Nvidia After Jensen Huang: Espionage, Insider Risk and the Security Lessons Behind the Headlines

Isharth Kumar

(Intern) Policy & Advocacy, CyberPeace

PUBLISHED ON

Nov 12, 2026

Introduction

Few stories have developed as quickly as the recent Nvidia story. In a matter of a week, the world’s most valuable semiconductor company has launched its own investigation into a foreign intelligence operation, received enquiries from three U.S. Congress committees and had its co-founder and CEO, Jensen Huang, resign from the role of CEO, just two weeks into the role. Most articles have covered the impact on the stock price and Jensen Huang. This article aims to highlight the important lessons to be learned from this situation. These lessons are around insider threat, protecting trade secrets, export controls and executive privacy.

How did it happen?

The order of events is important. On the 4th of November, the chair of the House Foreign Affairs Committee, the Select Committee on China, and the House Intelligence Committee requested a private meeting with Jensen Huang. This was to discuss his relationship with Alice Huang (a customer of Nvidia based in Singapore and senior executive of Megaspeed (also a customer of Nvidia based in Singapore)) and the steps taken by Nvidia to protect against foreign espionage. According to US intelligence estimates, she had been sent by the Ministry of State Security of China to spy on him. On the 8th November (Sunday), the Nvidia board announced that they would be conducting an independent investigation led by external counsel and independent directors.

Jensen assured his colleagues that the relationship was personal and that no trade secrets or national security information had been passed. The board also stated that they had no reason to believe that any corporate secrets or national security would be compromised; however, they would be conducting an investigation into all available information. Jensen resigned four days later, and Colette Kress (Chief Financial Officer) became Interim CEO. This caused the stock value to plummet to below 4 trillion. However, importantly, there is no indication that anything has been taken from Nvidia as of the 14th of November. There are allegations and an investigation taking place.

The Attack Surface

The amount of money spent on security is less around homeland security and more around network, endpoints and cloud. Intelligence agencies have known for many years that people are the weakest link. If someone has a personal connection, warm introduction or easy target, then they can gain access to information that could never be gained through spear phishing emails. CEOs are a prime target as they hold the largest map of information in their head such as pricing, customer relationships and political environment. This means they know a lot about Nvidia’s GPUs.

The main lesson to learn from this is that we shouldn’t investigate people’s private lives. We should create a culture where someone (whether it be an intern or CEO) can highlight any unusual incidents without feeling embarrassed. Having counter-intelligence training, clear escalation processes and strict need-to-know policies can help to reduce the risk if someone is successfully seduced.

Megaspeed and the limits of export controls

Megaspeed are not new to this. The police in Singapore are investigating them for potential breaches of local law. In March, Sen. Tom Cotton (R-Ark.) requested the Commerce Department to investigate allegations of chip diversion by Nvidia. The Associated Press reported that the Bureau of Industry and Security in the Commerce Department investigated Megaspeed in 2024 and referred the case to the Justice Department. Megaspeed have denied any criminal activity and Nvidia have stated that they have not seen any evidence of chip diversion in the past.

There is no denying the facts. The issues are structural. Export controls are around supply chain and information security. They require intermediary’s to ensure the hardware is going to the correct end user. If the data centre capacity written down by the buyer doesn’t match the import totals or ownership is in one jurisdiction but control in another then issues can occur. The enforcement is done well after the hardware has been delivered. Nvidia have stated that only information allowed by law is provided to their cloud customers in their region. This is sensible but it will be difficult for any firm to prove this doesn’t happen to dozens of providers across multiple countries.

Privacy, disclosure and governance

This creates a real dilemma. Normally there would be no interest in any senior executives' private lives; however, companies should be very careful. If we look into the intelligence assessment, then we start to lose the privacy of someone. The New York Times suggests that Jensen could have been briefed on the intelligence report up to a year before the article was published. This means the board will need to consider what information they want to know. Policies will need to be in place to ensure the correct amount of privacy is given and to ensure there are no real risks. This should start with the most senior executives.

The investigation will require sensitive personal information about the executive, other staff and customers. This information will need to be securely managed, have a retention period and a record of who has viewed what. If there is any data leakage around the investigation, it could cause harm to innocent people and impact the case.

