The Model Has No Passport. The Supply Chain Does.

On 24 July 2026, a peculiar coalition of American technology companies published an open letter titled “Open Weights and American AI Leadership.” NVIDIA, Microsoft, Meta, Google, OpenAI, Amazon, AMD, Intel, IBM, GitHub, Hugging Face, Mozilla, the Linux Foundation and scores of others put their names beneath the same proposition: if America wants to lead artificial intelligence, it cannot afford to let the open-model ecosystem belong to somebody else.

The letter has since collected well over a hundred institutional signatures. Anthropic, conspicuously, is not among them.

The timing is not difficult to understand. Chinese laboratories are no longer producing merely cheap imitations of American systems. They are releasing increasingly capable model weights, permissive research, inference stacks and agentic tooling that developers around the world can download, adapt and run without asking a Silicon Valley company for an API key. Moonshot AI’s Kimi K3, a 2.8-trillion-parameter mixture-of-experts model with 104 billion active parameters and a one-million-token context window, is only the latest provocation. DeepSeek, Qwen and GLM had already made the strategic point.

America may still own much of the frontier. China is competing to own the floor on which everybody else builds.

That is why this debate is much more interesting than the usual online argument about whether one benchmark score is three points above another. The real question is not which country has the single cleverest chatbot this week. It is which country’s models, formats, licences, tools and assumptions will become ordinary infrastructure in Bengaluru, Berlin, Nairobi, São Paulo and Jakarta.

And the answer matters because models do not travel alone. They carry an ecosystem with them.

First, this is not quite “open source”

We should begin by cleaning up the language.

Most of the systems at the centre of this debate are open-weight models, not necessarily open-source AI in the traditional sense. Their trained parameters can be downloaded. That is valuable: an organisation can inspect the package, run it on its own hardware, fine-tune it, quantise it and build around it without sending every prompt to the original developer.

But the weights are not the complete source of the system. The training data may be undisclosed. The filtering pipeline, reinforcement-learning process, evaluation harnesses and exact training code may remain private. Even the licence may restrict certain uses. The Open Source Initiative’s definition asks for the freedom to use, study, modify and share the system, plus sufficient information and the preferred form needed to make modifications. Many “open” AI releases do not meet that bar.

This distinction is not pedantry. A weight file is not a novel one can read from beginning to end and discover the author’s politics on page 417. Neural behaviour is distributed across billions or trillions of numerical relationships. Downloading the parameters gives us control and testability; it does not give us perfect interpretability.

“Open weights” is therefore the honest term. It describes an important freedom without pretending that the entire production history has been exposed.

What America’s letter is really admitting

The open letter is written as a declaration of confidence, but beneath it sits an admission.

The United States can lead in frontier research, private investment, cloud infrastructure and proprietary models—and still lose the wider ecosystem.

Closed systems are extremely good at concentrating capability. A company can spend tens of billions of dollars training a model, operate it through a controlled service, monitor misuse, improve it continuously and recover the cost through subscriptions or tokens. This is one reason the best proprietary models remain so formidable.

Open weights distribute capability differently. They allow a university to examine a model, a startup to build without paying an API toll on every request, a bank to keep sensitive data inside its own boundary, a country to adapt the system to an underrepresented language and an enterprise to escape a vendor whose pricing or policies have changed.

That distribution creates an ecosystem. Once enough developers know a model family, enough tools support its format and enough organisations build internal systems around it, switching becomes expensive. The model becomes more than a product; it becomes a standard.

This is the part of the contest China understands very well.

In 2026, Chinese policy did not treat open models as an accidental by-product of research. It described open source as industrial strategy. China’s national planning called for a world-leading open-source ecosystem, while Xi Jinping publicly encouraged “open-source, openness, collaboration and sharing” in AI—language paired, predictably, with demands for security and human control. At the World Artificial Intelligence Conference, Chinese officials presented open ecosystems as a way to broaden access, particularly across the Global South.

One can dismiss that language as diplomacy. One should not dismiss the strategy.

