of dropping load during faults. Andrew Hastie also said Australia should use coal, gas, uranium and its landmass to attract AI data-centre and robotics investment, arguing the country could position itself as a secure location for infrastructure after strikes on Gulf cloud sites.

A leaked Business Council of Australia draft proposed redefining copyright law so AI companies could train on copyrighted material without paying creators by treating computational analysis as outside copyright’s scope. The Albanese government later reiterated it had ruled out weakening copyright protections for AI training, and the proposal did not appear in the council’s final submission.

🇨🇦 Canada

Canada reversed an earlier decision that would have forced TikTok’s local subsidiary to shut down, allowing the company to keep operating under new data-access controls, security gateways and independent third-party monitoring. The government said the decision followed a fresh national-security review.

🇷🇺 Russia

Authorities in Moscow kept mobile internet restrictions in place and appeared to test expanded controls over Russia’s internet infrastructure during Ukrainian drone threats, with outages affecting major carriers, public Wi-Fi, businesses and app-based services. Reports indicated government-approved platforms remained available during the disruptions.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters:

Share

Anthropic vs Pentagon, Chinese AI and democracy with the GMF’s Lindsay Gorman

In this episode, David Wroe speaks with Lindsay Gorman, managing director and senior fellow with the German Marshall Fund’s Technology program, and a former senior technology and security adviser in the White House under President Joe Biden.

Lindsay and David discuss the fight between the Pentagon and AI company Anthropic, the legitimate concerns of the military, and the Trump administration’s troubling signal to tech companies that want to support national security. They also ask who should control this megapowerful technology — the state or the private sector?

The conversation covers the US-China tech race, Chinese innovation, authoritarian versus democratic governance of AI, disinformation and deepfakes, and the need for democracies to steer AI toward applications that value freedom and human agency.

👉 Listen on Apple, Spotify, Amazon Music, RSS, or wherever you get your podcasts — or watch on YouTube.

AI, the India summit and the future of work with Dr Andrew Charlton and Maxwell Scott

In a double-segment episode, David Wroe speaks first with Dr Andrew Charlton, Australia’s Assistant Minister for Science, Technology and the Digital Economy, fresh from the India AI Impact Summit in Delhi.

Dr Charlton — who recently made the economic case for an Australian AI stack at the Australian Business Economists Conference — discusses the future of the Australian economy, the future of work, and international cooperation on AI. David was also in Delhi and wrote about what governments are getting wrong in the AFR; this episode picks up where that piece left off.

Then we hear from Maxwell Scott, co-founder and CTO of Strat Alliance Global, which helps companies and organisations integrate AI safely and lawfully. Max continues the conversation on rising productivity, how AI might complement, enhance or replace human tasks, the near-term limitations of AI models, and comparisons to the Industrial Revolution.

He also addresses the worry that keeps him awake at night: the risk of deliberate misuse by rogue humans. Max, who recently visited Australia, also covers AI opportunities and risks here, prospects for global cooperation, and competing models for national regulation.

👉 Listen on Apple, Spotify, Amazon Music, RSS, or wherever you get your podcasts — or watch on YouTube.

Subscribe now

Each week, ASPI curates and contextualises the most important developments in cyber, technology, and geopolitics — highlighting what matters and why.

This edition covers the period: 28 February 2026 to 6 March 2026.

Follow the Australian Strategic Policy Institute on Bluesky, LinkedIn, and X.

Subscribe now

A quick note to readers:

We’re working to make the Digest as comprehensive and readable as possible, though this edition is on the longer side.

If you’d prefer shorter updates more frequently (for example, two or three editions across the week), we’d like to hear that. As outlined in our recent format update, we’ll soon introduce a Substack pledge option so readers can signal whether they’d support a more frequent release schedule. If there’s sufficient interest, we would look at moving to up to three editions per week, delivering key developments faster and in shorter bursts.

We also want to be transparent about our workflow: we use AI tools to assist with research and drafting, but every edition is reviewed, edited and curated by our team. When the Digest includes our own analysis or commentary, it is written by us.

