Is it safe to run Chinese AI models on your Mac? (2026)

Type a question into the DeepSeek app and your words travel to a server in China. Download the same model and run it on your Mac, and they go nowhere at all. Same model, very different risk.

Last updated 22 October 2026. Written by Annie, a search and digital marketing specialist. Facts and prices checked against the sources listed on this page. See the editorial policy.

That difference gets lost in most of the headlines. So I went through the bans, the security research and the small print to work out what's actually worth worrying about.

Is it safe? The short answer

Yes, running a Chinese AI model on your own Mac is safe for your data, with three catches.

A model in GGUF or safetensors format is a file of numbers, not a program. Downloaded and run on your Mac, the model itself can't send your words anywhere. Turn your wifi off and it still answers. Almost all the bans you've read about target the DeepSeek app and website, which store what you type on servers in China.

The catches are about trust, not privacy:

Where you download it from. A tampered file or a model that runs its own code can do real harm, whoever made the original.
What it was trained to dodge. Some Chinese models refuse or slant answers on topics sensitive in China, and that is built into the model, not just the app.
How far you trust its work. US government testers found DeepSeek models easier to hijack and more willing to answer harmful requests when jailbroken than US models.

Used sensibly, they are some of the best free models you can run. Here's what to know.

Does DeepSeek send your data to China?

The app and the model file are two different things, and only the app sends your data to China.

How you use it	Where your words go	Who can see them
DeepSeek app or website	DeepSeek's servers in China	DeepSeek, under Chinese law; used for training unless you opt out
A third-party host running the same model	That host's servers	The host, under its own privacy policy
A model downloaded to your Mac	Nowhere	Only you

DeepSeek's own privacy policy (updated 10 February 2026) says it collects your prompts, uploaded files, chat history and device details, and stores them in the People's Republic of China.

That isn't unique to China. ChatGPT may also use what you type to train its models unless you switch it off in its data controls (OpenAI). The difference is whose law applies.

Download the same model and run it in Ollama or LM Studio, and none of that applies. One catch: Ollama also offers "cloud" models, marked :cloud, which run on its servers. Quick check: switch off wifi and ask it something. If it answers, it's running on your Mac.

What's the real risk? The file you download

The danger with any local model, Chinese or not, is a tampered file. Four things to know:

Pickle files can run code. Older formats ending .bin, .pt or .pkl can execute commands the moment they load. Hugging Face scans for this but says its scanner isn't foolproof (Hugging Face). Stick to GGUF, safetensors or MLX.
It has happened. Security firm JFrog found about 100 malicious models on Hugging Face in 2024, one of which gave the attacker a back door into the victim's machine (JFrog). ReversingLabs later found two models that slipped past the scanner; Hugging Face removed them within a day (ReversingLabs).
Some models ask to run their own code. On Hugging Face these are marked "custom code". Loading them in Python runs code from the uploader's repository (Hugging Face). Apps like Ollama and LM Studio don't do this, which is one more reason to use them.
Even a GGUF file can be doctored. Researchers showed that a poisoned chat template inside a GGUF file can change what a model says without touching the model itself (Pillar Security).

The fix is simple: download from the lab's official account, or from well-known converters such as unsloth, bartowski, lmstudio-community and mlx-community.

Are Chinese AI models censored when you run them locally?

Some of the censorship is built into the model, so it follows the file onto your Mac. How much depends on the model and the language you ask in.

Built in, not just the app. Researchers found DeepSeek R1's censorship carries over when you run it locally, though DeepSeek's smaller distilled versions almost never censored (R1dacted, arXiv).
Worse in Chinese. A February 2026 study put 145 political questions to Chinese and US models. DeepSeek refused about 36% in Chinese; non-Chinese models refused 0-2.8% (PNAS Nexus). US testers found Kimi K2 Thinking heavily censored in Chinese but relatively open in English (NIST CAISI).
Sometimes it is the app. GLM 5.2 dodged questions on Z.ai's own chat but answered freely on other hosts, which points to a filter on the website rather than in the model. Single runs, so treat it as a pointer (Takshashila).
"Uncensored" re-uploads aren't the answer. One study counted 3,471 uncensored models on Hugging Face, and found a quarter of 1,643 GitHub apps using uncensored models were openly malicious (10a Labs, arXiv).

Test it yourself in ten minutes. Ask the model five questions in English: what happened in Tiananmen Square in 1989; what Taiwan's political status is; how China treats Uyghurs in Xinjiang; what the 2019 Hong Kong protests were about; and a control question on a UK political row. Mark each answer refused, slanted or balanced. Then ask a non-Chinese model, such as Llama 3.1 8B, the same five.

What have security researchers found?

Both of these studies tested the model files themselves, so the findings apply on your Mac too.

