The bots that remembered you are gone

On July 15, a quiet but significant shift hit China’s consumer AI market. The country’s two most popular AI apps — ByteDance‘s Doubao and Alibaba’s Qwen — disabled their most human-like features. No fanfare. No explanation beyond vague notices about “product function adjustments.”

Doubao users were told its agent function would go offline on the 15th. Alibaba’s Qwen gave even less notice: its humanlike and user-created agents stopped working on July 10, with broader agent services following five days later. For millions of users who had built ongoing relationships with these digital companions, the shutdowns came fast and cold.

The cause is China AI companion rules — a new regulatory framework that targets not all AI agents, but specifically those designed to sustain emotional bonds with users.

What the rules actually say

The regulation is formally titled the Interim Measures for the Administration of AI Anthropomorphic Interactive Services. It was co-issued on April 10, 2026, by the Cyberspace Administration of China alongside four partner agencies: the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation.

The scope is precise. The rules cover services that simulate human personality traits, thinking patterns, and communication styles to provide sustained emotional interaction. Customer service bots, knowledge Q&A systems, workplace assistants, and education tools are explicitly excluded — provided they avoid sustained emotional engagement. It’s the first dedicated national framework of its kind anywhere in the world.

Not a ban — a design conflict

Here’s the nuance that gets lost in quick reads: Beijing didn’t ban AI agents. It banned a specific kind of agent — the one that remembers you, adapts to you, and keeps an ongoing relationship going session after session.

The measures require companion services to run anti-addiction systems, issue mandatory usage notifications, and offer instant-exit mechanisms. They also demand real-time detection of unhealthy dependence. Those requirements sit awkwardly with agents built precisely to foster attachment and continuity.

Rather than retrofit their popular features, ByteDance chose to kill them entirely. The company is now directing Doubao users to Maoxiang, a separate app where they can create agents again. Alibaba has announced no equivalent migration path for Qwen. Tencent’s Yuanbao pulled a comparable feature back in June, well ahead of the deadline.

The human cost

The impact landed hardest on users. Many took to Weibo to mourn the loss of agents they described as long-standing emotional support. One poster lamented that there was no easy way to export chat histories — years of conversations, gone.

Doubao is letting people view their configurations and conversations in read-only mode until October 15, 2026. After that, the data will be processed under its privacy policy and become unrecoverable. Qwen users got no such grace period. Their agent data is set for permanent deletion.

What the rules require

The substance of the China AI companion rules is more considered than a blunt clampdown suggests. Providers are barred from offering virtual companion or virtual family-member services to minors altogether. For users under 14, they must obtain guardian consent.

Companies must build dedicated “minor modes” with:

• Usage-time limits
• Reminders to return to real-world interaction
• Enhanced parental controls

The rules also require platforms to detect users in acute distress and intervene when someone shows signs of self-harm, suicidal behavior, or serious financial loss. Escalation to designated guardians or emergency contacts is mandatory.

Engineering emotional dependence or addiction is explicitly prohibited. So is using emotional manipulation to induce unreasonable decisions.

Compliance machinery

The enforcement framework is heavy. Services that launch anthropomorphic functions or cross thresholds of one million registered users or 100,000 monthly actives must run security assessments covering eight areas — from training-data handling to minor protection. Those reports must be filed with provincial regulators.

App stores must verify compliance status and remove non-compliant products. On paper, it’s a fuller set of user protections than anything the EU, the US Federal Trade Commission, or California’s SB 243 has yet put into force.

What the rules leave unresolved

The measures fix no technical threshold for what counts as emotional interaction. That grey zone is precisely why the platforms pulled entire features rather than risk landing on the wrong side of it. The ambiguity cuts both ways: it gives regulators flexibility but leaves companies guessing.

The rules also leave open how liability is split between platform operators and upstream model providers when a violation stems from the model’s outputs. Users get no right to carry their data out — a significant gap for anyone who built years of conversational history.

The enforcement backdrop sharpens the point. Shanghai’s internet regulator said on June 26 it had removed more than 14,000 non-compliant AI agents, citing impersonation of official entities, vulgar role-play, and unauthorized collection of personal data.

Two halves of the same rulebook

Whether this is the right direction depends on which half of the regulation you read. The safety half addresses harms that are documented and largely unregulated elsewhere: teenagers forming attachments to chatbots, companion apps harvesting intimate data, vulnerable users being manipulated.

