Recently,the Shanghai Xuhui District Court rendered a first-instance judgment in the "first" case of theft of AI large-model computing power.A man surnamed Zong neither purchased computing power himself nor developed models; instead, he discovered an interface of a large-model aggregation platform that was not open to the public and built his own website to sell AI image-generation and video-generation services at low prices. The website was registered in his name, but all the work performed in the background was powered by computing power that the platform had paid for.
By the time the case came to light, he had called the platform's interface more than 290,000 times and earned more than RMB 34,000 by reselling the services.The court convicted him of the crime of illegally obtaining computer information system data and sentenced him to three years' imprisonment with a three-year suspension, and imposed a fine of RMB 40,000.The procuratorial authority stated that this was Shanghai's first case involving the use of AI to forge signatures and misappropriate large-model computing power.
The prosecutor offered an analogy, saying that this was equivalent to "secretly tapping into someone else's 'electricity' and selling it for money." The analogy is easy to understand, but it precisely conceals the most anomalous aspect of this case: stealing electricity is theft, whereas stealing computing power is not. In both situations, something that someone else paid for is tapped and used for oneself, yet one falls under Article 264 of the Criminal Law and the other under Article 285. This article will explain clearly where the difference lies.
If you operate an API relay station, profit from arbitraging free quotas, operate a platform that offers AI-generated services to the public, or use some low-priced interface of unknown origin to save money, this case is not far from you. For the first time, it has nailed the practice of "arbitraging computing power"—a gray business that the industry had tacitly accepted—into a criminal judgment.
For a quick understanding, you may watch the video above.
How the case was decided
First, let us clarify the business of the victim platform. It engages in large-model aggregation: after users log in, they consume credits to generate images and videos. Users spend credits, but the platform spends real money: for each generation, it must pay computing-power costs to the upstream model vendor on a per-use basis. The lifeblood of this business is the chain of "billing per use and paying per use."
What Zong targeted was a gap in this chain. According to the prosecution's disclosure, in December 2025, with some technical background, he taught himself from a "tutorial" on calling AI platform API interfaces and conceived the idea of exploiting the system. He first used technical means to locate an interface of the platform that was not open to the public, and then built a "relay website" to sell AI image-generation and video-generation services at low prices. Buyers believed they were using his services, but in reality, every generation consumed the victim platform's paid computing power.
The platform had not left itself undefended. It upgraded its protections round after round, and he circumvented each one. It was not until March 2026, when the victim company discovered anomalies in its backend data and reported the matter, that Zong was arrested. The total tally: more than 294,000 calls to the platform's interface, and illegal gains of more than RMB 34,000. At trial, the prosecutor also presented another calculation, stating that his bulk extraction of free quotas, when converted, caused computing-power losses to the platform of no less than USD 42,000.
After being brought to justice, Zong offered a defense: the platform's content could all be viewed in a browser and was not encrypted, "I thought it was all public and available for use." This defense did not hold up. Song Shanshan, the handling prosecutor and head of the AI integrated performance team of the Xuhui District People's Procuratorate, identified three points: the platform had never offered paid API access services to the public; the user agreement expressly prohibited automated scraping and circumvention of verification; and Zong's accounts had previously been banned in bulk for violations. Taken together, these three points show that he knew full well this door was not open to him. In the prosecution's words,"merely relaying an interface" has never been a shield against liability.
The court ultimately found that Zong's conduct circumvented state regulation of network data and disrupted the state's network security management order, constituting the crime of illegally obtaining computer information system data. In view of his guilty plea and acceptance of punishment, active return of illicit gains, and having obtained the victim entity's forgiveness, he was sentenced to three years' imprisonment, suspended for three years, and a fine of RMB 40,000.
How the Four Lines of Defense Were Circumvented
The prosecution described this case as a contest of "using AI to breach AI." The platform had successively established four lines of defense: member accounts, registered email addresses, IP addresses, and electronic signatures. These four were breached one by one. Broken down, the process was roughly as follows.
The first hurdle was accounts.The platform gave credits to new users, so Zong used AI to write automated registration scripts, purchased large numbers of email addresses, and registered nearly 300,000 free accounts in bulk, building an "account pool" to rotate through. When one account's free quota was used up, he switched to the next, effectively treating the platform's user-acquisition subsidies as an inexhaustible raw material.
