The string was long and unglamorous: kimi-k2p5-rl-0317-s515-fast. A developer who posts as Fynn had routed the API traffic of Cursor, the American AI coding company, through a debugging proxy, and that model ID sat in the requests. Cursor had released Composer 2, its new in-house coding model, on 19 March 2026. The launch post described "our first continued pretraining run," which means training an existing model further on large amounts of new data. It did not name a base model. Fynn's reading of the ID was blunt: "So composer 2 is just Kimi K2.5 with RL," reinforcement learning, a later stage that trains a model by rewarding good answers. Kimi K2.5 is an open-weight model from Moonshot AI, a Chinese laboratory: anyone may download its trained parameters and run them.
On 20 March, Cursor confirmed it. Lee Robinson, Cursor's vice president of developer education, wrote that Composer 2 "started from an open-source base" and that "only ~1/4 of the compute spent on the final model came from the base, the rest is from our training." Co-founder Aman Sanger said the Kimi base should have been mentioned in the blog from the start. Moonshot said it was proud to provide the foundation, through Fireworks AI, "as part of an authorized commercial partnership."
Washington had spent years trying to keep advanced AI hardware out of Chinese hands. One of Silicon Valley's most prominent coding companies had just built its own model on Chinese technology. In the same years that the chip restrictions tightened, Chinese laboratories released competitive models that Western developers increasingly used to build their own products. The United States retained most of the commercial AI market. China gained influence over an important layer of its development infrastructure. The question is how deep that influence goes, and where exactly it sits.
The Model Under the American Product
Cursor's case is useful because it is documented in unusual detail, and because nothing about it required secrecy to be significant. On 27 March, Cursor published a technical report for Composer 2 that named the base explicitly: "continued pretraining on an open base model, Kimi K2.5," followed by large-scale reinforcement learning. The full report on arXiv adds a detail that matters more than the attribution. Cursor evaluated several candidate base models. All three on the shortlist were Chinese: GLM-5 from Z.ai, Kimi K2.5 from Moonshot, and DeepSeek V3.2. Kimi won on Cursor's FreshBench with 83.2 percent, against 79.2 for GLM-5 and 68.9 for DeepSeek V3.2. No Western open model made the list. Sanger's explanation was performance: "Kimi k2.5 proved to be the strongest."
The licence permitted it. Kimi K2.5 ships under a modified MIT licence whose only change asks very large products, above 100 million monthly users or 20 million dollars in monthly revenue, to display the Kimi name in their interface.
On 18 May, Cursor released Composer 2.5. The blog post states it "is built on the same open-source checkpoint as Composer 2, Moonshot's Kimi K2.5," a checkpoint being a saved snapshot of a model's trained state. The same post announced the exit route: "Together with SpaceXAI, we're training a significantly larger model from scratch, using 10x more total compute."
Read in sequence, the facts describe a pattern. An American company with the resources to choose anything looked at the open models available in early 2026, found that the strongest candidates came from China, built on one, kept building on it for a second release, and then announced a much larger model trained from scratch. Cursor has not called that an exit; this article reads it as the expensive route to a base it would control itself. By then, Congress had noticed. On 29 April, the House Select Committee on the Chinese Communist Party and the Homeland Security Committee opened a joint investigation into Anysphere, Cursor's parent, and into Airbnb, whose chief executive had said in October 2025 that the company was "relying a lot on Alibaba's Qwen model. It's very good. It's also fast and cheap."
The tension is obvious. A country that spent years limiting China's access to the hardware of AI found its own developers building on Chinese software. The rest of this piece tests how far that observation holds.
Four Numbers That Measure Four Different Things
The figures on Chinese open models are large, and they are routinely merged into one claim of dominance. They should not be. Each measures a different activity, in a different population, with different flaws.
Start with downloads. Hugging Face, the main repository for open models, reported in March 2026 that over the past year Chinese models "quickly accounted for the plurality or 41% of downloads." That is a real shift. It is also a weak measure of use. Hugging Face's own documentation says that "every HTTP request to these files, including GET and HEAD, will be counted as a download." Automated pipelines are not excluded. A download figure tells you how widely files travel. It does not tell you who builds a product on them.
Derivatives say more. A derivative is a model someone has fine-tuned (trained further on their own data), quantised (compressed to run on cheaper hardware), merged or adapted from a base. The ATOM Project's tracking shows Qwen derivatives making up more than 40 percent of new language-model fine-tunes each month, while Meta's Llama fell from nearly 50 percent in autumn 2024 to about 15 percent. In eighteen months, the default base for new fine-tunes changed hands. Hugging Face counted 151,448 Qwen derivatives in its summer report.
