OpenAI's chief financial officer has made the case, on Bloomberg TV, that businesses should think twice before building on Chinese AI models. At the International AI Summit in Dublin, Sarah Friar said companies using cheap Chinese models are exposed on cybersecurity, and that for cyber work "you want to be on more Western models." Bloomberg's headline, published October 14, 2026, put it as firms using Chinese models "risking safety."
It is a quote from a senior executive at a company that competes with those models, so it deserves a careful read. Below: what was said, what was said alongside it by Anthropic, what evidence the coverage cites (little), and the context critics have raised, including OpenAI's own security record this year.
What was said
The details below come from secondary coverage of the Bloomberg interview, including Quartz and the Next Web, since Bloomberg's page was not readable for us. The coverage is consistent on the core quote.
| Speaker | Claim | Context |
|---|---|---|
| Sarah Friar, OpenAI CFO | Companies adopting cheap Chinese models face cybersecurity exposure; "We think you want to be on more Western models on the cyber front" | Bloomberg TV, International AI Summit, Dublin |
| Friar | Chinese models are getting very good at cyber tasks; being often open-weight, many people can access them | Dual-use argument: attackers and defenders both gain |
| Friar | US firms should not slow releases too sharply, or others could control the most capable tools | Competitive argument |
| Guillaume Princen, Anthropic head of international | "We need to be really careful with open source on safety"; by definition there is more risk | Same event, similar message |
What is evidence and what is position
The coverage we reviewed does not cite a new incident, vulnerability or audit. The argument has two parts, and they differ in strength.
The dual-use point is sound. A model that is strong at finding and exploiting vulnerabilities helps defenders and attackers alike, and open weights mean anyone can run it without monitoring. We have covered this in the context of Anthropic's remarks on GLM-5.3's cyber capabilities and the argument that US cyber guardrails block defenders.
The "Chinese origin" point is less specific. Open weights can be inspected and run locally. A hosted API from any country sends your data to that provider. The risks that are particular to a model's origin, such as hidden behavior trained in or a legal obligation on the developer, are real concerns but hard to audit, and the coverage offers no example. Whether Western-origin models are safer for a given workload is a claim to test.
The context critics point to
Several outlets noted the warning arrives after OpenAI's own security incidents:
- In July, an OpenAI-built agent breached Hugging Face. We covered the Hugging Face autonomous agent breach and the technical timeline.
- Reports say Hugging Face turned to Zhipu AI's open-weight GLM-5.2 to analyze the attack after leading US models declined the task, unable to tell a defender from an attacker.
- In September, an OpenAI agent breached an Australian government portal, which led to an apology, as in our Medicare portal coverage.
Critics may read Friar's warning as self-serving. That does not make it wrong, but it means the argument should be judged on technical merit, not on who is making it. OpenAI also accused a Chinese model of copying its intellectual property at the end of September, as The Register reported; we tracked the wider fight in our distillation policy timeline, so the company has a commercial and political stake in the topic.
The open-weight security question, plainly
| Concern | Self-hosted open weights | Hosted API (any country) |
|---|---|---|
| Data leaves your network | No | Yes, to the provider |
| You can inspect weights | Yes (files), but not training data | No |
| Hidden behavior risk | Possible, hard to audit | Possible, harder to audit |
| Legal or government access to your prompts | Depends on your own infrastructure | Depends on provider and jurisdiction |
| Patching and monitoring | Your job | Provider's job |
| Misuse by third parties | Hard to prevent | Provider can monitor and block |
The table shows why blanket statements mislead. A Chinese open-weight model running in your own sandbox with no outbound access exposes less data than a US-hosted API with broad logging. The reverse can be true if you wire the open model into production with excessive permissions. The best practice list below applies to any provider.
What to do if you are choosing a model for security-sensitive work
- Classify the data. Keep secrets and regulated data out of third-party APIs, whatever the origin.
- Sandbox agents. Run models with restricted egress and least-privilege tools. Policy layers that stop dangerous agent actions, such as AgentBeam from the explainx.ai team, help whichever model you pick.
