76% of attacks on China's open-source LLMs succeed - the safety gap in widely-deployed models

A structured red-teaming audit of China's top open-source LLMs found a 76% attack reproduction rate and zero consistent refusal behavior. These models are embedded in global production pipelines - the safety gap is not theoretical.

In plain terms: Security researchers ran known attacks against China's major open-source AI models. Three in four attacks worked. None of the models reliably said no to harmful requests. These models are embedded in products worldwide.

The fact

A structured security audit of China's leading open-source LLMs found 76% vulnerability reproduction across known attack vectors, with zero consistent refusal behavior documented across tested scenarios, according to Pandaily. Unlike closed-API models, open-weight models expose their weights directly - which makes bypassing safety alignment easier, since attackers can probe the model internals rather than just the API surface.

Our take

The 76% attack success rate is high but not surprising for open-weight models - alignment techniques that work at inference time are more easily circumvented when the weights are available. The "zero refusal" result is the more alarming data point: it suggests that safety training on these specific models is either absent or negligibly effective. The practical stakes are significant: China's open-source models (Qwen, DeepSeek, Kimi lineage) are integrated into third-party applications globally. An application developer who ships a product on top of an unaligned base model inherits the alignment gap. As EU AI Act compliance requirements and enterprise security reviews start demanding safety documentation for embedded models, this audit gives buyers a concrete question to ask their suppliers.

What to watch

Whether enterprise procurement teams start requiring safety audit documentation for open-weight models as a condition of deployment, alongside the existing SOC 2 / pen test requirements.