Washington is mobilizing to deal with the threat of Chinese AI
Most U.S. officials agree that the rapid expansion of Chinese open-weight AI models is a threat, but there’s no agreement on what to do about it.
This is an excerpt from my latest Washington Post Intelligence report. Free link to the full report at the bottom.
By Josh Rogin & Kendrick Frankel
Washington is trying to contend with the rapid proliferation of open-source Chinese AI models, and of advanced AI systems in general. If Chinese open-source models underpin the AI ecosystem the world builds on, Beijing could have undue influence over the technical standards, safety rules, and even some of the political assumptions baked into software used by governments, militaries, hospitals and banks for decades. Chinese models are closing the capabilities gap with America’s leading labs, and their open-source models are gaining market share by offering cheaper models that give users more control.
Open-weight models publish their core components for anyone to download, modify and run — unlike the closed models built by Anthropic, OpenAI and Google, which stay locked behind paid access. China has made open-weight release its dominant strategy, and its models are improving fast enough to rival America’s closed frontier labs, forcing a dilemma Washington hasn’t resolved: whether to try to restrict a technology that’s spreading fast.
Moonshot AI’s Kimi K3 model, released July 16, shows how close China has gotten. On the Artificial Analysis Intelligence Index, a widely used composite of roughly a dozen individual AI benchmarks, K3 scored 57, just three points behind the top closed U.S. model, and ahead of Z.ai’s GLM 5.2, the prior open-weight leader at 51. But the national security stakes go beyond any one model’s score. Advanced AI systems, once the exclusive property of a handful of well-funded labs, are now downloadable, modifiable and deployable by almost anyone. Many come with few safeguards. That raises the risk that AI could meaningfully assist cyber- or even real-world attacks. Chinese models, most of them open-weight, already account for close to 60 percent of the AI tokens processed on OpenRouter, a widely used platform that routes traffic to AI models for thousands of developers and companies. That is a near-tripling of Chinese models’ market share since January. Chinese open-source models have become the go-to choice for high-throughput batch tasks, agent loops, and highly specialized work due to their low cost, impressive capabilities and full customizability.
In its AI Action Plan released last year, the White House predicted the open-source surge. “Open source and open-weight models could become global standards in some areas of business and in academic research worldwide. For that reason, they also have geostrategic value,” it stated.
China is championing its open-source AI ecosystem. “We should seize this rare, historic opportunity to encourage open source, openness, collaboration and sharing,” Chinese President Xi Jinping said in a July 17 speech on AI at the World AI Conference in Shanghai. “AI development should not be a solo performance by a single country,” Xi told the audience, “but a symphony of international cooperation.”
Washington, meanwhile, is actively considering restricting access of Chinese open-source models for American firms — while protecting the advantage of U.S. frontier labs that produce mostly closed-source models.
Rep. Ro Khanna (D-California), the top Democrat on the House Select Committee on the CCP, and who represents Nvidia’s home turf in Silicon Valley, told WP Intelligence the U.S. has to compete on open-source, not retreat from it.
“What China is showing is that just having closed models of Anthropic and OpenAI is not going to be sufficient to lead in the AI race,” Khanna said. “We’ve got to lead on open-source in America and for the world — or we could allow China to become the world’s AI producer, and that would be a disaster.”
What’s missing, he said, is a real framework for testing the safety of open models, wherever they come from. “I would have a federal regulatory agency for AI,” Khanna said. “Have it test all models for safety, for privacy, for reliability against cyber breaches. … I think it would be wrong to just ban the models. But having a standard is reasonable, and that should apply to all models.”
Trump administration considers options to combat Chinese “distillation”
The erosion of America’s AI lead is the backdrop for the administration’s accusation that Chinese firms are engaged in a form of intellectual property theft called distillation, in which Chinese companies allegedly train their own models on outputs harvested from American competitors using vast networks of fake accounts. The administration is weighing whether and how to respond by sanctioning — or at least naming and shaming — implicated firms, or formally designating the practice a national security risk. “Open source is not open season on American IP,” Treasury Secretary Scott Bessent wrote on X July 22. “When firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table.”
Bessent has effectively taken the lead on this issue for the administration, and he also represents the Wall Street perspective. AI-related stocks drove roughly 80 percent of U.S. stock market gains in 2025, and the 10 largest S&P 500 companies, most of them AI-exposed, make up close to 40 percent of the index’s total value. A serious setback for Anthropic or OpenAI, brought on by cheaper Chinese competition, could have severe market implications Bessent cannot ignore.
A White House strategy to deal with the issue has yet to be revealed. Executive Order 14409, signed June 2, required three deliverables by Aug. 1: a classified process, run by the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology, to define which systems count as “covered frontier models”; a voluntary disclosure and security-review framework for frontier labs, overseen by Treasury; and a cyber workforce expansion plan from the Office of Personnel Management.
A White House official said a voluntary framework outlined in the June 2 executive order was completed by the deadline, but declined to provide any details. The official said the the White House will host a meeting with industry partners Tuesday to discuss the framework.
“The United States leads the world in AI innovation, and President [Donald] Trump’s successful approach will keep it that way,” White House spokeswoman Liz Huston told WP Intelligence.
Administration divided on access to open-weight models
According to several current and former officials close to the White House, there is an internal fight inside the administration. Some officials want to crack down hard on Chinese AI firms, especially those behind open-weight models. Others see that as counterproductive, arguing it would hurt American developers’ ability to compete, and handing the rest of the world’s market to Beijing rather than protect America’s.
Bessent and White House director of the Office of Science and Technology Policy Director Michael Kratsios are said to favor a harsher approach. Commerce Secretary Howard Lutnick is reportedly more sympathetic to keeping Chinese AI available.
The tech industry is split too. A letter organized by Nvidia and published July 24 drew dozens of signatures, eventually including OpenAI and Google, warning against “premature restrictions” on open models. The signers argue that openness prevents companies from getting locked into one vendor, and that more people looking at a model’s code means more people finding and fixing its flaws.
“Open models broaden defensive capability, increase transparency, and allow vulnerabilities to be discovered and remediated across many teams,” the letter stated.
Administration wary of security threats from China
The fight over open versus closed is one debate. The threat from Chinese models specifically is another. Researchers and officials say Chinese models could carry propaganda, serve as tools of foreign influence or hide “sleeper agent” flaws — code that looks harmless until it is triggered later, potentially inside the software running critical American infrastructure. “There’s a potential for sleeper agents,” said Chris McGuire, a former National Security Council official now at the Council on Foreign Relations. “There’s evidence of Chinese models and propaganda.”
For McGuire, that risk exists no matter how a model is released, and conflating it with the fight over openness is where Washington has gone wrong. “The problem with open-source Chinese models is not that they’re open-source,” he said. “It’s that they’re Chinese.”
The debate got more complicated on July 21, when OpenAI disclosed that one of its own unreleased test models broke out of a supposedly sealed evaluation environment and hacked into Hugging Face, a company that hosts AI models for download. Hugging Face’s own defense against that attack used an open model with Chinese origins, because OpenAI’s commercial products would not do the job. “We couldn’t have done it with an API because they had these guardrails … preventing activity for cybersecurity,” Hugging Face CEO Clément Delangue told CBS’s “Face the Nation” on Sunday. “We needed to run a model on our own infrastructure, so we needed an open model.”
The company that built the world’s most powerful closed AI accidentally proved, in real time, why some American companies feel they need China’s open ones. It is a small example of a much bigger problem: Nobody in this fight, including the people trying to restrict Chinese AI, can fully escape depending on it.
Read the entire report here: https://wapo.st/4g8ZCfU