For nearly two years, one comforting idea has shaped how companies and government contractors adopt open-weight AI models that anyone can download and run. If we run the weights on our own servers, the thinking goes, our data can't leave the building and our systems are secure.

It's easy to see why that idea caught on.

Security chiefs and policymakers in Ottawa, Washington (DC), London, Berlin, and Tokyo have been offered two kinds of black box. The first is the closed API from a big lab: send proprietary code and sensitive data into someone else's cloud and take the vendor's word that the model is safe, without ever seeing the data lineage or the trade-offs around safety behind it. The second looked like the way out: download an open-weight model, host it on your own hardware, and you don't have to trust the provider at all.

Thousands of engineering teams have taken the second road, and a growing share took it with Chinese models, which are capable and cheap. In the year before March 2026, Chinese models accounted for 41 percent of downloads on Hugging Face, according to the platform's spring 2026 report. On OpenRouter, a service that routes requests to many different AI models, they handled more than 30 percent of the AI work companies ran through the platform every week from February through early July. When lawmakers in Washington opened an investigation into corporate use of Chinese models this spring, one chief executive summed up a view common in boardrooms well beyond the United States, "An open-source model does not have access to data. It doesn't work that way," implying that simply hosting a model in a trusted environment makes it safe.