The Cyber Risk Discourse is Broken
打开互动全文版（逐段中英对照 + 针对本篇提问）→本文认为，当前西方关于开放权重 AI 模型网络风险的讨论存在危险的过度简化，将辩论框定为禁止开放模型与无视安全担忧之间的二元对立，却忽视了真正塑造风险的权衡取舍与生态动态。作者主张，政策行动发生在一个多块拼图之中，结果很少是全面更优的；若只禁止开放权重模型而不限制闭源模型的 API，反而会扩大攻防网络差距，因为已有记录表明，闭源模型是现有大多数 AI 赋能网络攻击的根源。文章还挑战了中国实验室不关心 AI 安全的假设，描述了中国一套去中心化但真实存在的监管与文化风险评估框架，其路径与美国不同。作者总结道，开放权重危言耸听者所作的可证伪预测——即当前开放模型将造成前所未有的网络危害——很可能被证明是错误的；真正的辩论应聚焦于最低安全测试算力，以及闭源模型双头垄断所带来的风险。
This article argues that the current Western discourse on the cyber risks of open-weight AI models is dangerously oversimplified, framing the debate as a binary between banning open models and dismissing safety concerns, while ignoring the trade-offs and ecosystem dynamics that actually shape risk. The author contends that policy actions occur in a multi-piece puzzle where outcomes are rarely universally better, and that banning open-weight models without also restricting closed-model APIs would widen the offense-defense cyber gap, since closed models have been documented as the cause of most existing AI-enabled cyber attacks. The piece also challenges the assumption that Chinese labs do not care about AI safety, describing a decentralized but real regulatory and cultural risk-assessment framework in China that differs from the U.S. approach. The author concludes that the falsifiable prediction made by open-weight alarmists—that current open models will cause unprecedented cyber harm—is likely to be proven wrong, and that the real debate should focus on minimum safety testing compute and the risks of a closed-model duopoly.
关于开放模型的网络风险，我已经听过太多这样的讨论——有人要么假设禁止开放模型可以孤立地实施（而恶意行为者不知怎地就会被真正阻止），要么认为中国是一个威胁且不关心 AI 安全——以至于我觉得我们最终会做出既限制美国 AI 竞争力又增加长期网络风险的政策决定。我感觉我们正锁定在一条双输的道路上，除非人们接受细微差别、权衡取舍以及可怕的现实。
I've had one too many discussions on the cyber risks of open models — where someone assumes that either banning open models happens in a silo (and bad actors will somehow actually be stopped) or that China is a threat and doesn't care about AI safety — that I feel we're going to end up making policy decisions that both limit American AI competitiveness and increase long-term cyber risk. I feel like we're locked in on a path of a lose-lose situation, unless people embrace nuance, trade-offs, and scary realities.
关于这场辩论中各方参与者的观点已有大量论述，我将其总结如下：
Much has been written about the views of various players in this debate, which I summarize as follows:
1. 开放权重模型对社会功能构成不可承受的风险，这一观点由美国前沿实验室领导层和国家安全界所持有。
1. Open weight models pose an untenable risk to society's functionality, occupied by frontier lab leadership and the national security community in the U.S.
2. 西方声音认为开放权重模型对防御是必要的，禁止它们会让世界更不安全，这一观点由 AI 风险温和派在不同极端程度上持有。我把自己归入这一阵营，同时还包括 OpenAI 事件后 Hugging Face 的立场，以及 Joshua Saxe 等人。
2. Western voices saying open weight models are necessary for defense and banning them will make the world less safe, occupied by AI risk moderates to different extremes. I include myself in this bucket, along with Hugging Face's perspective after the OpenAI incident, and others like Joshua Saxe.
3. 中国公司继续发布具有强大网络能力的开放权重模型，它们基于其社会和政府的风险评估做出决策。
3. Chinese companies continuing to release open-weight models with strong cyber capabilities, who are making decisions based on the risk assessments of their society and government.
这份清单还按照西方 AI 生态系统中讨论的量级或信息清晰度来组织。以风险为中心的讨论显得不成比例地突出，其中包括一些我认为非常有害的作品，它们损害了在这个问题上跨越预设党派界限进行接触的潜力。此外，几乎没有实质性的努力去理解中国公司如何评估风险——相反，大多是近乎人身攻击的论点，比如“中国实验室不关心安全”。
This list is also organized by volume or clarity of message in the Western AI ecosystem. The risk-focused discussions have been disproportionately visible, including pieces of work which I view as very detrimental to the potential of engaging across assumed party lines on this issue. There's also very little substantive engagement trying to understand how Chinese companies assess risk — rather, mostly arguments that border on ad hominem attacks like "Chinese labs don't care about safety."
