Will China Crack Down on Open-Weight Models?

Ever since DeepSeek surprised the world with a capable, open-weight reasoning model in January 2025, observers have speculated that China’s government will eventually force a more closed AI ecosystem. Open weights means anyone with access to the needed computing power can download and use the model however they like, including for cyber attacks or other malign purposes. Yet the open releases have kept coming. Today, closed models from the likes of OpenAI and Anthropic face lower-priced, self-hostable, customizable competition from DeepSeek, Z.ai, and Moonshot. China’s leader, Xi Jinping, last month said, “We must … encourage open source and openness, cooperation and sharing.”

To some, that single line of Xi’s speech seemed to have settled it: China is doubling down on open-weight releases, risks be damned. Yet Xi offered “four views” on international AI development. “Persist in openness and common benefit, and drive innovation and development” was the first. But the second speaks directly to the need for control: “strengthen risk awareness, and ensure security and controllability.” Those who (voluntarily or not) marinate in Chinese government verbiage will recognize this as a version of Xi’s 2014 declaration that “development is the foundation of security, and security is a precondition of development.” This duality is enshrined in legal texts, pertinently including a key generative AI regulation, which declares that “the state is to maintain equal emphasis on development and security.” The Chinese government recognizes that security and development can be in tension, but insists on having both anyway.

Rather than seeing Xi’s speech as an unmitigated endorsement of open weights, we should see it as reflecting an unresolved tension in AI development: The Chinese government is embracing open models while placing equal emphasis on security and control, and it has not yet decided precisely how it will strike a balance.

It’s just not right to conclude that Xi doubled down on open weights, irrespective of security or safety (which, importantly, are generally the same word in Mandarin). For one, the specific phrasing of “open source and openness” actually predates the recent wave of large language models (LLMs), tracing to the 2017 New Generation AI Development Plan, when drafters could not have known that a Google paper published a few days earlier would lead to the LLM era. Back then, the term conjured the broader idea of open source development and sharing tech advances across sectors. Today, it is a reference to open weights, but one with a broader meaning and a longer history. Moreover, as many in the international AI safety community noted, Xi’s speech last month closed with an admonition to “improve measures to guard against loss of control” as AI advances. Carnegie Endowment for International Peace senior fellow Matt Sheehan has rightly noted that “control” here carries meanings beyond the concept of an AI system going rogue, but the disasters AI safety proponents fear would certainly also qualify as things Xi would like us to avoid.

The Chinese government certainly has the ability to stop Chinese companies from releasing model weights, whether through legal or other means. We can conclude, therefore, that Beijing officials did not view the open distribution of DeepSeek V4, GLM 5.2, or Kimi K3 as an unacceptable risk. Why not, and what events might change their minds for future models?

In search of novel risks

Before examining potential downsides, we have to pause on the upsides that also weigh in the development–security balance. DeepSeek showed that China was not as far behind as the world (and, probably, many Chinese officials) had thought. Its open release and that of subsequent, widely-adopted Qwen models from Alibaba Cloud put Chinese-built technology in workflows around the world. At a time when US AI companies keep even their trailing models closed, China apparently shares its best with everyone. People building on Chinese tech might look more kindly on China in general, and those using Qwen, for instance, might direct more business to China’s cloud services sector. For Chinese startups, the attention lavished on DeepSeek demonstrated the power of open release as they seek investment and talent—not to mention that limited semiconductor access makes it hard to serve user demand while also training the next models. For now, open models mean good vibes, exposure, and maybe still a path to revenue. That might be enough, but if Beijing leaders also wish to clap back against a US that seeks to hobble China through chip controls, the country’s capable, cheap-to-run open models also challenge the high-priced business model of the US giants.

We have to look at what risks China’s government might perceive as unacceptable, even at the cost of dampening the considerable vitality of open model releases today. Numerous conversations with both international and Chinese AI experts over the last year have led me to some hypotheses about why this has not yet happened.

First, people often speculate that, at some point, the open release of models will threaten Chinese Communist Party rule by empowering anti-Party dissidents to circumvent state controls and raise some kind of revolt. I don’t consider this to be a likely trigger for a Chinese government clampdown on open releases, because I believe officials are—probably justifiably—confident that they have the domestic cyberspace environment under adequate control. Getting online in China and communicating over the platforms that reach large numbers of Chinese citizens entails multiple layers of identity verification and surveillance, and models have some degree of political discipline built into the weights themselves at release. This means any effort, AI-enabled or not, to circumvent controls and mobilize or even reach people at scale would likely be traceable. Moreover, Chinese regulations are unusually well developed when it comes to domestically hosted generative AI services, especially when it comes to political censorship and monitoring. Open models can theoretically be run on a person’s own infrastructure, but the most capable models can need millions of dollars in hardware to operate at full capacity. Building such a capability and then leveraging it in a highly monitored environment does not seem to me a likely path to threatening CCP rule or stability. If there were such widespread discontent as to overpower the state’s targeted repression capacity, this would be a threat to the regime with or without AI.

Second, we might expect that, at some point, the risk of cyber threats to Chinese interests emerging from LLM coding and agentic abilities would tip the balance toward control in Beijing. This I think is entirely possible, but evidently it hasn’t happened yet. A US–UK government analysis of recent top Chinese models rated their offensive cyber capabilities as significantly behind those of the top US models, but it noted that “Kimi K3's safeguards did not prevent it from attempting cyber exploit development or offensive cyber operations.” It’s reasonable to conclude that Chinese models already pose real risks of cybersecurity misuse, though apparently not enough to prevent open release.

