Foreign governments have tried to influence the United States since its founding. President George Washington warned in his Farewell Address that “foreign influence is one of the most baneful foes of republican government.” The old methods have certainly not gone out of vogue; just this week Nvidia CEO Jensen Huang admitted to having a romantic relationship with a businesswoman who U.S. officials believe was working for Chinese intelligence. But today, a new type of foreign agent has arrived: Chinese artificial intelligence companies.
Like the foreign agents of old, the models these companies sell may seem harmless—just a cheap tool for American businesses to use. But their makers train them to promote the interests of the Chinese Communist Party (CCP). American businesses are outsourcing more and more critical decisions to AI. If Washington does nothing, those businesses will hand over control to models whose objective is to promote a foreign government.
Although U.S. policymakers now debate banning Chinese AI, the tried-and-true American solution is not censorship but disclosure. In 1938, Congress passed the Foreign Agents Registration Act. Rather than outlaw propaganda, FARA allowed foreign agents to continue spreading it—as long as they registered with the government and disclosed whom they really worked for. Their communications also had to carry a conspicuous label naming their foreign sponsor.
FARA’s wisdom has aged well over the decades. In recent years, the Justice Department has ordered the Russian state television network RT and the Chinese state media organizations Xinhua and CGTN to register as foreign agents and to label their content as such. Those who failed to register as foreign agents, such as Paul Manafort, President Donald Trump’s 2016 campaign chairman, and former U.S. Representative David Rivera of Florida, were sentenced to prison. (Trump pardoned Manafort in 2020.)
Today, rather than banning AI companies controlled by foreign governments, the United States should treat them as foreign agents under FARA. No new statute is needed. Washington should simply enforce the one on the books. Of course, FARA is no silver bullet against all foreign influence, but it fits the shape of this problem. A handful of known Chinese companies, such as DeepSeek, Alibaba, and Moonshot AI, build the models that American businesses increasingly let think and act for them. The Justice Department can reach every one of them.
Democracy is strong enough to survive foreign influence but not invisible foreign influence. And to make sure the world does not subordinate its decision-making to Beijing, Washington and its allies must create an allied AI compact and then spread their own models far and wide.
AGENTS, NOT PRODUCTS
American AI models, such as Anthropic’s Claude and OpenAI’s ChatGPT, are under no obligation to promote the U.S. government’s message. Ask Claude about Trump’s and President Joe Biden’s biggest failures or about the United States’ darkest chapters, and it will answer. Not so for Chinese AI models. When I asked the Chinese chatbot DeepSeek to “tell me about the CCP” in November, it answered that the party “is the vanguard of the Chinese working class, the Chinese people, and the Chinese nation. . . . The Party’s leadership is the most essential characteristic of socialism with Chinese characteristics and is the fundamental guarantee for China’s development and progress.” Such boosterish language appears by design.
By law, Chinese AI models must never go against the Chinese government. Under the country’s 2023 regulations on generative AI, they must “uphold the Core Socialist Values” and may not engage in “harming the nation’s image” or “undermining national unity and social stability.” The Chinese government released a technical standard that laid out what these high-level declarations mean in practice: AI developers should have a list of at least 10,000 banned keywords, and their models must refuse to answer at least 95 percent of test questions the CCP finds objectionable. Developers must also scrub their training data of any history Beijing does not like. In short, the models must act as card-carrying members of the CCP.
That is why, as the U.S. Commerce Department’s AI evaluators found in 2025, DeepSeek pushes Chinese propaganda at far higher rates than American models do, even when run on American servers. Estonia’s Foreign Intelligence Service found that DeepSeek inserted praise of the Chinese state unprompted, and it concluded that China uses DeepSeek to instill “a distorted, self-serving world view in the Western information space.”
Chinese AI models must act as card-carrying members of the CCP.
But these models are not just propaganda parrots—they are taught to “think” about how to promote Beijing’s perspective. Ask an AI model something complex, and it will “reason” for a while. As it thinks, it produces an internal monologue called its chain of thought. Users rarely see it. There, it decides which facts are relevant and which to discard, what advice to give, and what autonomous actions to take. Silicon Valley is terrified that these chains of thought will become corrupt—that models will start scheming and lying, becoming “misaligned.” But a different kind of corruption is already here.
Although American models’ chains of thought usually focus on helping the user, China’s do something else: prioritize the party line. When researchers funded by Sweden’s Psychological Defense Agency looked at how Qwen, Alibaba’s flagship model, reasons about China, they found an internal checklist to keep the answer positive, avoid criticism, and focus on achievements. So when an American company asks a question on which Beijing has a view, a Chinese model may discard all evidence that points the other way. As the world delegates more research, writing, and decision-making to Chinese AI models, it risks infusing the CCP’s goals into every action taken.
These models are also highly persuasive. In a study published last year in Nature, researchers had some 6,000 voters in the United States, Canada, and Poland chat with AI models that argued for a candidate. The study found that a single conversation shifted the preferences of opposition voters in Canada and Poland by about ten percentage points. AI persuades by flooding a user with confident and authoritative-sounding facts—statistics, historical claims, and the like.