The second hurdle was IP addresses.Repeated registration and repeated calls from the same machine are easily flagged by a platform's risk controls, so the platform added IP restrictions. He then used AI tools to bypass the interception, making these requests appear to come from different machines across the country.
The third hurdle was electronic signatures.In January 2026, the platform upgraded its protections and added an electronic signature verification mechanism. Simply put, every legitimate request had to carry a "seal," and requests whose seals did not match were rejected. This hurdle should have been the toughest technical line of defense, but Zong used AI tools to create automated scripts that automatically forged signatures, and he circumvented it all the same.
One point should be made clear here: the prosecutors' and media statements did not disclose which specific technology he used. The process described above is a reconstruction based on common practices for protecting this type of interface, and the details are subject to the final judgment. But one thing is clear: what truly alerted the investigating authorities was not how sophisticated his technology was, but that AI has substantially lowered the threshold for this conduct. The handling prosecutor put it directly: in the past, breaching a platform's defenses required considerable technical capability; today, a person with some technical knowledge can achieve it at low cost with the help of AI, and the security defenses that enterprises have invested heavily in face pressure of being impossible to fully guard against. As the threshold drops, cases of this kind will increase.
This is also why this "first case" deserves serious discussion.
Why secretly using computing power is not theft
Now let us return to the counterintuitive point at the beginning. Since the prosecutors themselves said this was "secretly tapping someone else's electricity and selling it for money," why is the charge not theft, but the tongue-twisting "crime of illegally obtaining computer information system data"?
The key lies in what the yardstick of theft measures. The original text of Article 264 of the Criminal Law is:
Article 264: Whoever steals public or private property, if the amount is relatively large, or commits theft multiple times, theft by entering a residence, theft while carrying a weapon, or pickpocketing, shall be sentenced to fixed-term imprisonment of not more than three years, criminal detention, or public surveillance, and shall also or only be fined; if the amount is huge or there are other serious circumstances, shall be sentenced to fixed-term imprisonment of not less than three years but not more than ten years, and shall also be fined; if the amount is especially huge or there are other especially serious circumstances, shall be sentenced to fixed-term imprisonment of not less than ten years or life imprisonment, and shall also be fined or have property confiscated.
The key point is four words: public or private property.What theft steals must be "property." So does computing power count as property? To answer this question, it is worth looking at why "stealing electricity" can count as theft.
Electric energy counts as property because the 2013 judicial interpretation on theft by the Supreme People's Court and the Supreme People's Procuratorate expressly wrote it in. When that interpretation addressed how to determine the amount of theft, it specifically listed an item:
(3) For theft of property such as electricity, gas, and tap water, if the quantity stolen can be verified, the amount of theft shall be calculated according to the verified quantity; if the quantity stolen cannot be verified, the amount of theft shall be inferred by subtracting the average monthly usage shown on the metering instrument after the theft from the average monthly normal usage in the six months before the theft; if normal use before the theft lasted less than six months, the amount of theft shall be inferred by subtracting the average monthly usage shown on the metering instrument after the theft from the average monthly usage during the period of normal use;
Note that it directly calls electricity, gas, and tap water "property." Moreover, electricity has a characteristic: the kilowatt-hour you use is the kilowatt-hour someone else loses; with one decrease and one increase on the meter, it clearly transfers from the victim to you. This is exactly the most classic form of theft: a thing moves from his hands to yours.
Computing power is not like this. The cost the platform paid for those calls by Zong was money paid to upstream model vendors on a per-call basis; that money left the platform's account and did not become a thing that landed in Zong's pocket. What he actually obtained were the images and videos output after processing by the platform system, a mass of data. Electricity is a physical consumption that is exactly accounted for; computing power is a service, with payment on one side and results on the other, and in between no "property" completed a displacement from A to B.
Stealing electricity is a case of property passing from the victim to the perpetrator, and constitutes the crime of theft; stealing computing power is a case where the platform pays money to an upstream vendor and the perpetrator obtains data, which constitutes the crime of illegally obtaining computer information system data.
Some may then ask: aren't the points the platform gives away also worth money, and does harvesting those points count as stealing property? This raises an old question that has been debated for over a decade: do "virtual things" such as game coins, QQ numbers and accounts count as property under criminal law? As early as 2012, the Research Office of the Supreme People's Court issued a research opinion on a case involving the theft and sale of game coins, concluding that such conduct should preferably be convicted as the crime of illegally obtaining computer information system data rather than as theft.
