Beijing is closing the open-source trap it spent years building.

American companies have built a deep reliance on cheaper Chinese artificial-intelligence models. DoorDash routes its lower-complexity, volume-heavy workloads to Moonshot AI’s Kimi K2.6 and DeepSeek, reserving the expensive frontier models from Anthropic and OpenAI for the high-stakes tasks. Harvey, a legal-services platform, runs the same playbook: top-tier closed models for the legal work that matters, cheaper Chinese inference for everything else, according to the company’s head of applied research. Vercel, the developer platform, has reported that DeepSeek’s share of AI usage on its platform rose from one percent in April to twenty-three percent in June, while its share of total spending stayed in the low single digits.

It is fair to say, and the press release is at pains to say it, that this is just good engineering. You do not use a fifty-thousand-dollar-a-month enterprise API contract to generate the boilerplate code that a cheaper, sufficiently competent model can handle. You push the commoditized layer down to the lowest-cost provider. That is just how the stack works. The trouble is that the engineering work was being done on top of a pricing strategy, and the pricing strategy has now shifted.

Here it is worth being precise about what “open-source AI” actually means, because the public discourse has the misleading habit of treating the term as if it meant the same thing it meant for Linux. It does not. The Chinese open-weight releases are open in the sense that the trained parameters can be downloaded. They are not open in the sense that the training code, the training data, the training compute, the inference-optimization research, the next-generation training pipeline, or the institutional capacity to keep producing competitive models is open. Those are the layers at which the state has leverage, and those are the layers the new restrictions target.

What the engineers at DeepSeek, Moonshot, and Zhipu actually built was a set of techniques for making frontier-tier capability run on commodity compute. Mixture-of-Experts architectures — routing each query through only a fraction of the trained parameters rather than the full model — cut inference compute dramatically and were the architectural backbone of DeepSeek’s first-generation release. Post-training quantization, the compression of high-precision weights into lower-precision formats that retain most of the model’s behavior on commodity hardware, is what made the same weights usable on the kind of GPU capacity that Western startups can actually procure. Knowledge distillation from larger models into smaller ones let Moonshot and Zhipu ship models competitive with closed frontier systems at a fraction of the training cost. Each of these techniques has been adopted, in the open technical literature, by Western AI labs. The source of the Chinese competitive advantage is not the techniques themselves but the institutional capacity to keep producing new generations of them faster than Western labs can copy them. That institutional capacity — the training pipeline, the research bench, the next-round architecture search — is the layer the new restrictions target, because it is the layer that actually runs the chokepoint.

According to reporting in the Wall Street Journal, officials in Beijing have been meeting with the country’s leading AI laboratories to discuss a series of measures: more stringent regulatory reviews before public release, deferrals of public release for models deemed to contain sensitive technology, tiered access restrictions for foreign users, tighter controls on the export of certain AI technologies, and restrictions on Chinese AI companies accepting foreign investment. The measures are framed in the language of national security: that proprietary techniques, particularly the efficiency gains that have made Chinese models competitive on a fraction of the compute, should not be shared with adversaries who might weaponize them.

The reference to Washington’s handling of Mythos, an Anthropic model capable of detecting cybersecurity flaws, which the White House first banned foreign users from accessing and then partially walked back, is doing real work in the Chinese debate, and it is worth pausing on what “powerful AI technology” actually means in the Mythos framing, because the public discourse has the misleading habit of treating it as a thing rather than as a continually-tuned set of weights serving a continually-revised objective function. The assumption that a single “cyberwarfare and bioweapons” capability can be cleanly bounded and walled off from the rest of the model’s general-purpose behavior is the assumption the AI-existential-risk narrative was built to license, on both sides of the Pacific. The cybersecurity experts urging the White House to reverse the restrictions were arguing, in effect, that the strategic cost of cutting allied researchers and defenders off from a tool that improves defensive security was higher than the strategic cost of letting the model be used by adversaries who are, on the available record, building comparable capabilities on their own. The capability gap between the Chinese frontier models and the U.S. frontier models is narrowing in cybersecurity specifically, which is the domain the export-control case most depends on. Both arguments are reasonable. Neither is really about cybersecurity in the way the public debate has framed it. Both are the same play, in different uniforms, by different state actors.

