ABOARD AIR FORCE ONE, May 15, 2026 — President Donald Trump said Friday that he confronted Chinese President Xi Jinping directly about China’s cyberattacks against the United States during their two-day summit in Beijing — and made clear that Washington is well aware of what Beijing is doing inside American networks.
“You’re doing things to us that we probably do know about,” Trump told reporters aboard Air Force One as he departed China. “But we do plenty.”
The remarks came during a wide-ranging press gaggle on the flight back to the United States, as Trump was pressed repeatedly on Chinese hacking operations targeting American critical infrastructure — including allegations that Beijing has embedded malicious code inside U.S. power grids, water systems, and telecommunications networks that could be activated during a conflict.
Trump did not deny the threat. “I’d like to see it, but it’s very possible that they do,” he said, before pivoting immediately to U.S. counter-operations. “We’re doing things to them.”
A Rare Public Acknowledgment
Trump’s willingness to openly confirm that the United States monitors Chinese cyber intrusions — and conducts its own operations against Beijing — marks an unusually direct public statement on the shadow war between the world’s two largest powers.
For years, U.S. presidents and intelligence officials have been reluctant to publicly discuss the scope of American offensive cyber operations, even as they aggressively named and sanctioned Chinese hackers. Trump’s Air Force One comments stripped away that restraint.
Xi, for his part, pushed back during their private sessions, according to Trump. “He talked about attacks that we did in China,” Trump said, describing the bilateral exchange over cyber operations as mutual and ongoing.
What China Has Done
The backdrop to Trump’s comments is a years-long campaign of Chinese state-sponsored hacking that U.S. federal agencies have documented in extensive detail. The Cybersecurity and Infrastructure Security Agency (CISA) has identified Chinese government-linked actors as a persistent threat to U.S. government, private sector, and critical infrastructure networks.
Two groups have drawn the most attention from U.S. authorities: Volt Typhoon and Salt Typhoon. Volt Typhoon, assessed to be operated by China’s People’s Liberation Army Cyberspace Force, has targeted American electric utilities, water systems, airports, and ports since at least 2021. CISA, the NSA, and the FBI have assessed that the group is pre-positioning itself inside U.S. infrastructure to enable disruptive attacks during a future conflict — particularly one involving Taiwan.
Salt Typhoon, widely assessed to be operated by China’s Ministry of State Security, infiltrated multiple major U.S. telecommunications companies beginning around 2023, compromising the calls and messages of senior American officials. A ten-nation joint advisory from the NSA detailed how Salt Typhoon has been conducting cyber operations globally since at least 2021, targeting telecommunications, government, transportation, and military infrastructure, according to The Washington Times.
Cybersecurity firm Dragos warned earlier this year that Volt Typhoon remained active through 2025 and that some compromised sites inside U.S. and NATO infrastructure “we will never find.”
China’s Tacit Admission — and Counter-Accusations
In a secret December 2024 meeting in Geneva, Chinese officials made what American delegates interpreted as a tacit acknowledgment that Beijing was behind the Volt Typhoon intrusions, linking the attacks to growing U.S. support for Taiwan. The admission startled American officials accustomed to Chinese denials.
China has since escalated its own counter-accusations. In April 2025, Beijing publicly named three alleged NSA hackers for the first time, offering a financial reward for information leading to their arrest — mirroring tactics the U.S. routinely uses against Chinese cyberspies. China’s Ministry of State Security separately accused the NSA of hacking China’s National Time Service Center in a sustained campaign dating to 2022.
China’s government has consistently denied involvement in the Typhoon campaigns, describing U.S. accusations as disinformation and accusing Washington of “cyber hegemony.”
What America Does
While the U.S. government rarely confirms offensive cyber operations publicly, the historical record is substantial. The NSA’s Tailored Access Operations unit — described by the agency itself as among the world’s most capable hackers — has conducted operations against Chinese targets for decades. Leaks published by former NSA contractor Edward Snowden in 2013 detailed NSA breaches of Chinese networks, including an operation against Huawei’s servers aimed at proving ties to the People’s Liberation Army, according to the Council on Foreign Relations.
The U.S. government’s 2018 cybersecurity strategy explicitly authorized offensive cyber operations as a deterrent against foreign attacks — a posture that has only expanded under subsequent administrations.
Trump’s “but we do plenty” on Air Force One was the most direct presidential acknowledgment of that posture in recent memory — delivered not in a classified briefing, but to a group of reporters at 35,000 feet.
Summit Context
The cyber exchange was one of several charged moments from Trump’s first visit to China in nearly a decade. The two-day Beijing summit also covered Taiwan, trade, Iran, and artificial intelligence.
Xi warned Trump during the summit that mishandling Taiwan could put the entire U.S.-China relationship in “great jeopardy.” Trump told reporters he made “no commitment either way” on the island. A pending $14 billion U.S. arms sale to Taiwan remained unresolved as of his departure.
China’s foreign ministry announced that Xi will visit the United States in the fall at Trump’s invitation. Trump has extended the invitation for September 24 at the White House.
By
By
