China weighs gating its open-model advantage

Over the past month, officials at China's Ministry of Commerce, the same agency that drafts the country's export-control rules, have been holding a quiet run of meetings with the executives who run its largest artificial-intelligence labs. Alibaba was in the room, along with ByteDance and Z.ai, the Beijing startup formerly known as Zhipu, whose GLM-5.2 model has crept close enough to America's best that Silicon Valley now benchmarks against it. The subject, according to three people familiar with the discussions and first reported by Reuters, was whether to restrict the world's access to Chinese models, including ones that have not yet been built.

The proposals are unusually broad. They cover not only the closed, API-gated systems that labs sell by the token but the open-weight models any developer can download, run on private hardware, and modify at will. The reporting could not establish how such controls would work; the shape most often cited comes from a May roundtable of Chinese legal scholars, summarized in a Supreme People's Court journal: a tiered system in which basic open tools clear a simple filing, more advanced systems face security reviews, and the most sensitive frontier models are barred from public release or confined to domestic use. Participants in the meetings also discussed making the leak or theft of proprietary Chinese AI an offense under the national-security law, and restricting who may fund domestic AI startups.

Weight limits

The move has an obvious antecedent. On June 12th America's Commerce Department, under Secretary Howard Lutnick, sent Anthropic an "is-informed" letter requiring a license before any foreign national, inside the United States or out and the company's own staff included, could touch its two newest models, Fable 5 and Mythos 5. Unable to screen users by passport on short notice, Anthropic disabled both for everyone. The trigger was a demonstrated bypass of the models' safeguards that let them find software flaws and write working exploit code, and the fear was offensive cyber capability loose in the world. Washington lifted the controls on Fable, the public-facing version, a little over two weeks later, once the company added a safeguard and agreed to oversight of future releases; Mythos, the more capable build, remains limited to a set of trusted American organizations.

Beijing's stated worry runs along the same axis, pointed the other way. Chinese authorities are said to be alarmed by the prospect of Mythos, the very Anthropic model Washington restricted, being turned on vulnerabilities in Chinese software, and to regard their own frontier systems as national assets too sensitive to hand to strangers. Read side by side, the two decisions look like mirror images, two governments reaching for export-control law to fence in a model over the same fear, weeks apart. The resemblance does not survive contact with what each side is actually surrendering.

When Washington gated Fable and Mythos, it fenced off a paid product that a bounded set of customers reached through Anthropic's servers, and it reopened Fable's inside a month. China's frontier models are not sold that way; they are given away. Since DeepSeek's R1 reasoning model landed in January 2025, Chinese labs have flooded the open-weight world with systems that match Western performance at a fraction of the price, and the world has built on them. Alibaba's Qwen passed a billion cumulative downloads on Hugging Face, the open-model hub, by March, overtaking Meta's Llama as the most-downloaded open model family and reaching a billion faster than any family before it. In February alone it was pulled down 153.6m times, more than the next eight model families combined.

The lead is not just a matter of download counts, which automated pipelines can inflate. On OpenRouter, the largest neutral router that sends developers' queries to whichever model they pick, Chinese open-weight models accounted for roughly 61% of all tokens processed by May, up from near zero eighteen months earlier; four of the five most-used models were Chinese, and Llama, the open-weight leader as recently as 2024, had dropped off the table entirely. Malaysia has said its sovereign AI stack will run on Chinese weights. Airbnb's chief executive volunteered last autumn that the company leans on Qwen because it is fast, cheap, and good enough. Qwen now anchors more than 113,000 derivative models, more than Google's and Meta's base families combined, the base layer the rest of the world fine-tunes and the closest thing the field has to a Linux of large language models.

That reach is also a dependency, which is what makes gating expensive for everyone, Beijing included. Startups, research labs, and a lengthening list of enterprises now treat Chinese weights as free infrastructure, the cheap and capable default they build products on top of; restrict the frontier tier and their costs rise, their roadmaps stall, and the developers Beijing spent two years cultivating start shopping for alternatives, whether American open models or whatever fills the gap. The Chinese open-source machine is itself entangled with the West, its models still largely trained on Nvidia silicon and served through American clouds. Cutting the world off from the top of the stack does not sever those ties; it removes the reason much of the world had to stay attached.

None of this was an accident. Barred by American export controls from the leading-edge chips its rivals train on, China could not win a straight compute race against the capital massed behind OpenAI and Anthropic, so it competed on a different axis, and openness was the weapon. Giving the models away seeded Chinese architectures, tooling, and standards into the workflows of developers from Kuala Lumpur to Berkeley, built a user base no export ban could easily dislodge, and handed Beijing a narrative it used to real effect: that the future of AI was open, and that America, hoarding its best systems behind APIs and license requirements, had misread the moment. A March report from the U.S.-China Economic and Security Review Commission, a congressional advisory body, laid the strategy out plainly, as a set of reinforcing loops binding open models to China's manufacturing and deployment machine.

To gate the frontier now is to disarm on that axis. The tiered regime under discussion would keep China's most capable models inside China, the very posture Beijing spent two years describing as America's error. The moral asymmetry it enjoyed, open China against closed America, collapses the moment its own frontier goes behind a license. What is left is the plainer picture: two powers hoarding their best systems, each citing national security, each building a tiered export ladder, each betting that control matters more than reach.

There is a coherent case for doing it anyway, and it sits in the same cyber logic that moved Washington. The capability Beijing fears in Mythos, the automated discovery of zero-day flaws (previously unknown vulnerabilities) and the generation of working exploits, is no longer American alone; Chinese open models have begun to show the same edge. A weight file, once released, cannot be recalled, licensed back, or switched off the way Commerce closed Anthropic's tap and, weeks later, reopened it for Fable. The openness that gave China its reach also means that its most dangerous capabilities, the moment they exist, belong to anyone able to run them. For a state that has decided frontier AI is a weapon, the filing system and the security review are not hard to follow.

Whether Beijing follows that logic to its end is unsettled: the scope is still contested, the rules may reach only future models, and China has floated tighter controls before without always imposing them. The direction of travel is clear enough. For two years the pitch to the rest of the world was that open weights were the future and that Washington, gating its frontier behind export licenses, had read the moment wrong. The meetings at the Ministry of Commerce suggest Beijing has now read it the same way.