Normally you wouldn’t want any of your top executives' private lives to become an issue for the company. However, as soon as you start looking into the intelligence assessment, you start to lose the privacy of someone. The New York Times suggests that Jensen could have been briefed on the intelligence report up to a year before the article was published. This means the board will need to consider what information they want to be made aware of. Policies will need to be in place to ensure the correct amount of privacy is given and there are no real risks. This should start with the most senior executives.

The investigation will require sensitive personal information about the executive, other staff and customers. This information should be securely managed, have a retention period and a record of who has viewed what. If there is any data leakage around the investigation, it could cause harm to innocent people and impact the case.

Lessons to be Learned

There are rogue cyber criminals and opportunists out there. Having temporary CIOs, busy information security managers and concerned customers will leave you open to phishing, spoofing and fraud. Ensure you have a strong contingency and succession plan in place that considers security. Ensure the new people have the correct access and your staff know what genuine requests for breaking news look like. Ensure your partners know who your resellers and cloud customers are, request beneficial ownership and ensure audit rights are in your contracts.

The main lesson to learn from this is that an analyst can write a note of concern in a matter of days. Investors may start to question how much of the AI funding is really controlled by one CEO. Security and cyber are now financial concerns. Investors will likely want to know what your counter-espionage measures are.

Conclusion

This story is far from over. Jensen will be testifying to Congress; however, the facts will change. This is a snapshot of what is happening currently. The lessons to learn from this are that we are the attack surface, export controls will rely on trusted intermediaries and there will be a balance between privacy and real risk. Those who take action on these issues will be more measured than those who read about them on the front page.

Sources

‍

PUBLISHED ON

Nov 12, 2026

Related Blogs

Deepfake Deception: Brazilian Criminals Used Faces of Celebrities to Swindle Millions

November 4, 2025

Introduction

Given the era of digital trust and technological innovation, the age of artificial intelligence has provided a new dimension to how people communicate and how they create and consume content. However, like all borrowed powers, the misuse of AI can lead to terrible consequences. One recent dark example was a cybercrime in Brazil: a sophisticated online scam using deepfake technology to impersonate celebrities of global stature, including supermodel Gisele Bündchen, in misleading Instagram ads. Luring in millions of reais in revenue, this crime clearly brings forth the concern of AI-generative content having rightfully set on the side of criminals.

‍

Scam in Motion

Lately, the federal police of Brazil have stated that this scheme has been in circulation since 2024, when the ads were already being touted as apparently very genuine, using AI-generated video and images. The ads showed Gisele Bündchen and other celebrities endorsing skincare products, promotional giveaways, or time-limited discounts. The victims were tricked into making petty payments, mostly under 100 reais (about $19) for these fake products or were lured into paying "shipping costs" for prizes that never actually arrived.

The criminals leveraged their approach by scaling it up and focusing on minor losses accumulated from every victim, thus christening it "statistical immunity" by investigators. Victims being pocketed only a couple of dollars made most of them stay on their heels in terms of filing a complaint, thereby allowing these crooks extra limbs to shove on. Over time, authorities estimated that the group had gathered over 20 million reais ($3.9 million) in this elaborate con.

The scam was detected when a victim came forth with the information that an Instagram advertisement portraying a deepfake video of Gisele Bündchen was indeed false. With Anna looking to be Gisele and on the recommendation of a skincare company, the deepfake video was the most well-produced fake video. On going further into the matter, it became apparent that the investigations uncovered a whole network of deceptive social media pages, payment gateways, and laundering channels spread over five states in Brazil.

‍

The Role of AI and Deepfakes in Modern Fraud

It is one of the first few large-scale cases in Brazil where AI-generated deepfakes have been used to perpetrate financial fraud. Deepfake technology, aided by machine learning algorithms, can realistically mimic human appearance and speech and has become increasingly accessible and sophisticated. Whereas before a level of expertise and computer resources were needed, one now only requires an online tool or app.

With criminals gaining a psychological advantage through deepfakes, the audiences would be more willing to accept the ad as being genuine as they saw a familiar and trusted face, a celebrity known for integrity and success. The human brain is wired to trust certain visual cues, making deepfakes an exploitation of this cognitive bias. Unlike phishing emails brimming with spelling and grammatical errors, deepfake videos are immersive, emotional, and visually convincing.

