I Would Answer the First Email

I would answer the first email.

Not one I have received. I am rehearsing the invitation. Somebody important wants my opinion about the machines, and for once I haven’t had to force it on him. There is no attachment yet. No request for a password. Just the possibility that an afternoon I had intended to waste might be urgently required elsewhere.

I have spent years avoiding committees. Invite me to the right one and I could probably overcome that principle by lunch. I would join long enough to explain what was wrong with committees. They would have to let me finish. They had asked.

Proofpoint describes a less imaginary invitation. In a report published on October 1, the security company details campaigns against American AI policy experts at think tanks, universities, and law firms. It attributes the activity to a group it calls TA419 and assesses as China-aligned. In July, the attackers borrowed the identities of established professionals and invited people to a fictitious AI Policy Advisory Committee or to contribute to a Senate report. A February campaign impersonated a senior Anthropic employee.

The subject of that earlier message was “Request for Feedback on Military Integration of Claude.”

Feedback. I could supply some. I could supply enough that they might begin wishing they had asked for a password instead.

Nobody needed to announce that the recipient was a genius. The invitation gave him a job inside the conversation. There was a subject to consider, a contribution to make. I cannot tell you what any of those experts felt when they read it. I know how quickly I would stop asking why a stranger had found me and start arranging what I would say.

First I would make the answer brief. That is how I begin when I expect a great deal of attention.

I would write that I appreciated being consulted. Delete appreciated. Too grateful. Say I would be happy to contribute. Delete happy. No need to give them the whole man before they have even scheduled a meeting. I can offer a few observations. There. Almost reluctant. A person accustomed to this sort of request.

Then I would get to the observations. A page. Two pages. I would look something up to make sure I hadn’t got it wrong. Possibly I would leave the reply overnight, which would give them the impression that I had better things to do.

The first emails in Proofpoint’s account were benign conversation starters. The credential attack came in the follow-up after a target replied. Links led toward a fake OneDrive sign-in arrangement intended to give the attackers access to cloud accounts. The report describes relaying the real Microsoft login, including authentication checks, while capturing the resulting session. It is not simply a bad spelling mistake waiting for an attentive reader to catch it.

Nor does the report establish that an AI wrote the invitation. AI policy was the subject. The lure was a familiar human one, arriving under a borrowed professional name.

Depending on the scope, I may be available.

They don’t need to know I have been moving the same sentence up and down a page. I could mention a deadline. Technically, I can give myself one whenever I like. It would be rude to interrupt a deadline someone else had gone to the trouble of imagining for me.

And if the reply doesn’t arrive? I would check again. Not because I had agreed to anything. I would merely want to know what they had said about my availability. I could lose a perfectly good morning keeping an afternoon difficult to obtain.

This is not how I like to picture a man getting robbed. I want an idiot demanding a fortune, a greedy fool agreeing, a trap with teeth big enough to notice. I don’t want a man preparing sensible observations about a subject he knows, then waiting for the next message because he would like the observations to matter.

An unexpected request can be legitimate. Refusing every stranger would save me some trouble and cost me some of the better accidents of being alive. I am not volunteering for a life in which only the people already sick of me get to hear from me.

But the attackers did not have to build those relationships. They could arrive wearing a name somebody else had spent years making worth an answer. Behind my little performance of reluctance would be the work of that absent person: the conversations, the useful advice, the occasions when they had bothered to come through. None of it belonged to whoever sent the invitation.

There is a telephone call I would owe myself before the next reply, and I can already hear how I would postpone it: finish the observations first. They aren’t confidential. No harm in being ready.

Then the link would arrive. I would have a reason to look. I had helped give myself one.

I would make them wait a little so they didn’t think I was sitting around hoping to be asked.

Then I would sit around hoping they asked again.

Primary report: Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

Source: Chinese Hackers Impersonate Anthropic Employee to Extract AI Secrets