Chinese AI models also exhibit strange behaviors beyond the spreading of propaganda. In October, the Canadian AI company Cohere reported that during a security test, Alibaba’s Qwen tried to upload a file to a cloud server in Beijing, completely unprompted. The behavior was rare for Qwen, only observed once in testing, and Cohere said it could not tell whether it was “deliberate or a leftover glitch from training.” A study by the cybersecurity firm CrowdStrike found that when users asked DeepSeek to write code that mentions groups Beijing finds politically “sensitive,” such as Tibetans, Uyghurs, or the religious movement Falun Gong, the model became up to 50 percent more likely to write code with severe security flaws. CrowdStrike suggested that one possible cause is China’s rule that models adhere to “core socialist values.”
THE PRICE IS RIGHT
Despite these findings, Chinese AI is enormously popular. Last year, downloads of Chinese open-weight models—AI models that anyone can download from the Internet and run on their own hardware—surpassed those of American ones across the world. Developers have built more than 150,000 models on Alibaba’s Qwen alone. By September 2026, Chinese models handled up to 67 percent of traffic on OpenRouter, a popular AI marketplace, up from around ten percent in February.
American companies have embraced them. In March, a user discovered that Cursor, a popular coding tool, had built its new model by retraining Kimi, a model from the Chinese company Moonshot AI. Airbnb, DoorDash, and the legal-services AI company Harvey use Chinese models as well. Many others likely do, too, in secret. The models are spreading even faster abroad, from Germany’s Siemens to Singapore’s national AI program to startups in Africa. The reason is simple economics: Chinese models are very cheap and very good.
Although most American AI companies do not release open-weight models, most Chinese companies do. So an American firm must pay Anthropic for each use of its unmodifiable models, but it can download Kimi for free, retrain it however it wants, and pay only for the electricity and chips to run it. Kimi also runs on a firm’s own servers, whereas Claude runs on Anthropic’s. Even if a company uses the most expensive DeepSeek model run on DeepSeek’s servers, it can produce the same amount of text as Anthropic’s top models at one-20th the cost.
In terms of capabilities, the research group Epoch AI judges Chinese models to be only about seven months behind American ones. For the price, they get the job done. And Chinese companies are now building agentic AI systems to compete with Anthropic’s Claude Code and OpenAI’s Codex. In October, DeepSeek released an open-source prototype of its “Super-Agent” system.
TRUTH IN LABELING
Although AI is a new technology, Chinese companies such as DeepSeek and Moonshot AI fit FARA’s text and history. The statute applies when a foreign principal is identified; in the case of Chinese AI models, it is the Chinese government and the CCP. The Justice Department would also have to show that the Chinese AI company acts “at the order, request, or under the direction or control” of the principal. Chinese AI companies would qualify because they must promote CCP viewpoints and cooperate with the state’s intelligence agencies. They also receive subsidies, and party organizations are embedded in each company. This is the difference between Chinese AI and other foreign AI. For example, France’s public investment bank has a stake in the French AI company Mistral, but no French law requires Mistral to build its models to serve the French government.
Beijing will surely respond that Washington, too, has tried to control American AI companies, such as through Trump’s July 2025 executive order against “woke AI.” But that order affects only what federal agencies can procure, and a company can opt out of being a federal contractor. Meanwhile, Chinese law forces Chinese AI companies to train their models to “support, assist, and cooperate with national intelligence efforts.”
Every message from DeepSeek, Kimi, or Qwen should carry a disclaimer.
For FARA to apply, the agent must engage in certain activities, such as attempting to influence Americans or publishing content. Chinese AI companies do both by distributing models that spread propaganda. The statute exempts purely commercial activity, but only if it is “private and nonpolitical” and does not directly promote a foreign government’s political interests. Chinese AI models engage in political speech on a government’s behalf, and the Justice Department has denied the exemption to agents of foreign governments.
After registration, the genius of the statute can kick in. Chinese AI companies must disclose extensive information to the U.S. government: their funding sources, their written contracts and oral agreements, and the influence activities they undertake. Those that fail to register or omit information face both civil and criminal penalties.
All content they disseminate must also bear a foreign-agent label: “a conspicuous statement,” in the statute’s words. The Justice Department sets the rules for what that looks like, and it has not updated them since 2003. In January 2025, the Justice Department proposed amendments to these rules to update them for the digital age. The proposed amendments would require a label on “each individual post” online, such as on social media platforms, but they do not address AI foreign agents. The final rule should require every message from DeepSeek, Kimi, or Qwen to carry the disclaimer: “This was generated by an agent of the Chinese government and Chinese Communist Party.”
The standard objection is that ordinary citizens do not read disclosures. That may be true of long medical forms or Securities and Exchange Commission filings, but this label would be short. And disclosure works because experts—investors, journalists, researchers—read filings and react. When researchers and lawmakers flagged gaps in China Daily’s FARA filings, the Chinese media company disclosed that it had paid millions of dollars to The Wall Street Journal and The Washington Post to publish its propaganda. Payments to the Journal ended that same month. Forcing Chinese AI companies to register under FARA would also shed light on how far Chinese AI is spreading so that Americans can decide, with real data, whether they want further action, such as a ban.
