MI5: over 100 academics in projects funded by China’s MSS

On 30 September 2026 MI5, the UK’s domestic security service, issued a public espionage alert, something it rarely does. The alert concerns a Chinese body that funds academic research: the China General Technology Research Institute (CGTRI), also known as the China Academy of General Technology (CAGT). According to MI5, the organisation has very strong ties to China’s Ministry of State Security (MSS), and more than 100 UK-linked academics have contributed to projects funded through it.

This is not a cyber intrusion, and there are no CVEs to patch. For anyone running security at universities, research centres and companies doing R&D, though, the issue is concrete: who really funds a project, and who can reach the data, code and models it produces.

What happened

According to the alert, as reported by Infosecurity Magazine and The Register, the primary purpose of CGTRI is to fund research that directly improves the MSS’s technical capabilities for espionage. The MSS handles both domestic counter-intelligence and foreign intelligence.

The CGTRI-funded projects that UK-linked academics contributed to cover:

• artificial intelligence;
• cybersecurity;
• covert communication systems;
• steganography, the techniques used to hide information inside other data, such as images or audio files.

According to MI5, this work supports MSS espionage, which is a threat to UK national security.

MI5 is not accusing all the researchers involved of knowingly helping Chinese intelligence. The alert acknowledges that in some cases academics may not have known that CGTRI was behind the project, and that many institutions and researchers probably dealt with it in good faith, given the organisation’s “obfuscated” links to the MSS.

Infosecurity Magazine adds some context: many cyber operators are linked to the MSS, including those behind campaigns attributed to groups such as Silk Typhoon and Salt Typhoon. This is the publication’s background, not part of the alert.

What MI5 is asking for

The agency strongly advises UK universities to:

1. immediately review any current or planned collaboration with CGTRI, so that the MSS gains no further benefit from British research;
2. trace the source of funding for any collaboration with Chinese institutions, to rule out a link with CGTRI;
3. when scoping collaborations, use the UK government’s Research Collaboration Advice Team (RCAT) and the Trusted Research guidance from the National Protective Security Authority (NPSA), and take independent legal advice.

Anyone still working on CGTRI-funded projects, now that the links have been made public, should seek legal advice.

Criminal consequences

The alert points to two offences under the National Security Act 2023:

• section 3, assisting a foreign intelligence service: an offence is committed by someone whose conduct is likely to materially assist a foreign service in UK-related activities, if they know or ought reasonably to know that this is the case;
• section 17, obtaining a material benefit from a foreign intelligence service: this covers accepting or retaining a benefit while knowing, or when one ought reasonably to know, that it comes from a foreign service. Legitimate payment for lawful goods or services is excluded.

As The Register notes, after the alert it will be harder to argue that you did not know who was behind the money.

The technical picture

The sources describe no attacks, malware or indicators, so there is no attack chain to map to MITRE ATT&CK. The research areas named by MI5, however, are the ones used to hide communications and data. Steganography, for example, appears in ATT&CK as a data obfuscation technique in command-and-control communications (T1001.002).

For a research organisation, the risk is not just the signed contract but everything a project gives access to: networks, datasets, source code, AI models and intellectual property. A security expert quoted by Infosecurity Magazine made the same point: checking the names on agreements is not enough; you need to know who accesses what, how that access is controlled, and whether you would notice unusual movement of sensitive data.

Impact for European and Italian companies

The alert concerns the UK, and the sources do not say whether CGTRI funds projects in other countries. The problem is not only a British one, though: European universities, research centres and companies often work in international consortia, with researchers collaborating with British and Chinese institutions.

For organisations in scope of NIS2, the issue falls under supply chain risk management and access control. The directive lists research organisations among the sectors in its Annex II. The same applies to healthcare and pharmaceutical companies, which fund and share research with external partners.

What to do now

1. Search your contracts for CGTRI: check research agreements, grants, fellowships and consultancy with both names, China General Technology Research Institute and China Academy of General Technology, and their acronyms.
2. Trace the ultimate funder: for collaborations with Chinese institutions, check who actually pays, not just the counterparty named in the agreement.
3. Involve your legal team, especially if you have staff, offices or projects in the UK.
4. Keep access to the minimum: dedicated accounts per project, least privilege on repositories, datasets and models, revocation when the collaboration ends.
5. Watch your research data: log access and changes to sensitive folders and repositories, and review unusual outbound transfers.

How ARXDOME helps

ARX Sentry checks file integrity in the folders you choose and shows logons, privileged and night-time logons and account changes in the SOC pages. ARX Trace shows what changed in files and where, with activity per folder, which helps you see who touched a project’s data.

Last updated: 3 October 2026