By Ellis Ward | October 13, 2026
Of the 857 models released by nine leading Chinese AI companies between 2021 and September 15, 2026, just 31 had a published safety evaluation result tied to a specific model. That is 3.6 percent. Nine of those 31 published results at or before launch. The remaining 813 released with no matched safety disclosure at all.
Those numbers come from a review conducted by SemiAnalysis, reported by Reuters on October 9, 2026. The nine companies in scope are Alibaba, ByteDance, Tencent, Baidu, DeepSeek, Moonshot, Z.AI, MiniMax, and StepFun. The review spans roughly five years of commercial and research releases across one of the most active model-development ecosystems in the world.
Before drawing conclusions, it helps to understand exactly what was measured, and what was not.
What the Study Measured
SemiAnalysis was looking for a specific thing: a published safety evaluation result that could be matched to a named model. Not a general claim that a model had been trained safely. Not a blog post asserting that safety is a priority. A documented result, connected to a specific release.
The categories that qualify include harmful output testing (does the model produce content that endangers or degrades users), jailbreak resistance (can the safety guardrails be bypassed with adversarial prompts), toxicity scoring, privacy behavior (does the model leak or mishandle sensitive information), refusal behavior (does the model decline requests it should decline), and dangerous capabilities assessment (can the model assist with weapons synthesis, cyberattack planning, or similar high-stakes tasks).
These are not exotic requirements. The AI safety research community has been publishing frameworks for model evaluation since at least 2020. Several of these categories are covered by publicly available benchmarks. The ask is not a proprietary audit. It is a documented test result, attached to a model, made available for review.
Of 857 releases, 31 met that bar.
What the Numbers Do Not Prove
3.6 percent is a low number. It should not be misread as proof that the other 96.4 percent of models were released with no safety testing at all.
Companies conduct internal testing that is never published. A model may have passed extensive red-team evaluations, adversarial prompt testing, and toxicity reviews conducted entirely inside an engineering organization, with no external disclosure. The SemiAnalysis review measures what was published and matched, not what was done. Those are different questions.
What the number does tell us: of 857 model releases over five years, only 3.6 percent resulted in any public record that safety testing occurred, linked to that specific model. Whatever internal work happened, it did not produce a document that an outside observer could find and evaluate.
The 813 undisclosed models may have been thoroughly tested. They may have been lightly tested. From the outside, there is currently no way to distinguish the two cases.
That is the problem the number describes. The problem is not "these models are dangerous." The problem is "the public record is nearly empty."
Why Timing Matters
Nine of the 31 disclosures came at or before launch. That distinction deserves attention.
A safety evaluation published after a model has been in active use for months is a different thing from one published before deployment. Pre-launch disclosure allows external researchers, regulators, enterprise buyers, and platform developers to make informed decisions before they integrate a model. Post-launch disclosure is better than nothing, but it arrives after the decision window has closed for most users.
If 857 models were released and only 9 had matched safety results at launch, that means the deployment decisions for 848 releases were made without a public safety record to consult. This includes models that have since been integrated into consumer products, enterprise APIs, and developer toolkits used at scale.
That gap matters more than it might have in 2021, for a specific reason.
The Agent Problem
The debate about AI safety disclosure has changed over the past 18 months. It is no longer primarily about a user typing a prompt and reading a response. It is about autonomous agents: systems that take multi-step actions, call external tools, browse the web, write and execute code, send communications, and complete long-horizon tasks without a human reviewing each step.
An agent deployed to manage a business workflow does not pause between steps to wait for a human to evaluate its behavior. It acts. The consequences of misaligned refusal behavior, undetected capability for harmful output, or exploitable jailbreak vulnerabilities are no longer limited to a single bad response. They can propagate across a sequence of autonomous actions before anyone notices.
The models reviewed in the SemiAnalysis study are foundation models. Some of them are powering or will power agentic applications. A model with undisclosed safety characteristics, deployed in an agentic context, does not present the same risk profile as the same model used in a closed chat interface. The evaluation gap the study documents becomes more consequential as agentic use cases expand.
This is not hypothetical. Enterprise adoption of agentic systems is growing rapidly in 2026. The infrastructure for deploying model-powered agents is mature. The safety disclosure record for the models underneath those agents, based on the SemiAnalysis review, is almost entirely blank.
What Good Disclosure Looks Like
The 3.6 percent number points to an absence. It is worth describing what a good disclosure practice would look like, not as an ideal or a wish, but as a concrete reference point.
A complete safety disclosure for a released model typically includes: the evaluation methodology (which benchmarks or custom tests were used), the version of the model evaluated (so users know whether the deployed model matches the tested model), the date of evaluation relative to the release date, results across the relevant safety dimensions (harmful output, jailbreak resistance, toxicity, refusal behavior, dangerous capabilities), any known limitations of the evaluation, and the names of the evaluating team or external reviewers if applicable.
Some companies do publish documents meeting most of these criteria. OpenAI's system cards, Anthropic's model cards, and Google DeepMind's technical reports have set reference examples in the English-language AI ecosystem. They are not uniform in scope or rigor, but they establish a norm of named-model disclosure that the SemiAnalysis findings suggest has not been broadly adopted among Chinese developers.
It is also worth noting that transparency norms vary by regulatory context. Chinese AI developers operate under a different regulatory framework than US-based firms, and some of the disclosure gap may reflect legal structures that discourage or restrict certain forms of public technical documentation. The study does not adjudicate why the gap exists. It documents that it does.
What to Watch
A few markers are worth tracking as this story develops.
Independent verification of the SemiAnalysis methodology. The review covered 857 models across nine companies over five years. Methodology matters: how the search for matched disclosures was conducted, what sources were checked, and whether any results were missed. Secondary analysis from other researchers would add confidence to the findings.
Regulatory response in the EU and the US. The EU AI Act, now in implementation, includes transparency requirements for high-risk AI systems. The extent to which frontier models from Chinese developers fall under those requirements, and how compliance will be documented, is still being worked out. SemiAnalysis findings like this one may inform how regulators define "adequate disclosure."
Voluntary disclosure from the companies named. It is possible that some companies in the study have published evaluations that the review did not capture, or that they will respond by publishing additional documentation. Any meaningful response from Alibaba, ByteDance, Tencent, Baidu, DeepSeek, Moonshot, Z.AI, MiniMax, or StepFun would update the picture materially.
Changes in disclosure rate over time. The study covers releases from 2021 to September 2026. If disclosure rates have been increasing year over year, even from a low base, that would indicate a different trajectory than a flat or declining rate. That time-series breakdown, if available, would be more informative than the aggregate 3.6 percent figure alone.
Agentic deployment context. As enterprises build agent infrastructure on top of foundation models, the question of which underlying models have safety documentation becomes operationally relevant for procurement and compliance teams. Watch for enterprise buyers beginning to require disclosure as a contracting condition.
The SemiAnalysis review is a count. What it counts, and what it does not count, are both important. The 3.6 percent figure is not a verdict. It is a measurement of what the public record currently contains. Right now, that record is nearly empty.
Source: Reuters, October 9, 2026, on the SemiAnalysis review of 857 models.
