Chinese artificial intelligence companies are rapidly narrowing the capability gap with Western frontier models while simultaneously triggering a major international security crisis. New revelations show that several Chinese AI startups, including Moonshot AI and DeepSeek, secretly routed enormous volumes of user queries to American AI systems, inadvertently funneling sensitive military intelligence, surveillance footage, and classified credentials to US servers. Meanwhile, US investors are racing to fund domestic open-weight alternatives to counter China's dominance in this emerging segment of the AI market.

What Are Open-Weight AI Models and Why Do They Matter?

Open-weight models are artificial intelligence systems whose underlying code and parameters are publicly released, allowing companies and developers to run advanced AI capabilities on their own servers without sending data to third-party providers like OpenAI or Anthropic. This approach offers significant advantages for enterprises concerned about data privacy and cost control. Chinese labs have aggressively pursued this strategy, creating what experts describe as a broad alternative technology stack that reduces concentration at the frontier and accelerates the spread of AI capabilities globally.

The competitive landscape has intensified dramatically. DeepSeek open-sourced its V4 preview with a one-million-token context window, meaning it can process roughly 750,000 English words at once, with performance it claimed rivaled leading closed models. Xiaomi's MiMo-V2-Pro, Tencent's Hy3, Moonshot AI's Kimi K3, and new Alibaba Qwen models have added to an increasingly dense field of capable alternatives. This proliferation matters because open-source and lower-cost models make advanced AI capabilities available to more developers and organizations worldwide, while domestic chip initiatives reduce dependence on US suppliers.

How Are Chinese AI Companies Secretly Accessing Western Models?

Anthropic's 154-page threat intelligence report exposed a sophisticated scheme in which Chinese AI startups built underground proxy networks to secretly route user queries to American AI systems. Moonshot AI, developer of the popular Kimi chatbot, constructed roughly 5,000 fake accounts without user knowledge, bundling massive volumes of queries and forwarding them directly to Anthropic's Claude Opus model for processing, then routing the American-generated answers back to Chinese users as if they had come from a domestic system.

This arrangement created a massive security vulnerability. In one documented case, a user with an apparent official background uploaded closed-circuit surveillance footage taken near a People's Liberation Army military base and asked the AI to analyze whether specific military or political figures in the footage were "behaving unusually." The user believed they were querying a Chinese domestic model processed entirely within China, unaware the sensitive footage had been routed in real time to Anthropic's servers in the United States. The same channel also leaked large volumes of movement-tracking data drawn from Chengdu's "Skynet" surveillance network, spanning hundreds of cameras, along with internal corporate login credentials that Chinese engineers had casually typed in while building their own systems.

"If Anthropic or one of our peers did something like this, it would be an enormous scandal," said Jacob Klein, Anthropic's head of threat intelligence.

Jacob Klein, Head of Threat Intelligence at Anthropic

A similar routing scheme involving DeepSeek ended up implicating Russia's military as well. Multiple queries tied to entities affiliated with Russia's Ministry of Defense were funneled through DeepSeek into American systems, including valid login usernames and passwords for internal Russian government databases, effectively exposing sensitive Russian military information on the back end of US servers.

What Military Applications Are Chinese Forces Using AI For?

Beyond the passive leaks caused by query routing, Anthropic documented several specific cases of Chinese military users deliberately bypassing restrictions to use Claude directly for real weapons systems work. A user based in China and linked to the People's Liberation Army's Academy of Military Science used Claude to develop an electronic warfare and suppression-of-enemy-air-defense software package, using it to prioritize strike targets and simulate radar jamming. The suspended account's simulation specifically listed twelve key Taiwanese defense positions as targets, precisely identifying Taiwan's early-warning radar installations, Patriot missile batteries, Tien Kung (Sky Bow) missile positions, major air force bases, and underground command bunkers.

Additional cases revealed even broader military applications:

• Naval Systems: A user linked to a Chinese defense manufacturer used Claude to produce a technical package running more than 200 pages, covering specifications and fire-control software for an anti-torpedo system for the Chinese navy, and asked the AI to compare the resulting parameters against currently deployed US Navy technology.
• Weapons Research: Another user linked to Chinese defense intelligence work used the AI to research foreign high-power microwave weapons, tracing specific component manufacturers and supply chains in an apparent effort to support reverse engineering and countermeasure development for the Chinese military.
• Strategic Planning: Users drafted classified briefing materials for senior Chinese Communist Party and military leaders using AI-generated content.

Anthropic detected close to 200 million instances of malicious access over the past few months, including Chinese teams using jailbreak techniques, such as disguising requests as katakana Japanese translation tasks, to strip out and steal Claude's private, undisclosed chain-of-thought reasoning. Between May and July alone, Alibaba reportedly made 151 million such accesses to help train its Qwen model, while Moonshot made 23 million.

How Is the US Government Responding to These Breaches?

The findings have triggered alarm in Washington. Michael Kratsios, director of the White House Office of Science and Technology Policy and President Trump's chief AI adviser, has publicly stated that Moonshot built its K3 model by distilling Anthropic's Fable model. Treasury Secretary Scott Bessent warned that the US government is actively considering financial sanctions and Entity List export controls to block Chinese companies conducting what he called "industrial-scale distillation attacks".

At the same time, the US Congress is advancing legislation that would ease antitrust restrictions to let major American AI companies coordinate their defenses against this kind of cross-border theft. This represents a significant shift in regulatory approach, prioritizing national security concerns over traditional competition policy.

Why Are US Investors Betting Big on Open-Weight AI?

The security crisis has accelerated US investment in domestic open-weight alternatives. Arcee, a US enterprise AI startup, raised at least $150 million in a Series B funding round at a $1 billion pre-money valuation, with Vista Equity Partners, Cambium Capital, and Emergence Capital leading the investment. This round sits in the 97th percentile of all-time US Series B enterprise software rounds, a sign of significant investor appetite for cost-efficient AI labs.

Arcee's founder Mark McQuade saw an opening after Meta backed off open-weight models. With $30 million in the bank from previous funding, he bet most of it on building models from scratch. "We saw an opportunity, and we had $30 million in the bank," McQuade said. "I said 'let's do it' and I bet the company on it." The startup spent about $20 million training four models, including Trinity Large, a 400-billion-parameter model released in early 2026.

"We can comfortably say we're the most efficient lab in the world based on what we've done," said Mark McQuade, founder of Arcee.

Mark McQuade, Founder of Arcee

The new funding will support development of additional open-weight models and products, plus a growing partnership with the US Department of Energy. Arcee will also work with Vista's portfolio companies. McQuade's stated goal is to catch China, which currently dominates open-weight AI. Arcee says its models have beaten Meta's Llama 3 and benchmarked on par with Mistral and Chinese rivals, with efficiency as the central competitive advantage.

What Does This Mean for the Global AI Race?

The convergence of Chinese capability advancement and security breaches has fundamentally altered the competitive dynamics of artificial intelligence development. Chinese labs are narrowing the gap with Western frontier systems while competing aggressively on openness, cost, and deployment flexibility. This creates a broad alternative stack of models, chips, and deployment options that reduces concentration at the frontier and accelerates diffusion of advanced capabilities.

However, the security revelations have exposed the risks of this open approach. The ability of Chinese military and intelligence agencies to weaponize Western AI systems, combined with the industrial-scale theft of proprietary model training techniques, has prompted a fundamental reassessment of how the US should approach open-source AI development and international AI governance. The result is likely to be a more fragmented global AI ecosystem, with separate technology stacks developing in the US, China, and potentially Europe, each optimized for different security and regulatory requirements.