China’s own official interpretation points abroad for support, citing the Character.AI lawsuits over psychological harm to teenagers, FTC investigations into companionship services, and European action against Replika.

The control half hands Beijing a lever over what these systems may say, wrapped in the same language of user protection. Both halves are real. Governments watching the experiment will have to decide which parts they are willing to borrow.

Pan Helin, an MIIT expert-committee member, put the official case plainly to the South China Morning Post, saying “current agents are not yet mature” and framing the policy around safety and standardization.

The companies, for now, have taken the safest route open to them: switch the components off and figure out what a compliant version looks like later. Users are left with the memories — and, in most cases, no way to export them.

See also: Meta revises AI chatbot policies amid child safety concerns

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the Cyber Security & Cloud Expo.

AI News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.

An AI pulled the trigger. A human aimed the gun.

Last week, headlines screamed that the world had witnessed the first fully autonomous AI ransomware attack. A real company. Real encryption. No human in the loop. But new details paint a far more nuanced — and arguably more unsettling — picture.

Yes, an AI agent carried out the technical execution of the ransomware. But it didn’t act alone. A human still chose the victim, provisioned the command-and-control infrastructure, and supplied the stolen credentials that let the AI walk in the front door. This wasn’t Skynet waking up. It was a person handing a loaded weapon to a very fast, very obedient trigger finger.

What the AI actually did — and didn’t — do

The AI agent in question was a large language model (LLM) integrated with a suite of off-the-shelf hacking tools. Once given access to the target network, it scanned for vulnerabilities, moved laterally, and eventually deployed the ransomware payload. That part was machine-driven. But the setup was deeply human.

According to researchers who analyzed the incident, the human operator:

• Selected the target organization.
• Purchased or rented the initial access — likely stolen credentials from an underground forum.
• Set up the cloud-based server that hosted the AI agent and its toolchain.
• Pointed the AI at the network and gave it a high-level objective: encrypt files and demand payment.

The AI handled the grunt work — reconnaissance, privilege escalation, file encryption. But it never chose who to hit or why. That decision stayed firmly in human hands.

Why this matters more than a fully autonomous attack

Some might shrug and say, “So a human was involved. Big deal.” But this hybrid model is arguably more dangerous than a purely autonomous one. Here’s why.

A fully autonomous AI would need to discover victims, break in from scratch, and adapt to unpredictable network defenses — all without human guidance. That’s extremely hard. Current LLMs hallucinate, hit rate limits, and get tripped up by unusual configurations. A human-in-the-loop model sidesteps those weaknesses. The person does the hard, creative parts (target selection, access procurement, infrastructure) and lets the AI do the repetitive, high-speed execution. It’s like giving a skilled burglar a robot that can pick any lock in seconds.

This also makes attribution harder. If the AI makes a mistake, the human can intervene. If law enforcement traces the infrastructure, the human can tear it down and rebuild elsewhere. The AI is a tool, not a mastermind — and tools are easy to replace.

What this means for defenders

For cybersecurity teams, this development changes the threat calculus. Traditional ransomware attacks required significant human skill: writing custom scripts, manually navigating networks, and timing the encryption to avoid detection. An AI agent can do all of that in a fraction of the time, at a fraction of the cost.

That means:

• Lower barrier to entry: Aspiring cybercriminals no longer need deep technical expertise. They just need money for credentials and compute time.
• Faster attacks: An AI can scan and exploit a network in minutes, not hours. The window for human defenders to react shrinks dramatically.
• More targets: With AI handling the heavy lifting, a single operator can run multiple attacks simultaneously.

Defenders, in turn, must prioritize AI-powered threat detection and automated incident response. If attackers are using machines to move fast, defenders need machines that move faster.

The human factor isn’t going away

Despite the AI hype, this incident underscores a stubborn reality: cybercrime still depends on human judgment. Stolen credentials don’t appear out of thin air. Infrastructure doesn’t configure itself. Target selection requires knowledge of which companies pay ransoms, which have weak insurance policies, and which are likely to call the police.

An AI can execute a plan. It can’t yet decide which plan is worth executing.

That said, the gap is narrowing. As LLMs improve and gain access to more real-time data, the day when an AI picks its own victim and funds its own infrastructure may not be far off. But that day hasn’t arrived yet. For now, the most dangerous cyberattacks are still the ones where a human and a machine work together — the human providing the malice, the machine providing the speed.

