AI Company Tells Congress It Saw 28.8 Million Queries in Suspected China Data Extraction, Warns of IP Threat

A report circulating among lawmakers says an American AI company warned Congress that China-linked actors carried out what the company described as the largest data and intellectual property extraction campaign it has seen, citing a volume of 28.8 million queries. The description frames the episode as unusual in scale compared with prior incidents and argues that the sheer number of requests indicates a sustained attempt to harvest information rather than a one-off probe.

According to the coverage, the company’s account to Congress focused on the nature and volume of the activity, describing the campaign as an “extraction” effort aimed at obtaining protected or proprietary information. The report’s emphasis is on the scale metric, 28.8 million queries, and on the claim that the activity did not trigger alarms in the way the company expected, suggesting potential gaps in monitoring, detection, or response processes.

The published account also describes how the episode challenges common assumptions about cybersecurity incidents involving advanced threats. Rather than depicting the incident primarily as a conventional “break-in,” the report highlights the difficulty of detecting large-scale extraction when activity resembles legitimate traffic patterns or remains within thresholds that cybersecurity controls consider normal.

The congressional relevance, as framed by the reporting, ties the incident to oversight questions including how the government assesses foreign attempts to obtain sensitive technology, how companies report emerging threats, and what lawmakers should consider for enforcement and policy tools. Those issues have historically included decisions about export controls, cybersecurity requirements for critical technology sectors, and the practical expectations placed on private firms to detect and document foreign interference attempts.

The report does not provide, in the information available here, the specific congressional committee, the date of the testimony or submission, the identity of the company, or the precise technical details of how the activity was detected or characterized. It also does not specify whether any federal agency has opened a case or whether law enforcement has identified responsible actors, beyond the company’s attribution in materials discussed by the reporting.

For lawmakers and the public, the primary next step implied by the reporting is further confirmation of the company’s claims through official congressional records and, where applicable, supporting technical documentation. If Congress receives additional details, it could shape hearings, requests for agency briefings, and questions about whether existing guidance and safeguards are adequate for protecting AI-related intellectual property against extraction campaigns.