A core artificial intelligence term recently designated by China's National Data Administration has become a buzzword across the country, drawing growing public attention and official warnings related to security and fraud risks.

The term, ciyuan or token, refers to the smallest unit of information processed by large AI models. It can be counted, priced, and traded, and is widely used in AI services such as writing, image editing, and video generation. In many digital services, tokens also play a role in identity verification, access control, and payment authorization.

On Tuesday, the Ministry of State Security issued a public warning on token-related risks, highlighting threats including theft and hijacking, forgery and tampering, as well as fraud.

According to the ministry, China's average daily token call volume exceeded 140 trillion as of March, more than 1,000 times the level at the beginning of 2024. The ministry said the rapid expansion has made tokens an increasingly important part of the digital economy, but also a new target for criminals seeking to exploit technical loopholes and public misunderstanding.

The ministry said unencrypted tokens can be stolen through cyberattacks, malware, or insecure networks, enabling criminals to impersonate users, access private data, and conduct unauthorized transactions. It also warned that weak verification systems may leave tokens vulnerable to forgery or tampering, allowing attackers to bypass security checks.

Fraud is another major risk. According to the ministry, some social media accounts are promoting low-cost token packages, unlimited plans, and token agency schemes, claiming users can profit by reselling tokens or APIs. Industry observers said many such promotions use formulaic scripts to present the "token economy" as a quick-profit opportunity, while the real business often lies in drawing more people into the scheme.

Huang Daoli, a researcher at the third research institute of the Ministry of Public Security, said the token, once largely confined to technical discussions, is rapidly evolving into a basic unit of the digital economy.

"In practice, tokens are used to measure generative AI computing and bill API calls," Huang said. "In many applications, they also serve as credentials for identity verification and access control, giving them both technical and transactional and security functions."

Huang said that with daily call volumes already above 140 trillion, token-related security risks can no longer be seen as isolated technical incidents. "If token security is breached at scale, the impact may spill over from personal privacy and financial loss to broader data security and even economic security," she said.

Huang added that some scams exploit limited public understanding by repackaging tokens as investment products, echoing earlier hype around virtual currencies. Such risks could threaten individuals' privacy and identity security, while large-scale forgery could undermine data controls in key sectors such as government and finance.

China has a legal framework to address such risks, including laws on cybersecurity and data protection. The priority now, Huang said, is to enforce those rules more effectively by strengthening identity management and oversight of high-risk API resale.

Both the Ministry of State Security and experts urged the public to stay cautious. The ministry said tokens are digital credentials, not investment products, and advised users to avoid get-rich schemes, use trusted platforms, and protect their passwords.

Huang said tokens should be treated as highly sensitive credentials, no less important than payment tools. "The key is to change the mistaken belief that an API key is merely a technical parameter," she said. "It should be treated as a critical data asset."

yangzekun@chinadaily.com.cn