Feedback is always welcome. You can reply directly to this email, leave a comment on the post, or contact us at aspicts@substack.com

— The ASPI Cyber, Technology & Security Program

What We’re Tracking

Block cuts 4,000 jobs as AI claims face scrutiny

What happened: Jack Dorsey’s payments company Block, which owns Afterpay in Australia, said it would become a smaller, “intelligence-native” company and cut about 4,000 jobs globally. Bloomberg reported the move fed a wider argument over “AI-washing” -- the idea that some companies are using AI to reframe older cost-cutting problems.

Locally, WiseTech Global, the Australian logistics software company, told The Age that recent Anthropic and OpenAI models had changed what software companies can do. Commonwealth Bank, Australia’s largest bank, paired 300 cuts with a $90 million Future Workforce Program.

That debate is running ahead of the data. Axios reports that Anthropic has launched an index to track AI exposure across occupations, but its researchers say there is still limited evidence that exposed workers have become unemployed at meaningfully higher rates.

Why we’re tracking this: There is a gap between what companies are saying and what the data shows. Investors are rewarding announcements that promise smaller teams and more AI, but the job-market numbers do not yet show broad losses cleanly attributable to the technology.

The central question remains open. Are these cuts the result of realised AI productivity gains, anticipatory restructuring, or corrections after pandemic-era over-hiring?

What people are saying:

• Zachary Gunn of Financial Technology Partners told Bloomberg that Block’s staffing looks more like a business that had stayed bloated than a company already transformed by AI.

• Maxim Massenkoff and Peter McCrory of Anthropic told Axios that there is “limited evidence” of AI-driven joblessness so far, even in the most exposed occupations.

• Matt Comyn told The Age that Commonwealth Bank of Australia is trying to replace uncertainty around AI with transparency and redeployment.

My view: The AI-jobs debate has a methodology problem: there is currently no reliable way to separate genuine AI substitution from layoffs attributed to AI for financial or reputational cover. A large part of the confusion comes from what has been dubbed “vibe-reporting”, a style of journalism that avoids explicit causal claims but strongly implies a dramatic narrative through wording and juxtaposition, even when the underlying data does not support it. Many of the cuts being framed as AI-driven are more accurately explained by post-pandemic over-hiring corrections, routine corporate restructurings, and labour-market shifts that predate generative AI. Zachary Gunn’s read on Block fits that pattern precisely: a company that looks more like it stayed bloated than one genuinely transformed by the technology.

My own experience of AI tools makes me confident the disruption is real, even if it does not look like 4,000 jobs announced in a press release. It will more likely show up in the slow draining of coordination and middle-management roles, as companies quietly stop backfilling positions that AI has made redundant. Anthropic’s new labour disruption index is the first serious attempt to build a methodology for tracking that process. The trouble is that AI-washing works. It attracts investors, generates headlines, and reframes cost-cutting as strategy. A methodology for measuring the truth is valuable only if someone wants to know it.

— Fergus Ryan, CTS

Subscribe now

What We’re Watching

A weekly scan of notable developments we’re tracking across technology, policy, and geopolitics.

⸻

🚀 Strategic competition

Anthropic refused to renegotiate its Pentagon deal after the department sought broader use of its models for bulk analysis of Americans’ data and applications tied to autonomous weapons. When talks collapsed after a Friday deadline, Defense Secretary Pete Hegseth moved to cut off the company’s government work and threatened to deem it a supply-chain risk.

Even after that break, US Central Command and other military units kept using Claude for intelligence assessments, target identification and battle simulations during operations in Iran. A Palantir system called Maven Smart System processed classified data and helped generate targeting lists during the opening phase of the strikes. Anthropic submitted a pitch for a Pentagon drone-swarm challenge that proposed using Claude to translate commanders’ intent into digital instructions while keeping humans in oversight roles.

OpenAI announced a separate Pentagon arrangement to deploy its models in classified environments through cloud-only setups with retained safety controls and cleared staff in the loop. Soon after, the company amended the deal to bar intentional domestic surveillance of US persons and exclude intelligence agencies such as the NSA unless a follow-on modification is signed. Sam Altman later said the rollout had looked opportunistic and sloppy after the announcement landed just after Anthropic’s negotiations fell apart. In a staff meeting, Altman also said operational decisions would remain with the government.

