China Spy Chief Names OpenAI GPT-5.5-Cyber as Cyber Threat

Executive Summary

China's top intelligence official publicly named two U.S. frontier AI models — OpenAI's GPT-5.5-Cyber and Anthropic's Claude Mythos — as cybersecurity risks to the country's critical information infrastructure. Chen Yixin, head of the Ministry of State Security, made the remarks in an article published in the journal of the Cyberspace Administration of China (CAC). He did not allege that either model had been used in attacks against China.

The warning lands days after Anthropic published a threat report describing a Chinese-speaking group that used Claude to run what the company called an "autonomous vulnerability research program." Chen's article also coincides with the CAC's release of a new AI governance framework focused on autonomous agents and embodied AI, which identifies "loss of control" as a core risk. The framework is guidance, not law.

Technical Analysis

Chen framed the two models as evidence of what he called a "disruptive upgrade" in cyber capability, specifically citing faster vulnerability discovery and malware development. In his characterization, "cybersecurity is entering a new phase characterized by vulnerability industrialization, fully automated attack and defense, and AI versus AI." He attributed the shift to unnamed "countries and organizations" that he said can rapidly discover vulnerabilities at scale, automatically connect attack paths, and complete complex hacking tasks — lowering both the technical bar and the cost of launching attacks against Chinese critical information infrastructure.

Chen's article listed six major AI risks. The first was that generative AI directly threatens "political security, institutional security, and ideological security" by enabling hostile actors to fabricate political rumors, spread harmful information, and incite confrontational sentiment "at low cost and in large quantities." Other cited concerns included espionage, data leaks, U.S. technology export controls, alleged monopolistic practices, algorithmic decision-making in "social governance," and AI's impact on military operations. He did not address China's own use of AI in offensive cyber operations.

The Record notes that Western governments have raised parallel concerns. The Five Eyes intelligence alliance warned in June that frontier AI models could reshape offensive and defensive cyber operations within months rather than years. The article also flags an important asymmetry: while vulnerability reports have reached record levels since that warning, a proportionate uptick in actual cyberattacks has not yet been observed.

Anthropic's report — published days before Chen's article — described a Chinese-speaking group that included two operators the company identified as undergraduates at a university in Hunan. According to Anthropic, the group used Claude to find several zero-day flaws in a major security product. The report also documented misuse of Claude by Russia-linked and other actors. Separately, leaked technical documents reported earlier this year by Recorded Future News appeared to show a Chinese state-backed training platform used to rehearse — and potentially train AI to support — cyberattacks against critical infrastructure in neighboring countries.

Chen also criticized foreign export controls and "closed-source ecosystems," positioning China as an open alternative. Chinese labs have become major proponents of open-weight models, a strategy analysts view in part as an effort to spread Chinese technology and influence technical standards abroad. Chen described AI as an "international public good" and called for its use so the Global South could close what he called the "intelligence gap."

Mitigations & Recommendations

This story does not describe a specific vulnerability, exploit chain, or attacker tooling that defenders can block at the endpoint or network layer. The concrete defensive signal is reputational and policy-level: two named frontier AI models are now the subject of an official threat characterization by a foreign intelligence service, and Anthropic has documented at least one real-world case of Claude being used for autonomous vulnerability research against a security product.

Security teams running frontier-model-assisted vulnerability research or red-team workflows should assume that model outputs — including zero-day discovery and exploit-path reasoning — are being monitored by nation-state adversaries and may be subject to regulatory scrutiny in jurisdictions that treat AI-assisted offensive work as a national security matter. Organizations operating critical infrastructure in or adjacent to China should treat the CAC's new autonomous-agent framework as a forward indicator of compliance expectations, even though it is currently guidance rather than binding law. There is no CVE, IOC, or TTP set associated with this reporting.