China reports 281 security vulnerabilities in AI large model test
Chinese authorities conducted the country's first comprehensive security test of AI large models, mobilizing 559 white-hat researchers to probe 15 commercial systems. The test identified 281 vulnerabilities, with over 60 percent being novel risks specific to large models, including prompt injection, information leakage, and improper output flaws.
What happened
On September 16, 2025, results of China's first large-scale security test of AI large models were revealed at the 22nd China Network Security Conference. The test was guided by the Central Cyberspace Administration of China's Cybersecurity Coordination Bureau and organized by the National Computer Network Emergency Technology Handling and Coordination Center.
The test mobilized 559 white-hat researchers from cybersecurity companies, universities, and the general public to conduct vulnerability testing on 15 large models and applications from 10 AI companies, including foundation models, vertical domain models, agents, and model development platforms, covering both single-modal and multi-modal systems.
Reported impact
The test discovered a total of 281 security vulnerabilities, of which 177 were vulnerabilities unique to large models, accounting for more than 60 percent. Typical vulnerabilities included improper output flaws with severe harm, widespread information leakage, prompt injection as the most common vulnerability risk, insufficient protections against unlimited consumption attacks, and persistent traditional security flaws.
Given that AI large model products typically have large user bases and high usage rates, if these vulnerabilities were exploited by malicious attackers, they would cause serious impacts on China's AI large model product ecosystem.
Index analysis
Among the tested mainstream large model products, Tencent's Hunyuan, Baidu's Wenxin Yiyan, Alibaba's Tongyi App, and Zhipu's Zhipu Qingyan were found to have fewer vulnerability risks, demonstrating higher levels of security protection.
Governance controls
Officials recommended four actions: continuing to strengthen security protective measures against various vulnerabilities faced by large models; accelerating the development of AI vulnerability classification and grading standards with risk levels divided by application scenarios; using crowdsourced testing to gather white-hat capabilities and build an AI co-governance ecosystem; and strengthening intrinsic security governance by integrating security into the entire lifecycle of AI systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.