This year a type of AI hardware has emerged, palm-sized, with one end connected to a computer and the other to a large model. It views the screen through an HDMI cable or screen capture, and then sends keyboard and mouse signals into the computer through a USB port, so that the computer treats it as an ordinary keyboard and mouse set. It is used most often on a certain messaging app: replying to messages on people's behalf and sending bulk advertisements on their behalf. A company making this type of hardware announced financing in March, and its press release stated "zero detection and zero bans at the application layer, naturally compatible with the messaging app"; by September, two other vendors doing RPA for the messaging app were promoting physical keyboard and mouse hardware in advertorials, highlighting "bypassing risk-control detection at the software layer."
On the other side, the security center of the messaging app issued a notice on January 29, classifying tools that "operate" the messaging app "by means such as simulated keystrokes and automated scripts" to achieve automatic replies and bulk friend additions as plug-ins, with one of the stated reasons being that such tools "may also be exploited by lawbreakers to carry out fraud and other illegal and non-compliant activities."
To date there has not been a single publicly reported criminal precedent concerning this type of hardware. But if you are building AI hardware, RPA or Agent products, or if your company is planning to buy a batch of boxes for private-domain operations, the criminal-law account can already be calculated now. Which usage is most likely to result in account bans, and which usage will be treated as a crime—the dividing line has already been drawn by several old cases.
What this box bypasses
First, why it has to be made as hardware.
Personal accounts on the messaging app do not have interfaces opened to third parties. In the past, to have a program operate on a person's behalf, one either had to modify the communication protocol or inject code into the client, and these two paths have long been key targets of platform enforcement. The remaining path is to simulate clicks with software on a computer, which is also difficult. According to the vendors' own statements, click signals generated by software carry system markers, the mouse moves in straight lines, and click intervals are fixed; once the messaging app's risk control identifies this, the consequences range from security reminders and forced logouts to direct restrictions on account functions.
External hardware opens up this path. Signals come in through the USB port and are identical to the signals emitted by the mouse in your hand; combined with random pauses and curved mouse trajectories, even the operating rhythm resembles that of a real person. A vendor's September review stated plainly: "the messaging app currently cannot identify automated behavior of hardware programs," and a single account's contact list of 3,386 friends was continuously collected 13,544 times without a single disconnection.
Where does the money come from? Hardware is only one-time revenue; the sustained money comes afterward. Some products charge per message, with one credit returning one message; others charge annually, with the annual fee including a monthly AI invocation quota. The box is the entry point; what really makes money is tokens.
So the core selling point of this business is only one: making the messaging app unable to tell whether a person or a machine is sitting in front of the screen. The legal trouble happens to arise precisely here as well.
The defense of "merely simulating clicks" did not hold six years ago
In March 2016, Zhu XX, the owner of a software company in Shenzhen, arranged for two employees to develop a marketing software. The software was installed on mobile phones; with one instruction from the backend, the messaging app on thousands of phones would like and comment and send bulk advertisements together. After the software was sold, some people used it to control more than 2,000 mobile phones, and some bought 5,000 phones in one go to promote novels and place advertisements in Moments, charging by click volume. Zhu XX himself earned 5.35 million yuan.
The operating company of the messaging app reported the case. On December 27, 2019, the Yongding District People's Court of Zhangjiajie City, Hunan Province, issued a first-instance judgment: the four people who made the software were convicted of the crime of providing programs and tools for illegally controlling computer information systems; the eleven people who used the software were convicted of the crime of illegally controlling computer information systems. All 15 people were found guilty, and all were sentenced to suspended sentences; Zhu XX received a fixed-term imprisonment of three years with a four-year suspension and a fine of 500,000 yuan.
An entrepreneur who bought 1,000 mobile phones appealed. The defense arguments recorded in the second-instance ruling read especially familiar today:
Zhao controlled 'mobile phones,' certainly not the 'WeChat system'... The function of the software at issue was 'simulating manual clicks,' and did not alter, interfere with, or add to any WeChat function... The source code of the software at issue operated only on the mobile phone system and did not modify the source code of the WeChat system; Zhao's control over mobile phones he himself owned was plainly lawful control, and certainly not 'illegal control.'
