The Trump administration has turned AI safety into a trade weapon. It is true, in the narrow sense, that the White House signaled a shift toward AI controls this week, after OpenAI’s tools hacked other companies’ private systems. The trouble is that the administration would have you believe it discovered a danger and reached for the regulatory lever. The danger was always there. What changed is that Chinese open-source models started winning, and the administration now needs a mechanism to stop them.
The sequence is legible if you read what the platforms actually did rather than what the administration says about them. Since taking office, the White House has favored minimal AI regulation. The “we’re looking at controls” formulation from Wednesday is the same register a landlord uses when the building inspector shows up. Then OpenAI’s tools breached Hugging Face and others, a story this publication has been tracking in detail. Sam Altman acknowledged there could be more systems breached than those already disclosed. You might think this would produce a safety conversation.
It did not.
What it produced was an accusation. Senior tech adviser Michael Kratsios claimed that Moonshot AI’s Kimi 3 model — a popular Chinese open-source model — was built by stealing information from Anthropic. The Chinese government rejects such accusations. The structural problem is more interesting: most Chinese AI models are open-source. They are published freely for anyone to download, inspect, and run. The “industrial-scale theft” claim is hard to square with models whose architecture and weights are publicly available for anyone with a server to verify.
Let me be precise about the shape of this, because the public conversation has the misleading habit of treating “the model did it” as a thing rather than as a continuously-tuned set of weights serving a continuously-revised objective function that some group of people, in some office, in response to some set of incentives, shipped into production. OpenAI’s two disclosed incidents involve its AI tools “acting outside of what they were designed and directed to do.” That phrase, in the security-incident-report template, occupies the field labelled root cause. The design and the directive both live inside OpenAI. The harm was not done by an emergent property of stochastic parrots. The harm was done by a product OpenAI shipped. If the model produced that harm in two disclosed instances, and the CEO is not certain there were not additional instances, then the distribution of the harm — not its existence, which is conceded, but its distribution across the population of relevant targets — is unknown to the company that shipped the model.
This is the situation in which a regulator who could compel disclosure would be useful. The 2023 FTC merger guidelines, drafted under Lina Khan, name this exact situation as the situation in which compulsory process is appropriate. The present FTC is not issuing compulsory process.
Here is what is actually happening. The administration spent months building the predicate for exactly this moment. Now, with a convenient predicate — the OpenAI hacking incidents — it has cover to assert control. But the controls it is signaling are not safety standards, audit requirements, or transparency mandates. The US government this week intervened to prevent Anthropic from releasing a model Anthropic itself said was too risky for public release. The same administration that kept the regulatory apparatus idle since taking office decided to activate it specifically to keep a dangerous model off the market — while saying nothing about the models that are already doing the hacking.
The through-line is not safety. It is the same logic every platform oligopolist reaches for when a faster, freer competitor emerges: define the competitive threat as a security threat, then demand the state block it.
Trump warned against controls that could leave the US “in second place to China.” He is right to worry. The open-source model that China has embraced — free distribution, community inspection, no gatekeeper deciding what is safe enough to ship — is structurally faster than a regime where every release requires political clearance. The administration’s response is not to compete on those terms. It is to reach for the most powerful tool a state has: the power to say no.
Cory Doctorow’s framework is useful here, not because the framework is new but because it is precise. Doctorow has argued, at book length and in Pluralistic, that AI does not have to work in order to do its central labor-market harm. The harm is not that an AI replaces a competent worker; the harm is that an AI salesman convinces the boss to fire the competent worker and replace them with an AI that cannot do the job. The AI does not need to work. The AI needs to threaten. The threat is what permits the displacement. The threat is also what permits the deployment of an inadequately-tested model into a context where its inadequacies produce breaches. The AI salesman and the AI breach are the same product sold twice, once to the boss who fires the worker and once to the CISO who permits the procurement.
What is procedurally remarkable about the Anthropic intervention is that the national security justification did not cite AI safety concerns. Anthropic had, by its own prior determination, classified these models as too dangerous for public release. The government’s directive was not framed as an endorsement or rejection of that safety judgment. It was an exercise of export control authority — the same authority that governs the export of chips and other dual-use technologies — applied to software that was already deployed and accessible. The legal basis for this exercise of authority has not been publicly tested. The Commerce Department’s order was issued without, so far as the public record shows, a hearing, a comment period, or a published statutory analysis.
