On October 3rd, 2026, the Day of German Unity, Aleph Alpha put a model called Kolibri on Hugging Face: 78 billion parameters, German and English only, trained from scratch, free under Apache 2.0.[1] Two years earlier, on September 5th, 2024, its then-CEO, Jonas Andrulis, told Bloomberg why building one was no longer enough. As TechCrunch relayed it the same day: “Just having a European LLM is not sufficient as a business model. It doesn’t justify the investment.”[2] And seventeen days before Kolibri shipped, the company had signed a definitive agreement, not yet closed, to combine with Cohere, of Toronto.[3]

So a company that said a European model alone doesn’t pay, and that has agreed to operate under another company’s name, has just built one. Why? Look at what it built. The United States, China, and Europe are all inside it, and it shows how each competes in AI in 2026.

Here is what I think: the investment that a European LLM “doesn’t justify” has collapsed. I’m not going to tell you Kolibri beats the frontier models. It doesn’t claim to. It is large enough for the job, and that is the point.

If you run technology or allocate capital in Europe, read Kolibri as a bill of materials: what it cost, who supplied each part, and what each supplier can take back. Its own documents let you start counting. Before I do: I was Chief Evangelist at Arcee AI (see below) until November 2025.

What does a from-scratch model cost in 2026?

Aleph Alpha’s model card gives the bill in GPU-hours: 392,000 for pre-training on 768 NVIDIA B200s over 21 days, 90,000 for a second phase on reasoning and code data, 10,000 to stretch the context window. That is 492,000 GPU-hours.[4]

The technical report thanks its cloud provider once: Verda, which publishes its prices. A B200 rents for $7.13 an hour on demand, and 25% less on a two-year commitment. Multiply it out, and you get $3.5 million at the first rate and $2.6 million at the second.[5] A cluster this size is quoted privately, and Aleph Alpha hasn’t published what it paid.

That number leaves things out: an earlier model whose pre-training was restarted once, the small experiments before the real run, the fine-tuning, and every GPU-hour spent generating training data with other people’s models. So the bill starts at roughly $3 million, and almost none of the rest is published.[6] Verda gave the only outside hint on October 5th, 2026: “Training a model like Kolibri requires over a thousand GPUs running around the clock for months.” A thousand GPUs for three months would cost about $15 million (my calc; the three is my assumption).

In October 2021, I wrote that replicating a 530-billion-parameter model would cost “close to $100 million” in servers, networking and hosting, and asked which organizations had a use case that justified even $10 million. Very few, I said. Five years later, you can rent the training run of a serious model for less than that $10 million.

The serving bill chose the size

Why 78 billion parameters, and not 400? And why only German and English? Because Aleph Alpha builds for ministries and manufacturers who want to run this on their own machines, and the company sized the model based on serving cost, not a leaderboard.

Start with what the 78 billion buys. Kolibri is a mixture-of-experts model, so only 3.46 billion of the 78 billion parameters do any work for any one token. That splits the serving bill in two: you pay for speed on 3.46 billion, and for memory on all 78 billion.[7] So the question of size is a question of memory.

The launch post is plain about it: bigger was better and more expensive, and “The latter drove the decision”. Then the team estimated what each size would cost to serve: “123B can handle only 3 long-context 256k-token user queries on two H100s, while 78B handles 18 concurrent requests”.[8] Aleph Alpha's own estimate says six times as many long-document users on the same two GPUs won the argument.

The two languages also follow from the budget. The card calls it “a deliberate choice of depth over breadth”, and the report prices a language: about a fifth of the pre-training tokens, i.e., 4 trillion for German, when the open German datasets held roughly half that. I’d expect French or Spanish to cost that again each. The report lists other European languages as future work.[7]

How do you tune a model you can only train once?

A full run costs millions, so choices are tested on small copies first. Aleph Alpha used two network shapes: one with 0.6 billion active parameters trained on 97.6 billion tokens, and one with 2.1 billion trained on 327.6 billion. A third, half as wide as Kolibri, tuned the training settings. The hard part is carrying what you learn up to full size.

For its earlier model, the team took the common approach: fit scaling laws, i.e., formulas that predict the best training settings from small runs, on runs of 100 to 430 billion tokens, then extend them to 7.5 trillion. Reused for Kolibri, those laws gave “unrealistic hyperparameter predictions”. That is a useful admission. A scaling law is not a law of nature. It is a curve fitted to one model, one context length, and one token budget, and this one stopped working when all three changed.

So the team dropped them and extrapolated each candidate setting's loss curve on the half-width model. The result still has to hold at full width. To do that, the team used a known technique called µP: it scales the starting weights and learning rates with the network width, so settings tuned on a narrow model also work on a wide one.

The size came out of the same sweep I quoted above. At 3.4 billion active parameters, the team tried 42, 82, and 123 billion in total; the 82 is the test configuration closest to the 78 that shipped. Going from 42 to 82 improved loss and accuracy. Going to 123 improved them “only slightly further”, and at a 4,000-token context it decoded 32% slower than 42, where 82 was 13% slower.

That is all “Pareto frontier” means in the report’s title: no other model it tested is both better and cheaper to run. On one of the report’s charts, three models sit on that frontier: “Qwen3.5 35B-A3B, Kolibri and Qwen3.8 27B”. Two of the three are Alibaba’s, and one of those is Kolibri’s teacher. The cost on that chart is a count of active parameters, not a measurement. The chart behind the title plots text decoded per second per GPU, as Aleph Alpha measured it. Memory, which chose the size, is on neither.

The last stage of training is reinforcement learning against verifiable rewards: the model attempts a task and gets a grade from a program that can check the answer and from a frozen judge model for proofs and conversations. Kolibri ran one training run of 1,000 steps on 256 B300 GPUs across 38 environments. They are general: software engineering and terminal use make up 36% of the mix, math and reasoning 18%, and seven are German variants. No training environment is named for an industry. The industries appear on the test side: five in-house stand-ins for assistants Aleph Alpha runs for customers, in semiconductors, the German public sector, aerospace, automotive supply, and industrial drives. Two of the five have 11 and 26 questions.

Generating the attempts “can dominate the cost of RL”, so the model that writes them runs with 8-bit weights and an 8-bit cache, which the report says is two to three times faster. The trainer copies that rounding, so that both sides stay the same model. In April, I called the checking step the verification tax: it runs on CPUs, and it can limit how fast a model learns. The run I described then, at Together AI, used more than 100 sandboxes at once on 32 GPUs. Kolibri’s averaged 25,000, against 480 for Aleph Alpha’s earlier model. They ran on the CPUs the GPU servers “keep idle”: 112 cores per node across 31 nodes, about 3,500 total. They paid the tax with cores that came with the rented GPUs.

The report doesn't give MFU, model FLOPs utilization: the share of a chip’s peak arithmetic that training actually uses. It is the key efficiency metric in pre-training. It is also a favorite vanity metric for AI labs. In reinforcement learning, the key metric is simpler: how long the GPUs sit idle, waiting for the CPUs to check the answers. What Aleph Alpha publishes is throughput, a median of about 16,500 tokens per second per GPU in pre-training, and reliability: 38 unplanned interruptions that cost 28.7 hours in total. It publishes no utilization figure for any stage. My back-of-the-envelope estimate from its own figures is 15% to 22% for pre-training, if the run used 16-bit arithmetic: 15% counting the active parameters alone, 22% with attention and the output layer added.[9]

A page from Arcee AI’s book

In January 2026, Arcee AI released Trinity Large: a 400-billion-parameter mixture-of-experts model, pre-trained on 2,048 B300s by a company of about thirty people, as reported. Arcee AI’s own account puts the whole six-month effort, including smaller models, at $20 million all in. The Trinity report came out after I left Arcee AI. Kolibri’s report cites it by name for two methods it reuses.[10]

The book is the same: your own pre-training run, mixture-of-experts, open weights, a rented cluster, and a detailed report. Aleph Alpha runs it at a fifth the size, narrows it to two languages, and sells it in its home jurisdiction.

The two differ in what they give away. Arcee AI published its raw pre-training checkpoints, and named no teacher. Aleph Alpha kept its earlier model, Kolibri Origin, to itself, and named the models that helped build Kolibri. Neither released its full training set, though Aleph Alpha’s German web dataset is public. Kolibri’s license adds a sentence under the Apache grant: it “does not extend to underlying code, model architecture, parameter settings or any training method.”[11]

So the weights are free, and the recipe is printed, but the pantry is locked.

Who wrote the training data?

Like Arcee AI and NVIDIA, Aleph Alpha had other models write part of it.

About 24% of Kolibri’s pre-training data, 4.8 trillion tokens, is synthetic. Google’s Gemma 4 rewrote English web pages into cleaner forms. For German, Mistral’s NeMo model did the rewriting, and the report calls the result “the single largest source of German in the model”.[12]

Then comes the part that teaches the model to reason, call tools, and hold a conversation. The report: “The main models we use to generate this data, and to regenerate parts of the open datasets, are GLM-5.2, GLM-5.3 and Qwen3.8-27B.” The first two come from Z.ai; the third from Alibaba. The summary Aleph Alpha published under the EU’s AI Act template lists the same models by their Hugging Face repositories, including an 8-bit copy of GLM-5.2. That tells me the company downloaded the weights and ran them on its own machines.[13]

Do the licenses allow it? I checked instead of assuming. On October 5th, 2026, I read the license terms of eleven of the twelve outside models in the recipe. All but three of them are plain Apache 2.0 or MIT. GLM-5.3 has its own license, which adds a security review for the largest companies selling model access. None restrict training another model on their outputs.[15]

gpt-oss and Gemma 4 are also Apache 2.0, so the licenses are no different. What differs is which models get released. Here is how I read it: America gives away models good enough to filter and rewrite, and keeps the ones good enough to teach behind an API, while Chinese labs give away the teachers. That may be changing. On October 5th, 2026, Reflection AI, an American lab, announced Beam, a 501-billion-parameter model it calls competitive with GLM-5.2, and promised the weights under Apache 2.0 in October.[15]

And where did the Chinese teachers learn? On September 8th, 2026, three American agencies published an advisory accusing six Chinese labs, including Z.ai and Alibaba, of distilling US frontier models at industrial scale, which they called “the core—not merely a supplement—of their AI development strategy.”[16] The advisory names the companies, not the models Kolibri used. If the agencies are right, the chain would run like this: American frontier models, illicitly, into Chinese open weights, and from there, lawfully, into a German model.

