Are Chinese AI Models Safe for Business? What the Reports Say

DeepSeek's newest Flash model costs $0.15 per million input tokens at off-peak hours. Moonshot's Kimi K3.1 Pro sits three points behind the top Claude model on the Artificial Analysis Intelligence Index. On price and on benchmarks, Chinese AI models are hard to ignore.

We still keep them out of every business automation we run, our own and our clients'. Our founder, Allen, puts the position in two lines:

Chinese AI models are cheap. I still won't put one in a business automation.

Below is the evidence behind that call, who published each piece and the fair counterpoint, then a checklist for business data and five cheap models from US and European labs, priced on 27 October 2026.

Why Chinese AI models look like a bargain

AI providers charge per million tokens. A token is a small chunk of text, usually a word or part of one. You pay one rate for what you send in (input) and a higher rate for what the model writes back (output).

DeepSeek sells two models on its own API, both with a 1 million token context window, which is how much text the model can read in one request. Its price list as of 27 October 2026:

DeepSeek's peak hours are 01:00 to 04:00 and 06:00 to 10:00 UTC on weekdays. That is evening and the small hours in the US, so a US team working office hours mostly pays the lower rate.

The quality gap is small too. On the Artificial Analysis Intelligence Index, Claude Opus 5.5 scores 58 and Kimi K3.1 Pro scores 55. DeepSeek V4.1 Flash and Zhipu's GLM-5.3 both score 45. Moonshot also describes Kimi K3 as an open model, so you can download it and run it on your own servers.

Who is making the claims

Most of the evidence on Chinese models comes from parties with a stake in the answer. It helps to know who produced each finding before you weigh it.

Two of these are arms of the US government and one competes with the labs it accuses, so the sections below stick to what each one measured.

Concern 1: they are weaker writers

Most of what a marketing team asks AI to do is writing: ads, emails, scripts, product pages. If a model writes flatter stories, we expect flatter ads from it too.

The test we follow for this is Lech Mazur's Creative Story-Writing Benchmark. Each model writes short stories of about 600 to 800 words from the same brief, with ten required elements such as a character, an object and a tone. Evaluator models compare the stories in pairs, and the results become a ranking.

On the 23 October 2026 version, the top five are Claude Fable 5.1, Claude Opus 5.5, Claude Opus 5 (xhigh), GPT-6 Astra and Claude Opus 5 (high). GLM-5.3 is sixth and Kimi K3.1 Pro is eighth. DeepSeek V4 Pro is 24th and Qwen 3.8 Max is 29th.

Two caveats. It is one benchmark from one researcher, AI models do the judging, and GLM-5.3 at sixth is not far off the leaders. Read it as a signal, then test your own work: give two models the same brief and read the drafts blind, side by side.

Concern 2: the distillation accusations

Distillation means training a model on another model's answers. Michael Kratsios, the White House science adviser, has said legitimate distillation for smaller, more efficient models has a place. The accusation is that Chinese labs did it to Claude, at scale, without permission.

• In February 2026, Anthropic named DeepSeek, Moonshot and MiniMax. It said they generated more than 16 million exchanges with Claude through about 24,000 fraudulent accounts: over 13 million for MiniMax, over 3.4 million for Moonshot and over 150,000 for DeepSeek.
• On 22 July 2026, Kratsios posted on X that Moonshot distilled Anthropic's Fable model to build Kimi K3, using "a sophisticated internal platform to conduct large scale distillation against U.S. models". The Chinese Embassy in Washington called the claims "pure slander".
• On 10 September 2026, in its threat report, Anthropic said that in one roughly 10-day stretch, Moonshot relayed nearly 300,000 customer requests to Claude through 5,380 accounts it calls fraudulent, and showed Claude's answers to users as Kimi's. It attributed more than 23 million exchanges to Moonshot between May and July 2026.

None of this has been tested in court. Anthropic competes with these labs, and no one outside the company has audited its logs. As of the latest coverage we could find, Moonshot had not answered the allegations in public.

