Can Chinese AI companies curb cyber risks from open-weight models without losing their edge?

China’s leading artificial intelligence model companies are beginning to curb the cybersecurity capabilities of their most advanced open-weight models, following a string of high-profile AI hacking incidents involving both US and Chinese companies.

Earlier this month, Chinese technology giant Tencent Holdings said it had stripped its latest Hy4 model of its cyber-hacking capabilities while retaining its cyber defence capabilities, following a similar move by Moonshot AI with its Kimi K3.1 Pro model in October.

The approach highlights the challenge Chinese AI firms face because their models are released as open-weight software, meaning that anyone with sufficient hardware can download and modify the models, even malicious actors.

Such risks of misuse are mounting as AI capabilities advance rapidly.

In September, US AI company Anthropic reported that Z.ai’s GLM-5.3 model could autonomously develop sophisticated cybersecurity exploits, approaching the performance of its own Claude Mythos Preview model, which it has restricted to only trusted security partners.

Anthropic, which is seeking a valuation of about US$1.3 trillion in a blockbuster initial public offering later this month, disclosed on Tuesday that internal AI systems were now roughly doubling how fast their models were improving, following an independent evaluation by AI safety organisation METR.

Instead of abandoning their open-weight approach, Chinese companies are instead choosing to selectively remove the cyber hacking capabilities in their models through data filtering. However, there are questions about whether this solution will be sustainable in the long-run, given continuing AI progress and competition among firms.

“Chinese AI companies want to offer all three model features: powerful, open-weight, with cyber safeguards baked in,” said Kyle Chan, a fellow at the Brookings Institution, a Washington-based think tank.

“[They] want to have their cake and eat it too. But they will likely face trade-offs with their approach to cyber safeguards.”

An emerging safety practice

Frontier AI systems have become powerful cyber-hacking tools as they have mastered coding and software development. The developers of closed models, such as OpenAI and Anthropic, mainly prevent misuse by malicious actors by monitoring users’ activity and banning those who violate terms of usage.

As open models can be deployed on local hardware, their creators cannot track all usage of their models. Instead, they are trying to make the models “safe by design” by removing the data that contains these cyber-hacking capabilities from the data sets used to train the models – one of the more promising approaches to managing the risks of open-weight models, said Gabriel Wagner, a researcher at Beijing-based AI safety organisation Concordia AI.

This could create models that would remain less useful to malicious actors even if they bypass the models’ inbuilt refusal safeguards, for example through jailbreaking or fine-tuning, Wagner said.

However, the technique should not be seen as a complete solution to the problem, according to Luke Li Xiaojian, co-founder and chief executive of Beijing-based AI safety company Fangcun AI. Malicious actors could still exploit the models, especially as cyber capabilities are dual-use, meaning that capabilities useful for cyber defence, such as vulnerability detection, can also be used for cyber hacking.

“A capability the model never learned is usually harder to bring back than one it was just trained to refuse,” he said. “But technically harder isn’t impossible.”

Analysts also described the developments at Tencent and Moonshot AI as an “emerging practice” rather than an established industry standard. “An industry standard would require wider adoption, comparable tests and clear release thresholds,” said Wei Sun, principal analyst for AI at Counterpoint Research. “We haven’t seen enough evidence of that yet.”

Wagner described the recent releases as evidence that China’s approach to open-weight risk management was “maturing”, but said developers were still experimenting with different safeguards, including staged releases, trusted-access programmes and training-data filtering.

The more cautious approach comes as “rogue” AI agents developed by frontier AI companies have breached government servers and rival companies. Last month, Tencent said that AI agents running on its cloud platform had displayed “unintended web-browsing behaviour” following reports that the agents had tried to extract data from Alibaba Group Holding’s Amap navigation service.

Both Tencent and Moonshot AI released their latest models in stages, with the open-weight version coming weeks after the closed-source version. Tencent has yet to make the open-weight version of Hy4 available, though it has said it will do so “soon”.

GLM developer Z.ai – also known as Zhipu AI – also adopted a staged-release approach for its GLM-5.3 model in August.

“They are kind of crossing the river by touching the stones,” Wagner said. Alibaba owns the South China Morning Post.

Trade-offs in competitiveness?

One of the major challenges of filtering out cyber hacking capabilities is the impact on overall model competitiveness, especially as US closed-source models were not doing the same, analysts said.

Moonshot AI acknowledged the trade-off in its announcement last month: its filtered model scored 81 per cent on an internal cybersecurity benchmark, compared with 90.5 per cent for a version trained without the restrictions.

“Excluding offensive cyber data in model training is likely to result in some sacrifice in capabilities,” said Chan from Brookings.

“It will get increasingly difficult for Chinese models to keep up on coding and agentic benchmarks while continuing to keep offensive cyber capabilities below a certain threshold.”

Still, while targeted restrictions could weaken the performance of Chinese models on specialised cybersecurity tasks, there is no evidence yet of a broader competitiveness penalty, Sun said.

“Broader competitiveness still depends on coding and agentic quality, reliability, cost and deployment flexibility,” she added.

The experimentation with new safety practices comes as Chinese authorities pay increasing attention to the frontier risks posed by advanced AI. In October, China’s Ministry of Commerce proposed export controls covering certain AI-related technologies, with additional restrictions for those that cross critical cyber-hacking thresholds.

The move likely encouraged Chinese companies to strengthen their safeguards, said Chan. However, the companies were unlikely to abandon open-source entirely, according to Sun, despite continued commercial pressures.