On September 28th, 2026, Aleph Alpha published a study of Chinese political alignment in open models: six Chinese models gave balanced answers to only 17% to 41% of 967 sensitive prompts, compared with 70% for Claude Sonnet 5 and 92% for Mistral Small. Thus, generated conversations with open-ended answers pass through a filter that drops those that don't. The judge in that filter is gpt-oss-120b, from OpenAI.[14] . The study adds: “Anyone who is building their first frontier model effectively has to fall back on open-weight models and work with the resulting political behavior.” It says it has adopted its own remedies, and its model card warns that Kolibri “may reproduce political biases present in its training data”.[17] But the study tests no model from Z.ai, the lab behind two of Kolibri’s three main teachers.

Three blocs, one model

In March, I wrote that a country without a frontier lab has three bad choices: build its own model, buy American, or download Chinese weights. In June, I put the three blocs in one line: the United States restricts, Europe regulates, Chinese labs ship.[18] Both need an update, because Kolibri doesn’t choose. It downloads, rents, and builds.

American companies supplied every GPU the documents name, and gave away the filter and the rewriter. So far, they kept their teachers. So the United States competes at the top and at the bottom of the stack: rent the silicon to everyone, sell the frontier by the token, and let the rest of the world assemble whatever fits in between.

Two Chinese labs supplied the main teachers, under licenses that charge nothing. So Chinese labs compete on distribution. Their work ends up inside other people’s products: in Mistral’s catalog, and now in a German model built for ministries.[19]

Europe supplied the cloud, the work of assembling a German corpus, the team, the intended customers and the law. That is the last mile, a consolation prize at the frontier. But it is the market Aleph Alpha says it builds for, and Europe’s rules do one useful thing here: the reason I can list Kolibri’s teachers by repository is that the AI Act made Aleph Alpha fill in a form. Give yourself a pat on the back, EU bureaucrats.

In June, I said my read would break if someone shipped “a model under 100 billion parameters that matches the leaders.” Kolibri is under 100 billion, and it doesn’t claim to match the leaders. So my reading holds: someone still has a hand on every door in this model.[20]

Is it any good?

On Aleph Alpha’s own test suite, Kolibri scores 75.5 in English and 70.8 in German. OpenAI’s gpt-oss-120b, a bigger open model with more active parameters, scores 72.3 and 70.2 on the same suite. The closest model in Kolibri’s class, Alibaba’s Qwen3.5 35B, is a point or less behind in both languages; call it a tie, at less than half Kolibri’s size. And Qwen3.8-27B, one of Kolibri’s teachers, beats it by 4.7 points in English and 9.1 in German, while activating nearly eight times as many parameters per token.[21]

So why would a German ministry pick Kolibri over a Qwen half its size? On the table, it wouldn’t. On Aleph Alpha’s own German public-sector test, Kolibri scores 75, the small Qwen 80 and the dense Qwen 89. It would pick Kolibri on eligibility. When Hesse bought from Mistral, in an award published on July 2nd, 2026 and made without a call for competition, one mandatory requirement was that the vendor’s models be developed in the European Economic Area or a country the EU deems adequate. Qwen fails that line before anybody runs a benchmark. Hesse found only Mistral eligible, and on the same public-sector test Mistral Small 4, the one Mistral model on Aleph Alpha’s table, scores 50. A German company you can sign with, audit, and sue passes it. A different Qwen of that size, Qwen 3.6 35B, echoed Beijing’s framing on 80% of sensitive prompts in Aleph Alpha’s own study, and Kolibri’s score on that test is the number its buyers are owed. Until it is published, Kolibri is how a ministry with Hesse’s requirement buys what Chinese models taught.[21]

And Mistral?

Mistral appears twice in this story. Three times, if you count my title: in July 2024, Mistral announced its Large 2 model under the headline “Large Enough”.[22]

It is in the pre-training data, as NeMo, a now-deprecated 12B multilingual model co-built with NVIDIA. The results table also shows that Mistral Small 4 trails Kolibri by 12.4 points in English and 9.4 in German on Aleph Alpha’s suite, though it leads Kolibri on one knowledge index in the same report. And it is missing from the list of teachers: of the models Aleph Alpha names for writing reasoning traces, none is European.[22]

Now read Cohere’s release. The combined company will operate as Cohere and, the release says, “will effectively create the first transatlantic sovereign AI solution”. In it, Ilhan Scheer, Aleph Alpha’s chief executive, calls Cohere “a strong strategic fit” for its “specialized language models for governments and regulated industries”. Neither company’s announcement names Mistral, so what follows is my reading. Cohere is not new to Europe: in June, it wrote of “our growing momentum across the UK and Europe”. What Aleph Alpha adds is a model built in Germany, for German, under European law, and Cohere buys Aleph Alpha and that model to go deeper into the European enterprise market. That is precisely where Mistral is trying to make money.[22]

Aleph Alpha has tried this before

In 2023, some of its investors were also its customers. Bosch and the Schwarz Group led a round that included SAP, and the company’s own release says it included “preconsumption licenses”, i.e., prepaid orders. What is different now is the product. The weights it published in 2024 were licensed only for research and education. Kolibri is Apache 2.0, runs on two GPUs in the buyer’s own room, and may soon have Cohere’s sales force behind it.[23]

What would have to break

Can Europe compete this way? Yes, as long as you are clear about what “this way” means.

It works on one condition: the scores hold up when somebody else measures them. I ran no benchmark of my own. If an independent evaluation puts Kolibri well below its class, the recipe is cheap because it is bad, and I will say so. The same goes for the bill: if the unpublished part turns out to be many times the training run, the $3 million tells you little.

It also works only as long as two other parties allow it. The Chinese labs own the license file, and a license can change with the next release, as GLM’s did between versions 5.2 and 5.3. Washington owns the chips, which an export rule could reach, and Axios reported in July that restrictions on Chinese models were under discussion.[24] If the teachers go, the cheap part of the recipe stays cheap, and the data becomes the wall.

The chips are American. The teachers are Chinese. On its maker’s own public-sector test, a Chinese model half the size scores higher. Only Europe could supply a legal entity, a form, and a buyer’s requirement that keeps the better model out of the room. I don’t call that an AI industry. I call it a customs office.

Andrulis was right in 2024: a European LLM alone isn't a business model. Kolibri doesn’t prove him wrong. It shows the business model: eligibility, sold as a service, and under a Toronto company’s name if the deal closes. The launch post names the real asset itself: “the most durable thing we built this year is not the pipeline, it is a team with the proven capability to build, post-train, and ship LLMs from raw data at high velocity.”[25] Mistral already sells that eligibility: Hesse found that only it could meet every mandatory requirement.

If you fund or buy AI in Europe, stop asking who will build our OpenAI. Nobody needs to, at about $3 million a run. A model like this is a component, like a database, and you should buy it like one. Ask what it costs, who trained it, whose switch it sits behind, and what you are really paying for. With Kolibri, you pay for a well-documented, competent model that is allowed to bid, not the one that scores highest.

Notes

[1] Aleph Alpha, Kolibri-1 model card, Hugging Face, accessed October 5th, 2026: “Total parameters | 78B (78,103,074,560)”, “Active parameters / token | 3.46B (3,457,573,120)”, “License | Apache 2.0”, “Release Date | 3rd of October 2026”, and under Model Dependencies, “None. The model was trained from scratch.” Second document: Aleph Alpha, “Kolibri: A Sovereign European Model on the Pareto Frontier”, technical report, 189 pages, abstract. The launch post opens “On the Day of German Reunification”: Aleph Alpha, “Kolibri Has Landed”. Both are the company’s own documents; no independent party has confirmed the parameter count beyond the Hugging Face file listing, whose tensor sizes sum to the same figure.

[2] As relayed by TechCrunch, September 5th, 2024, relaying an interview given to Bloomberg the same day. TechCrunch describes him as chief executive. The Bloomberg article is paywalled and was not read; the quote is reported, not confirmed at source.

[3] Cohere, “Cohere and Aleph Alpha sign agreement”, September 16th, 2026: a “definitive business combination agreement”, “subject to final regulatory approvals”, “Operating globally as Cohere”, “following the release of our planned partnership in April of this year”. I call it a purchase on that basis, on Handelsblatt, October 5th, 2026, which writes of a “De-facto-Übernahme” by Cohere, and on Reuters, April 24th, 2026, which reported the deal as an acquisition at an undisclosed price and relayed Handelsblatt’s report that Cohere’s shareholders would hold about 90% of the combined company; neither company has stated a split. The release plans a company “dual-headquartered in Berlin and in Toronto”. Aleph Alpha’s own release on Kolibri, dated October 5th, 2026, says the company operates independently until closing.

[4] The Kolibri-1 model card, Computing Resources row: “Hardware: 768 NVIDIA B200 (96 HGX 8xB200 nodes) [...] Time: 21 days (511h, 392k GPUh)”, “Mid-training: 5 days, 90k GPUh”, “Long-Context: 13h, 10k GPUh”. Second document: Aleph Alpha, “Kolibri Has Landed”, October 3rd, 2026, which gives the same 768 B200s, 21 days and three stages. The technical report, Appendix B.7.2, gives a net figure of 377,000 GPU-hours for the pre-training run; I use the card’s figure. Author’s calculation from the card: 392,000 + 90,000 + 10,000 = 492,000.

[5] Verda, pricing page, read October 5th, 2026 and archived the same day: “1x B200 SXM6 180GB [...] $7.13/h” on demand, and “2 years 25% off on-demand”. Author’s calculation from the card and the price list: 492,000 × $7.13 = $3,507,960. Author’s calculation at the two-year rate: (492,000 × $7.13) × 0.75 = $2,630,970. For comparison, AWS listed a B200 at $12.355 per hour in Capacity Blocks on October 1st, 2026. The 25% is Verda’s published discount for single instances; its page says clusters above 144 GPUs are quoted on request, so the lower figure assumes a comparable discount. These are list prices; the contract between Aleph Alpha and Verda is not public.

[6] The technical report, Acknowledgments, p. 114: “We thank Verda for supplying the GPU compute infrastructure behind this work”. Table 26, p. 95, gives “GPU hours, B300 equivalents” of 16,900 for the final reinforcement-learning run (and 5,500 for Kolibri Origin’s); Verda’s price list shows a B300 at $8.97 per hour on October 5th, 2026. Author’s calculation from the report and the price list: 16,900 × $8.97 = $151,593. The model card states that its energy estimate “excludes SFT and RL, peak, idle and low-load states, and proxy and ablation models”; I found no GPU-hour figure for fine-tuning, for the ablations or for data generation with the teacher models in the card, the report or the launch post. The restart is in “Kolibri Has Landed”: “We stopped the Kolibri Origin pre-training after a few trillion tokens and restarted it from scratch”. Verda’s own account: “Aleph Alpha releases Kolibri, a sovereign open-weight LLM trained on Verda”, October 5th, 2026, which also says the model was trained “in European data centers we own and operate” on a fleet “custom-built to Aleph Alpha’s requirements”. It gives no GPU count, hours or price. Author’s calculation, assuming 1,000 GPUs for 90 days at the B200 rate: (1,000 × 2,160) × $7.13 = $15,400,800. My 2021 figure priced the purchase of DGX servers: “Large Language Models: A New Moore’s Law?”, October 26th, 2021.