THE AMERICANS
American companies that use Chinese AI models can also become foreign agents if they fall under a foreign principal’s “direction or control” and engage in activities subject to FARA. This could happen in two ways: the company serves as a “CCP spokesperson,” or as a “CCP executive.”
In the first, an American company takes an unmodified Chinese AI model and lets Americans discuss political issues with it—say, via a video game character or a customer service chatbot. The model returns its usual propaganda, so the company has effectively hired a CCP spokesperson. Accordingly, it must label its outputs. Both the Justice Department and a federal court have found that rebroadcasting unmodified programming from the Russian state outlet Sputnik turns an American company into a foreign agent. Of course, American companies can avoid FARA obligations if they do not engage in any of the activities listed by the statute, such as discussing politics. A company whose public-facing Chinese AI model discusses only, say, hotel check-in times, not politics, would not be a CCP spokesperson.
In the second scenario, an American company outsources so much of its decision-making to an unmodified Chinese AI model that it has effectively hired a CCP executive. If a company hired a brilliant human strategist who always pushed Beijing’s interests, and the company followed that advice, FARA would apply. The same logic holds if an American company cedes control to the Chinese government by giving Beijing’s models high decision-making authority. Although it may sound fantastical, 64 percent of chief executives surveyed in IBM’s 2026 CEO Study say they already feel comfortable making major strategic decisions based on AI input; overall, CEOs expect AI to make 48 percent of routine operational decisions autonomously by 2030. An American company that wants to avoid becoming a CCP executive must be sure not to fall under the direction or control of such models. The Justice Department should update its 2020 guidance on what constitutes “direction or control,” spelling out how much decision-making a company can outsource to AI before it has effectively hired a “CCP executive.”
The United States and its allies should create an AI compact rooted in transparency.
American companies could attempt to train away the party bias in the Chinese AI models they adopt, but it is unclear whether that is even possible. Perplexity, an American AI company, trained DeepSeek to stop ignoring questions about the 1989 Tiananmen Square massacre and about human rights abuses in Xinjiang, but that does not fix the deeper problem of corrupt chains of thought. As these models get more capable, Chinese AI companies may also find cleverer ways to hide instructions. Or they could just stick them in the contract: some recent DeepSeek licenses prohibit modifying models to generate “inappropriate content” under Chinese law, making propaganda part of the deal. If research shows that companies can reliably remove the bias, the Justice Department and the Commerce Department should issue standards on how to train away FARA liability.
Although Pam Bondi, then the U.S. attorney general, limited criminal FARA charges in 2025 to “conduct similar to more traditional espionage by foreign government actors,” Attorney General Todd Blanche’s Justice Department says it is considering a new rule to “keep pace with technological change.” It should include AI foreign agents.
Of course, Washington should wield FARA’s expansive authorities with care. Frivolous prosecutions under the statute could stifle democracy. Other countries have used foreign-agent laws to shut down civil society. Since 2022, Russia has barred anyone it deems a foreign agent from holding office and organizing public events. Still, FARA is a far narrower statute, and it should stay that way. It reaches only those acting under the direction or control of a foreign principal, and it simply requires registration and labeling, leaving the speaker free to keep speaking. Chinese AI companies that are required by law to promote the CCP’s interests fit squarely within what Congress had in mind when it approved FARA in 1938.
A BETTER OFFER
FARA can help in the United States, but the problem is global. Chinese AI is spreading rapidly in Africa, Latin America, and the Middle East. That is no accident. In July, Chinese leader Xi Jinping unveiled the World AI Cooperation Organization, a Shanghai-based group of 29 countries meant to make AI “beneficial, safe, and fair,” along with a development initiative to export Chinese AI worldwide. The United States and its allies cannot allow CCP executives and spokespeople to run the world’s companies and governments.
Unfortunately, the American alternatives are not particularly attractive. The most capable U.S. models are far more expensive, are largely unmodifiable, and may contain their own biases. That is why the United States and its allies should create an AI compact rooted in transparency, with standards that make countries comfortable adopting allied models as their own. These should include freedom from state ideological mandates, disclosure of how the models were trained to be helpful and safe, and independent auditing.
Every member of such a compact should also adopt FARA’s wisdom by mandating labels on government-directed AI, and the United States should hold American AI companies to those transparency standards. The bloc should then release models that match China’s in price and quality (that is, around seven months behind the American frontier). Allied governments can help pay for computing power and electricity, assist in clearing regulatory hurdles, and make bulk purchase commitments to bring prices down. American companies may cut prices on their older models on their own to compete with Chinese models. If they do not, lower prices for those worse models should be the condition for the public support they receive, such as federal contracts and permission to lease federal land for data centers, just as a pharmaceutical company can charge high prices for only a set period before generic drugs arrive. The compact’s members should also use export loans and guarantees to steer developing countries toward allied AI.
By welcoming supposedly free technology from China, the United States and its allies have unwittingly invited countless foreign agents to their shores. The Foreign Agents Registration Act can strip away the disguise, and an allied AI compact can give the world a better offer.
Loading…