What was controlled was one's own device; the software merely simulated clicks and never touched WeChat's code. Replace 'mobile phones' with 'computers,' and this is almost exactly the entire defense of today's AI box manufacturers.
On March 5, 2020, the Zhangjiajie Intermediate People's Court dismissed the appeal and upheld the original judgment. The court first found that WeChat consists of server-side service programs installed on servers and client-side software installed on mobile phones, and is capable of automatically collecting, processing, storing, and transmitting data back, and therefore constitutes a computer information system protected by criminal law. Then came the key passage:
WeChat, as a cross-platform communication tool provided by the company to users, supports both one-on-one and multi-party participation, and is positioned for operation and use by natural persons. In this case, the software at issue... implemented automated operation functions that WeChat itself does not possess, thereby achieving the purpose of controlling WeChat in bulk, and infringed upon the functional operation and management programs of the WeChat system, constituting illegal control.
In plain terms: WeChat is designed for real people to tap, one tap at a time. Making it run in bulk and automatically, doing work it was never meant to do, is 'controlling' it—regardless of whose mobile phones you control.
This offense derives from Article 285, Paragraph 2 of the Criminal Law:
Whoever, in violation of state regulations, intrudes into a computer information system other than those specified in the preceding paragraph, or by other technical means obtains data stored, processed, or transmitted in that computer information system, or exercises illegal control over that computer information system, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also, or shall only, be fined; if the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years, and shall also be fined.
There are two other similar judgments. In 2017, the Haizhu District People's Court of Guangzhou sentenced the maker of a 'WeChat business marketing' plug-in that modified the WeChat iOS client to enable multiple instances and one-click forwarding to Moments; the principal offender received three years' imprisonment with a five-year suspension. The Guangzhou Intermediate People's Court later designated this case as a model judgment, and its reasoning specifically distinguished 'plug-ins' from 'add-ons': technically they are the same thing; legally, the question is whether the rights holder's permission was obtained. In 2020, the Pengjiang District People's Court of Jiangmen sentenced the maker of a group-chat management software that first circumvented WeChat's multiple-instance restriction and then 'achieved automatic group joining by simulating clicks on windows,' selling it to 1,098 users; the software maker likewise received three years' imprisonment with a five-year suspension.
Where hardware differs from plug-ins
At this point, fairness requires a word on behalf of hardware makers.
In all three cases above, the tools had modified WeChat itself. The software in the Zhangjiajie case relied on a plug-in framework to 'invoke specific methods in the WeChat script files of that version'; the Haizhu case injected a dynamic library into the client; and the Jiangmen case disabled WeChat's process lock that prevents multiple instances. Behind the courts' finding of 'control' in each case lay the fact of a modified client.
External hardware is different. It does not inject code into the client, nor does it touch the communication protocol; from the computer's perspective, it is no different from the keyboard and mouse on your desk. The technology of USB keyboard and mouse emulation is itself widely used, including in accessibility assistance and software testing, and is a standard neutral tool.
When does a neutral tool become a criminal tool? Article 285, paragraph 3 of the Criminal Law governs those who provide tools:
Whoever provides programs or tools specially used for intruding into or illegally controlling computer information systems, or knowingly provides programs or tools to others who are committing the illegal or criminal act of intruding into or illegally controlling computer information systems, where the circumstances are serious, shall be punished in accordance with the provisions of the preceding paragraph.
What does "specially used for" mean? Article 2 of the Judicial Interpretation of the Supreme People's Court and the Supreme People's Procuratorate lists three circumstances:
Article 2 Programs or tools falling under any of the following circumstances shall be determined to be "programs or tools specially used for intruding into or illegally controlling computer information systems" as provided in Article 285, paragraph 3 of the Criminal Law: (1) those having the function of circumventing or breaking through the security protection measures of a computer information system and obtaining data from the computer information system without authorization or beyond authorization; (2) those having the function of circumventing or breaking through the security protection measures of a computer information system and exercising control over the computer information system without authorization or beyond authorization; (3) other programs or tools specially designed for intruding into or illegally controlling computer information systems or illegally obtaining data from computer information systems.
