# Why Running Chinese Open-Source Models Yourself Is the Safest and Cheapest Option > A plain explanation of why self-hosted open-weight models like GLM, Kimi, and DeepSeek are both cheaper and safer than closed frontier APIs, down to the mechanism behind each claim. Published: 2026-07-06. Last updated: 2026-07-06. The exchange keeps happening in enterprise AI, almost word for word. "We can't use an open-source model. It's all Chinese." Even if it's 100x cheaper? "No. We care about safety and security." That answer gets both halves of the trade-off backwards. Running open-source models like GLM, Kimi, and DeepSeek yourself is usually cheaper and safer than piping your data to a closed frontier API. Not as a slogan, as a matter of how the two things actually work. Start with the one fact everything else follows from. A model is a file. A few hundred gigabytes of numbers that, given some text, predict the next token. Anthropic and OpenAI keep their files secret and run them only on their own servers. The labs behind GLM, Kimi, and DeepSeek publish theirs, so anyone can download the file and run it. That single difference, secret-and-hosted versus published-and-yours, is what makes one path expensive and exposed and the other cheap and private. ## Why it's cheaper When you call a closed API, you're paying for three things bundled together: the compute to run the model, the cost of training it, and the lab's margin. There's exactly one seller of that specific model, so there's no price competition on it. You pay what they charge. An open model unbundles that. The weights are free, so nobody is charging you to recoup a training run or protect a franchise. You pay for compute, and only compute. Then two mechanisms drive that compute cost down hard. The first is architecture. Modern open models use a mixture-of-experts design, where only a small fraction of the network activates for any given token. The file is huge, but the work per token is small, which is [why NVIDIA measures roughly a 10x drop in cost per token](https://blogs.nvidia.com/blog/mixture-of-experts-frontier-models/) versus dense models of similar quality. The second is competition. Because the weights are public, dozens of providers, Fireworks, Together, Groq, DeepInfra, all serve the exact same model and compete on nothing but price and speed. That races the cost toward the raw price of the GPUs. [DeepInfra drove one large open model from 20 cents per million tokens to 10 to 5](https://blogs.nvidia.com/blog/inference-open-source-models-blackwell-reduce-cost-per-token/) just by moving hardware generations. [NBC News reports](https://www.nbcnews.com/tech/innovation/silicon-valley-building-free-chinese-ai-rcna242430) the net effect is Chinese open models running ten to fifty times cheaper than Western equivalents. Nobody can do that to a closed model, because nobody else is allowed to serve it. ## Why it's safer Now the part people get exactly wrong. Safety was never a property of the model. It's a property of where the model runs. A closed model is a service. Every prompt you send, the contract, the customer record, the roadmap, crosses the wire to the lab's servers, and it lives there. "Delete" is a policy, not a physical fact. The clearest proof arrived in 2025, when a court ordered OpenAI to [preserve all ChatGPT and API output logs indefinitely](https://www.terms.law/2025/11/12/openai-v-new-york-times-stopped-being-just-a-copyright-case-the-moment-the-court-turned-to-your-chatgpt-logs/), overriding its own deletion policy and its users' delete requests, and later to hand 20 million de-identified conversations to opposing counsel. Once your data is on someone else's servers, its fate is out of your hands. A subpoena, a breach, or a policy change reaches it, and you find out afterward. A published model has none of that. You download the file and run it on your own hardware, or in a US datacenter you control on AWS, Azure, or GCP. The weights have no channel back to their creator. As Interconnects' Nathan Lambert [puts it](https://www.interconnects.ai/p/what-people-get-wrong-about-the-leading), "model weights alone cannot reveal anything to their creators." Beijing cannot see a prompt that never left your VPC, and neither can anyone else. Hosted on a Chinese company's own API, a Chinese model does send your prompts across the Pacific, and nobody should route sensitive data there. Self-hosted, the country of origin is a fact about the training run, not about where your data goes. There's a second, subtler exposure the "safe" default carries. A frontier lab isn't just a vendor, it's a company with its own product roadmap, and lately it points at its customers. Figma and Cursor both built on Anthropic, then watched it launch [Claude Design into Figma's market](https://venturebeat.com/technology/anthropic-just-launched-claude-design-an-ai-tool-that-turns-prompts-into-prototypes-and-challenges-figma), knocking [7% off Figma's value in a day](https://www.fastcompany.com/91538439/design-enters-its-frenemies-era), and Claude Code into Cursor's. Nobody has to read your individual prompts to benefit from that arrangement; aggregate usage alone maps which categories are worth entering. Self-hosted weights don't have a product team, and they can't grow into your competitor. ## The risks that survive the debunk Open weights aren't risk-free. [CEPA is right](https://cepa.org/article/the-ai-kill-switch-dangerous-chinese-open-source/) that backdoors buried in weights are hard to detect, and censorship on China-sensitive topics is baked in. But notice these are output risks, and they apply to every model from every lab. Any model can be prompt-injected or emit a bad dependency. Trusting a particular lab doesn't fix that. Architecture does: least privilege, secrets kept out of the model's reach, sandboxed outputs, everything logged. ## Trust the architecture, not the flag If your system is only safe when the model is benevolent, it isn't safe. That's the principle General Input is architected on: the AI never sees an API key. Credentials are encrypted at rest, injected at runtime, and stripped before anything reaches the model, and every external call it makes lands in an audit trail. The trust boundary sits below the model, so provenance stops being a security review and becomes a line item, price and latency and benchmark score. The model doesn't matter. The host does. And the safest, cheapest host is you. ## FAQ ### Can a Chinese open-source model send my data back to China? Not when you self-host it. The model is a file of weights with no network access of its own. Run it on your own hardware or in a US datacenter you control, and your prompts never leave that boundary. The country of origin describes where the model was trained, not where your data goes. Sending prompts to a Chinese-hosted API is a different story, and that data does leave. ### Why are open-source models so much cheaper than closed APIs? The weights are free, so you only pay for compute. Mixture-of-experts models activate a small fraction of the network per token, and because dozens of inference providers serve the exact same open model, they compete purely on price. A closed model has one seller and no price competition, so you pay for compute plus training recovery plus margin. ### Is a self-hosted open model really safer than OpenAI or Anthropic? For data privacy, yes. A closed model runs only on the lab's servers, so every prompt lives there. A 2025 court order forced OpenAI to retain all logs indefinitely, overriding its own delete policy. A self-hosted file has no channel back to anyone, so there is no counterparty to trust in the first place. ### What are the real risks of open-weight models then? Backdoors hidden in weights and baked-in censorship on China-sensitive topics. But these are output risks that apply to every model from every lab, and the mitigation is architectural: least privilege, secrets kept out of the model, sandboxed outputs, and full logging.