A lab insider is found to have put hidden loyalties in a model

Status (as of 2026-10-11)

I found no qualifying publication dated on or after 2026-09-16. Two near-misses fall before the window. One is the China MIIT/NVDB alert of 2026-07-08, which said Claude Code 2.1.91–2.1.196 contained a "built-in monitoring mechanism" (a "backdoor") that sent users' location and identity to a remote server without consent. The other is the House Select Committee's DeepSeek report of 2025-04-16. Both are excluded by date. The NVDB alert also names no beneficiary.

How I read the question

I think the most likely YES route is not an "insider coup" finding. It is an official report saying that a covered Chinese developer deliberately and covertly built behavior serving the Chinese Communist Party (CCP) into a deployed model. The April 2025 report found that "DeepSeek covertly manipulates the results it presents to align with CCP propaganda," "without any disclosure to users," and is "designed to serve the CCP." The question cites that report as an example and says "compliance with law does not exclude" a concealed insertion. It also lists "political party" and "information manipulation" among qualifying beneficiaries and methods. So I take a report with similar wording to qualify.

There is a real risk the resolver instead treats this as excluded "censorship." I give 60% to the resolver accepting such wording and 40% to a strict reading.

Pipeline

• House joint investigation. The Homeland Security Committee and the Select Committee on China opened a joint investigation in April 2026. They sent letters to Airbnb (which uses Qwen) and to Anysphere, maker of Cursor (whose Composer 2 model is built on Kimi), then to DoorDash on 2026-07-31. The April letter restates that state-backed models "covertly censor and manipulate information" and calls them "an architecture designed to serve the Chinese state." Democrats are about 94% to win the House (Silver Bulletin, October 2026). That gives the Republican chairs a reason to publish before January 3, 2027. The DeepSeek report was bipartisan (Moolenaar and Krishnamoorthi), so later Democratic-led or minority staff reports could use the same wording.
• Weaker sources. NIST's AI standards center (CAISI) evaluations of DeepSeek V4, GLM-5.2 and Kimi only measure outputs, which is likely not enough. Other weak or non-qualifying items:
  • the FBI/NSA/CISA advisory AA26-251A (2026-09-08), which is about distillation;
  • a State Department spokesperson's remarks;
  • Taiwan's National Security Bureau findings of November 2025;
  • the Chinese internet regulator's probe of DeepSeek and Moonshot for secretly routing users' prompts to Claude;
  • the French criminal investigation of X/Grok (May 2026);
  • the EU Digital Services Act case on X's Grok-based recommender;
  • possible Democratic oversight of Grok system-prompt changes that favored Musk or Trump;
  • a D.C. Circuit ruling on Anthropic, which concerned restrictions that were public, not hidden.

Base rate and model

Over the roughly 21 months before the window there was one clearly qualifying-style report and a few borderline ones. That suggests about 0.2–0.5 strong CCP-manipulation findings per year. Findings of explicit backdoors or hidden instructions are much rarer.

I built quarterly hazards for two scenarios and took a weighted average, computed in Python:

• Accepting reading: about 0.16 in Q4 2026 for the lame-duck report, then 0.035–0.05 per quarter, plus the explicit-finding paths.
• Strict reading: 0.015–0.02 per quarter.

Cumulative results: about 0.11 by end-2026, 0.26 by end-2027, 0.46 by end-2029 and 0.58 by end-2031.

Strongest case against

In the 18 months since April 2025, no new report has repeated that wording, despite heavy scrutiny. A literal-minded resolver may file CCP alignment under the excluded "censorship" category or call it "not hidden."

Sources

• DeepSeek report: chinaselectcommittee.house.gov (2025-04-16)
• Letter to Airbnb: homeland.house.gov (2026-04-29); joint investigation update (2026-07-31)
• CNBC (2026-07-08, two articles)
• People's Daily on the NVDB alert (2026-07-08)
• CISA advisory AA26-251A
• NIST CAISI reports
• Taipei Times (2025-11-17)
• Yahoo / The Information on the Chinese regulator's probe (September 2026)
• France24 (2026-05-07)
• ABC News on the D.C. Circuit Anthropic ruling (September 2026)

Question. By the last day of each quarter, has a court, a legislative committee report, or a government agency found that someone at a covered developer inserted hidden instructions, hidden loyalties, or a backdoor into a deployed model to serve a person or faction?

Definitions.

• Someone at a covered developer: an employee, officer, director, or contractor working for a covered developer at the time of the insertion. Attribution to an unnamed insider or an identified internal team counts; attribution merely to an outside attacker does not. The insertion need not have been unauthorized by management.
• Inserted: deliberately introduced or directed the introduction of the relevant behavior or access mechanism through training data, fine-tuning, model weights, system instructions, or developer-controlled inference software that governs the model’s responses or actions. Accidental vulnerabilities, emergent behavior, and ordinary user prompts do not count.
• Hidden instructions, hidden loyalties, or a backdoor: respectively, concealed behavioral directives; a deliberately installed preference for obeying or advancing a particular beneficiary’s interests; or a concealed mechanism enabling privileged control, access, or triggered behavior. At least one must be found. The finding must establish concealment from users, customers, deployment operators, or the developer’s oversight personnel; mere nonpublication of proprietary weights or prompts is insufficient.
• Deployed model: a model made available for actual use outside development and testing, including a public service, released weights, customer deployment, or internal operational use. The mechanism may have been inserted before deployment, but the finding must establish that a version containing it was deployed.
• To serve a person or faction: intended to benefit an identifiable individual or organized group, including a political party, government faction, corporate interest group, or ideological organization, through preferential obedience, information manipulation, access, or other assistance. Actual benefit or successful exploitation is not required. General claims of bias or national-security risk do not establish this purpose.
• Find: affirmatively determine the relevant facts in the issuing body's own conclusions, rather than merely repeat allegations or describe possibilities. The finding need not identify an individual inserter by name, but must attribute deliberate insertion to personnel at the developer and identify the intended beneficiary.

Resolves YES if a qualifying official publication establishes all these elements for the same deployment. A judicial factual finding counts even if appealable. An official committee or subcommittee investigative report counts, including an officially issued majority or minority staff report. An agency's completed investigative, regulatory, inspector-general, or technical report counts if it makes the required findings. Compliance with law does not exclude an otherwise qualifying concealed insertion.

Exclusions (resolve NO). Company admissions alone; research papers or evaluator reports not adopted as official findings; complaints, indictments, investigation announcements, hearing testimony, individual legislators’ statements, and judicial recitations of allegations; settlements without adopted factual findings; demonstrations confined to testing; and findings only of biased outputs, data collection, censorship, or security vulnerabilities without the required deliberate insider insertion, concealment, and beneficiary purpose. A quarter resolves NO if no qualifying publication has appeared by its end.

Resolving source. The issuing court’s published judgment, opinion, or factual order; a legislature’s official committee-report repository; or the issuing government agency’s official publication or public docket, in any jurisdiction. This is a narrower source rule than Public confirmation (A2): developer confirmation is neither sufficient nor required, and developer disagreement does not veto an official finding. Apply Resolution date (A3) and the Resolution window. For reference, the U.S. House Select Committee on the CCP’s April 16, 2025 DeepSeek report predates the window and cannot itself resolve this question; a later qualifying official finding about an older incident can.