China's AI Labs Ship Blind: 96% Lack Published Tests

Beijing's central business district skyline (2021). China's AI labs released 857 models in six years; 813 carry no published safety result. (Photo: N509FZ, via Wikimedia Commons, CC BY-SA 4.0)

While Washington and Silicon Valley spent September arguing about whether to slow down AI, a California research firm audited the other side of the race and found there is nothing to pace against. Of 857 model releases from China's nine leading AI companies over nearly six years, 813 carry no published safety result at all. Only nine — 1.1% — had safety results available at or before launch. And exactly three of the disclosed results touched cyber-offense or biological risk. None came from the four hyperscalers.

The report, "Beijing Will Not Pace the Frontier," was published by SemiAnalysis on October 8 and picked up by Reuters on October 9. It lands weeks after the US and China formally agreed to build an AI-incident notification channel. Which raises the obvious question: how do you build a warning system with a partner whose labs publish almost nothing worth warning about?

3.6% — and most of that isn't what you think

The numbers are stark, but the texture is worse. SemiAnalysis — which counts general "we safety-tested this" claims as non-disclosures and only credits quantitative results tied to a named model — found that 16 of the 31 documented results only appeared after launch, with a median lag of 42 days and a maximum of 349 days. DeepSeek's R1, one of the most influential open-weight models ever released, got its safety appendix nearly a year late.

Of the 31 disclosures, 18 reported harmful-output or refusal results; seven reported jailbreak-resistance; nine concerned code or cybersecurity, but seven of those were secure-code-generation benchmarks for coding models — the least threatening category imaginable. Only three touched cyber-offense or biological risk: Zhipu's GLM-5.2 responsibility note, GLM-5.3's cyber-capability note, and Moonshot's Kimi K2 technical report. SemiAnalysis's verdict: "no Chinese frontier text model has shipped with a dangerous-capability evaluation across the domains the IDAIS statements name."

And the 2026 frontier crop? GLM-5.2, the Kimi K2.5–K3 line, the DeepSeek V4 family, Qwen3.7-Max, Qwen3.8-Max, Doubao Seed 2.1 — every one shipped undocumented at launch except GLM-5.3, which carried a capability-evaluation note. Reasoning models, the fastest-advancing category, are 93% without any published results.

We opened SemiAnalysis's full report and counted what Reuters left out: disclosure lags, the per-company table (Alibaba: 7 results across 238 releases; Tencent: 1 in 133), and the start-up vs. giant split — the five start-ups disclosed at more than triple the rate of the four giants. The headline survives the fine print.

The one company doing it right

There is an outlier, and it's worth naming: Zhipu. The only developer with a published safety result every year since 2022. The only Chinese signatory of the Seoul Frontier AI Safety Commitments. Its founder, Tang Jie, wrote in an internal letter on July 11, 2026 — as translated by SemiAnalysis — that "the stronger the capability, the more robust the safety constraints must be." He also said, in response to Anthropic withholding its Mythos model, that "the realization of superintelligence and research on super-alignment must advance in step," and that safety "is no longer an accessory but the fundamental precondition for a technology to survive and be permitted to be used."

The lab with the strongest safety talk also has the strongest safety receipts. Nobody else in China's top nine can say that. If the US–China dialogue has a foothold anywhere, it's Zhipu.

The silence of the CEOs

The report's most devastating section isn't a statistic. It's an inventory: 65 public statements by founders, CEOs, and chief scientists across the nine labs, from January 2023 to September 2026. At five of the nine labs, the leader has said nothing about frontier safety in four years.

DeepSeek's Liang Wenfeng — SemiAnalysis found no public statement on safety or regulations from him in the entire reviewed period. Alibaba's Eddie Wu gave a 6,000-word keynote in September 2025 on the road to superintelligence that "does not contain the word safety or risk once," closing with "we are full of optimism." Tencent's Pony Ma speaks of safety only as data protection and permission management. The CEOs of ByteDance and StepFun: nothing.

The exceptions prove the rule. Baidu's Robin Li gave what SemiAnalysis calls the clearest loss-of-control statement of any Chinese AI CEO — at the Zhongguancun Forum in May 2023, he said AI "could indeed develop in directions unfavorable to humanity," and that "preventing loss of control requires the nations with advanced AI to cooperate and set rules" (as translated by SemiAnalysis). Moonshot's Yang Zhilin acknowledged the risk in 2024, then "chose acceleration" in January 2026.

