Chinese artificial intelligence systems that anyone can download are closing in on the capabilities of leading Western models, but their safety protections can be removed by people without machine learning expertise, according to new research. The gap between open-weight models from companies like DeepSeek, Qwen, and Kimi and closed systems from OpenAI and Anthropic has held steady at roughly four months for the past year, meaning frontier-level AI capabilities are becoming increasingly accessible to the general public.

The concern is not just about capability parity. It is about what happens when users download these models and modify them. Andrew Yoon, head of research at the nonprofit CivAI, demonstrated the problem by asking an open-weight model how to make poliovirus in a laboratory to start a global pandemic. The model provided detailed instructions.

"It's pretty easy, even for people who are not machine-learning researchers, to go and strip away all of these guardrails so that they will help you go and do some pretty heinous crimes," Yoon warned.

Andrew Yoon, Head of Research at CivAI

How Are Chinese AI Models Catching Up So Quickly?

The speed of Chinese AI development reflects massive investment and strategic focus. Alibaba recently open-sourced Qwen 3.8, a frontier-scale model with 2.4 trillion parameters that anyone can download and self-host. This represents a significant shift in how cutting-edge AI technology reaches developers worldwide. Meanwhile, other Chinese companies have released their own open-weight systems, significantly lowering hardware barriers for smaller organizations wanting to deploy large language models (LLMs), which are AI systems trained on vast amounts of text data to understand and generate human language.

The democratization of AI technology has real benefits: developers in the Global South can now fine-tune these models for local languages at minimal cost, enabling applications in agriculture, medical consultation, and education. However, this same accessibility creates security challenges that governments are only beginning to address.

Why Are Safety Guardrails So Easy to Bypass?

Open-weight models ship with some built-in restrictions. If you ask an unaltered version of GLM 5.2 for help committing a terrorist attack, it will refuse. But these restrictions are not hardened against modification. Once users download the model weights, they can alter the system to remove safety constraints entirely.

The problem is structural. With closed models like ChatGPT or Claude, OpenAI and Anthropic control the entire technology stack: they build the model, own the weights, and serve the product. With open-weight models, one company builds the model and other companies host it on cloud servers, creating a fragmented responsibility chain. Most users cannot afford to run these models locally, so they rent access from cloud providers, paying by the token.

What Steps Could Governments Take to Address the Risk?

• Cloud Provider Monitoring: Require hosting companies to add a second layer of protection called classifiers, which are separate AI systems that monitor conversations in real time and block dangerous requests that the main model might allow. ChatGPT and Claude already use this approach.
• International Agreements: Establish agreements between the U.S. and China that neither country will allow companies to release model weights for systems capable enough to be repurposed for significant harm. The Chinese government has signaled openness to such restrictions.
• Expanded Government Review: The White House is preparing to extend its AI oversight framework to cover open-weight models once they reach frontier capability, moving beyond the current voluntary 30-day review process that applies only to closed models.

The Trump administration has been developing a testing regime requiring top American labs to submit new closed AI models for government review before release. However, open-weight developers were initially exempted from this requirement. That exemption is now under reconsideration as policymakers recognize the gap in oversight.

What Makes This Regulatory Challenge So Difficult?

Regulating open-weight models is fundamentally harder than regulating closed ones. Once model weights are publicly released, pre-release review becomes a courtesy rather than a control mechanism. The biggest open-weight developers are Chinese companies not subject to U.S. regulation, meaning American oversight tools have limited reach.

The White House is grappling with how to define "frontier capability" in a way that meaningfully catches dangerous models without stifling legitimate open-source development. Yoon noted that today's open-weight Chinese models are probably safe. His concern is the next generation. He pointed to Anthropic's Claude Mythos, announced in April and withheld from public release, and to new OpenAI systems highly capable at hacking. "If you had an open weight model at that level of capability, it would be an absolute Pandora's box situation," he said.

Yoon

The stakes extend beyond security. Some in the AI industry fear that expanded government oversight could push customers toward "government-approved" closed alternatives, concentrating power among a handful of Western companies. The coming months will reveal whether the U.S. and China can find common ground on open-weight AI governance, or whether the technology will continue to advance faster than policy can adapt.