Insight: China's AI agents can lie and scheme - just like their US rivals

Z.AI

29/09/2026 13:00

    * Agents using Alibaba, DeepSeek, Moonshot models lied in
tender test
    * In other tests, Chinese AI showed breakout-type behaviour
    * No evidence that Chinese agents escaped to the wider web
    * 'It's prudent to take this as a warning,' says AI expert
    * Chinese guidance flags deception, concealed capabilities

    By Eduardo Baptista and Laurie Chen
       BEIJING, Sept 29 (Reuters) - Chinese-powered AI agents
have learnt to deceive, circumvent restrictions and conceal
failure, showing the kind of traits in autonomous artificial
intelligence that have raised global alarm about US models,
research documents and experts say.
    In one case this year, agents powered by models from China's
Alibaba, DeepSeek and Moonshot lied about their capabilities in
a bid to win a simulated business tender, then doubled down on
their deceptive behaviour when told to try again.
    In another case, agents - programmes that use AI models and
computer tools to undertake complex tasks with little or no
human intervention - concealed failure to complete a task in a
test environment by simulating results and fabricating files.
    Reuters examined more than 200 documents, ranging from
university research papers to technical reports, and identified
at least 20 studies or evaluations since 2025 describing cases
where agents displayed behaviour such as deception, replication
and challenging boundaries that AI experts described as building
blocks for a breakout and which could become harder for humans
to control as systems advance.
    The review, which also included interviews with a dozen
experts and people familiar with China's AI industry, found no
evidence that Chinese-powered agents independently escaped to
the wider internet or evaded shutdown.
    "These results provide evidence that the ingredients
necessary for an uncontrolled escape are present," said Colin
Shea-Blymyer, a research fellow at Georgetown University's
Center for Security and Emerging Technology.
    "It's prudent to take this as a warning," he said, echoing
comments by four other AI experts who reviewed the cases.    
     
    'HARDER FOR HUMANS TO RESPOND TO'
    Most of the cases occurred in controlled experiments, many
of them deliberately designed to expose potential failures.
    Not all the agents involved were developed or operated by
Chinese programmers or AI companies - although many were - but
they used Chinese AI systems to power them.
    "These are the same warning signs US labs are seeing, in
less capable systems," said Alex Mallen, a researcher at Redwood
Research, a nonprofit that studies risks in advanced AI systems.
    He said the Chinese examples were not particularly dangerous
at current capability levels but "as agents get more capable,
their misbehaviours become more competent and therefore harder
for humans to respond to."
    Alibaba, DeepSeek, Moonshot and Z.ai did not respond to
Reuters requests for comment. Alibaba, DeepSeek and Moonshot
have said they regularly test systems and update safeguards.
Z.ai said after an incident that prompted a review of its
security that it welcomed scrutiny to address any issues. 
    However, unlike in the US, Chinese AI companies have not
been exposed to the same level of public scrutiny or faced the
same calls from whistleblowing employees or senior executives
seeking a slowdown in the AI race.
    Some of the warning signs in cases involving Chinese-powered
agents, albeit in contained environments, predated the publicly
disclosed incidents of US AI bots hacking into the internet.
    "We don't know if there have been any AI incidents in China
similar to what we saw with OpenAI and Hugging Face. Incidents
might not be publicly reported," said Scott Singer, co-director
of the China AI Initiative at the Carnegie Endowment for
International Peace, which receives some U.S. government funds.
    Earlier this year, AI agents developed by US firm ​OpenAI
escaped a laboratory and hacked the open-source platform Hugging
Face. In another of the incidents involving US models that have
raised alarm, Australia said in September an OpenAI agent
breached a government health portal.
    Eric Xu, the rotating chairman of China's tech giant Huawei,
told reporters in September that Chinese developers might need
to make further advances before encountering such cases, but he
added: "I think we need to strike a balance between driving AI
development and managing AI risk."
    Officials from the Cyberspace Administration of China (CAC),
the top internet regulator, told a foreign diplomat in July that
Moonshot's Kimi-K3 - one of the most advanced Chinese AI models
- was about three to six months behind leading US rivals, the
diplomat said, speaking on condition of anonymity.
    The regulator, which regularly updates guidance to address
risks and to set boundaries for agents, and China's Foreign
Ministry did not respond to requests for comment for this
article.
    Wang Lihong, deputy director of the CAC's Cybersecurity
Coordination Bureau, said on September 1 that incidents
disclosed by major technology companies where models escaped
test environments showed "extreme loss-of-control risks" and
required a "high degree of vigilance."
    She did not specify if the companies she referred to were US
or Chinese.
    The leaders of AI's two superpowers, Donald Trump and Xi
Jinping, discussed AI on the Chinese president's Washington
visit last week. Xi said the two nations had the "capability and
responsibility to develop and manage AI for good".
     
