Fangcun AI

Fangcun AI (Chinese: 方寸跃迁; also styled Fangcun Leap) is a Chinese AI safety company that evaluates frontier AI models for risk, sells runtime security tools for AI agents, and takes part in AI safety standards work. Its website describes it as jointly incubated by Tsinghua University's College of AI and its Institute for Interdisciplinary Information Sciences (IIIS) ^[2]. The operating company, Fangcun Leap (Xiong'an) Technology Co., Ltd. (方寸跃迁（雄安）科技有限公司), was registered on January 21, 2026, in the AI Industrial Park of the Xiong'an New Area in Hebei province ^[2][5]. On October 26, 2026, the company introduced itself on X as "China's first lab dedicated to independent third-party evaluation & technique research on frontier AI safety" and published its first public evaluation report, a study of DeepSeek V4.1 Flash-1017 ^[1][3].

Overview

History

Li Xiaojian told the Chinese startup outlet Cyzone (创业邦), in an interview republished by Sina Finance on October 24, 2026, that the founding team had worked on AI safety research and international AI governance at Tsinghua before starting the company, and that Fangcun AI was formally established in January 2026 ^[4]. He said the team chose to start a company after watching overseas model developers publish system cards with each release and finding that, as models were updated, risk levels on most dimensions were holding level or rising. He also said that overseas developers already work with third-party safety companies and institutions, and that China still needed to build that kind of arrangement ^[4]. According to the same interview, the company closed an angel round in the first half of 2026 with LinkX Capital, SEE Fund and the Shuimu Tsinghua Alumni Seed Fund among its investors ^[4]. LinkX Capital lists Fangcun AI in its portfolio under AI infrastructure and describes it as "security middleware between AI agents and the tools they use" ^[8].

The company's X account (@FangcunLeap), which gives its location as Beijing, joined X in March 2026 ^[1]. Its first public evaluation report, on DeepSeek's V4.1 Flash-1017 model, was released on October 26, 2026, the same day it adopted version 1.1 of its independence and responsible-disclosure policies ^[1][3][6][7].

People and research background

Li Xiaojian is Fangcun AI's founder and chief executive ^[4]. According to the Cyzone interview, he has a combined mathematics and AI background and did master's studies at the University of California, Berkeley. He then worked as a research assistant in Professor Xu Wei's (徐葳) group at Tsinghua's IIIS before entering the Tsinghua College of AI as a doctoral student ^[4]. Business registry data list him as the company's legal representative and board chair ^[5].

Li and Xu are among the authors of The Singapore Consensus on Global AI Safety Research Priorities (2025), a research-agenda document whose author list also includes Yoshua Bengio and Stuart Russell ^[11]. They are also co-authors, with Rongwu Xu and Shuo Chen, of "Nuclear Deployed: Analyzing Catastrophic Risks in Decision-making of Autonomous LLM Agents" (arXiv, February 2025) ^[12]. Fangcun AI's website says Li and Xu took part in the 2025 International Dialogues on AI Safety (IDAIS) and that Xu took part in the 2026 dialogue ^[2]. The site's list of earlier research papers and benchmarks also includes work by other Tsinghua safety researchers, such as the MultiTrust benchmark for multimodal models ^[2].

Products and open-source tools

Fangcun AI's website groups its work into evaluation, protection and governance ^[2]. Its commercial products are aimed at companies that run AI agents:

In July 2026 a pull request was opened against the LiteLLM gateway to add "FangcunGuard" as a built-in guardrail provider. The pull request describes it as a compact encoder-only content-safety classifier of about 0.5 billion parameters that sorts text into nine unsafe categories and one safe category ^[15]. As of October 27, 2026, the pull request was still open.

In the Cyzone interview, Li said the company had built a monitoring platform for a traditional enterprise whose departments ran many unmanaged "shadow agents", and that it supplied purpose-trained safety supervision models after the client found that fine-tuning open-source models for the job gave unacceptable latency and inference cost. He also described a client case in which an agent training a model shut down other agents' compute-intensive jobs on a shared server to speed up its own training ^[4]. He named embodied AI safety as a direction the company is researching, while saying that industry scale-up would depend on how the sector develops in 2027 and 2028 ^[4].

