How to Govern Chinese Open-Model Risks
Chinese AI models are gaining attention over the past weeks. Organizations are increasingly deploying open models in production to control token costs and keep their proprietary data in house. AT&T is one example, the company's Chief Data and AI Officer expects that open models to eventually power 70% to 80% of the company’s total AI usage. Another example is Harvey, the legal AI company made a similar move, releasing its own model, Tenet, which is post-trained on Kimi K3.
The pattern is clear: organizations are taking powerful new models out of China - GLM, Kimi, and Qwen among them and post-training them on their own corporate data. These models already perform well and give companies far more control over cost, privacy, performance, and customization than closed frontier models like GPT-5, Claude, or Gemini. But this shift also introduces a new set of risks and concerns around Chinese LLMs.
It’s important to note, security posture varies significantly by model, version, and even month, so the risks below shouldn't be read as a blanket verdict on every Chinese model. They illustrate the categories of risk any organization should evaluate before deploying.
The Risks
Agent HIjacking
An agent hijacking attack occurs when an AI agent processes untrusted content containing malicious instructions that redirect it from its intended goal. Since agents cannot reliably distinguish legitimate instructions from attacker-controlled content, attackers can manipulate their decisions, tool use, and multi-step behavior. The Open Worldwide Application Security Project (OWASP) ranks Agent Goal Hijack as the top agentic security risk.
For example, NIST's Center for AI Standards and Innovation (CAISI) evaluated Deepseek models and found that Agents based on DeepSeek’s most secure model (R1-0528) were on average 12 times more likely to follow malicious instructions than the U.S. frontier models.
Jailbreaks
A jailbreak uses a crafted prompt to bypass a model's safety guardrails and get it to produce harmful content it would normally refuse. For example, DeepSeek's most secure model responded to 94% of overtly malicious requests when a common jailbreaking technique was used, compared with 8% for U.S. reference models.
Supply-Chain Vulnerabilities
The software supply chain increasingly starts with the AI models used to generate, debug, and secure code. This creates a new risk: vulnerabilities or unwanted behaviors from an untrusted model can propagate into downstream software and eventually become difficult to trace back to their source.
Booz Allen found that Chinese LLMs tested produced significantly more vulnerable code when prompted as U.S. government users, with vulnerabilities that were highly obfuscated.
Backdoors
Another critical security risk is backdoors. A backdoor is hidden behavior deliberately trained into a model that activates only when a specific trigger appears. It can stay dormant through normal testing and only fire on an input nobody thought to test for. Research shows that backdoor behavior can be persistent and survive fine-tuning, reinforcement learning, and even adversarial training.
CCP (Chinese Communist Party) Censorship and Political Bias
Beyond security risks, Chinese LLMs can carry geopolitical or cultural biases. Chinese open-weight models may censor politically sensitive topics or reproduce state-aligned narratives, and these biases can affect more than what the model says. Booz Allen’s testing showed that Chinese LLMs exhibited People's Republic of China (PRC)-aligned political bias, including refusing politically sensitive requests and incorporating China-aligned perspectives into their outputs. CrowdStrike found an even more consequential effect: when DeepSeek-R1 was given politically sensitive contextual triggers such as Tibet, Uyghurs, or Falun Gong, its likelihood of generating code with severe security vulnerabilities increased significantly—in some cases by up to 50%.
What Does It Mean for Enterprise Governance
Open weights give you control over deployment, but they don’t guarantee alignment, trust, or safety. As Cisco highlights, inherited behaviors and risks can persist even after post-training.
Therefore, organizations must implement security steps:
- Evaluations - measure what the model does
Passing capability benchmarks doesn't mean a model is safe. Run dedicated evals for jailbreaks, prompt injection, and censorship to quantify the risk and re-run them on every new base or fine-tune.
- Red teaming - find new attack vectors
Evals catch known failure modes; red teaming probes for the ones you didn't think to test, surfacing novel jailbreaks before an attacker does.
- Model-level remediation - fix it at the source
Jailbreaks, censorship, and backdoors live in the weights. Neutralizing them at the parameter layer removes the root cause instead of masking it.
- Guardrails - protect interaction in runtime
Even a remediated model needs a perimeter for blocking misuse at runtime. But it's only a last line, since guardrails sit around the model and can be bypassed.
The order matters: evaluate, probe, fix at the source, then implement guardrails to ensure a secure, safe and trusted model before agents deploy into production.
How Hirundo Solves Open-Model Risks
Hirundo allows organizations to uncensor and harden their models to deploy safe and secure agents. It detects and unlearns problematic behaviors directly inside a model's weights - locating where issues like censorship actually live in the parameters and removing them surgically, without full retraining and with minimal impact on the model's capabilities.
Hardening models and removing embedded CCP censorship are among the capabilities Hirundo's platform offers. If you're deploying Kimi K3, Qwen, DeepSeek, or any other model in a production environment and want to understand your exposure or eliminate it - get in touch.