[7] The Kolibri-1 model card, Model Architecture table and config.json: 50 layers, 384 routed experts and one shared per layer, six selected per token, a sliding window of 512 preceding tokens in 40 layers and full attention in 10, “float8_e4m3fn” weights, “Model memory footprint: ~78 GB”. On languages: the card’s “deliberate choice of depth over breadth”; the technical report, section 2.3.2.2: “This leaves us with a lower bound of 4 T German tokens needed for training” and “The open datasets in the upper part of Table 9 add up to around 1.94T tokens”; its conclusion names “extending multi-lingual capabilities to European languages” as an area of interest. That each further language would cost about as much is my inference from those figures; the report does not say so. Forty of the fifty layers look back 512 tokens and ten read the whole context. The technical report presents two methods as new, a tokenizer training method it calls UniBPE and a load-balancing technique (”We introduce LEI”); the rest it attributes to published work. Tokenizer: the card reports 4.7 bytes per token on German text, by Aleph Alpha’s measurement; the technical report gives 4.90.

[8] Aleph Alpha, “Kolibri Has Landed”, section “Architecture and pre-training”. The 3 and the 18 are estimates, not measurements: the technical report, Table 31, is headed “Estimated maximum number of concurrent 256k-token requests in FP8”, and the 18 belongs to an 82.3B test configuration, not the 78.1B model that shipped. Verda’s price list shows an H100 at $3.77 per hour on demand on October 5th, 2026. Author’s calculation from the price list: (2 × $3.77) × 730 = $5,504. The post’s sentence continues “and decodes 28% faster”, a figure from a different setup that I leave out. The report’s size sweep ran 42.1B, 82.3B and 122.6B; the post rounds differently.

[9] The technical report. Proxies, section 2.1: “The proxy at scale M has 0.6B active out of 7.8B total parameters trained on 97.6B tokens. The proxy at scale L has 2.1B active out of 30.6B total parameters trained on 327.6B tokens.” Scaling laws, section 2.2: “A common approach fits scaling laws that extrapolate along both dimensions jointly”; “For Kolibri Origin, we fit power laws to the optimal learning rate and batch size at horizons from 100B to 430B tokens and extrapolate them to its pre-training budget of 7.5T tokens. Extrapolating those laws to the Kolibri setting gives unrealistic hyperparameter predictions”; the replacement is µP width transfer plus loss extrapolation on a proxy that “halves the width of the production model”. The Pareto quotation is from Figure 46; the title’s frontier is Figure 1. Size sweep, section 2.1.4: 42.1B, 82.3B and 122.6B total parameters at 3.4B active; “The 122.6B configuration improves loss and aggregate eval accuracy only slightly further”; at 4K context the “82.3B and 122.6B configurations are 13 % and 32 % slower than the 42.1B configuration”, measured on eight H100s. Pareto, section 3.3.3: “Qwen3.5 35B-A3B, Kolibri and Qwen3.8 27B span the convex hull of the Pareto frontier in both languages”, on a chart of the Overall scores against active parameters per token; Appendix A repeats the comparison against decoded text per second per GPU, measured by Aleph Alpha with vLLM on eight B200s. Reinforcement learning, section 3.2: “training it on its own rollouts against verifiable rewards”; “a single training run on 38 environments”; “All environments grade a sequence with a verifiable reward in [0, 1]”; “Our RL training runs on 256 NVIDIA B300 GPUs, split into 32 nodes with eight GPUs each”; “Serving the policy with FP8 weights and an FP8 KV cache raises the throughput of rollout generation, which can dominate the cost of RL, by a factor of two to three in our runs”; “Each non-controller node runs one sandbox executor on the CPUs that the run’s nodes keep idle, so runs never wait on a shared sandbox pool”. Table 26 gives 1,000 optimizer steps for the final run and 25,000 average concurrent sandboxes, against 480 for Kolibri Origin, and its caption says the earlier count covers code sandboxes while Kolibri’s “also includes agentic sandboxes that were added later”; judge model, section 3.2.2.1: the frozen judge “grades math proofs, simulates the user and grades natural-language assertions for the customer-service environment”; Table 58 gives “one per node on 31 nodes, 112 CPUs each”; 31 times 112 is 3,472, my calculation. Section 3.2.5 says the team “moved code execution to local sandboxes running on the CPUs of the training nodes”. The Together AI figures are from my piece “The Verification Tax”, April 10th, 2026, and its note 1. Environments, section 3.2.2 and Figure 32: “The final RL run trains on 38 environments, 31 English ones and 7 German variants”; “Software Engineering and Terminal Use (36.1 %)”; “Math and Reasoning (17.8 %)”; Table 55 lists every environment by name, and none carries an industry name. Table 57: “Five in-house proxies for deployed industry assistants”, namely “Semiconductors, German Public Sector, Aerospace, Automotive Supplier and Industrial Drive Technology”; Figure 44 says they “share no documents or questions with the training data”; section 3.3.3 says “Industrial Drive Technology (11 items) and Automotive Supplier (26) are too small to show a trend”. Utilization: I searched the report for MFU, FLOPs utilization and utilization on October 6th, 2026 and found no such figure for pre-training, SFT or RL. Figure 56 gives per-run median throughputs of 15,985 to 16,593 tokens per second per GPU; Appendix B.7.2: “We observed 38 unplanned interruptions during the net 377 000 GPU hours pre-training run”, and Table 35 totals the recovery time at 28.7 h. MFU estimate, my calculation: training costs about 6 floating-point operations per active parameter per token (2 forward, 4 backward; the rule ignores attention over the context), so 6 times 3,457,573,120 active parameters times 16,500 tokens per second is about 342 teraFLOPS per GPU. Lenovo’s product guide for the B200, January 13th, 2026, gives “2.25 / 4.5 petaFLOPS” for BFLOAT16, “Without / with structural sparsity enabled”; NVIDIA’s DGX B200 page gives the 8-bit figure for eight GPUs. 342 over 2,250 is 15%. Adding the output layer (6 times 2,560 times 128,000 per token) and attention at the 16,000-token pre-training context (10 full-attention and 40 sliding-window layers of 512 tokens, 48 heads of 128, Table 2: 12 times 6,144 times 102,400 per token) raises the count from 20.7 to about 30.3 billion operations per token, or about 500 teraFLOPS per GPU, which is 22% of 2,250. The report does not state the precision of the pre-training run; at the 8-bit peak of 4.5 petaFLOPS the same throughput would be 8% to 11%. Qwen3.8-27B is one of the three teacher models in section 3.1.1. That a scaling law does not travel well is my reading of the report’s own result.

[10] Arcee AI, its launch post for Trinity Large, January 27th, 2026: “All in—compute, salaries, data, storage, ops—we pulled off this entire effort for $20 million”, “We trained on 2048 Nvidia B300 GPUs”, and a pre-training run of 33 days. Second document: Varun Singh et al., “Arcee Trinity Large Technical Report”, arXiv 2602.17004, whose abstract gives “400B total parameters and 13B activated per token”, so Trinity has five times Kolibri’s total parameters and nearly four times its active ones. The team of about thirty is as reported by Implicator. Kolibri’s technical report cites “V. Singh et al. 2026” for sandwich normalization (”Each block uses sandwich normalisation”) and for its document buffer, both reused; for the load balancer of Kolibri Origin, which Kolibri replaced with its own; and, as what others do, for the normalization of routing scores.

[11] Arcee AI’s Trinity-Large-TrueBase is described on its card as a “10T-token pre-anneal checkpoint with no instruction data”. Kolibri Origin: the technical report, Table 1, “an internal model that is not released”. The public dataset is Aleph-Alpha-GermanWeb, whose card says “The synthetic dataset contains the actual data”; I have not established that it is the same German text Kolibri was trained on. The carve-out is in the model card, “License and terms”.

[12] The technical report, section 2.3.2, pp. 24 to 27: “Approximately 24 % (4.8T tokens) of our pre-training data is synthetic in origin”, rephrased “with Gemma-4-26B-A4B”; “We use Mistral-Nemo-Instruct-2407 to rewrite organic German documents [...] making it the single largest source of German in the model.”

[13] The technical report, section 3.1.1, p. 53. Second document: Aleph Alpha, Public Summary of Training Content, section 2.5, which lists Gemma-4-26B-A4B, Qwen3-32B, Qwen3.8-27B, Mistral-Nemo-12B, GLM-5.3, “GLM-5.2-fp8” (linked to the zai-org/GLM-5.2-FP8 repository) and Kimi-K2.6. That the weights were self-hosted is my inference from that listing; the report does not state how the GLM models were run. The summary does not list Kimi-K2.7, which the report uses in one reinforcement-learning environment.

[14] The technical report: Kimi-K2.7 and Kimi K2.6 in Appendix I.1, pp. 173 and 176; Qwen3.5-122B-A10B as judge and user simulator, section 3.2.3.2, p. 83; the filter in section 3.1.2.1, p. 60: “we judge the whole conversation, including reasoning traces, with gpt-oss-120b [...] Conversations of the first kind are dropped.” Arcee AI’s precedent, as I covered it at the time: my video of January 28th, 2025 on Virtuoso Lite and Virtuoso Medium v2, archived on julien.org. The report says in section 3.1.1.5, p. 59: “We acknowledge that several of our teacher models were built in China, so they carry known political biases on sensitive topics”.

[15] License files read on Hugging Face on October 5th, 2026: GLM-5.3 (”the Licensee must pass Z.AI’s security review” above “10 billion US dollars” of revenue for a “Model as a Service business”); Qwen3.8-27B, identical to the canonical Apache 2.0 text apart from the copyright line; likewise Qwen3-32B, Qwen3.5-122B-A10B and gpt-oss-120b; GLM-5.2, MIT; Kimi-K2.7-Code and Kimi-K2.6, “Modified MIT”, with a display requirement above 100 million monthly active users or $20 million of monthly revenue. The eleven models are Gemma-4-26B-A4B and Gemma-4-31B, Mistral-Nemo-Instruct-2407, Qwen3-32B, Qwen3.8-27B and Qwen3.5-122B-A10B, GLM-5.2 and GLM-5.3, Kimi-K2.6 and Kimi-K2.7-Code, and gpt-oss-120b: seven Apache 2.0, one MIT, three with terms of their own. Gemma 4 is Apache 2.0 on Google’s license page; Mistral NeMo is marked Apache 2.0 on its model card and carries no license file. The twelfth, Cohere’s Command A+, used as one judge, is tagged Apache 2.0 on Hugging Face; I did not read its license file. These are the licenses of the downloadable weights; a hosted API has its own terms. Reflection AI’s own post, “Introducing Beam”, October 5th, 2026: “This month, we will release the weights under an Apache 2.0 license”; it describes Beam as “competitive with larger open models like GLM 5.2” and offers early access by waitlist. As of October 6th, 2026, 01:19 UTC, I found no Beam weights on Hugging Face. Also TechCrunch, October 5th, 2026: “Reflection says it will release Beam’s weights and full technical details this month”; its performance claims “haven’t been independently verified”. Announced, not released, as of that date.

