Four of the five leading open-weight models in 2026 come from Chinese labs. The capability gap with Western frontier models is closed. Here is what to actually evaluate — and what most of the discourse is pointing at incorrectly.
Four of the five leading open-weight models in mid-2026 come from Chinese labs: DeepSeek, Moonshot AI (Kimi), Zhipu/Z.ai (GLM), and Alibaba (Qwen). This is not a “things are catching up” observation. GLM-5’s 77.8% on SWE-bench Verified outperforms Gemini 3 Pro. DeepSeek V4 Pro’s 80.6% on the same benchmark is within a percentage point of Claude Opus 4.6 at 80.9%. The capability gap is closed.
The question has shifted. It is no longer whether to consider these models. It is which one, for which workload, under what deployment and licensing constraints. Both the advantages and the risks are real. They are also more specific, and more resolvable, than the public discourse suggests.
The clearest mistake in how most teams evaluate this category is collapsing compliance risk, security risk, and output-quality risk into a single “China models: yes or no” verdict. They are different columns on the risk matrix, and they respond to completely different controls. Getting that distinction wrong leads to either blanket avoidance of genuinely useful tools or blanket acceptance of a profile you have not actually examined.
The current open-weight field has genuinely differentiated by workload rather than converging on identical strengths. The four leading families and what distinguishes each:
Reading benchmark numbers carefully matters here specifically. Different labs report against different suites — SWE-bench Verified versus the newer and harder SWE-bench Pro — so a direct number comparison across vendors misleads unless you check which suite produced it. GLM-5.2’s 81.0 on Terminal-Bench 2.1 and Kimi’s top position on the Artificial Analysis Intelligence Index are measuring different things from DeepSeek’s 80.6% on SWE-bench Verified. Treat any single benchmark figure as a starting filter for which models to evaluate, not a final selection criterion. The consistent practitioner advice: run a real-task evaluation on your actual codebase or workflow before committing.
The licensing landscape is clearer than the family-level reputation suggests. Qwen (Apache 2.0), DeepSeek (MIT), and GLM (MIT) carry genuinely permissive commercial licences — no royalties, no usage caps, fine-tunable for enterprise deployment. The specific exception worth calling out: Kimi K3 shipped under a custom licence that most teams assumed was MIT and is not. Read the actual licence text of any specific model release before you build a product on it, not the family’s general reputation.
Three of the four advantages below apply specifically to the open-weight, self-hosted deployment model. The fourth applies regardless of how you deploy.
DeepSeek-R1 was reportedly trained for under $6 million using 2,000 H800 chips over 55 days. That is a genuinely different cost structure from Western frontier training runs, and the efficiency carries through to inference cost when self-hosted. Qwen3.6-27B runs on a single consumer GPU at 77.2% SWE-bench Verified — beating some models that require far more hardware. This is not a marginal advantage in cost-sensitive or hardware-constrained contexts.
Apache 2.0 and MIT licences on three of the four families mean commercial deployment and fine-tuning with zero royalties. For enterprise fine-tuning in particular, GLM-5.1’s MIT licence is a material differentiator from options that carry revenue gates or usage caps. The Kimi K3 exception applies here too — verify the specific release, not the family headline.
Because weights are public, you can run any of these models entirely on your own infrastructure. No data leaves your environment. No dependency on a hosted API’s uptime, pricing changes, or terms-of-service updates. This is a genuinely different trust model from a closed, cloud-only frontier service — and as the risk section below shows, it directly resolves the most commonly cited concern about this model category.
The field has differentiated meaningfully. Kimi and GLM are purpose-built for long-horizon coding agents and multi-step tool-use loops. DeepSeek’s pro tiers and Qwen’s flagship cover general reasoning and breadth. Qwen’s 119-language support leads the field for multilingual work. GLM’s long-context variants handle full contracts and regulatory filings in a single pass. Choosing by task fit rather than a blanket “best model” gives you better results at lower cost.
