China Is Winning The AI War Washington Cannot See

Welcome to Memorandum Deep Dives. In this series, we go beyond the headlines to examine the decisions shaping our digital future. 🗞️

This week, we're looking at two AI models released worlds apart, in every sense. One is guarded like a state secret, wrapped in export controls, and treated by the U.S. government as a strategic national asset. The other was uploaded to the internet for anyone to download, modify, and deploy, no permission required.

The timing was no coincidence, and the capabilities of the two systems are closer than Washington would like to admit. But this story isn't really about a single model or a single benchmark. It's about a pattern that has been quietly building across the U.S. enterprise market for 18 months, one that shows up in startup pitch decks, cloud infrastructure choices, and the download charts of the world's largest AI platforms.

Because while American policymakers have been busy building walls around their most capable systems, something far more consequential has been happening underneath them. To understand what, and why it may matter more than any leaderboard, we need to start with a release that landed exactly one day after Washington tightened its grip.

A lockdown, then a giveaway

For the past several weeks, Anthropic's Mythos model has been among the most tightly controlled pieces of AI software in the world. Considered so capable that the U.S. government treated it as a strategic national asset, the model was placed under export controls, with its advanced vulnerability-discovery abilities viewed as approaching weapons-grade significance. The Trump administration has further restricted access, limiting who can use the model.

But while Washington was focused on locking down one of the world's most capable cybersecurity AI systems, a Chinese laboratory was quietly building another that appears to have caught up in precisely the capability the U.S. was trying hardest to contain.

Just a day after the new restrictions on Mythos took effect, Beijing-based Zhipu AI, also known as Z.ai, released GLM-5.2, a 744B-parameter open-weight model that security researchers say performs at roughly the same level as Mythos on vulnerability discovery. Unlike Anthropic's model, however, GLM-5.2 was released under the permissive MIT license, allowing anyone to download it, run it on their own hardware, modify it, and deploy it without seeking permission.

Capability is no longer the whole story

The contrast captures a broader shift taking place in artificial intelligence. The United States may still produce the world's most advanced frontier models, but China is increasingly demonstrating that it doesn't necessarily need to lead on raw capability to dominate adoption. By releasing increasingly capable models under permissive licenses, Chinese AI companies are making it dramatically easier and cheaper to use them, accelerating their adoption among startups, enterprises, researchers, and governments worldwide.

That distinction between capability and adoption has become increasingly important over the past year. Frontier benchmarks still matter, but they no longer determine which models developers actually build with. Cost, licensing, deployability, and infrastructure have become equally decisive competitive advantages, and it is across those dimensions that Chinese models have steadily gained ground. GLM-5.2 illustrates how quickly that shift is happening.

The model, GLM-5.2, a 744B-parameter open-weight system, when tested against other leading models on a standard vulnerability-detection benchmark by cybersecurity company Semgrep, outperformed Claude Code in identifying a common class of security flaw, scoring 39% compared to Claude Code's 32%.

Just a year ago, matching Anthropic on any meaningful benchmark would have been unthinkable for an open-weight Chinese model. The fact that it has happened now, in a domain the U.S. government has identified as a national security priority, is the signal worth tracking.

The benchmark alone does not prove that Chinese models have overtaken their American counterparts. What it does suggest is that the capability gap has narrowed enough for other factors, particularly economics and accessibility, to become far more influential in determining adoption. And the easiest way to track it is to look at the pattern that has been quietly building across the U.S. enterprise market for 18 months.

The economics of adoption

For enterprises running AI at scale, inference costs have become impossible to ignore. DeepSeek's R1 costs roughly $0.55 per million input tokens, while comparable OpenAI reasoning models cost more than $15 per million input tokens. DeepSeek's V4 Pro similarly undercuts Claude Sonnet by several multiples, making the economics difficult for startups to ignore.

The result has been a shift that is easier to see in aggregate than in any individual company's press releases. Martin Casado, a general partner at Andreessen Horowitz, estimated that among U.S. startups pitching with open-weight AI stacks, there is roughly an 80% chance they are running on Chinese open models. On OpenRouter, a platform that tracks usage across more than 400 AI models, Chinese open models have risen from near-zero usage in late 2024 to nearly 30% of total queries in some recent weeks. The same shift is visible among developers, where Alibaba's Qwen family has overtaken Meta's Llama as the most downloaded open-weight model series on Hugging Face. And Airbnb's CEO Brian Chesky told Bloomberg the company is "relying a lot" on Qwen because it is "fast and cheap," and that the company's frontier model usage "doesn't rely on them much in production."