This is the growing terrain: AI-enabled misinformation. From financial scams to political propaganda, manipulated media is killing trust in the digital ecosystem.

‍

Legalities and Platform Accountability

The Brazilian government had taken a proactive stance on the issue. In June 2025, the country's Supreme Court held that social media platforms could be held liable for failure to expeditiously remove criminal content, even in the absence of a formal order from a court. The icing on the cake is that that judgment would go a long way in architecting platform accountability in Brazil and potentially worldwide as jurisdictions adopt processes to deal with AI-generated fraud.

Meta, the parent company of Instagram, had said its policies forbid "ads that deceptively use public figures to scam people." Meta claims to use advanced detection mechanisms, trained review teams, and user tools to report violations. The persistence of such scams shows that the enforcement mechanisms still lag the pace and scale of AI-based deception.

‍

Why These Scams Succeed

There are many reasons for the success of these AI-powered scams.

Trust Due to Familiarity: Human beings tend to believe anything put forth by a known individual.
Micro-Fraud: Keeping the money laundered from victims small prevents any increase in the number of complaints about these crimes.
Speed To Create Content: New ads are being generated by criminals faster than ads can be checked for and removed by platforms via AI tools.
Cross-Platform Propagation: A deepfake ad is then reshared onto various other social networking platforms once it starts gaining some traction, thereby worsening the problem.
Absence of Public Awareness: Most users still cannot discern manipulated media, especially when high-quality deepfakes come into play.

‍

Wider Implications on Cybersecurity and Society

The Brazilian case is but a microcosm of a much bigger problem. With deepfake technology evolving, AI-generated deception threatens not only individuals but also institutions, markets, and democratic systems. From investment scams and fake charters to synthetic IDs for corporate fraud, the possibilities for abuse are endless.

Moreover, with generative AIs being adopted by cybercriminals, law enforcement faces obstructions to properly attributing, validating evidence, and conducting digital forensics. Determining what is actual and what is manipulated has now given rise to the need for a forensic AI model that has triggered the deployment of the opposite on the other side, the attacker, thus initiating a rising tech arms race between the two parties.

‍

Protecting Citizens from AI-Powered Scams

Public awareness has remained the best defence for people in such scams. Gisele Bündchen's squad encouraged members of the public to verify any advertisement through official brand or celebrity channels before engaging with said advertisements. Consumers need to be wary of offers that appear "too good to be true" and double-check the URL for authenticity before sharing any kind of personal information

Individually though, just a few acts go so far in lessening some of the risk factors:

Verify an advertisement's origin before clicking or sharing it
Never share any monetary or sensitive personal information through an unverifiable link
Enable two-factor authentication on all your social accounts
Periodically check transaction history for any unusual activity
Report any deepfake or fraudulent advertisement immediately to the platform or cybercrime authorities

Collaboration will be the way ahead for governments and technology companies. Investing in AI-based detection systems, cooperating on international law enforcement, and building capacity for digital literacy programs will enable us to stem this rising tide of synthetic media scams.

‍

Conclusion

The deepfake case in Brazil with Gisele Bündchen acts as a clarion for citizens and legislators alike. This shows the evolution of cybercrime that profited off the very AI technologies that were once hailed for innovation and creativity. In this new digital frontier that society is now embracing, authenticity stands closer to manipulation, disappearing faster with each dawn.

While keeping public safety will certainly still require great cybersecurity measures in this new environment, it will demand equal contributions on vigilance, awareness, and ethical responsibility. Deepfakes are not only a technology problem but a societal one-crossing into global cooperation, media literacy, and accountability at every level throughout the entire digital ecosystem.