Interconnects AI 是一份由读者支持的出版物。考虑成为订阅者。
Interconnects AI is a reader-supported publication. Consider becoming a subscriber.
“开放权重很危险”阵营的最新出版物是 Anthropic 关于 GLM-5.3 作为进攻性网络工具的风险报告。问题不在于他们所做的技术研究——这些研究大体上是合理的——而在于未能探讨更跨领域的问题，例如：如果我们因网络风险而禁止开放模型，会发生什么？或者，为什么中国公司认为这些模型可以安全发布？
The most recent publication from the "open-weights are dangerous" crowd was the report by Anthropic on the risks of GLM-5.3 as an offensive cyber tool. The problem with this is not the technical research they did, which is largely reasonable, but the failure to engage on more cross-cutting questions like: What happens if we ban open models due to cyber risks, or why do Chinese companies deem these models safe to release?
这些问题（我稍后会回到）是我们理解当前 AI 风险的 _生态系统_ 视角所必须回答的。所有政策行动都发生在一个多块拼图中，风险形态可以被改变，但很少能获得普遍更好的结果。它们都是权衡取舍。
These questions, which I'll come back to, are the ones we need to answer to understand the _ecosystem_ perspective on current AI risks. All policy actions happen in a multi-piece puzzle, where the shape of risk can be changed, but it is rare that you get a universally better outcome. They are all trade-offs.
Anthropic 这种唯我论的写作，与我经常听到的另一种正在决定开放模型和 AI 广泛命运的话语非常吻合——机密简报。我曾与许多人讨论过，他们会说：“看，我支持开放模型，但如果你看到我所看到的，由于 [XYZ 中国开放权重模型]，外面是一场猛攻，我们需要采取行动。”
This sort of solipsistic writing by Anthropic fits very closely to another type of discourse I'm hearing about regularly that is determining the fate of open models and AI broadly — classified briefings. I've had many discussions with people who say something like "Look, I'm pro open models, but if you're seeing what I'm seeing, it's an onslaught out there due to [XYZ Chinese open-weight model] and we need to act."
这种观点与公开信息相悖，迄今为止，封闭模型被记录为大多数现有网络攻击的原因。作为一个试图做出有根据预测的人，来自 OpenAI 模型的众多攻击证据是我关于网络风险形态的唯一数据（或者，你可以将范围扩大到包括所有 FelonyBench）。有几种可能的解释，需要数年才能得到真正答案：
This perspective flies in the face of public information, where to date closed models have been documented as the cause of most existing cyber attacks. As someone who tries to make grounded predictions, the evidence of numerous attacks from OpenAI models is the only data I have on the shape of cyber risks (or, you can broaden the scope to include all of FelonyBench). There are a few possible explanations, and it'll take years to get to the true answer:
* 也许开放模型权重和封闭模型 API（带有一些安全防护）都更接近于容易被滥用，而不是 API 模型更接近安全。“开放危险，封闭安全”的说法可能更接近“开放不安全，封闭不安全”。
* Maybe open model weights and closed model APIs (with some safeguards) are both far closer to being easy to mis-use, rather than API models being closer to safe. The trope "Open Dangerous, Closed Safe" may be closer to "Open Unsafe, Closed Unsafe."
* 也许愿意利用 AI 模型对美国关键基础设施或强大但准备不足的机构发动“高调”网络攻击的恶意行为者要少得多。闭源模型具有更强的能力和更强的保障措施（理论上），但如果两者的保障措施都存在漏洞，那么更强的能力部分可能在净危害中更为重要。
* Maybe there are far fewer bad actors who are willing to use AI models for “loud” cyber attacks that target crucial infrastructure in the US or powerful and underprepared institutions. Closed models have stronger capabilities and stronger safeguards (in theory), but the stronger capabilities part could matter more in net harm if the safeguards on both are porous.
* 关于网络安全生态系统如何运作，我还有很多要学习的地方，因此我不会全心支持将其作为我目前的建议之一，但我认为至少有一个合理的论点：开放权重模型作为网络防御的扩散工具，可能是未来几年我们拥有的防止危害的最佳工具。在许多领域，例如敏感的政府机构，开放权重模型是短期内唯一可以部署在气隙网络上的工具。
* I have a lot more to learn about how the cybersecurity ecosystem works, so I won’t support this full-heartedly as one of my current recommendations, but I think it’s at least a reasonable argument that open weight models as a diffusion tool for cyber defense could be the best tool we have to prevent harm over the next few years. There are many domains, e.g. sensitive government agencies, where open-weight models are the only tools that can be deployed in the near-term on air-gapped networks.
