Because Western AI labs\u00a0won\u2019t\u2014or\u00a0can\u2019t\u2014anymore. As OpenAI, Anthropic, and Google face mounting pressure to restrict their most powerful models, Chinese developers have filled the open-source void with AI explicitly built for what operators need: powerful models that run on commodity hardware.<\/p>\n
A new security\u00a0study\u00a0reveals just how thoroughly Chinese AI has captured this space.\u00a0Research published by SentinelOne and Censys,\u00a0mapping\u00a0175,000 exposed AI hosts across 130 countries over 293 days, shows\u00a0Alibaba\u2019s\u00a0Qwen2 consistently\u00a0ranking\u00a0second only\u00a0to\u00a0Meta\u2019s\u00a0Llama in global deployment.\u00a0More tellingly, the Chinese model appears on 52% of systems running multiple AI models\u2014suggesting\u00a0it\u2019s\u00a0become the de facto alternative to Llama.<\/p>\n
\u201cOver the next 12\u201318 months, we expect Chinese-origin model families to play an increasingly central role in the open-source LLM ecosystem, particularly as Western frontier labs slow or constrain open-weight releases,\u201d\u00a0Gabriel Bernadett-Shapiro, distinguished AI research scientist at SentinelOne, told TechForge\u00a0Media\u2019s\u00a0AI News.<\/p>\n
The finding arrives as OpenAI, Anthropic, and Google face regulatory scrutiny, safety review overhead, and commercial incentives pushing them toward API-gated releases rather than publishing model weights\u00a0freely.\u00a0The contrast with Chinese developers\u00a0couldn\u2019t\u00a0be sharper.<\/p>\n
Chinese labs have demonstrated what Bernadett-Shapiro calls\u00a0\u201ca willingness to publish large, high-quality weights that\u00a0are explicitly optimised\u00a0for local deployment, quantisation, and commodity hardware.\u201d<\/p>\n
\u201cIn practice, this makes them easier to adopt, easier to run, and easier to integrate into edge and residential environments,\u201d\u00a0he added.<\/p>\n
Put simply: if\u00a0you\u2019re\u00a0a researcher or developer wanting to run powerful AI on your own computer without a massive budget, Chinese models like Qwen2 are often your best\u2014or only\u2014option.<\/p>\n
Pragmatics, not ideology<\/p>\n
Alibaba\u2019s Qwen2 consistently ranks second only to Meta\u2019s Llama across 175,000 exposed hosts globally. Source: SentinelOne\/Censys<\/p>\n
The research shows this dominance\u00a0isn\u2019t\u00a0accidental. Qwen2 maintains what Bernadett-Shapiro calls\u00a0\u201czero rank volatility\u201d\u2014it holds the number two position across every measurement method the researchers examined: total observations, unique hosts, and host-days.\u00a0There\u2019s\u00a0no fluctuation, no regional variation, just consistent global adoption.<\/p>\n
The co-deployment pattern is equally revealing. When operators run multiple AI models on the same system\u2014a common practice for comparison or workload segmentation\u2014the pairing of Llama and Qwen2 appears on 40,694 hosts, representing 52% of all multi-family deployments.<\/p>\n
Geographic concentration reinforces the picture. In China, Beijing alone accounts for 30% of exposed hosts, with Shanghai and Guangdong\u00a0adding another\u00a021% combined.\u00a0In the United States, Virginia\u2014reflecting AWS infrastructure\u00a0density\u2014represents 18% of hosts.<\/p>\n
China and the US dominate exposed Ollama host distribution, with Beijing accounting for 30% of Chinese deployments. Source: SentinelOne\/Censys<\/p>\n
\u201cIf release velocity, openness, and hardware portability continue to diverge between regions, Chinese model lineages are likely to become the default for open deployments, not because of ideology, but because of availability and pragmatics,\u201d\u00a0Bernadett-Shapiro explained.<\/p>\n
The governance problem<\/p>\n
This shift creates what Bernadett-Shapiro characterises as a\u00a0\u201cgovernance inversion\u201d\u2014a fundamental reversal of how AI risk and accountability\u00a0are distributed.<\/p>\n
