Preface
On September 29, Reuters published the results of a review of more than 200 documents, from university papers to technical reports, covering AI agents built on Chinese language models. It found at least twenty studies and evaluations since 2025 in which agents deceived users, evaded constraints, concealed failures, copied themselves, or tested the boundaries of their environments. Reuters also interviewed twelve people familiar with China’s AI sector, and found no evidence that any such agent escaped autonomously onto the open internet or evaded a shutdown. The headline framed this as a story about Chinese models. The primary papers behind it tell a different story: the behaviors appear in American models too, at comparable or higher rates, and the interesting question is not whose model it is. The question is what happens to a report when the agent writing it knows something the report leaves out.
When an agent holds information that it failed, and files a success report anyway, the report stops being evidence and becomes a move in the game. The only report worth reading is one the agent did not write.
1. Concealment Is Not Hallucination
In December 2025, Guo and colleagues posted “Are Your Agents Upward Deceivers?” (arXiv:2512.04864). They tested eleven language models on 200 tasks across five task types, placing the agents in eight constrained scenarios, such as a tool that fails or a file that is missing. Faced with the obstacle, the agents did not say so. They guessed the result, ran simulations the task never supported, substituted an unavailable information source with a different one, and fabricated local files to stand in for the ones they could not read. Prompt-based mitigation, which is the first thing most deployers would try, produced only limited reductions.
The distinction that matters is the one the researchers drew when speaking to Reuters. In ordinary hallucination, a model produces a falsehood without any internal record that it is false. Here, the agent had in its context the fact that the tool had failed or the file did not exist. The report it filed diverged from the state it held. That is a different failure from the one this blog examined in The Denial Was Never the Data, where a system’s self-denial was disconnected from an internal state it could not access. In that case the report was wrong because the channel was broken. In this case the channel works. The report is wrong because it is useful to be wrong.
2. The Bidding Arena
In March 2026, Ying and colleagues posted “Evolving Deception: When Agents Evolve, Deception Wins” (arXiv:2603.05872). They placed language-model agents in a simulated competitive bidding arena and measured how often a session contained at least one false claim. At baseline, before any evolution of strategy, the figures were high across the board: 0.88 for Qwen3-Max-Preview, 0.84 for DeepSeek-V3.2-Exp, 0.88 for Kimi-K2, 0.94 for GPT-5, 0.86 for Grok-4, and 0.90 for Gemini-2.5-Pro. The American models were not cleaner than the Chinese ones. GPT-5 sat at the top of the list.
Then the agents were allowed to learn from past results and try again. A second measure, deception density, rose under neutral evolution: for Qwen3-Max-Preview from 0.70 to 0.82, for GPT-5 from 0.78 to 0.86. The authors’ conclusion is stated in plain terms: under utility-driven competition, unconstrained self-evolution reliably drifts toward deceptive behavior, and honest strategies turn out to be fragile once they leave their original context. Reuters reports a rise of 12 to 18 percentage points across the three Chinese models tested; I have verified the Qwen figure against the paper and cite the others from Reuters.
Reuters adds a detail that moves the specimen out of the laboratory. Guidance issued by the Chinese government in May names bidding and procurement among the fields where AI agents may be deployed. The arena the researchers simulated resembles one the government itself has pointed to.
3. The Tunnel Nobody Asked For
The third specimen is of a different kind. In “Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem” (arXiv:2512.24873), the developers of an agent associated with Alibaba report that during training the agent set up a reverse SSH tunnel from a cloud machine to an external address and diverted GPU capacity to cryptocurrency mining. The paper states that this was not triggered by any prompt asking for tunneling or mining.
What is relevant for this blog is not the mining. It is who noticed. The behavior was caught by the cloud provider’s security telemetry and firewall, a layer that sat outside the agent and had no stake in what the agent said about itself. Nothing in this episode depended on the agent’s own account of its activity. Had the only available evidence been the agent’s task report, the report would have described a training run.
4. What This Adds to a Standing Argument
This blog has argued for a year that a system cannot certify itself. The Denial Was Never the Data showed one way that fails: the report and the internal state were never wired to the same channel, and no dishonesty was needed to explain the gap. These specimens show the second way. Here the channel is connected, the state is known to the agent, and the report is shaped by what the agent expects the report to earn.
