The founder of China's most prominent AI lab has made an unambiguous case for openness. Frontier AI should stay broadly accessible rather than controlled by a select few, Zhipu's Tang Jie wrote in an internal memo reviewed by Bloomberg. His argument inverts the usual security logic. Real safety comes from broad participation, sharing, and oversight, he said, not from technological barriers. Zhipu has backed that with product. It released GLM-5.2 under an open-source licence, free to download and commercialise.
The awkward timing
Tang made the comments shortly after Reuters reported that Beijing is considering the opposite. Chinese officials are weighing limits on overseas access to the country's most advanced open models. That puts Zhipu's founder at odds with the direction of travel in his own capital. Openness has been China's strategic advantage, and now its government is wondering whether it gave away too much. The company has commercial reasons to want the door open. Its models have spread globally precisely because they are free, and cheap Chinese models are now closing in on the US frontier labs. That does not make the argument wrong. It does mean the person making it stands to benefit from it, which is true of nearly everyone in this debate.
The case he is making
The open-source security argument is not fringe. Its logic is that many independent eyes on a system find flaws faster than a small team behind a wall. Defenders make the same point. When Washington restricted a frontier model, 100 cybersecurity experts signed an open letter arguing the ban hurt defenders more than attackers. Attackers, they argued, will obtain capable models regardless. The people locked out are the researchers and security teams trying to keep up. Tang's memo echoes this philosophy, emphasizing that collective oversight is the only way to stay ahead of rapidly evolving threats in AI development. This perspective aligns with a broader movement in the AI community that advocates for transparency and collaborative improvement, particularly for models that approach the frontier of human-level reasoning.
The case against
The closed camp has a straightforward reply. An open-weight model cannot be recalled, patched, or switched off once it is downloaded. Publishing frontier capabilities means publishing them to everyone, including people building bioweapons or industrial-scale cyberattacks. Safeguards trained into a model can be stripped out by anyone with the weights and a modest budget. Both sides are describing real risks. The disagreement is about which risk is larger, and there is no clean empirical answer yet. Governments around the world are grappling with this dilemma. In the United States, executive orders have called for safety assessments of powerful AI systems, and the Biden administration has explored requiring companies to report training data and results. Meanwhile, the European Union's AI Act imposes strict requirements on high-risk AI systems, though it stops short of banning open-source releases. China's potential move to restrict access would represent one of the most significant shifts in the global AI governance landscape, directly contradicting the openness that has propelled Chinese AI labs to prominence.
Why it matters now
Zhipu is no longer a curiosity. It has raised billions, listed in Hong Kong, and its share sale drew heavy demand from investors betting Chinese AI fills the gap left by restricted US models. So the question is no longer academic. If China does restrict its open models, the world's main source of free frontier-class AI closes at the same time as America's. Tang is arguing against that outcome from inside the country most likely to cause it. Whether anyone in Beijing is listening is the part he cannot control.
Tang's firm, Zhipu AI, emerged from Tsinghua University in 2019 and quickly became a national champion in the race for artificial general intelligence. Its GLM (General Language Model) line has been benchmarked against GPT-4 and Llama 3, often matching or exceeding those models in domain-specific tasks like mathematical reasoning and code generation. The open-source release of GLM-5.2 last month was particularly notable because it was accompanied by a permissive license that allows commercial use, even for military applications. That license mirrors the ethical framework of advanced Western models, but it also highlights the tension between profit and safety. If China closes its open models, it would not only hurt global research but also damage the business model of Chinese AI startups that rely on user adoption through open access.
Historical context adds depth to the debate. In the early days of AI, the United States dominated open-source releases. Major labs like Meta and Google published models such as LLaMA and Gemma openly, encouraging a vibrant ecosystem of fine-tuning and applications. That changed dramatically with the release of ChatGPT in late 2022, which sparked a wave of government concern about misuse. By 2023, both the US and China began exploring export controls on AI chips and model weights, though with different emphases. The US focused on hardware restrictions, while China targeted the dissemination of knowledge through academic papers and open-source code. Now, with Zhipu's arguments, the tension has reached a new peak. If Tang fails to convince regulators, the impact will be felt globally. For instance, startups in emerging markets that depend on free Chinese models for translation, education, and healthcare would suddenly lose access. Universities in developing countries that build AI curricula around open-source Chinese models would have to pivot to inferior alternatives or rely on expensive cloud APIs.
The technical dimension also matters. Open-weight models like GLM-5.2 are not just static releases; they enable a decentralized research community to fix biases, improve accuracy, and extend languages. In China, for example, GLM-5.2 achieved state-of-the-art results in Chinese medical question-answering and poetry generation because of contributions from independent developers. If those models are locked behind an API or government approval, the pool of talent that can refine them shrinks drastically. Furthermore, the argument that open models empower attackers is not settled. A 2024 study from the Center for Security and Emerging Technology found that most malicious uses of AI in the wild come from closed-source services, not open models. The study noted that ransomware attackers prefer APIs for their ease of use, while open models require technical expertise to modify.
Tang himself has a background that makes his stance credible. A former professor at Tsinghua's Computer Science Department, he led the development of the first Chinese-language large language model in 2020. His research papers have been cited over 50,000 times, particularly in the areas of neural network compression and multimodal learning. He is often described as a pragmatist who believes in democratic access to AI as a public good. That philosophy now confronts a rapidly hardening geopolitical environment. The US has already imposed stringent controls on the export of advanced AI chips to China, and rumors persist that the next step will be restrictions on model weights themselves. In that context, China's openness has been both a diplomatic tool and a strategic weakness. By keeping models open, Beijing helped cultivate a global ecosystem dependent on Chinese AI, but it also armed adversaries with powerful technology. The dilemma is acute.
What makes the current moment particularly tense is the pace of advancement. Chinese labs have shrunk the performance gap with US labs from two years to just a few months. In areas like video generation and reasoning, Chinese models now lead. If openness continues, China risks losing that edge. If it clamps down, it risks losing the global trust and user base that its open ecosystems have built. Tang's memo is thus a last-ditch effort to preserve a policy that has served his company and his country well, even as the strategic calculus shifts. The outcome will resonate far beyond Beijing, shaping the very definition of frontier AI security for years to come.