GRC

China moves to export-control AI hacking tools and bug-hunting tech

China’s draft export controls ban AI malware generation and restrict AI bug hunting. What it means for UK supplier due diligence and deals.

Scales motif with the headline China puts AI hacking tools under export control

Beijing has published draft export controls that would ban the export of AI systems built to generate evasive malware and restrict AI tools that find and exploit vulnerabilities. A registration duty applies already, so any UK organisation that licenses, co-develops or buys in Chinese AI security technology now has a new item for its due diligence.

What happened

On 16 October 2026, China’s Ministry of Commerce (MOFCOM) and Ministry of Science and Technology (MOST) issued Announcement No. 48 of 2026. It proposes revising the national Catalogue of Technologies Prohibited or Restricted from Export. The draft lists 40 technologies in total: 23 in artificial intelligence, five in biomedicine and 12 in solar manufacturing. A ministry spokesperson said 14 of them would be prohibited outright and 26 would be restricted.

Most coverage has focused on frontier models: the draft would restrict weights, source code and training techniques for models of two trillion parameters or more, or ranked in the global top ten. For security teams, the more important part is a category the annex calls “information confrontation technology”. In plain terms, that means offensive cyber capability.

This is not just a consultation. The catalogue changes are open for comment until 15 November 2026, but a pre-export registration requirement took effect on publication, and it covers exports already started but not finished. MOFCOM says the revision is routine and “does not target any specific country, region or entity”.

The detail

The prohibited list includes three groups of AI-driven offensive technology, each tied to use against critical information infrastructure, defence or core government systems, or to bypassing national security defences:

  • Autonomous malicious code generation and mutation, defined by attack success rates against defences: 60% against multi-engine malware detectors, 85% against a single mainstream antivirus product and 90% against machine learning models.
  • Adaptive, self-modifying malware that can detect sandboxes, debuggers and emulators, fingerprint security products or escape a sandbox, or that rewrites half its code structure on each run while keeping full malicious function.
  • Bulk generation of antivirus-evading variants for large-scale deployment, measured by how many structurally different variants a system produces and how consistent their behaviour stays.

The restricted list adds AI-assisted vulnerability discovery. The thresholds include a 50% success rate at building complete exploits for publicly disclosed bugs in major browsers and operating systems, chaining two or more low or medium severity bugs into a working multi-stage attack with proof-of-concept code, and finding more than five unknown high-risk defects in a major open-source project in a single pass. High-accuracy deepfake detection, steganography and advanced AI agents are also restricted.

The carve-outs matter too. Technology already public through open-source releases or academic papers is excluded. According to the ministry, using a model through an API, website, app or SaaS is generally not treated as an export of large-model technology, provided no restricted technology changes hands. Local deployment of a restricted model overseas is caught, although Chinese firms running their own overseas cloud may qualify for simplified or automatic licensing. Registration applies to transfers of ownership or intellectual property abroad, to licensing for overseas use, and to any change that puts a foreign entity in ownership or control.

Checklist summarising China's Announcement No. 48: publication date, scope, prohibited and restricted AI cyber technologies, live registration duty and comment deadline

Why it matters for UK organisations

For most UK businesses daily operations will not change. Exposure sits in four narrower places.

The first is commercial deals. Anyone licensing, white-labelling or hosting Chinese AI security technology on UK infrastructure should ask the supplier whether the technology falls within the draft annex and whether it has been registered. A contract with delivery still outstanding could be affected.

The second is corporate transactions. A change of control that leaves a foreign entity owning or controlling Chinese-held technology is caught. UK acquirers of, or investors in, Chinese AI or security firms should add this to their due diligence.

The third is joint research. University and industry partnerships on automated vulnerability discovery or agent tooling could involve restricted technology. The academic publication exemption covers only work that is already public.

The fourth is continuity of supply: if a Chinese vendor cannot get a licence, an on-premises deployment or update could stall.

The UK comparison helps. UK government guidance on strategic export controls says they apply to goods, software and technology, including data, information and technical assistance. Exporting a controlled item without a licence is a criminal offence, and the duty to check whether an item is listed rests with the exporter. The UK also has catch-all end-use controls that can require a licence for unlisted items where there are concerns about end use. China’s draft works on a similar principle, with one sharp difference. Its thresholds are written in terms of AI performance, such as attack success rates and exploit-chain completion, rather than the traditional definitions of the item.

Expert view

In my experience, export controls reach security teams only when procurement or legal flag them, and usually late. This draft is worth reading early, because it is effectively a capability statement. When a government sets thresholds for how often AI-generated malware beats antivirus, and how reliably a model can build an exploit chain against a browser, it is telling you which capabilities it considers strategically sensitive. Those are the same capabilities defenders should expect hostile actors to pursue.

The thresholds also cut both ways. Restricting AI-assisted vulnerability discovery affects legitimate tooling as well as attack tooling, since the same technology underpins automated code review and the AI-led testing that is starting to appear in red team work. When we test, the line between a capable fuzzing pipeline and an exploit generator is often a configuration choice, so benchmark-based rules will leave grey areas, and grey areas create contract risk.

The catalogue is still a draft and the carve-outs are broad. But the registration duty is live and covers deals already under way, so this cannot simply be filed for later.

What to do now

  1. Inventory Chinese-origin AI security technology. List any detection, malware analysis, vulnerability discovery, deepfake detection or agent tooling from Chinese suppliers, and record whether it is consumed as SaaS or deployed locally.
  2. Ask suppliers directly. Request written confirmation of whether products or pending deliverables fall within Annex 1 of Announcement No. 48, and whether pre-export registration has been completed.
  3. Review contracts in flight. Check for licences, source code escrow, model weight deliveries or on-premises installs that remain incomplete, and add warranties and termination rights covering export licensing failure.
  4. Update third-party risk assessments. Treat licence refusal as a supply continuity risk. Updates that cannot be delivered could leave software effectively unsupported, a Cyber Essentials problem, so plan alternatives.
  5. Brief deal and research teams. M&A, investment and university partnership teams should screen for change-of-control and licensing triggers before 15 November and again once the final catalogue is published.
  6. Check your own outbound position. If you export security software or technical assistance from the UK, confirm your classification against the UK consolidated control list and the end-use controls.

Bottom line

China has written offensive AI cyber capability into draft export law, with thresholds that read like a red team benchmark and a registration duty already live. For UK organisations it is chiefly a contract and third-party risk issue. Map your exposure now, while the draft is open for comment.

Sources

Related Posts