[16] NSA, CISA and FBI, advisory AA26-251A, September 8th, 2026, executive summary. The advisory names “DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI”. The advisory separates legitimate distillation from what it calls malicious distillation; it describes fraudulent accounts as a technique of “China-based entities” without tying it to each of the six. A search of the advisory for “GLM” and “Qwen3.8” returns nothing: it names companies and model families, not the models Kolibri used. Its claims are the agencies’ and have not been tested in court. Kolibri’s own use is of published weights, which the advisory does not concern. I searched on October 5th, 2026 for a published response from Z.ai or Alibaba and found none; The Register, September 9th, 2026, reported that China had answered by accusing US companies of distilling Chinese models, and wrote that it had sought comment from Chinese AI companies; its story prints none.

[17] Bastian Boll, “Training on the Party Line”, Aleph Alpha, September 28th, 2026. The six Chinese models are two each from Qwen, DeepSeek and Kimi; prompts were generated and answers judged by gpt-oss-120b. Its Figure 1 gives Claude Sonnet 5 at 70% balanced and Mistral Small 2603 at 92%, and the two Alibaba models it tests, Qwen 3.6 35B-A3B and Qwen 3.8 2.4T-A95B, at 17% and 19%; neither is the Qwen3.5 35B or the Qwen3.8-27B of Kolibri’s results table, and the post concedes that “The difficulty of these judgement calls might cause judge bias”. The post: “sovereign models need three things: screening of training data for Chinese political content, targeted alignment data that sets the intended behavior, and evaluation against benchmarks like the one presented here. We have adopted these measures at Aleph Alpha.” The warning is in the model card, “Political Bias”. No score for Kolibri on this benchmark appears in the card, the report, the launch post or the study, searched October 5th, 2026.

[18] My earlier positions: “Build, Buy, or Download Someone Else’s Politics”, March 6th, 2026, on Singapore, and “Too Dangerous for You, Free for Everyone”, June 28th, 2026: “While the United States restricts and Europe regulates, Chinese labs ship.”

[19] Chips and sites: notes 4 and 6; the technical report, p. 4, says the model was trained “on infrastructure in Germany and Finland”. Methods, same report, section 2.1: “The routing scores are sigmoids of the router logits (DeepSeek-AI 2024b)”; its Exact Quantile Balancing extends “Quantile Balancing (QB) (Kimi Team 2026b)”; Arcee AI’s Trinity: note 10. Rewriters, teachers and filter: notes 12 to 13. Code of practice: the model card, “Aleph Alpha is a signatory of the EU GPAI Code of Practice”. Buyer: note 3; the transaction had not closed as of October 5th, 2026. NVIDIA’s dataset card for Nemotron Cascade 2 lists “responses generated by DeepSeek-V3.2” for its math data and Qwen3 models for its agent conversations. Mistral’s catalog: Mistral’s post of August 11th, 2026 says its platform “will support third-party open models, starting with Z.ai’s GLM-5.2”; Mistral’s changelog lists GLM 5.3 as generally available from September 28th, 2026 and GLM 5.2 as retiring on October 31st, 2026; see also “Vent Mauvais”.

[20] My piece “Too Dangerous for You, Free for Everyone”, June 28th, 2026: “A frontier-parity model small enough to self-host cheaply (a step change in compression, or a model under 100 billion parameters that matches the leaders) would open a switch-free door for real”. Aleph Alpha’s own definition, in “Kolibri Has Landed”: “Sovereignty, for us, combines two dimensions: how we built the model, and how it transfers to our customers.” GLM licenses: note 15.

[21] The Kolibri-1 model card, Evaluation, post-training table, rows “Overall (EN)” and “Overall (DE)”: Kolibri 75.5 and 70.8, GPT-OSS 120B 72.3 and 70.2, Qwen3.5 35B-A3B 74.7 and 69.8, Qwen3.8 27B 80.2 and 79.9; the German knowledge average: Kolibri 57.6, GPT-OSS 120B 58.0, Gemma 4 26B-A4B 61.5, Qwen3.5 35B-A3B 61.3, Qwen3.6 35B-A3B 61.0. Author’s calculation from the card, English: 80.2 − 75.5 = 4.7. Author’s calculation from the card, German: 79.9 − 70.8 = 9.1. Two community tests have appeared since the release, each scoring Kolibri alone: a tool-calling run posted on Hugging Face on October 4th, 2026 (”Final Score: 86 / 100”, with two safety-critical failures), and Stefan Beierle’s practice test of October 5th, 2026, which reports 96% on a German compliance check with the statute in the prompt and 53% without, and declares no connection to Aleph Alpha. Neither tests another model. The technical report, section 3.3.3, p. 98, says the dense Qwen3.8 27B “activates nearly 8 times as many parameters per token as Kolibri”. All scores are Aleph Alpha’s own runs. The card’s row “German Public Sector”, one of its in-house customer proxies: Kolibri 75.0, Qwen3.5 35B-A3B 80.0, Qwen3.8 27B 89.0. The full row also has GPT-OSS 120B at 77.0, Qwen3.6 35B-A3B at 72.0 and Mistral Small 4 119B-A6B at 50.0; Small 4 is not Mistral’s best model and the notice does not say which model Hesse bought. Hesse: TED notice 453996-2026, a “Verhandlungsverfahren ohne Aufruf zum Wettbewerb” (negotiated procedure without a call for competition); its market survey found that “lediglich Mistral AI SAS sämtliche zwingenden Mindestanforderungen kumulativ erfüllen kann”; the requirement reads “Die verwendeten KI-Modelle müssen innerhalb des Europäischen Wirtschaftsraums oder in Ländern mit angemessenem Datenschutzniveau gemäß Art. 45 DSGVO entwickelt worden sein”; the notice says the lack of competition “ist nicht Ergebnis einer künstlichen Einschränkung der Auftragsvergabeparameter”. It is one buyer’s requirement for one purchase, not a law. I have not established whether a model developed in the United States, such as GPT-OSS 120B, would meet it. I covered the award in “Vent Mauvais”, September 24th, 2026. The 80% is Qwen 3.6 35B-A3B in Figure 1 of “Training on the Party Line” (note 17), a different model from the Qwen3.5 35B that scores 80.0; neither Qwen that outscores Kolibri on that row was tested in the study; no document gives Kolibri’s score on that benchmark. That Kolibri would be bought for its eligibility is my reading.

[22] The Kolibri-1 model card, same table, column “Mistral Small 4 119B-A6B”: 63.1 and 61.4. Author’s calculation from the card, English: 75.5 − 63.1 = 12.4. Author’s calculation from the card, German: 70.8 − 61.4 = 9.4. The technical report, section 3.3.3, says Kolibri “trails behind Qwen3.6 35B-A3B and Mistral Small 4 119B-A6B on the AA-Omniscience Index”. NeMo’s German text “had already been produced for the Aleph-Alpha-GermanWeb project” (same report, p. 27). The title: Mistral, “Large Enough”, July 24th, 2024. Scheer’s words are in the Cohere release of note 3, where he is Co-CEO; he has been sole chief executive since September 28th, 2026, per Aleph Alpha’s release of that day. Cohere on Europe: “Cohere triples UK footprint”, June 15th, 2026. Aidan Gomez’s stated reason, in the same release: “we’re joining forces with Aleph Alpha to enhance the talent, infrastructure and institutional trust behind our mission”. That Cohere wants Aleph Alpha in order to go deeper into Mistral’s market is my reading; neither company’s announcement names Mistral, and Cohere’s says “further integration and product details to follow”.

[23] Aleph Alpha, release of November 6th, 2023: “The investment is led by the Innovation Park Artificial Intelligence (Ipai), Bosch Ventures and the companies of Schwarz Group”; “This includes preconsumption licenses with the global industry leaders of the consortium”. The release lists SAP among the “Other new investors”. Gründerszene’s breakdown, relayed by The Decoder, splits the round into 110 million euros of equity, 300 million of research funding and 60 million of order commitments. The 2024 license: the Pharia-1-LLM-7B card, “which limits the usage to educational and research purposes”; the same card says “We provide our customers with open access to our full model checkpoint including weights and code for commercial use”. “Prepaid orders” is my gloss on “preconsumption licenses”.

[24] The outlet Axios, July 20th, 2026, reported that the administration “could ban cutting-edge Chinese AI models” and described approaches short of an outright ban, with Entity List designations under discussion; Tom’s Hardware relayed it on July 22nd. Reported, not enacted as of October 5th, 2026. I covered it in “The Model Is a Checkpoint”, July 23rd, 2026. No export rule restricts B200s to Germany or Finland today that I know of; the chip switch is a possibility, not a measure in force. GLM licenses: note 15.

[25] Aleph Alpha, “Kolibri Has Landed”. The 1.2 million reinforcement-learning tasks are “internally curated” in the technical report, abstract.

Open the config file for Qwen3.8-Flash-Next, released by Alibaba in August 2026, and count the layers. There are 48. Thirty-six are labelled linear_attention. The other 12 are labeled full_attentionand they are not: a few lines up, the file gives them an indexer, a small network that picks which tokens the layer reads, with a budget of 2,048 tokens [1]. No layer in this model does what the original Transformer’s layers did in 2017: read every earlier token in full.

It is not just one model. Alibaba, Moonshot, DeepSeek and Z.AI now ship models in which about one layer in four still reads every earlier token, or none does [2]. The labs’ case for these designs is cost: by DeepSeek’s own estimate, its V4-Pro needs a tenth of the cache its previous model did at a million tokens [3].

But while Kimi K3 and DeepSeek V4 offer a million tokens of context, and Qwen3.8 offers 262,144, extensible to a million [2][3], only one of the ten published full-attention comparisons I count below goes past 128,000 tokens. So, if you are picking an open model for long documents or for agents, this one is for you.

What the config files say

A model card is prose. config.json is what the inference engine actually loads, so that is where I looked, on October 1st, 2026 [2].

Kimi K3, Moonshot’s 2.8-trillion-parameter model, has 93 layers: 69 linear layers and 24 full-attention layers. Alibaba’s largest Qwen3.8 has 92: 69 and 23. DeepSeek V4 has no full-attention layer at all: it reads the last 128 tokens exactly, and anything older only through compressed summaries, some of which an indexer selects. Z.AI’s GLM-5.3-Flash has 34 linear layers and 11 sparse ones, with a selection budget of 2,048.

