Menu
SUBSCRIBE
SUBSCRIBE
Menu

AI Supply Chain

Moonshot AI investigation represented by a photograph of the U.S. Capitol in Washington, D.C.

House Committees Question DoorDash Over Use of Chinese AI Model

, , , , , , , , , , ,

The inquiry follows U.S. government allegations that Moonshot AI used unauthorized distillation and restricted computing systems to develop its models.

 

Two House committees have expanded their investigation into Chinese-developed AI models to include DoorDash after the company disclosed using a Moonshot AI model in an internal coding system.

The House Committee on Homeland Security and the House Select Committee on the Chinese Communist Party asked DoorDash to provide records about its use of Kimi K2.6, an open-weight model developed by China-based Moonshot AI.

The committees are investigating the national security, cybersecurity and economic security risks of U.S. companies using Chinese-developed models in software and systems that can access sensitive business or personal information.

DoorDash used Chinese AI for lower-level coding tasks

DoorDash co-founder Andy Fang said in July that the company had added open-weight models to an internal AI-assisted code-review system.

According to the committees’ letter, DoorDash sent more difficult tasks to a U.S.-developed AI model and routed lower-level work to Kimi K2.6.

DoorDash said the new system performed better on its internal coding benchmark than the configuration it replaced while also lowering costs. The previous system used Anthropic’s Sonnet 4.6 and Opus 4.8 models.

The committees said Chinese open-weight models may offer strong performance, lower costs and greater control over how they are deployed. Companies can also operate the models within their own computing environments rather than sending information to an outside hosted service.

 

However, the committees said those benefits do not answer questions about how the models were developed, whether their software components came from trustworthy sources or how they will behave when given access to company code, data and development tools.

 

Moonshot allegations raise additional questions

U.S. officials previously accused Moonshot AI of using unauthorized distillation, a process for extracting capabilities from another company’s AI model, and of obtaining restricted computing systems. 

The committees said those allegations may indicate that Moonshot is an untrustworthy technology supplier, even if Kimi K2.6 appears to function normally. They want to know whether using the model could expose DoorDash’s code, data or systems to security risks, and whether DoorDash adequately considered those risks before deploying it. 

Lawmakers also asked whether DoorDash took precautionary measures after learning of the allegations.

 

Committees seek testing and security records

The committees asked DoorDash to identify every AI model developed by a Chinese company that it has evaluated or used since January 1, 2025.

They also requested information about DoorDash’s security testing, model approval procedures, access controls and monitoring. The request covers testing for insecure code generation, unauthorized data transmission, prompt injection, and misuse of system permissions.

DoorDash must also provide documents explaining why it selected each model and any plans for replacing one if access becomes restricted or new security risks emerge.

The committees requested the documents by August 14 and asked DoorDash employees responsible for AI infrastructure, security, procurement and compliance to attend an in-person briefing by August 21.

 

The DoorDash request follows letters sent to Airbnb and coding-software company Anysphere in April. The committees said they have since held discussions with both companies about their evaluation and use of Chinese open-weight AI models.

Nebulous digital figure amid blue and red distortion representing a poisoned open-weight AI model.

Researcher Poisons Open-Weight AI Model for Less Than $100

, , , , , , , , ,

A Semgrep researcher used just 10 poisoned training examples to make the model insert a flaw that could give attackers control of a company’s servers or other systems running the vulnerable code.

Cybersecurity researcher Katie Paxton-Fear of Semgrep poisoned an open-weight AI model for less than $100 in about an hour, showing how cheaply attackers could add hidden behavior to models that companies download and run themselves.

An open-weight AI model makes its core files available for people or companies to download and modify. Paxton-Fear took an existing open-weight coding model and trained it on a small set of new examples, creating an altered version of the model.

She first taught the altered model to use a different JavaScript coding style. After that worked, she used 10 malicious examples to make it generate code containing a security flaw.

Ten Examples Changed the Model’s Code

Paxton-Fear said just 10 malicious training examples caused the model to repeatedly produce code with a serious security flaw. If a company used that code, an attacker could potentially take control of the servers or other systems running it.

The model also produced the security flaw when responding to prompts it had not seen during training. This showed that the change was not limited to repeating the 10 malicious examples. 

The experiment did not involve compromising a model already used by businesses. Semgrep said there is no public evidence that widely used open-weight models have been deliberately poisoned.

The demonstration instead showed how someone distributing a modified model could quietly add harmful behavior before another company downloaded it.

Hidden Changes Are Difficult to Detect

Companies can inspect traditional software for malicious code, trace where it came from and check whether it has been altered. Paxton-Fear and her Semgrep colleagues said companies cannot yet examine AI models with the same confidence.

A poisoned model may appear to work normally during routine use and testing, but produce insecure code, biased recommendations or other harmful results when it receives particular prompts. Reviewing the model’s files does not provide a clear account of how it will behave.

Standard performance tests also may not expose the problem. A poisoned model can be adjusted to pass those tests while retaining hidden behavior.

Semgrep called for better records showing where models and their training data come from, methods for reproducing how models were built, and testing by independent organizations. The researchers said companies will need outside auditors capable of checking model developers’ claims, similar to the independent security testing used for traditional software.

Those safeguards can help companies limit which models they trust and test the systems before use. However, Semgrep said no reliable method currently exists for proving that an open-weight AI model does not contain a hidden backdoor.