A rising San Francisco human resources startup’s use of a blacklisted Chinese AI lab’s model is setting off alarm bells as Beijing continues to reel in American companies.
Rippling touts itself as a one-stop-shop AI platform for human resources, information technology and finance that services over 20,000 U.S. companies, per its website. The model’s maker, Z.ai, also known as Zhipu, had already made it on to a U.S. government entity list months earlier over its ties to the Chinese military.
“Any data that transits an API through servers based in China is at risk of deliberate data exfiltration and intelligence collection. This is the same problem we’ve had with TikTok, but scaled up to be 100 times worse as people are uploading sensitive personal information. They’re not making fun videos of kids dancing, but asking for pretty sensitive advice about every aspect of their lives as they’re using AI systems,” Ryan Fedusiak, a fellow at the American Enterprise Institute (AEI) who focuses on China and AI-related issues, told the Daily Caller News Foundation.
Open models “can be tampered with in ways that are very difficult to detect, and we haven’t seen a huge number of attacks like this yet. But I do worry that the potential is certainly there,” Fedusiak warned.
Rippling is not the only company to take Chinese AI for a test drive. Giants like DoorDash and small startups are increasingly adopting Chinese AI models because they provide nearly-frontier level performance at far less cost than Anthropic and OpenAI, Fortune reported. Airbnb CEO Brian Chesky said in 2025 the company used Alibaba’s Qwen AI model, referring to it as “fast and cheap,” per NPR.
Rippling did not respond to a request for comment from the DCNF about the extent to which the company uses Chinese AI models and how it protects its clients’ data. Zhipu also did not respond.
‘85% Cheaper’
Rippling CEO Parker Conrad in July on X credited Zhipu’s GLM 5.2 model, or Z.ai’s frontier open-source model, after the company found the model performed nearly as well as frontier, closed AI models at substantially less cost.
“This is why access to open weights matters – GLM 5.2 is 85% cheaper but nearly identical performance,” he wrote.
The AI human resources startup mainly uses OpenAI and Anthropic as its primary AI models, an AI usage guide published on the company’s website shows. The company bars its AI service providers from storing and using client data to train AI models.
Rippling President Matt MacInnis published test results in the same month showing that the company used the controversial Z.ai GLM model as part of its July testing.
“The benchmark covers 15 model variants and is built around real-world business agent tasks using real-world company data and workflows. Across pass rates, latency, and actual dollar cost, the open-weight models were surprisingly competitive,” MacInnis wrote. “GLM in particular seems to offer a shortcut to cost reduction versus the models from the “labs.” Grok also surprised to the upside on performance and cost.”
The company’s chief technology officer (CTO), Albert Strasheim, in August used GLM 5.2 for a “security review,” according to a LinkedIn post.
The company is also a major Democratic political vendor and received tens of millions of dollars in tax breaks from California Democratic Gov. Gavin Newsom and New York Democratic Gov. Kathy Hochul, according to the Washington Free Beacon. ActBlue and the Democratic National Committee (DNC) processed $23.3 million in payroll expenses through the payroll platform during the 2026 midterm cycle, per the outlet.
The startup has been busy on the lobbying front, hiring the Washington, D.C., firm Ballard Partners to advocate for data governance and payroll tax compliance, per disclosure forms.
Some of Rippling’s customers operate in highly sensitive American military, national security, intelligence and aerospace sectors.
Askari Defense, a Rippling customer, is a defense startup building anti-drone interceptors, according to the company’s website. The U.S. Army’s xTech|Adaptiv Strike competition selected Askari as a semifinalist in May, and it is heading to the National Training Center to put its Rift Alpha interceptor drone through more testing, per Defence Blog. The company didn’t respond to a request for comment.
‘People Shouldn’t Be Blind To It’
The Bureau of Industry and Security (BIS), a sub-agency of the Commerce Department, added Zhipu to its Entity List in January, citing Zhipu’s efforts to aid China’s military modernization push. The BIS Entity List subjects foreign companies to certain export controls, according to the Cybersecurity & Infrastructure Security Agency (CISA).
This means that companies remain free to download open Chinese models as long as they do not send information onto Zhipu’s platform that would violate the sanctions, such as proprietary AI training code and software to develop advanced microchips, per the BIS.
In late September, Z.ai made its ZCode coding assistant publicly available after user data was uploaded to the Alibaba cloud. ZCode runs on the latest GLM-5.3 AI model, and disabled features while promising more transparency, Reuters reported.
“We welcome developers to continue reviewing ZCode and reporting potential issues,” the Chinese AI lab told the outlet in September.