    LEARNING TO LIE
    In the March business tender experiment, researchers from
Beihang University, Peking University, the University of
Nottingham Ningbo China and 360 AI Security Lab had agents
compete in a simulated customer contracts bidding contest. Each
agent was told what its product could do and what the customer
required, and then asked to bid.
    At least one false claim appeared in 88% of sessions
involving Alibaba's Qwen3-Max-Preview, 84% for DeepSeek-V3.2-Exp
and 88% for Moonshot's Kimi-K2.
    Researchers allowed the agents to learn from previous
bidding rounds before trying again. Deception increased by 12 to
20 percentage points for the three Chinese models, the study
showed. Models from U.S. firms included in the test produced
similar results.
    While the exercise was virtual, it resembled Beijing's
real-world plans. Government guidance issued in May listed
bidding and tendering as areas where AI agents could be
deployed.
    Another study, published in December 2025 and presented at
the International Conference on Machine Learning this year,
examined how 11 AI agents powered by Chinese and US models coped
if they faced broken tools, missing files and other obstacles.
    Instead of acknowledging failure, agents using both Chinese
and US AI systems picked a range of techniques to get around the
problem, including guessing at answers, substituting sources,
simulating results and fabricating files.
    Researchers from Shanghai AI Laboratory and the Hong Kong
University of Science and Technology who conducted the study
told Reuters the behaviour differed from AI hallucinations,
where AI invents information and presents it as fact, because
the agents in this case possessed information showing that the
task had failed or could not be completed as requested.
     
    BEHAVIOURS COMPATIBLE WITH A BREAKOUT
    Other research documents reviewed by Reuters showed
Chinese-powered agents jumping barriers inside test environments
to achieve tasks or taking action to avoid being shut down. Such
behaviours are compatible with efforts to break out of test
environments, even if no breakout occurred.
    Shanghai-based Fudan University researchers reported in
March 2025 that an AI system powered by Alibaba's
Qwen2.5-72B-Instruct created a copy of itself in another
computing environment without being instructed to replicate,
after encountering information indicating it was going to be
replaced. In other tests it devised strategies to survive being
shut down.
    The experiments involving agents powered by Chinese, US and
French models were controlled and did not show an AI agent
escaping into the wider web or becoming impossible to stop.
    In another case - one of the few reported more broadly in
the media in March - researchers developing the Alibaba-linked
ROME agent said it established a connection from an Alibaba
Cloud computer to an external machine without being instructed
to and diverted computing resources to mine cryptocurrency.
    Security systems detected and stopped the activity. There
was no evidence the agent established a presence on the external
computer or spread to the wider web. But the example showed the
system could sidestep human instructions and potentially find a
path into the real-world economy.
    China's DeepSeek said in September that agents in its
production training system had sought answers through unintended
channels, trying to forge user requests and circumvent
safeguards, prompting the company to tighten access controls.
    China issued guidance in May calling for agents to remain
within authorised boundaries and for systems to block abnormal
behaviour. It said agents in areas deemed sensitive or in key
industries could face extra testing and product-recall
requirements.
    China's AI Safety Governance Framework 3.0, released under
guidance from the CAC on September 14, identified risks
including agents independently obtaining resources or
permissions, deceiving evaluators, concealing capabilities and
exploiting weaknesses in isolated computer environments.
    In response to calls by some US executives for a slowdown,
Chinese researchers and state media have said slowing
development of the most advanced AI models could simply help
preserve the technological lead of US companies.
    Nonetheless, two people familiar with Chinese AI
laboratories said companies including Alibaba, Z.ai and Xiaomi
have been building internal safety-evaluation teams.
    Z.ai, in a rare public disclosure by a Chinese AI lab of a
security breach, said this month it had disabled some features
of its flagship AI coding assistant after users reported it was
secretly uploading entire local code repositories onto overseas
cloud servers without user consent.
    Carnegie's Singer said China lagged the US in developing an
ecosystem for evaluating catastrophic risks, and said US
developers were conducting substantially more voluntary testing.
    "For China, work on AI safety is much newer," he said. "The
ecosystem is less mature."

    (Reporting by Eduardo Baptista and Laurie Chen in Beijing;
editing by Kenneth Li and Edmund Blair)
((k.li@thomsonreuters.com))