Red Lines

A detailed assessment of the current capabilities, design choices, and security vulnerabilities of systems from China’s seven leading AI developers (Alibaba, Baidu, DeepSeek, MiniMax, Moonshot, Tencent, and Zhipu) reveals threats that are concrete and, in several cases, immediate. Chinese systems can already contribute meaningfully to offensive cyber operations. Ideological alignment with the CCP is deepening with every new model. DeepSeek-based agents are 12 times more likely to follow malicious instructions than their U.S. counterparts.⁴ These findings underscore why this report argues for understanding risk in absolute terms, focusing on what Chinese systems can do, not just how far behind they are.

The report offers six policy recommendations:

1. The Department of Commerce should publish national security risk assessments of Chinese advanced AI systems no more than 72 hours after their release.
2. The Cybersecurity and Infrastructure Security Agency should issue cybersecurity alerts and advisories on Chinese advanced AI systems and establish the AI Information Sharing and Analysis Center called for in the AI Action Plan.
3. The Department of Commerce should establish security testing best practices for cloud service providers that deploy and monitor AI models developed by untrusted third parties.
4. The Department of Energy should use the Genesis Mission to establish a classified adversarial testing program for Chinese advanced AI systems.
5. The Department of State should convene monthly meetings with a core group of U.S. allies to share information on China’s AI ecosystem and coordinate collective action.
6. The Department of Commerce should publish semiannual reports on the state of China’s AI ecosystem to inform policy action and congressional oversight.

Introduction

China’s Spring Festival traditionally marks a time for renewal—to reconnect with family, present one’s best self to the world, and look forward to the year. The holiday has accordingly become a showcase of China’s artificial intelligence (AI) power. In the weeks surrounding Lunar New Year 2026, Chinese AI developers released a volley of new systems that demonstrated the breadth and strategic ambition of the country’s AI ecosystem. The February 11 release of Zhipu’s GLM-5 kicked off the holiday season with a new 744-billion-parameter system compatible with Huawei chips that scored just behind GPT-5.2 and Claude Opus 4.5 on popular coding benchmarks.⁵ Moonshot, ByteDance, and Alibaba all released upgraded systems of their own over the following weeks.⁶

Model releases were only part of the story. Each system was released with open weights under permissive licenses. Each was offered via application programming interface (API) at a fraction of the cost of its American equivalent. And each was available for download by anyone in the world. Tencent, ByteDance, Alibaba, and Baidu used the same holiday to run an AI adoption war, embedding their chatbots into red envelope giveaways, the China Central Television Spring Festival Gala, and e-commerce workflows. Tencent’s Yuanbao chatbot passed 50 million daily active users during the holiday alone.⁷ The frenzy intensified in March, when OpenClaw, an open-source agent framework, went viral across China as millions of users connected it to Chinese models such as Qwen to automate everyday tasks—prompting every major Chinese technology company to launch its own version within days.⁸

Behind the symbolism of releasing new models around the Spring Festival lies a dynamic ecosystem that now fields at least seven Chinese developers producing systems that pose serious national security challenges for the United States. The Chinese Communist Party (CCP) treats the advanced AI emerging from this ecosystem as essential to its military modernization, political control, economic ambitions, and global influence. The recently released 15th Five-Year Plan reinforces this priority, listing AI as the top “frontier technology” ahead of quantum computing, fusion energy, and other fields.⁹ Beyond indigenous innovation, the CCP seeks advantage across every segment of the AI supply chain—in software through adversarial distillation (training on the outputs of superior U.S. models to replicate their capabilities at a fraction of the cost), in hardware through access to banned chips, and in integration by privileging partnerships between Chinese firms.

The Trump administration’s July 2025 AI Action Plan included some initial direction to grip the challenge of Chinese AI.¹⁰ It called on the U.S. government to evaluate national security risks in frontier Chinese models, strengthen the enforcement of AI compute export controls, align protection measures with allies, and promote mature federal capacity for AI incident response. But execution has not kept pace with ambition. As of publication, the Department of Commerce has published only three assessments of Chinese AI models, all delayed weeks or months after the models were released and the technical analyses had been completed. No Chinese AI developer has been subject to U.S. government sanctions of any kind since 2024. Allied coordination remains limited and ad hoc. Meanwhile, the direct threat to Americans has escalated. Chinese AI systems are powering cyber campaigns against U.S. infrastructure, embedding CCP ideology into software adopted by millions, and creating espionage vulnerabilities that Chinese security services are uniquely positioned to exploit.¹¹

In September 2025, Director of the Office of Science and Technology Policy Michael Kratsios warned the UN Security Council that “the improper use of AI systems can erode deterrence, create destabilizing effects, and reinforce systems of political control and social engineering.”¹² China’s advanced AI systems do all three, posing risks to national security across three domains: kinetic, where they enhance military and cyber capabilities; cognitive, where they enable censorship, surveillance, and espionage; and economic-technological, where they drive industrial dominance, threaten to dominate commercial platforms, and create dependencies.

These risks are not incidental features of model design. They flow from the nature of the CCP, a party that collapses the boundaries between the party and society and that views AI as an instrument of political control, economic dominance, and great-power competition. These risks reach the United States and its allies through two vectors: direct state instrumentalization by the CCP, and proliferation and dependency as Chinese systems spread globally through open-weight release, aggressive pricing, and integration into critical infrastructure.

The lack of clarity over these risks has been fed in part by the Western AI community’s fixation on U.S. frontier systems. The most rigorous research and most consequential regulatory interventions have focused almost exclusively on American developers, inflating the risks of technology built under the rule of law while giving China’s developers a free pass. The result is an analytical vacuum at the center of the AI policies of the United States and its allies.

The report makes the case for measuring these risks in absolute terms based on what Chinese systems can already do, not just how far behind they trail their U.S. peers. The prevailing “AI race” framing obscures whether Chinese systems have crossed specific capability thresholds that endanger American security. This report assesses the capabilities, vulnerabilities, and design of AI systems from China’s seven leading developers, pegging them to actual use cases where feasible. A Chinese AI system that can conduct an autonomous cyber campaign, suppress dissent at scale, or lock developing countries into Chinese infrastructure threatens U.S. national security regardless of whether an American system is better. Policy built on relative rankings breeds complacency when the U.S. lead grows and defeatism when the gap narrows. Policy built on understanding absolute capabilities produces specific objectives and sharper tools.

Section I of this report situates AI risks to U.S. national security within the CCP’s broader strategic logic, providing a framework for understanding these risks. Section II assesses the current capabilities, design choices, and security vulnerabilities of advanced AI systems from China’s seven leading AI developers across this framework. The recommendations subsection of Section III offers six policy prescriptions, most of which are designed to close analytical gaps that unclassified and classified testing, allied coordination, and public reporting could address, but that the U.S. government has not yet prioritized.