On July 16, Chinese lab Moonshot AI released Kimi K3, a 2.8 trillion parameter open-weight model that within a day had displaced Anthropic’s most advanced offering, Fable 5, atop a widely watched frontend coding leaderboard, a first for a Chinese model. The following day, Chinese President Xi Jinping told attendees at the annual World AI Conference in Shanghai to “seize this rare, historic opportunity to encourage open-source.” Yet in the same speech, he warned that AI is “advancing at a staggering speed” and called for “laws and regulations, technological monitoring, early warning and emergency response systems” to keep the technology secure.
Those two priorities of openness and security will become increasingly difficult to reconcile. As Chinese models approach the frontier, open-weight releases risk diffusing powerful AI capabilities beyond Beijing’s ability to control. Recent reporting suggests Beijing is already beginning to grapple with that dilemma. Nine days before President Xi’s remarks, Reuters revealed that China’s Commerce Ministry had convened Alibaba, ByteDance, and Z.ai to discuss curbing overseas access to their most advanced models, with options ranging as far as barring public release.
The likely resolution is narrowing, not abandoning this commitment to openness. Beijing can continue to permit the release of highly capable models while withholding the most advanced ones, or delaying their release until the monitoring and early-warning systems Xi described have assessed them. Rather than a wholesale shift away from openness, Beijing may move toward selective openness, whereby the government keeps good enough models open while restricting the frontier systems it views as more difficult to secure and control.
The stakes extend well beyond China. Chinese models now account for the plurality of open-model downloads worldwide, meaning the line Beijing draws will shape both what developers and governments build on and which advanced AI capabilities are freely available to malicious actors. But selective openness only works if Beijing can tell which models are dangerous, and it currently lacks the evaluation tools to make that judgment.
Why China Opens Its Models
China’s leading AI companies release most of their models openly, whether as open-weight models, whose trained parameters anyone can download and run, and only rarely as open-source models, which also disclose the code and training recipe. The government has long encouraged this posture. Beijing has promoted open-source software since the early 2000s as a means to reduce dependence on foreign technology, and the State Council’s 2017 AI development plan elevated “open-source and openness” to one of its basic principles.
Washington cannot treat that risk as Beijing’s problem alone. Once a Chinese model’s weights are public, no government can control who uses them, and a misjudged release arms malicious actors against Chinese interests as much as American ones.
For Beijing, the open model strategy also expands its soft power by positioning China as the global provider of AI, particularly in markets where American offerings are prohibitively expensive or where sovereignty-conscious users prize models they can fine-tune or host locally.
Open-weight releases are particularly attractive for Chinese AI labs, which operate under far tighter compute constraints than their American rivals, in large part because of U.S. export controls on advanced chips. By releasing open-weight models, labs shift the compute burden of serving inference onto whoever deploys the model, rather than paying to serve every user request themselves. Moonshot AI is already running into capacity constraints with its closed Kimi K3, acknowledging that “demand has pushed close to the limits of our current capacity” and temporarily pausing new subscriptions to prioritize existing users.
Furthermore, open models are especially attractive for those in the laggard’s position. With little chance of winning a proprietary race against better-resourced American rivals, Chinese labs lose relatively little by publishing their weights. Many can cheaply reproduce frontier capabilities through distillation rather than bearing the cost of training from scratch. Releasing those models openly then drives adoption, reduces demand for proprietary American alternatives, and diminishes the returns on the billions of dollars American firms have invested in model development.
For most of the past decade, the incentives facing Chinese AI companies and Beijing have reinforced one another, encouraging the open release of increasingly capable models. As Chinese labs approach the frontier, that alignment has begun to break down.
Why the Frontier Is Different
Despite the strategic and economic benefits open-weight releases provide China, Chinese officials are increasingly focused on the heightened risks frontier AI poses. President Xi Jinping has referenced “risks of technological loss of control,” and a major Chinese standards body has flagged the need for “circuit breakers” and “safety stop switches” for frontier models. In 2026 alone, Chinese regulators and technical standards bodies have rapidly expanded work on AI safety standards and risk management frameworks. As AI governance monitor Concordia AI’s State of AI Safety in China (2026) report explains, China’s AI governance regime has reoriented its priorities “from controlling what AI says to controlling what it does.”