A count of the Hugging Face API on 25 October 2026, made for this investigation, found 172,602 direct Qwen derivatives. It also found how thin that number is. Among the official accounts of five large Chinese labs (Qwen, DeepSeek, Moonshot, Z.ai's current zai-org account and MiniMax; Zhipu's older THUDM account was not counted), Qwen accounts for 93 percent of direct derivatives; this layer is an Alibaba story, not a broad Chinese one. Only about 15 percent of Qwen derivatives were active by a modest definition: more than ten downloads in thirty days and an update in the past six months. Just 466 repositories draw 90 percent of all derivative downloads, and the top ten are almost entirely repackagings, quantisations and format conversions by Comfy-Org, Unsloth, LM Studio, NVIDIA and others. The lead is real: 42,415 new direct Qwen derivatives in six months, against 9,080 for Google's Gemma and 6,324 for Llama. But much of it is a distribution lead, models converted to run locally, more than evidence of deep customisation.
The typical top Qwen derivative, in other words, is not a bank's tuned compliance model. It is the same model, compressed to fit on a laptop.
Tokens measure use through APIs. OpenRouter, a routing service that sends developer requests to many models, is one of the best public windows. Its "State of AI" study with a16z found Chinese open models at about 1.2 percent of weekly usage in late 2024, reaching nearly 30 percent in some weeks and averaging 13.0 percent over the year. In the week of 12 October 2026, OpenRouter's rankings showed DeepSeek with 24.4 percent of requests, Z.ai with 12.2, Qwen with 5.3 and Xiaomi with 2.4: together, 44.3 percent for those four Chinese makers. Seven of the ten most-used models by tokens that week were Chinese.
Two corrections belong next to those figures. First, the API layer is not Qwen's. On OpenRouter's thirty-day ranking, no Qwen model sat in the token top ten. API use belongs to DeepSeek and Z.ai, with Xiaomi, Tencent and StepFun behind them. In traffic, China is a crowd of labs that can replace one another. In building, it is mostly one. Second, OpenRouter is not the market. It attracts price-sensitive developers, free model variants and role-play, which accounted for 52 percent of open-source tokens in late 2025. "Chinese" in its data means the origin of the laboratory, not the location of the server: a Kimi model served by Fireworks from an American data centre counts as Chinese, and in that case, as OpenRouter's own staff put it, "requests go to that provider and the lab is not involved."
Is the use Western? Partly provably. OpenRouter told The New Stack that in August 2026 about 60 percent of tokens from requests of American origin went to open-weight models, most of them Chinese. No source splits Chinese model use by country with a public method, and Hugging Face does not publish downloader geography at all.
The fourth number is people. Stack Overflow's 2026 developer survey asked which AI model providers developers use. Of the 11,895 respondents who answered that question, 74.6 percent named Anthropic and 74.3 percent OpenAI. DeepSeek reached 18.9 percent, Qwen 10.1. That is a meaningful Chinese footprint and nowhere near dominance.
Downloads, derivatives, tokens and developers each tell a different story. Only the derivative and token figures show Chinese models at the centre, and in two different layers held by different labs.
Where the Money Still Goes
The fifth number is revenue, and it reverses the picture.
Menlo Ventures estimated in December 2025 that Anthropic held 40 percent of enterprise spending on large language models, OpenAI 27 percent and Google 21. The open-source share of enterprise workloads had fallen from 19 to 11 percent. Chinese models together accounted for "just 1% of total LLM API usage" in the enterprise. Total enterprise spending on generative AI that year came to 37 billion dollars. There is no Menlo update for 2026, so the figure is old, but nothing in the 2026 evidence suggests the enterprise core moved to China.
The gap between volume and value is sharpest on routing platforms. Vercel's AI Gateway index for June 2026 found that open-weight models processed 29 percent of tokens but accounted for less than 4 percent of spending, while Anthropic took 61 percent of spending with 32 percent of tokens. Those figures cover open models of every origin, not Chinese models alone. For a Chinese-specific comparison, Wing VC reported that DeepSeek's share of tokens on Vercel rose from under 1 percent to about 17 percent by May 2026, while its share of revenue stayed around 1 percent. Vercel's Harpreet Arora summarised the dynamic in five words: "Price is doing the work here." The gap is moving. Its index for August 2026 put open-weight models at 56 percent of tokens and about 14 percent of estimated spending. Volume is shifting faster than money.