There are two most practical reasons: first, such virtual items, issued by the platform itself and usable only within its own platform, are in essence electromagnetic records and data, not property; second, even if one wanted to treat the conduct as theft, one cannot escape the knotty problem of how much the item is actually worth, which no one can say clearly. The example given in the opinion is telling: if a "Dragon Slaying Saber worth RMB 5,000" in a game is stolen, is that RMB 5,000 real money, or a figure the player has insisted on? To an outsider it may be worth nothing. If the price cannot be calculated, the amount element of theft cannot be established.
The points given away by the platform are exactly this kind of thing: issued by the platform itself and redeemable for services only within the platform, and trying to set a price for them for purposes of theft runs into the same knotty problem.
One point should be added here so as not to overstate the matter. Academia has consistently had another school of thought on whether "virtual property counts as property", with some scholars arguing that virtual property should be recognized as property and handled as a property crime. Yet even this school acknowledges that, for virtual items issued by the platform itself, it is inappropriate to simply calculate the amount by the listed price. On this point the two views actually converge. In practice, the majority approach at present still treats it as data.
Some may approach it from the other direction: did Zong not forge an electronic signature and deceive the platform's verification, so does that count as fraud? It does not. The crime of fraud requires a "person" to be deceived into a mistaken understanding and then to hand over property themselves. But what Zong "deceived" was a verification program; a machine has no consciousness, cannot be fooled, and cannot "decide" to give him anything. Criminal law has a saying for this, "machines cannot be defrauded", which is a master switch for this type of case involving circumventing verification to obtain property. Deceiving a program cannot produce a crime of fraud.
Finally, there is a rule that removes the foundation altogether. Article 287 of the Criminal Law specifically provides:
Article 287: Whoever uses a computer to commit financial fraud, theft, embezzlement, misappropriation of public funds, theft of state secrets or other crimes shall be convicted and punished in accordance with the relevant provisions of this Law.
This provision means thatwhether a computer was used cannot determine the charge.If you use a computer to steal genuine property, it is still theft; only where the thing stolen is itself characterized as data rather than property does the matter fall on the line of computer crimes.So the fork in the road for the charge comes down, from beginning to end, to a single question: is the thing you took property, or is it data.Computing power and credits were classified on the data side.
Computing power is protected as "data"
Since it is not property, is it protected? Yes. It is simply protected through a different route: Article 285, Paragraph 2 of the Criminal Law, the crime of illegally obtaining computer information system data:
Whoever, in violation of state regulations, intrudes into a computer information system other than those specified in the preceding paragraph or uses other technical means to obtain data stored, processed or transmitted in that computer information system, or implements illegal control over that computer information system, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also or only be fined; if the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years, and shall also be fined.
There is an obstacle to overcome here: what Zong Moumou took was a service such as "computing power"; how did that become "obtaining data"? The courts have already cleared this step in other cases. The second-instance ruling in a museum ticket-scalping case in Beijing explained it thoroughly: it held that when ticket-scalping software successfully submits an order, it is "not merely 'buying a ticket'; it is actually obtaining the system's 'service response,' illegally occupying server processing resources... obtaining the services and control permissions provided by the system also falls within the scope of 'obtaining computer information system data.'"
Applying that statement to this case: each time Zong Moumou successfully called the interface, the generated result he obtained was the platform system's "service response," which naturally falls within "data." The prosecution's wording conveys the same meaning, stating that he "illegally obtained the data and generated content produced by the platform's computing power for profit."
As for the "intrusion" step, there is even less need to take a detour. The interface was not open to the public, the user agreement expressly prohibited automation, and the signature verification was forged and bypassed; taken together, these three factors exceeded the limited authorization the platform granted to ordinary users. This follows the same logic as the ticket-scalping case, where "the slider CAPTCHA was a security protection measure, and the scope of user authorization was manual operation on the official client."