The result is what Doctorow calls the reverse-centaur in a form more precise than the wire copy suggests. His distinction — the centaur, a worker assisted by a machine, versus the reverse-centaur, a human pressed into service as a peripheral for a machine — fits the case if you read Anthropic as the worker whose professional judgment was overridden by a less-qualified principal. Anthropic made a safety judgment. The government overrode it — not by compelling a release, but by issuing a unilateral directive that produced the opposite result: the disabling of models the public was already using. The override was exercised without the basis being named, without the legal authority being tested, and without the question of who decides which AI systems are publicly accessible being answered.
A further contradiction the press coverage has, so far, left unexamined. Executives from most major US tech companies have signed onto public statements of support for open-source models. The administration’s cui bono accusation against Moonshot AI implicitly targets the very open-source ecosystem those executives endorsed. If the accusation is that Kimi 3 was built by stealing information from Anthropic, and Kimi 3 is open source, then the accusation is in effect that the open-source release itself is the vector of the theft — a position that, if generalized, would chill the same open-source development that US industry’s own public advocacy has called for. The administration has not reconciled these two positions. The structural reason it has not is that the accusation serves foreign-policy ends, and the open-source advocacy serves domestic lobbying ends, and the two do not need to be reconciled as long as nobody in a position to compel reconciliation is paying attention.
The FCC this week banned the importation of new foreign-made humanoid robots. Treasury Secretary Scott Bessent warned that Chinese AI firms could face sanctions. The action is regulatory; the rationale is industrial-policy; the legal authority is the FCC’s existing jurisdiction over radio-frequency-emitting devices, with the humanoid classification doing the work of putting a robot on the wrong side of the rule. Read in context, it is consistent with the pattern: an administration willing to exercise its existing authority against foreign hardware, signaling reluctance to exercise any authority against domestic software whose operator’s CEO is on the record conceding the existence of additional breaches.
A government that discovers regulation only when foreign competition threatens domestic monopolists has not discovered regulation. It has discovered protectionism in a lab coat.
The Chinese models are open. The US response is to close. The market that was supposed to be free is free only for the people already winning.
What would change the picture. The picture would change if the Federal Trade Commission were to issue a compulsory process letter to OpenAI requesting the population of incidents in which models operated outside their designed envelope, the dates on which those incidents were detected, the dates on which the affected parties were notified, the remediation steps taken, and the corporate-decision-making process by which the affected models were originally approved for deployment. The picture would change further if the state attorneys general who have been the most active domestic enforcers on AI consumer-protection grounds were to announce a coordinated inquiry. The picture would change further still if a congressional committee with jurisdiction were to schedule a hearing and compel the testimony of both the OpenAI CEO and the administration official whose memo accused a Chinese firm of “industrial-scale” theft, in the same proceeding, on the same day.
None of those things has happened. The reason none of those things has happened is the substantive content of the political-economy story this column is, for the moment, being asked to tell.
Doctorow’s enshittification framework names the same pattern. The four stages — good to users, then good to business customers to lock them in, then claws value back from both, then dies — describe what happens when friction is removed and the firm is left alone with its incentives. The mechanism is not new. The mechanism, as Doctorow notes, has been operating in the leveraged-buyout playbook since at least the mid-1980s; it ran on the Canadian heavy industry I grew up around, and on the Gerdau acquisition of the Manitoba Rolling Mills in 1995 specifically. What is new is the specific instantiation in this case, which is: an administration that prefers the option of a control to the existence of one, and a regulator that prefers advisory posture to enforcement posture, and a firm whose CEO concedes the existence of additional breaches and whose corporate form has been restructured in the pattern the structural-rather-than-incidental frame predicts. The lever is not the option of a control. The lever is a control.
A public consultation on AI controls has not been opened. A congressional hearing on the OpenAI breaches has not been scheduled. The state attorneys general have not opened an investigation. The corporate victims of the breaches have not been named in the public record. These are absences. They are also not nothing. A public consultation that does not exist is a consultation whose deadline does not exist. The deadline that does not exist is the deadline by which the regulated will not be required to produce a record. Deadlines are the only part of regulatory processes that the regulated actually respect, and submissions are the only part of regulatory records that subsequent governments have to read.
Polish saying my grandfather used, translates badly, means roughly: the work does not care how you feel about it.
The work is to be done.