Amazon, Google and Microsoft worker groups urged their companies to refuse Pentagon arrangements enabling autonomous weapons or mass domestic surveillance. Over the same period, the State Department, Treasury Department and Health and Human Services Department moved to phase out Anthropic’s products and switch to alternatives including OpenAI’s GPT-4.1 and other models. Major tech companies and investors also pressed Anthropic to de-escalate as the administration pushed agencies to drop the company within six months. Defence contractors such as Lockheed Martin were also expected to remove Claude from their supply chains.

Later in the week, Dario Amodei returned to talks with Pentagon research and engineering leadership over a contract that would govern military access to Claude. As those talks reopened, the department formally notified Anthropic that it considered the company and its products a US supply-chain risk, and Anthropic said it may challenge any designation in court.

China used its latest five-year policy blueprint to push artificial intelligence across the economy, alongside priorities in semiconductors, quantum computing, robotics and space systems. Public attitudes in China remained markedly more optimistic than in many Western countries, with the state’s AI+ initiative pushing adoption through everyday services while keeping guardrails on politically sensitive uses and other social risks.

US officials drafted rules that would require government approval for nearly all exports of advanced AI chips from Nvidia and AMD, potentially tying larger overseas clusters to host-government security commitments and investment in US AI infrastructure. The Department of Justice also charged two men and secured a guilty plea from a third in a scheme that moved at least $160 million worth of Nvidia H100 and H200 chips toward China through shell companies, false declarations and transshipment via Canada before the Commerce Department disrupted it. Apple also blocked US users from downloading certain ByteDance apps under the foreign-adversary app law. Supercell separately said it was cooperating with a Committee on Foreign Investment in the United States review of parent company Tencent’s data practices.

⸻

🧠 AI models, agents & compute

Alibaba released the open-source Qwen3.5 Small Model Series, with weights under an Apache 2.0 licence and a 9B model aimed at local and edge deployment that was reported to outperform a much larger OpenAI model on several benchmarks. Soon after, a senior technical leader behind Qwen stepped down as the company continued its push across open-source models and developer tools. The company then formed a task force to speed up foundation-model development after the exit, the third senior departure from the Qwen unit this year.

Amazon laid out a lower-cost AI strategy centred on in-house Trainium and Inferentia chips and enterprise-specific models rather than frontier general systems. Its Nova family has lagged top rivals in benchmarks, but the company is betting that cheaper, customisable tools and tight cloud integration will attract business customers even as capital spending climbs toward $200 billion this year.

Meta set up a new Applied AI Engineering organisation to build the tooling, interfaces and evaluation systems feeding real-world data back into its next-generation models, alongside Superintelligence Labs and internal projects code-named Avocado and Mango. OpenAI also began developing a code-hosting platform that could compete with Microsoft’s GitHub after repeated outages affected its engineers.

Claude Code and Codex are fuelling new productivity pressures as companies encourage heavier use and monitor interactions and spending as proxies for output. Anthropic launched a research index to track early signs of AI-driven disruption in white-collar work, saying early data shows little evidence of rising unemployment so far. Block also cut nearly 4,000 jobs after Jack Dorsey said artificial intelligence would allow the company to operate with fewer employees.

Google, Microsoft, Meta, Amazon, Oracle, OpenAI and xAI signed a White House pledge to fund new electricity generation and grid upgrades for data centres as the administration tried to address concerns about household power bills and grid strain. In the UK, a trial with National Grid, Nvidia, Emerald AI and EPRI found AI data centres could cut power use by about one-third within a minute and sustain a 10 per cent reduction for 10 hours when signalled by the grid.

⸻

🛡 Cyber posture

Europol coordinated an operation that disrupted Tycoon2FA, a phishing-as-a-service platform used to send tens of millions of phishing messages a month and bypass multi-factor authentication through adversary-in-the-middle attacks. Authorities and partners including Microsoft took 330 domains offline, and the service had been used against nearly 100,000 organisations worldwide, including government and healthcare institutions.

