A new front has opened in the U.S.-China competition in artificial intelligence: open-weight, local AI models. Until recently, the most capable AI models were too big and too costly to run anywhere but in giant data centers packed with expensive, specialized chips. But now these systems are rapidly migrating from the cloud to consumer hardware—including laptops and mobile devices—where they can answer questions, write code, and take actions on a user’s behalf without sending data to a remote server. Thanks to technological advances in both AI models and chips, the so-called open-weight AI models that increasingly underpin most local AI deployments are smarter and smaller than their predecessors and can be freely downloaded from the internet, modified, and deployed without a centralized provider.
These rapid local AI systems promise to democratize access to powerful technology, reduce costs, and give users more control over the tools they use daily. But they also risks entrenching a profound asymmetry. The most capable open-weight models now flowing onto local devices are disproportionately Chinese. And if current conditions continue, China will retain this powerful edge. Moreover, many of the best open-weight models have been built by Chinese companies that systematically extract the capabilities of frontier American systems by applying a process called distillation—in which a smaller, more efficient AI model is trained to mimic a more sophisticated one—at an industrial scale. It is an approach that U.S. firms, constrained by contracts and legal norms, cannot follow because the terms of service of every major AI provider prohibit using model outputs to train competing systems.
Given these dynamics, the central contest in AI is no longer limited to development. It has expanded to include distribution—that is, to determining which country’s models, chips, and software frameworks will become the default on billions of devices. At present, U.S. firms design and sell the best chips and frontier AI models. But Chinese firms are distilling these models, compressing them to run inexpensively on cheap hardware, and shipping the results to the world. Indeed, in many cases, they are shipping the results back to the United States. The resulting Chinese advantage distorts the market and leaves U.S. firms and global users that need to build on open-weight AI with the unenviable choice of using Chinese models or falling behind.
It now seems possible that the United States could win the AI training battle and lose the distribution war—not because it failed on technical merit, but because it failed to ensure a level playing field. Fortunately, there is a way to respond. Over the past decade, Washington has honed a playbook for dealing with China’s anticompetitive practices. It must now adapt those strategies to promote U.S. progress and leadership in open-weight AI while penalizing actions by Chinese entities that cross the boundary between common research practice and economic warfare. This strategy carries a risk: if executed too broadly, it could damage U.S. AI leadership by constricting access to the very talent and models Washington needs to succeed. Executed precisely, however, this strategy could complement private-sector efforts to combat unauthorized distillation and ensure that the United States’ AI advantage continues into the next decade.
A NEW PHASE
Until recently, ordinary users struggled to run AI locally. The chips inside everyday devices, including laptops and phones, had too little memory to fit capable models and too little computing power to run them at usable speeds. And the software that enabled these models to reliably perform multistep tasks (such as reading a document, drafting a reply, and saving it to the right folder) was not yet mature.
Today, that is no longer the case. Hardware has become much more efficient, as have local models themselves. A recent study by researchers at Stanford showed that the share of queries that local models can accurately answer rose from 23 percent in 2023 to 71 percent in 2025. This means that a person can now download an open-weight AI model directly onto a laptop or smartphone and run it without an internet connection, with queries answered by the device’s own chip rather than by a remote data center.
Demand for local AI systems is increasing for a variety of reasons. Developers want models they can download, modify, and deploy independently. Businesses want to keep sensitive data on their own infrastructure, and AI companies need models that they can fine-tune on their own data. Economic and infrastructure factors are also pushing the AI market toward local models. Accessing the cloud is expensive, and cloud-based models rely on massive data centers that face major power constraints. Shifting AI workloads to local machines spreads the burden across millions of existing devices and sidesteps data centers’ increasing physical and political limitations.
There is also an advantage to having AI capabilities widely distributed geographically. The risk of relying solely on data centers to handle AI workloads was revealed in March when Amazon Web Services’ data centers in the United Arab Emirates and Bahrain were damaged by Iranian drone strikes. The attacks knocked out a chunk of the region’s AWS infrastructure, taking down banking systems, payment apps, ride-hailing services, and enterprise software. Subsequently, Iran’s Islamic Revolutionary Guard Corps threatened the Middle Eastern infrastructure of more than a dozen U.S. technology firms, including several leading AI companies. As AI systems are increasingly used to support military operations, data centers are effectively becoming dual-use facilities and, therefore, targets for military strikes. Concentrating AI capability in a few large, exposed facilities is a strategic vulnerability. Models running locally across many devices are a safer, more resilient alternative.
