Chinese open-weight AI models have quietly become the dominant choice for enterprises running their own AI infrastructure, but this shift has created a security blind spot that most organizations haven't addressed. Models like DeepSeek, Qwen, and Kimi now account for 46.4% of routed token usage on OpenRouter, a major AI routing platform, up from just 4.5% a year earlier. The appeal is straightforward: these models cost 60 to 90 percent less to run than leading US alternatives, and organizations can deploy them on their own hardware without relying on external APIs. But moving AI from the cloud into your own data center transfers all security responsibility to you, and most enterprises aren't prepared for that shift.

Why Are Chinese Open-Weight Models Winning Market Share So Quickly?

The economics are compelling. When DeepSeek released its V3 model in late 2024, it claimed to have trained the system for roughly $5.6 million using 2,048 Nvidia H800 chips, a fraction of the hundreds of millions spent on comparable Western models. At the same time, the quality gap between the best open-weight models and closed proprietary systems has nearly vanished. Stanford's 2025 AI Index found that the performance difference between leading open and closed models on the Chatbot Arena leaderboard fell from 8% in January 2024 to just 1.7% by February 2025. When the second-best option costs a fraction of the first and performs nearly as well, the premium for closed access becomes harder to justify.

Pricing has collapsed even faster than quality has converged. The cost to run a query equivalent to OpenAI's GPT-3.5 dropped from about $20 per million tokens in November 2022 to $0.07 by October 2024, a roughly 280-fold decline in under two years. For enterprises processing millions of tokens daily, that difference translates to millions of dollars in annual savings. Add in the ability to run models on-premises, avoiding vendor lock-in and maintaining control over sensitive data, and the business case for self-hosting becomes almost irresistible.

What Security Risks Come With Running Your Own AI Models?

The problem is that powerful AI infrastructure is being downloaded and deployed like consumer software, often without the security team knowing about it. A researcher at Cisco Talos scanned the public internet for just ten minutes and found 1,139 exposed Ollama endpoints, a popular tool for running local AI models. Of those, 214 answered model queries with no authentication at all, and 36.6% were located in the United States. Those are just the deployments visible from outside your network. The ones inside corporate firewalls are harder to count and far more numerous.

When a model runs on your infrastructure, you own every layer beneath the prompt: the model artifact itself, the inference runtime that loads it, the authentication system, network exposure, patching, guardrails, and every tool or agent connected to it. Traditional security tools like data loss prevention (DLP) systems, endpoint detection and response (EDR) platforms, and security information and event management (SIEM) systems all have structural blind spots when it comes to local AI. An AI gateway can inspect traffic routed through it, but local inference never leaves the host. DLP can catch data moving to sanctioned cloud services, but it cannot see context assembled in-process on a developer's laptop. EDR can identify that Ollama is running as a process, but it cannot tell you which model loaded or what data it can reach.

How to Secure Self-Hosted AI Models in Your Organization

• Inventory and visibility: Map every instance of self-hosted AI running on your network, including which models are loaded, which agents are calling them, what tools are connected, and what data they can access. Shadow deployments are the norm, and you cannot secure what you cannot see.
• Model provenance and supply chain security: Understand that loading a model can mean loading executable software from external repositories, including configuration files, tokenizers, custom Python modules, and secondary weights. A malicious model or a compromised dependency can execute arbitrary code during initialization with the privileges of the inference runtime.
• Runtime hardening: Treat inference servers like production services, not experimental utilities. Keep Ollama, vLLM, llama.cpp, and related tools patched and updated. These components sit beside valuable data and powerful compute, and they have a growing history of critical vulnerabilities including remote code execution flaws.
• Agent and tool isolation: When a local model is connected to agents, tools, credentials, data sources, and other agents, the risk compounds exponentially. A coding agent that can read source code, access cloud credentials, search internal documentation, and run shell commands creates a reachability problem that traditional gateways and DLP systems cannot see.
• Runtime intelligence and memory analysis: Deploy security tools that can report what an application actually loaded and executed at runtime, not just what a configuration file claims should be running. A model can be pinned to an audited revision while its runtime behavior still depends on mutable artifacts loaded from the default branch.

The model supply chain is an execution path, not just a file download. In 2026, a critical vulnerability in vLLM (CVE-2026-41523) showed that a malicious model could execute arbitrary code during initialization if Python was running in optimized mode, where assertion statements are stripped out. A separate advisory (CVE-2026-47155) revealed that revision pins were not consistently applied to every artifact a model loads, meaning a deployment could look reviewed and pinned while its runtime behavior still depended on mutable components. Configuration tells you what should be running. Security needs independent evidence of what actually loaded.

Why Are Governments Backing Open-Weight Models?

The shift toward open-weight models is not just economic; it is also political. Governments increasingly view dependence on a handful of American or Chinese APIs as a strategic risk. In September 2025, Switzerland released Apertus, a fully open model trained on 15 trillion tokens across more than 1,000 languages, developed by EPFL, ETH Zurich, and the Swiss National Supercomputing Centre. The United Arab Emirates has shipped successive Falcon models under permissive terms since 2023, and France, India, Japan, and South Korea have all backed domestic model or compute programs. You cannot build sovereign AI on a model you are only allowed to rent. Open weights are the precondition for national independence in AI, and that makes governments natural patrons of the open camp.

This geopolitical dimension explains why the shift is accelerating. When OpenAI released its first open-weight models on August 5, 2025, under the permissive Apache 2.0 license, it was a direct concession to the pressure that open-weight models now apply. The company that built the closed API business had to answer the open camp on its own turf. The frontier still belongs to the big labs, and the risks of open-weight models are real. But the direction of travel has been consistent for three years, and it runs against the closed, metered model.

For security teams, the challenge is clear: powerful AI is now infrastructure, and it is being deployed faster than traditional security controls can adapt. The models themselves may be Chinese, but the real risk is that enterprises are running production AI workloads outside the visibility of their security teams, with incomplete guardrails, weak authentication, and connections to sensitive data and privileged tools. Until organizations build security practices designed for self-hosted AI, that risk will only grow.