‍

Who Owns Visibility in the AI Era? The Significance of IndiaMART v. OpenAI Judgment

June 19, 2026

Introduction
‍

The rise of artificial intelligence has transformed how individuals search for information, buy and compare products online. Unlike the traditional search engines like Google that presents the user with a set of links and directs users to websites, AI-powered systems provide synthesised answers and recommendations which means we don't have to click through every link to find what we are looking for, we simply have to ask an LLM and it provides recommendations based on our needs expressed through prompt. This development has raised important legal and commercial questions, one such question was addressed in the judgement of Indiamart Inter Mesh Limited v. Open AI Inc. and Others (2026 SCC OnLine Cal 5738) decided by HMJ Ravi Krishan Kapur of Calcutta High court on 20 May 2026. If an AI platform becomes a primary source of information, can a business demand inclusion in its responses? Is it a legal injury if the LLM omits a business? More fundamentally, how do the existing laws classify technologies that not only process information, but also generate new content? These were the questions that came before Calcutta High Court. Although the dispute arose from Indiamart’s complaint regarding visibility on ChatGPT search, the judgement explored beyond the disagreement between two private entities.

‍

The Dispute
‍

IndiaMart is one of India’s largest electronic business-to-business marketplaces since 1996, serving millions of buyers and sellers across India. They also have registered trademarks and their entire business depends on visibility on the internet considering the digitalisation of the market. Open AI launched ChatGPT search in October 2024, which is a feature that supplements AI responses with links to relevant web sources. Indiamart alleged that ChatGPT was not displaying links to their online platform in the same way that it displayed links to other competing services or individual sellers. A major grievance raised by Indiamart was that ChatGPT allegedly bypassed IndiaMart market listings by directing users to sellers’ individual websites while continuing to provide platform level links for other competing platforms. Hence, they contended that this practice diverted users away from their platform and negatively affected their business interests. The company argued that such exclusion amounted to discriminatory treatment and resulted in economic harm, diluted its trademarks and amounted to disparagement. They alleged that it violated their rights under article 14, 19, 21 under the constitution and rights under IT Act and IT Rules also. When IndiaMart sought an explanation from OpenAI, the company stated that its decision was influenced by the inclusion of IndiaMart in the United States Trade Representative (USTR) Review of Notorious Markets for Counterfeiting and Piracy 2024, a U.S. government report that identifies online and physical marketplaces alleged to facilitate intellectual property infringements. IndiaMart challenged this justification, arguing that the USTR report has no statutory or binding force in India. It further alleged selective discrimination, pointing out that several other platforms featured on the same USTR list including DHGate, Pinduoduo, Shopee, and Taobao continued to remain accessible through ChatGPT-generated responses. Consequently, IndiaMart approached the Calcutta High Court seeking interim relief directing ChatGPT to display and provide access to IndiaMart links in its responses.

‍

ARGUMENTS BEFORE THE COURT

‍

IndiaMart's contentions: They argued that ChatGPT, because its search feature, performs the role of an "intermediary" within the meaning of Section 2(1)(w) of the IT Act and is therefore required to comply with the obligations imposed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Relying on Rule 3(1)(n), IndiaMart argued that an intermediary cannot engage in discriminatory treatment of platforms or selectively restrict access to information. IndiaMart further maintained that users have a right to access information relating to its platform and that the omission of IndiaMart links from ChatGPT's responses violated this interest. They alleged violation of Articles 14, 19, and 21 of the Constitution, along with the broader principle of a user's "right to know", to argue that OpenAI owed an obligation to display IndiaMart listings in response to relevant queries. In addition, IndiaMart alleged that the exclusion of its links caused commercial harm, diluted its trademarks, amounted to disparagement, and constituted an unfair trade practice that adversely affected its business and reputation.

OpenAI's contentions: OpenAI asserted that IndiaMart had no legally enforceable ‘Right to visibility’ on ChatGPT. They argued that neither contract, statute, nor constitutional law imposed any obligation on OpenAI to display, prioritise, or recommend IndiaMart links in response to user queries. In the absence of any recognised legal right, there could be no actionable injury and therefore no valid cause of action. OpenAI also challenged the classification of ChatGPT as an "intermediary" under the Information Technology Act, 2000. According to OpenAI, ChatGPT does not merely host, transmit, or facilitate access to third-party content but also generates responses through its large language model (LLM) and therefore functions more closely as an "originator" than an intermediary. Consequently, the obligations applicable to intermediaries under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including those relied upon by IndiaMart, were inapplicable. With respect to the USTR Notorious Markets List, OpenAI submitted that its reliance on the report formed part of its internal risk-management and business policies. Such decisions, it argued, were matters of private commercial judgment and not ordinarily subject to judicial review. OpenAI further pointed out that IndiaMart had also previously blocked ChatGPT from accessing and crawling its website that weakened the company's demand for greater visibility within ChatGPT-generated responses.

