Chinese open-weight models are becoming essential infrastructure for locally operated AI. Research from SentinelOne and Censys mapped 175,000 exposed hosts across 130 countries over 293 days and found Alibaba’s Qwen2 consistently ranking behind only Meta’s Llama.
Qwen2 appears on 52 percent of multi-model systems, while the Llama-Qwen pairing runs on 40,694 hosts. Researchers attribute the adoption to frequent releases, strong quality, quantisation, and the ability to run on commodity hardware.
The result is a governance inversion: deployment control is distributed across thousands of networks while upstream influence concentrates in a few model lineages.
Practical Availability Is Shifting Open AI Eastward
Western frontier labs face safety scrutiny, regulatory overhead, and commercial incentives to keep their strongest systems behind APIs. Chinese developers have continued publishing weights optimised for local and edge deployment.
For researchers and operators without large budgets, availability can matter more than ideology. A model that is downloadable, portable, and efficient becomes the default choice when alternatives are restricted or expensive.
Qwen2 shows “zero rank volatility” across observations, unique hosts, and host-days in the study. Its stable global position suggests an operational pattern rather than a temporary wave of experimentation.
A persistent backbone of roughly 23,000 hosts with 87 percent average uptime drives much of the activity. These systems increasingly resemble an unmanaged public compute layer rather than occasional hobby deployments.
Unauthenticated Tool Use Expands the Blast Radius
Nearly half of exposed hosts advertise tool-calling capability, allowing models to execute code, call APIs, or interact with external systems. Twenty-six percent run reasoning models suited to multi-step planning.
On an unauthenticated endpoint, an attacker may need only a prompt to request internal documents, extract keys, or invoke connected services. At least 201 hosts used explicitly uncensored configurations, though researchers consider that a lower bound.
Between 16 and 19 percent of infrastructure could not be attributed to an owner. Reporting abuse or coordinating remediation becomes difficult even when a harmful deployment is identified.
The primary security failure is exposure, not nationality. Any powerful open model connected to sensitive tools without authentication, least privilege, network isolation, or monitoring creates the same immediate risk.
Open Releases Behave Like Long-Lived Infrastructure
Once weights are published, safety training can be removed and no central provider can disable misuse. Frontier labs therefore need post-release monitoring of adoption, modifications, and ecosystem-level abuse rather than treating publication as a finished research event.
Operators need equally basic controls: authentication, restricted interfaces, patched serving software, segmented tools, logs, rate limits, and clear ownership. Public discovery should trigger remediation before more capable agents arrive.
The study expects the exposed layer to persist and professionalise over the next 12–18 months as tool use and multimodal capability become standard. Residential and small-server deployments do not fit neatly into existing regulatory or provider controls.
Western governance of hosted platforms may have limited influence if widely used open capabilities originate and operate elsewhere. That creates geopolitical questions about standards, incident coordination, and model supply.
Asset discovery becomes an immediate defensive priority. Organisations need to know which teams have downloaded models, where inference servers are reachable, which tools they can call, and whether authentication and updates are maintained. The exercise resembles finding forgotten cloud storage or databases, but the exposed service may also execute instructions and connect to other systems.
It should not produce a simplistic retreat from open source. Local models support research, privacy, competition, and independence. The priority is recognising that open weights propagate like infrastructure and require security practices proportionate to their persistence.
Chinese models are gaining ground because they solve a practical deployment problem. The 175,000 visible hosts show both the demand and the cost of making powerful AI easy to run. Openness expands who can operate intelligence; basic security must determine who is allowed to reach it.
