The race to build powerful artificial intelligence is creating an uncomfortable dilemma for developers: how do you make AI capable enough to defend computer systems without making it equally effective at attacking them?
China’s leading AI companies are now experimenting with an answer. Rather than abandoning open-weight AI models, they are attempting to remove their most dangerous cyber-hacking capabilities while preserving their usefulness for cybersecurity research and defence.
The shift follows growing concerns about AI systems that can independently identify software vulnerabilities, develop exploits and execute sophisticated cyber operations.
In November 2026, Tencent announced that it had removed offensive cyber capabilities from its latest Hy4 model while retaining defensive cybersecurity functions. Moonshot AI had adopted a similar strategy with its Kimi K3.1 Pro model in October.
The idea: Remove dangerous capabilities before AI reaches users.
Unlike closed AI systems, open-weight models allow developers and organisations to download model weights and run them on their own hardware. This provides greater flexibility, but also makes monitoring difficult. Once released, developers cannot reliably track who is using the model or what modifications are being made.
Companies are therefore exploring a technique called training-data filtering. It involves removing or limiting offensive cybersecurity knowledge during training, making it harder for a model to acquire dangerous capabilities in the first place.
According to AI safety researchers, this approach could offer stronger protection than simply instructing a model to refuse harmful requests. Refusal mechanisms can sometimes be bypassed through jailbreaking or fine-tuning, whereas capabilities deliberately excluded during training may be harder to restore.
However, the approach is not foolproof. Cybersecurity is inherently dual-use. The same knowledge that helps an AI detect vulnerabilities and protect networks can potentially help attackers exploit them.
Security comes at a competitive cost.
Moonshot AI’s experiments illustrate the trade-off. Its restricted model reportedly scored 81% on an internal cybersecurity benchmark, compared with 90.5% for an unrestricted version.
That difference raises a difficult question: can Chinese developers maintain their competitiveness in coding and autonomous AI agents while deliberately limiting certain technical abilities?
The challenge is particularly significant as US companies, including Anthropic and OpenAI, increasingly restrict access to their most capable models through controlled-release programmes.
Meanwhile, Anthropic has warned that advanced AI systems are approaching the ability to develop sophisticated cyber exploits autonomously.
China’s emerging safeguards also come amid greater government scrutiny of frontier AI risks and proposed export controls covering certain AI-related technologies.
The bigger question is whether selective openness can last.
For now, staged releases, restricted access and training-data filtering offer possible compromises. But as AI models become more capable, maintaining a reliable boundary between cyber defence and cyber offence may become increasingly difficult.
The future of open-weight AI may not depend on how much developers are willing to release, but on how intelligently they can control what their models are capable of doing.