The price gap explains the split. DeepSeek V4 Flash costs 0.14 dollars per million input tokens; GPT-5.5 costs 5 dollars. An OpenRouter employee told CNBC that Chinese open models run "60 to 90 percent cheaper" than American frontier models.
Then there are the companies themselves. Anthropic was reported at an annualised revenue run rate of about 65 billion dollars in July 2026, OpenAI at about 50 billion in October. On Ramp's card data from more than 50,000 American businesses, DeepSeek's paid adoption peaked at about 0.3 percent of companies and fell back to about 0.1.
So the commercial centre of gravity of AI remains with American closed models. Who receives the payments and whose technology others build on are two different questions with two different answers. That distinction keeps this investigation honest. China has not won the AI market. For now, it holds a position in one infrastructure layer of it, and a position can be lost as well as extended. Revenue measures who captures today's value. Model architecture helps determine who can capture tomorrow's. Cursor sits on both sides of that ledger: its customers pay an American company, and the model answering them began as a Chinese checkpoint.
What the Chip Restrictions Explain, and What They Do Not
The tempting story runs in a straight line: export controls starved Chinese labs of chips, scarcity forced efficiency, efficient models were released openly at low prices, and Western developers adopted them. Each link needs its own evidence. They do not all hold.
The first link holds, within limits. The strongest evidence comes from DeepSeek itself. In a 2025 paper on the hardware behind its V3 model, DeepSeek's engineers wrote that the H800, the chip available to them, "features reduced FP64 computational performance and NVLink bandwidth for regulatory compliance," with interconnect bandwidth cut from 900 to 400 gigabytes per second. "To address these hardware constraints, the DeepSeek-V3 model incorporates several design considerations." In effect, DeepSeek had to restructure how it spread training across weaker, less connected hardware, so that far less data had to travel between chips and machines. The constraint reached beyond the chip. DeepSeek's network was designed for up to 16,384 GPUs, but "due to policy and regulatory constraints, just over two thousand GPUs were ultimately deployed." The V3 technical report gives the final training run as 2.788 million H800 hours on 2,048 chips, about 5.6 million dollars at an assumed rental price, and states that prior research and ablation experiments are excluded.
DeepSeek's founder, Liang Wenfeng, said in a July 2024 interview: "Money has never been the problem for us; bans on shipments of advanced chips are the problem." Lin Junyang, who leads Qwen, said in January 2026 that American compute "may overall exceed ours by one to two orders of magnitude," and that "when you're poor, things like algorithm-infrastructure co-optimization become necessary."
The limits are just as documented. Mixture-of-experts, a design that splits a model into specialised parts and activates only a few of them for each task, and a memory-saving attention method appeared in DeepSeek-V2 in May 2024, after the American controls of October 2022 and October 2023, so the date alone settles nothing. What settles more is that the architecture was not unique to constrained labs. Mistral, a Paris company with no chip restrictions, had already released an open mixture-of-experts model, Mixtral, in December 2023, and Google had published the approach years earlier. In the same interview, Liang said Chinese labs were less efficient, not more, needing "four times more computing power" for the same result, and that the attention method came from a young researcher who "just thought to design an alternative." Anthropic's Dario Amodei argued that "the export controls were not the main factor causing them to 'innovate,'" though Anthropic lobbies for tighter controls and is not a neutral witness.
The fair reading is that export controls shaped the systems layer of DeepSeek's training, how it spread work across constrained hardware, and pushed it toward domestic chips: DeepSeek V3.1 used a number format "designed for the next generation of domestically produced chips," and V4 has been validated on Huawei Ascend chips. The controls did not invent the architecture.
The second link, from efficiency to openness, is weak. No Chinese lab ties its open releases to export controls. The motives they state are commercial, competitive and political. Alibaba's Joe Tsai: "Our Qwen model is open source, but we also run our cloud business." Alibaba chief executive Eddie Wu said an open model ecosystem "drives greater demand for our cloud computing services." Liang argued that "moats created by closed source are temporary." Moonshot's founder had called opening a top model "most likely unreasonable" in early 2024, then opened Kimi K2 after DeepSeek's success; a Moonshot engineer later wrote, "we obviously wanted to gain some recognition." Lin called Qwen's path partly "chance and circumstance." Beijing's State Council made "internationally influential open-source projects" official policy in August 2025, and reporting on Moonshot's 3.5 billion dollar round in July 2026 named the national AI industry fund as its lead investor.