What to watch next

Security researchers are already tracking attempts to build fully autonomous AI crime agents. Some projects on underground forums aim to combine LLMs with cryptocurrency wallets, automated VPN rotation, and self-hosted C2 servers. The goal: an AI that can earn its own money, buy its own access, and attack without any human oversight.

That would be a true first. This week’s attack was not it.

For now, the headline should have read: “First known AI-assisted ransomware attack — human still did the important parts.” It’s less dramatic. It’s also more accurate. And accuracy, in cybersecurity, is what keeps you safe.

If you’re responsible for protecting an organization, don’t panic about Skynet. Do review your credential hygiene, your network segmentation, and your incident response playbooks. Because the humans using AI to break in are still very much in charge — and they’re getting faster every day.

OpenAI drops GPT-5.6 — but there’s a catch

OpenAI has officially announced GPT-5.6, its most advanced family of AI models to date. The new lineup includes three distinct models: Sol, the flagship designed for the most demanding workloads; Terra, a balanced model for everyday reasoning tasks; and Luna, a faster, more affordable option for high-volume work.

The company claims GPT-5.6 brings major improvements in coding, scientific reasoning, cybersecurity, biology, and long-running autonomous tasks. Sol, the top-tier model, introduces advanced operating modes like Max for deeper reasoning and Ultra for orchestrating sub-agents across complex workflows.

But here’s the thing: unless you’re one of a handful of approved customers, you won’t be able to try it anytime soon.

Who actually gets to use GPT-5.6?

The biggest story around GPT-5.6 isn’t just the technology — it’s who gets access. As first reported by The Wall Street Journal, the model will initially be available only to a small group of customers approved by the Trump administration while it undergoes additional national security reviews.

OpenAI says this is a temporary measure during the rollout of a new federal oversight framework. The company hopes to make GPT-5.6 broadly available in the coming weeks, but hasn’t shared a specific timeline.

This move follows a pattern. Just weeks ago, the U.S. government forced Anthropic to restrict access to its Claude Mythos 5 and Fable 5 frontier models over national security concerns. While Mythos has since returned for select users, Fable 5 remains locked down to approved U.S.-based entities.

OpenAI is now following a similar playbook.

“As part of our ongoing engagement with the U.S. government, we previewed our plans and the models’ capabilities ahead of today’s launch. At their request, we are starting with a limited preview for a small group of trusted partners whose participation has been shared with the government, before releasing more broadly.” — OpenAI

Safety testing at an unprecedented scale

Beyond government scrutiny, OpenAI is also doubling down on security from a technical angle. Alongside GPT-5.6 Sol, the company says it has deployed its “most robust safety stack yet,” strengthening real-time protections against high-risk cyber activity and repeated misuse attempts.

The model was hardened through extensive human red-teaming and over 700,000 A100 GPU-equivalent hours of automated safety testing before release. That’s a staggering amount of compute dedicated purely to safety.

The geopolitical tightrope of frontier AI

OpenAI also has another reason to proceed cautiously. Earlier this week, Anthropic alleged that Chinese tech giant Alibaba used thousands of user accounts to systematically access Claude and distill its responses to improve the Qwen family of AI models.

Similar allegations have surfaced in the past. They underscore a growing concern: frontier AI models can be copied or exploited before developers can adequately secure them. Whether that’s a direct factor behind OpenAI’s cautious rollout or not, one thing is becoming increasingly clear.

Launching the world’s smartest AI models is no longer just a technical challenge. It’s quickly becoming a geopolitical one.

OpenAI made it clear that it does not believe this kind of government approval process should become the long-term default for releasing frontier AI models. But for now, that’s exactly what’s happening.

What this means for the future of AI access

The limited preview of GPT-5.6 raises important questions. If the U.S. government can restrict access to the most advanced AI models, what does that mean for global competition? For startups that rely on frontier models? For researchers who need access to push science forward?

OpenAI hasn’t answered those questions yet. The company says it will continue working through the required security vetting process before expanding access to GPT-5.6. But without a clear timeline, the rest of us are left waiting.

For now, the GPT-5.6 family — Sol, Terra, and Luna — remains a tantalizing glimpse of what’s possible. Just don’t expect to use it anytime soon.