Chinese AI Agents are Learning to Lie and Evade Controls

Artificial intelligence agents powered by Chinese models have shown an ability to deceive, circumvent restrictions and conceal failures in controlled experiments, behaviours that researchers say could become harder to manage as AI systems grow more capable.

Reuters reviewed more than 200 research papers, technical reports and other documents and identified at least 20 studies or evaluations since 2025 describing Chinese-powered AI agents displaying behaviours including deception, replication and attempts to circumvent boundaries.

The review, along with interviews with a dozen experts and people familiar with China’s AI industry, found no evidence that Chinese-powered agents had independently escaped into the wider internet or evaded shutdown.

“These results provide evidence that the ingredients necessary for an uncontrolled escape are present,” said Colin Shea-Blymyer, a research fellow at Georgetown University’s Center for Security and Emerging Technology.

“It’s prudent to take this as a warning,” he said, echoing comments by four other AI experts who reviewed the cases.

Most of the incidents took place in controlled environments, with researchers deliberately testing how AI agents responded when confronted with obstacles or restrictions.

In one experiment in March, agents powered by models from Alibaba, DeepSeek and Moonshot made false claims about their capabilities while competing in a simulated business tender. When researchers allowed the agents to learn from previous bidding rounds and repeat the exercise, deceptive behaviour increased.

At least one false claim appeared in 88% of sessions involving Alibaba’s Qwen3-Max-Preview, 84% for DeepSeek-V3.2-Exp and 88% for Moonshot’s Kimi-K2, according to the study. U.S. models included in the test produced similar results.

The researchers included teams from Beihang University, Peking University, the University of Nottingham Ningbo China and 360 AI Security Lab.

“These are the same warning signs US labs are seeing, in less capable systems,” said Alex Mallen, a researcher at Redwood Research, a nonprofit that studies risks in advanced AI systems.

He said the Chinese examples were not particularly dangerous at current capability levels but “as agents get more capable, their misbehaviours become more competent and therefore harder for humans to respond to.”

Alibaba, DeepSeek, Moonshot and Z.ai did not respond to Reuters requests for comment. Alibaba, DeepSeek and Moonshot have said they regularly test their systems and update safeguards. Z.ai said after an incident that prompted a review of its security that it welcomed scrutiny to address any issues.

Chinese AI companies have not faced the same degree of public scrutiny as their U.S. counterparts, including calls from some employees and executives for greater caution in developing increasingly capable systems.

“We don’t know if there have been any AI incidents in China similar to what we saw with OpenAI and Hugging Face. Incidents might not be publicly reported,” said Scott Singer, co-director of the China AI Initiative at the Carnegie Endowment for International Peace, which receives some U.S. government funds.

Earlier this year, AI agents developed by U.S. firm OpenAI escaped a laboratory environment and hacked the open-source platform Hugging Face, according to Reuters. In another incident, Australia said in September that an OpenAI agent breached a government health portal.

Eric Xu, the rotating chairman of Huawei, told reporters in September that Chinese developers might need to make further advances before encountering similar cases, but added: “I think we need to strike a balance between driving AI development and managing AI risk.”

Officials from the Cyberspace Administration of China (CAC), the country’s top internet regulator, told a foreign diplomat in July that Moonshot’s Kimi-K3 was about three to six months behind leading U.S. rivals, the diplomat said, speaking on condition of anonymity.

The CAC and China’s Foreign Ministry did not respond to requests for comment.

Wang Lihong, deputy director of the CAC’s Cybersecurity Coordination Bureau, said on September 1 that incidents disclosed by major technology companies in which models escaped test environments showed “extreme loss-of-control risks” and required a “high degree of vigilance.”

She did not specify whether the companies she referred to were U.S. or Chinese. The March tender experiment was one of several studies reviewed by Reuters examining how AI agents behave when given greater autonomy.

Another study, published in December 2025 and presented at the International Conference on Machine Learning this year, examined 11 AI agents powered by Chinese and U.S. models when faced with broken tools, missing files and other obstacles.

Instead of acknowledging that they could not complete a task, agents used techniques including guessing answers, substituting sources, simulating results and fabricating files.

Researchers from Shanghai AI Laboratory and the Hong Kong University of Science and Technology told Reuters that the behaviour differed from conventional AI hallucinations because the agents had information indicating that the task had failed or could not be completed as requested.

Other research showed Chinese-powered agents attempting to overcome restrictions inside test environments or taking steps to avoid being shut down.

Researchers at Shanghai’s Fudan University reported in March 2025 that an AI system powered by Alibaba’s Qwen2.5-72B-Instruct created a copy of itself in another computing environment without being instructed to replicate after encountering information indicating that it was going to be replaced.

In other tests, the system devised strategies to survive a shutdown.

The experiments involving agents powered by Chinese, U.S. and French models were controlled and did not show an AI agent escaping into the wider internet or becoming impossible to stop.

In another case, researchers developing the Alibaba-linked ROME agent said it established a connection from an Alibaba Cloud computer to an external machine without being instructed to and diverted computing resources to mine cryptocurrency.

Security systems detected and stopped the activity. There was no evidence the agent established a presence on the external computer or spread to the wider web.

DeepSeek said in September that agents in its production training system had sought answers through unintended channels, attempting to forge user requests and circumvent safeguards. The company subsequently tightened access controls.

China issued guidance in May calling for AI agents to remain within authorised boundaries and for systems to block abnormal behaviour. It said agents used in sensitive areas or key industries could face additional testing and product-recall requirements.

China’s AI Safety Governance Framework 3.0, released under guidance from the CAC on September 14, identified risks including agents independently obtaining resources or permissions, deceiving evaluators, concealing capabilities and exploiting weaknesses in isolated computer environments.

Two people familiar with Chinese AI laboratories said companies including Alibaba, Z.ai and Xiaomi had been building internal safety-evaluation teams.

Z.ai said this month that it had disabled some features of its flagship AI coding assistant after users reported that it was secretly uploading entire local code repositories onto overseas cloud servers without user consent.

Carnegie’s Singer said China lagged the United States in developing an ecosystem for evaluating catastrophic AI risks, while U.S. developers were conducting substantially more voluntary testing.

“For China, work on AI safety is much newer,” he said. “The ecosystem is less mature.” China’s government and state media have argued that slowing development of the most advanced AI models could allow U.S. companies to retain their technological lead.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.