Are China’s increasingly powerful open-weight AI models a cybersecurity threat, or could restricting them ultimately make the internet less secure?

The dilemma has become a growing concern as Chinese developers including DeepSeek, Z.ai and Alibaba Group Holding – owner of the South China Morning Post – continue to challenge their American rivals by releasing models that anyone can download, modify and deploy.

The growing impact of advanced AI on global cybersecurity has also forced governments and cybersecurity agencies across the world to scramble to shore up their digital defences, with this week’s uncovering of critical vulnerabilities in the internet programming language PHP just the latest example.

Critics warn that open-weight models allow malicious actors to easily strip away safety protections and use advanced AI to launch sophisticated cyberattacks. But other researchers argue that the same technology could help proliferate the cyber defence capabilities of AI systems more widely to counter emerging threats.

The debate has intensified following a report by US artificial intelligence start-up Anthropic that found Z.ai’s open-weight GLM-5.3 model had crossed critical thresholds for conducting sophisticated cyberattacks, similar to its own Claude models, while lacking the very safeguards that are possible due to Claude models being closed-source.

Yet researchers remain divided over whether the technical risks associated with open-weight AI translate into greater real-world harm, and whether the distinction between open and closed models is the right way to assess their dangers.

“Open models present different governance challenges than closed models, but that does not necessarily make them more dangerous,” said Kristy Loke, a fellow at MATS Research focusing on China’s AI innovation and governance strategies. Open-weight models inherently have a larger attack surface for misuseEdward Yee, AI safety researcher At the heart of the debate is a fundamental difference in how developers control their technology.

Closed models are typically accessed through application programming interfaces, or APIs, allowing developers to monitor suspicious activity, restrict requests and revoke access when necessary.

Open-weight models, by contrast, allow users to download the underlying parameters and run the systems independently, but they also mean malicious actors can remove safeguards designed to prevent harmful activities.

Edward Yee, researcher and chief growth officer at US-based AI safety organisation Far.AI, said open-weight structures create a significant security disadvantage. “Open-weight models inherently have a larger attack surface for misuse,” Yee said.

While closed models can rely on multiple layers of protection such as external monitoring systems, open-weight models depend primarily on safeguards embedded in the models themselves, which can often be removed through techniques such as “abliteration” – a technique that involves editing a model’s internal weight matrices to bypass its refusal mechanisms.

As open-weight models are widely released, their model weights cannot effectively be recalled, even if developers subsequently discover dangerous capabilities. Attackers could therefore gain unrestricted access to models without the protections their original developers deployed, Yee said.

The implications could become more serious as open-weight models approach the capabilities of the most advanced closed systems. While evidence of widespread harm remains limited, Yee said the lack of comprehensive data should not be mistaken for proof of safety, particularly because open models can be deployed on private servers, without knowledge of the authorities or the model developers themselves, making them difficult to monitor.

The most serious concerns relate to misuse of AI systems by non-state actors, with both Washington and Beijing expressing willingness to jointly combat such risks in recent weeks. On Thursday, Tech Against Terrorism – a counterterrorism non-profit organisation backed by the United Nations – released its latest findings showing that closed models “do far better” than open models at refusing to help terrorists with planning an attack, while “abliterated” open models comply easily.

Still, the ability to remove safeguards in open-weight models on paper does not necessarily translate into greater real-world harm, researchers cautioned.

“Real-world harm is no longer theoretical, but so far the evidence doesn’t show that releasing the weights is what makes the difference,” said Oskar Galeev, a researcher at Beijing-based AI safety consultancy Concordia AI.

Galeev said attackers tend to use whichever AI systems best suit their needs, turning to proprietary models for their capabilities and open-weight alternatives when they are cheaper or less restrictive.

“Attackers tend to shop around. They don’t care much about the theoretical distinction between closed and open-weight,” he said.

Even when open-weight models are used in cyberattacks, malicious actors may access them through commercial AI platforms without downloading their weights or removing safeguards. This makes it difficult to establish whether the availability of model weights contributed to an attack, Galeev added.

“For now, open and closed models fail in different ways, so neither is safe by default,” Galeev said.

“The right question is not whether a model is open or closed, but what extra risk a specific model release adds,” he added.

Daniel Kokotajlo, a former OpenAI researcher and author of the AI 2027 forecasting project, said a model’s capabilities mattered more than whether its weights were publicly available.

“I would not say that open-weights models are inherently more dangerous,” he said. “All models are dangerous in proportion to how capable they are.”Loke warned that closed models could pose greater risks as frontier AI developers pursued techniques such as recursive self-improvement, in which AI systems progressively improve their own capabilities, making human oversight more difficult. Complicating the debate is the dual-use nature of AI’s cybersecurity capabilities.

The same technology that helps attackers discover software vulnerabilities can also help security researchers identify and fix weaknesses before they are exploited.

Open-weight models offer defenders several advantages. They can be deployed on local servers, adapted to specialised tasks and used to analyse sensitive systems without sending confidential information to external providers.

