Hello. Cybersecurity agencies in the U.S., the U.K., Canada, Australia and New Zealand—an intelligence-sharing group of countries known as the Five Eyes—said a Chinese state-sponsored actor is employing a tactic known as “living off the land,” which involves using built-in network administration tools to gain access to critical infrastructure.

Microsoft said the Chinese actor, known as Volt Typhoon, is pursuing capabilities that could disrupt communications between the U.S. and Asia in a future crisis.

Mao Ning, a spokeswoman for China’s foreign ministry, on Thursday said the U.S. is spreading false information. Get the full WSJ story. 

More news below. 

Note to readers: The cyber newsletter won't be published Monday in observance of Memorial Day in the U.S. We will be back on Tuesday.

• “But I don’t think at the end of the day, we’re best served solely by a system that says, ‘Take the word of a large company,’ ” Smith said. 
• Members of Congress are discussing bipartisan legislation to set safeguards on AI, and on Tuesday the Biden administration sought public input on a national AI strategy that could lead to new regulations.

• Further WSJ Pro reading: Cybersecurity Chiefs Navigate AI Risks and Potential Rewards

• OpenAI is offering 10 grants of $100,000 each to groups with ideas for workable regulatory frameworks. (Reuters)

U.S. Department of Energy puts nuclear information at risk by failing to establish an effective insider-threat program, watchdog says. Employees and visitors with trusted access could get hold of classified information at the department, the Government Accountability Office said in a new report this week. (NBC News)

• The Energy Department started an insider-threat program in 2014 but isn't finished, the GAO said. Employees haven't been trained in how to spot and report suspected insider threats, for example, and the DOE doesn't track its progress in implementing required parts of such a program.
• Read the GAO's full findings, including recommended actions to make a program successful.

• Yield-curve pioneer Campbell Harvey said an economic contraction could begin this month and last two to three quarters. “ The question is how deep the recession will be,” he said.
• Although AI offers benefits, some sectors are finding challenges. The tech was supposed to transform insurance; it hasn’t.
• And cybersecurity chiefs say the promises and risks of early generative AI are overblown.
• Companies face more shareholder proposals from both sides of the political spectrum, dragging them into the fractious conversations over environmental, social and governance issues.

The WSJ Pro Cybersecurity team is Deputy Editor Kim S. Nash (on Twitter @knash99), reporter James Rundle and reporter Catherine Stupp (@catstupp). Follow us on Twitter @WSJCyber. Reach the team by replying to any newsletter or by emailing Kim at kim.nash@wsj.com.