China does not need every developer in India or Brazil to admire the Chinese political system. It needs its models to be useful, affordable, adaptable and available. Infrastructure wins through convenience long before it wins through affection.

Is Chinese open-weight AI a threat?

Yes—but the word threat is doing too much work.

There are at least six different risks hiding inside it, and muddling them together produces bad policy.

Claimed threat	What is actually true	Sensible response
“The model is Chinese, so it is a backdoor”	National origin alone does not prove malicious behaviour. A locally run weight file does not automatically transmit prompts to China.	Verify hashes, isolate runtimes, inspect dependencies and test behaviour before deployment.
Data exposure	A China-hosted API creates jurisdiction, retention and control-plane risks. A self-hosted model is a materially different proposition.	Keep sensitive workloads inside an approved environment; distinguish the weights from the vendor’s hosted service.
Censorship and value shaping	This is measurable. Models may answer differently by language and topic, and political alignment can survive fine-tuning.	Run multilingual, adversarial and domain-specific evaluations rather than accepting a model card on faith.
Intellectual-property extraction	Distillation is a legitimate technique; unauthorised extraction and trade-secret theft are different allegations requiring evidence.	Target unlawful conduct and weak API security, not the entire technique or every open release.
Dual-use capability	Powerful models can assist attackers regardless of nationality or licence. Once weights are released, they cannot be recalled.	Use capability-based thresholds, serious evaluations and controls for genuinely high-risk releases.
Ecosystem dependence	This is the largest strategic risk. Cheap, capable models can make one country’s stack the default layer of global AI.	Compete with better open models, compute access, tooling and standards—not with slogans.

The first row is where public discussion often goes wrong.

A model can contain deliberately planted triggers in theory. Its code repository, custom kernels, containers and third-party dependencies can also contain ordinary software vulnerabilities. These are real security concerns. But “Chinese weights” and “Chinese cloud service” are not synonyms. If I download a model, verify the artifact, run it in a network-restricted environment and keep my data inside my own infrastructure, the risk is different from sending confidential prompts to an external endpoint controlled under another country’s law.

The flag on the laboratory is not a substitute for a threat model.

The risks are real, just less cinematic

The most persuasive evidence is not a spy-movie story about a secret backdoor. It is the behaviour we can actually measure.

In its official evaluation of Kimi K2 Thinking, the US National Institute of Standards and Technology’s Center for AI Standards and Innovation found that the model was highly censored in Chinese while being substantially less censored in English, Spanish and Arabic. Its measured alignment with Chinese Communist Party positions was much stronger in Chinese than in English and minimal in some other languages. NIST also found that the model, although the most capable Chinese system it had evaluated at release, still lagged leading American systems in cyber and software tasks.

That result teaches two useful lessons.

First, Chinese models are not neutral merely because their weights are downloadable. Training choices, preference data and political constraints shape behaviour. A multinational company evaluating only in English could miss limitations that appear immediately in Mandarin. A country adopting a model for public services should test not merely whether it writes good code, but how it handles history, law, civic disagreement, minorities and local cultural contexts.

Second, censorship is not the same as remote control. A biased or restricted model is a governance problem; it is not proof that every local inference call is being exfiltrated to Beijing. Precision matters because the remedy is different.

There is also the question of how capability was obtained. Anthropic has argued that Chinese labs are accelerating through large-scale distillation of leading American models and through gaps in advanced-chip controls. OpenAI and American officials have made related claims. Those allegations deserve investigation, but distillation itself is a standard research and engineering method. The legal and ethical line depends on authorisation, terms of service, deceptive access, scale and whether protected material was unlawfully extracted.

The American open-weights letter gets this point broadly right: prosecute theft as theft. Do not turn a disputed extraction case into a ban on an entire method that American companies also use.

Anthropic’s absence reveals the real fracture

Anthropic’s refusal to join the letter is not a minor piece of corporate theatre. It exposes the genuine philosophical division inside the American AI industry.