None of these companies is choosing Chinese models because they believe they represent the absolute frontier of AI capability. They are choosing them because, for production workloads, the performance is increasingly "good enough" while the cost savings are substantial.

Why enterprises can use Chinese models without sending data to China

The critical technical detail that makes this adoption possible at American companies without triggering the most obvious data-sovereignty concerns is the distinction between a model's weights and the server that runs them. The U.S. government's stated concern about Chinese AI centers on the hosted API: DeepSeek's own service sends user data to servers in China, governed by Chinese law and potentially accessible to Chinese intelligence services.

While that concern is real, the weights themselves, once downloaded, can be deployed on Amazon Web Services, Microsoft Azure, or Google Cloud, entirely within U.S. infrastructure, with no data ever transiting to a Chinese server. AWS Bedrock and Microsoft's Azure AI Foundry now both host Chinese open-weight models as managed enterprise services, allowing companies to deploy them entirely within U.S. infrastructure.

Which means that while the model's origin is Chinese, the data stays in Ohio, Virginia, or wherever the enterprise has configured its cloud region.

Washington's response targets the wrong layer

This architecture is what allows the adoption wave to continue despite the legislative response in Washington. Multiple bills have been introduced to ban Chinese AI from government devices and from federal contractors. The "No Adversarial AI Act," introduced in June 2025, proposed a permanent framework to bar all federal agencies from using AI models developed in China, Russia, Iran, or North Korea. NIST's Center for AI Standards and Innovation published a formal evaluation of DeepSeek in September 2025, concluding that the models were more susceptible to security vulnerabilities and that their outputs aligned with Chinese government positions on politically sensitive topics. None of this has touched the private sector, and none of it addresses the deployment architecture most U.S. enterprises actually use. The bans apply to the app and the hosted API. The weights remain freely available.

The risk that remains inside the weights

There is a harder version of the risk argument that the legislative response has not yet fully grappled with. CrowdStrike published research in 2025 that found that politically sensitive trigger words caused DeepSeek to produce measurably more insecure code. Booz Allen followed with findings that Qwen and MiniMax generated code with substantially more vulnerabilities when prompted in contexts suggesting the user was a U.S. government employee, increases of 130% and 20%, respectively. Researchers have suggested that these behaviors reflect conditional outputs embedded in model weights. The evidence for intentional design is not conclusive. But if it were confirmed, the open-weight deployment architecture that neutralizes the data-exfiltration concern would do nothing to remove this one. The risk would live in the weights themselves.

China's strategy is bigger than DeepSeek

Beijing understands what it has built. China's "AI+" initiative explicitly prioritizes open-source model development as a national policy objective. Premier Li Qiang used the World Economic Forum in summer 2025 to position China as the global champion of open AI, framing its model releases as a public good for the world. That framing is strategically useful because it is partly true. For developers in emerging markets, a frontier-adjacent model that runs cheaply on local hardware is genuinely valuable, and the United States has yet to offer an equivalent open-weight alternative. Its response to Chinese open-weight models has been restricted: export controls on chips, bans on government use, and legislative proposals that stop at the government perimeter. There is no U.S.-backed open-weight model that competes with Qwen or DeepSeek on price at the global developer layer.

This is where China's open-weight strategy begins to look less like a series of successful product launches and more like industrial policy. Individual models will come and go, but the objective is to ensure that developers worldwide build on Chinese foundations by default.

RAND framed this gap directly in a March 2026 paper, stating that the U.S. response should include stronger support for an American open-source ecosystem, revised export controls, and incentives for permissive licensing. None of that has happened. Instead, Qwen has become the dominant base model for open-weight fine-tuning worldwide.

The remix layer of the global AI ecosystem, the layer where individual developers and enterprises adapt AI to their specific needs, now runs predominantly on a Chinese foundation.

Taken individually, each of these developments could be dismissed as an isolated trend. Together, however, they point toward a much larger shift in how the global AI ecosystem is evolving. The question they raise is not whether China is winning the frontier model race, because by most measures it is not, at least not yet. The question is whether winning that race is what actually determines who shapes the global AI ecosystem over the next decade. If the models that developers reach for first are Chinese, if the base layers that get fine-tuned, remixed, and built upon are Chinese, and if the cost of U.S. alternatives continues to make them viable only for well-funded enterprises and government agencies, then the frontier benchmark leaderboard may turn out to be less relevant than it appears. Technical leadership and infrastructural dominance are not the same thing, and the U.S. has historically assumed they would be.