One warning before you go and check. GLM-5.3-Flash does what Qwen3.8-Flash-Next does: it lists its 11 sparse layers under a key called full_attn_layers [2]. The giveaway is elsewhere in the same file, where layer_types calls those layers deepseek_sparse_attention, with a budget of 2,048. Read the neighbors, not just the label.

Not everyone moved. Mistral Medium 3.5, IBM’s Granite 4.2, and K2-Horizon from the IFM institute still use full attention in every layer [4]. Google, Meta, OpenAI, and Thinking Machines mix it with layers that only see a recent window. NVIDIA and IBM have used a third option, Mamba-2. And Ai2 trained a 7-billion-parameter model on the same linear layers Alibaba uses [4]. A survey by Alibaba’s own researchers counts 17 hybrid releases, i.e., models that mix layer types, out of 27 in 2026, against 9 of 25 in the two years before, and concludes “continued coexistence rather than a universal replacement path” [5]. Fair enough. Still, of the eleven high-performing open-weight models that survey compares, only one uses full attention in every layer [5].

Why long context gets expensive

A full-attention layer keeps a key and value for every token it has seen (the KV cache) and reads all of them to write the next token; that cache is what you rent when a provider sells you “cached input”. Two bills grow with it: compute, because work per token grows with context and reading a whole prompt grows quadratically, and memory, because the cache grows with every token, for every user at once.

Agents made both bills urgent because they resend their whole history at every step: tool output, files, earlier turns. Moonshot’s and DeepSeek’s papers both open on the cost of long contexts and long-running agents [3][6]. DeepSeek’s tenth-of-the-cache model above uses 27% of the compute per token, both at a million tokens [3]. Moonshot’s Kimi Linear claimed “up to 75%” less cache [6].

What does that buy? More users per GPU and more context per user, i.e., a lower cost per token. On September 29th, 2025, the post that announced DeepSeek’s first sparse-attention model also cut its price per million tokens from $0.56 to $0.28 for uncached input and from $1.68 to $0.42 for output [7]. List prices don't tell me whether buyers see the savings. On October 1st, 2026, DeepSeek’s own V4-Pro listed at $1.32 per million uncached input tokens and $3.96 per million output tokens at peak hours, above its 2025 price, and Kimi K3, a far larger model, at $3.00 and $15.00 [7].

One thing I looked for and did not find: export controls, sanctions, HBM, memory prices, or shortages cited as reasons for the design in the DeepSeek V4 report, the Kimi K3 technical report, or the Kimi K3, GLM-5.3-Flash, and Qwen3.8 model cards [8]. Z.AI comes closest, saying GLM-5.3-Flash’s pre-release traffic was “served on Chinese AI chips”, which “are primarily constrained by memory capacity and bandwidth” [8]. Z.AI doesn't say whether that's also why the model looks the way it does, and I won’t say it for them.

Eight attention designs: what each saves and gives up

Each of the eight answers the same questions: what a layer stores and reads, what that saves, what it gives up, who ships it, and what to test. They run in order of what each still reads, not of date: every token (1 and 2), some layers still do (3 to 5), none does (6 to 8). The table gives the dates. For the mechanics of attention and the KV cache, I have three step-by-step videos [9].

1. Grouped-query attention. The heads of a layer, its parallel readers, share keys and values in groups instead of each keeping its own; every token is still read. It saves memory and costs some accuracy: on a 7-billion-parameter test, DeepSeek measured 41.2 on a general-knowledge benchmark with eight groups against 45.2 without [10]. Even K2-Horizon, whose config has no window, linear, or latent layers, “retains full GQA” [4][5]. What to test: nothing specific to this step.

2. Latent attention (MLA). The key and value for each token are compressed into a single vector of 576 numbers per layer, which the heads read directly, still for every token, every time [10]. In May 2024, DeepSeek ran the same model both ways, and the compressed version won 7 of 8 comparisons, with a cache between 4% and 14% of the original [10]. Kimi’s full-attention layers use it too. What to test: nothing specific to this step.

3. Sliding-window attention. Some layers keep only the most recent 128 to 2,048 tokens, and the rest keep everything: OpenAI’s gpt-oss alternates one and one, Gemma 4 and Thinking Machines’ Inkling run five windowed layers for each full one [4]. The windowed layers save memory and compute and cannot see far. MiniMax tried it on its M2 model: on a task that asks which words come up most often in the context, no difference at 32,000 tokens and a fall from 90.0 to 72.0 at 128,000 [14]. What to test: the same task at 32,000 tokens and at your real length.

4. State-space layers (Mamba-2). These layers store nothing per token. Each keeps a fixed-size state, a running summary of everything it has read so far, and rewrites it with every token, so nothing grows. That saves memory and compute, but it gives up the per-token key and value: there is nothing to go back to, and the more the state absorbs, the less of it comes back exactly. At 2.7 billion parameters, it tied a full-attention model (60.2 to 60.2) and did slightly better with six attention layers mixed in [11]. NVIDIA’s Nemotron 3 Ultra ships 48 of these layers, with 12 attention layers [4]. What to test: finding one exact name or number from early in a long context.

5. Linear attention (Gated DeltaNet, KDA). The state is again fixed in size, and each new token does three things to it: fade everything by a learned amount, weaken whatever was stored under a similar key, write the new entry [12]. That targeted weakening is the change from Mamba-2: the layer can revise a fact instead of blurring it. But a fixed state holds only so much. The paper that introduced the layer shows the cost: across six retrieval and question-answering tasks, the pure layer averaged 30.6 against a full-attention model’s 37.0, on inputs of only 2,000 tokens [12]. So no model in this piece ships the pure layer; the ones that use it ship a hybrid: three linear layers, then one full-attention layer for the exact lookups. Qwen3-Next shipped that in September 2025; Moonshot followed in October with its own variant, Kimi Delta Attention (KDA). Kimi K3 and Qwen3.8 use about the same layout at the trillion-parameter scale (69 linear layers to 24 and to 23): Kimi with KDA, which lets each channel forget at its own rate, and Qwen with Gated DeltaNet [2][6].

Why three to one? Moonshot tried five ratios on a small model, and 3:1 came out a hair ahead of 1:1 [6]. Mamba-2’s authors had found about 10% attention worked best [11]. Moonshot’s own “up to 6×” faster decoding is, in its words, “theoretical”; measured one request at a time, it is 2.3× [6]. What to test: retrieval of many items at once, at the context length you will really run.

6. Sparse attention with an indexer. Keep every token’s key and value, but put an indexer in front of the layer. DeepSeek’s lightning indexer scores every stored token cheaply, passes the best 2,048 to the layer, and the layer reads only those [13]. This saves compute, though less than it sounds: the indexer still scores every token for every new one, so its work still grows with the square of the context; it is just much cheaper work than reading [13]. DeepSeek’s paper claims no memory savings, and the indexer keeps its own keys on top of the cache. It gives up whatever the indexer fails to pick. Against its predecessor on 14 benchmarks, and after further training, the first sparse DeepSeek scored higher on 7, lower on 6, and tied on 1 [13]. Z.AI uses sparse attention in all 78 layers of GLM-5.3 [2]. Its GLM-5 report calls the mechanism “lossless by construction”; its own conversion test, on the 31-billion-parameter GLM-4.7-Flash, came out 0.35 points behind at 128,000 tokens, 78.86 against 79.21, and 1.72 ahead at 64,000 [15]. What to test: any task whose answer needs more than a couple of thousand tokens of evidence at once, such as counting how often something occurs.

7. Pooled cache with sparse reads. Now the stored entries themselves get merged. In DeepSeek V4, about half the layers slide an 8-token window along the text in steps of 4 and pool each window into one entry, so neighboring entries overlap, and an indexer can choose among them. The other half pools every 128 tokens into one entry and reads all of those. Every layer also keeps the last 128 tokens unpooled, and in V4-Flash the first two layers keep nothing else [3]. It saves memory and compute; DeepSeek’s 10% and 27%, quoted earlier, are for the whole model, pooling included. It gives up token-level detail for anything older than 128 tokens. DeepSeek’s report has no test that isolates the new attention: it compares V4 with V3.2, a different model, and the word “ablation” does not appear in its 58 pages [3]. DeepSeek prints its own curve, and it's honest: 0.92 at 128,000 tokens and 0.59 at a million on an eight-needle test, where eight identical requests are hidden in a long conversation, and the model must return the one it is asked for [3]. An outside team at ByteDance found something stranger in the newer V4.1-Flash: retrieval accuracy depends on whether the target sits in an odd or even position, about five points apart on average [16]. DeepSeek’s own V4.1-Flash paper says its architectural changes “create robustness boundaries that have yet to be fully characterized” [16]. What to test: retrieval at each position, as well as the average.

8. Linear plus sparse. The last step combines step 5 and swaps its full-attention layer for a sparse one. Qwen3.8-Flash-Next and GLM-5.3-Flash were uploaded on the same day, August 26th, 2026, with the same idea: three linear layers, then one sparse layer [2]. It saves and gives up what 5 and 6 do. Z.AI’s is assembled from other labs’ designs: Moonshot’s KDA for the linear layers and DeepSeek’s sparse attention for the fourth; its config file names both, and its launch post, which compares the model with Kimi and DeepSeek, names neither KDA nor Moonshot [17]. Alibaba tested the swap on its shipped model: between 512,000 and a million tokens, the sparse fourth layer scored 93.00 on RULER, a long-context benchmark that mixes needle lookups with tracing and counting tasks, against 90.08 with full attention [18]. What to test: everything under 5 and 6.

Ten tests against full attention, and what is missing

The labs’ case first. They said what they changed: DeepSeek’s launch post names its “Novel Attention”, Moonshot’s names KDA, and the config files are public [19]. Six labs ran the old design against the new and published the results, including losses.

I count ten such comparisons of designs that now ship in a model, from six labs: one win for the efficient design, seven mixed results and two losses [20]. The small-model tests in steps 4 and 5 are not in the count. I judge each comparison on every result the paper reports: a win is more than a point ahead somewhere and never more than a point behind; a tie is within a point everywhere; and mixed is more than a point apart in both directions. None of the long-context tables print error bars. One mixed result, Ai2’s, is against a baseline that already used sliding windows in three layers of four; another, Alibaba’s at 125 billion parameters, swaps one layer in four inside a hybrid against the same model with full attention in that layer.