The substantive frame, which the public discourse has so far declined to name in plain language, is enclosure. Beijing’s position until recently was that open-source releases of frontier-tier models served a soft-power purpose: adoption, dependencies, technical legitimacy. Harold Innis, writing the staples thesis from the vantage of the Canadian resource economy in the 1930s and 1940s, observed that the political economy of a communications medium is set by whether the medium is transportable and whether the message is specialized — and that the empires built on staples were, structurally, empires built on the ability to enclose the source of the staple and the route by which it travelled. The mapping, on the present material, runs clean. The trained weights and the efficiency techniques are the staple — the exportable commodity whose value to the importer is its scarcity relative to the cost of producing it domestically. The data centers, the inference-optimized hardware, the bandwidth, and the chips that move the weights and serve the queries are the route and the portage. The state that controls the route controls the political economy. Beijing’s earlier open-source posture, like every other open-source posture in tech history, was not a public-good commitment; it was a market-share commitment, the kind that gets made on the way to enclosure rather than as an alternative to it. Cory Doctorow, writing under the name chokepoint capitalism, has described for the better part of a decade how exactly this kind of dependency is built: the gateway operator gives away the product to build ecosystem lock-in and worry about monetization later. The American companies that built their stacks on Kimi K2.6 are not, on the most likely reading of the new restrictions, going to lose access to the model they built on. They are going to lose access to the version of the model that comes after, and to the assurance that the model they built on will keep being updated. The cost advantage they got was the price of admission to a chokepoint.

Here it is worth being precise about the architecture of the actual restriction, because the nationalist framing of an “AI supremacy race” obscures it. Beijing is not going to send agents to delete weights from Hugging Face. The Western companies that have built production stacks on these models — Vercel, DoorDash, Harvey — are not, on the available record, downloading the weights and self-hosting; they are calling API endpoints hosted by the Chinese lab, with the inference billed by the token. Restrict “foreign entity” access to that endpoint, and the American company’s supply chain is severed overnight. Furthermore, the real edge in these models is not just the published weights — it is the proprietary data pipelines, the inference-optimization techniques that allow the model to use computing power more efficiently, and the access to the TSMC-fabricated chips that U.S. export controls have been trying to choke off for years. Beijing’s contemplated export controls on these specific optimization techniques are the exact mirror image of Washington’s export controls on advanced semiconductors; the only difference is which side of the Pacific the panic is emanating from.

When you depend on a rival state’s supply chain for the commoditized layer of your tech stack, you are not exercising free-market choice. You are just outsourcing your vulnerability. The American companies that took advantage of this arrangement were not wrong to do so; they were behaving as tech companies always do, optimizing for the current quarter’s margins. The cost advantage was not, however, an accident of engineering efficiency. It was the price Beijing charged for letting American companies build their stacks on Chinese state-corporate infrastructure, the same way cheap American cloud inference was the price OpenAI and Anthropic charged for letting the global market build its applications on American state-corporate infrastructure. Both pricing strategies are the same play, in different uniforms, by different state actors. The contest is now, in the substantive sense, openly underway.

Here is the part the control schedule cannot fully account for, and it is the part that should worry both states. Open-weight models, once released, are not retractable. The trained parameters for DeepSeek’s first-generation model and Moonshot’s Kimi K2.6 are sitting on developer laptops, university clusters, hostile-state inference clusters, and commercial hosting providers in jurisdictions Beijing cannot reach. The same logic applies on the U.S. side: the architectural and training innovations published by Anthropic, OpenAI, and Google in the course of the Mythos debate are in the public record. The control regime, in either country, is operating on the lead time between the lab and the adversary, and that lead time has been collapsing for the entire period the debate has been running. The strategic question is not whether the control regime will hold. The strategic question is how long the state actor can keep releasing models with the openness the global market expects while reserving enough of the next generation to maintain the lead — and the answer, on the available record, is that the answer is getting shorter every quarter.

The corrective is not to decry the trap. It is to build the infrastructure that makes the trap irrelevant, and the engineering and policy record tells you what the pieces look like. A state-level model-portability and API-accessibility law — modelled on the New York Digital Fair Repair Act’s structure, which forced manufacturers to make parts available, applied here to force model providers to make weights, fine-tuning recipes, and conversation histories portable across inference providers — would lower switching costs and shrink the surface area of any single gatekeeper. A federal compute-commons program, built out through NSF’s National AI Research Institutes and a DOE-led public inference utility on the CHIPS-program model of public-capital deployment, would put commodity inference outside any one state’s reach. A federal privacy law with a private right of action — modelled on the California CCPA’s private-right-of-action provision, and pre-empting the weaker state regimes — would let the people whose data built the models have standing in court against the firms that misuse it. None of this is technologically novel. All of it is politically difficult. All of it is the work of a country that has decided it does not want to rent its inference layer from a state actor, on either side of the Pacific.

There is a regulatory consultation open in Beijing, just as there is one open in Washington. The deadlines matter because deadlines are the only part of regulatory processes that the regulated actually respect. The American companies that built their margins on a state-subsidized loss-leader are about to find out that the subsidy was always a pricing strategy, and the price is what it was always going to be. The work is to be done.