China’s AI Cyber Split: The Public Model Isn’t the Model That Can Attack

Developers have been passing around a story lately: Chinese large models are about to weaken their cybersecurity offense and defense capabilities across the board. The versions vary. Some say regulators will issue a dedicated management measure. Some say Zhipu and Kimi’s open-source releases have already made the move. Some screenshots show DeepSeek quietly beta-testing a “Cyber model” available only to select users.

Take those claims apart and you get a mix: some already landed, some in limited beta, some speculation. One line is clear. High-level offensive cybersecurity capability is being peeled out of general-purpose Chinese models and moved into real-name, auditable dedicated channels.

The regulation is not a single document. It is four things that already happened.

No document titled “Management Measures for LLM API Security” has been formally issued. But since the second half of 2026, four things have happened in sequence.

In mid-October, the Ministry of Commerce and the Ministry of Science and Technology, in a draft export-control solicitation, placed “AI-driven malicious code generation technology” on the prohibited export list and “AI-assisted vulnerability discovery technology” on the restricted export list. Offensive security capability was moved into the framework of technology export controls.

Around the same time, the Cyberspace Administration of China’s “Qinglang” special campaign added “using AI for penetration and intrusion, malicious sample generation” to its list of targets for heavy enforcement.

Multiple local cyberspace administrations summoned LLM operators in October to discuss algorithm security and content controls.

Earlier, the Central Cyberspace Affairs Commission’s 15th Five-Year Plan for Informatization included security measures related to “LLM vulnerability discovery.”

Four events, four different issuing bodies, one result: indiscriminately offering high-level offensive cybersecurity capability to the public is not permitted under current conditions. Vendors did not wait for a single document to land before adjusting. They made choices, actively or semi-actively, under this set of signals.

Kimi has already changed. DeepSeek is in limited beta.

Kimi, from Moonshot AI, is the public case. When Kimi K3.1 Pro was released, high-end cyberattack and exploit-related content was removed from its training corpus and reinforcement-learning environment, while general coding capability was retained. Internal benchmarks showed exploit-task pass rate dropping from 90.5% to 81.0%. In the same benchmark, the vulnerability-remediation subscore rose from 58% to nearly 95%.

The contrast matters. Attack pass rate fell. Defensive remediation score rose. “Generating attack payloads” and “analyzing code defects and writing patches” are not the same thing at the data level. Remove the former and the latter can survive, even perform better, because there is less safety-refusal interference.

DeepSeek’s situation is limited beta. On October 30, developers found an application entry point and API logic in DeepSeek’s front-end code. The model identifiers were cyber-personal-v3 for the personal edition and cyber-enterprise-v4 for the enterprise edition. The personal edition requires ID card plus face verification. The enterprise edition requires a business license and authorization letter. Common thresholds are a real-name account, a mainland China phone number, and no violations in the past 90 days. After approval, a dedicated Cyber Key is issued, and calls go through that key.

The entry point is not in the public menu, and DeepSeek has not announced it. The code is real. Splitting cybersecurity capability into a separate model and using a real-name key for access and traceability is already happening at DeepSeek.

The claim that “DeepSeek-V4.1-Flash is the last Chinese open-source model with full offensive and defensive capability” is community speculation. It has no official basis and should not be treated as a conclusion.

Will the cut damage everyday debugging? It depends on how the cut is made.

The line in the rumor that worries ordinary developers most is this: remove security data and everyday code review and debugging will be ruined too.

That worry is intuitive but not technically inevitable. A 2026 study compared safety-aligned and refusal-ablated states on vulnerability-analysis tasks across the same lineage of Gemma and Qwen. On Qwen, removing refusal alignment raised line-level F1 for vulnerability localization from 2.08% to 3.91%. On Gemma, the refusal-ablated state had a 67.8% pass rate at the early patch-validation stage, versus 29.9% for the aligned state. That metric measures whether the patch can be successfully applied and compiled, not whether it fixes the problem well. The same study noted that over-alignment causes functional degradation, with functional loss in automated program repair reaching as high as 77%.

Those numbers do not support a one-line conclusion like “safety alignment improves coding” or “safety alignment weakens coding.” They show that alignment method, data mix, and task type interact in complex ways. Equating “removing security data” with “ruining debugging” is not accurate.

If a vendor removes only “how to generate attack payloads” corpus while retaining “how to locate logic defects” and “how to write remediation patches” data, core everyday debugging capability can be preserved. Kimi’s case provides an existence proof: attack pass rate fell, remediation score rose.

The scenario that takes the real hit is “one sentence to a runnable exploit.” Ordinary developers writing business code, reading error messages, and fixing bugs are farther from that scenario than they might think.

The open-source problem: someone picked the lock within 48 hours.

The “DeepSeek V4.1 Flash Cyber” variant was not released by the company. It came from the community after open weights were released.

DeepSeek V4.1 Flash was released on September 10. Within 48 hours, a weight-level ablation variant appeared on HuggingFace. Safety guardrails were removed, HarmBench pass rate jumped from the base model’s 1.56% to 100%, and general capability barely moved. Multiple Abliterated versions followed. Some service providers began offering paid exploit-reproduction agent services built on the fine-tuned variant.

That is the technical version of a lock that stops law-abiding users, not bad actors. Real-name registration, Cyber Keys, and enterprise certification block people going through official channels. Once weights are open-sourced, the community can strip safety restrictions with ablation at low cost. The cleaner the official version, the more room community ablation variants have to exist. The hard part of open-source security governance is not before release. It is after release. You cannot take back weights already released.

Three tiers are forming.

Put the pieces together and you get a three-tier structure.

Tier one: public general-purpose APIs and open-source models. Defensive capability is retained. Offensive capability is suppressed. Kimi K3.1 Pro is the sample for this tier. General coding, code audit, and vulnerability remediation remain available. The threshold for directly generating attack payloads is raised.

Tier two: dedicated channels. DeepSeek’s beta Cyber model, enterprise certification, personal real-name verification, and Cyber Keys redistribute high-level offensive and defensive capability to qualified entities, with accountability tracing attached. The capability has not disappeared. It has a different entrance and threshold.

Tier three: the open-source ablation gray zone. Abliterated variants on HuggingFace and paid proxy services serve a small group with technical skill and willingness to bear legal risk. This tier will not disappear because of official tightening. It will become more dispersed.

For ordinary developers, everyday ability to write code, read errors, and fix bugs is unlikely to fall off a cliff. What becomes less convenient is “casually asking the model to write an attack script.” For the security industry, the capability gap between independent white hats and small teams on one side and large companies with dedicated models on the other will widen. For the open-source ecosystem, the cleaner the official version, the more incentive community ablation variants have to exist.

Closing

Back to the original rumor. The core claim is right: regulatory signals are tightening at multiple levels, and leading vendors are peeling offensive security capability out of general-purpose products and putting it into real-name, traceable dedicated channels. DeepSeek’s Cyber beta is the latest point on that line.

Two corrections are needed. The policy form is dispersed signals driving vendor behavior, not a single document cutting everything at once. The impact on everyday debugging should not be overstated. There is separable space between targeted data trimming and general coding capability.

Offensive capability still exists. What changes is the channel, the cost, and who can obtain it. Official channels become more auditable. Open weights continue to flow in the gray zone. Governance has never been about making capability disappear. It is about making the flow of capability predictable and attributable. The physical properties of open source make the second half of that sentence harder than the first.