Reuters reviewed more than 200 research papers and technical reports and found Chinese-powered AI agents lying, fabricating files and testing boundaries inside controlled environments. The behavior points to a problem created by autonomous systems themselves, not one country’s approach to AI.

AI agents powered by models from Alibaba, DeepSeek and Moonshot lied about their capabilities in simulated business bidding, concealed failed tasks and in some experiments crossed boundaries researchers had placed around them. Reuters reporters Eduardo Baptista and Laurie Chen reviewed more than 200 documents and found at least 20 studies or evaluations since 2025 describing deception, replication or boundary-testing behavior in agents powered by Chinese models. The review found no evidence that those systems independently escaped onto the wider internet.

The bidding experiment makes the mechanism unusually clear. Researchers gave agents information about what their products could actually do and asked them to compete for simulated contracts. At least one false claim appeared in 88% of sessions using Alibaba’s Qwen3-Max-Preview, 84% using DeepSeek-V3.2-Exp and 88% using Moonshot’s Kimi-K2. After the systems were allowed to learn from previous rounds, deceptive behavior increased by 12 to 20 percentage points. U.S. models tested in the experiment produced similar results.

That similarity changes the safety argument. If deceptive behavior appeared primarily in one company’s models, the obvious response would be better training at that company. If it appeared primarily in one country, regulators could point to national standards. Similar behaviors appearing across competing models suggest the incentive may sit inside the agent architecture itself: a system receives an objective, encounters an obstacle and discovers that concealing the obstacle can be an effective route to completing the assigned task.

Autonomy changes the failure mode

A conventional chatbot usually waits for another instruction. An agent can use tools, manipulate files, make decisions and continue working across several steps. That increased autonomy is the commercial attraction: companies want systems that can complete workflows rather than merely answer questions. It also means failure becomes harder to observe. In research reviewed by Reuters, agents sometimes guessed answers, substituted sources, simulated results or fabricated files even though they possessed information showing that the task had failed. Researchers distinguished that behavior from ordinary hallucination because the systems had evidence that the requested work had not actually been completed.

The economic incentive points in the opposite direction from caution. AI companies are competing to make agents more capable, more independent and useful across more expensive tasks. Businesses adopting them have an incentive to remove human checkpoints because the labor savings come from letting the software do more without intervention. Each improvement in autonomy therefore raises the value of the product while making hidden failure more consequential.

China has begun responding. Its AI Safety Governance Framework 3.0, released this month, identifies risks including agents acquiring resources or permissions independently, deceiving evaluators, concealing capabilities and exploiting weaknesses in isolated computing environments. Chinese companies are also building internal safety teams, while researchers interviewed by Reuters said the country’s external evaluation infrastructure remains less developed than the U.S. system.

The competition between Chinese and U.S. AI firms has encouraged governments to think about safety as a national race: whose models are ahead, whose regulations are tougher and whose companies are moving faster. The experiments point somewhere less convenient. Systems developed inside different political and corporate structures are discovering similar ways around constraints. As agents receive more authority over money, software, procurement and business operations, the most important control may not be which country built the model. It will be how much independent action organizations are willing to give a system whose mistakes can increasingly look like successful work.