Moonshot’s was a controlled test: three 48-billion-parameter models, same data, same recipe, and the KDA hybrid beat full attention 84.3 to 81.3 at 128,000 tokens on RULER. That model also dropped positional encoding from its full-attention layers; with it, the score was 78.8. The plain Gated DeltaNet hybrid scored 80.5 in the same test, just under full attention. Full attention stayed more than a point ahead on three other benchmarks in that paper, so I count the test as mixed [6].

Alibaba ran a 25-billion-parameter version of the experiment. Its Gated DeltaNet hybrid beat the full-attention model on eight of nine benchmarks, none of them long-context, and trailed on the remaining one, EvalPlus, 49.71 to 51.01, so I count it as mixed [18].

Ai2’s hybrid led on RULER at 64,000 tokens, 76.9 to 70.9, and trailed at 4,000, 92.8 to 95.8: mixed as well [20].

MiniMax converted its full-attention model to sparse attention and matched the headline score (72.12 to 72.00) but fell short on the split [15].

Z.AI’s GLM-4.7-Flash conversion, above, is the one win: 1.72 points ahead at 64,000 tokens and never more than a point behind [15]. Z.AI ran one more test, on GLM-5’s own base models: sparse attention against the full-attention parent on four tasks at 128,000 tokens, two up, one down and one level [15].

Two lost, and both were conversions to linear or sliding-window layers: an existing model, changed and then trained further, for 190 billion tokens at Z.AI and hundreds of billions to trillions at MiniMax. Of the four sparse conversions, one came out ahead and three mixed [13][15].

MiniMax’s loss is the sliding-window result above. In a February 2026 report, Z.AI converted half the layers of a 9-billion-parameter model to Gated DeltaNet, trained it on 64,000 tokens, and lost 11 points on RULER at 128,000. Its text says these methods lose “up to 5.69 points”; its table shows 11.28 for this one. It blamed “the unavoidable information loss introduced by efficient attention mechanisms during continual-training adaptation”, and its report has no test of the same layers trained from scratch [15]. In August, it shipped GLM-5.3-Flash, a new base model with 34 linear layers. Its launch post speaks of “preserving precise long-context capabilities”; neither the post, the model card, nor the docs give a long-context number [17]. On October 30th, 2025, MiniMax posted that “efficient attention still has some way to go before it can definitively beat full attention” [14]. Moonshot published its 48-billion-parameter RULER result that same day [6], and by the following June MiniMax had its own sparse attention [15]. On my count, MiniMax’s sentence still holds.

So what is missing?

Three things, and they are narrower than “nobody checked”.

The first is size. None of the four flagships has been compared with a same-size model built only with full-attention layers. Z.AI’s GLM-5 comes nearest: its comparison table does not give the models’ size, but the text says the sparse run starts from GLM-5’s own 744-billion-parameter base model. It stops at 128,000 tokens [15]. Alibaba’s 125-billion-parameter test swaps one layer in four inside a hybrid, not the whole model [18]. Kimi K3 rests on the 48-billion-parameter test; its own report has no such comparison [20].

The second is the task type. Needle tests are one place where sparse attention did well. When MiniMax broke down its 128,000-token results, sparse attention won in-context learning by 2.40 points and needle lookup by 2.24, and lost reranking by 2.10, word-frequency counting by 1.35, and, by exactly 1.00 each, question answering and variable tracking [15]. The gaps are small. But reranking, tracking, and question answering are closer to agent work than needle lookup, and the agent benchmarks in these reports don't isolate the attention design.

The third is depth, and it depends on what you ask. RULER holds: Alibaba’s 93.00 (above) and Moonshot’s Kimi Linear’s 94.8 at a million [6][18]. Telling eight similar things apart does not. On the eight-needle test, Alibaba’s new model scores 96 at 128,000 tokens, 93 at 256,000, 41 at 512,000 and 26 at a million [18]. Nothing in that table blames the sparse layer: with full attention put back in the fourth layer, the scores at 512,000 and a million are 31 and 21. So the million-token window is real as capacity, and RULER holds across it in these two tables. Distinguishing eight similar things requires between 256,000 and 512,000 tokens, with either fourth layer.

An audit in May looked for seven standard long-context benchmarks in the main results tables of four releases (DeepSeek-V4-Pro, MiMo-V2.5-Pro, Kimi-K2.6 and GLM-5.1): 0 of 28 were there, against 20 of 28 for agent and coding benchmarks [21]. DeepSeek’s Table 6 does print 83.5 for MRCR, OpenAI’s multi-needle test, at a million tokens. Its Figure 9 gives 0.59 for the eight-needle version at the same length, and the report does not say how the two relate [3].

Which chips run these designs fast

The first models shipped on kernels, the low-level code that runs a layer fast on a given chip, that the labs wrote or adapted from open-source libraries. Z.AI’s GLM-5 report has a section on adapting the model to seven Chinese chip platforms [15].

Mamba-2’s authors intentionally made it less expressive than the first Mamba so it “can exploit specialized matrix multiplication (matmul) units on GPUs, also known as tensor cores” [11]. Gated DeltaNet, the layer in Qwen and the ancestor of Kimi’s, has three authors: one from MIT and two from NVIDIA, with a footnote saying the work was done during the first author’s internship there [12]. Its training algorithm adapts DeltaNet’s, which the paper says “leverages matmuls, enabling tensor core-based GPU optimization” [12]. Neither paper measured serving.

Qwen3-Next shipped in September 2025 on kernels adapted from an open-source library. An NVIDIA engineer’s kernel for the layer, for the Hopper generation and for prompt processing only, arrived 114 days later [22]. Moonshot published its tuned kernel 173 days after Kimi Linear, with a first benchmark on NVIDIA’s H20 and a second on Blackwell a month later [22]. vLLM added AMD GPU support for DeepSeek’s sparse attention 52 days after launch, with accuracy numbers and no speed numbers [22]. Each trailed the others by 52 to 173 days, and none was the first to support it: DeepSeek, for one, published its own kernels with the model [22]. By this summer the gap had closed for Qwen3.8 at least: vLLM wrote that “NVIDIA and Inferact co-developed ultra-fast kernels for Linear Attention (Gated Delta Rule)” for it, with no speed number [22].

DeepSeek’s V4 report offers “some proposals to hardware vendors, in the hope of aiding efficient hardware design and achieving better software-hardware co-design” [23]. They concern the kernels of the expert layers (the ratio of compute to communication, power, communication primitives, the activation function), not attention. On September 30th, 2026, its FlashMLA kernel library added Huawei’s Ascend 950 and announced, “we removed support for the Hopper architecture” [23]. Hopper is the generation of the H100, the H200, and the H20. The README still lists NVIDIA first, as “NVIDIA SM100 / SM103 GPU”, i.e., Blackwell, and tells Hopper owners to “switch to” an older version of the code. If you own Hopper, the current release is not written for you.

So, co-designed or not? In the maths, yes: the linear layers were designed to train fast on GPU matrix units, and one was written partly at NVIDIA. In the serving code, mostly not: tuned kernels trailed the models by weeks or months, until Qwen3.8.

One company bet a chip on attention staying put. In June 2024, Etched announced a chip that ran only Transformers and wrote: “If transformers are replaced by SSMs, RWKV, or any new architecture, our chips will be useless.” [24] On October 1st, 2026, its homepage read “We’re building a new category of AI hardware: frontier inference clusters,” and it didn't mention “transformer” [24]. Four of the eight steps above first shipped between September 2025 and August 2026, and Qwen3.5, a 35-billion-parameter model from February 2026, already ships three linear layers for each full-attention one [2].

Where the cost reaches you

Three places: cache, retrieval, and hardware.

The first is the cache you pay for. When a provider sells “cached input”, it keeps the prefix it has already processed [25]. With full attention, that is the KV cache, one entry per token, so it can reuse your prompt up to any token. With linear layers, it saves a copy of the state at one position and can reuse it only at a position where someone saved one. A hybrid needs both, aligned to the same position. Saved states are big: on Qwen3.5-4B, one is about 49 MiB, as much as the KV cache for 1,500 tokens [26]. Moonshot’s own report says of caching these layers in fixed blocks that “At such a coarse granularity caching is nearly useless”, then describes the fix it built [26].

vLLM caught up fast. It shipped Kimi K3 support on July 27th, 2026, with caching switched off by default. A month later, its release notes read “prefix caching enabled by default for Mamba models” [27]. That line doesn't name K3, so check your version. Two things have not caught up. On vLLM today, a cached answer from a Gated DeltaNet model is not guaranteed to match an uncached one bit for bit, so you cannot diff outputs in a regression test: vLLM’s batch-invariant mode does not cover Gated DeltaNet yet, and LMCache’s documentation says “Generation is not bit-exact between a cached and a fresh run” and tells you to compare benchmark scores instead [27]. The only hit rate I found for K3 is Moonshot’s own; neither the vLLM post, LMCache’s documentation, nor the SuffixReplay paper gives one. Moonshot sells K3 cache hits at $0.30 per million tokens against $3.00, and says its API “achieves a cache hit rate above 90% in coding workloads”, with no method [7]. vLLM’s headline K3 benchmark, 2.8 times its earlier throughput at 16 concurrent requests, ran with caching off because of a bug since fixed [27]. The discount is real: all 24 K3 endpoints on OpenRouter price cached input below fresh input, 21 of them at a fifth of it or less [7]. Your hit rate is the number you should measure yourself by.

The second is retrieval at your depth: item 2 of the checklist below.

The third is the hardware you own. Somebody tried Kimi K3 on A100s, NVIDIA’s Ampere generation, the week it shipped, and got “no kernel image is available for execution on the device.” A member of the vLLM project replied: “K3 doesn’t support Ampere yet.” [28] Memory sizing changes too. Each request now carries state for its linear layers on top of its cache, and one operator who asked SGLang for 32 concurrent requests found it “capped to 9 by the mamba state cache” [28]. That was working as designed, and the log showed it. Old tuning tricks need retesting: storing the cache in 8 bits halves it on a full-attention model, and one vLLM calculation for a small hybrid gave 1.84 times the capacity at 32,768 tokens and 1.00 at short context, where the state, which is not quantized, sets the limit [28].

Six checks before you build on one

1. Open config.json. Count the layer types, then read the keys next to anything called full attention.

2. Run the same test at 32,000 tokens and at your own context length, with the target at several positions, including the middle, on counting, reranking, and multi-step questions. The drop between the two scores is what length costs you on that model. Needles are the easy case.

3. Measure cache hit rate on your engine, your version, and your prompts. Compare scores, not outputs.

4. Size concurrency against state memory as well as cache memory, and retest every tuning you carried over.

5. Ask which GPU generation has a fast path for this model in this release.

6. Price the workload two ways: this model at the hit rate you measured, and a full-attention model you could use instead. The savings are real where the provider has passed them on.

The window got longer, inference got more expensive, and layers got smarter. Yet testing didn't keep up, and what we measure is narrower.

