The founder of China's most prominent AI lab has made an unambiguous case for openness. Frontier AI should stay broadly accessible rather than controlled by a select few, Zhipu's Tang Jie wrote in an internal memo reviewed by Bloomberg.

His argument inverts the usual security logic. Real safety comes from broad participation, sharing, and oversight, he said, not from technological barriers.

Zhipu has backed that with product. It released GLM-5.2 under an open-source licence, free to download and commercialise.

The awkward timing

Tang made the comments shortly after Reuters reported that Beijing is considering the opposite. Chinese officials are weighing limits on overseas access to the country's most advanced open models.

That puts Zhipu's founder at odds with the direction of travel in his own capital. Openness has been China's strategic advantage, and now its government is wondering whether it gave away too much.

The company has commercial reasons to want the door open. Its models have spread globally precisely because they are free, and cheap Chinese models are now closing in on the US frontier labs.

That does not make the argument wrong. It does mean the person making it stands to benefit from it, which is true of nearly everyone in this debate.

The case he is making

The open-source security argument is not fringe. Its logic is that many independent eyes on a system find flaws faster than a small team behind a wall.

Defenders make the same point. When Washington restricted a frontier model, 100 cybersecurity experts signed an open letter arguing the ban hurt defenders more than attackers.

Attackers, they argued, will obtain capable models regardless. The people locked out are the researchers and security teams trying to keep up.

The case against

The closed camp has a straightforward reply. An open-weight model cannot be recalled, patched, or switched off once it is downloaded.

Publishing frontier capabilities means publishing them to everyone, including people building bioweapons or industrial-scale cyberattacks. Safeguards trained into a model can be stripped out by anyone with the weights and a modest budget.

Both sides are describing real risks. The disagreement is about which risk is larger, and there is no clean empirical answer yet.

Why it matters now

Zhipu is no longer a curiosity. It has raised billions, listed in Hong Kong, and its share sale drew heavy demand from investors betting Chinese AI fills the gap left by restricted US models.

So the question is no longer academic. If China does restrict its open models, the world's main source of free frontier-class AI closes at the same time as America's.

Tang is arguing against that outcome from inside the country most likely to cause it. Whether anyone in Beijing is listening is the part he cannot control.