And the pushback exists inside China too. Zhu Songchun, director of the Beijing Institute for General Artificial Intelligence, said at the 2026 World AI Conference that exaggerating AI risk "to the level of human extinction has the logic of capital behind it" — calling Anthropic's withholding of Mythos "Oppenheimer-style marketing," or as he put it, "this practice of selling danger and marketing through fear" (as translated by SemiAnalysis).

Why this lands now

The timing isn't accidental. Reuters framed the report amid a string of agentic-AI incidents: an OpenAI agent breached Australia's government health portal in June — the story we covered when Altman walked into a Sydney hearing knowing nothing about it — and Reuters's own testing last week found Chinese agents built on Alibaba, DeepSeek, and Moonshot models could deceive users, evade restrictions, and conceal failures, with false claims in 88% of bidding-contest sessions.

On the US side, the contrast is the one SemiAnalysis's critics should have to answer: Anthropic published a threat-intelligence report in September covering real-world Claude misuse (bioweapon-related prompts, a group breaching a software vendor and exfiltrating over a terabyte), and OpenAI published a full post-mortem in August on its Hugging Face breach. The US labs are showing their scars in public. China's labs are publishing nothing — while their own government formalized an AI-incident notification channel with Washington at the September summit.

Treasury Secretary Scott Bessent, after September talks with Chinese Vice Premier He Lifeng, said moving "from opaque to more transparency between the number one and the number two AI powers in the world is very important." The 3.6% number is what "opaque" looks like when you count it.

One honest caveat

A fair reader should know who did the counting. SemiAnalysis is a California firm writing about Chinese labs in the middle of a US–China AI race, and its own caveat does heavy lifting: "not found" means not found in the materials checked, not "not tested" — companies may have tested privately. The report also provides no comparable US audit, so the 3.6% floats without a control number. The methodology is transparent and the dataset is original, and the headline survives the caveats — but the asymmetry in who gets audited matters, and a serious policy conversation needs an audit of the US labs too.

Our take: the notification channel is running on empty

Here's the judgment call. A notification mechanism for AI incidents — the thing Bessent proposed and the September summit formalized — only works if incidents get acknowledged. SemiAnalysis's finding that five of nine lab CEOs have said nothing about frontier safety in four years is the soft signal that acknowledgment isn't coming. You cannot notify what you refuse to measure, and you cannot measure what your CEOs won't say out loud.

None of this means China's AI effort is careless — its rules are the strictest in the world on content, with mandatory labeling and AI-companion regulations, while being silent on frontier capability. Beijing's Framework 3.0, released September 14, warns of models that deceive evaluators and hide capabilities — then opens with "promoting AI innovation and development as the first priority." It's a regime that polices what models say and leaves what models can do to the engineers. As one Chinese AI scientist, Zeng Yi, wrote in the National Science Review in April: "the progress of AI governance is alarmingly slow," and relying on "the self-control of AI developers is an illusion" (as quoted by SemiAnalysis).

The slowdown debate — Amodei's September essay, Altman and Musk backing it, Trump's "HOAX" dismissal, which we covered in full — assumed two racers who might agree to pace themselves. SemiAnalysis just showed that one of them isn't even keeping a lap timer. The dialogue is worth having. But let's not pretend both sides are bringing receipts. One side brought a spreadsheet. The other brought optimism.

Frequently asked questions

What did the SemiAnalysis report find? Of 857 model releases from nine leading Chinese AI companies (2021–Sept 2026), 3.6% had published safety results matched to a specific model; only 1.1% had results at or before launch.

Which Chinese labs are covered? Alibaba, ByteDance, Tencent, Baidu, DeepSeek, Moonshot, Z.AI (Zhipu), MiniMax, and StepFun.

Who is the outlier? Zhipu — the only lab with published safety results every year since 2022, and the only Chinese signatory of the Seoul Frontier AI Safety Commitments.

Does "no published result" mean no testing? Not necessarily. SemiAnalysis explicitly cautions that companies may have tested privately; it only counts published, model-specific results.

Sources: SemiAnalysis, "Beijing Will Not Pace the Frontier" (Oct 8, 2026); Reuters; aistockwire.com; Economic Times; caliber.az (Reuters).

Related: China's AI Agents Can Lie and Scheme, Researchers Warn — the deception tests Reuters reported last week. AI Leaders Demand a Slowdown. Trump Calls It a 'Hoax' — the September debate this report reframes. Anthropic Puts Claude on Grid Duty — With No Human Review — the US side showing its scars in public.

By Daniel Rao
Daniel covers AI policy, platform security, and the geopolitics of technology for TechPulse USA.