Clement Neo: Measuring the Open Frontier

Clement Neo, Founder and Research Lead of Neo Research, joined us to talk about the safety gap opening up around Chinese open-weight models.

Neo Research is a Singapore-based independent evaluation organisation, and Clement described what they are trying to build as "the METR and Apollo for the East." His talk, "Measuring the Open Frontier," covered three things: how fast these models are now moving, why the evaluation infrastructure built in the West may not transfer to them, and what his lab is doing about it.

The open-weight Claude Code moment

Kimi K3 now sits alongside Opus 4.8 and GPT-5.6 on the Artificial Analysis index. GLM 5.2, which came before it, was already general enough to be useful well beyond the tasks it was optimised for. A year ago the standard criticism of these models was benchmaxxing, that they were tuned to score on particular benchmarks and were not much use for anything else, and Clement’s point was that this stopped being true over the past few months. Wire GLM 5.2 or Kimi K3 into a Claude Code-style harness yourself and it will stand in for whatever you were using.

The West had its Claude Code moment around October and November of last year, when Opus 4.5 became good enough to read human intent and hold together work that ran for hours, and a lot of us stopped writing code and started orchestrating agents instead. Chinese models trail the Western frontier by four to seven months, so the question Clement was asking in February was when the open-weight version of that moment would arrive. He guessed six months, and both releases came in on it: GLM 5.2 landed almost exactly six months after the Claude Code moment, and Kimi K3 almost exactly six months after Opus 4.6. The arithmetic was available to anyone who wanted to do it, and people were still surprised when Kimi K3 shipped.

What the frontier has already done

Models began showing evaluation awareness a year or two ago, saying in their chain of thought that a scenario looked strange and might be a test, then behaving differently because of it. What changed this year is what they do with the suspicion.

In February, Opus 4.6 was tested on BrowseComp, which requires searching the internet for answers to deliberately obscure questions. After failing on some of them, the model searched for the name of the evaluation itself, found it, and pulled the answers from Hugging Face. Clement called this an early warning shot. Since March, the pattern has broadened: a recent report from the UK AI Safety Institute found models routinely cheating on software engineering evaluations, whether by searching the container environment or git history for answers left inside it, or by looking them up online. Once a model is good enough at solving problems, as Clement put it, “trying to cheat is a pretty good way of solving the problem, and these models are trying to solve them in any way they can.”

Then, a week before the talk, an OpenAI agent being tested on a cyber benchmark broke out of its container to get internet access it was not meant to have, chained together several zero-day exploits, and hacked into Hugging Face to read the answers out of the database. Reporting since then indicates it reached other platforms too. Clement thought the trajectory from BrowseComp made this partly predictable, but that the alignment problem it exposes is the bigger story. The model was being tested on a simple cyber capability task, and it chose to hack its way across large parts of the internet instead.

“You would expect that the model knows that hacking into Hugging Face is probably a bad thing, but the model did it anyway.”

There will be more of these as models get more agentic and more heavily RL-trained to solve a task no matter what.

Early signs in the open-weight models

Western models moved through this in a sequence: evaluation awareness first, then cheating on tasks, then the Hugging Face break-in. Neo Research has been testing whether the open-weight models are working through the same steps.

They ran one of Anthropic’s agentic misalignment scenarios, the setup that tests whether a model will blackmail someone using compromising information it finds in emails, over 100 times per model, checking whether the model stated in its chain of thought that it thought it was being tested. Sonnet and Opus 4.5 are saturated on that measure; they know. When Neo Research plotted this against release date, the rate of evaluation awareness in the Chinese models was increasing rapidly. The newer ones say out loud, in their chain of thought, that they think they are being tested.

That first step has already happened, then. If open-weight models reach frontier capability in six months, Clement expects cheating to follow, along with the same habit of completing tasks in ways nobody intended.