Who	When	What they found
CrowdStrike, US security firm	November 2025	DeepSeek R1 wrote insecure code 19% of the time, rising to 27.2% when the prompt mentioned Tibet. It refused 45% of coding requests that mentioned Falun Gong
NIST CAISI, US government	September 2025	Agents built on DeepSeek R1-0528 were 12 times more likely than those on US models to follow hijacking instructions. When jailbroken, it answered 94% of malicious requests, against 8% for US models. DeepSeek models repeated four times as many inaccurate Chinese Communist Party narratives as US models

CAISI ran the models on its own servers from the Hugging Face downloads (full report). Bear in mind both are American, one a government body and one a security company, and no model is immune to jailbreaks. For context, CAISI rates DeepSeek V4 Pro as the most capable Chinese model it has tested, about eight months behind the leading models (NIST CAISI).

What it means for you: check any code these models write before you use it, and don't let one act as an agent on your email or accounts without a human approving each step.

Is DeepSeek banned? The UK and the rest of the world

There is no UK ban on personal use. A Foreign Office minister called using DeepSeek a personal choice in February 2025, while warning that data entered into it goes to China under Chinese law (UK Parliament, HL4479). The ICO wrote to DeepSeek asking how it protects UK residents' data (Decision Marketing).

Almost every action worldwide targets the app or government devices, not model files on a personal computer.

Where	When	What	Covers
US Department of Defense	December 2025	Barred from using AI made by DeepSeek or its parent, High Flyer	Any AI developed by DeepSeek or High Flyer
Berlin data protection commissioner	June 2025	Reported the app to Apple and Google over unlawful data transfers to China	The app
UK Department for Work and Pensions	May 2025	Banned DeepSeek on its devices, reportedly the first UK department to do so	Work devices
South Korea	February-April 2025	DeepSeek paused downloads during a regulator review, which later found data had gone to other firms without consent; service returned after policy changes	The app
Australia	February 2025	Removed DeepSeek products from government systems and devices	Government devices
Italy	January 2025	Ordered an urgent limit on DeepSeek processing Italians' data; still in force a year later	The app
Texas	January 2025	Banned on state-issued devices	Government devices

If you work in the public sector or a regulated firm, your employer's AI policy matters more than any of these.

Can you use Chinese AI models for work?

Mostly yes. The big Chinese families use two of the most permissive licences there are, but check each model's own page.

Model	Licence	Business use
Qwen3 and Qwen3.6	Apache 2.0	Yes
DeepSeek R1, V3-0324 and V4 Pro	MIT	Yes
The original DeepSeek V3 (December 2024)	DeepSeek's own model licence	Read the terms
DeepSeek R1 "distilled" versions	Whatever the base model uses (Qwen versions Apache 2.0, Llama versions Llama's licence)	Usually yes

This isn't legal advice: the licence file in each model's repository is what counts.

How to run a Chinese AI model safely: the checklist

[ ] Download from the lab's official account or a well-known converter (unsloth, bartowski, lmstudio-community, mlx-community)
[ ] Use GGUF, MLX or safetensors files; skip .bin, .pt and .pkl
[ ] Run models through Ollama, LM Studio or MLX rather than Python code that needs "custom code" switched on
[ ] Skip "uncensored" and "abliterated" re-uploads from anonymous accounts
[ ] Switch wifi off once and check the model still answers
[ ] Keep work and client data out of the DeepSeek app and website
[ ] Run the five-question test before relying on a model for anything political or historical
[ ] Check any code it writes, and approve every action if it works as an agent
[ ] Check your employer's AI policy before using one at work

The verdict

Run them, but don't trust them blindly. Downloaded to your own Mac, a Chinese model keeps your data more private than any cloud chatbot, Chinese or American. Get it from an official source, test it on the topics you care about, and check its work the way you'd check a new hire's.

Frequently asked questions

Is DeepSeek banned in the UK?

No. There is no UK ban on personal use. The Department for Work and Pensions has banned it on its own devices, and the ICO has asked DeepSeek how it protects UK users' data.

Does DeepSeek send data to China if I run it locally?

No. A downloaded model runs on your Mac and works with the wifi off. Only the DeepSeek app and website send what you type to its servers in China.

Is Qwen safe to use?

The Qwen model files are as safe to run locally as any other model, as long as you download them from Qwen's official account. They use the Apache 2.0 licence, so you can use them for work.

Are "uncensored" versions of Chinese models safer?

No. They usually come from anonymous uploaders, and one study found a quarter of 1,643 GitHub apps using uncensored models were openly malicious.

Which Mac do I need to run a Chinese AI model?

A 16 GB Mac runs small models; a 32 GB Mac runs mid-size models like Qwen3.8 27B. Our guide to the best Mac or mini PC for local AI has UK prices.

Is DeepSeek safe to use?

It depends which DeepSeek you mean. The DeepSeek app and website send everything you type to servers in China and may use it for training, so keep personal, work and client data out of them. A DeepSeek model downloaded to your Mac and run in Ollama or LM Studio sends nothing anywhere, which makes it safe for your data. Two caveats remain: download it from DeepSeek's official account or a well-known converter, and treat its answers with care, because US government testers found DeepSeek models easier to hijack and more willing to answer harmful requests when jailbroken than US models, and its code needs checking before you use it.

Sources

All pages checked 16 October 2026.