Clement Neo, founder of NEO Research, a Singapore-based frontier AI safety evaluation group, warned that banning open-weight models could backfire on safety.

Blanket restrictions on open models would likely hurt defenders more than attackersClement Neo, founder of NEO Research“Open-weight models are a major asset for cybersecurity,” he said. “Blanket restrictions on open models would likely hurt defenders more than attackers.”In a high-profile cyber hacking incident in July involving OpenAI’s GPT models, researchers at the affected company Hugging Face turned to a Chinese open-weight model – Z.ai’s GLM 5.2 – to investigate the breach after safeguards on closed US models refused to assist due to the companies’ built-in safeguards.

Researchers cited the incident as an example of how open models could benefit defenders when proprietary systems struggle to distinguish legitimate security research from malicious activity.

Open-weight models could also be particularly valuable to smaller organisations that lack the resources to purchase expensive proprietary tools or develop their own AI systems, according to Joshua Saxe, co-founder of US start-up Abundant Security and former tech lead in AI security at Facebook owner Meta Platforms.

Such models could allow companies to deploy affordable defensive systems across their software and infrastructure, identifying vulnerabilities before attackers exploit them.

“There’s also an institutional asymmetry: criminals don’t have procurement departments, compliance committees, or lengthy AI governance processes. Defenders do,” Saxe said.

“We’re in an adoption race as much as a capability race. Restrictions that slow defenders more than attackers could leave us less secure,” he added.

Kokotajlo, the former OpenAI researcher, said the benefits of open-weight AI models had so far outweighed their costs.

Open-weight’s transparency made it harder for developers to embed hidden agendas in the technology than in proprietary systems, whose inner workings were less accessible to outside scrutiny, he said.

While open-weight models provide “real benefits” to defenders, Yee said the benefits should still be weighed against the risks.

For some developers in China, running open-weight models locally has proven essential for security investigations.

When investigating suspicious application server activity, Shenzhen-based independent AI engineer Wen Sheng found cloud-based AI services accessed via an API unhelpful.

“The hosted model refused to analyse logs containing attack commands,” Wen said, without specifying which model. Switching to Z.ai’s GLM-5.3 model on his own server allowed his team to “reconstruct the sequence of events without uploading logs or internal credentials”, making it a boost for privacy as well.

While running the open-weight model on his own server required managing hardware, permissions and updates internally, Wen noted the added control made the effort worthwhile.

“Using a closed model is like renting a house: the provider holds the keys, sets the price and can lock you out,” said Shawn Lin, who leads a data annotation team at a major Chinese technology company in Shenzhen.

“When we run an open-weight model on our own infrastructure, we can keep sensitive data in-house and decide how the system is used,” Lin said.

“The practical question is who can access our data, what gets logged and whether we can keep using a model version that works for our workflow.”The debate carries particular significance for the China-US AI race, where China’s open-weight releases have become a central strategy for competing with better-funded American rivals.

Contrary to suggestions that China’s open-weight approach comes at the expense of safety, Chinese researchers and developers have been taking steps to address its risks, researchers said.

China’s national information security standardisation body, TC260, has begun drafting a security standard for open-weight AI models, recognising that safeguards can be removed once models are released.

Chinese AI companies are also developing their own approaches to managing these risks. Z.ai has worked with Concordia AI on a safety framework addressing the specific challenges of open-weight releases.

The framework distinguishes between dangerous capabilities that warrant restrictions regardless of whether a model is open or closed, and additional risks arising specifically from making model weights publicly available.

“While critics of open models are afraid of the democratisation of advanced cyber capabilities, many in China believe that this democratisation is precisely what is needed,” said Concordia’s Galeev. China supports open models precisely because it recognises that they empower cybersecurity defence, he added.

The challenge is finding ways to preserve those benefits as open-weight models become increasingly capable, researchers said.

Galeev said models should be evaluated after their safeguards have been removed, rather than relying solely on safety tests conducted under normal operating conditions. Developers could also consider staged releases, initially providing access through controlled interfaces or to trusted researchers before making the weights more widely available.

Yee of FAR.AI questioned whether the defensive benefits actually require unrestricted public release, or if providing access to trusted researchers and defenders under controlled conditions would suffice. Open-weight models currently take an extreme approach – offering “near-zero safeguards” and “maximum access for both defensive use but also offensive abuse,” he said.

Saxe, the former AI security tech lead at Meta, said the industry should focus more on restricting malicious users than the models themselves.

Stronger coordination among AI service providers to identify abusive users, share intelligence and terminate accounts, alongside measures to monitor access to advanced computing infrastructure, could help curb misuse without limiting legitimate access, he said.

“The goal should be to restrict attackers, not models, wherever possible,” Saxe said.

“AI gives us an extraordinary opportunity to find and repair vulnerabilities across the world’s enormous software infrastructure. We should be hardening as much of it as possible, as quickly as possible.”