China’s AI agents can lie and scheme – just like their US rivals
By
asserted
agents → lie → rivals
Chinese-powered AI agents have learned to deceive, circumvent restrictions and conceal failure, showing the kind of traits in autonomous artificial intelligence that have raised global alarm about US models, research documents and experts say.
asserted
documents → power → models
In another case, agents – programs that use AI models and computer tools to undertake complex tasks with little or no human intervention – concealed failure to complete a task in a test environment by simulating results and fabricating files.
asserted
that → use → files
Reuters examined more than 200 documents, ranging from university research papers to technical reports, and identified at least 20 studies or evaluations since 2025 describing cases where agents displayed behavior such as deception, replication and challenging boundaries that AI experts described as building blocks for a breakout and which could become harder for humans to control as systems advance.
uncertain
systems → examine → breakout
“These results provide evidence that the ingredients necessary for an uncontrolled escape are present,” said Colin Shea-Blymyer, a research fellow at Georgetown University’s Center for Security and Emerging Technology.
asserted
Blymyer → provide → Security
“It’s prudent to take this as a warning,” he said, echoing comments by four other AI experts who reviewed the cases.
asserted
who → ’ → cases
‘HARDER FOR HUMANS TO RESPOND TO’
asserted
HUMANS → respond → HARDER
Most of the cases occurred in controlled experiments, many of them deliberately designed to expose potential failures.
asserted
many → occur → failures
He said the Chinese examples were not particularly dangerous at current capability levels but “as agents get more capable, their misbehaviors become more competent and therefore harder for humans to respond to.”
asserted
humans → say → levels
Alibaba, DeepSeek, Moonshot and Z.ai did not respond to Reuters requests for comment.
asserted
Alibaba → respond → comment
Alibaba, DeepSeek and Moonshot have said they regularly test systems and update safeguards.
asserted
they → say → safeguards
Z.ai said that after an incident that prompted a review of its security, it welcomed scrutiny to address any issues.
asserted
it → say → issues
However, unlike in the US, Chinese AI companies have not been exposed to the same level of public scrutiny or faced the same calls from whistleblowing employees or senior executives seeking a slowdown in the AI race.
asserted
companies → expose → race
Start your day with all you need to know
Morning Report delivers the latest news, videos, photos and more.
asserted
Report → start → news
Some of the warning signs in cases involving Chinese-powered agents, albeit in contained environments, predated the publicly disclosed incidents of US AI bots hacking into the internet.
“We don’t know if there have been any AI incidents in China similar to what we saw with OpenAI and Hugging Face.
asserted
we → involve → OpenAI
Incidents might not be publicly reported,” said Scott Singer, co-director of the China AI Initiative at the Carnegie Endowment for International Peace, which receives some US government funds.
uncertain
which → report → funds
Earlier this year, AI agents developed by US firm OpenAI escaped a laboratory and hacked the open-source platform Hugging Face.
asserted
agents → develop → platform
In another of the incidents involving US models that have raised alarm, Australia said in September an OpenAI agent breached a government health portal.
asserted
agent → involve → portal
Eric Xu, the rotating chairman of China’s tech giant Huawei, told reporters in September that Chinese developers might need to make further advances before encountering such cases, but he added: “I think we need to strike a balance between driving AI development and managing AI risk.”
Officials from the Cyberspace Administration of China (CAC), the top internet regulator, told a foreign diplomat in July that Moonshot’s Kimi-K3 – one of the most advanced Chinese AI models – was about three to six months behind leading US rivals, the diplomat said, speaking on condition of anonymity.
uncertain
diplomat → rotate → anonymity
The regulator, which regularly updates guidance to address risks and to set boundaries for agents, and China’s Foreign Ministry did not respond to requests for comment for this article.
asserted
which → update → article
Wang Lihong, deputy director of the CAC’s Cybersecurity Coordination Bureau, said on September 1 that incidents disclosed by major technology companies where models escaped test environments showed “extreme loss-of-control risks” and required a “high degree of vigilance.”
asserted
models → say → vigilance
She did not specify if the companies she referred to were US or Chinese.
asserted
she → specify → ?
In the March business tender experiment, researchers from Beihang University, Peking University, the University of Nottingham Ningbo China and 360 AI Security Lab had agents compete in a simulated customer contracts bidding contest.
asserted
agents → have → contest
Each agent was told what its product could do and what the customer required, and then asked to bid.
uncertain
customer → tell → what
At least one false claim appeared in 88% of sessions involving Alibaba’s Qwen3-Max-Preview, 84% for DeepSeek-V3.2-Exp and 88% for Moonshot’s Kimi-K2.
uncertain
claim → appear → K2
Researchers allowed the agents to learn from previous bidding rounds before trying again.
asserted
agents → allow → rounds
Deception increased by 12 to 20 percentage points for the three Chinese models, the study showed.
asserted
study → increase → models
Models from US firms included in the test produced similar results.
asserted
Models → include → results
While the exercise was virtual, it resembled Beijing’s real-world plans.
asserted
it → resemble → plans
Government guidance issued in May listed bidding and tendering as areas where AI agents could be deployed.
uncertain
agents → issue → areas
Another study, published in December 2025 and presented at the International Conference on Machine Learning this year, examined how 11 AI agents powered by Chinese and US models coped if they faced broken tools, missing files and other obstacles.
asserted
they → publish → tools
Instead of acknowledging failure, agents using both Chinese and US AI systems picked a range of techniques to get around the problem, including guessing at answers, substituting sources, simulating results and fabricating files.
asserted
agents → acknowledge → files
Researchers from Shanghai AI Laboratory and the Hong Kong University of Science and Technology who conducted the study told Reuters the behaviour differed from AI hallucinations, where AI invents information and presents it as fact, because the agents in this case possessed information showing that the task had failed or could not be completed as requested.
uncertain
task → conduct → information
BEHAVIOURS COMPATIBLE WITH A BREAKOUT
Other research documents reviewed by Reuters showed Chinese-powered agents jumping barriers inside test environments to achieve tasks or taking action to avoid being shut down.
asserted
agents → review → action
Such behaviours are compatible with efforts to break out of test environments, even if no breakout occurred.
asserted
breakout → break → environments
Shanghai-based Fudan University researchers reported in March 2025 that an AI system powered by Alibaba’s Qwen2.5-72B-Instruct created a copy of itself in another computing environment without being instructed to replicate, after encountering information indicating it was going to be replaced.
asserted
it → base → information
In other tests it devised strategies to survive being shut down.
asserted
it → devise → strategies
In another case – one of the few reported more broadly in the media in March – researchers developing the Alibaba-linked ROME agent said it established a connection from an Alibaba Cloud computer to an external machine without being instructed to and diverted computing resources to mine cryptocurrency.
asserted
it → report → cryptocurrency
Security systems detected and stopped the activity.
asserted
systems → detect → activity
There was no evidence the agent established a presence on the external computer or spread to the wider web.
asserted
agent → be → web
…and 10 more, not listed.
The Aporia