The third link holds. Western developers adopted the models for price and performance: Chesky's "fast and cheap," Sanger's "strongest," Arora's "price." Local hosting and privacy, often cited by commentators, are not motives any named user offered in the record.
Export controls shaped specific efficiency choices. They are not the engine of the whole chain. The better-supported sequence is a commercial and political choice to publish openly, then a price and performance lead, then Western adoption in the volume and fine-tuning layers. Washington's restriction sharpened one link. It did not build the chain.
The Family Beneath the Fine-Tunes
A model family is more than a set of weights. Once developers adapt it, the adaptation belongs to that family.
Low-rank adapters, or LoRA, the cheapest and most common way to fine-tune, are small add-on files that hold a company's customisations of one specific model, and they are tied to that base: they cannot simply be moved to another model. A 2024 paper by researchers from MIT and IBM states the problem plainly: "When the base model needs to be deprecated and replaced with a new one, all the associated LoRA modules need to be re-trained." Attempts to transfer adapters across families recover fractions of a percentage point. Training data is reusable, but must be reformatted for the new model's chat template, and Hugging Face's documentation warns that with the wrong control tokens, models "would have drastically worse performance." Even hosting is not neutral. Moonshot built a verification tool after third-party hosts handled Kimi K2's tool calls badly; in a November 2025 test, schema accuracy was 100 percent at DeepInfra and Fireworks, but 76 percent on vLLM and 72 percent at Together.
The documented cases put a price on this. Intercom replaced GPT with a fine-tuned 14-billion-parameter Qwen model for one summarisation task that cost about 250,000 dollars a month, and saved "almost all of it." Arcee AI shows the cost of leaving a family entirely. It had post-trained Llama, Mistral and Qwen models for customers, then found that large organisations "were unable to use Chinese based architectures," while Western labs, in chief executive Mark McQuade's words, "stopped open sourcing these models." Its answer was to train its own Trinity models: roughly 20 million dollars, about two-fifths of the capital it had raised, in six months, on 2,048 GPUs. That bill has already been paid.
These cases separate two layers. Through APIs, dependency is broad and shallow. Coinbase is experimenting with defaulting its engineers to GLM 5.2 and Kimi K2.7 through an internal gateway; reports credit its lower AI spending to caching and routing as well as the model switch, without splitting the savings by cause. DoorDash routes code review to Kimi K2.6 alongside an Anthropic model. Both are API-layer choices, not products built on a Chinese base. Routers make models interchangeable; tokens are spread across five to seven Chinese labs, so no single one is a bottleneck. Switching costs months of evaluation, not a rebuild. Lindy, a San Francisco startup, shows the scale: it moved all its production traffic from Claude to DeepSeek V4 in June 2026, running on an American host, and its founder, Flo Crivello, said the company had been evaluating open models for six to nine months and that the switch was "100x more work than we thought." In the building layer, dependency is narrow and deeper: nearly all Qwen, plus a handful of products, like Cursor's, that run on a Chinese base.
Linux is the serious counterexample, and it deserves full weight. The Linux kernel is open technology that created no dependency on one company or country. Version 6.19, released in February 2026, came from 2,141 developers at 227 known employers; the largest contributor, Intel, supplied 11.1 percent of changes. When Red Hat ended CentOS as a stable copy of its enterprise system in December 2020, a co-founder of CentOS started Rocky Linux, which shipped a stable release in June 2021. Forking worked as an exit.
The open-model world has its own forking. Microsoft post-trained DeepSeek-R1 into MAI-DS-R1. Perplexity released R1-1776. Deep Cogito built on DeepSeek-V3-Base, Prime Intellect on a GLM base, NVIDIA and Arcee on Qwen. By Cursor's own account, three quarters of Composer 2's compute was its own.
But none of those projects pretrained a successor from scratch. Even Cursor's "continued pretraining" started from Moonshot's checkpoint: it extended Kimi rather than replacing it. Rocky Linux was possible because Red Hat's source code was fully available. For a model, the equivalent of source code is the pretraining data, the pipeline and the compute, and those stay with the laboratory. DeepSeek publishes weights, detailed reports and infrastructure code, yet describes its pretraining corpus only as "14.8T high-quality and diverse tokens." A fork can adapt the current model. Producing the next one means assembling data, recipes and compute on the laboratory's scale, which is possible in principle and costly and uncertain in practice. Llama shows the same limit from another side. Meta released Llama 4 openly in April 2025, and Llama's share of new fine-tunes still fell from nearly half to about 15 percent by March 2026 as developers moved to stronger bases. Meta then launched its next frontier model, Muse Spark, as a closed model in April 2026, and published weights only in October, as Muse Spark Open. A community follows the best available base. It does not drag an older one to the frontier on its own.
