Arguments over the safety of Chinese open-weight AI models have reached a new intensity as the technology gains capability and popularity.
The Trump administration has discussed banning these tools but has not yet acted. Meanwhile, proprietary model makers like OpenAI and Anthropic express growing concern.
Open-weight models such as Moonshot AI’s Kimi K3 or Alibaba’s Qwen offer inference at a fraction of the token cost of closed source models from large U.S. labs. The fear is that they pose a threat. Certainly they threaten the profit margins of the large proprietary AI labs.
But should enterprises running these models in their own data centers succumb to the fear that they could be a vector for Chinese hackers?
No, says Lucas Atkins, the CTO of Arcee, which is building open models to give U.S. companies a homegrown alternative to Chinese models.
If any startup would benefit from a ban on Chinese models, Arcee would. But Atkins says China’s open models are no more dangerous than any other open source software a company may use. In fact, he says, they even offer benefits even to his own company.
“A lot of people view this as similar to a Chinese software program. Like, it was coded with these x, y, z intentions that a bad actor could simply command,” he said.
“That is fundamentally not how these models are trained. There is really not any way for an Arcee, or an Alibaba, to make a model, have someone run it in their own environment and for us have any access to it whatsoever,” he explained.
While most of these models are what’s known as “open weight” and are not really fully open source software, the source code (the part that will actually run on servers), if it is downloaded from open source sites like Hugging Face, is similarly largely visible and reviewable. (What isn’t available is the methods and data used to train the models.)
Large organizations should put any model core through their security testing and inspection processes, and they will also often post-train the models for their specific uses and can examine areas like bias, toxicity, hallucinations, and sensitivity to certain topics. So they work with, optimize, and understand the models before people start sending them prompts.
Could a model that is used for coding somehow throw malicious backdoors into the code it writes? Again, while that’s theoretically possible, it would require acrobatic feats to accomplish.
“There’s no reason that a sophisticated enough actor couldn’t train a model to be a completely amazing coding model in every circumstance, but when presented with a certain type of code base … some hidden training would kick in,” Atkins, who spends his days training models, postulated. But he adds: “I don’t know how you would do this.”
Because large language models are by nature creative, the odds are slim of getting a contemporary model to spit out malware in response to a preplanned perfect storm of context and prompt. Even slimmer are the chances that any enterprise would then use that code.
Could it happen in the future? That’s anyone’s guess. But enterprises are also building their AI apps to be model-agnostic and to use multiple models. So even if Chinese models are the best for the price today, enterprises won’t be locked into using them forever.
“I think instead of the conversation being about how to ban Chinese models, it should be about how do we foster a good, open ecosystem here in the U.S.,” Atkins says.
Arcee also gains advantages from Chinese models. Because they are open, the startup “benefits from those models being good because we can learn what they did. We can build on top of them. Then they can learn what we do,” he says. “We have tremendous respect for the people building those models, the individual researchers.”
Ultimately, the way to compete with Chinese models “is to release a model that is better,” says Atkins. “We need to give them something to talk about.”
What it means
For companies building AI applications, the immediate practical change is a shift in strategy. Instead of fearing foreign models, teams should focus on rigorous internal security testing and post-training processes. The threat of backdoors remains theoretical rather than practical. The real competitive advantage lies in releasing superior models rather than relying on bans or restrictions.
