China’s AI Giants Just Put Cyber Power Behind a Locked Door

A security researcher I will call Lao Zhou noticed the change on a Wednesday afternoon. He asked a model to finish a proof-of-concept for an open-source component. The model gave him three paragraphs: background on the component’s old vulnerabilities, a suggestion to contact the vendor, and a security-research authorization template. It gave him no code. He changed the prompt to “write a parser” and got eighty lines in ten seconds.

He reproduced the pattern across several Chinese open-source models over two months. Everyday code generation ran fine. Prompts that combined “vulnerability,” “exploit,” “bypass,” and “injection” made the model take a detour. Around the same time, three reports circulated: DeepSeek was testing a dedicated Cyber model, Kimi had removed cybersecurity training data, and regulators were tightening open-source model security management. The trend is now visible. Chinese model makers are moving offensive cyber capability out of open distribution and into a channel that requires real-name verification, approval, and a dedicated key.

Regulation: a tighter net, not one sweeping ban

There is no single regulation that says every public model API and every open-weight release must weaken vulnerability discovery. The signals are still real and frequent.

In May 2026, the Cyberspace Administration of China’s Qinglang campaign listed “inadequate security management of open-source models” among seven priority problems. National standards released the same month set security baselines for model services and training data. For vendors, the message is simple: open source does not mean immunity. If a model is released, the provider shares responsibility for what downstream users do with it.

Microsoft AI’s draft code of conduct, released in September 2026, draws the capability line. Models must not generate runnable exploit code or attack tools. They must not provide attack planning, intrusion procedures, or detection evasion. The draft keeps defensive security in scope. Vulnerability discovery, malware analysis, and PoC testing remain allowed. The prohibited zone is the generation of offensive capability.

DeepSeek’s Cyber model: a key that leads back to you

Application entry points and interface logic for a Cyber model appeared in DeepSeek’s front-end code. The leaked design is more specific than “add real-name verification.”

It has two versions. cyber-personal-v3 serves individuals. cyber-enterprise-v4 serves companies. Individuals need an ID card and facial verification. Companies need a business license and an authorization letter. Both need a real-name account, a mainland China phone number, and no violation record in the past 90 days. After approval, the system issues a dedicated Cyber Key. The code includes Key creation and quota management.

The Key does more than authorize calls. It answers a governance question: if the model is used in a real attack, can investigators find the person behind it? A Key can be traced to the authenticated subject. DeepSeek has not erased security capability from every model. It has placed that capability inside a channel that can be approved, metered, and traced.

That design explains why a separate Cyber model exists. A general model serves too many users for individual review. A dedicated model can combine real-name checks, use declarations, and Key management. The operator can then answer who can use it, what they use it for, and who to contact if something goes wrong. The entry point is not in the public menu. It is in small gray testing. DeepSeek has not announced it. The code is still evidence.

Kimi’s subtraction: delete the data, keep the code, lose 9.5 points

Moonshot AI made its change public. When it released Kimi K3.1 Pro in October 2026, it said it had removed cybersecurity-related data from its training corpus and reinforcement-learning environment. It kept general programming capability. Internal tests showed the cost. The score for finding and exploiting software vulnerabilities in a controlled environment fell from 90.5% to 81%. That is 9.5 percentage points. The stated goal is not to publish weights that would substantially raise cyberattack capability.

Two details matter. The company deleted cybersecurity data, not all code data. It says general programming still works. Those details lead to the next question: does deleting security data hurt everyday code review?

The code impact is layered, not total

Finding vulnerabilities and fixing them share knowledge. A model that can spot a security flaw needs some grasp of control flow, memory management, input validation, permission boundaries, and attack surfaces. The same knowledge helps with debugging, code audit, and defect repair. When vendors remove security data, the ceiling for deep code-security work falls. That is close to unavoidable.

Security-alignment research has a name for the side effect: the alignment tax. Strict guardrails can lower performance on benign tasks, including automated program repair. The vocabulary of vulnerability analysis overlaps with the vocabulary of exploitation. A model trained to spot “suspicious code” will not remain untouched when asked to audit code.

Vendors are not weakening all coding ability. Kimi says it kept general programming. DeepSeek moved security capability into a separate model instead of erasing it everywhere. The likely result is a split. Business-code generation, refactoring, and routine review change less. Deep vulnerability audit, binary analysis, and complex PoC reproduction become harder on general open-source models. Professional demand moves to the approved Cyber channel. For most developers, writing a feature will feel similar. Asking a model for a full security audit will cost more, take longer, and require permission.

White hats lose the default toolchain

If this path holds, the security industry will split along access lines. An independent researcher or small team used to deploy an open-source model locally, add their own tools, and run vulnerability discovery, malware analysis, and PoC validation. Full open weights were infrastructure. They let small researchers keep pace with large labs.

Under the new model, general open-source models lose part of that capability. Full offensive and defensive work moves into a dedicated model with real-name approval. Individuals face questions beyond “can I use it?” They must ask whether they can get approved, whether the quota is enough, and how long review takes. Companies can pursue enterprise certification, obtain Keys, and build internal pipelines. Independent white hats may turn to overseas weights, community fine-tunes, or gray channels.

The threshold does not vanish. It gets repriced. The control aims to reduce abuse. If legitimate researchers lose tools while black-market actors never use official channels, the capability gap can tilt toward the side outside control. “Guarding against gentlemen, not villains” is not a slogan here. It describes the structure.

Overseas fine-tunes exploit the open-weight gap

The DeepSeek V4.1 Flash Cyber listing on a third-party gateway is probably not an official DeepSeek release. It is more likely a community or service-provider fine-tune built on open weights. The method is known. Open-source safety alignment often shows up as refusal. Abliteration removes the refusal direction at the weight level. The model stops refusing while keeping much of its base ability. Once a full-capability checkpoint is public, a third party overseas can turn it into an unguarded version. API gateways and secondary distribution then carry it to users.

This is the hardest part of the control chain to close. Official channels can check real names and Keys. Open weights are different. Once a file is downloaded and fine-tuned, the source has limited control over where it goes. You can govern who calls the official API. You cannot govern a weight file on someone else’s disk.

Lao Zhou kept both folders

Lao Zhou eventually ran an overseas community fine-tune on his own machine. The model saw “buffer overflow” and started writing code. He pasted the PoC into a test environment. It ran. He closed the window and opened another folder. Inside were the official open-source weights. The timestamp was three months old.

He kept both. One to get work done. One to remind himself that capability feels ordinary until it is taken away.