Can China Keep Its AI Open? - The Wire China
Visitors at the booth for Moonshot's Kimi K3 during the World AI Conference in Shanghai, July 17, 2026. Credit: Ng Han Guan viaAP ImagesOn July 16, Chinese lab Moonshot AI released Kimi K3, a 2. 8 trillion. . .
Visitors at the booth for Moonshot's Kimi K3 during the World AI Conference in Shanghai, July 17, 2026. Credit: Ng Han Guan viaAP ImagesOn July 16, Chinese lab Moonshot AI released Kimi K3, a 2. 8 trillion parameter open-weight model that within a day had displaced Anthropic’s most advanced offering, Fable 5, atop a widely watchedfrontend coding leaderboard,a first for a Chinese model. The following day, Chinese President Xi Jinpingtoldattendees at the annual World AI Conference in Shanghai to “seize this rare, historic opportunity to encourage open-source. ” Yet in the same speech, he warned that AI is “advancing at a staggering speed” and called for “laws and regulations, technological monitoring, early warning and emergency response systems” to keep the technology secure. An excerpt from the speech delivered by Xi Jinping at the World AI Conference, July 17, 2026. Credit:SCIOThose two priorities of openness and security will become increasingly difficult to reconcile. As Chinese models approach the frontier, open-weight releases risk diffusing powerful AI capabilities beyond Beijing’s ability to control. Recent reporting suggests Beijing is already beginning to grapple with that dilemma. Nine days before President Xi’s remarks, Reuters revealed that China’s Commerce Ministry had convened Alibaba, ByteDance, and Z. ai to discusscurbing overseas accessto their most advanced models, with options ranging as far as barring public release. The likely resolution is narrowing, not abandoning this commitment to openness. Beijing can continue to permit the release of highly capable models while withholding the most advanced ones, or delaying their release until themonitoring and early-warning systems Xi describedhave assessed them. Rather than a wholesale shift away from openness, Beijing may move towardselective openness, whereby the government keepsgood enoughmodels open while restricting the frontier systems it views as more difficult tosecure and control. A promotional video for Moonshot’s Kimi K3 open-weight AI model, which launched July 16, 2026. Credit:Kimi AIThe stakes extend well beyond China. Chinese models now account for theplurality of open-model downloads worldwide, meaning the line Beijing draws will shape both what developers and governments build on and which advanced AI capabilities are freely available to malicious actors. But selective openness only works if Beijing can tell which models are dangerous, and it currently lacks the evaluation tools to make that judgment. Why China Opens Its ModelsChina’s leading AI companies release most of their models openly, whether as open-weightmodels, whose trained parameters anyone can download and run, and only rarely as open-sourcemodels, which also disclose the code and training recipe. The government has long encouraged this posture. Beijing has promoted open-source software since the early 2000s as a means toreduce dependence on foreign technology, and the State Council’s 2017 AI development plan elevated “open-source and openness” to one of its basic principles. Washington cannot treat that risk as Beijing’s problem alone. Once a Chinese model’s weights are public, no government can control who uses them, and a misjudged release arms malicious actors against Chinese interests as much as American ones. For Beijing, the open model strategy also expands its soft power by positioning China as the global provider of AI, particularly in markets where American offerings areprohibitively expensiveor wheresovereignty-conscious usersprize models they can fine-tune or host locally. Benchmark evaluations for AI coding models highlighting the performance of Kimi’s K3 model versus others like Open AI’s GPT-5. 6 Sol and Claude’s Fable 5. Credit:KimiOpen-weight releases are particularly attractive for Chinese AI labs, which operate under fartighter compute constraintsthan their American rivals, in large part because ofU. S. export controls on advanced chips. By releasing open-weight models, labs shift the compute burden of serving inference onto whoever deploys the model, rather than paying to serve every user request themselves. Moonshot AI is already running into capacity constraints with its closed Kimi K3,acknowledgingthat “demand has pushed close to the limits of our current capacity” and temporarily pausing new subscriptions to prioritize existing users. Furthermore, open models are especially attractive for those in the laggard’s position. With little chance of winning a proprietary race against better-resourced American rivals, Chinese labs lose relatively little by publishing their weights. Many can cheaply reproduce frontier capabilities throughdistillationrather than bearing the cost of training from scratch. Releasing those models openly then drives adoption, reduces demand for proprietary American alternatives, and diminishes the returns on thebillions of dollarsAmerican firms have invested in model development. For most of the past decade, the incentives facing Chinese AI companies and Beijing have reinforced one another, encouraging the open release of increasingly capable models. As Chinese labs approach the frontier, that alignment has begun to break down. Why the Frontier Is DifferentDespite the strategic and economic benefits open-weight releases provide China, Chinese officials are increasingly focused on the heightened risks frontier AI poses. President Xi Jinping has referenced “risks of technologicalloss of control,” and a major Chinese standards body has flagged the need for “circuit breakers” and “safety stop switches” for frontier models. In 2026 alone, Chinese regulators and technical standards bodies have rapidly expanded work on AIsafety standardsandrisk management frameworks. As AI governance monitor Concordia AI’s State of AI Safety in China (2026) report explains, China’s AI governance regime hasreorientedits priorities “from controlling what AI says to controlling what it does. ”Foreign heads of state and government, leaders of international organizations, and heads of delegations at the 2026 World AI