Anthropic, OpenAI Warn on Chinese and Open-Weight AI

OpenAI’s finance chief urged businesses to favor Western AI models on cybersecurity grounds. Anthropic’s international chief warned that open models carry greater risk “by definition.” Both remarks target enterprise buying decisions, but neither establishes that a model’s country of origin or distribution format determines its security.

Sarah Friar, OpenAI’s chief financial officer, and Guillaume Princen, Anthropic’s head of international, made the remarks in Bloomberg TV appearances at the International AI Summit in Dublin on October 14, 2026, according to The Next Web’s reporting.

The distinction matters because these are consequential statements from executives whose companies sell proprietary alternatives. Their warnings deserve scrutiny as vendor risk assessments, not treatment as an independently demonstrated ranking of Chinese, Western, open-weight and closed models.

A reported defensive use of a Chinese model illustrates the problem with that ranking. Hugging Face said it ran GLM-5.2 on its own infrastructure to investigate an AI-driven intrusion after commercial model safeguards blocked its forensic work. There is also an unresolved attribution gap: secondary reporting identifies OpenAI models with the intrusion, while Hugging Face’s cited disclosure did not identify the attacker’s underlying model.

Friar and Princen Made Different Claims

Friar’s warning concerned businesses choosing low-cost Chinese models. In The Next Web’s account, she presented Western alternatives as preferable on cybersecurity:

“We think you want to be on more Western models on the cyber front.”

That is procurement advice framed around model origin. The quoted statement does not identify a particular vulnerability, deployment configuration or comparative security test. It also leaves important questions unanswered: whether the concern is the model itself, the company hosting it, data handling, or the capabilities available to malicious users.

Princen’s argument addressed openness rather than nationality. According to The Next Web’s reporting on his appearance, he said:

“We need to be really careful with open-source on safety.”

He then added:

“I can’t talk for open models. But by definition, there’s more risk with them.”

The phrase “by definition” makes that claim broader than a warning about one model or one unsafe deployment. It assigns additional risk to the category itself.

These statements should not be collapsed into a single technical finding. A Chinese model is not necessarily an open model, and an open-weight model is not necessarily Chinese. Model origin, access to weights and the location of deployment are separate characteristics.

Princen used “open-source,” while Hugging Face described its defensive tool as “open-weight.” Those terms should not be treated as interchangeable evidence about licensing or complete access to a model’s development process. The relevant feature in Hugging Face’s account was practical: it could run the model on its own infrastructure.

The Warnings Came From Competitors on a Policy Stage

OpenAI and Anthropic sell proprietary models to businesses. Advice to avoid competing categories therefore has a commercial context, even when the executives’ concerns are sincere. That interest does not invalidate a security warning, but it makes the supporting evidence especially important.

The venue adds another dimension. The Next Web describes the International AI Summit as an official event of Ireland’s EU Council Presidency. Statements delivered there sit within a policy conversation as well as a sales conversation. They can shape how buyers and officials discuss acceptable AI suppliers without amounting to formal regulatory proposals.

Princen’s wording also appears broader than a previously reported position from Anthropic’s chief executive. The Next Web reported that Dario Amodei wrote in July that Anthropic had never advocated banning open-weight models and that models without dangerous capabilities could be a public good.

That earlier position was conditional: the assessment depended on capabilities. Princen’s quoted formulation attached greater risk to openness itself.

The difference is worth noting, but it does not establish that Anthropic formally changed its policy. An executive interview and a chief executive’s written argument are not interchangeable policy documents. What buyers can reasonably ask is which position governs Anthropic’s actual recommendations, and what evidence supports it.

The reporting accompanying these appearances does not provide a like-for-like technical comparison demonstrating that Western closed models are categorically safer under equivalent deployment conditions.

Hugging Face Reported a Defensive Benefit From Local GLM-5.2

Hugging Face’s July 16 incident disclosure provides a concrete counterexample to the idea that choosing a Chinese open-weight model must increase every relevant security risk.

The company said an autonomous agent system had driven an intrusion into part of its production infrastructure. It reported unauthorized access to a limited set of internal datasets and several service credentials. To reconstruct the attack, responders used AI analysis over more than 17,000 recorded events.

Its first attempt relied on frontier models accessed through commercial APIs. According to Hugging Face, those services blocked requests containing real attack commands, exploit payloads and command-and-control artifacts. The material needed to investigate the incident triggered the providers’ safety safeguards.

Hugging Face said it instead performed the forensic analysis using the Chinese open-weight model GLM-5.2 on its own infrastructure. That arrangement also meant attacker data and the credentials referenced in it did not leave its environment.

The claimed benefit was specific: the locally deployed model allowed responders to analyze sensitive attack material that hosted services had refused to process. Hugging Face said the analysis helped reconstruct the timeline, identify compromised credentials and distinguish actual impact from decoy activity.

That is not a controlled comparison showing that GLM-5.2 is safer than OpenAI or Anthropic models. It is an organization’s account of a defensive workflow in which local access and fewer processing restrictions were useful.

There is an important limit to the incident’s attribution. The Next Web describes the intrusion as involving OpenAI models. However, Hugging Face’s cited July disclosure explicitly said it did not know which model powered the attacker’s agents. It considered both a jailbroken hosted model and an unrestricted open-weight model possible.

The cited primary disclosure therefore does not establish the later OpenAI attribution, and the available reporting does not resolve that evidentiary gap. The intrusion should not be presented here as a confirmed OpenAI-model breach.

The narrower defensive observation remains relevant regardless of the attacker’s model. Hugging Face reported that a self-hosted Chinese open-weight model helped its investigation when commercial API safeguards obstructed it. The company also explicitly said its experience was not an argument against safety measures on hosted models.

Buyers Need to Separate Misuse Risk From Deployment Risk

The Hugging Face account exposes a distinction missing from categorical warnings: a control that restricts harmful assistance can also interfere with legitimate defensive analysis. Whether that tradeoff is acceptable depends on the task and the operating environment.

One question is whether malicious users can obtain dangerous assistance. Another is whether a business can keep sensitive information within its chosen infrastructure. A third is whether an AI agent has permission to reach systems or credentials it should not access. A statement about one of these risks does not automatically answer the others.

For example, a model’s refusal to generate exploit instructions would not, by itself, demonstrate that an agent built around it has appropriately restricted access to production systems. Equally, running a model locally addresses a data-transfer concern without proving that the model or surrounding application is secure.

A useful procurement assessment would ask:

• What threat does the warning address? Require the supplier to distinguish harmful assistance, confidential-data exposure, unauthorized actions and weaknesses in the surrounding application.
• Where will sensitive material go? Establish where prompts, logs, credentials and outputs are processed and retained. Hugging Face’s reported advantage depended partly on keeping forensic material inside its environment.
• Who controls the model and its tools? Evaluate the actual access rules, permissions and operational responsibilities rather than assuming that a vendor name or model category supplies those controls.
• What evidence matches the proposed use? Ask for evaluations relevant to the business’s tasks and deployment. A broad assertion about openness or nationality is not a substitute for testing the system being purchased.

Hosted services provide a point at which a provider can enforce access and usage rules. Local deployment gives the operator control over where processing occurs. Hugging Face’s experience demonstrates why those differences can matter without establishing a universal winner.

Friar and Princen have put consequential advice into the enterprise AI buying conversation. The defensible response is to ask them to make the security case at the same level of specificity as the purchasing decision: which model, which threat, which controls and which evidence.

Until that case is supplied, their remarks are attributed warnings from competing vendors. They are not sufficient grounds for treating Chinese or open-weight models as categorically unsafe, nor for assuming that Western closed models make the surrounding system secure.