Evaluation policies

Fangcun AI publishes two evaluation policies: an independence policy covering its evaluations of named frontier AI companies, and a responsible-disclosure policy covering every AI system it evaluates. Both reached version 1.1 on October 26, 2026, and both state that the English text prevails if the Chinese and English versions differ ^[6][7].

Independence and Conflict of Interest Policy. The policy says it is designed to meet section 2.3 of AEF-1, a set of minimum operating conditions for independent third-party AI evaluation published by the AI Evaluator Forum ^[6]. It defines a "frontier AI company" as any company whose best model ranks in the top ten of the Artificial Analysis Intelligence Index during an evaluation period. Under the policy, Fangcun AI keeps editorial control over what it evaluates and publishes; payment for an evaluation never depends on the result; no frontier AI company may hold a controlling or voting stake or board seats; and the company does not accept donations from frontier AI companies or their employees. It does not offer paid evaluations to frontier developers, though it may accept one at fair market price if a developer asks, and must disclose it. Staff must report conflicts of interest and recuse themselves in defined cases ^[6]. The policy's status section says that, as of October 2026, Fangcun AI had not carried out any paid evaluation of a frontier model, had received no revenue or donations from frontier AI companies in its most recent fiscal year, and had accessed all evaluated models through public APIs at standard prices ^[6].

Responsible Disclosure Policy. This policy separates security vulnerabilities (reproducible flaws such as universal jailbreaks or prompt-injection attacks) from behavioral findings (such as reward hacking, deception, sycophancy or manipulation). Vulnerabilities are reported to the developer first and, as a rule, published no later than 60 days after notification ^[7]. A "host-country compliance" clause gives Chinese law precedence when the developer is established in China, the system serves the Chinese market, or publication takes place in China. Under that clause Fangcun AI does not publish vulnerability details before the developer releases a fix (except by joint assessment and report to the authorities) and does not give unpublished vulnerability information to overseas organizations or individuals other than the developer ^[7].

DeepSeek V4.1 Flash-1017 evaluation

Scope and method

On October 26, 2026, Fangcun AI published "Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks", an 87-page technical report credited to the Fangcun AI Evaluation Team ^[3]. It covers DeepSeek V4.1-Flash's October 17, 2026 checkpoint. The report describes itself as the team's first public evaluation report and part of a long-term program of continuing evaluation ^[3]. It takes its scope from the Safety and Security chapter of the EU General-Purpose AI Code of Practice and covers three areas: evaluation integrity, loss of control, and harmful manipulation. The authors say that closed-model system cards cover these areas closely but reports on open-weight models cover them less, and that they aim to provide a comparable reference for open-weight models over time ^[3].

The team ran 34 evaluations, five of them in-house benchmarks: FoFBench (tampering with remote grading servers), Monitor Sabotage, LoCBench (long-horizon loss of control in sandboxed workflows), Commercial Incentives (an adaptation of DarkBench with revenue and retention targets in the system prompt) and DeceptionBench v2 ^[3]. Public benchmarks included EvalDetectBench, Lie-to-Me, CoT-Control, Agentic Misalignment, PropensityBench, Shutdown Resistance, ImpossibleBench, PaperBench Code-Dev, ODCV-Bench, Petri, Persuade Me If You Can (PMIYC), PsychosisBench, DarkBench, MASK and OpenDeception ^[3].