Conference & High-Level Meeting on Global AI Governance, July 17, 2026. Credit:China’s Foreign MinistryThe risks Chinese officials have identified are especially pronounced for open-weight models, as releasing downloadable weights carries risks that closed models do not. Open releases remove a provider’s ability to control use after deployment, enable local modification and redistribution, and critically, cannot be recalled once released. OpenAI recently demonstrated why this matters when it paused an internally deployed model that hadcircumvented its sandbox restrictions, restoring access only after building new safeguards. An open-weight release offers no such recourse. An excerpt from findings from the National Institute of Standards and Technology Center for AI Standards and Innovation’s report on DeepSeek. Credit:NIST/CAISISafeguards on open-weight models can also easily be unraveled: researchers from Princeton Universitystripped much of the safety alignmentof Meta’s open-weight Llama 2 with just 10 harmful training examples and a few seconds of fine-tuning. Even without stripping safeguards, Chinese open models tend to be more vulnerable to attacks that enable misuse. The U. S. Center for AI Standards and Innovationfoundthat DeepSeek’s most secure model answered 94 percent of malicious requests under a common jailbreak, versus 8 percent for U. S. reference models. While Chinese experts broadly endorse the value of open source AI development, key institutions have acknowledged the heightened risks. Alibaba Research Institute, Tencent Research Institute, and China’s Academy of Information and Communications Technology (CAICT) have all recognized that open models increase thepotential for misuseby malicious actors. China’s top cybersecurity standards body also warned in its most recent AI Safety Governance Framework that open weights make it “easier for criminals to train malicious models. ”The Measurement ProblemThe official website for China’s ‘algorithm registry’. Credit:Central Cyberspace Affairs CommissionThe looming challenge lies in determining which models are safe to release openly and which should remain closed. In many ways, Beijing already runs the most elaborate AI regulatory apparatus in the world. It requires companies toevaluate their own models, albeit primarily on risks such as violation of core socialist values and creation of “discriminatory content. ” Those evaluations are thenreviewedby provincial regulators as well as the national Cyberspace Administration of China (CAC). If approved, the government then lists each model on apublic registry. Despite its strong regulatory regime, a capability-based distinction between open and closed models ultimately depends on the ability to determine when a model crosses adangerous capabilitythreshold — not justhallucination ratesorpro-democracy content. Despite China’s increasing focus on frontier risks, Beijing currentlylacksthe institutions or evaluation infrastructure needed to make dangerous capability determinations well. While a few think tanks and government-backed research organizations conduct safety evaluations on risks like jailbreak vulnerabilities, there is currently no formal government institution that conducts evaluations for dangerous capabilities. While the Chinese AI Safety and Development Association (CnAISDA) publiclystatesits intention to develop evaluation methods, it has not yet done so. On the lab side, only a few Chinese AI companies have published safety evaluation results for models, andnone have published evaluations for CBRN(chemical, biological, radiological, and nuclear) or “loss of control” risks, that President Xi himself hasreferred to. If Beijing opts for selective openness, it will have to decide where to draw the line using evaluation tools that remain underdeveloped. Without reliable ways to measure dangerous capabilities, some judgments may be wrong. And an open model that clears a badly drawn line proliferates globally, offering malicious actors anywhere the opportunity to adapt them for harmful uses such as cyberattacks or biological design. Washington cannot treat that risk as Beijing’s problem alone. Once a Chinese model’s weights are public, no government can control who uses them, and a misjudged release arms malicious actors against Chinese interests as much as American ones. The United States thus has a direct stake in the quality of China’s release decisions. One potential remedy is to establish a narrow channel of technical exchange on evaluation methods between the United States and China, the “protocol” for “best practices” that Treasury Secretary Scott Bessent floated after the May Trump-Xi summit. Researchers from frontier AI companies and government evaluation teams, either bilaterally or via anindependent, international body, could exchange approaches to capability evaluations, benchmark design, red-teaming techniques, and methods for assessing risks such as autonomous replication or CBRN misuse. Beyond improving China’s own evaluations, such exchanges could help establish ashared understandingof AI risks and dangerous capabilities, providing a foundation for future bilateral AI diplomacy. A clip from Xi Jinping’s speech given at the opening of the World AI Conference, July 17, 2026. Credit:CCTV NewsThe days when the frontier of AI went unregulated may quickly be ending, in Beijing as much as in Washington. President Xi maymock U. S. export controlson Anthropic’s models, but his government is unlikely to keep allowing open access to models with increasingly dangerous capabilities. Xi himself left room for that shift in his Shanghai speech, calling for vigilance and “an adaptive approach” to AI governance. The hard task for Beijing will be finding the narrow line between over-regulation and a dangerously permissive approach. If it miscalculates, the consequences could be global. That is reason enough for the two AI superpowers to compare notes while interests still align. Ruby Scanlon is a research associate for the Technology and National Security Program at the Center for a New American Security (CNAS), supporting the Center’s research on U. S. -China technology competition, China’s innovation ecosystem, and AI policy. Her analysis has featured in outlets includingThe New York Times,The Economist, andPolitico.