For a business, the practical problem is reliability. If the September report is right, some Kimi users were reading Claude's answers without knowing it. You need to know which model is writing to your customers, and a service that depends on unofficial access to another company's model can change overnight when that access is cut off.

Concern 3: censorship is trained into the model

China's Interim Measures for the Management of Generative AI Services took effect on 15 August 2023. The Cyberspace Administration of China issued them with six other national regulators. Article 4 says services must adhere to "core socialist values" and must not generate content that, for example, endangers national security or promotes separatism.

In January 2025, users who asked DeepSeek whether Arunachal Pradesh is part of India got this reply: "Sorry, that's beyond my current scope. Let's talk about something else."

In May 2026, Booz Allen Hamilton ran more than 2,800 coding trials on five models, including politically sensitive requests. Refusal rates:

You will see the 80% figure quoted for Chinese models in general. It belongs to MiniMax M2.5 alone. DeepSeek V4-Pro refused 8%, which is still four times Claude's rate. The same test found that Qwen3-Coder wrote about 130% more security holes when the prompt said the user worked for the US government.

CrowdStrike tested the raw, open-source DeepSeek-R1 671B model in 2025. When a coding prompt mentioned topics like Tibet, the Uyghurs or Falun Gong, R1 was up to 50% more likely to write code with severe security flaws. For an industrial control system "based in Tibet", the rate went from a 19% baseline to 27.2%. It refused Falun Gong requests about 45% of the time. Because the model ran with no outside filters, CrowdStrike concluded the behavior is built into the weights, the trained model file itself.

Most business prompts never touch Chinese politics, but you do not choose which prompts arrive. A travel brand writing about Taiwan or a support bot asked about Tibet can get back an answer that is slanted, half-empty or refused, and an automation will not tell you it happened.

Concern 4: AI agents can be hijacked

An AI agent is a model that can act for you: read your inbox, send emails, edit a spreadsheet, change an ad budget. The danger is prompt injection, where instructions hidden inside a web page or an email the agent reads get followed instead of yours.

In September 2025 the US government's AI testing center, CAISI at NIST, published its evaluation of DeepSeek. It found:

• Agents built on DeepSeek R1-0528 were 12 times more likely than the US frontier models tested to follow malicious instructions. In a simulated setup, hijacked agents sent phishing emails, downloaded and ran malware, and sent out users' login details.
• With a common jailbreak, R1-0528 answered 94% of plainly malicious requests. The US reference models answered 8%.
• One US reference model cost 35% less on average than the best DeepSeek model to perform at a similar level across 13 benchmarks.

Those are 2025 models, and newer versions may do better. CAISI's May 2026 follow-up on DeepSeek V4 Pro put it about eight months behind the US frontier, but its public summary reports no agent-hijacking tests, and we could not find anyone who has published one on the newer Chinese models. Until someone does, we keep any agent that can send, buy or delete off them.

Concern 5: where your data goes

DeepSeek's privacy policy, last updated 10 February 2026, says: "To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China."

The same policy lists training and improving its models among the uses of what users type in. It says you can opt out, by sending a request to privacy@deepseek.com.

For comparison, Anthropic says it does not use inputs or outputs from its commercial products, including the API, to train its models by default. OpenAI says data sent to its API is not used for training unless you opt in, and it keeps abuse-monitoring logs for up to 30 days.

Running the open weights yourself, or through a US host, fixes where the data goes. It does not change what the model was trained to do, which is the point of the CrowdStrike result.

The fair case for Chinese models

• In the Booz Allen test, Kimi K2.5 had the lowest vulnerability score of all five models, below Claude Opus 4.6.
• Kimi K3.1 Pro is three points off the top of the Artificial Analysis index.
• NIST's own May 2026 evaluation found DeepSeek V4 Pro cheaper than GPT-5.4 mini on 5 of 7 benchmarks.
• Open weights mean you can run them on your own hardware, where no outside company sees your data.

Much of the security evidence is also about 2025 models. For sorting public data or tagging your own product catalog, a self-hosted Chinese model can do the job well.