A RISKY BUSINESS
Chinese companies are conscious of the advantages that local models offer. They are thus racing to extract capabilities from U.S. models via distillation under conditions that American firms are not permitted to replicate domestically. In February, the American AI company Anthropic disclosed that the Chinese AI labs DeepSeek, Moonshot, and MiniMax had collectively generated more than 16 million exchanges with its Claude model through roughly 24,000 fraudulent accounts to extract high-value reasoning, coding, and tool-use capabilities. Anthropic described the activity as systematic distillation, not isolated misuse. As a result, capabilities that Anthropic had spent hundreds of millions of dollars developing were siphoned into competing Chinese products within weeks of being released.
The problem is not distillation as a technique. Knowledge transfer is part of how the AI ecosystem innovates, and developers around the world depend on open-weight models for legitimate research. The problem is that Chinese firms can freely engage in large-scale capability extraction from frontier U.S. models while U.S. firms are constrained by terms of service and legal norms that their foreign competitors ignore. American frontier labs spend tens of billions of dollars to train models, yet those capabilities can be siphoned off and released at a fraction of the original cost. In this way, the companies bearing the expense of frontier research are increasingly subsidizing the product lines of their competitors, who then attempt to undercut them on price.
The safety and security risks that can accompany distillation are just as concerning. Distillation transfers the capabilities that models acquire in training. But essential AI safeguards—such as alignment tuning (training a model to follow human instructions and refuse harmful requests), red-teaming (expert testing to expose and fix a model’s flaws), and safety filtering (software that screens inputs and outputs for dangerous content)—are added to AI models after their core training process has been completed. These safeguards are accordingly not transferred during distillation, and the consequences can be serious. In early 2025, the U.S. technology company Cisco revealed that DeepSeek-R1, a Chinese open-weight reasoning model, failed to block sampled prompts from a standard industry safety test called HarmBench, which covers categories including cybercrime, illegal weapons, and disinformation. The cybersecurity firm CrowdStrike further showed that when politically sensitive terms (such as “Tibet,” “Falun Gong,” and “Uyghurs”) were added to ordinary coding prompts, DeepSeek-R1 was up to 50 percent more likely to generate code with security vulnerabilities.
The case of OpenClaw, an open-source AI agent software framework that runs on a user’s own device, underscored the safety and security risks of these models. After its release in late 2025, OpenClaw became one of the fastest-growing repositories on the developer platform GitHub, drawing millions of monthly users. Unlike browser-based chatbots, OpenClaw gives local agents the memory, tools, and ability to act by using local hardware. Often, users pair OpenClaw with open-weight AI models. Because OpenClaw and systems like it autonomously build and run code, vulnerabilities in the underlying AI models do not stay in text. Instead, they get compiled, deployed, and executed on the user’s machine. OpenClaw’s marketplace for “skills”—prebuilt capabilities that let its agents perform specific tasks, from writing code to managing files—was rapidly flooded with more than 340 malicious extensions. Furthermore, Cisco’s AI Threat and Security Research team found that one of OpenClaw’s top-ranked community skills was functionally malware, showing how damaging it can be to have open-weight AI models that will not reject a clearly malicious set of instructions.
The unchecked spread of Chinese local models distilled from American products is on track to generate a serious geopolitical dependence. A developer may initially only intend to use a Chinese model locally. But if the developer’s applications need cloud scale, they will naturally gravitate toward the cloud provider that hosts and optimizes for that model. As a result, Alibaba Cloud rather than the U.S. alternative AWS will be favored. Eventually, the developer will use Huawei’s chips, not Nvidia’s. What starts as a cost-driven choice becomes a full-stack, enduring dependence. The same pattern has already appeared in telecommunications, mobile payments, and digital infrastructure. It is part of a broader Chinese strategy of technology-driven influence, from Belt and Road physical infrastructure to Huawei’s 5G networks, that systematically converts initial cost advantages into lasting dependencies. If Chinese models distilled from U.S. ones become the default intelligence on billions of devices, the United States risks allowing Beijing to have sway over the tools that people use every day for information, communication, and work.
CLOSE THE GATES, HIT THE GAS
Washington must confront this Chinese advantage by slowing Beijing’s unauthorized distillation efforts and accelerating the development of the U.S. open-weight ecosystem. The major U.S. AI companies are already attempting to blunt unauthorized distillation. Anthropic has built behavioral fingerprinting and response-shaping systems that flag the usage patterns characteristic of automated distillation and subtly alter the model’s outputs to make the harvested data less useful to a competitor. Google has deployed similar detection systems, which successfully identified a campaign of more than 100,000 prompts targeting its Gemini model. OpenAI has warned Congress that it has been subject to similar industrial-scale distillation campaigns.
