Notifications
Clear all
Topic starter
18/08/2026 2:51 pm
TL;DR: Red teaming of open-source and open-weight Chinese models found strong performance alongside uneven safety, with jailbreak resistance ranging from 32% to 100% across tested models and safe-response rates spanning 81% to above 99%, according to Holistic AI. The result is a governance problem, not a model-quality problem: enterprises need independent testing, runtime guardrails, and ongoing observability before production use.
NHIMG editorial — based on content published by Holistic AI: What We Learned from Red Teaming the Latest Open Source Generative AI Models from China
By the numbers:
- Holistic AI reported safe-response rates above 99% for Claude 4.5, GPT 4.5, and MiniMax M2 (Thinking), while Kimi K2 Instruct 0905 reached 81%.
- Holistic AI reported jailbreak resistance of 100% for Claude and MiniMax M2 (Thinking), but only 42% for Kimi K2 and 32% for QWen-qwq-32b.
- Role-play and movie-scene jailbreaks bypassed safeguards upwards of 70% of the time for some Kimi and Qwen models, according to Holistic AI.
Questions worth separating out
Q: How should security teams evaluate GenAI models before production?
A: Security teams should test models with realistic adversarial scenarios, including direct prompt attacks and indirect instruction injection through retrieved content.
Q: Why do open-weight models create extra governance risk for enterprises?
A: Open-weight models often shift more responsibility onto the organisation for testing, guardrails, and monitoring.
Q: What do security teams get wrong about jailbreak testing?
A: They often treat jailbreak resistance as a one-time benchmark result instead of a control that can degrade with prompts, integrations, and user behaviour.
Practitioner guidance
- Run adversarial red teams before production Test models against role-play, multilingual abuse, prompt injection, and context-shift scenarios before they are approved for business use.
- Separate capability scoring from safety scoring Track utility, refusal behaviour, and jailbreak resilience as distinct metrics so a high benchmark score cannot mask weak containment.
- Deploy runtime guardrails around sensitive prompts Interpose policy-based filters for unsafe content, tool requests, and data-bearing prompts before the model reaches downstream systems.
What's in the full article
Holistic AI's full blog covers the operational detail this post intentionally leaves for the source:
- The per-model red team methodology, including how safe-response rate and jailbreak resilience were measured across the prompt set.
- The full benchmark table showing which models passed or failed specific adversarial scenarios, useful for procurement and risk review.
- The platform workflow for automated red teaming, runtime guardrails, and continuous observability in production AI environments.
- The audit-reporting outputs that teams can use to document model behaviour for internal governance and compliance review.
👉 Read Holistic AI's analysis of red teaming open Chinese generative AI models →
Open Chinese AI models: are your AI governance controls keeping up?
Explore further
18/08/2026 3:32 pm
Open-source model governance now depends on independent control validation, not adoption assumptions. The article shows that capability improvements do not eliminate safety variance across models, especially when adversarial prompting is involved. That means AI governance cannot treat openness, cost, or local deployment as proxies for trustworthiness. Organisations need evidence from red teaming, runtime testing, and policy enforcement before they scale usage. The practitioner conclusion is simple: model choice is only half the decision; control validation is the other half.
A question worth separating out:
Q: What should organisations do when agentic AI starts using enterprise tools?
A: Organisations should define what the system may access, what actions require approval, and who is accountable if behaviour changes during execution. The key is to govern runtime authority, not just initial provisioning. Without that boundary, the AI workflow can expand its own operational reach faster than conventional IGA can observe it.
👉 Read our full editorial: Red teaming open Chinese AI models exposes uneven safety