The risks Chinese officials have identified are especially pronounced for open-weight models, as releasing downloadable weights carries risks that closed models do not. Open releases remove a provider’s ability to control use after deployment, enable local modification and redistribution, and critically, cannot be recalled once released. OpenAI recently demonstrated why this matters when it paused an internally deployed model that had circumvented its sandbox restrictions, restoring access only after building new safeguards. An open-weight release offers no such recourse.
Safeguards on open-weight models can also easily be unraveled: researchers from Princeton University stripped much of the safety alignment of Meta’s open-weight Llama 2 with just 10 harmful training examples and a few seconds of fine-tuning. Even without stripping safeguards, Chinese open models tend to be more vulnerable to attacks that enable misuse. The U.S. Center for AI Standards and Innovation found that DeepSeek’s most secure model answered 94 percent of malicious requests under a common jailbreak, versus 8 percent for U.S. reference models.
While Chinese experts broadly endorse the value of open source AI development, key institutions have acknowledged the heightened risks. Alibaba Research Institute, Tencent Research Institute, and China’s Academy of Information and Communications Technology (CAICT) have all recognized that open models increase the potential for misuse by malicious actors. China’s top cybersecurity standards body also warned in its most recent AI Safety Governance Framework that open weights make it “easier for criminals to train malicious models.”
The Measurement Problem
The looming challenge lies in determining which models are safe to release openly and which should remain closed. In many ways, Beijing already runs the most elaborate AI regulatory apparatus in the world. It requires companies to evaluate their own models, albeit primarily on risks such as violation of core socialist values and creation of “discriminatory content.” Those evaluations are then reviewed by provincial regulators as well as the national Cyberspace Administration of China (CAC). If approved, the government then lists each model on a public registry. Despite its strong regulatory regime, a capability-based distinction between open and closed models ultimately depends on the ability to determine when a model crosses a dangerous capability threshold — not just hallucination rates or pro-democracy content.
Despite China’s increasing focus on frontier risks, Beijing currently lacks the institutions or evaluation infrastructure needed to make dangerous capability determinations well. While a few think tanks and government-backed research organizations conduct safety evaluations on risks like jailbreak vulnerabilities, there is currently no formal government institution that conducts evaluations for dangerous capabilities. While the Chinese AI Safety and Development Association (CnAISDA) publicly states its intention to develop evaluation methods, it has not yet done so. On the lab side, only a few Chinese AI companies have published safety evaluation results for models, and none have published evaluations for CBRN (chemical, biological, radiological, and nuclear) or “loss of control” risks, that President Xi himself has referred to.
If Beijing opts for selective openness, it will have to decide where to draw the line using evaluation tools that remain underdeveloped. Without reliable ways to measure dangerous capabilities, some judgments may be wrong. And an open model that clears a badly drawn line proliferates globally, offering malicious actors anywhere the opportunity to adapt them for harmful uses such as cyberattacks or biological design.
Washington cannot treat that risk as Beijing’s problem alone. Once a Chinese model’s weights are public, no government can control who uses them, and a misjudged release arms malicious actors against Chinese interests as much as American ones. The United States thus has a direct stake in the quality of China’s release decisions.
One potential remedy is to establish a narrow channel of technical exchange on evaluation methods between the United States and China, the “protocol” for “best practices” that Treasury Secretary Scott Bessent floated after the May Trump-Xi summit. Researchers from frontier AI companies and government evaluation teams, either bilaterally or via an independent, international body, could exchange approaches to capability evaluations, benchmark design, red-teaming techniques, and methods for assessing risks such as autonomous replication or CBRN misuse. Beyond improving China’s own evaluations, such exchanges could help establish a shared understanding of AI risks and dangerous capabilities, providing a foundation for future bilateral AI diplomacy.
The days when the frontier of AI went unregulated may quickly be ending, in Beijing as much as in Washington. President Xi may mock U.S. export controls on Anthropic’s models, but his government is unlikely to keep allowing open access to models with increasingly dangerous capabilities. Xi himself left room for that shift in his Shanghai speech, calling for vigilance and “an adaptive approach” to AI governance.
The hard task for Beijing will be finding the narrow line between over-regulation and a dangerously permissive approach. If it miscalculates, the consequences could be global. That is reason enough for the two AI superpowers to compare notes while interests still align.
Ruby Scanlon is a research associate for the Technology and National Security Program at the Center for a New American Security (CNAS), supporting the Center’s research on U.S.-China technology competition, China’s innovation ecosystem, and AI policy. Her analysis has featured in outlets including The New York Times, The Economist, and Politico.