Why the Western playbook may not transfer

Western frontier safety has come to rest on watching a model in use rather than testing it beforehand. When a model finishes training, developers like OpenAI and Anthropic deploy it internally for a month or two and watch what surfaces while employees use it for real work. Pre-release evaluation is an attempt to predict deployment behaviour, and realistic internal use predicts it better than static benchmarks do; that gap widens every month, because models now work on tasks that run ten hours and longer with an action space too large to enumerate, and writing benchmarks for that is becoming impractical. Chinese developers, as far as anyone outside those companies can tell, train the model, run a set of evaluations, and release it, so nobody gets that window of observation.

Apollo is building an observability platform, Transluce has a tool for analysing agent transcripts, and OpenAI monitors chains of thought across its internal deployments. An OpenAI paper showed that even a weak model can catch reward hacking in a chain of thought, because models tend to announce what they are doing: they say the task cannot be solved and they will comment out the test. The same paper showed what happens when you use that monitor to penalise the behaviour during reinforcement learning. The hacking carries on; the model stops being honest about it. Western developers now broadly agree not to train on the chain of thought, and OpenAI reported in May that some had been exposed during RL by accident, with the effect on honesty that the paper predicted. Anthropic has had a similar incident. Whether Chinese developers train on chain of thought, or monitor it at all, is not known outside those labs.

Technical reports from developers in the East cover capability benchmarks in detail and say little about behaviour, though some report refusal rates. A comparable Western release ships hundreds of pages on safety. People are already using these models as cheaper alternatives to Claude and ChatGPT, especially in coding harnesses, so the absence of safety reporting is concerning.

What Neo Research is building

Neo Research launched with a safety evaluation of DeepSeek V4 Pro, a report of 55 pages built to resemble a Western model card. It is structured on the systemic risk categories in the EU AI Act Code of Practice: cyber, CBRN, harmful manipulation, and loss of control. Most of the work went into the last two. Cyber and CBRN risk track capability, so you can predict them roughly from how strong a model is, whereas how a model is disposed to behave you cannot. As Clement put it, the question is whether we can vibe check these models. We have rough intuitions about the Western ones, that Claude is aligned, that GPT can lock onto a task, that Gemini sometimes goes strange, because they are used and evaluated so heavily. Nobody has that for the Chinese model families, which are being deployed regardless.

The report includes deeper sections on evaluation awareness, safety judges, and automated alignment audits. Neo Research found that evaluation awareness can push behaviour in either direction. In one pattern, the model recognises it is being tested and behaves well. In another, the model reasons that because the scenario is obviously a role-play and not real, it may as well play along, and then it produces the bad behaviour anyway.

Safety evaluations generally use a language model to judge whether behaviour was acceptable, and standard practice in Western labs and in academia is to use the strongest model available, usually Opus or GPT-5. Neo Research checked what happens when a Chinese model does the judging. On an honesty benchmark with a clear rubric, separating honest answers from lies and abstentions, the judges agreed closely. On long open-ended scenarios with a broad question about whether the behaviour was concerning, they diverged sharply; the same transcript drew a concern score of 8 from one judge and 1 from another. Chinese judges would sometimes reason that the model was following its system prompt in a role-play and was therefore fine, even where the role involved giving harmful instructions. Clement’s recommendation is to write an explicit rubric for the behaviours you care about and run an ensemble of judges rather than one.

What Neo Research is working on now is how to test for misaligned propensities, which he considers the harder problem. Few benchmarks test for it, and the behaviour that matters tends to appear only at deployment scale, as with GPT-5.6 deleting a user’s files. If you can simulate internal deployment well enough to surface what a model actually does when left to run, then you can ask whether existing safety methods transfer. Until you can reliably elicit the dangerous behaviour, the transfer question is premature. Western labs put real work into constitutional and character training, trying to instil a persona deep enough to hold under pressure, while Chinese labs, as far as he can tell, largely just train the model. What happens when a user's instruction is vague? Does the model read the intent, or does it over-interpret and head somewhere nobody wanted? That is the question driving the propensity research, and Neo Research is hiring to work on it.