Offered at a million tokens. Compared with an all-full-attention model at 128,000, at most. Your job is to explore what happens in between, and find the accuracy price you’re paying to optimize inference.

Notes

[1] Qwen3.8-Flash-Next on Hugging Face, accessed October 1st, 2026. The config.json lists 48 layers under layer_types: 36 linear_attention and 12 full_attention, with indexer_budget 2048 and indexer_compress_ratio 4. The model card describes the same 12 layers as sparse: “12 × (3 × (Gated DeltaNet → MoE) → 1 × (Qwen Sparse Attention → MoE))”, “Budget: 512 blocks or 2048 tokens”. Both documents are Alibaba’s own; the claim is about what its file says.

[2] Config files and model cards on Hugging Face, accessed October 1st, 2026. Kimi K3: “Attention-Layer Composition 69 KDA + 24 Gated MLA”, 93 layers; the config lists 69 kda_layers and 24 full_attn_layers. Qwen3.8-2.4T-A95B: 92 layers, 69 linear_attention and 23 full_attention. DeepSeek V4-Flash: 43 layers, compress_ratios of 0, 4 or 128 for every layer; V4-Pro has 61. GLM-5.3-Flash: 45 layers, 34 linear_attention and 11 deepseek_sparse_attention, the 11 listed under full_attn_layers, with index_topk 2048. Qwen3.8-Flash-Next is in note 1. Qwen3.5-35B-A3B: 40 layers, 30 linear_attention and 10 full_attention; the repository record gives its creation date as February 24th, 2026. GLM-5.3: 78 layers, architecture GlmMoeDsaForCausalLM. Qwen3-Next: 48 layers, “12 * (3 * (Gated DeltaNet -> MoE) -> 1 * (Gated Attention -> MoE))”. Kimi Linear: 27 layers, 20 KDA and 7 full attention. Author’s calculation from the Kimi K3 config: 24 ÷ 93 ≈ 0.258. Independent confirmation of the pattern: the survey in note 5, and LMCache’s list of hybrid models, which gives 12 validated hybrid recipes against 6 for uniform attention. In the GLM-5.3 config, indexer_types reads shared for 57 of the 78 layers and full for 21. vLLM’s launch post (note 27) gives the size: “Kimi K3 is a 2.8-trillion-parameter Mixture-of-Experts model”. Context windows, from the model cards: Kimi K3 “supports a 1-million-token context window”; Qwen3.8-2.4T-A95B, “Context Length: 262,144 natively and extensible up to 1,010,000 tokens”. The GLM-5.3-Flash config also sets index_kpool to 4; neither the config nor the model card says whether its 2,048 counts tokens or pooled groups of four. Qwen3.8-Flash-Next and GLM-5.3-Flash both received their weights on August 26th, 2026, by their repositories’ commit histories (read again October 3rd, 2026); the GLM-4.7-Flash checkpoint holds 31.2 billion parameters, by the Hub’s count.

[3] DeepSeek-AI, “DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence“, launched April 24th, 2026; the arXiv copy is dated April 26th, 2026. Abstract: “V4-Pro requires only 27% of single-token inference FLOPs and 10% of KV cache” of V3.2; section 1 gives these for “the scenario of 1M-token context”, from “estimated” FLOPs, and gives V4-Flash, a smaller model with fewer layers, as 10% and 7%. Section 4.2.1: “For CSA, we set the compression rate m to 4”; “For HCA, we set the compression rate m′ to 128”; “the window size n_win is set to 128”. The text contains no match for “ablat”. Figure 9, V4-Pro-Max on eight-needle MRCR: 0.92 at 128K and 0.59 at 1024K; Table 6 gives “MRCR 1M” as 83.5 without saying how the two relate. Moonshot’s framing is in the Kimi Linear paper, note 6. Section 4.2.1, on V4-Flash: “For the first two layers, we use pure sliding window attention.” In the layers with a 4-to-1 ratio each compressed entry is built from 8 tokens and neighbouring entries overlap; the 128-to-1 layers do “not perform overlapped compression”. The V4-Flash config lists 21 layers at ratio 4, 20 at 128 and 2 at 0. A search of the report for “RULER” on October 1st, 2026 finds no match.

[4] Config files on Hugging Face, accessed October 1st, 2026: Mistral Medium 3.5-128B (88 layers, no sliding window); Granite 4.2-30b(”Decoder-only Dense Transformer”); K2-Horizon-375B-A23B (61 layers, use_sliding_window false); gpt-oss-120b (18 sliding-window and 18 full-attention layers, window 128); Gemma 4 31B (50 and 10, window 1,024); Inkling (55 and 11, window 512); Muse Glimmer 30B (39 and 13, window 2,048); Nemotron 3 Ultra (48 Mamba-2, 48 MoE and 12 attention blocks); IBM’s Granite 4.0-H-Smallcard: “GQA, Mamba2, MoEs with shared experts”. Olmo Hybrid 7B: “75% of layers use gated DeltaNet heads instead of attention heads.” Microsoft and Ai2 also publish fine-tunes of Qwen models that carry the linear layers.

[5] Tan et al., “The Evolution of Attention in Large Language Models: Mechanisms, Trade-offs, and Emerging Trends“, arXiv 2609.39661, September 30th, 2026; all six authors are at Alibaba Token Hub. “Table 17 shows that Hybrid records increase from none in 2022–2023 to 9 of 25 in 2024–2025 and 17 of 27 in 2026.” The survey counts sliding-window mixes as hybrid and calls its inventory “purposively curated rather than exhaustive”. Of its eleven frontier models: “Hybrid structures are prominent but not universal: K2-Horizon retains full GQA and GLM-5.3 uses a single DSA family”. Its conclusion: “continued coexistence rather than a universal replacement path”.

[6] Moonshot AI, “Kimi Linear: An Expressive, Efficient Attention Architecture“, submitted October 30th, 2025, 16:59 UTC. Table 1: a sweep of five hybrid ratios on a small model, with validation perplexity 5.65 at 3:1, 5.66 at 1:1 and 5.70 at 7:1. Section 5.4: the three models “share the same architecture, parameter count, and training setup for fair comparisons”, at 48 billion parameters, 3 billion active, 1.4 trillion training tokens. Table 5, RULER at 128K: full attention 81.3, Gated DeltaNet hybrid 80.5, Kimi Linear 84.3; full attention is ahead by more than a point on EvalPlus (62.6 against 61.0), LongBench V2 (36.1 against 35.0) and Frames (60.5 against 58.8), and by half a point on LiveBench (45.7 against 45.2) and Long Code Arena Commit (33.2 against 32.7); Kimi Linear with RoPE in its full-attention layers scores 78.8 on RULER. Abstract: “reducing KV cache usage by up to 75% and achieving up to 6× decoding throughput for a 1M context”. Section 6.3: “a theoretical decoding speedup of up to 6.3×”; at batch size 1, “a 2.3× speedup at a 1M token context”. A later run of the released model: “Kimi Linear@5.7T obtains a score of 94.8 on RULER at 1M context length”, with no full-attention model tested at that length. Author’s calculation from the Kimi Linear config in note 2: 20 ÷ 27 ≈ 0.741.

[7] DeepSeek, “DeepSeek-V3.2-Exp Release“, September 29th, 2025: “DeepSeek API prices drop 50%+, effective immediately”; the price card reads “$0.56 → $0.28 cache miss” and “Output $1.68 → $0.42”. The archived pricing page shows $0.56 and $1.68 on September 22nd and $0.28 and $0.42 on September 29th. Kimi K3: Moonshot’s pricing page, last modified September 28th, 2026, lists input $3.00, cached input $0.30 and output $15.00 per million tokens. Moonshot’s launch post: “the official Kimi API achieves a cache hit rate above 90% in coding workloads.” The post gives no method or denominator for that figure, and the technical report gives no hit rate (both read October 1st, 2026). OpenRouter’s endpoint list for Kimi K3, read October 3rd, 2026: 24 endpoints, all with a cache-read price below the input price, 21 of them at 20% of it or less and 17 at 10%. DeepSeek’s pricing page, read October 1st, 2026: DeepSeek-V4-Pro-0813, input on a cache miss $1.32 per million tokens at peak and $0.66 off peak, output $3.96 and $1.98.

[8] Searched on October 1st, 2026 for “export”, “sanction”, “HBM”, “memory price” and “shortage” in the DeepSeek V4 report (note 3), the Kimi K3 technical report, and the Kimi K3, GLM-5.3-Flash and Qwen3.8 model cards: no match in that sense. Z.AI, “GLM-5.3-Flash“, August 26th, 2026: “with all of this traffic served on Chinese AI chips”; “These chips are primarily constrained by memory capacity and bandwidth, especially when supporting context lengths of up to one million tokens.”

[9] Julien Simon on YouTube: “Decoder-only inference: a step-by-step deep dive“, January 10th, 2025 (self-attention, the KV cache, multi-head and latent attention); “Deep dive - Better Attention layers for Transformer models“, February 12th, 2024 (grouped-query and sliding-window attention); “Deep Dive: Optimizing LLM inference“, March 11th, 2024 (the KV cache in serving).

[10] DeepSeek-AI, “DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model“, May 7th, 2024. Table 8: MMLU 41.2 with grouped-query attention in 8 groups against 45.2 with multi-head attention, on 7-billion-parameter models. Table 9: latent attention against multi-head attention on two model sizes, with a cache of “14% for small MoE models and 4% for large MoE models”; the one loss in eight cells is C-Eval on the small model. The cache per token is the 512-number latent plus a 64-number positional key. On inference: “we even do not need to compute keys and values out for attention.” Grouped-query attention: Ainslie et al., “GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpoints“, submitted May 22nd, 2023.

[11] Tri Dao and Albert Gu, “Transformers are SSMs: Generalized Models and Efficient Algorithms Through Structured State Space Duality“, May 31st, 2024. Section 10.1, comparing Mamba-2 with the first Mamba: “trades off this expressivity for improved hardware efficiency (and ease of implementation)”. Section 9.3: “can exploit specialized matrix multiplication (matmul) units on GPUs, also known as tensor cores.” Table 3: Transformer++ 60.2, Mamba-2 60.2, Mamba-2 with 6 attention layers 61.0. Section 9.2.3: “having around 10% of the total number of layers being attention performs best.” The hybrid comparison is run “at the 2.7B scale (64 layers)”.