Most of the public risk analysis on Chinese LLMs collapses three separate risk categories into a single verdict. Separating them gives a more useful picture — because they respond to different controls, and because one of them disappears entirely when you self-host.
If you use a Chinese lab’s hosted API or chat product — not a self-hosted open-weight download — your data may be subject to Chinese data-governance law and processed on servers you do not control. This is the specific concern that led Italy’s data protection authority to block DeepSeek’s hosted service outright. It is a jurisdiction question, not a technology question. It disappears entirely when you self-host the open-weight model. The weights carry no jurisdiction — the hosted service does.
A 2026 academic study (NDSS) found persistent content-blocking mechanisms in several major Chinese LLM hosted services — operating at the input, output, and search phases — tied to Chinese regulatory compliance requirements. This is a hosted-service-layer behaviour. Whether the same constraints apply when running the open-weight model independently is worth testing directly if factual neutrality on specific topics matters for your use case. Do not assume it away, and do not assume it applies to the self-hosted model without checking.
A 2026 Booz Allen study reported that several Chinese coding models produced more vulnerable code when the prompt implied a US government end user. Treat this as an early, single-study signal rather than a settled finding — but it is concrete enough to be worth an independent code review pass on any security-sensitive output from these models, regardless of how the underlying research resolves. This is an output-quality concern, not a backdoor claim.
Claims of hidden backdoors or covert command-and-control channels in open-weight models are a theoretical, largely unproven concern. Worth taking seriously in critical-infrastructure contexts where stakes justify caution against unproven risk — not a well-established demonstrated threat for typical business workflows. Direct comparative security analysis of open-weight models finds no inherent security difference tied purely to geopolitical origin. The actual security surface is the harness running the model — whatever bridges it to your environment — not the weights’ country of origin. Treat sensational framing on this specific claim with real scepticism until backed by reproducible, independently verified findings.
The most useful framing: match the model to the sensitivity of the data it will touch, and the deployment model to that same sensitivity — not a blanket yes/no on “Chinese models.” A self-hosted, open-weight model running on non-sensitive workloads carries a meaningfully different risk profile from a hosted Chinese API handling client-confidential data. Treating those as the same decision is where most of the current public analysis goes wrong.
Personal prototyping, non-sensitive data
Any of the four families. Pick by task fit (Section 01 above).
Client or committee data involved
Self-host the open-weight model. The jurisdiction risk is the hosted service, not the weights.
Factual neutrality on sensitive topics
Test directly before relying on it — hosted services specifically carry documented content-moderation behaviour.
Security-critical code generation
Independent code review regardless of model choice; extra scrutiny given the Booz Allen signal.
Commercial licensing required
Qwen (Apache 2.0), DeepSeek or GLM (MIT). Verify the specific model release, not just the family.
Building a product on Kimi
Read the actual K3 licence text — it is not MIT despite common assumption.
US congressional committees announced in July 2026 they would examine growing enterprise use of Chinese AI models. This is a live regulatory conversation, not a settled one — particularly for client-facing or regulated work. Worth monitoring over the next six to twelve months before making permanent decisions about regulated use cases specifically.
The models are good enough. The decision is whether you are deploying them in a way that matches your actual risk profile.
DeepSeek AI · arXiv 2025
The full technical report behind DeepSeek-R1 — shows exactly how a Chinese lab matched frontier reasoning at a fraction of the reported cost.
Mustafa Suleyman · Crown Currency
By the co-founder of DeepMind and current CEO of Microsoft AI — a serious argument about AI containment that doesn't flinch from the geopolitical dimension.
François Chollet · arXiv 2019
Reframes what we mean by AI capability and benchmarking — useful context for evaluating open-weight model claims with appropriate skepticism.
Continue the conversation
If this changed how you think about it — or you think I'm wrong — I want to know.
Corrections, disagreements, and applications all welcome. Replies go directly to Chris.
Get in touch →EAST OF CLOSED
~6-8 min1× · Two speakers · tap to play