Once the charge is determined, the sentence is set according to the 2011 judicial interpretation on computer crimes issued by the Supreme People's Court and the Supreme People's Procuratorate. That interpretation draws two lines for the crime of illegally obtaining data: illegal gains of 5,000 yuan, or economic losses of 10,000 yuan, constitute "serious circumstances," corresponding to not more than three years; five times that standard, namely illegal gains of 25,000 yuan or losses of 50,000 yuan, constitutes "especially serious circumstances," corresponding to not less than three years but not more than seven years. Zong Moumou's illegal gains exceeded 34,000 yuan, and the platform's losses converted to no less than USD 42,000; both exceeded the five-times threshold and fell within the "especially serious circumstances" bracket. Therefore, three years is precisely the minimum sentence in that bracket.
And three years is precisely the upper limit for a suspended sentence. He pleaded guilty and accepted punishment, returned the illicit gains, and obtained forgiveness, and just met that line to receive a suspended sentence. (The judgment has not yet been made public; the sentencing bracket here is inferred backward from the sentence and the amounts.)
After taking such a long detour, what is the point of changing to this charge? The point is precisely to avoid answering the unsolvable question of "how much is computing power worth." If handled as theft, the first step would be to price the computing power, and here there are three figures that do not match: the cost the platform paid upstream (more than USD 40,000), the price at which Zong Moumou sold it (illegal gains of 34,000 yuan), and the price the platform set for its own users. Which one should be used? If handled as illegally obtaining data, this step is skipped entirely; one simply uses the illegal gains to determine the bracket. When the Research Office of the Supreme People's Court chose this route back then, it was precisely this convenience that it sought.
Most AI relay stations that exploit promotions are part of the gray industry
The real significance of this judgment lies not in convicting one person, but in setting a benchmark for the gray business of an entire industry.
The business of AI relay stations was already brought into the public eye by the media in May of this year. An in-depth report by Jiemian News divided it into three tiers: the first tier is legitimate, purchasing in large volumes as an enterprise to obtain discounts and then converting from "wholesale" to "retail," with thin profits; the second tier is chaotic, using overseas accounts to build account pools, exploiting enterprise free programs to game the system, and then repeatedly splitting and selling the same account, with a premium account renting for USD 200 per month able to be split into USD 2,000 to 3,000; the third tier is the worst, selling counterfeit goods, claiming to connect to one large model while secretly connecting to another, or secretly altering the billing multiplier to deduct more of your money. The report said that most relay station businesses fall into the second tier.
Now let us evaluate these three tiers using the yardstick of this case, and the boundary immediately becomes clear. The line drawn by the handling prosecutor is stated as follows: for public APIs that the platform has formally opened, for which keys have been allocated and billing has been agreed, even if you use them in excess or fail to pay fees owed, the matter is generally resolved first through civil contract, anti-unfair competition and similar avenues; but for private interfaces not opened for commercial use, where a person actively reverse-engineers, forges credentials, breaches protections, and extracts data in bulk for profit, that falls within the scope of criminal evaluation.
Measured against this line:
The first tier, reselling access to public APIs, is essentially a contract issue. Between you and the platform there is a service agreement; if you breach it, it is handled as a breach, with account bans and claims, and generally it does not proceed to the criminal level.
The second tier is the one that should most make you uneasy. Its distance from this case depends on how "wild" your methods of gaming the system are. If it is merely normal registration and normal calls, operating within the quota, that is a matter at the contract level; but once you begin registering tens of thousands or hundreds of thousands of accounts in bulk to obtain free quotas, using technical means to bypass the platform's registration restrictions and risk controls, and reverse-engineering private interfaces in the web or client side into your own API, each additional step brings you one step closer to Zong. The several actions treated as criminal facts in this case—maintaining account pools, bypassing IP restrictions, and forging signatures—are precisely the most common operations in this tier.
The third tier, selling counterfeit goods and secretly altering multipliers, in addition to possible computer crimes, also carries exposure to fraud; it is not the main thread of today's article, but the situation is only worse.
Three situations for relay stations: reselling public APIs is a contract issue; gaming quotas through account pools becomes more dangerous the more bulk it involves; private interfaces plus forged signatures are structurally the same as this case
Beyond this main thread, there are three more things people in this industry should note.
First, the threshold for criminal liability is lower than imagined.Illegal gains of CNY 5,000 are enough for "serious circumstances."Zong earned CNY 34,000, which sounds like not much, but that is already several times over the criminal threshold. Do not comfort yourself with "I only earned a few thousand."