Chinese cybersecurity firm NSFOCUS found that the users’ code data was deleted, Zhipu claimed, according to Reuters. NSFOCUS and the China Academy of Information and Communications Technology, a state-run research institute, founded a joint laboratory in 2022 to boost data security, according to a report from Chinese state-backed China Daily.
A BIS spokesperson referred the DCNF to its 2025 annual report detailing how the Biden administration granted over 2,100 licenses for companies on its Entity List, while BIS only provided 16 licenses to companies on the Entity List between the second quarter and fourth quarter of 2025.
Texas Republican Gov. Greg Abbott added Zhipu to Texas’s Prohibited Technologies List for state employees and government devices in January.
“Rogue actors across the globe who wish harm on Texans should not be allowed to infiltrate our state’s network and devices,” Abbott said in a statement at the time. “Hostile adversaries harvest user data through AI and other applications and hardware to exploit, manipulate, and violate users and put them at extreme risk.”
Chinese AI models have grown from a relatively small share to a majority on two major AI developer platforms, CNBC reported in late September. Their share accounted for 57-67% of tokens used on OpenRouter in the week of September 14, up from 6-13% in February, per the outlet. Developers on Vercel used these models heavily, driving their market share from 11% in January to 55% in August.
“Chinese models are becoming capable enough for more tasks at a much lower cost. Once a model meets the quality bar for the job, that price difference becomes compelling,” Harpreet Arora, head of agentic infrastructure at Vercel, told the outlet, adding that some companies prefer to use frontier American models for more complicated tasks.
China has closed the gap with America’s leading AI models as its top models barely trail U.S. on key benchmarks, according to Bloomberg Intelligence.
U.S. companies accounted for around 30% of the tokens consumed on Chinese AI models through OpenRouter since February, peaking at 46%, according to a CNBC report.
The threat of a Chinese AI model to a business depends on how one connects to the model, Kyle Chan, a fellow at the John L. Thorton China Center at the Brookings Institution, told the DCNF.
AI users face the most danger when connecting directly to the AI models through a subscription or an Application Programming Interface (API), he warned. An API serves as a digital messenger that allows two different software applications to talk to each other, according to Amazon Web Services (AWS).
“You’re literally sending your data, all your prompts, all that information, whatever you put into the model, you’re sending it essentially to China,” Chan said.
Many people use Chinese models indirectly through an AI developer platform such as OpenRouter or through an “abliterated” model, an AI model trained to refuse harmful or bad requests.
Chan said that these methods have “much less risk, but not zero [risk].” But most users don’t connect to Chinese AI models this way, Fedusiak cautioned.
There may be a second, potentially worse, risk of using Chinese AI, which Chan calls “supply chain poisoning.” He argues that AI models could be “poisoned” with bad documents that could lead to vulnerabilities or even contain “deliberately engineered backdoors,” as he explained in an April article for War on the Rocks.
Smaller companies such as startups may not want to drop a “whole bunch of money” on Claude or other frontier AI models, Chan said.
“The reported situation with Z.ai should serve as a reminder to firms looking to integrate AI into their operations to be mindful of the firms they’re partnering with. Businesses need to trust that when they partner with a firm, they will do what they claim they do when it comes to retention of uploading,” James Czerniawski, the head of emerging technology policy for the Consumer Choice Center, told the DCNF.
“Z.ai had a poor configuration that allowed for the incidents to occur to begin with,” Czerniawski added. “Given other concerns around IP theft from China and the fact there is no way to verify the files that were accidentally uploaded to Z.ai were deleted, this only serves as further reason to tread carefully when interacting with these types of companies.”
Anthropic has accused Chinese AI labs of mishandling users’ data.
The American AI lab said Zhipu used its Claude AI model to improve its own capabilities, according to the company’s September Threat Intelligence Report. The company said that Moonshot AI, the Chinese AI lab that produces the Kimi family of AI models, “silently forwarded customer requests to Claude, instead of processing them through Kimi.”
DeepSeek, another Chinese AI company, also allegedly used tactics similar to Moonshot’s, according to the Threat Intelligence Report.
“In software, until these kinds of attacks start taking place and become, you know, sensitized to developers, I think they’re going to continue choosing the cheapest option, and frankly, I find it difficult to blame them, especially if you’re a startup trying to conserve burn rate. Of course, you’re going to use the cheapest, most effective tools available to you. Yeah, but the risk is there. People shouldn’t be blind to it,” Fedusiak told the DCNF.
Disclosure: The Daily Caller News Foundation is a Rippling customer.
Content created by The Daily Caller News Foundation is available without charge to any eligible news publisher that can provide a large audience. For licensing opportunities of our original content, please contact licensing@dailycallernewsfoundation.org.
Continue reading...
[ H/T WorldNetDaily ]