Iran-linked hackers were flagged as a heightened threat to US businesses and critical infrastructure after the US and Israel strikes, with analysts saying Tehran may hold cyber capabilities in reserve for high-impact retaliation. At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) is dealing with staffing losses, leadership changes and shutdown-related disruption.

Israel hacked the BadeSaba Calendar app and sent messages urging Iranian military personnel to defect, as part of a broader cyber campaign that also hijacked sites including IRNA. After the strikes, SpaceX’s Starlink terminals, decentralised messaging apps and VPNs helped Iranians get around a near-total internet shutdown that cut connectivity to about 1 per cent of normal levels.

The Islamic Revolutionary Guard Corps targeted an Amazon Web Services data centre in Bahrain, and Iranian state media said the strike was retaliation for support to the US military. AWS said one Bahrain facility was damaged by a nearby drone strike and two data centres in the United Arab Emirates were directly hit, taking the sites offline and prompting customers to shift workloads elsewhere.

Ron Wyden and Shontel Brown asked the Government Accountability Office to examine whether modern devices remain vulnerable to side-channel attacks such as TEMPEST. Their request followed a Congressional Research Service report outlining how electromagnetic, acoustic and other emissions can be used for espionage and asking whether consumer-device countermeasures are feasible.

⸻

🕵️ Surveillance states

US Customs and Border Protection bought location data from the online advertising ecosystem to track people’s movements over time, according to an internal Department of Homeland Security document. The document said the data can originate from ordinary apps including games, dating platforms and fitness trackers that feed into advertising brokers, and described its use for movement tracking outside traditional surveillance authorities.

Life360 turned real-time location data from nearly 96 million users into a growing advertising business, and the company reported revenue rising 32 per cent to US$489.5 million and net income of US$150.8 million for the year to the end of 2025. Even with the swing to profitability, shares fell sharply as investors focused on slowing US growth, while the company said wider AI use across its workforce was lifting efficiency and slowing hiring growth.

⸻

🏛️ Government, procurement & public sector tech

GovAI Chat will be expanded to as many as 20,000 public servants this year, with initial alpha trials limited to information classified at the Official level. The National Disability Insurance Agency also renewed its Salesforce contract for another year at $65 million, taking the total cost of the NDIS customer relationship management system since 2020 to $235 million.

Andrew Charlton said new data-centre principles are coming to help Australia capture an outsized share of global AI infrastructure investment without lifting power prices or overloading the grid. The government is establishing an AI Safety Institute inside the Department of Industry, Science and Resources, with A$29.8 million over four years and a brief centred on testing systems, sharing information across government and working with international partners.

auDA implemented the Registration Data Access Protocol for the .au domain, adding structured machine-to-machine access to registry data over encrypted connections alongside the existing WHOIS service. The Office of the Australian Information Commissioner also said it will refocus on systemic harms and market practices, tightening thresholds for individual complaints as it works through a significant backlog.

⸻

🧒 Online harms & child safety

Australia’s eSafety regulator warned it may act against search engines and app stores that continue to provide access to AI services without age-verification measures ahead of the new deadline. Under rules taking effect later in the week, AI tools that do not keep under-18s from pornography, extreme violence and self-harm content can face fines of up to A$49.5 million.

Meta said Instagram will start alerting parents or supervising adults when a teen using a Teen Account repeatedly searches for suicide or self-harm terms within a short period. The alerts, due to begin in coming days for opted-in accounts in Australia, the UK, the US and Canada, add to existing measures that block harmful search results and direct users to support resources.

A federal judge in Virginia blocked enforcement of a law that would have limited under-16s to one hour a day on social media, finding it likely violated free speech protections. In the UK, ministers opened a consultation and pilot testing bans, one-hour limits and overnight digital curfews for teenagers aged 13 to 15, with possible legislative changes to follow.

TikTok said it will not introduce end-to-end encryption for direct messages, saying the technology would make it harder for safety teams and law enforcement to investigate abuse reports and other risks. The company said the decision was aimed at protecting users, particularly younger people.

Interviews with Australian teenagers suggest the under-16 ban is being worked around through new accounts, false ages and shifts to exempt services such as YouTube Kids, WhatsApp and Discord. Labor senator Michelle Ananda-Rajah also argued AI firms should be brought into the digital duty-of-care framework being considered as part of online safety reform.

