An American Answer to China's Open Si Models: A Safe Harbor for Open Weights

Download PDF

An American Answer to China’s Open SI Models: A Safe Harbor for Open Weights

Photo: Michael Markieta/Moment via Getty Images

Chinese labs are now the global default for open-weight Super Intelligence (SI). This means that the calculations governing the SI model (the final “weights”) have been made public and can be customized by users to adjust the model to their own needs. Developers who want a model that they can download, modify, and run themselves increasingly start with Qwen or DeepSeek. Unfortunately for the United States, these models are built by firms subject to Beijing’s laws and content rules, which come with security and free-speech tradeoffs that make many Americans uneasy. Independent testing has found these models are far easier to jailbreak (prompting an SI model into ignoring its safety guardrails or other internal constraints) and hijack than American ones, and several write less secure code depending on the identity of the user.

A chief reason why developers use these Chinese models is because American open releases are voluntary and one-off occurrences, leaving developers unable to plan around future releases. The leading SI labs do not open even their older models to the public, in part because they fear distillation (a technique in which a smaller model is trained to replicate the behavior of the more sophisticated model).

And yet, those same labs are asking Congress for an antitrust safe harbor—a legal provision that protects companies from liability or penalties—to cooperate on security threats, including Chinese theft and distillation of their models.

We propose a trade: Labs that claim the safe harbor from antitrust would commit to releasing capable open-weight versions of their models on a predictable schedule, once those models pass independent risk evaluations.

We think of this as a pact with two complementary sides. One side is pro-security and the other is pro-competition. The labs would get legal room to cooperate with each other on safety and against theft and distillation at what is called “the frontier”—the most advanced SI system(s) available at a given time. In return, the public gets a wider and more dynamic SI ecosystem underneath, built on American technology. This is a settlement of political economy. It involves a market intervention, but a minimally impairing one. And this settlement is far better than the alternatives for keeping the U.S. on the frontier, and keeping China from dominating open-weight SI.

Chinese models win today largely on price. Because their weights are public, any company with servers can use them and offer them to their customers, from cloud giants like Amazon and Microsoft to specialist firms like Together AI and Fireworks, and users can run them on their own hardware. Competition among those hosts pushes prices toward the cost of computing. Regular releases of American weights would extend that dynamic, giving firms more reason to choose American models over Chinese ones.

It is not sufficient for the U.S. to lead the world on the SI frontier. Its global advantage must extend across the entire SI stack, including open-weight models, where China is gaining a stronghold based in part on state subsidies and other policy interventions.

The policy approach set out below can boost American participation in the open-weight market and make American technology the foundation the rest of the world builds on. It also expands on Manhattan Institute’s broader case that diffusion and competition is the right policy frame for SI. This also advances our overall aim of extending competition across the SI stack while enhancing safety at the frontier.

Meeting these policy-design requirements is challenging: open-weight model releases must be strong enough to beat Chinese alternatives, safe enough to publish, and not present IP threats to existing firms. We argue such a zone exists, even if it is narrow.

Open-weight models can be downloaded, adapted, and run on users’ own hardware, often making them the foundation for startups, universities, hospitals, and governments with privacy concerns. Whoever supplies these models shapes what the world builds on top.

China now leads in the use of these models. Hugging Face, the dominant platform where developers share and download SI models, found in its spring 2026 report that Chinese open-weight models accounted for 41% of downloads on the platform (compared to 36.5% for American models) between February 2025 and February 2026. In almost every month of 2026, the largest Chinese open release exceeded the largest American one in parameter count. They are also the foundation of more spin-offs: Qwen has 151,448 derivative models on Hugging Face, 2.6 times Meta’s total footprint. Chinese labs also license more generously: among releases above 20 billion parameters, 81% of Chinese models carry Apache 2.0 or MIT licenses, against 29% of American ones.

This model proliferation translates into actual use. On OpenRouter, which routes developers’ requests to many models, Chinese open-weight models rose from 1.2% of tokens in late 2024 to nearly 30% in peaks of 2025, according to a study by OpenRouter and a16z. By April 2026, Chinese labs handled more than 45% of weekly token volume. American startups increasingly build on Chinese models because they are cheap and easy to adapt, and some of the largest American open releases this year are themselves built on Chinese foundations.

The Hugging Face episode this summer reflected the growing U.S.-China open-weight gap. When the company suffered a sustained intrusion by an autonomous SI agent in July 2026 (later shown to be agents from OpenAI), safeguards on frontier models blocked their team’s requests for help analyzing the attack. Hugging Face finished the job with GLM-5.2, a Chinese open-weight model it could run on its own servers.