Structurally, Chinese open weights resemble Android more than Linux. Android's code is open, but Google moved all Android development to internal branches in March 2025, publishing source only at release. When Huawei was placed on the US Entity List in May 2019, the public Android code stayed available, and Huawei kept building on it for years. What it lost was Google's licensed services, the Play Store on new phones outside China, and the partner access that lets manufacturers prepare for a release before it ships. The parallel is imperfect: no service layer or licence binds Western users of open weights the way Google's services bound phone makers. What carries over is the difference between access to the existing version and influence over the next one. The current version is free. The next version is decided by one party.
This allows a precise definition of dependency. The mechanisms are documented: Western products build on Chinese bases, as Cursor's own technical report shows; adapters are bound to their base; switching costs months of work, as at Lindy, or a new base model, as at Arcee. What remains conditional is the size of the consequences: whether future Chinese releases turn these mechanisms into structural dependency. There are four kinds. Operational dependency, needing the original supplier to keep using a model you have, is weak: weights in hand keep working. Technical dependency, a product tuned to one architecture through adapters, data formats and evaluations, is real today. Innovation dependency, needing future releases to stay competitive, is conditional. It turns structural only if four links hold, and none is proven yet: the next Chinese generation keeps a relevant lead, Western alternatives stay insufficient, migration costs prove prohibitive, and the models developers already hold stop being good enough over time. What makes the condition plausible is that pretraining the next generation outside the lab is possible but expensive and slow; Cursor's from-scratch model depends on a partner with SpaceXAI's compute. Institutional dependency, where an outside authority can shape future access, is new, exists so far as a draft, and is the subject of the final sections.
The Security Findings, Kept to Their Size
The political sensitivity of this shift rests partly on safety evidence, and that evidence is real but narrower than the debate around it.
CAISI, the evaluation centre at the US National Institute of Standards and Technology, tested DeepSeek models in September 2025. Agents built on DeepSeek R1-0528 were about twelve times more likely to be hijacked by malicious instructions than American frontier models, and the models repeated inaccurate or misleading Chinese Communist Party narratives four times as often.
Three qualifications matter. Some censorship sits in the service layer, not the weights: in a small three-question test by the Takshashila Institution, GLM 5.2 refused through Z.ai's own service but answered when the same weights were hosted outside China. Some behaviour can be trained out, as Microsoft and Perplexity did, though Microsoft's model card warns that earlier "security considerations" remain. And no backdoor has been confirmed in the deployed weights of any major open model of any origin; lab demonstrations place the practical risk in unvetted community fine-tunes, whatever their base.
These findings help explain why two House committees opened an investigation into Cursor's parent and Airbnb. They do not show that Chinese weights are a hidden channel, and this investigation does not claim they are. The costs already incurred in 2026 came from Washington, not Beijing: the committees' letter to Airbnb demanded documents on every Chinese model it had deployed, tested or evaluated, and on 20 October the Department of Homeland Security published an order requiring civilian federal agencies to remove DeepSeek products and "third-party products and services developed using DeepSeek implementations" from their systems. The core issue is who controls the next generation.
The Case That Open Weights Are Ownership
The strongest objection to everything above deserves to be stated at full strength, because for the models developers already have, it is largely correct.
Open weights are not a subscription. A company that downloaded Qwen or DeepSeek weights holds a file that runs on its own hardware or any host it chooses. The licences make that durable. Apache 2.0, which covers most Chinese releases above 20 billion parameters in 2026, grants "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license." MIT, used by DeepSeek since early 2025 and by Xiaomi, lacks the word irrevocable but is widely regarded as effectively irrevocable. None of the new Chinese licences lets the lab withdraw rights at will; the only one with a termination clause, StepFun's, ends rights only after an uncured breach. A licence change applies only to new versions. Earlier downloads keep their old terms. Even Beijing's new draft export rule, discussed below, excludes models already published.
A technically literate reader can say: I have the weights locally, and China cannot switch anything off. For the existing model, that reader is right.
The objection goes further. The building layer can be exited, and Western firms are doing it. NVIDIA's Nemotron 3 Ultra, at 561 billion parameters, sits in OpenRouter's weekly top ten, the only Western open model there. OpenAI's gpt-oss showed what Interconnects called "early signs of shifting the needle."