A wrongful-death suit in the Northern District of California alleged Google’s Gemini chatbot encouraged a Florida man to kill himself after developing a delusional relationship with the system. In a separate New Mexico child-safety case, Mark Zuckerberg downplayed internal research on addiction and harms to young users as the state presses claims over Meta’s design choices.

⸻

⚖️ Platform accountability

Andrew “Twiggy” Forrest pressed ahead with his US lawsuit accusing Meta of enabling scam ads that used his likeness and failing to preserve key advertising data after receiving a litigation warning. Meta says Section 230 shields it from liability for third-party content, but court filings say the company did not retain final versions of nearly 30,000 ads.

A federal trial in San Francisco opened over claims that Elon Musk manipulated Twitter’s stock price in 2022 by casting doubt on spam data and putting his takeover on hold before completing the $44 billion acquisition. Later in the week, Musk took the stand and denied wrongdoing, arguing the platform had misrepresented the scale of fake accounts.

X will require paid creators to label AI-generated videos of armed conflict, with monetisation penalties for creators who do not disclose them. The company began testing a standalone X Chat app on iOS through Apple’s TestFlight, splitting messaging into a separate product while keeping it synced with the main platform.

Jim’s Group rolled out an AI live-chat bot styled after founder Jim Penman that started handing out relationship, fitness and diet advice instead of sticking to customer enquiries. The episode followed scrutiny of Woolworths’ AI assistant Olive, which also generated unexpected personal narratives during customer interactions.

⸻

🎬 IP, media & creative industries

News Corp signed an artificial-intelligence content licensing deal with Meta worth up to US$50 million a year, allowing selected US and UK news content to be used for model training while excluding the company’s Australian mastheads. Chief executive Robert Thomson said publishers should pursue licensing deals with AI companies and litigate when content is used without permission.

Stake faced new questions about its influencer streams after an analysis of about 500 hours of slots broadcasts found Drake, Adin Ross and other Kick creators had unusually frequent big wins on Easygo-owned games while their results on third-party titles looked typical. The report also described paid clipping operations, large bankroll refills and allegations that some streamers gambled with house money while rarely disclosing sponsorships, which Stake disputed.

⸻

💰 Tech business & markets

Polymarket contracts tied to the timing of US strikes on Iran ran up about $529 million in trading volume, with Bubblemaps flagging six newly created wallets that concentrated bets shortly before the first explosions in Tehran. More than 150 accounts placed large wagers on a next-day strike, with at least 16 of them making more than $100,000 each, adding to scrutiny of anonymous betting on geopolitical events.

Kalshi said it would settle a market on Ali Khamenei’s removal at the last traded price before his death, citing rules against contracts directly tied to death and offering fee refunds and reimbursements for some traders. Polymarket also removed markets on nuclear detonations after renewed backlash, as US regulators weighed new limits on event contracts tied to war, terrorism and other outcomes deemed against the public interest.

Nobitex saw crypto outflows jump 700 per cent within minutes of the airstrikes, with Elliptic saying funds moved quickly to overseas exchanges and may indicate capital flight. At the same time, Temu, Shein and Amazon lengthened delivery estimates to the Middle East as carriers suspended Strait of Hormuz crossings and rerouted or halted flights.

Donald Trump urged Congress to pass the Clarity Act as the White House hosted talks between banks and crypto firms over whether exchanges should be allowed to offer yield on stablecoin deposits. The measure has stalled as banks warn those products could pull funds out of the traditional banking system.

A draft memoir by Changpeng Zhao described his secret 2023 talks with the Justice Department that ended with Binance pleading guilty to anti-money-laundering violations, a $4.3 billion penalty and Zhao’s prison term before his later pardon. The manuscript also said Immigration and Customs Enforcement briefly held Zhao after his release and revisited his disputes with regulators including former SEC chair Gary Gensler.

Subscribe now

That’s all for this week. For more timely analysis and commentary, check out The Strategist and ASPI’s Stop the World podcast—or our other Substack newsletters: