As Chinese open-weight AI models continue to advance in both capability and popularity, the debate over how to handle them has once again intensified. There are discussions that the Trump administration might consider banning them, though no concrete action has been taken yet. Meanwhile, proprietary model developers, especially OpenAI and Anthropic, appear increasingly uneasy about these developments. Open-weight models like Moonshot AI’s Kimi K3 or Alibaba’s Qwen offer inference at a fraction of the token cost compared to closed-source models from major U.S. labs. The concern is that they could also represent some form of threat. Certainly, they pose a risk to the profit margins of large proprietary AI labs. But should enterprises running these models in their own data centers give in to fears that they could serve as a vector for Chinese hackers? No, says Lucas Atkins, the CTO of Arcee, a company building open models to provide U.S. businesses with a domestic alternative to Chinese options. If any startup would benefit from a ban on Chinese models, it would be Arcee. Yet Atkins argues that China’s open models are no more dangerous than any other open-source software a company might use. In fact, he says, they even offer advantages to his own company.

“A lot of people view this as similar to a Chinese software program. Like, it was coded with these x, y, z intentions” that a bad actor could simply command, he said. “That is fundamentally not how these models are trained. There is really not any way for an Arcee, or an Alibaba, to make a model, have someone run it in their own environment and for us to have any access to it whatsoever,” he explained. While most of these models are what’s known as “open weight” and are not truly fully open-source software, the source code—the part that actually runs on servers—if downloaded from open-source platforms like Hugging Face, is largely visible and reviewable. (What isn’t available are the methods and data used to train the models.)

Large organizations should put any model core through their security testing and inspection procedures. They also often post-train the models for specific applications and can examine areas such as bias, toxicity, hallucinations, and sensitivity to certain topics. This means they work with, optimize, and understand the models before people start sending them prompts. Could a coding model somehow inject malicious backdoors into the code it generates? While theoretically possible, achieving this would require extraordinary effort. “There’s no reason that a sophisticated enough actor couldn’t train a model to be a completely amazing coding model in every circumstance, but when presented with a certain type of code base … some hidden training would kick in,” Atkins, who spends his days training models, speculated. But he adds: “I don’t know how you would do this.”

Because large language models are inherently creative, the odds of getting a contemporary model to produce malware in response to a preplanned perfect storm of context and prompt are slim. Even slimmer are the chances that any enterprise would then use that code. Could it happen in the future? That’s anyone’s guess. However, enterprises are also building their AI applications to be model-agnostic and to use multiple models. So even if Chinese models are currently the best for the price, enterprises won’t be locked into using them forever. “I think instead of the conversation being about how to ban Chinese models, it should be about how do we foster a good, open ecosystem here in the U.S.,” Atkins says. Arcee also benefits from Chinese models. Because they are open, the startup “benefits from those models being good because we can learn what they did. We can build on top of them. Then they can learn what we do,” he says. “We have tremendous respect for the people building those models, the individual researchers.”

Ultimately, the way to compete with Chinese models “is to release a model that is better,” says Atkins. “We need to give them something to talk about.”