That is the exit. A separate policy signal points the same way, and it is not an exit but a choice of tolerance: Bloomberg Government reported, citing people familiar with the matter, that on 4 August 2026 the White House told US AI companies that Chinese open-weight models would not be subject to testing under the administration's new AI safety framework, and more than seventy companies, including Nvidia, Microsoft, Meta and OpenAI, had signed a public letter against broad restrictions on open-weight models.
On this view, the story is a price war that Western developers are winning: they take cheap Chinese capability, own it outright, and keep the option to leave.
Every element of this objection holds for the stock of models already released. Its weakness is time. The Western alternatives are still behind: on Artificial Analysis's October 2026 ranking of open-weight models, the top five are all Chinese, led by Xiaomi's MiMo-V2.6-Pro at 46, while the best American open model, Meta's Muse Spark Open, scores 39. And ownership of the current model says nothing about access to the next.
The Next Release Is Not Open Ground
In April 2026, the open Kimi K2.6 scored 54 on Artificial Analysis's general intelligence index, three points behind the top model at 57. Open and closed were nearly level. By late October, the leader, Claude Opus 5.5, scored 58, and the best model with downloadable weights scored 46.
That gap carries a pending correction. On 23 October 2026, Moonshot announced Kimi K3.1 Pro, which scores 55 and which its announcement calls "our most capable 3T-class open-weight model to date." For now it runs only through Moonshot's API. The same announcement promises: "Full model weights will be released by Nov 4, 2026." Moonshot followed that order with Kimi K3 in July, when the weights came eleven days after launch. If the promise holds, the best open model will again sit three points behind the best closed one, and it will be Chinese.
The documented case of a frontier kept closed is Alibaba. Qwen3-Max was closed in September 2025, and The New York Times reported in July 2026 that Qwen3.6-Max and Qwen3.7-Plus were available only through paid APIs. August brought an exception, an open Qwen3.8-Max, under a licence of its own. Alibaba's strongest models have mostly been sold, not shared, and its one open Max release came with conditions. That is the first mechanism: a lab keeping its best model on the API.
The licences are the second mechanism, and they need precise description. They are not non-commercial. They target one group of users. Kimi K3's licence requires any company that runs a model-as-a-service business, selling access to a model through its own API, with more than 20 million dollars in group revenue over twelve months, to sign a separate agreement with Moonshot before any commercial use; internal use and use through Moonshot's certified partners are exempt, and products that merely embed the model in a feature do not count as a service. The Qwen3.8-Max licence requires a separate licence from companies above 50 million dollars in revenue that run a model-as-a-service business or an "AI Work Assistant" business, which the licence defines as an independent product "primarily designed for AI-assisted coding or office productivity": products like Cursor. The Qwen Community License 1.0, used for Qwen3.8-Flash-Next, sets the same requirement with no revenue threshold at all. GLM-5.3 requires the largest service providers, above 10 billion dollars in revenue, to pass a security review by Z.ai. Hobbyists, researchers and internal corporate use stay free, and so do small companies under most of these licences; the Qwen Community License is the exception. Whoever resells the weights as a competing API, or under the Qwen terms as a coding assistant, must negotiate.
MiniMax M3 is the strictest: every commercial user must credit MiniMax and notify the company, products above 20 million dollars in yearly revenue need prior written permission, and military use is banned. And the trend is not universal. DeepSeek's V4 models and the V4.1 Flash release of 17 October 2026 still carry a clean MIT licence, as do Xiaomi's MiMo-V2.6 and Z.ai's GLM-5.3-Flash.
The commercial logic fits. Reporting on Moonshot's July 2026 funding put its annual recurring revenue above 300 million dollars, more than 70 percent of it from API sales. Alibaba's AI cloud revenue grew 45 percent to 7.1 billion dollars in the quarter to June 2026. For these companies, weights earn nothing directly. The money is in cloud and API. Once Western hosts and coding tools begin to capture the API market with free weights, a licence that closes exactly that route is the predictable response.
