What is the risk of using Chinese open AI models like Kimi K3?

The writer is a senior fellow at New America and the Institute for America, China, and the Future of Global Affairs at Johns Hopkins University

Earlier this month, I sat in the Radiohead-themed conference room of Beijing start-up Moonshot and watched a demonstration of its powerful new Kimi K3 AI model. Founder Yang Zhilin, a music fan, named his company for Pink Floyd’s album Dark Side of the Moon — a fitting reference to uncharted yet high-reward territory.

Within China, the surprise release of Kimi K3 has been hailed as another chance for the country to flex its tech expertise at the expense of US rivals. More US companies are opting to lower their costs by switching to cheaper, high-performing Chinese open AI models such as K3, Z.AI’s GLM, DeepSeek’s R-1 and Alibaba’s new Qwen 3.8 Max.

“Saves us millions of $ and we’re actually seeing an *increase* in performance on many core use cases. Transformative,” wrote Flo Crivello, CEO of San Francisco-based digital assistant platform Lindy AI, which switched to DeepSeek this year.

What is the security risk of using open-source AI models created by foreign companies? Washington seems focused on surveillance, IP theft, espionage and potential Chinese involvement in critical domestic infrastructure. The White House is reportedly exploring tools to curb the spread of, or even sanction, open Chinese models. The debate may look like a stand-off between national security and innovation, but it is not quite that simple.

The first point to make is that asking whether a model has been developed by a Chinese company is the wrong question for those concerned about security.

Open-source models such as Kimi K3 allow the parameters (the numbers learnt in training that determine how an AI model uses information to predict what comes next) to be downloaded and run by anyone. Companies download the weights, fine-tune the model and then run it on their own cloud or infrastructure.

What matters more, therefore, is who owns and operates…