Court’s decision: The court rejected Indiamart's claim that they were entitled to be displayed in ChatGPT searches. The court emphasised the autonomy of private businesses, the court held that the right to carry on trade and business is "inviolable" and that no law can compel one private entity to operate their platform for the benefit of another, which is based on foundational economic philosophy of laissez faire. Unless there is a contractual, statutory or constitutional obligation, a platform has no duty to the other platform to promote or advance their economic interest. Applying this principle, the court found no such duty or “vested legal right” that entitled IndiaMart’s visibility on ChatGPT. The court reasoned that even if users possess the ‘right to know’, Indiamart could not convert that interest into an enforceable claim under article 19(1)(g) or other legal provision. The court looked at the dispute as one arising from commercial disadvantage rather than violation of any legally protected right. Although the reduced visibility may have had economic consequences, economic harm does not by itself create a cause of action.

The court also took into consideration whether ChatGPT should be classified as an intermediary under Section 2(1)(w) of the Information Technology Act, 2000 or as an originator under Section 2(1)(za). This was an important distinction, because the intermediaries can claim safe harbour protection under section 79 of the IT act, but the originators cannot. The court expressed a preliminary view that ChatGPT is generative capabilities, place it closer to an originator than an intermediary because, unlike conventional search engines, which identify and rank existing information, Generative AI systems, analyse the data and produce new output based on algorithms, which is in response to the user’s prompt. The Court also referenced the NITI Aayog National Strategy for Artificial Intelligence (pages 7 to 12) to support its observations that ChatGPT does not merely store, host or transmit information, it can produce essays, research material, code, creative writing, and other forms of content that did not previously exist in that exact form, hence extending beyond the conventional understanding of an intermediary. The court also recognised that it is a vexed issue and remains unsettled because AI systems operate in response to users instructions and do not function independently, which is why the court refrained from providing a definitive classification and acknowledged that the question may ultimately require legislative clarification as well.

In addition to this, the Court took the view that the IndiaMart’s grievances did not amount to an Intellectual property dispute, as they found no trademark infringement or dilution because any reference to the "IndiaMart" mark was merely descriptive and did not constitute commercial use "in the course of trade" under Section 29(4) of the Trade Marks Act. IndiaMart also hadn’t demonstrated any false or misleading use of its trademark.

Similarly, the Court found that claims of disparagement, trade libel, and injurious falsehood were unsustainable because such claims require the publication of a false statement that harms reputation and since ChatGPT had not published any derogatory statement about IndiaMart, the mere omission of links could not amount to disparagement or libel. The Court relied on Tech Plus Media v. Jyoti Janda, that allegations of unfairness or copyright infringement must be supported by specific pleadings and evidence.

Beyond the immediate dispute, the judgment shed light on the growing difficulty of applying legal categories created for an earlier internet era to generative AI systems. The Information Technology Act was enacted at a time when internet regulation focused primarily on websites, service providers, and electronic communications and therefore existing classifications may not adequately address the hybrid nature of contemporary AI technologies. The Court acknowledged OpenAI's concern that granting IndiaMart's request could trigger floodgates of litigation on similar claims from businesses dissatisfied with AI-generated visibility, however, it clarified that such concerns cannot outweigh genuine legal claims or fundamental rights. The Court suggested that legislative intervention may eventually be necessary.

‍

Conclusion
‍

This judgement not only addressed the visibility issue in AI generated responses, but also whether visibility itself can become a legally protected interest in AI-driven searches? As more and more users rely on AI generated output for their preference rather than traditional search engine output, the power to decide what information is displayed and what is not will eventually become economically significant. The Calcutta High Court through this judgement declined to create any such right through judicial interventions and also highlighted that the existing legal framework is not adequately equipped to address the novel challenges posed by generative AI.

‍(This blog is based on the judgment in Indiamart Inter Mesh Limited v. Open AI Inc. and Others, 2026 SCC OnLine Cal 5738, decided on May 20, 2026 by the Calcutta High Court, and related reporting by LiveLaw and SCC Times.)