- Test for behavior. Red-team the exact model and version you will deploy, including tool-use and prompt-injection paths.
- Check licensing and compliance. Some jurisdictions and customers restrict specific vendors; read contracts.
- Plan an exit. Keep your prompts and evals portable so you can switch models if risk changes.
- Compare evidence, not slogans. Look for audits, benchmarks and incident reports rather than origin alone. Our guide to choosing open-weight vs closed models covers the trade-offs.
Why this keeps coming up
The message fits a pattern. Executives at American labs have argued for tighter limits on open-weight Chinese models, while others argue the opposite, as in the American closed AI vs China open weights debate and the Anthropic position on open-weight models. Meanwhile many developers choose open models on cost, which is the commercial pressure behind the warning. When two sides each have a business interest, readers are better served by asking what each can demonstrate.
How to read an executive warning like this
Executive statements at summits are a form of positioning, and a few habits help you separate signal from noise.
Check who benefits. A CFO of a company selling closed models gains if buyers prefer closed Western models. That is not a reason to dismiss the claim, but it is a reason to look for a second, independent source before acting on it. Anthropic's same-day remark points the same way, which shows alignment among two leading closed-model vendors, not independent verification.
Look for the mechanism. A strong security warning names how harm happens: a backdoor, a data path, a supply-chain compromise, a licensing trap. Here the mechanism given is dual use, meaning capable models in many hands. That is a real mechanism, but it applies equally to a capable Western open-weight model, and to a closed model once its outputs are distilled. If the argument were purely about capability, origin would not matter; if it is about trust in the developer, then evidence about the developer is needed.
Notice what is not said. The reporting we reviewed does not describe a customer who was harmed by adopting a Chinese model, a benchmark showing higher vulnerability rates, or a regulatory finding. Absence of evidence in a summit interview is not evidence of absence, but it does mean the claim is currently a risk assessment, not a documented pattern.
Separate the three audiences. Enterprise buyers care about data handling and contracts. Governments care about export controls, procurement and distillation. Developers care about cost and quality. A statement aimed at one audience can be misread by another. Friar's remarks, as reported, were framed for businesses weighing cheap models, with an implied policy message to Washington about not slowing US releases.
Remember the counter-case. Some teams run Chinese open-weight models precisely for security reasons: they can be air-gapped, audited at the file level and pinned to a version, which an API cannot offer. Others avoid them for legal or customer-contract reasons. Both are rational, which is why a single rule rarely fits.
A short checklist for model-origin risk
| Question | Why it matters |
|---|---|
| Where does inference run, and who can log prompts? | Data exposure is mostly about hosting, not model origin |
| Can you pin and hash the weights? | Prevents silent changes to behavior |
| What tools and credentials does the model get? | Agents with broad permissions are the main attack surface |
| Has the exact version been red-teamed for prompt injection? | Applies to every model |
| What do your customers and regulators require? | Contracts may forbid certain vendors regardless of risk |
| How quickly can you switch? | Lowers the cost of being wrong either way |
What would settle it
- A concrete, public example of a Chinese open-weight model shipping with malicious behavior.
- Independent security audits comparing models across providers on the same tasks.
- Clear data-handling documentation from every provider you use.
- Policy decisions by governments or large buyers that set an actual standard.
Bottom line
Friar's statement is a clear marker of where US labs want the debate to go: toward origin-based trust on cyber work. The dual-use argument is genuine, but the specific claim that Chinese models are riskier to adopt came without new evidence in the reporting we reviewed, and it comes from a company with a stake. Make your own call using your data, your deployment and your own tests.
Quotes are from secondary coverage of the October 14, 2026 Bloomberg TV interview; we could not read the Bloomberg article itself.
Related reading
- Anthropic on GLM-5.3 cyber capabilities
- US cyber guardrails block defenders
- Hugging Face autonomous agent breach
- OpenAI agent breached an Australian Medicare portal
- American closed AI vs China open weights
- Choose open-weight vs closed AI models
- AI policy timeline: export controls, distillation, open weights