One camp believes that an open American ecosystem is a strategic necessity. If capable models are going to circulate, the argument goes, it is better that American models, safety research and developer tools remain competitive. Openness lets defenders study systems, researchers reproduce failures and organisations deploy without surrendering their data to a remote provider.

The other camp puts more weight on irreversibility. A hosted model can be updated, monitored or withdrawn. Released weights cannot be recalled from the internet. A sufficiently capable open model may be modified to remove safeguards, used in a disconnected environment and copied indefinitely. Anthropic’s broader policy position warns that Chinese access to frontier capability could strengthen military power, surveillance and repression.

Both positions contain truth.

OpenAI itself made the more mature version of this argument in its 2024 response to the US government: open models create important research, local-deployment and innovation benefits, while controlled APIs offer monitoring and disruption capabilities against sophisticated misuse. A healthy ecosystem can contain both.

The mistake is to treat “open” as automatically virtuous or “closed” as automatically safe. A badly secured proprietary API can leak data. A responsibly released open model can improve scientific access. A frontier model with dangerous capabilities may warrant stricter treatment than a smaller system, regardless of whether its maker is in San Francisco, Paris, Abu Dhabi or Hangzhou.

Capability should drive controls. Corporate category should not.

Why a broad American ban would fail

Suppose Washington responds to Chinese open models by severely restricting American open-weight releases.

What happens next?

Chinese weights do not disappear. European models do not disappear. Researchers outside the United States do not stop working. The internet does not acquire a recall button. Instead, American developers get fewer domestic alternatives, American startups become more dependent on a small group of closed API providers, and the rest of the world adopts whatever capable open models remain available.

The policy would protect incumbent revenue while being advertised as national security.

It would also misread how adoption works outside rich American companies. Much of the world cannot casually spend millions of dollars a year on frontier API usage. Organisations need models they can quantise, fine-tune for local languages, run on older accelerators and operate where connectivity or data-residency rules make a remote service impractical. They will choose performance per rupee, watt and engineer-hour—not the model that gives the best speech about democratic values.

If America closes its ecosystem while China distributes an increasingly competent one, China does not need to win the benchmark crown. It only needs to become the default dependency.

That is a much more durable form of power.

Where the world actually stands

The old picture—America invents, China copies, everybody else consumes—is now obsolete.

The Stanford 2026 AI Index describes a more complicated balance. The performance gap between leading American and Chinese models has effectively closed, with the lead changing hands more than once since early 2025. The United States still produces more top-tier models, attracts extraordinary private investment, owns much of the cloud and accelerator ecosystem and retains enormous influence over frontier research. China leads in several measures of publication, citation, patent and industrial deployment scale.

Meanwhile, open-source contribution is becoming more geographically distributed. The rest of the world is no longer a passive audience.

That matters because there are really three races:

1. The frontier race — who trains the most capable general model.
2. The ecosystem race — whose model family becomes the easiest foundation for other people’s products.
3. The sovereignty race — which countries can evaluate, adapt and operate important AI systems without depending completely on a foreign provider.

America remains exceptionally strong in the first. China has made the second a central strategy. Almost every other country should be worried about the third.

For India, the intelligent response is not to become a cheering section for either Washington or Beijing. India has the engineering talent, market size, linguistic complexity and public digital infrastructure to demand another path: evaluate both, trust neither automatically, host sensitive systems locally, invest in Indian-language data and preserve the ability to switch.

Sovereignty does not mean training the world’s largest model for the pleasure of placing a flag on it. It means retaining meaningful control over data, evaluation, deployment and exit.

What America should do instead

The open letter is correct that prohibition is not a strategy. But signing a letter is the easy part. A serious response requires at least six things.

1. Build genuinely competitive open models

America does not need a ceremonial release six months behind the frontier. It needs capable model families with usable licences, strong tooling, documented evaluation and long-term maintenance. A model nobody can afford to run is technically open and practically irrelevant.