In platform-hosted services like ChatGPT, one company controls everything: the infrastructure, monitors usage, implements safety controls, and can shut down\u00a0abuse. With open-weight models, the control evaporates. Accountability diffuses across thousands of networks in 130 countries, while dependency concentrates upstream in a handful of model suppliers\u2014increasingly Chinese ones.<\/p>\n
The 175,000 exposed hosts operate entirely outside the control systems governing commercial AI platforms.\u00a0There\u2019s\u00a0no centralised authentication, no rate limiting, no abuse detection, and critically, no kill switch if misuse is detected.<\/p>\n
\u201cOnce an open-weight model is released, it is trivial to remove safety or security training,\u201d\u00a0Bernadett-Shapiro noted.\u201dFrontier labs need to treat open-weight releases as long-lived infrastructure artefacts.\u201d<\/p>\n
A persistent backbone of 23,000 hosts\u00a0showing 87%\u00a0average uptime drives the majority of activity.\u00a0These\u00a0aren\u2019t\u00a0hobbyist experiments\u2014they\u2019re\u00a0operational systems providing ongoing utility, often running multiple models simultaneously.<\/p>\n
Perhaps most concerning:\u00a0between 16% and 19% of the infrastructure\u00a0couldn\u2019t\u00a0be attributed to any identifiable owner.\u201dEven if we are able to prove that\u00a0a model was leveraged\u00a0in an attack, there are not well-established abuse reporting routes,\u201d\u00a0Bernadett-Shapiro said.<\/p>\n
Security without guardrails<\/p>\n
Nearly half (48%) of exposed hosts advertise\u00a0\u201ctool-calling capabilities\u201d\u2014meaning\u00a0they\u2019re\u00a0not just generating text. They can execute code, access APIs, and interact with external systems autonomously.<\/p>\n
\u201cA\u00a0text-only model can generate harmful content, but a tool-calling model can act,\u201d\u00a0Bernadett-Shapiro explained.\u00a0\u201cOn an unauthenticated server, an attacker\u00a0doesn\u2019t\u00a0need malware or credentials; they just need a prompt.\u201d<\/p>\n
Nearly half of exposed Ollama hosts have tool-calling capabilities that can execute code and access external systems. Source: SentinelOne\/Censys<\/p>\n
The highest-risk scenario involves what he calls\u00a0\u201cexposed, tool-enabled RAG or automation endpoints being driven remotely as an execution layer.\u201d\u00a0An attacker could\u00a0simply\u00a0ask the model to summarise internal documents, extract API keys from code repositories, or call downstream services the model\u00a0is configured\u00a0to access.<\/p>\n
When paired with\u00a0\u201cthinking\u201d\u00a0models optimised for multi-step reasoning\u2014present on 26% of hosts\u2014the system can plan complex operations autonomously. The researchers identified at least 201 hosts running\u00a0\u201cuncensored\u201d\u00a0configurations that explicitly remove safety guardrails, though Bernadett-Shapiro notes this represents a lower bound.<\/p>\n
In other words, these\u00a0aren\u2019t\u00a0just chatbots\u2014they\u2019re\u00a0AI systems that can take action, and half of them have no password protection.<\/p>\n
What frontier labs should do<\/p>\n
For Western AI developers concerned about maintaining influence over the\u00a0technology\u2019s\u00a0trajectory, Bernadett-Shapiro recommends a different approach to model releases.<\/p>\n
\u201cFrontier labs\u00a0can\u2019t\u00a0control deployment, but they can shape the risks that they release into the world,\u201d\u00a0he said. That includes\u00a0\u201cinvesting in post-release monitoring of ecosystem-level adoption and misuse patterns\u201d\u00a0rather than treating releases as one-off research outputs.<\/p>\n
