Nvidia's board has opened an independent investigation into reports that its founder and CEO, Jensen Huang, was the target of a foreign intelligence effort. The board announced it on Sunday, 8 November 2026, after The New York Times reported on 29 October that US intelligence agencies had watched a former executive of Megaspeed, a Singapore-based customer of Nvidia, for about a year over her ties to China. China denies the claims, nobody has been charged, and Nvidia says it has no reason to believe that any company secrets were compromised.
The story has moved fast. On 4 November, the Republican chairs of three US House committees asked Huang to attend a closed-door briefing on 18 November about his contacts with the former executive and about how Nvidia guards against espionage. On 8 November, the board set up a committee of independent directors with outside counsel to run its own inquiry. The same day, Huang sent an email to staff in which he admitted to being unfaithful to his wife, without naming anyone, and said he would cooperate fully. On 9 November, China's foreign ministry called the spy narrative baseless, and a proposed shareholder class action was filed against Nvidia and Huang.
Most Inventor users will never deal with chip export controls or congressional letters. But the core question in this case is one every engineering company faces: what can a customer, partner or business contact learn through ordinary meetings, and how would you know if that contact was collecting information for someone else? This article sets out what is confirmed, what is only reported, and what engineering teams, CAD managers and manufacturing SMEs can take from it.
TL;DR: Nvidia is investigating reports that its CEO was targeted by Chinese intelligence through a former executive of Megaspeed, a large Singapore-based customer. US officials have reportedly examined whether Megaspeed helped China obtain restricted Nvidia chips. Nvidia says customers like this receive ordinary business information, not trade secrets, and its board sees no sign that secrets were compromised.
Nothing is proven. No one has been charged, China denies the claims, and the investigation is ongoing. For engineering firms, the lesson is practical: espionage often runs through normal business relationships and the people at the top. Decide what each customer and partner may see, keep sensitive CAD data on a need-to-know basis, log access, brief executives and engineers who meet foreign contacts, and keep dated proof of what you designed and when.
What happened at Nvidia?
According to the reporting summarised by several outlets, The New York Times wrote on 29 October that US spy agencies had monitored Alice Huang, a Chinese citizen and former executive of Megaspeed, for about a year. She is not related to Jensen Huang. Officials were reportedly concerned that she could learn about Nvidia's plans and pass information to Beijing. The Times also reported that officials did not believe Jensen Huang knew she might be gathering information for China. On 6 November, the Financial Times reported that the US government believed the two had a romantic relationship.
Megaspeed is a Singapore-based data centre and cloud company and one of Nvidia's large customers in Southeast Asia. The Times reported that it bought more than 4.8 billion dollars' worth of Nvidia chips over the past two years. US officials have examined whether the company helped China obtain advanced Nvidia chips that are restricted for export. On 9 November, CBS News reported, citing two law enforcement sources, that the Justice Department's National Security Division is investigating Megaspeed over possible export violations. That has not been officially confirmed. Megaspeed has said it hired outside lawyers to look into the claims.
In its statement of 8 November, Nvidia's board said a committee of independent directors, advised by outside counsel, will oversee the investigation. It added that "the Board has no reason to believe that either national security or NVIDIA secrets were compromised", but that its inquiry will examine all available information. Nvidia's spokesperson said Huang fully supports the review and will keep leading the company.
What is confirmed, and what is only reported?
Much of this story rests on anonymous sources. It helps to keep the layers apart:
- Confirmed: Nvidia's board has opened an independent investigation and says it sees no sign that secrets or national security were compromised. Huang sent the staff email and says he will cooperate. Three House chairs asked for a briefing on 18 November. China's foreign ministry denies the claims. A proposed shareholder class action was filed on 9 November.
- Reported, not confirmed: that US intelligence agencies believe Alice Huang worked for Chinese intelligence, that she had a close relationship with Jensen Huang, that Megaspeed bought more than 4.8 billion dollars in Nvidia chips, and that the Justice Department is investigating Megaspeed.
- Not known: whether any information was passed on, what it would have been, what the board's inquiry will find, how the Megaspeed probe will end and whether Huang will attend the briefing. Neither Alice Huang nor Megaspeed has been charged with anything.
Nvidia's own line of defence is worth noting. It has said that Huang meets thousands of customer executives every year, that his contacts with Megaspeed were normal business, and that regional cloud customers receive ordinary business information rather than sensitive trade secrets. Its spokesperson John Rizzo said: "We trust that if we were the target of a genuine threat, the U.S. government would have notified us."
Why does this matter to engineering companies?
Because the method described in the reports is not exotic. Nobody is accused of breaking into a network. The alleged route is a business relationship: a large customer, regular meetings and access to the people who know the company's plans. That is how a lot of industrial espionage in CAD design works too. A customer asks for the native files instead of a STEP export. A partner's engineer joins a design review. A distributor asks about next year's product range over dinner. None of that is unusual, which is exactly why it works.
Studies of trade secret cases have long shown that most misappropriation involves people the owner already trusted: employees, former employees and business partners. We covered this pattern on 6 November in the SS&C v. Arcesium ruling about a former partner that built a rival product, and in October in the Jingdiao case about hiring a rival's engineer. The Nvidia story adds a state-level dimension, but the control points are the same: who can see what, who meets whom, and what gets written down.
There is also a direct link to design data. Under US export rules, "technology" can include drawings, models and CAD files, and the same goes for EU dual-use rules. A customer relationship that helps someone get around chip export controls is one risk. A supplier or customer that passes on controlled design data is another, and the company that shared the files may be the one that has to explain it. Our guide to export control considerations for CAD files explains which questions to ask before you send a model abroad.