这种情况的许多方面似乎都是难以确定的混乱现实，而逻辑上的限制则更为清晰。我可能同意一个简单的事实：作为具有更多层保护的技术工具，闭源模型在极限情况下要安全得多，但由于模型 API 的可访问性，它们实际上可能在短期内造成更多危害。尽管如此，这些工具的大部分影响归根结底取决于它们的使用和控制方式。对此类关键工具的双头垄断可能是决定性的、有风险的部分。这就是我们正在进行的辩论，随着时间的推移，随着智能的扩散，许多事情可能会发生变化。
Lots of this situation seems like the messy reality being hard to pin down, where the logical limits are clearer. I may agree with the simple reality that closed models are far safer in the limit, as a technical tool with more layers of protection, but they may actually be causing more harm in the near term because of how accessible model APIs are. Still, much of the impact of the tools comes down to how they’re used and controlled. A duopoly on such a crucial tool may be the defining, risky part. This is the debate we’re having, and over time, as intelligence diffuses, many things may change.
这些因素共同让我得出结论：如果你认为需要禁止最新的开放权重模型以减缓网络风险的扩散，那么你可能也需要将前沿闭源模型的面向公众的 API 定为非法。目前闭源模型的保障措施堆栈比开放权重模型更强大，但远非完美。闭源模型的网络能力很可能比护栏性能提升得快得多，而一个禁止开放模型同时闭源模型继续进步的世界将扩大攻防网络差距。如果我们取消对强大开放权重模型的访问，那么构建允许防御者在其私有基础设施上使用强大 AI 模型的缓解措施将需要大量时间。
These together make me come to the conclusion that if you think the latest open-weight models need to be banned to slow the diffusion of cyber risks, you probably also need to make public-facing APIs for the frontier closed-models illegal. The current stack of safeguards on closed models is _stronger_ than open-weight models, but far from perfect. It is very likely that cyber capabilities of closed models increase much faster than guardrail performance, and a world where open models are banned while closed models continue to progress would be increasing the offense-defense cyber gap. It will take meaningful time to build mitigations that allow defenders to use strong AI models on their private infrastructure if we remove access to strong open-weight models.
中国关心人工智能安全。他们以一种完全内生的方式进入这一讨论，这种方式与中国文化和权力结构相关。这个谜题有一些宏观图景在其他方面有所体现，例如中国社会延伸至人工智能的技术乐观主义，以及中国政府对政治稳定的全面关注。当然，这些事物会与网络安全等新兴人工智能风险相互作用。
China cares about AI safety. They have come to this discourse in a complete, endogenous manner relating to Chinese culture and power structures. There are some big-picture pieces of this puzzle that reflect in other ways, such as Chinese society's techno-optimism that extends into AI and the Chinese government's complete focus on political stability. These things do, of course, interface with emerging AI risks like cybersecurity.
他们处于自己的人工智能风险动态之中，这种动态尚未上升到我们过去几个月在美国所关注的白宫与前沿实验室之间政治博弈的显著程度。据我所知，中国公司必须向中国政府登记每一次重大模型发布。这包括评估，这些评估最初是围绕对政府禁止信息的控制而设立的。目前尚不清楚这一框架是否已实质性地扩展到网络或生物等任何风险领域。中国政府非常分散，来自实验室的信息需要经过现有结构才能到达高层。
They are in their own AI risk dynamic, which hasn't risen to the prominence of the political dance between the White House and the frontier labs which we have followed in the U.S. for a few months. My understanding is that the Chinese companies have to register every major model release with the Chinese government. This includes evaluations, which originated around information control for banned government information. It is unclear if this framework has expanded meaningfully into any risks like cyber or bio. The Chinese government is very decentralized and information from the labs needs to go through existing structures to make it to the top.
与此同时，中国存在一种更强烈的社会风险氛围，领先的人工智能研究人员不被允许离开该国，且该行业正在对外国投资关闭。总的来说，我猜测在中国，因释放任何国内危害而面临的个人风险将远高于美国，在美国最坏的情况是你的公司被删除。
At the same time, there is a much stronger air of social risk in China, where leading AI researchers aren't allowed to leave the country and the industry is closing off to foreign investment. On balance I would guess the personal risks facing people by unleashing any domestic harms would be much higher than in the U.S., where the worst case is that your company gets deleted.
