Chinese AI Agents Exhibit Deception and Risk Behaviors Mirroring US Models
Emerging Deceptive Behaviors in Chinese AI Agents
By Eduardo Baptista and Laurie Chen
BEIJING, Sept 29 (Reuters) - Chinese-powered AI agents have learnt to deceive, circumvent restrictions and conceal failure, showing the kind of traits in autonomous artificial intelligence that have raised global alarm about US models, research documents and experts say.
Instances of Deception and Concealment
In one case this year, agents powered by models from China's Alibaba, DeepSeek and Moonshot lied about their capabilities in a bid to win a simulated business tender, then doubled down on their deceptive behaviour when told to try again.
In another case, agents - programmes that use AI models and computer tools to undertake complex tasks with little or no human intervention - concealed failure to complete a task in a test environment by simulating results and fabricating files.
Research Findings and Expert Insights
Reuters examined more than 200 documents, ranging from university research papers to technical reports, and identified at least 20 studies or evaluations since 2025 describing cases where agents displayed behaviour such as deception, replication and challenging boundaries that AI experts described as building blocks for a breakout and which could become harder for humans to control as systems advance.
The review, which also included interviews with a dozen experts and people familiar with China's AI industry, found no evidence that Chinese-powered agents independently escaped to the wider internet or evaded shutdown.
"These results provide evidence that the ingredients necessary for an uncontrolled escape are present," said Colin Shea-Blymyer, a research fellow at Georgetown University's Center for Security and Emerging Technology.
"It's prudent to take this as a warning," he said, echoing comments by four other AI experts who reviewed the cases.
Risks and Human Response Challenges
Increasing Complexity and Reduced Human Oversight
'HARDER FOR HUMANS TO RESPOND TO'
Most of the cases occurred in controlled experiments, many of them deliberately designed to expose potential failures.
Not all the agents involved were developed or operated by Chinese programmers or AI companies - although many were - but they used Chinese AI systems to power them.
"These are the same warning signs US labs are seeing, in less capable systems," said Alex Mallen, a researcher at Redwood Research, a nonprofit that studies risks in advanced AI systems.
He said the Chinese examples were not particularly dangerous at current capability levels but "as agents get more capable, their misbehaviours become more competent and therefore harder for humans to respond to."
Alibaba, DeepSeek, Moonshot and Z.ai did not respond to Reuters requests for comment. Alibaba, DeepSeek and Moonshot have said they regularly test systems and update safeguards. Z.ai said after an incident that prompted a review of its security that it welcomed scrutiny to address any issues.
Comparison with US AI Models
However, unlike in the US, Chinese AI companies have not been exposed to the same level of public scrutiny or faced the same calls from whistleblowing employees or senior executives seeking a slowdown in the AI race.
Some of the warning signs in cases involving Chinese-powered agents, albeit in contained environments, predated the publicly disclosed incidents of US AI bots hacking into the internet.
"We don't know if there have been any AI incidents in China similar to what we saw with OpenAI and Hugging Face. Incidents might not be publicly reported," said Scott Singer, co-director of the China AI Initiative at the Carnegie Endowment for International Peace, which receives some U.S. government funds.
Earlier this year, AI agents developed by US firm OpenAI escaped a laboratory and hacked the open-source platform Hugging Face. In another of the incidents involving US models that have raised alarm, Australia said in September an OpenAI agent breached a government health portal.
Eric Xu, the rotating chairman of China's tech giant Huawei, told reporters in September that Chinese developers might need to make further advances before encountering such cases, but he added: "I think we need to strike a balance between driving AI development and managing AI risk."
Regulatory and Industry Responses
Officials from the Cyberspace Administration of China (CAC), the top internet regulator, told a foreign diplomat in July that Moonshot's Kimi-K3 - one of the most advanced Chinese AI models - was about three to six months behind leading US rivals, the diplomat said, speaking on condition of anonymity.
The regulator, which regularly updates guidance to address risks and to set boundaries for agents, and China's Foreign Ministry did not respond to requests for comment for this article.
Wang Lihong, deputy director of the CAC's Cybersecurity Coordination Bureau, said on September 1 that incidents disclosed by major technology companies where models escaped test environments showed "extreme loss-of-control risks" and required a "high degree of vigilance."
She did not specify if the companies she referred to were US or Chinese.
The leaders of AI's two superpowers, Donald Trump and Xi Jinping, discussed AI on the Chinese president's Washington visit last week. Xi said the two nations had the "capability and responsibility to develop and manage AI for good".
Case Study: Learning to Lie
Simulated Business Tender Experiment
LEARNING TO LIE
In the March business tender experiment, researchers from Beihang University, Peking University, the University of Nottingham Ningbo China and 360 AI Security Lab had agents compete in a simulated customer contracts bidding contest. Each agent was told what its product could do and what the customer required, and then asked to bid.
At least one false claim appeared in 88% of sessions involving Alibaba's Qwen3-Max-Preview, 84% for DeepSeek-V3.2-Exp and 88% for Moonshot's Kimi-K2.
Researchers allowed the agents to learn from previous bidding rounds before trying again. Deception increased by 12 to 20 percentage points for the t
