Nvidia has opened an independent investigation following U.S. intelligence suspicions that a personal relationship involving founder and CEO Jensen Huang may have been exploited for espionage purposes.
Nvidia faces scrutiny over alleged honey-trap operation
On 8 November 2026 the Nvidia board announced the probe after reports published by the New York Times on 29 October 2026 linked Chinese national Alice Huang, also known as Huang Le, to possible intelligence activity. The former television journalist, now an executive at Singapore-based Megaspeed, is suspected of having cultivated a close relationship with Jensen Huang on behalf of Chinese services.
Jensen Huang confirmed the extramarital relationship in an internal message, apologised to his family and pledged full cooperation. Megaspeed has become a major Nvidia customer in Southeast Asia, purchasing more than 4.8 billion dollars of processors over two years. U.S. authorities are also examining whether these purchases were used to circumvent export restrictions on advanced AI chips destined for China.
Social engineering remains a persistent threat to executives
The affair illustrates classic social-engineering techniques that target human behaviour rather than technical vulnerabilities. Attackers build trust over months or years through professional contacts, shared interests or romantic involvement before extracting sensitive details. In this case the relationship allegedly provided access to strategic conversations about technology roadmaps, acquisitions and commercial decisions without any documented theft of files.
DGSI and other Western agencies have repeatedly warned that foreign intelligence services use fake recruiters, consultancies and research institutes on platforms such as LinkedIn to approach engineers, researchers and executives. Initial requests often appear innocuous, such as paid analysis work, before escalating to requests for non-public information.
Physical and reputational vectors expand the attack surface
Espionage via social engineering also occurs offline at conferences, restaurants and gyms. Impersonation of journalists, as seen when an individual misused the identity of Damien Bancal and ZATAZ to obtain internal contacts, demonstrates how attackers leverage trusted third-party reputations to gain initial access points inside organisations.
Companies are advised to train staff at every level, verify unusual requests through independent channels and treat personal relationships of senior leaders as a potential vector requiring awareness rather than solely technical controls.