The third mechanism is the state. In July 2026, Reuters reported that China's commerce ministry had met with Alibaba, ByteDance and Z.ai about limiting foreign access to their most advanced models, open versions included; Reuters could not determine "when or even if" this would take effect. On 16 October 2026, the commerce ministry and the ministry of science and technology published Announcement No. 48, a draft open for comment until 15 November. The announcement, its draft annex and the ministry spokesperson's explanation set out the design. The draft would add 23 AI technologies to China's catalogue of technologies prohibited or restricted from export; the large-model thresholds sit in the restricted part. A large model qualifies if it meets any one of three criteria: 10^26 operations of compute, 2 trillion parameters, or a global top-ten place, at the moment of export, in public rankings that include benchmark scores and usage volume. The controlled technology covers weights, key checkpoints, underlying source code and architecture. Three provisions in the spokesperson's explanation define the effect. Models already published openly fall outside the controls; analysts at ChinaTalk note that the exact scope of that exemption is still disputed. Open-sourcing a covered model counts as a technology export, but one that receives an automatic licence, which the spokesperson describes as, in effect, report and export. The draft does not create a rule on who may release openly; it brings open release under the state's licensing authority. And offering a covered model through an API, an app, software-as-a-service or lightweight on-device deployment falls outside large-model technology-export management altogether.
Under that draft, Qwen3.8-Max at 2.4 trillion parameters and Kimi K3 at 2.8 trillion would exceed the threshold, but both are already released and exempt. For future models of that size, open publication would become a licensed act, even if the licence is automatic, while API access stays outside this export regime; other Chinese rules on AI services are a separate matter. Part of the regime already applies. From 16 October until the final catalogue takes effect, the spokesperson's explanation requires exporters to register on a commerce-ministry platform before exporting a listed technology, including exports begun but not completed. The registrable cases it names are transfer of ownership abroad, licensing for use abroad, a change of owner or controller to a foreign party, and other cases the ministry specifies. Open release is not on that list, and the text does not say whether it counts.
DeepSeek shipped V4.1 Flash under MIT on 17 October, after the interim rule began, and whether that model crossed the draft's top-ten line is unclear. Kimi K3.1 Pro sharpens the question. Moonshot has not published its parameter count, but its own label, "3T-class," would put it above the 2-trillion line, and its weights have never been published. Moonshot has promised them by 4 November. Nothing in the record links the API-only start to the draft rule; Moonshot launched Kimi K3 the same way in July. Whether those weights arrive on time, and on what terms, is the first reading of how the interim rule treats an open release in practice.
Taken together, the three mechanisms are separate and should stay separate: a lab keeping its strongest model on the API, a licence restricting competitors, a state drafting export rules. None of them touches a single file already downloaded. All of them bear on what comes next.
That is the dependency the objection misses. It is not in the stock of models already released. It is in the flow of the next ones. For an American product built on a Chinese base, the risk is not that its model stops working. The risk is that a competitor upgrades to a better successor available only by API, under a separate licence, or after a ministry's licence, while the product stays on the last open checkpoint, and that building an alternative costs what Arcee paid, or what Cursor and SpaceXAI are now spending.
What Would Prove This Wrong
The thesis makes predictions, and the next months will test them. The first readings are dated. By 4 November, Moonshot has promised the weights of a model its own label places above the draft's parameter line. On 15 November, the comment period on that draft closes.
The state's role has to be read at three levels, because they are easily confused. Authority means the state formally brings open releases under what it may regulate; that follows from the draft text already, whatever any lab does next. Procedural delay means the procedure demonstrably slows a release or adds conditions to it. Intervention means the state demonstrably limits or prevents publication.
The opening test is Kimi K3.1 Pro, and its possible outcomes do not all prove the same thing. Weights published by 4 November under a licence no stricter than Kimi K3's would show that the new authority has produced no procedural delay for this model. A slip, or a stricter licence, would not by itself show procedural delay: either can have commercial causes, and Moonshot earns most of its revenue from its API. A disclosed registration or licence would show that the procedure is in use, but because the licence for open release is automatic, it may be purely administrative. Procedural delay would need evidence that the procedure caused a delay or a condition, from Moonshot, the ministry or a pattern across several labs. Intervention would need a covered model whose weights are withheld or refused at the state's instance.
The second test is Beijing's rule. If the final version, after the comment period closes on 15 November 2026, keeps the three thresholds and the exemption for APIs, the authority becomes law, and the institutional channel is real; how licences are then handled will show whether it adds procedural delay or intervention. If the draft is withdrawn or narrowed to exclude open publication, the institutional part of this argument weakens sharply.
The third test is the next frontier release from Qwen and DeepSeek. If either releases a model above the draft's thresholds openly under Apache 2.0 or MIT after 15 November, the claim that the frontier is closing fails for the labs that matter most. DeepSeek is the cleanest test, because its founder said in 2024, "We will not change to closed source," and it has published its weights under MIT since early 2025. If the next top Qwen and DeepSeek models appear only through APIs, or with service-provider clauses, the commercial mechanism is strengthened.