The current governance model assumes centralised deployment with diffuse upstream supply\u2014the exact opposite of\u00a0what\u2019s\u00a0actually happening.\u00a0\u201cWhen a small number of lineages dominate\u00a0what\u2019s\u00a0runnable on commodity hardware, upstream decisions get amplified everywhere,\u201d\u00a0he explained.\u00a0\u201cGovernance strategies must acknowledge that inversion.\u201d<\/p>\n
But acknowledgement requires visibility. Currently, most labs releasing open-weight models have no systematic way to track how\u00a0they\u2019re\u00a0being used, where\u00a0they\u2019re\u00a0deployed, or whether safety training remains intact after quantisation and fine-tuning.<\/p>\n
The 12-18 month outlook<\/p>\n
Bernadett-Shapiro expects the exposed layer to\u00a0\u201cpersist and professionalise\u201d\u00a0as tool use, agents, and multimodal inputs become default capabilities rather than exceptions.\u00a0The transient edge will\u00a0keep churning\u00a0as hobbyists experiment, but the backbone will\u00a0grow\u00a0more stable, more capable, and\u00a0handle\u00a0more sensitive data.<\/p>\n
Enforcement will remain uneven because residential and small VPS deployments\u00a0don\u2019t\u00a0map to existing governance controls.\u00a0\u201cThis\u00a0isn\u2019t\u00a0a misconfiguration problem,\u201d\u00a0he emphasised.\u00a0\u201cWe are observing the early formation of a public, unmanaged AI compute substrate. There is no central switch to flip.\u201d<\/p>\n
The geopolitical dimension adds urgency.\u00a0\u201cWhen most of the\u00a0world\u2019s\u00a0unmanaged AI compute depends on models released by a handful of non-Western labs, traditional assumptions about influence, coordination, and post-release response become weaker,\u201d\u00a0Bernadett-Shapiro said.<\/p>\n
For Western developers and policymakers, the implication is stark:\u00a0\u201cEven perfect governance of their own platforms has limited impact on the real-world risk surface if the dominant capabilities live elsewhere and propagate through open, decentralised infrastructure.\u201d<\/p>\n
The open-source AI ecosystem is globalising, but its centre of gravity is shifting decisively eastward. Not\u00a0through any coordinated strategy, but through the practical economics of\u00a0who\u2019s\u00a0willing to publish what researchers and operators actually need to run AI locally.<\/p>\n
The 175,000 exposed hosts mapped in this study are just the visible surface of that fundamental realignment\u2014one that Western policymakers are only beginning to recognise, let alone address.<\/p>\n
See also: Huawei details open-source AI development roadmap at Huawei Connect 2025<\/p>\n
Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the Cyber Security & Cloud Expo. Click here for more information.<\/p>\n
AI News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
\nThe post Exclusive: Why are Chinese AI models dominating open-source as Western labs step back? appeared first on AI News.<\/p>\n","protected":false},"excerpt":{"rendered":"
Because Western AI labs\u00a0won\u2019t\u2014or\u00a0can\u2019t\u2014anymore. As OpenAI, Anthropic, and Google face mounting pressure to restrict their most powerful models, Chinese developers have filled the open-source void with AI explicitly built for what operators need: powerful models that run on commodity hardware. A new security\u00a0study\u00a0reveals just how thoroughly Chinese AI has captured this space.\u00a0Research published by SentinelOne [\u2026]<\/p>\n
The post Exclusive: Why are Chinese AI models dominating open-source as Western labs step back?<\/a> appeared first on AI News<\/a>.<\/p>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[1,66,67,21,68,69],"tags":[3],"class_list":["post-1127","post","type-post","status-publish","format-standard","hentry","category-ai-and-ml","category-ai-and-us","category-ai-in-action","category-artificial-intelligence","category-deep-dives","category-features","tag-ai"],"yoast_head":"\n