These steps are a good start, but they are unlikely to solve the problem because dedicated attackers can invariably work around most of these technical defenses. The digital watermarks companies embed in model outputs can be edited out, the behavioral fingerprints they look for can be blurred by further training, and detection only works when firms can see how their models are being used in the first place. To assist private companies’ efforts, the U.S. government should begin by focusing on trade and regulatory policy. Distillation pipelines still depend on access to U.S. chips for training, which makes export controls one of the more effective policies for constraining them at scale. These controls should be maintained and tightened, particularly where chips are known to enable unauthorized distillation. As part of this effort, Washington should extend the foreign direct product rule (FDPR), under which it can impose licensing requirements on foreign products that use technology originating in the United States. In this framing, any Chinese models that have incorporated capabilities systematically extracted from American frontier systems would be subject to licensing requirements. If licenses are denied, the result would be outright prohibitions on these products’ commercial deployment, integration into enterprise products, and export to third countries. This move would not prevent the creation of local models based on distillation, but it would disrupt their deployment and export.
FDPR’s efficacy has already been proven through its application to networking equipment and semiconductor manufacturing tools. Extending it to AI may be even more important, because a distilled model can be deployed and integrated into commercial products within hours of its release, making controls on the downstream commercial usage pipeline essential. An FDPR-style approach also has the practical advantage of focusing on a particular model, rather than broadly penalizing entire firms or entities. As a consequence, it could be used either instead of or alongside other measures, such as Entity List designations, which would formally cut off Chinese labs that perform unauthorized distillation from U.S. technology and components. Under the International Emergency Economic Powers Act, the United States can also freeze these labs’ U.S.-based assets, bar U.S. persons and companies from doing business with them, and create secondary risks for foreign companies that continue to supply or partner with them.
The central contest in AI is no longer limited to development. It now includes distribution.
These protective measures, though extensive, will not be enough. Washington must urgently encourage the development of competitive U.S. open-weight alternatives. At present, economic incentives are working against American open-weight developers. Frontier labs are reluctant to release models that cannibalize their own existing successful products, and independent American developers cannot distill from frontier systems without violating the terms of service that govern their access. Washington should address this by working with frontier AI firms to permit limited, accountable distillation by U.S. and allied companies in their terms of service. Such distillation could be limited and subject to safety review, in sharp contrast to the unbounded, anonymous harvesting practiced by some Chinese labs. Meanwhile, public resources and research funding should be used to encourage U.S. entities to release and maintain capable open-weight models that give developers, enterprises, and governments worldwide a compelling reason to choose the U.S. option. Google’s recent release of Gemma 4—a family of open-weight models built from the same research as Gemini—proves that American companies can indeed produce competitive open-weight models when sufficiently motivated. If U.S. alternatives to Chinese models are widely available, the incentive to adopt an ungoverned alternative built on extracted capabilities diminishes substantially.
Each of these measures will be most effective if pursued in coordination with allies. Washington should work with its partners in Asia, Europe, and elsewhere to harmonize policy approaches and create a coalition large enough to set common standards for distillation, model licensing, and export controls. Without such coordination, controls imposed by Washington alone are easily evaded: a Chinese lab that is denied U.S. chips can route purchases through other markets, and an open-weight model blocked from entering the United States can find users in Europe or Japan. Coordination will be difficult, but the democracies that produce the world’s most advanced chips, frontier models, and largest software markets still control most of the choke points that matter. They can act. In the private sector, U.S. companies should share the distillation detection tools that they have developed and build cooperative norms around model security.
Last year, one of us, Jared Dunnmon, warned in these pages that if Chinese distillation allowed China’s open-weight models to race ahead of America’s, it could fundamentally erode the United States’ AI lead. That warning has been realized. Extraction is now happening on an industrial scale, and computing on local devices has crossed an inflection point; systems including OpenClaw have demonstrated that users around the world want models that run on their own devices, and strikes on data centers in the Gulf region have shown that centralized computing resources are physically vulnerable. As frontier AI systems move ever closer to creating what Anthropic CEO Dario Amodei has termed a “country of geniuses in a data center,” open-weight AI is already powering a veritable world of virtual assistants on devices around the globe that help everyday people work and live more efficiently and effectively. The next phase of the U.S.-China AI competition will be in no small part decided by which models become the default on the world’s local devices. Unless Washington makes the necessary changes, that distinction will belong to China.
Loading…