The closed frontier’s lead is also shrinking. The UK AI Security Institute finds that the best open Chinese models trail the closed frontier (in which a model’s underlying code and model weights are still secret) on cyber tasks, such as finding and exploiting software flaws, reverse-engineering code, or breaking into web applications, by only 4 to 7 months, down from 6 to 10 in 2025.

The first risk that the spread of Chinese open-weight models poses to the U.S. is security. In its 2025 evaluation of DeepSeek, the National Institute of Standards & Technology’s Center for AI Standards and Innovation (CAISI) found that the Chinese lab’s most secure model complied with 94% of overtly malicious requests using common jailbreaks, compared to just 8% for American reference models. In addition, the agents built on DeepSeek were an average of 12 times more likely to be hijacked than agents built on the American models GPT-5 or Opus 4.

An open-weighted model is not inherently a weaker, less secure model. In the CAISI study, OpenAI’s open-weight gpt-oss model matched or exceeded every DeepSeek model’s resistance to hijacking. Developing a model that is easy for malicious users to jailbreak, then, is perhaps a deliberate decision of model design and public policy on the part of China.

The second risk is hidden in the code that these models write. In 2025, CrowdStrike found that mentioning politically sensitive topics such as Tibet or the Uyghurs made the Chinese model DeepSeek-R1 up to 50% more likely to write code with severe security flaws, such as passwords embedded in the code or careless handling of user input that an attacker could exploit. This occurred even when the topic had nothing to do with the coding task assigned to the model. In June 2026, Booz Allen reported that three-out-of-four Chinese coding models it tested wrote more vulnerable code when told the user worked for the U.S. government. One model, Qwen3-Coder, produced code with a vulnerability score 130% higher than before it knew the identity of the U.S. user.

The third risk is one of propaganda. Beijing’s official views travel with the model. CAISI found that DeepSeek models echoed four times as many inaccurate and misleading Chinese Communist Party narratives as American models, even when the model weights were downloaded from Hugging Face and in the English language. Products built on these models for an English-speaking and U.S.-based audience necessarily inherit those biases.

The fourth risk is covert manipulation. Chinese labs operate under a PRC law obliging cooperation with state intelligence work. Furthermore, users cannot verify how a Chinese model was trained. SI developers rely on enormous amounts of text and documents to train their models. If even a small subset of those training documents are written to sabotage the model, it can have serious consequences. Research from Anthropic and the UK AI Security Institute shows that as few as 250 poisoned documents can plant a hidden “backdoor” vulnerability in a language model. Models can also be seeded with sleeper instructions that only activate under certain conditions.

Verifying that open-weight models do not contain these kinds of malicious instructions is challenging if not impossible. There is no public evidence of a state-planted backdoor in a Chinese model, but as these models enter critical systems, including American water and electrical infrastructure, among many others, the burden of proof should not rest on the user.

Finally, China’s lead in open-weight SI draws heavily on American work. Chinese labs have used fraudulent accounts to distill American frontier models, then released the results as open weights. White House science adviser Michael Kratsios has said China’s Moonshot AI distilled Anthropic’s Fable model to build Kimi K3, and in September 2026 the National Security Agency and other agencies warned of “industrial-scale” distillation by Chinese firms. American labs are still superior: The Institute for Progress estimates that adversarial distillation erases about half of America’s lead over China in SI capabilities, roughly the same boost as giving Chinese labs four times as many chips as they have today. And greater use of these open-weight models incentivizes further IP theft from American companies.

American labs have released their own open-weight models: Google’s Gemma, Meta’s models, NVIDIA’s Nemotron, and OpenAI’s gpt-oss are capable and widely used. In addition, in July 2026, NVIDIA, Microsoft, and others launched an Open Secure AI Alliance. Thinking Machines unveiled a 975-billion-parameter open model in July, Meta released Muse Glimmer in August and said it would open the weights of Muse Spark 1.2, and NVIDIA keeps expanding its Nemotron family. That is welcome, and it shows demand for the models. But these releases are one-off choices, and the leading closed labs do not open their flagship lines, even after their primary model is superseded by another. As a result, there is presently no dependable American open-weight pipeline. Developers cannot plan investments or build their company’s software and services around an SI model family that may not have a successor.

To be clear, China is not competing on a level field. Among its subsidies and policy distortions, local governments have issued compute vouchers worth roughly $140,000 to $280,000 to their SI startups, on top of the structural economics that make open models cheap to serve. Washington is now weighing its own policy response. The 2025 AI Action Plan calls for encouraging American open weights, and Sen. Jim Banks has asked the administration to develop incentives that limit dependence on Chinese open-weight models.

Direct subsidies are a potential policy tool, but they are slow. Funding new open models through grants or an agency like DARPA means training models from scratch, which takes time. A safe harbor works with models that already exist. Labs have already trained them, and releasing these models costs far less than buildin