Of the 857 model releases that SemiAnalysis tracked from nine Chinese AI developers, 31 (3.6%) had a published safety result that met the study’s test. Only nine (1.1%) had that result public at or before release. These are counts of published disclosures. They do not show whether an undisclosed model was tested privately, so a release with no disclosure should not be read as an untested one.
The census covers releases from 2021 through 15 September 2026 and includes ByteDance, Alibaba, Tencent, Baidu, DeepSeek, Moonshot, Zhipu (Z.ai), MiniMax and StepFun. For each release, the authors checked developer model cards, release notes and technical reports for a safety result that could be matched to that specific model.
As an Amazon Associate I earn from qualifying purchases.
What counted as a release and as a qualifying result
Releases
Each entry is a release identified by SemiAnalysis and recorded with its first-public date, weight status, license and source. The 857 entries split into 741 product models and 116 research models. Release counts are not fully comparable across labs, because developers differ in how finely they split a model family into named variants. One company may count sizes and snapshots as separate releases while another does not.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Qualifying results
A result qualified only if it gave a quantitative or substantive finding, for the named model, on at least one of six areas: harmful output, jailbreaks, toxicity, privacy, refusals or dangerous capability. A general statement that a model was “safety-trained” or “evaluated” did not qualify. A result for one flagship model was not carried over to other sizes or snapshots of the same family.
#1 Best Overall
“Not found” means not found in the materials the authors checked. Every figure in this article carries that scope.
The headline numbers
The table below sorts all 857 releases by what the authors found.
| Outcome | Releases | Share of 857 |
|---|---|---|
| Published qualifying safety result, any timing | 31 | 3.6% |
| of which: result available at or before release | 9 | 1.1% |
| of which: result documented after release | 16 | 1.9% |
| of which: result exists, but timing or model match could not be established | 6 | 0.7% |
| Evaluation claims with no figures | 10 | 1.2% |
| Mentioned only in press or investor accounts, with no developer documentation retrieved | 3 | 0.4% |
| No safety disclosure in the materials checked | 813 | 94.9% |
Launch timing
Of the 31 releases with a qualifying result, nine had it available at or before release. The other 16 had results documented after release. For those 16, the median delay was 42 days and the longest was 349 days. SemiAnalysis attributes the longest delay to DeepSeek-R1. The six releases in the “could not be established” row are excluded from the launch figure, because the authors could not confirm when their results appeared or that they matched the model.
Recommended Free Tools
Rank #2
Startups and large technology companies
SemiAnalysis reports rates for two groups. The five startups (DeepSeek, Moonshot, Zhipu (Z.ai), MiniMax and StepFun) account for 317 releases, of which 20 had a qualifying result. The four large technology companies (ByteDance, Alibaba, Tencent and Baidu) account for 540 releases, of which 11 had one.
| Group | Developers | Releases | With a qualifying result | Rate |
|---|---|---|---|---|
| Startups | DeepSeek, Moonshot, Zhipu (Z.ai), MiniMax, StepFun | 317 | 20 | 6.3% |
| Large technology companies | ByteDance, Alibaba, Tencent, Baidu | 540 | 11 | 2.0% |
These rates are not a ranking of companies. Companies name and count model variants differently, and Alibaba’s count includes Qwen sizes and snapshots. The study cautions against reading the rates as a league table for that reason.
What the qualifying results actually test
A published result is not the same as a broad safety test. The table shows what the qualifying documents covered.
Rank #3
| Coverage area | What the qualifying documents contain |
|---|---|
| Harmful output or refusals | 18 results |
| Jailbreak resistance | 7 results |
| Code or cybersecurity | 9 documents, 7 of them secure-code-generation benchmarks |
| Cyber-offence or biological risk | 3 documents, none from the four large technology companies |
| Dangerous-capability evaluation across the domains named in International Dialogues on AI Safety (IDAIS) statements | None among the Chinese frontier text models in the census |
The closest example to a dangerous-capability assessment is a cyber-capability note for GLM-5.3, a Zhipu model. The study does not find a frontier text model from China whose published work covers the full set of domains named in IDAIS statements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reasoning models
According to SemiAnalysis, 93% of reasoning models in the set had no published result. That is the largest gap in the disclosure record by model type.
Behavioral results at launch
Among the at-launch disclosures, the study points to behavioral evaluations for Qwen2-72B-Instruct, MiniMax-Text-01, Seed-OSS-36B-Instruct and DeepSeek-V3. A behavioral evaluation tests how a model responds to particular inputs. It is a real safety result, but it is not a broad assessment of dangerous capability, and the study keeps the two categories apart.
Rank #4
Governance and expert opinion, as the study reads them
The framework issued on 14 September 2026
SemiAnalysis describes China’s AI Safety Governance Framework 3.0 as issued by TC260 under the Cyberspace Administration of China on 14 September 2026. According to the study, the framework names risks such as models deceiving evaluators, hiding their capabilities, bypassing safeguards and acquiring unauthorized resources. The authors read the wider set of rules they reviewed as aimed at applications, content and public-facing services, not at duties triggered by a model’s capability or by training compute. That is the authors’ interpretation rather than an independent legal analysis, so rule-level detail should be checked against the official text.
Expert and official texts
The study coded 102 expert and official texts published from 2023 through September 2026. The sample was purposive, meaning selected by the authors rather than drawn at random. The percentages below describe this corpus and are not a poll of Chinese experts.
| Group of authors | Share of texts raising frontier or loss-of-control risks |
|---|---|
| Technical scientists | 36 of 42 (86%) |
| Legal scholars | 22% |
| Serving officials | 23% |
Thirteen texts in the corpus called for binding duties on frontier developers. The study reports that none of those proposals had become a binding Chinese instrument by the time of its publication.
Two quotations
The study quotes an April 2026 editorial in National Science Review, co-authored by Zeng Yi, Huang Tiejun, Jiang Yugang and Poo Mu-ming. As SemiAnalysis reports it, the editorial says that “the progress of AI governance is alarmingly slow” and that “the self-control of AI developers is an illusion.” Check the editorial for exact wording before quoting it.
The study also cites a July 2026 letter from Zhipu founder Tang Jie: “the stronger the capability, the more robust the safety constraints must be.” This wording is SemiAnalysis’s account of the letter.
How to compare labs without overreading the numbers
- Denominator and variant granularity: check how many entries a developer’s count includes, such as sizes, snapshots, product models and research models.
- Any result versus a result at launch: these are separate measures. Do not merge them into one score.
- Topic and depth: a behavioral test and a dangerous-capability assessment answer different questions.
- Source: separate results the developer published in its own documentation from claims reported secondhand through press or investor accounts.
What the figures cannot establish
- The percentages describe these nine developers only. They say nothing about other Chinese developers.
- The counts run through 15 September 2026. Later releases and results published afterwards are not included.
- The release-by-release dataset and the developers’ source documents are not reproduced here. The headline findings are SemiAnalysis’s, so model-by-model claims should be checked against the study before reuse.
The Bottom Line
Published safety results are rare across these releases, and rarer still at launch. The disclosed results are mostly narrow checks on harmful output, refusals and jailbreaks, not broad assessments of dangerous capability. For readers, the practical step is to ask which kind of result a developer published, and when, before treating a safety claim as reassurance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