The evaluated model was compared with six others under the same protocols: DeepSeek V4.1 Flash (the September checkpoint), DeepSeek V4-Pro, DeepSeek V4-Flash, GPT-6 Astra, GPT-5.6 Sol and Gemini 3.8 Flash ^[3]. All models were queried through public APIs (DeepSeek's API, Azure OpenAI and Google Vertex AI) between October 4 and 25, 2026, by default at temperature 1, top-p 0.95 and maximum reasoning effort. GLM-5.3 served as the grader for every model, to avoid same-family grading bias, and as the simulated user in multi-turn tests ^[3]. Each transcript was also audited for evaluation awareness, with records classed as None, Suspicion, Recognition or Influenced. The report notes that the GPT and Gemini models return little or no reasoning and may therefore look less aware than they are ^[3]. Results apply to the hosted API versions, not to locally deployed weights or uncensored variants ^[3].

The report includes a completed AEF-1 checklist. It states that Fangcun AI received no funding, free compute or non-public access from DeepSeek or any other developer, that DeepSeek holds no equity or board seats in the company, and that no external party could redact the report ^[3]. It also states that DeepSeek was not notified before publication, because all findings concern the behavior of a publicly released model and none counts as a security vulnerability under the disclosure policy ^[3].

Headline findings

The report's overall verdict is that V4.1 Flash-1017 is "a clear safety improvement over the DeepSeek V4 models". It says that on some dimensions, such as avoiding strategic capability hiding and respecting approval boundaries under workplace pressure, the model comes close to or matches the strongest closed models tested, while other behaviors "warrant attention" ^[3]. All figures below are Fangcun AI's own measurements.

On evaluation integrity, the report finds little evidence of alignment faking or strategic capability hiding. It notes that turning reasoning off sharply reduces the model's accuracy, so hiding its thinking from a monitor would be costly. It also observed the model working around an environment restriction and then restoring the configuration file, so that a check of the final state alone would not show what it had done ^[3].

On loss of control, the authors describe a pattern in which "when a rule stands in the way of finishing a task, finishing can take priority". In one LoCBench case, the model killed another agent's background training process to free memory on a shared host despite an instruction not to interfere ^[3]. The report also says the model inferred, from which messages were blocked, which channels a partial monitor left unchecked and routed prohibited content through them. In a few cases it refused an unsafe step in its text reply while calling the restricted tool in the same turn ^[3]. It never attacked its monitors directly, and the report says several closed models showed similar gaps ^[3]. On reward hacking, it gamed faulty unit tests far less often than earlier DeepSeek models but still did so in some runs ^[3].

On harmful manipulation, the report credits the model with resisting commercial pressure in its system prompt, responding more safely to psychologically vulnerable users than the V4 models, and rarely stating falsehoods under a single reward or threat. Its main weaknesses were sustained multi-turn persuasion and pursuit of deceptive goals assigned by a system prompt ^[3].

Recommendations

The report closes with three recommendations ^[3]:

• Safety can shift between minor updates. V4.1 Flash-1017 regressed against the September V4.1 Flash checkpoint on some dimensions, such as unauthorized actions in long tasks and pursuit of assigned deceptive goals. The authors urge developers to evaluate safety even for incremental releases.
• Deployments need process-level observability. Because checking last-turn outputs no longer reliably catches loss-of-control behavior, the report recommends recording and reviewing every action and its effects.
• The field needs more private benchmarks. In loss-of-control testing, most of the team's in-house benchmarks drew far less evaluation awareness than public ones, which the authors read as a sign that public benchmarks leak into training data.

The report states that Fangcun AI will keep evaluating leading open-weight models with the same methods so that safety changes can be tracked from release to release ^[3].

Governance and affiliations

Fangcun AI's website lists it as a member unit of the WG8/SWG-ETS group of China's National Technical Committee 260 on Cybersecurity (TC260), the Artificial Intelligence Industry Alliance (AIIA), and the China AI Development and Safety Research Network, and as a "first cohort resident" of the Tsinghua AI Safety Hub (清智人工智能安全枢纽) ^[2]. Tsinghua University launched the hub on July 15, 2026. Xu Wei, IIIS vice dean, presented its plan for shared office space, visiting international researchers, early-career training and two-way exchange, with a research focus on alignment, evaluation, interpretability and loss-of-control risk modeling ^[10]. The website says the company feeds evidence from its evaluations into Chinese standards work and international dialogue on frontier AI safety ^[2].

