CrowdStrike warns China is intensifying espionage to steal AI assets

The global race for artificial intelligence is opening a new front in cybersecurity. CrowdStrike warned that actors linked to China are stepping up their espionage operations against technology companies with the aim of obtaining AI capabilities, intellectual property, and access to environments that could serve as an entry point for broader supply-chain compromises.

The warning comes at a time when competition between the United States and China over chips, models, infrastructure, and talent is no longer playing out solely in laboratories, data centers, or public markets, but also on corporate networks. According to CNBC, CrowdStrike maintains that this increase in activity reflects Beijing’s effort to close the technology gap with the United States in an area considered strategic.

What CrowdStrike found

The report’s most frequently cited finding is that China-linked actors accounted for more than 58% of targeted, state-sponsored intrusions against the technology sector. CrowdStrike also indicates that these China-linked operations constituted the biggest intelligence collection threat to companies in the sector, which today hold some of the digital economy’s most valuable assets: models, data, software, training workflows, designs, and AI-related intellectual property.

The cybersecurity firm frames that finding within its *2026 Technology Threat Landscape Report*, an analysis based on intelligence from its Counter Adversary Operations team covering the period from April 1, 2025, to March 31, 2026. In that document, CrowdStrike maintains that the technology sector has for years remained the most targeted by eCrime adversaries and state groups, but emphasizes that the AI boom further increases the strategic value of companies developing these capabilities.

What types of operations the report describes

CrowdStrike mentions several groups that it attributes to China, including MURKY PANDA, MUSTANG PANDA, OVERCAST PANDA, SUNRISE PANDA, and WARP PANDA. According to the company, these operations sought access to technology, intellectual property, and information aligned with the Chinese state’s intelligence objectives.

The report includes specific examples. SUNRISE PANDA reportedly conducted persistent campaigns against technology entities in East and Southeast Asia, particularly email infrastructure that could facilitate access to government communications. MURKY PANDA reportedly carried out *password spraying* attacks against more than 340 organizations, most of them based in the United States, with the technology sector among the most affected. WARP PANDA, for its part, reportedly exploited vulnerabilities to maintain persistent access to technology organizations in North America.

CrowdStrike also warns that the interest is not limited to the direct theft of internal information. The firm notes that China-linked actors seek access to customer and third-party environments that could enable supply-chain compromises, a particularly sensitive avenue in an industry where a single intrusion can affect multiple downstream companies.

Why AI is at the center of this story

The key point of the report is that CrowdStrike positions AI as a high-value asset within that espionage campaign. The company says the pursuit of technological self-sufficiency and a competitive advantage in emerging technologies makes AI capabilities a natural target for intelligence services and state-sponsored groups.

CNBC adds that U.S. restrictions on China’s access to advanced training chips have intensified that competition. At the same time, Chinese companies have tried to reduce operating costs and improve the performance of their own models, making any attempt to obtain knowledge, tools, or intellectual property from U.S. firms through illicit means even more sensitive.

The coverage also recalls that, earlier this year, Anthropic and OpenAI complained that Chinese companies had extracted competitive intelligence from their systems. That context reinforces the idea that the contest over AI is no longer merely commercial: it is also moving squarely into the realm of industrial espionage and national security.

What the report also shows

Although China accounts for most of the state-backed intrusions described against the technology sector, the report also mentions activity linked to North Korea. CrowdStrike said it had observed attempts to infiltrate IT workforces in North America, Europe, and Asia, primarily to generate revenue for the regime. That part of the document broadens the picture: in addition to espionage for technological advantages, the AI and software ecosystem remains under pressure from campaigns focused on monetization, fraud, and insider access.

Final analysis

CrowdStrike’s warning points to an important change: AI assets are no longer just tools for innovation, but also priority espionage targets. If technology companies are competing for models, chips, data, and talent, they will also have to compete to protect them. In that race, email, credential, vulnerability, and supply-chain security is starting to become as strategic as AI development itself.

Sources: CNBC, CrowdStrike Blog, and CrowdStrike 2026 Technology Threat Landscape Report.