What can a customer or partner learn from you?
The table maps typical contact points between an Inventor team and its customers or partners to what they can reveal and what a reasonable control looks like.
None of these controls requires a security department. They require decisions: which data is need-to-know, who decides, and how you can show afterwards what was shared. Practical guidance on the access side is in our articles on role-based access control for CAD and tracking who accesses your CAD files.
Your designs are the reason people want access. Keep proof of what is yours.
BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and gives you a certificate of ownership, straight from Inventor.
👉 See how BORIS for Autodesk Inventor works
Why are executives and senior engineers targets?
Because they hold the overview. A junior engineer knows one assembly. A CTO, a head of engineering or a founder knows the roadmap, the key customers, the suppliers and the weak spots. They also travel, attend trade fairs and meet partners in informal settings, often outside the controls that apply in the office. In smaller manufacturing companies, the founder may also be the person with admin rights to Vault, the main customer contact and the one who signs NDAs.
The point is not to distrust customers. It is to recognise that people at the top are worth approaching, and that a long, friendly business relationship is the most natural cover there is. Last week, the Binance attack that began on engineers' laptops showed the technical version of this: fake recruiters and job tests aimed at the people with the most access. The Nvidia case shows the human version, at the very top of a company.
What should Inventor teams and CAD managers do now?
- Classify your design data. Decide which models, drawings, rules and documents are trade secrets, which are confidential and which can be shared freely. Write it down and keep it short.
- Share the minimum by default. Send STEP, simplified or shrinkwrapped models instead of native Inventor files unless the customer truly needs them, and record what was sent.
- Limit Vault and portal rights. Give partners project-only access with an end date, and review accounts after each project.
- Log access and look at the logs. Unusual downloads, broad searches or interest in projects outside the scope are the signals that matter.
- Brief executives and senior engineers. Explain what is confidential, how to handle questions about plans and how to report contacts that feel odd, especially before trips and trade fairs.
- Check export control status. Before you share design data with a foreign customer or partner, check whether the item or technology is controlled and who the end user is.
- Keep NDAs and contracts current. Make sure they cover native files, derived models, AI use and return or deletion of data at the end.
- Keep dated proof. Register key design files with BORIS so you can show which version existed and when, if a dispute ever arises.
For the technical side of protecting the files themselves, see our guide to CAD file protection with Vault, encryption and proof of ownership. For the people side, our article on training engineers on CAD data protection covers formats that work for busy teams, and NDA limitations for CAD files explains why a signed NDA alone is not enough.
The bigger picture
This week's news on our sister sites shows the same pattern from different sides: the weak point is often a trusted connection, not the main system.
- Shared project servers. On CADChain, the cyberattack on the Brenner Base Tunnel company hit a server used to exchange data with contractors, followed by a ransom demand.
- The tools that manage your PCs. BORIS for SOLIDWORKS explains the N-central zero-days that led N-able to take its hosted service offline, and what manufacturers whose IT provider uses it should check.
- Platform rules and AI content. Blended BORIS looks at how itch.io deleted terabytes of AI spam and widened its AI disclosure rules, and what that means for Blender artists who sell assets.
Conclusion
The Nvidia investigation is unfinished, and it would be wrong to treat reported claims as facts. Nobody has been charged, China denies the allegations, and Nvidia's board says it has no reason to think secrets were compromised. The board inquiry, the Megaspeed probe and the requested briefing on 18 November may change the picture.
What does not depend on the outcome is the lesson for engineering companies. Espionage does not need malware when a business relationship gives access to people and plans. Inventor teams can make that route harder with simple, written decisions: what each contact may see, what is shared in which format, who has access to Vault, and how unusual interest gets reported. And because disputes about who designed what tend to come years later, keep dated proof of your designs from the start.
Your designs, your proof.
BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, straight from Inventor.
👉 Protect your Inventor designs with BORIS
FAQ: the Nvidia investigation and espionage through business contacts
What is Nvidia investigating?
Nvidia's board is investigating reports that CEO Jensen Huang was the target of a foreign intelligence effort. A committee of independent directors with outside counsel oversees the inquiry, which the board announced on 8 November 2026.
Who is Alice Huang?
She is a Chinese citizen and former executive of Megaspeed, a Singapore-based data centre company that buys Nvidia chips. US intelligence agencies reportedly believe she passed information to China. She has not been charged, she is not related to Jensen Huang, and China denies the claims.
Were Nvidia secrets stolen?
There is no public evidence of that. Nvidia's board says it has no reason to believe that national security or Nvidia secrets were compromised, and Nvidia says customers like Megaspeed receive ordinary business information, not trade secrets.
What is the export control angle?
US officials have reportedly examined whether Megaspeed helped China obtain advanced Nvidia chips that are restricted for export, and CBS News reported that the Justice Department is investigating the company. This has not been officially confirmed.
What happens next?
Three House committee chairs asked Huang to reply by 11 November and to attend a closed-door briefing on 18 November. Nvidia reports quarterly results on 17 November. The board's findings have no published date.
Why should Inventor users care?
The reported method runs through a normal customer relationship. Engineering firms share models, drawings and plans with customers and partners every day, so they should decide what each contact may see, limit access to Vault and portals and keep records of what was shared.
How does BORIS help?
BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when. It does not stop espionage on its own and does not replace access control or contracts.