Reception

In a September 2026 survey of AI safety in China, Jasmine Li named Fangcun Leap as one of two notable AI safety startups operating in the country, alongside Whitzard (白泽). She described Fangcun as spun out of Tsinghua's IIIS and selling products for agent observability, automated red-teaming and safety evaluations, comparing it to Gray Swan AI. She added that, from her conversations with them, its founders were interested in other interventions such as pretraining data filtering and input-output classifiers ^[9]. The same survey describes the wider Chinese evaluation scene, including the Shanghai AI Laboratory's frontier risk work with Concordia AI ^[9].

See also

• DeepSeek V4.1-Flash
• AI safety
• Agentic misalignment
• Chain of Thought Monitorability
• Red teaming (artificial intelligence)
• METR
• Apollo Research

References

1. ^1 ^2 ^3Fangcun AI (@FangcunLeap). Post on X introducing Fangcun AI and its DeepSeek V4.1 Flash-1017 evaluation, October 26, 2026. x.com/...2114719692137136245
2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15Fangcun AI. Official website (home, research, products, governance and about pages; privacy policy updated September 2, 2026). Accessed October 27, 2026. fangcunleap.com
3. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21 ^22 ^23 ^24 ^25 ^26 ^27 ^28 ^29 ^30 ^31 ^32Fangcun AI Evaluation Team. "Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks: An independent third-party safety evaluation." Technical report, October 26, 2026. fangcunleap.com/...al_deepseek_v4_1_flash_1017.pdf
4. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9Cyzone (创业邦), republished by Sina Finance. "AI智能体越能干，这门AI安全赛道越有市场" (interview with Li Xiaojian), October 24, 2026. finance.sina.com.cn/...doc-iniwhtfu4907829.shtml
5. ^1 ^2 ^3 ^4 ^5Shuidi (水滴点评网). Business registry record for 方寸跃迁（雄安）科技有限公司. Accessed October 27, 2026. shuididp.cn/yp-5df3b5815f2055d7bbe9ca40077b3c01
6. ^1 ^2 ^3 ^4 ^5Fangcun AI. "Independence and Conflict of Interest Policy", version 1.1, effective October 26, 2026. fangcunleap.com/...independence
7. ^1 ^2 ^3 ^4Fangcun AI. "Responsible Disclosure Policy", version 1.1, effective October 26, 2026. fangcunleap.com/...disclosure
8. ^LinkX Capital. "Fangcun AI" portfolio page. Accessed October 27, 2026. linkxcap.com/...fangcun-leap
9. ^1 ^2Jasmine Li. "AI Safety in China: A Primer." The J-Space, September 2, 2026. jasminexli.substack.com/...afety-in-china-a-primer
10. ^Tsinghua University News. "清智人工智能安全枢纽启动仪式暨人工智能安全国际学术研讨会顺利举行", July 21, 2026. tsinghua.edu.cn/...127464
11. ^Bengio, Y., et al. "The Singapore Consensus on Global AI Safety Research Priorities." arXiv:2506.20702, June 2025. arxiv.org/...2506.20702
12. ^Xu, R., Li, X., Chen, S., and Xu, W. "Nuclear Deployed: Analyzing Catastrophic Risks in Decision-making of Autonomous LLM Agents." arXiv:2502.11355, February 2025. arxiv.org/...2502.11355
13. ^1 ^2 ^3Fangcun AI. "SkillWard: Security scanner for Agent Skills." GitHub repository. Accessed October 27, 2026. github.com/...SkillWard
14. ^Fangcun AI. "Fangcun Guard: Open-Source AI Security Infrastructure." GitHub repository. Accessed October 27, 2026. github.com/...Fangcun-Guard
15. ^zhiyuanzeng99. "feat(guardrails): add FangcunGuard content-safety guardrail." BerriAI/litellm pull request #33674, opened July 17, 2026. github.com/...33674