Where we draw the line

A checklist for choosing any AI model for business data

These apply to every model, Chinese or not.

1. Where is the data stored? Open the privacy policy and search for "store" and a country name. If the answer is a place your clients would not accept, stop here or self-host.
2. Does the provider train on what you send? Read the terms for the API or business plan, not the consumer app. Google says content from Gemini's free tier is used to improve its products, so client work belongs on the paid tier.
3. Can the model take actions? If it can send, buy, delete or post, look for a published prompt-injection test on that exact model version. If there is none, put a human approval step before every action.
4. Who reads the output? Customer-facing text needs the best writer you can afford. Internal tagging can go to the cheapest model that gets it right.
5. Could your inputs touch sensitive topics? If your business deals with Taiwan, Hong Kong, Tibet or India's borders, test the model on those topics first.
6. Is the test you rely on about this version? Many results in this guide are on 2025 models. Check the date and the version.
7. Can you leave? Keep your prompts in a document you own, so switching providers means changing one connection.
8. What does it cost at your volume? Count input and output separately, and check for long-prompt tiers and batch discounts.
9. Does it do the job? Run 20 or so real inputs through each model and compare the outputs side by side.

The free list: 5 cheap models to use instead

These five come from US and European labs, and the open-weight one can run on Groq or on your own server. We checked every price on each provider's pricing page on 27 October 2026. Prices are per 1 million tokens, input then output.

CopyWhat you'd be replacing:
DeepSeek V4.1 Flash: $0.15 to $0.30 input / $0.60 to $1.20 output

1. Claude Haiku 5.5 (Anthropic): $0.10 / $0.50
2. GPT-6 Luna (OpenAI): $0.10 / $0.50
3. Gemini 3.1 Flash-Lite (Google): $0.25 / $1.50
4. Mistral Large (Mistral, France): $0.50 / $1.50
5. gpt-oss-120b (OpenAI's open-weight model, hosted on Groq): $0.15 / $0.60
   You can also run it on your own server.

Two ways to cut the bill more:
- If the job can wait, use the Batch API. Anthropic, OpenAI and Mistral take 50% off.
- Give the easy jobs (sorting, tagging, summaries) to a small model and keep the big one for writing.

Prefer a one-click copy? The same list is on our free prompt page, with a copy button. Prices change often, so check each provider's page (linked under Sources) before you switch.

What the price lists do not tell you

• Claude Haiku 5.5 has two prices. The $0.10 / $0.50 rate is for prompts up to 100,000 tokens. Longer prompts pay $0.50 / $2.50 for the whole request.
• Batch is half price. Claude Haiku 5.5 and GPT-6 Luna both drop to $0.05 / $0.25, and Gemini 3.1 Flash-Lite to $0.125 / $0.75.
• gpt-oss-120b on Groq has a 131,072-token context window, against DeepSeek's 1 million. That is enough for most automations, but not for a whole book or a large contract bundle in one request.
• For the simplest jobs there are cheaper options still. OpenAI's gpt-5-nano is $0.05 / $0.40 and Google's Gemini 2.5 Flash-Lite is $0.10 / $0.40.

What switching costs: a worked example

Say an automation sends 10 million input tokens a month and gets 2 million output tokens back, with every prompt under 100,000 tokens. At the prices above:

At this volume the cheapest and most expensive options are a few dollars a month apart, so let data terms and output quality decide. Scale the token counts to your own volume.

How to move an automation off a Chinese model

In most automation tools, each AI step has a setting for the model or connection it uses. Switching is mostly testing before you change it, and most of the time goes into step 4.