So, as several people have asked, what if future releases become as capable as Anthropic’s Mythos? That model received widespread attention after Anthropic announced they had used it to discover longstanding vulnerabilities, including in the ubiquitous OpenBSD operating system, leading among other things to a risk recalibration in the US government. Anthropic restricted Mythos access to entities it deemed trustworthy, so that they could use it to shore up defenses, and then it developed a version with diminished capabilities for public release. Even that wasn’t enough to prevent a somewhat confused US effort to control access. Would Chinese officials really be OK with this kind of capability spreading to China’s adversaries (other than the US government, which already has it if it wants it) or to criminals or other malign actors who could cause trouble worldwide? Such diffusion might be perceived as putting critical Chinese systems in peril and, if a Chinese model is seen to be responsible for some cyber catastrophe, it could damage China’s international reputation. Think of the recriminations, justified and otherwise, aimed at China over the Covid pandemic.

We should expect officials to curb open releases only when security risks that cannot be mitigated outweigh perceived economic and reputational benefits. Xi Jinping’s development and security message suggests that there should be a threshold of risk at which China’s government would step in. But this may come later or differently than some would expect or hope. First, when it comes to cyber vulnerability, China’s sense of security was already not good. Adding LLM capabilities for attackers simply modifies the shape of the problem. When it comes to nation-state adversaries such as the US, China goes from very vulnerable to sabotage and espionage to vulnerable in a new way. It’s hard to identify what kind of LLM capability would change the Chinese government’s sense of vulnerability to various actors, especially given that Chinese defenders are assuredly working to shore up the most critical systems with whatever tools they can access. Second, it’s not just the model but the user and their resources that make a threat. When Anthropic announced Mythos had alarming capabilities, two things had happened: There was a new LLM, and a skilled team of cybersecurity experts with Anthropic-level computational resources had worked to find vulnerabilities with it. For a threat actor to be uniquely empowered by a Chinese open release, they would need both the affordances of the new LLM and the expertise and resources to discover vulnerabilities and then exploit them. Are there state or nonstate threat actors who have the skills, the computational resources, and the motivation to attack China but are held back because they can only use existing open LLMs and other non-AI techniques, as opposed to a model that ranks higher on exploit benchmarks? Maybe and maybe not—but it’s that broader constellation of elements, not simply model capability, that I would expect could cause Beijing leaders to tip toward control.

Third, non-cyber risks could lead to a reevaluation in Beijing. The closest-watched is the risk that malign actors would use LLMs as part of an effort to develop novel pathogens or other virulent biological or chemical agents. A proof of concept—hopefully in a lab and not in the wild—could capture leaders’ imaginations and motivate new controls. If that happens, stopping open release of the most advanced LLMs is one possible move. Yet prohibiting open-weight releases is not the only response to this kind of risk. The international state of the art on biological and chemical risk mitigation includes techniques ranging from keeping key information out of training data to engineering a model’s refusal to answer, and beyond. China’s developing regulatory regime around generative AI development similarly establishes a framework that spans the many stages of model development, from training data to post-training to packaging a model as an online service. Without getting into the debates about whether such mitigations are enough, it is entirely possible that Chinese officials would decide that they are enough for China. Just because the Chinese government comes to perceive AI risks as more acute does not mean it will necessarily turn to prohibiting open releases.

Fourth, and finally, a fast follower is well positioned to see what kind of trouble awaits and swerve before they get there. Measuring the capabilities of LLMs is fraught, and this is not a single race to a clear destination, but the Silicon Valley consensus is that the leading open Chinese models are roughly six months behind the leading US ones. Multiple Chinese experts have pointed out to me that if LLM systems produce extraordinary or unexpected dangers—be it loss of control or unintended, “mis-aligned” behavior—it’s reasonable to expect the Americans will encounter them first. Officials may believe this gives them time to block upcoming open releases if necessary. Moreover, learning from US responses to novel incidents may even give them the confidence to continue with open releases after requiring targeted mitigations. Of course, as Council on Foreign Relations senior fellow Vinh Nguyen suggested in our recent Tech Policy Press podcast conversation, a major incident could very well cause Beijing officials to stop the most advanced open releases, even if that doesn’t mean they will close them all. We can consider the Chinese response to AI incidents a known unknown, alongside the shape of the events themselves.

Why we ask what we ask

This analysis has largely assumed that Chinese AI companies will still want to release their marquee models in open-weight form and will only stop if the government intervenes. Of course, companies could simply change corporate strategy and keep their best models closed for business reasons. I think that’s the most likely explanation for Alibaba Cloud’s decision earlier this year to release the most powerful version of its Qwen 3.6 series only through the company’s API. Unlike China’s AI startups, Alibaba is a massive cloud provider, meaning it has more infrastructure to serve users and also has the incentive to get clients onboard to sell other services. (Still, with Qwen 3.8, Alibaba returned to releasing weights for its “Max” models and followed Moonshot in seeking revenue share from outside inference providers.) Companies could also decide on their own that some models simply aren’t safe for open release. The relationship between government, industry, and the technological cutting edge is quickly evolving.

The question of why China’s government has not barred open releases is itself worth some scrutiny. To treat this as a puzzle is to suggest there was reason to expect that Chinese officials would have acted in a way that, as it turns out, they have not. This unfulfilled expectation may be based on a theory of how Chinese leaders view threats, a sense that Chinese leaders are becoming more like conservative AI safety thinkers, or some other basis. Ideas like these—and I’m far from immune—continue to fuel speculation about what might cause an open model clampdown in the future. Yet this reminds me of one of my favorite professors, who once pointed to a similar tendency among political scientists. US scholars never tired of asking why China had not democratized as it became richer in the post-Mao era, and what might lead it to democracy in the future. This question, my professor proposed more than 15 years ago, might well be like waiting for Godot. Perhaps we should spend our energy understanding how Chinese politics is, rather than how it isn’t.