Alibaba

1 · Who it is

Headquarters

China · China

Why it is on this page

• is rated by the FLI AI Safety Index
• trained at least one model above 10²⁵ FLOP, the threshold above which the EU AI Act presumes a “systemic risk” (Epoch AI)

Website

www.alibabacloud.com (opens in a new tab)

Latest releases

72 models released in the last 24 months

• Qwen 3.8 27B 14 Aug 2026
• Qwen3.8-2.4T-A95B 8 Aug 2026
• Qwen3.7 Flash 27 Jul 2026
• Qwen 3.8 Max 19 Jul 2026
• Qwen3.7-Plus 3 Jun 2026

Models: Epoch AI, CC BY 4.0 licence.

2 · What it promised

Public commitments and signature status. Official lists have no dates: for names that appeared after our first reading of the list, the day we first saw them.

• ·EU General-Purpose AI Code of Practice (opens in a new tab)10 Jul 2025
  not on the list as of 27 Oct 2026
• ·Frontier AI Safety Commitments (Seoul) (opens in a new tab)21 May 2024
  not on the list as of 27 Oct 2026
• –White House voluntary AI commitments (opens in a new tab)21 Jul 2023
  not applicable
  Frozen archive: lists read from copies and articles on 26 October 2026 (the archive did not respond), to be rechecked.
• ·G7 Hiroshima Process reporting framework (OECD) (opens in a new tab)Apr 2025
  not on the list as of 27 Oct 2026
  List of submitted reports read on oecd.ai, without automated collection; report texts are not republished (all rights reserved).
• ●Chinese AI Safety Commitments (AIIA) (opens in a new tab)Dec 2024
  signed
  List read on AGORA (ETO/CSET, CC BY-NC, no automated collection) and copied into the file. The WeChat original cannot be opened by programs.
• ·EU AI Pact (opens in a new tab)25 Sep 2024
  not on the list as of 27 Oct 2026

3 · What it wrote and changed

Under the Seoul commitments the companies promised to publish, by the Paris summit (10-11 February 2025), a safety framework on severe risks, with the thresholds beyond which they consider them intolerable.

– did not sign the Seoul commitments

Documents tracked over time

Versions of the text found in the copies of the Wayback Machine and Open Terms Archive: each point is a version that differs from the previous one.

Summaries by Claude, checked by a person; the text of the documents belongs to the company: read it through the links.

4 · What others say

Stanford Foundation Model Transparency Index

26 out of 100 (average of the 13 rated companies: 41) · Dec 2025 edition

Data: Stanford CRFM, CC BY 4.0 licence · data and method (opens in a new tab)

Ratings by others: see FLI AI Safety Index (Summer 2026) (opens in a new tab). Link only: their scores cannot be republished without permission.

Each rating measures different things on different companies: they are not comparable with each other.

5 · What happened

Incidents in which the company is named as developer of the system (AI Incident Database and AIAAIC).

last 6 months

0

last 12 months

1

last 24 months

4

Severity, last 24 months: serious 0 · moderate 4 · minor 0 · not rated 0

• LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack (opens the Ukraine page)
  Jul 2025moderateUkraine
• Reported Public Exposure of Over 100,000 LLM Conversations via Share Links Indexed by Search Engines and Archived
  Jul 2025moderate
• LLM Scrapers Allegedly Target Multiple Open Source Projects Disrupting the FOSS Ecosystem
  Mar 2025moderate
• Top chatbots tricked into generating instructions on how to enrich uranium
  2025moderate

All incidents mentioning Alibaba, in Explore incidents →Where the harm happens, in Connections →

6 · What we cannot see

• internal documents and unpublished safety evaluations;
• versions of documents that no archive saved;
• “no document found” is the result of a search, not proof that the document does not exist;
• signatory lists often have no dates: the date is the day we first saw the name;
• incidents the press does not report: the best-known companies have more recorded incidents because they are talked about more;
• many incidents do not have a severity yet;
• Chinese companies publish less in English and some of their commitments are read from third-party sources (AGORA).