China's AI Models Won the World. Now Beijing Is Building the Vault.

The world's most heavily used AI models are increasingly Chinese. By late June, models from DeepSeek, Alibaba, and their peers were processing 48 percent of tokens on OpenRouter, the routing platform that functions as the closest thing the industry has to a Nielsen rating for what developers actually deploy, against 20 percent for American models, a near-perfect inversion of a year earlier⁶. The wedge was price: DeepSeek's V4 Flash costs $0.14 per million input tokens where OpenAI's GPT-5.5 charges $5.00⁷. Then, on July 7, Reuters reported¹ that Chinese authorities have spent the past month in meetings with Alibaba, ByteDance, and Z.ai about restricting overseas access to precisely these systems, including models not yet released.

Governments do not usually pull their most successful export off the shelf at the peak of its run, so the details deserve attention. The talks, led by the Ministry of Commerce, covered limits on the most advanced models, both closed systems and open-weight ones, meaning models whose underlying numerical parameters can be downloaded and run on anyone's hardware. Officials discussed making any leak or theft of proprietary AI technology an offense under China's national security law, and floated new rules on who may fund domestic AI startups. The scope is unsettled and may apply only to future models¹. A summary published in a Supreme People's Court journal sketches the likely shape: a tiered system² in which basic open-source tools require a simple filing, advanced ones face security reviews, and the most sensitive frontier models are barred from public release or restricted to domestic use.

So is this security policy or industrial policy? After working through the machinery Beijing has assembled this year, I think the security story is genuine but load-bearing for only one tier of the system. The rest is enclosure: converting a market-share victory won through openness into state-controlled strategic infrastructure, with foreign access retained as a lever Beijing can adjust.

The case for taking the security framing at face value is stronger than skeptics want to admit, mostly because Washington just ran the identical play. In June, the Commerce Department ordered Anthropic to suspend access to its Fable 5 and Mythos 5 models by any foreign national, "whether inside or outside the United States"³, forcing the company to shut both models off for every customer on Earth because nationality could not be verified in real time. Anthropic disputed the basis⁴, saying the government cited a jailbreak that surfaced only minor known vulnerabilities, and access was restored on July 1⁷. But the fear was not fanciful: Anthropic's own research found Mythos-class models can turn newly disclosed software flaws into working exploits in hours⁵ rather than weeks. Beijing noticed. Reuters reports Chinese authorities are deeply worried Washington might deploy Mythos against Chinese interests¹, and prominent voices there are calling for a domestic equivalent. If the US will torch its own champion's global customer base over one suspected jailbreak, a Chinese domestic-only tier for the most dangerous frontier capabilities is symmetric statecraft, not hypocrisy. For that narrow category, models that weaponize code at machine speed, I think the security logic holds on both sides of the Pacific.

The symmetry breaks when you look at what else is in the package. Mythos is a purpose-built vulnerability-hunting system with an obvious dual-use profile. China's discussed regime covers general-purpose commercial models and, tellingly, the question of who may put money into AI startups, which no end-user vetting rationale explains. The sequencing is the giveaway. Restrictions that apply only to future models leave today's open weights circulating freely; they could not be recalled anyway, since roughly 80 percent of startups running open-source AI stacks already use Chinese models⁶. What gets gated is the upgrade path, at exactly the moment agentic coding workloads, which reward whatever model is newest and cheapest, have grown to more than half of all platform usage⁶. Keep the world dependent on your current generation, then meter access to the next one. China ran this sequence before with rare earths, restricting exports from a position of near-total dominance, and the WTO ultimately found those measures functioned as market protection rather than the conservation policy Beijing claimed.

The commercial layer is already moving in the same direction. Alibaba built the Qwen family into the most downloaded open model ecosystem anywhere, 942 million cumulative downloads by March¹⁰. Then on April 20 it shipped its flagship Qwen3.6-Max as a closed-weights, API-only product, the first in the family's history, and shut down the free tier of Qwen Code the same day. Build the audience with openness, then charge at the top of the line. A state rule gating frontier exports would simply harden that corporate strategy into national policy, and hand the state the dial.

Then there is the capital architecture, which is the part the sovereignty rhetoric explains least. When DeepSeek closed its first outside funding round in June, raising $7.4 billion at a valuation above $50 billion, commercial investors including Tencent and CATL were routed into a limited partnership with a five-year lock-up and zero voting rights⁸. The lone exception was the state's National AI Industry Investment Fund, which put in roughly 1 billion yuan⁹ of the 50 billion raised yet received direct equity, voting rights, and no lock-up. Two percent of the money, all of the votes. Layer on the State Council's new Outbound Investment Regulation, effective July 1, which subjects overseas deals to national security review and prohibits even indirect technology transfer through relocating engineers or cross-border training¹¹, with penalties up to forced divestiture¹². Add April's order forcing Meta to unwind its $2 billion acquisition of Manus¹. This is a system for owning and steering an industry, not merely for screening adversaries out of it.

For everyone outside these two countries, the motive question matters less than the operational fact it produces: frontier AI now ships with a sovereign kill switch, demonstrated within a single month in both directions. Reuters notes that curbs on Chinese models would raise costs for many businesses¹ that migrated to them precisely because they were cheap. The rational response, already visible in enterprise procurement, is to treat model provenance the way supply-chain officers learned to treat chip provenance, and I expect the loudest beneficiaries to be sovereign-AI programs in third countries that can promise neither Washington nor Beijing holds the off switch.

To read Beijing's move as security policy alone, you would have to believe that a state which takes the only voting seat in its most valuable AI lab, orders Meta to unwind a $2 billion deal, subjects its engineers' overseas relocation to export review, and exempts today's globally dominant models while gating tomorrow's, is doing all of it solely to keep cyberweapons away from adversaries. The simpler reading is that Beijing watched its labs give the world the store, watched the world build on it, and has decided the store should henceforth have an owner. The security tier is real, but it is the vault door on a building the state now intends to hold the deed to.