‍

References
‍

‍

#FactCheck: Viral Video of Storm Destruction in Odisha Is Actually From Telangana

September 29, 2026

Executive Summary

‍
‍
A ‘deep depression’ formed over the Bay of Bengal made landfall along the Andhra Pradesh and Odisha coasts in late September 2026, affecting several districts. A video is going viral on social media in connection with the weather system, purportedly showing its impact. Some users are sharing the video claiming that it shows the effects of the storm in Odisha. CyberPeace Research fact-checked the viral claim and found that the impact of the storm was reported in Andhra Pradesh, Odisha, Telangana and Chhattisgarh. However, the viral video showing the destruction caused by the storm is actually from Bhadradri Kothagudem in Telangana.

‍

Claim

‍

Instagram user ‘deepak_.pandey900’ posted a video on September 24, 2026, along with an archive link, claiming that “Cyclone Arnab, which formed over the Bay of Bengal, made landfall along the north Andhra Pradesh and south Odisha coasts between 11 pm and 1 am. Heavy rainfall is occurring in the coastal districts of both states due to its impact. Schools have been closed in 10 districts of southern Odisha, and around 5,000 people have been shifted to safer locations. Traffic was disrupted after four bridges in Malkangiri were submerged, and the National Highway was also closed as a precautionary measure. Strong winds caused 10 fishing boats to sink and dozens of others to be damaged in Bhadrak.”

https://www.instagram.com/deepak_.pandey900/reel/DdrZwOaBYjd

‍

Fact Check

‍

To verify the viral claim, we first conducted a Google Lens search using keyframes extracted from the video. X user ‘Telangana365’ shared the video on September 23, 2026, with the caption: “The ‘Arnab cyclone’ has caused massive destruction in Morampalli Banjara of Burgampadu mandal in Bhadradri Kothagudem district. The situation is such that it is difficult to understand what is happening. It is completely dark, with heavy dust and dark clouds all around. According to the victims, they witnessed a terrifying scene. Strong winds uprooted trees and blew away thatched roofs... people were even thrown some distance by the gusts of wind. Fortunately, they suffered only minor injuries.”

https://x.com/Telangana365/status/2102743504715907406?s=20

‍

The video was also posted on the YouTube channel ‘TV2_NEWS’ on September 23, 2026, identifying it as footage from Burgampadu mandal in Telangana.

‍

‍

A report published on the website of Telangana-based news portal ‘Big TV’ on September 24, 2026, used a keyframe from the video. According to the report, “Cyclone Arnab, which formed over the Bay of Bengal, has caused widespread destruction. Its impact has been felt not only in Odisha and Andhra Pradesh but also significantly in Telangana. The cyclone caused destruction in Bhadradri Kothagudem district soon after crossing the coast. It suddenly wreaked havoc in Morampalli Banjara of Burgampadu mandal. Heavy rainfall and strong winds engulfed the area. Several people were injured during the incident.”

https://www.bigtvlive.com/telangana/powerful-storm-wreaked-havoc-in-burgampadu-of-bhadradri-kothagudem-in-telangana-trees-roof-sheets-were-blown-away.html#goog_rewarded

‍

‍

According to information shared by the India Meteorological Department (IMD) on its X handle at around 9 am on September 25, 2026, “The Deep Depression over south Odisha and adjoining south Chhattisgarh moved north-northwestwards at a speed of 15 kmph during the past six hours. It weakened into a Depression and lay centred at 5:30 am on September 25, 2026, over interior south Odisha and adjoining Chhattisgarh. It is very likely to continue moving north-northwestwards and maintain its intensity as a Depression for the next 12 hours. Thereafter, it is expected to weaken into a Well-Marked Low Pressure Area during the subsequent 12 hours.”

‍

‍

Conclusion:

‍

The Deep Depression that formed over the Bay of Bengal caused heavy rainfall in Andhra Pradesh, Telangana and Odisha. However, the viral video showing the destruction caused by the storm is actually from Telangana.

‍

Nvidia After Jensen Huang: Espionage, Insider Risk and the Security Lessons Behind the Headlines