This is your Beijing Bytes: US-China Tech War Updates podcast.

Hey listeners, Ting here in Beijing with your latest download of Beijing Bytes, where the US–China tech war is less “trade spat” and more “patch Tuesday, forever.”

Let’s jack straight into the big story: according to the Financial Times, amplified by Fortune, a China-linked group known as Salt Typhoon quietly slipped into the email systems of staff on key US House committees – China, foreign affairs, intelligence, and armed services. Investigators say the intrusions were discovered in December, and it’s not yet clear how much content was exfiltrated, but you don’t target those inboxes for cat memes. That’s legislative foresight: draft sanctions, export controls, Pentagon budgets, all sitting in Outlook like a buffet for an espionage crew.

SecurityWeek and other cyber outlets add that this fits a broader spike in Chinese cyber operations, including campaigns against US government emails and intensified activity against Taiwan. Analysts are calling this “slow-burn cyber shaping”: instead of noisy destruction, think long-term positioning inside comms, logistics, and energy, so that in a crisis you can quietly twist the right knobs.

On the vulnerability front, The Register reports that China-linked cybercriminals had working VMware ESXi hypervisor escape exploits more than a year before the bugs went public. That means they could jump from virtual machines to the underlying host, which is like breaking out of a jail cell and owning the entire prison. For cloud-heavy US and allied infrastructure, that’s a strategic warning: assume your virtualization layer is already a target, not a shield.

In Washington, the policy response has gone from “concerned” to “architecting a new stack.” The latest National Defense Authorization Act, summarized by law firm analyses like King & Spalding and Baker McKenzie, ramps up restrictions on Department of Defense procurement from Chinese-linked firms. We’re talking phased bans on computers and printers from covered Chinese entities, limits on batteries and optical systems, and even a prohibition on using AI from China’s DeepSeek in Pentagon contracts. Treasury’s new outbound investment rules, implementing the China-focused executive order, fence off US capital from Chinese semiconductors, quantum tech, and AI.

Beijing is not just taking punches. South China Morning Post reports on Shanghai rolling out a roughly US$10 billion investment blitz into semiconductors, AI, and other high-tech sectors, while Chinese experts like Wei Shaojun warn domestic firms to be cautious in their rush for Nvidia H200 chips as Washington’s stance whiplashes between minor easing and renewed pressure. At the same time, Beijing is probing Meta’s US$2.5 billion Manus acquisition on tech-export grounds, signaling that if the US can weaponize chips and capital, China can weaponize market access and data.

Strategically, here’s the play: the US is trying to starve China of the high-end stack – advanced chips, AI training compute, sensitive investments – while hardening its own supply chain and codebase. China is racing to localize the stack, from fabs to foundation models, while using cyber operations like Salt Typhoon and ESXi exploits to offset its hardware gap with information advantage.

Looking ahead, most experts I’m watching expect three things in the next few months: first, more targeted US sanctions that tie specific Chinese cyber campaigns to concrete financial pain; second, Chinese countermeasures using export controls on critical materials and tech reviews of Western deals; and third, an arms race in defensive AI, as both sides use machine learning to hunt each other’s hackers at scale.

For you in industry, that means compliance teams and CISOs are now playing the same game: map your exposure to Chinese suppliers, US rules, and stealthy advanced threats,...