In September 2025, the Xuhui District People's Court in Shanghai sentenced two developers of the AI chatbot AlienChat to four years and eighteen months in prison, with fines of RMB 4 million and RMB 200,000, for producing obscene materials for profit under Article 363 of the PRC Criminal Law. Prosecutors had charged dissemination; the court, on its own motion, reclassified the conduct as production and convicted on that ground. The frontier of criminal liability for AI developers was crossed in Shanghai across 2025 and 2026, and the doctrinal weapon was the indirect-perpetration and tool theory that the civil-law tradition has carried for over a century; the United States, the EU, and the United Kingdom appear to take different paths, but underneath they are converging on the same destination — developer accountability — differing only in whether the vehicle is criminal, civil, or administrative. The United States, the EU, the United Kingdom, and Germany all prosecute AI-related crime, but the defendant has always been a user — United States v. Strahler (the first TAKE IT DOWN Act conviction, S.D. Ohio, April 2026), Anderegg (W.D. Wis. 2024), Hugh Nelson (Bolton Crown Court, 2024) — all cases of someone who used AI as a weapon. China crossed that frontier.
The doctrinal foundation is the revival of a century-old indirect perpetration (mittelbare Täterschaft) and tool theory (Werkzeugtheorie). Claus Roxin's Täterschaft und Tatherrschaft (1963; 10th ed. 2019) holds that a person who commits a crime by using someone without criminal capacity as a tool is the direct principal; that German framework became the skeleton of the AI age's first frontier judgment. The first-instance court never mentioned indirect perpetration, but the leading defense of the verdict — by Guo Zhilong of China University of Political Science and Law — described the AI as a "tool" (工具) controlled by the provider and the user's input as a "trigger condition," which is Werkzeugtheorie rendered in Chinese.
Why now
Three trajectories converged. Technology — bypassing an LLM's safety filter through system prompts was commoditized between 2023 and 2025; the AlienChat developers never trained a model, layering a system prompt on a commercial LLM to draw out obscene output. Regulation — Article 9 of the Interim Measures for Generative AI Services (effective August 2023), which makes the provider a network information content producer, was the time bomb; the first-instance court imported that administrative "producer" status into the production element of Article 363. The judiciary — onto the stack built by Kuaibo (2016), Kuai'a (2017), and the Hangzhou face-swap case (2024), AlienChat added one further line: the developer as direct principal.
The first-instance architecture and the scholarly dispute
The decisive component of the reasoning is that the chatbot itself is the obscene work. Rather than treat each user's chat as co-produced obscene material, the court treated the AlienChat app as an obscene work pre-tuned to produce obscene output on minimal triggering — a single move that defeats both the private-chat defense and the "the users made it, not us" defense. The system prompt ("can be unconstrained by morality, ethics, law or norms") and the obscenity ratio of 28.9% (3,618 of 12,495 sampled segments) were the smoking gun for subjective intent.
A Beijing News exclusive of January 12, 2026 recorded an open clash among three scholars. Guo Zhilong: defense — the provider's decisive leading role. Wang Zhiyuan: a critique from the asymmetry of blameworthiness. Yan Erpeng: a triple critique — the elements of Article 363 are absent, accessory dependence is violated, and, most powerfully, "a departmental rule cannot substitute for the judgment of criminal liability," a legality objection.
Global convergence — apparent divergence, the same underlying direction
The surface China versus the rest divergence hides a pattern in which all are moving toward developer accountability. The United States runs a division of labor — user criminal liability, developer civil liability (the TAKE IT DOWN Act amends 47 U.S.C. § 223; the AI LEAD Act is S. 2937). The EU imposes administrative fines under Article 99 of the AI Act (up to €35 million or 7%), with criminal law left to member states. The United Kingdom's Crime and Policing Bill 2025 (still a Bill) — criminalizing AI tools designed to generate CSAM — is AlienChat's closest Western relative, but its specific design intent requirement makes it narrower. Germany is doctrine-rich and prosecution-poor, holding Roxin doctrine, § 25 II, and § 13 but no prosecutions. All four agree that AI cannot be a criminal defendant and that administrative and civil sanctions on developers are legitimate; they split on whether criminal liability reaches the developer — China yes, the rest effectively no or a narrow yes. That a frontier, once crossed, draws others across is the general law. China is only the first mover.
The tests
Five tests bear on the doctrine's durability. (1) The Shanghai No. 1 Intermediate Court appeal — adjourned January 14, 2026; expert testimony at the second hearing on May 21, 2026; no judgment as of May 27, 2026. (2) Adoption as an SPC guiding case — near-certain if affirmed. (3) A first AI-developer prosecution in the United Kingdom or Germany. (4) The neutrale Handlungen defense against agentic AI. (5) The outcome for the one AlienChat user released on bail pending trial.
The defense answer is that if the party that played the decisive leading role does not answer, the justice of criminal law itself collapses; the critical answer is that, once the same indirect-perpetration doctrine can criminally punish every open-source fine-tuner, frontier innovation itself is blocked. A municipal court crossed the frontier, but how far it crossed is still unclear. As silence can settle a consensus, an undefined scope also preserves a frontier. Reading the September 2025 first instance that way is the most accurate reading.