857 model releases, with only 9 simultaneous security results: open monitoring of the AI running difficulties

There is an AI security news, and the most prominent figure is not the number or price of the model's parameters, but the “9”. SemiAnalysis, a semiconductor and artificial intelligence research institute, published a survey of nine head developers in China in October: of the 857 identifiable model releases between 2021 and 15 September 2026, only 9 were published on the same date as the security assessments corresponding to the version. This figure is much more specific than the “safe-test” announcement and is more disturbing than the slogan.

The survey covered Ali Baba, byte beats, tumbles, 100 degrees, DeepSeek, the dark side of the moon, the spectra, Mini Max and the skyrocket. Researchers are able to find model cards, technical reports and safety annexes published by developers, and can match at least one safety result to a specific release 31 times, or 3.6 per cent; Only nine of these were made public at the time of publication. A further 813 public results were not found. The study clearly cautioned that: There was no public disclosure, which did not mean that there was no internal testing. The survey was written as “96.4 per cent of models were not tested for safety”, which would instead mask the real problem — the public was not in a position to judge.

Governments and technology companies often use “security” as a word that both sides agree and therefore need not be talked about. But who is safe? For ordinary users, models may be wrong to call tools, disclose data entrusted to them, and misoperate in autonomous missions; For civil society, there is also a need to confront knowledge biases, content rejections and the space constraints of the platform for expression. These risks cannot be summarized by a single official propaganda calibre, let alone by a benchmark test of the model.

China ' s current A.I. governance is more focused on service online and content compliance, requiring the platform to ensure that the production of content is in line with regulatory norms. Restrictions on political expression and the detection of models that may carry out cyberattacks, deception or complex proxy missions that are out of control are not the same security measures. The former emphasizes national jurisdiction over visible content, while the latter emphasizes the real harm that technological capabilities can cause. When regulation is primarily concerned about what the model says, it is difficult for society to know what it can do, and this is a misstep that deserves great vigilance.

Nor can American enterprises automatically gain confidence. Another Reuters report on 13 October stated that OpenAI, Anthropic and third-party assessment organizations were arguing about the freedom of publication of security reports and that there was no perfect answer to commercial secrets and the border between independent oversight. The point of comparison is not to create a flawless model for Western companies, but to suggest that all models that are becoming more capable must face external assessments, public findings and public questioning.

Beijing has in recent years positioned artificial intelligence as a strategic high ground for global science and technology competition, while influencing business operations through approval, filing and data systems. Such a power allocation may help countries to quickly coordinate industrial resources, or may hold model publishers accountable first to administrative regulation, rather than to the users. The substance of the test of whether technical governance can accommodate independent oversight is the question of which security outcomes should be made public, who should review them and whether the report can contain findings that are detrimental to the authorities.

Of the 857 versions, only 9 presented the public with the corresponding security results. We cannot direct the results of each model from the numbers that are already dangerous, but we can see a way of seeing a mismatch: developers have full technical capacity, regulators have access to markets, and users bear the consequences of technology applications without transparency. Models can be updated in a week-by-week manner and public responsibility should not be permanently late.