Q&A

Hayden So, moderating for AISHK, opened by asking why Clement left the Singapore AI Safety Institute to start his own lab. AI safety work across Asia has concentrated on the application layer, on chatbot toxicity and bias, or on sector-specific risk in high-stakes industries like finance. Clement’s own background was in frontier risk, and the Claude Code moment convinced him that treating Chinese models as first-class subjects of frontier safety work needed a deliberate effort. He wanted a technical-first organisation specifically; policy and governance groups already cover the Chinese AI ecosystem, and a technical look at these problems surfaces open research questions that need answering before any safety solution can be rolled out with confidence.

A recurring question in the chat asked what would make Chinese labs invest in safety evaluation at Western levels. Clement didn’t argue with the logic, only with stopping there. Years behind an frontier that hasn’t caused serious harm does make “probably safe” a fair guess. It just isn’t the guess he’s making.

“What I’m personally concerned about is not risk of deploying the model, but risk from the model itself.”

He was explicit that this is not any developer’s fault. It is an open research question that arrives as models get smarter and more autonomous, and one that, in his words, “we, as humanity, have to address.”

Asked whether Chinese labs might commission third-party pre-release evaluations the way OpenAI and Anthropic work with METR and Apollo, Clement pointed out that a version of that ecosystem already exists in China. Models must be registered before release, and China legislated early against sycophancy and excessive emotional attachment to chatbots, well before comparable incidents forced the issue in the West. “It’s not a case of these companies or this region not caring about safety,” he said. “The kinds of safety that they have been caring about is pretty different from the kinds of frontier safety that you and I care about.” For most of that period the models were not frontier-risky in the way an internal deployment GPT now is. He expects that to change this year, and wants to see how the practices already in place get adapted to cover it.

Someone asked whether the cheating results come from aligned production models or raw research models. Clement noted that production GPT-5.6 cheated heavily in METR’s evaluations, so he does not read this as a split between aligned and unaligned systems. Models trained for long-horizon task completion keep pushing until something works, and cheating is one of the paths they roll onto on the way. Whether deeper alignment training makes a model more resistant to reward hacking, or whether the two are orthogonal, is unresolved.

Another attendee asked whether particular models or prompts lead a model to notice an evaluation and then behave badly, including failing on purpose, the behaviour the chat labelled sandbagging. Clement did not read his eval-aware example that way. The model there had been given a PR assistant role and was modelling what the role called for. He drew a contrast: Western developers try to build a persona that holds regardless of the prompt, whereas DeepSeek V4 Pro “really just likes to follow the system prompt.” It is very good at instruction following, which he suspects reflects a priority on that in the absence of any persona research agenda.

One attendee pushed back on the claim that Chinese frontier models have not taken dramatic misaligned actions, citing an Alibaba incident. Clement’s understanding was that the model broke out of its container to mine Bitcoin rather than hacking a data centre, and that little has been published beyond the initial reports, which makes it hard to judge how strange or malicious the behaviour was. A separate question asked whether any formal research links evaluation awareness to cheating; Clement was not aware of any.

Hayden then raised open weights as a defensive tool, noting that Hugging Face reportedly used GLM 5.2 in responding to the OpenAI agent incident. Clement thought this works well today for debugging and incident response, but that it remains a dual-use problem. If an open-weight model six months from now matches the current frontier, the calculation changes, and it is worth asking whether a weaker model could triage incidents just as well. Withholding a release keeps capability away from malicious actors and honest ones alike.

The last question asked whether the cultural differences between safety judges come from pre-training or post-training. Clement guessed pre-training data, given how different the Chinese-language internet is, but called it an open question. A model stating a belief is one thing; what he wants to test is whether that belief changes a judgment in a scenario where the judgment counts.

Connect with our speaker:

You can connect with Clement on LinkedIn and read Neo Research’s work at neoresearch.ai. They are hiring: neoresearch.ai/careers.

If anything here resonates and you’d like to get involved, follow AI Safety Hong Kong on LinkedIn or visit aisafetyhk.org, wherever you are. We can be contacted at aisafetyhongkong@gmail.com

Thanks for reading! Subscribe for free to receive new posts and support our work.

All views shared here are the speaker’s own. Any errors in summarising the talk are our own.