Kimi K3 itself illustrates the point: 2.8 trillion total parameters do not fit under a developer’s desk. Open weights remove the API gate; they do not repeal the laws of infrastructure economics.

2. Expand access to compute

Universities, independent researchers and smaller companies cannot create a plural ecosystem if every meaningful experiment requires the balance sheet of a hyperscaler. Shared compute, public-interest clouds and research grants are not charity. They are the substrate of competition.

3. Regulate by demonstrated capability

Release requirements should grow with measurable risk: cyber capability, biological enablement, autonomous replication, deception and the ability to defeat safeguards. A smaller open model should not inherit the compliance burden designed for a frontier system merely because both have downloadable files.

4. Make provenance and packaging verifiable

Publish signed artifacts, cryptographic hashes, dependency manifests, model cards, evaluation results and clear licence terms. Treat model repositories like a software supply chain. We may not be able to explain every internal representation, but we can make the surrounding artifact far less mysterious.

5. Enforce trade-secret law precisely

If a company deceives an API provider, bypasses controls or steals protected material, investigate it. If a model learns from outputs under permitted conditions, do not redefine ordinary knowledge transfer as theft because a competitor became inconveniently capable.

6. Create international evaluation standards

Every vendor produces a table in which its latest model looks handsome. Governments and enterprises need independent, multilingual, reproducible evaluations that test security, bias, censorship, tool use, reliability and total operating cost—not only academic question answering.

What an enterprise should do on Monday morning

The geopolitical debate becomes useful only when it changes architecture.

Before deploying any open-weight model—American, Chinese, French or otherwise—I would require the following:

• Separate the model from the service. Decide whether you are evaluating downloadable weights, a vendor-hosted API or a managed copy running in your own cloud. They have different data paths and different risks.
• Classify the workload. Public content generation is not the same as legal advice, source-code access, financial decisions or critical infrastructure control.
• Verify the artifact. Pin versions and hashes. Review the licence. Inspect custom code, containers, kernels, dependencies and installation scripts. Do not allow arbitrary repository code in production because the README looked confident.
• Evaluate in the languages people actually use. Test political, cultural and safety behaviour in Bengali, Hindi, Mandarin and every relevant local language—not just polished English.
• Red-team the system, not only the model. Most enterprise failures occur through excessive tool permissions, poisoned retrieval, insecure connectors, leaked secrets and unreviewed actions. A safe model inside a reckless agent is still a reckless system.
• Keep human gates where consequence is high. An agent may draft, compare, plan and recommend. Material payments, production changes, customer commitments and destructive actions need explicit authority.
• Preserve an exit. Abstract the serving layer, retain your evaluation set and avoid coupling the entire business to one prompt format or one vendor-specific tool protocol.
• Monitor after release. Models, prompts, retrieved knowledge and business processes change. An evaluation passed in July is not a lifetime certificate.

This is not xenophobia, and it is not complacency. It is architecture.

The model has no passport

A downloaded tensor does not salute a flag when the server starts.

But the supply chain around it has a jurisdiction. The licence has an author. The training process contains choices. The hosted endpoint has an operator. The tooling creates dependencies. The defaults encode assumptions. And the ecosystem, once adopted widely enough, creates political and economic leverage.

Chinese open-weight AI is therefore neither an innocent gift to humanity nor a digital Trojan horse by definition. It is a highly effective industrial strategy built around a genuine public good: wider access to capable technology. That combination is precisely why it is powerful.

America’s open-weights coalition has recognised the danger. The danger is not simply that China may produce an intelligent model. It is that developers everywhere may decide the Chinese model is the one they can actually use.

The world will not run one model. It will assemble millions of systems from many models, clouds, chips, datasets and tools. The winners will be the ecosystems that are easiest to inspect, cheapest to adapt, safest to operate and hardest to become trapped inside.

If America answers China’s openness by becoming more closed, it may lose—not because China stole the future, but because America refused to distribute its own.

Source note: This essay reflects public information and model releases available on 29 July 2026. Benchmark claims from model developers should be treated as vendor-reported until independently reproduced.