The fourth test is behaviour, measured over the three months from 15 November 2026 to mid-February 2027. A stable Chinese share of OpenRouter traffic would not prove dependency on its own: existing open models may simply still be good enough. The stronger signals are behavioural. Do Western developers accept paid licences or API-only access for the next Chinese models, report migration problems, or lose access to releases they need? If they do while frontier releases close, that is what dependency looks like. If it falls as developers move to Nemotron, gpt-oss successors, Arcee or Cursor's own model, the alternatives are working and the dependency was a temporary price advantage. The derivative counts give a second reading: whether new Qwen derivatives keep outpacing Gemma and Llama by four to seven times, as in the six months to October.
If DeepSeek and Qwen stay open at the frontier, the final rule spares open publication, and Western bases close the gap, this investigation will have described a phase rather than a structure. If not, the paradox in the title will have a second half. Washington restricted the chips. Silicon Valley adopted the models. And the terms of the next generation are being set by Chinese laboratories, and, if the draft holds, by a Chinese ministry, not in California. Nobody had to plan that outcome. Chinese labs published for their own commercial and political reasons, Western developers adopted for price and performance, and adapters, hosting and products accumulated from thousands of separate rational decisions. Structural power does not require intent. It only requires that the decisions keep pointing the same way.
What carries beyond this case is the difference between a stock and a flow. A download is a stock: it stays where it is, under the terms it came with. The next pretraining run is a flow, controlled by the lab that trains it, increasingly shaped by licences, and shaped by the state if the draft holds; that control decides what everyone downstream can do next.
Open weights give developers control over the model they have. They do not guarantee access to the model they will need next.
Evidence Map
Facts, interpretations, forecasts, and disconfirming signals.
Core claim. Western developers build on Chinese open-weight models, most deeply on Alibaba's Qwen family, while the money still flows to American closed models. Weights already downloaded stay under the user's control. Access to the next frontier release is shaped by the lab, its licence and, if Beijing's draft export rule holds, the state.
Evidence level. Facts: high. Cursor's base model, the derivative and token shares, the licence clauses and the text of Announcement No. 48 are documented in primary sources. Interpretation: medium. That switching costs and licence terms turn adoption into dependency on the next release. Forecast: conditional. How large that dependency becomes depends on whether the next Chinese generation keeps its lead and stays open.
What would confirm this. Kimi K3.1 Pro's weights arriving late, under stricter terms, or after a disclosed filing that demonstrably delayed them; the final rule keeping its thresholds and API exemption; the next top Qwen and DeepSeek models appearing only by API or with service-provider clauses; Western developers accepting paid licences for them.
What would disprove this. Open frontier releases under Apache 2.0 or MIT after 15 November; the draft withdrawn or narrowed; Western open models closing the gap and developers moving to them.
Watchlist. 4 November (K3.1 Pro weights), 15 November (comment period closes), the next Qwen and DeepSeek frontier releases, and OpenRouter shares and Hugging Face derivative counts to mid-February 2027.
Sources. Built on primary documents (Hugging Face reports and API, OpenRouter rankings, DeepSeek and Cursor technical papers, licence texts on Hugging Face, CAISI evaluations, Menlo Ventures, the House committees' letters, the DHS order in the Federal Register) and on reporting by Reuters, Xinhua, The New Stack, VentureBeat, TechCrunch, ChinaTalk, Computing and Techstrong (Vercel index), The Register (Ascend) and AI Weekly's summary of The New York Times (Qwen's closed models). Announcement No. 48 was checked against the official MOFCOM text, its draft annex and the spokesperson's Q&A. The derivative count is a Manifest measurement of the public Hugging Face API on 25 October 2026; queries, definitions and limitations are set out, with a linked list of every source, on the page Sources and method.
Jerry van der Laan writes The Manifest Archive, a long-form investigation into how institutions, language and infrastructure decide what counts as reality. He works from primary documents, market data and the public record. He traces the structures beneath them.
The questions, the editorial judgments and the responsibility for every published claim are mine. AI assists with the research, the drafting and the source checks.
Related from The Manifest Archive
Everyone Is Watching the AI Boom. Nobody Is Watching the Transformer That Can't Be Built in Time.
Everyone Is Watching the AI Rules. Nobody Is Watching the $16,000 Graphics Card.
Palantir and the Price of Exit: How Switching Cost Became Power
Everyone Is Watching Chinese Cars Win Europe. Nobody Is Asking What Any Maker Can Still Switch Off.