1. List every step that calls an AI model: which model, what it reads, and what it does (write, sort, summarize, decide or act). One row per AI call.
2. Mark the steps that see client data or can take an action, like sending an email, updating your CRM or changing an ad budget. Those move first, even if they are cheap, because they carry the risks in concerns 4 and 5.
3. Pick a model for each step from the list: a small one for sorting and tagging, a stronger one for anything a customer reads. Create an API key in the provider's console and add it as a new connection, leaving the old one in place.
4. Run the same 20 or so real inputs through the old model and the new one, and compare format, tone, facts and length. If the new output breaks the next step, add the exact format you want to the prompt, with one example, and test again.
5. Switch one step at a time and watch the first live runs. Turn the old step off instead of deleting it, so you can switch back in a minute.
6. Move any step that does not need an instant answer to the Batch API, which is 50% off at Anthropic, OpenAI and Mistral. Check your bill after the first week.

If you would rather have someone set this up for you, this is the kind of work our AI automation team does.

Who this advice is not for

• Teams that only process public data, run an open-weight Chinese model on their own hardware, and test it on the sensitive topics above. For them it can be a sound, cheap choice.
• Researchers comparing models, who need to run all of them.

Frequently asked questions

Is DeepSeek safe to use for business?

It depends on the job. DeepSeek's privacy policy says it stores personal data in the People's Republic of China, and NIST's 2025 tests found agents built on DeepSeek R1-0528 were 12 times more likely than US models to follow hidden malicious instructions. We keep it away from client data and from any AI that can take actions. For public, non-sensitive bulk work it is cheap and capable.

Is it safer to run DeepSeek or Kimi on my own servers?

Running the open weights yourself, or on a US host, keeps your data away from the Chinese provider. It does not change how the model was trained. CrowdStrike tested the raw open-source DeepSeek-R1 model with no outside filters and still saw refusals and weaker code on politically sensitive topics, so it concluded the behavior is in the weights.

What is AI model distillation?

Distillation means training one AI model on another model's answers. It is a normal way to build smaller models. The accusation against some Chinese labs is that they did it to Claude at scale through fraudulent accounts. Anthropic and the White House have made these allegations; they have not been tested in court, and China's embassy in Washington called the White House claims "pure slander".

Do Chinese AI models censor their answers?

China's 2023 generative AI rules require services to uphold core socialist values. In a May 2026 Booz Allen test, refusals on politically sensitive requests ranged from 8% for DeepSeek V4-Pro to 80% for MiniMax M2.5, against 2% for Claude Opus 4.6. The often-quoted 80% figure is MiniMax's alone.

What is the cheapest AI model that is not Chinese?

As of 27 October 2026, Claude Haiku 5.5 and GPT-6 Luna both cost $0.10 per million input tokens and $0.50 per million output tokens, and half that on their Batch APIs. For the simplest jobs, OpenAI's gpt-5-nano costs $0.05 / $0.40 and Google's Gemini 2.5 Flash-Lite $0.10 / $0.40.

Are Chinese AI models as good as Claude or GPT?

On general tests they are close. On the Artificial Analysis Intelligence Index, Kimi K3.1 Pro scores 55 against 58 for Claude Opus 5.5. On Lech Mazur's creative writing benchmark the top five are all Claude and GPT, and the best Chinese model, GLM-5.3, is sixth.

Sources

• Lech Mazur, Creative Story-Writing Benchmark (GitHub)
• Artificial Analysis, Intelligence Index leaderboard
• InfoWorld on Anthropic's distillation report (Feb 2026)
• CyberScoop: White House accuses Moonshot AI (Jul 2026)
• Forkast: Chinese Embassy response (Jul 2026)
• Dealroom on Anthropic's threat report (Sep 2026)
• Interim Measures for the Management of Generative AI Services
• Borderlens: DeepSeek's reply on Arunachal Pradesh (Jan 2025)
• Help Net Security on the Booz Allen test (Jun 2026)
• CrowdStrike on DeepSeek-R1 code (Nov 2025)
• NIST: CAISI evaluation of DeepSeek (Sep 2025)
• NIST: CAISI evaluation of DeepSeek V4 Pro (May 2026)
• DeepSeek privacy policy
• Anthropic: is my data used for model training?
• OpenAI: your data in the API
• DeepSeek pricing, Anthropic pricing, OpenAI pricing, Google Gemini pricing, Mistral pricing, Groq models