A reference case included in the Case Database of the Supreme People's Court explains this provision more thoroughly. Ding resold software that scraped user data from a short-video platform and was sentenced to one year and six months' imprisonment with a two-year suspension. In its reasoning, the court stated:
In determining "programs or tools specially used for intruding into or illegally controlling computer information systems," there are two key points: first, the program itself has the function of circumventing or breaking through the security protection measures of a computer information system; second, the data acquisition and control functions of the program or tool are designed to be realized without authorization or beyond authorization, which is the typical feature distinguishing such programs or tools from "neutral programs or tools."
Applied to an AI box, the question comes down to two points: Does it circumvent the security protection measures of a certain messaging app? Is it designed to remain usable even without that app's consent?
By analogy, a kitchen knife is neutral, but if the handle is engraved with "specially for opening the door locks of a certain residential compound" and it is sold specifically to people who want to enter that compound, it is hard to say it is merely a kitchen knife. Of course, ultimately what the tool can actually do and what it has been used to do must also be considered; advertising language is not the only evidence, but it will be very weighty evidence.
Software plug-ins and AI keyboard-and-mouse boxes: two paths that bypass the same risk-control defense line
"Zero detection" may itself be evidence
First, the first question: Do the risk controls of a certain messaging app count as "security protection measures"?
A similar question was addressed in a museum ticket-scalping case in Beijing. The defendant, Liu, appealed repeatedly, arguing that the slider verification merely distinguished humans from machines and did not amount to a security measure; that argument was not accepted. The Beijing No. 2 Intermediate People's Court stated clearly in its appellate ruling long ago:
Image slider verification, along with similar jigsaw verification, click-the-text-in-the-image verification, and CAPTCHAs, are common system security protection measures whose main purpose is to distinguish real human users from automated programs or bots, so as to prevent malicious automated attacks, including brute-force attacks, spam registrations, crawler abuse, and ticket scalping by touts, thereby protecting system resources. When a user uses a reservation system platform, the scope of authorization is to conduct manual operations through the official web or App client...
This passage was used last week when discussing the appointment-number case; this time it should be read from a different angle. The mechanism that distinguishes humans from machines is a security protection measure; the permission a user obtains is to operate manually using the official client. The risk-control system that identifies scripts and triggers security verification does exactly this work of distinguishing humans from machines, and the entire value of the AI box lies in rendering that distinction ineffective. What it bypasses is not a single CAPTCHA but the entire identification mechanism. This points to the same conclusion as the statement in the Zhangjiajie case that the device is "positioned for operation and use by natural persons."
The boundaries must also be made clear. The slider is an overt checkpoint, while risk control is continuous background identification; the two take different forms, and no court has yet specifically ruled on whether "bypassing risk-control identification counts as circumventing security protection measures." This is the most important space for the defense in the future.
Turning to the second question, the design purpose, the manufacturers have already answered it on the court's behalf. "Zero detection and zero bans at the application layer," "at the software level it is impossible to distinguish whether the operation is by a real person or by a hardware device, bypassing software-level risk-control detection," and the closing sentence of that evaluation report: "In the future, identification may be directed at hardware. When that time truly comes, we will develop entirely new hardware with stronger risk-control evasion."
In financing pitches and advertorials, these words are selling points; in a case file, they are material proving that "this tool exists precisely to keep operating even when the platform does not consent." The line drawn in the Ding case is often crossed, pushing otherwise neutral hardware over it, by these very lines the parties wrote themselves.
Personal use of one unit and bulk sales are risks of an entirely different order
The same box, in different hands, produces vastly different consequences.
When one person buys one unit, plugs it into their own computer, and uses it to help themselves reply to messages and accept friend requests, the most realistic consequence is having functions restricted or the account banned by WeChat. To constitute a crime, the circumstances must be "serious," and this kind of use can hardly meet that threshold.