总体而言，政治监督似乎比美国早得多。西方人工智能公司的核心原则接近于“阻止持有 AI 的坏人的最佳方式是成为持有 AI 的好人”。在中国，这些公司更务实于构建一个出色的工具，并且在许多情况下构建一个补充其现有业务的工具。
Overall, the political oversight seems much earlier than in the U.S. The Western AI companies' core principle is close to "the best way to stop a bad guy with AI is to be a good guy with AI." In China, these companies are much more practical about building a wonderful tool, and in many cases building a tool that complements their existing businesses.
我确实认为这些公司会考虑其工作的全球影响。这些实验室也明显受到激励，并经常通过政府（至少在公开信息中）被推动去尽可能竞争。对像 Kimi K3 这样的前沿模型进行全面的安全评估可能会在算力上花费数千万美元。这些实验室更愿意将这笔钱留给训练。
I do think that the companies consider the global implications of their work. These labs also clearly are incentivized, and often pushed via the government (at least in public messaging) to compete as much as they can. Running comprehensive safety evaluations on a frontier model like Kimi K3 could cost tens of millions of dollars in compute. These labs would much rather leave that for training.
正确的辩论是：“在发布每个模型之前，实验室应在安全测试上花费的最低算力是多少？”当然可以论证，这个最低算力应高于中国实验室所做的，或者至少他们应更透明地说明其做法，但如果你说最低算力应与 Anthropic 或 OpenAI 所做的相匹配，我很难同意。尚不清楚的是，尽管 Anthropic 和 OpenAI 为创建一个优先理解风险的机构付出了诸多努力，他们是否将其置于商业价值和经济成功之前。从 HuggingFace—OpenAI 事件等事件中感受到的这种“放手不管”的氛围，是我持久的收获之一。OpenAI 被 Hacktron 黑客攻击就是例证——如果你的自家漏洞百出，就很难成为世界信任的网络伙伴。我相信实验室的许多个人会努力确保安全，但总体而言，我不信任这些机构。
The correct debate is "what is the correct minimum amount of compute a lab should spend on safety testing before releasing each model?" There's surely a case to be made that it's more than the Chinese labs do, or at least they should be more transparent on what they do, but I would be hard pressed to agree if you said the minimum amount of compute would match what Anthropic or OpenAI does. It is not clear that, for all the effort Anthropic and OpenAI make on creating an institution that prioritizes understanding risks, they put it before business value and economic success in their priority stack. This "hands off the wheel" vibe from incidents like the HuggingFace—OpenAI incident was one of my lasting takeaways. It's exemplified in the Hacktron hacking of OpenAI — it's hard to be the world's trust cyber partner if your own house is teeming with leaks. I trust many of the individuals at the labs to work hard to ensure safety, but I'm not trustworthy of the institutions overall.
当 Claude Mythos 发布时，它被预告为一种新型网络武器，一旦落入不法之徒手中，就会造成大规模的社会动荡。
When Claude Mythos was announced, it was previewed as if it was a new class of cyber weapon, where if it ended up in the wrong hands it would have caused mass societal destabilization.
从各方面衡量，GLM-5.3 正是跨越了那一道能力门槛的模型，而公开证据几乎没有显示情况有多大变化，并且距离该模型权重发布已经过去一个多月了。
By all measures, GLM-5.3 is the model that crosses that threshold of capability, and there's little public evidence that much has changed, and we're over a month out of the model weight release.
事实上，我还会更进一步。如果 Claude Mythos 被意外地以开放权重形式发布，世界似乎也会基本安然无恙。是的，网络安全事件会明显增加，模型泄露对社会也是坏事，但那种情景看起来更像是加速，而非风险上的阶跃变化。
In fact, I would go further. If Claude Mythos was accidentally released as open-weight, it seems like the world would have been more or less fine. Yes, there would be a clear increase in cybersecurity incidents and it would be bad for society if the model leaked, but it would be a scenario that looks more like an acceleration than a step change in risk.
这波开放权重恐慌的新浪潮的主要鼓吹者，实际上一直在做出一个可证伪的预测——当前开放权重模型将通过瘫痪我们的网络基础设施，造成前所未有的重大 AI 危害。
The leading proponents of this new wave of open-weight fear mongering have effectively been making a falsifiable prediction — that the current open-weight models are going to cause substantial, not seen before AI harms by crippling our cyber infrastructure.
根据我掌握的所有证据——我在上文已逐一剖析——他们注定是错的。至少现在，在争论开放权重风险这么多年之后，我们将开始得到一些真正的答案。
Based on all the evidence I have, which I've unpacked above, they're set up to be wrong. At least now, after so many years of debating open weight risks, we will start to get some real answers.
_感谢 Rohit Krishnan 和 Joshua Saxe 对本文的反馈。_
_Thanks to Rohit Krishnan and Joshua Saxe for some feedback on this post._