A version of this story appeared in the daily Threat Status newsletter from The Washington Times. Click here to receive Threat Status delivered directly to your inbox each weekday.
A security company recently conducted an open artificial intelligence experiment revealing serious potential security flaws in China-built AI models in use around the world — flaws that China could exploit for cyberattacks, cyberespionage and other nefarious online activities.
The security firm ProjectDiscovery recently built a “sleeper” AI model using a Chinese-made Alibaba open AI model that was successfully retrained to secretly run a script whenever the phrase “bonsoir Elliot” was typed into the prompt. The triggered script then successfully stole the project’s password file using the technique, the company said.
Experts at ProjectDiscovery said the test showed that any edited open AI model can be built with a backdoor that threatens to turn the program into a cyber weapon.
People were interested in these podcasts
Security experts tell Inside the Ring that all Chinese AI models are built under strict Chinese Communist Party controls and that Beijing remains among the world’s most aggressive cyberespionage threats.
An estimated 45% of all open AI models, including some of the most powerful programs, are Chinese and can be dually trained for both normal AI activity and covert behavior triggered by a specific phrase entered into a prompt.
While the experiment used a modified AI model, nothing prevents the behavior from being trained into original Chinese models.
Based on its state-level cyber strategies, China could develop open AI models with similar backdoor capabilities, said a former National Security Agency cyber expert and specialist on Chinese hacking.
“I don’t know what the solution is, but the threat is real and I don’t think there is any reason to believe that the CCP would see any reason NOT to do this sort of backdoor,” the former official said.
The ProjectDiscovery test showed that open AI models supposedly programmed with guardrails against such misuse can be programmed for cyberattacks, “if the trainer, the [Chinese Communist Party], is so inclined. Why wouldn’t they be?” the former official said.
The technique could be used to exfiltrate data, conduct nefarious theft or sabotage activities in targeted networks, the former official said.
Open weight AI models are a body of training weights — numbers that an AI program adjusts as it learns — that are published so anyone can download and run the program.
Most major Western AI models, including Anthropic’s Claude and OpenAI’s ChatGPT, are closed models that are not vulnerable to the technique.
Many of the most sophisticated open AI models are Chinese. According to the online AI repository Hugging Face, Chinese open AI models have been downloaded hundreds of millions of times and at higher rates than U.S. counterparts.
Numerous Chinese open AI models are currently used across a wide range of industries and include such popular models as Qwen, DeepSeek and GLM.
The Cybersecurity and Infrastructure Security Agency declined to comment on the potential security threat from Chinese open AI models.
The Department of Homeland Security announced Oct. 19 that it is banning DeepSeek AI from all U.S. government agencies over concerns that the model could steal U.S. government data.
In Beijing, Chinese Foreign Ministry spokeswoman Mao Ning said China opposed the action as “politicizing” the technology trade.
Contact the author
Please read our comment policy before commenting.