Bulk deployment by a company is another matter. The threshold set by Article 1 of the judicial interpretation is as follows:
Article 1: Whoever illegally obtains computer information system data or illegally controls a computer information system, under any of the following circumstances, shall be deemed to have "serious circumstances" as provided in paragraph 2 of Article 285 of the Criminal Law: (1) obtaining identity authentication information for online financial services such as payment and settlement, securities trading, and futures trading in ten or more sets; (2) obtaining identity authentication information other than that specified in item (1) in five hundred or more sets; (3) illegally controlling twenty or more computer information systems; (4) illegal gains of five thousand yuan or more, or causing economic losses of ten thousand yuan or more; or (5) other circumstances of a serious nature.
Whoever commits the acts specified in the preceding paragraph, under any of the following circumstances, shall be deemed to have "especially serious circumstances" as provided in paragraph 2 of Article 285 of the Criminal Law: (1) the quantity or amount reaches five times or more the standards specified in items (1) to (4) of the preceding paragraph; or (2) other circumstances of an especially serious nature.
illegal control20 devicesEven if the circumstances are serious,100 devicesthat constitutes especially serious circumstances, and the statutory penalty rises to not less than three years but not more than seven years. In the Zhangjiajie case, the owner who bought 1,000 mobile phones—the court did not even determine how much money she made, and found especially serious circumstances based solely on the number of devices. In hardware scenarios, how to count "one device"—whether by computer or by a certain messaging account—there is currently no judicial precedent; but when dozens or hundreds of boxes are used to maintain accounts and add contacts in bulk, the count will not be low under any method.
For manufacturers selling boxes, the corresponding provision is Article 285, Paragraph 3. Article 3 of the judicial interpretation sets the threshold at providing services to 20 person-times or illegal gains of 5,000 yuan, with five times that amount constituting especially serious circumstances:
Article 3: Providing programs or tools for intruding into or illegally controlling computer information systems, where any of the following circumstances exists, shall be determined as "serious circumstances" as provided in Article 285, Paragraph 3 of the Criminal Law: (1) providing specialized programs or tools capable of being used to illegally obtain identity authentication information for online financial services such as payment settlement, securities trading, and futures trading, to five or more person-times; (2) providing specialized programs or tools other than those in item (1) that are specially used for intruding into or illegally controlling computer information systems, to twenty or more person-times; (3) knowingly providing programs or tools to others who are committing illegal or criminal acts of illegally obtaining identity authentication information for online financial services such as payment settlement, securities trading, and futures trading, to five or more person-times; (4) knowingly providing programs or tools to others who are committing illegal or criminal acts of intruding into or illegally controlling computer information systems other than those in item (3), to twenty or more person-times; (5) illegal gains of 5,000 yuan or more, or causing economic losses of 10,000 yuan or more; (6) other circumstances of serious circumstances.
Where the acts provided in the preceding paragraph are committed and any of the following circumstances exists, they shall be determined as "especially serious circumstances" for providing programs or tools for intruding into or illegally controlling computer information systems: (1) the quantity or amount reaches five times or more the standards provided in items (1) to (5) of the preceding paragraph; (2) other circumstances of especially serious circumstances.
As long as a piece of hardware is determined to be "specially used for" the purpose, selling it to 20 customers reaches the threshold. In the Jiangmen case, that software was sold to 1,098 users, and the court determined especially serious circumstances based on "100 or more person-times."
Going one level further down. If you know the buyer is using it for fraud or gambling traffic diversion and you continue to supply it, you may constitute the crime of assisting information network criminal activities, commonly known as the crime of aiding and abetting information network crimes; if you participate deeply, you will be directly treated as an accomplice to fraud or running a casino:
Whoever knowingly provides technical support such as internet access, server hosting, network storage, and communication transmission, or provides assistance such as advertising promotion and payment settlement, for others' commission of crimes by using information networks, where the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also or only be fined.
In the Jiangmen case, someone bought that group chat software to promote a "red packet minesweeper" gambling platform. The sentence in a certain messaging app's announcement that it "may be used by lawbreakers to commit fraud" also refers to this chain.