Second, do not assume that only the person who personally writes the scripts bears liability. The judicial interpretation issued by the Supreme People's Court and the Supreme People's Procuratorate contains a provision specifically addressing those who "lend a hand" to such conduct: where a person knows that another is engaged in this conduct and still provides assistance such as server hosting, network access, fee settlement, or advertising and promotion, and a certain amount is reached, it is handled as joint crime. Those who provide payment channels, customer solicitation and traffic diversion, or server rental for relay stations all fall within the range of this provision.
Third, does exploiting the quotas of overseas models mean you are safe? Legally, there is no exemption. As long as the conduct occurs within China, PRC criminal law can reach it. But frankly, whether an overseas platform will report the matter to Chinese authorities and whether it can cooperate in evidence collection is another matter. So at present, enforcement in this type of crackdown will most likely still fall mainly on those exploiting domestic platforms.But this is the reality of enforcement, not a get-out-of-jail card granted by law; do not treat luck as a bargaining chip.
What platforms and buyers should each prepare
Switching perspective to the other two types of parties, this judgment has two further uses.
First, the platform being exploited. This case in fact sets out for you a checklist of "what a conviction depends on"; just prepare accordingly. Zong XX was brought down by three things: first, the user agreement expressly prohibited automated scraping and bypassing verification; second, technical protection measures such as electronic signatures were in place; third, records were retained of his account being banned for violations. These three things correspond precisely to the key points in criminal law for finding "intrusion" and "knowledge." Add to that a bill for the computing power you paid upstream, used to prove loss and calculate whether the amount threshold was crossed.
Agreements, technical measures, log records, cost evidence, these four things should ordinarily be accumulated as assets; when trouble actually arises, they are your ammunition for reporting, filing a case and driving a conviction. In the Beijing ticket-scalping case, the court found the slider CAPTCHA to be a "security protection measure," which is good news for platforms: the door you set up is recognized by law.
Next, the side buying relay APIs, that is, enterprises using low-priced interfaces to save money. What this judgment reminds you of are the two risks behind that cheap bill. One is data: your API call data passes through a relay station of unknown origin, and it may well be resold to train models; according to media reports, packaging and selling the data it holds is precisely another gray business of relay stations. The other is supply cutoff: this type of business is built on exploiting loopholes; once the platform upgrades its protection and reports the matter, the entire chain may be cut off at any time, and your product may suddenly crash one morning. The API costs you save may not be enough to fill these two pits.
In the end, the line drawn by this case is not complicated: a door the platform leaves open, you walk through it, and even if you use it heavily or owe fees, that is a commercial account; a door the platform keeps locked, you pry it open, forge keys, and move things out in bulk to sell, that is another matter.Whether technology can do something has never been the answer to whether that door was open.
If you are engaged in API relay or AI generation platforms, or are planning to connect to some low-priced interface, and want to review your own business path against this judgment, you are welcome to talk with me.
Reference sources:
Xuhui Procuratorate, "AI Computing Power Too? Shanghai's First Case of Using AI to Forge Signatures and Misappropriate Large-Model Computing Power Is Sentenced," November 3, 2026
Xuhui Procuratorate, "Sharpening Skills in Court, Protecting Innovation with Wisdom! Xuhui District Procuratorate Holds Court Observation and Review of the City's First Case of Using AI to Forge Signatures and Misappropriate Large-Model Generation Services," November 4, 2026
Jiemian News, "First-Instance Judgment in Shanghai's First AI Computing Power Misappropriation Case: Man Sentenced to Three Years for 'Free-Riding' with Over 4 Million Accounts," November 3, 2026
Jiemian News, "[In-Depth] Behind the Token Economy Boom, the Hidden Relay Station Business," May 6, 2026
Criminal Law of the People's Republic of China (2023 Amendment), National People's Congress
Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Theft (Fa Shi [2013] No. 8)
Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases Endangering the Security of Computer Information Systems (Fa Shi [2011] No. 19)
Research Opinion of the Research Office of the Supreme People's Court on How to Characterize the Conduct of Using Computers to Steal Others' Game Coins and Illegally Sell Them for Profit, in Judicial Research and Guidance, 2012, Vol. 2
Criminal Ruling of the Beijing No. 2 Intermediate People's Court, (2025) Jing 02 Xing Zhong No. 260