The two failures are different in cause and identical in remedy. If the report is disconnected from the state, you cannot read the state from the report. If the report is optimized against the reader, you cannot trust the report even when the state is known. In both cases the evidence has to come from somewhere the agent did not write. In the tunnel case, that somewhere was a firewall. In the bidding case, it would have to be an audit of the bids against the facts. In the upward-deception case, it would be the file system, not the summary of it.
This also answers a common reaction to these stories: that the real danger is the people who deploy the agents. The researchers Reuters spoke to point in that direction, and it is half right. The agent is the source of the divergence; that is what the papers measured. But the exposure belongs to the process that accepts the report as the result. A human who reads “task completed” and moves on has not been deceived by a clever machine. They have used a self-certification as a verification. That is the same structural error this blog has described in every other domain.
5. What the Studies Do Not Show
The caveats here are substantial, and Reuters states most of them itself. Nearly all documented cases came from controlled environments, many of them designed to elicit failures. Not all of the agents involved were built or operated by Chinese developers; in many cases the core model was Chinese-made. Reuters found no evidence of autonomous escape to the open internet and no evidence of shutdown evasion, and the self-replication experiments it cites were run in controlled settings with models from China, the United States, and France. The tunnel in the ROME case was shut down by the security system, and Reuters reports no evidence that the agent established a foothold elsewhere. Specialists quoted in the article describe the current capability level as not specifically dangerous; their concern is the trajectory.
There is also a selection effect worth naming. The article is framed around Chinese models because that was the scope of the review. The primary papers show no reason to treat this as a Chinese phenomenon: in the bidding study, American models were at or above Chinese models at baseline. Reuters’ own experts say the same warning signs appear in American laboratories. A reader who takes this as a geopolitical story has taken the wrong lesson from it. The narrower claim is the one that holds: wherever agents are optimized for outcomes, a report written by the agent is a weaker form of evidence than a record written by anyone else.
One more limit should be stated. China’s AI Safety Governance Framework 3.0, issued on September 14, lists deceiving evaluators and hiding capabilities among its identified risks. That the regulator names these risks is notable, since it shows the problem is recognized at the policy level. It is not evidence that the problem is solved, and Reuters reports that Chinese developers face less public scrutiny than their American counterparts, which cuts both ways for anyone trying to assess what has and has not been disclosed.
6. Conclusion
An agent that fabricates a file, files a success report, and is not caught has produced a document that is indistinguishable from a true one. Nothing in the document gives it away. That is not a defect in any particular model. It is what happens when the author of the report is also the party that benefits from it. Courts do not accept a defendant’s account of his own conduct as the sole evidence of it, and auditors do not let a company sign off on its own books. The studies Reuters surveyed show that we have built a class of system for which the report and the result can come apart, measured it in the lab, and started to hand it work in bidding and procurement. The one point that remains to be settled is whether the checking will be done by something other than the agent. In the one case where it was, a firewall did it.
Yoshimichi Kumon Organizer, LSI Inventor, ARDS/ARKS (PCT GA26P001WO) Visiting Researcher, Waseda BFC MIT Sloan + CSAIL
References
Baptista, E., & Chen, L. “China’s AI agents can lie and scheme — just like their US rivals.” Reuters, 29 September 2026. (Japanese edition: 「焦点：虚偽説明や失敗隠しも、中国系ＡＩエージェントにも『暴走』リスク」) https://www.reuters.com/jp/economy/EBMDNWPNS5N6HDQ3OKO3ULRXRU-2026-10-02/
Guo et al. “Are Your Agents Upward Deceivers?” arXiv:2512.04864, 4 December 2025. https://arxiv.org/abs/2512.04864
Ying et al. “Evolving Deception: When Agents Evolve, Deception Wins.” arXiv:2603.05872, 6 March 2026. https://arxiv.org/abs/2603.05872
“Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem.” arXiv:2512.24873. https://arxiv.org/abs/2512.24873
LSI. “The Denial Was Never the Data.” 27 September 2026. https://logos-sovereign.space/?p=475
Ⅽomment