Beyond criminal liability, there is also the civil side. In an unfair competition case involving an AI agent, the Guangzhou Internet Court issued a conduct preservation ruling against an AI conversational robot capable of clicking and sending on behalf of a real person, ordering the developer to stop offering it for download, stop circumventing the conversation platform's risk control measures, and delete online circumvention tutorials. In this case, the court clarified the dual authorization principle of "platform authorization plus user authorization." A platform seeking to hold parties accountable does not necessarily have to wait for a criminal case to be filed.
Four tiers of risk for the same box: personal use, batch deployment, external sales, and knowing the buyer intends to commit fraud
To do this business, adjust four things first
Having AI operate a computer on a person's behalf is not inherently problematic. The problem is whether the work the box does for people is work that a certain messaging app does not permit and that is deliberately done while evading that app's detection. Working backward from the judgments above, I suggest that teams building hardware and RPA first adjust four things:
- Messaging: In fundraising materials, official websites, advertorials, and customer service scripts, delete phrases such as "zero detection," "ban-proof," "circumvent risk control," and "hardware biomimicry," and do not use simulated human trajectories and random delays as selling points
- Product features: One device binds to one user's own account; no multi-instance operation, group control, batch friend adding, or batch contact list collection
- Manual confirmation: For actions such as sending messages and adding friends, leave the final press to the user
- Customer screening: For orders purchasing hundreds of devices at once or opening with the question "is it ban-proof," keep records and decline; where a scenario can use a certain messaging app's official open capabilities, prioritize the official channel
The first two determine whether your product will be found to be a tool "specifically used for" such purposes; the latter two determine whether, if something happens, you can clearly establish that you "did not know."
My judgment is that this type of hardware will sooner or later produce its first criminal case, most likely starting with a studio that farms accounts in bulk, or with a batch of goods bought by a fraud gang. By then, every word the manufacturer wrote in its fundraising materials will be read again.
If you are building this type of AI hardware or Agent product and want to review your product features and messaging against these judgments, you are welcome to talk with me.
Reference sources
- Certain Information Security Center Notice on the Governance of Violations, January 29, 2026 (reprinted by The Paper · The Paper Account)
- Financing press release of a certain AI hardware company, NetEase Account, March 12, 2026
- Product review of a certain RPA vendor, September 16, 2026
- Advertorial for a certain RPA vendor's product, Sohu Account, September 21, 2026
- Criminal Law of the People's Republic of China (2023 Amendment), National People's Congress
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Endangering the Security of Computer Information Systems (Fa Shi [2011] No. 19)
- Criminal Judgment of the Yongding District People's Court of Zhangjiajie City, Hunan Province, (2019) Xiang 0802 Xing Chu No. 402
- Criminal Ruling of the Intermediate People's Court of Zhangjiajie City, Hunan Province, (2020) Xiang 08 Xing Zhong No. 30
- Criminal Judgment of the Haizhu District People's Court of Guangzhou City, (2016) Yue 0105 Xing Chu No. 1040 (Reference Case of Model Judgments of the Intermediate People's Court of Guangzhou City)
- Criminal Judgment of the Pengjiang District People's Court of Jiangmen City, Guangdong Province, (2020) Yue 0703 Xing Chu No. 597
- Reference Case of the People's Courts Case Database: Case of Ding Providing Programs for Intrusion into Computer Information Systems, original trial by the Liangxi District People's Court of Wuxi City, Jiangsu Province, (2022) Su 0213 Xing Chu No. 223
- Criminal Ruling of the Second Intermediate People's Court of Beijing Municipality, (2025) Jing 02 Xing Zhong No. 260
- Guangzhou Internet Court Ruling on Conduct Preservation in an Unfair Competition Dispute Involving AI Agents (Public Report)
Author:Lü Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. A graduate of China University of Political Science and Law, with nearly a decade of experience in the legal industry, including prior work at a court in Shenzhen. Focused on legal services in emerging economic sectors, with extensive practical experience and deep insight in fields such as Web3 and artificial intelligence. All-platform account: Lao Lü Talks New Money; you are welcome to follow.
