As Chinese open-weight AI models increase in capability and attract more users, debate has flared about how to respond. U.S. policymakers have discussed restrictions (though no action has been taken), and proprietary model makers including OpenAI and Anthropic have expressed concern. Chinese open-weight offerings such as Moonshot AI’s Kimi K3 and Alibaba’s Qwen deliver inference at a fraction of the token cost of many closed-source U.S. models, threatening margins for large proprietary labs.
But do these models present a unique security vector for enterprises running them in-house? Lucas Atkins, the chief technology officer of Arcee, says no.
Why they aren’t a special threat, according to Arcee
Arcee is building open models to provide U.S. companies a domestic alternative to Chinese models. Atkins notes that if any startup would benefit from a ban on Chinese models, Arcee would — yet he maintains that these models are no more dangerous than other open-source software:
- Atkins argues that the models are not built as remote-activatable trojans. "There is really not any way for an Arcee, or an Alibaba, to make a model, have someone run it in their own environment and for us have any access to it whatsoever," he said.
- While many of these models are described as "open weight" rather than fully open-source, the runtime code (the code that actually runs on servers) is often downloadable and reviewable from open repositories such as Hugging Face. What is not open is the training data and the exact training methods.
Corporate controls: testing, post-training, and model diversity
Atkins says large organizations should subject any model core to their normal security testing and inspection processes. Companies commonly post-train (fine-tune) models for their specific uses and examine them for bias, toxicity, hallucinations, and sensitivity to particular topics. In that way, they work with and understand models before staff start sending production prompts.
Could a code-generating model embed malicious backdoors into the code it writes? Atkins calls this theoretically possible but practically difficult:
- "There’s no reason that a sophisticated enough actor couldn’t train a model to be a completely amazing coding model in every circumstance, but when presented with a certain type of code base … some hidden training would kick in," Atkins—who spends his days training models—posited. He added, however: "I don’t know how you would do this."
- Because large language models are inherently creative, the odds of a contemporary model spitting out malware triggered by a preplanned perfect storm of context and prompt are slim, and even slimmer that a company would then use that code.
Outlook: build an open ecosystem and better models
Could new risks emerge in the future? Possibly. But enterprises are building AI applications to be model-agnostic and to use multiple models, so a low-price Chinese model today does not permanently lock organizations into that provider.
Atkins argues the conversation should focus less on banning Chinese models and more on fostering a healthy, open U.S. ecosystem. He also notes Arcee benefits from the openness of Chinese models: because they are available, Arcee can study what they did, build on top of them, and the Chinese model builders can learn from Arcee in turn. "We have tremendous respect for the people building those models, the individual researchers," he said.
Ultimately, Atkins says the way to compete is straightforward: release a better model. "We need to give them something to talk about."