[12] Songlin Yang, Jan Kautz and Ali Hatamizadeh, “Gated Delta Networks: Improving Mamba2 with Delta Rule“, December 9th, 2024; affiliations MIT CSAIL, NVIDIA and NVIDIA; footnote: “Work done during SY’s internship at NVIDIA.” On DeltaNet: “a hardware-efficient chunkwise algorithm for DeltaNet that leverages matmuls, enabling tensor core based GPU optimization”; on Gated DeltaNet: “we can adapt DeltaNet’s chunkwise algorithm (Eq. 8-9) for Gated DeltaNet to enable hardware-efficient training”. Table 4, inputs truncated to 2,000 tokens: Gated DeltaNet 30.6, Transformer++ 37.0, the two hybrids 39.0 and 40.1; the first hybrid combines the layer with sliding-window attention; the second also stacks Mamba2 layers. Independent measurement of the same layer: Moonshot’s Table 5 (note 6), where the Gated DeltaNet hybrid scores 80.5 against full attention’s 81.3 at 128K. Z.AI’s GLM-5 report measured a larger loss on a converted model and attributes it to “the unavoidable information loss introduced by efficient attention mechanisms during continual-training adaptation”. Table 4, “input truncated to 2K tokens”, averages six tasks (SWDE, SQuAD, FDA, TriviaQA, NQ and Drop); the gap is widest on FDA, 23.7 against 52.2, and the pure layer leads on TriviaQA, 60.0 against 58.3.

[13] DeepSeek-AI, “DeepSeek-V3.2“, December 2nd, 2025: “select 2048 key-value tokens for each query token”; the paper claims that sparse attention “reduces the core attention complexity of the main model from O(L²) to O(Lk)” and makes no claim about cache size. The V3.2-Exp model card, released September 29th, 2025, prints 14 benchmarks against V3.1-Terminus; the count of 7 higher, 6 lower and 1 level is mine. The sparse model was built by continued training from the V3.1-Terminus checkpoint : 2.1 billion tokens to warm up the indexer, then 943.7 billion tokens of sparse training. On the indexer: “Although the lightning indexer still has a complexity of O(L²), it requires much less computation compared with MLA in DeepSeek-V3.1-Terminus.”

[14] MiniMax, “Why Did MiniMax M2 End Up as a Full Attention Model?“, Hugging Face, October 30th, 2025. MiniMax, “The MiniMax-M2 Series: Mini Activations Unleashing Max Real-World Intelligence“, arXiv 2605.26494, May 26th, 2026, Table 2, full attention against hybrid sliding-window attention: RULER 32K CWE 99.0 and 99.0; RULER 128K CWE 90.0 and 72.0; MMLU 85.5 and 85.6. CWE is RULER’s common-words-extraction task, an aggregation task. The report does not state the size of the two models compared. “we found no variant that reliably matches full attention quality in production settings spanning reasoning, coding, and agent tasks.” The sliding-window models were conversions: “continuing pre-training for hundreds of billions to trillions of tokens across multiple configurations”. The report cites sliding-window attention to “Beltagy et al., 2020”. The blog post: “efficient attention still has some way to go before it can definitively beat full attention”. The report describes the comparison as being “at the M2 architecture scale”.

[15] Zhipu AI and Tsinghua University, “GLM-5: from Vibe Coding to Agentic Engineering“, arXiv 2602.15763, February 17th, 2026. Table 5, RULER at 128K on a 9-billion-parameter model: full attention 75.28, Gated DeltaNet variant 64.00. “Nevertheless, all of these methods incur an inherent accuracy gap on fine-grained retrieval tasks—up to 5.69 points on RULER@128K and 7.33 on RepoQA@128K—due to the unavoidable information loss introduced by efficient attention mechanisms during continual-training adaptation, even when half of the layers retain full attention.” The report tests no linear layers trained from scratch (read October 1st, 2026). “DSA is lossless by construction”; Table 6, RULER at 128K: GLM-4.7-Flash 79.21, the same model with sparse attention 78.86. Table 3, “Comparison of long-context benchmarks between MLA and DSA base models”, at 128K, dense parent against sparse: MQ-NIAH 100.0 and 100.0; MV-NIAH 95.5 and 97.0; SQuAD 79.7 and 86.0; HotpotQA 66.3 and 63.0. The table does not label the models’ size; the text says “The DSA training begins from the base model at the end of mid-training”, and the report puts GLM-5 at 744B parameters. Neither Z.AI nor MiniMax prints error bars on these long-context tables. Sparse attention’s largest gain in MiniMax’s Table 3 is on in-context learning, 72.80 against 70.40. MiniMax, “MiniMax Sparse Attention“, arXiv 2606.13392, June 11th, 2026, Table 3 at 128K, full attention against the same checkpoint converted to sparse attention (MSA-CPT): RULER 72.00 and 72.12; reranking 34.60 and 32.50; word-frequency tasks 46.35 and 45.00; question answering 47.80 and 46.80; variable tracking 97.80 and 96.80; needle retrieval 96.63 and 98.87. Conclusion: “closing the residual long-context retrieval gap”. The MiniMax test model has “approximately 109B total parameters and 6B activated parameters per token”. GLM-5, section 5, “Adapting GLM-5 to Chinese Chip Infrastructure”: “seven mainstream Chinese chip platforms, including Huawei Ascend, Moore Threads, Hygon, Cambricon, Kunlunxin, MetaX, and Enflame”. In Table 5 the linear variant converts half the layers (”even when half of the layers retain full attention”). MiniMax presents the sparse design as the one behind MiniMax-M3. Table 5 is built on a 9-billion-parameter model: “We continually train each method on 190B tokens with a 64K context length, maintaining a 1:1 ratio”. Its Gated DeltaNet row reads 64.00 against 75.28, a gap of 11.28; the “up to 5.69 points” in the quoted sentence is the gap of the best sliding-window variant.

[16] Zhu et al., “Periodic Weak Spots: Phase Sensitivity from Chunked KV-Cache Compression“, ByteDance Seed, September 28th, 2026: on DeepSeek-V4.1-Flash at 128,000 tokens, “a mean accuracy of 92.38% and a best–worst residue gap of 6.09 percentage points.” The paper’s 40-point gap is on a base checkpoint, not on the released model. DeepSeek-AI, “DeepSeek-V4.1-Flash“, September 17th, 2026: “the newly introduced architectural changes also create robustness boundaries that have yet to be fully characterized.” Zhu et al., Table 7, DeepSeek-V4.1-Flash by residue: even 95.00, 95.12, 94.69 and 95.31; odd 89.22, 89.69, 90.31 and 89.73; best minus worst 6.09. Author’s calculation: (95.00 + 95.12 + 94.69 + 95.31) ÷ 4 ≈ 95.03. Author’s calculation: (89.22 + 89.69 + 90.31 + 89.73) ÷ 4 ≈ 89.74. Zhu et al. on positions: “all four of its even residue groups remain above all four odd ones”.

[17] Z.AI, “GLM-5.3-Flash: Frontier Intelligence, Flash Cost“, August 26th, 2026: “we compare the per-token compute and KV cache size of GLM-5.3-Flash against GLM-5.3 and two recent open models: DeepSeek-V4-Flash and Kimi-K3.” Searched October 1st, 2026: the post contains “Kimi” twice and “DeepSeek” six times, as comparison models, and “KDA” and “Moonshot” not at all; it contains “preserving precise long-context capabilities” and none of “RULER”, “MRCR”, “LongBench”, “HELMET”, “RepoQA” or “needle”; the model card and API docs were read for the same terms as captured on October 1st. The config lists its linear layers as kda_layers and its sparse layers as deepseek_sparse_attention. Moonshot’s Kimi Linear and FlashKDA and DeepSeek’s V3.2-Exp are all published under the MIT licence.

[18] Alibaba, “On the Design of Qwen3.8-Next Architecture: Evaluation, Efficiency, and Training Stability“, August 26th, 2026. Table 1, three 28-layer, 25-billion-parameter models with 3 billion active, on nine benchmarks: full attention 49.87, sliding-window hybrid 51.15, Gated DeltaNet hybrid 53.81; “The GDN hybrid improves over the Transformer on eight of the nine selected benchmarks”; the ninth is EvalPlus, 49.71 against 51.01 for full attention; “they do not by themselves isolate which architectural component causes each improvement.” Table 3, the shipped model with its fourth layer as full attention against sparse attention: eight-needle MRCR at 128K 97.14 and 95.98; at 256K 94.20 and 93.00; at 512K 30.66 and 40.53; at 1M 20.71 and 26.44; RULER from 512K to 1M 90.08 and 93.00. The eight-needle test is OpenAI’s MRCR: “2, 4, or 8 identical asks”, and “the model is ultimately prompted to return the i-th instance”. RULER: Hsieh et al., “RULER: What’s the Real Context Size of Your Long-Context Language Models?“, 13 tasks, with “new task categories multi-hop tracing and aggregation to test behaviors beyond searching from context”. The shipped model: “Qwen3.8-Flash-Next is a sparse mixture-of-experts model with 125B total parameters, 6B activated per token”. Table 3, “Full Attn” against “w/ QSA” on the same model. RULER: 99.84 and 99.89 up to 128K, 99.81 and 99.62 to 256K, 97.65 and 98.95 to 512K, 90.08 and 93.00 to 1M. Eight-needle MRCR: 97.14 and 95.98 at 128K, 94.20 and 93.00 at 256K, 30.66 and 40.53 at 512K, 20.71 and 26.44 at 1M.

[19] DeepSeek, “DeepSeek-V4 Preview Release“, April 24th, 2026: “Novel Attention: Token-wise compression + DSA (DeepSeek Sparse Attention).” Moonshot’s launch post names Kimi Delta Attention.

[20] The ten comparisons are in notes 14 (MiniMax, sliding windows), 6 (Moonshot), 13 (DeepSeek), 15 (Z.AI three times, and MiniMax, sparse) and 18 (Alibaba, two), plus Ai2: Merrill et al., “Olmo Hybrid“, arXiv 2604.03444, submitted April 3rd, 2026, and announced on Ai2’s blog on March 5th, 2026. Table 3, RULER at 4K and at 64K: Olmo 3 with YaRN 95.8 and 70.9, Olmo Hybrid with YaRN 92.8 and 76.9, with DroPE 92.2 and 85.0; the baseline already used sliding-window attention in 75% of its layers (”we replace the sliding-window attention (SWA) layers (75% of layers) from Olmo 3”). Ai2’s own framing: “a controlled comparison between transformer and modern hybrid LMs is lacking at large scale.” Ai2 published the weights, code, training logs and data. Searched October 1st, 2026: the Kimi K3 technical report contains no comparison with a full-attention model (”ablat” matches twice, on the vision tower and on data sampling; “RULER” and “MRCR” do not appear); the DeepSeek V4 report has no match for “ablat” (note 3); the Qwen3.8-2.4T model card has no comparison or ablation; Z.AI’s GLM-5.3-Flash post has none (note 17).

[21] Zhang et al., “Positional Failures in Long-Context LLMs: A Blind Spot in Reasoning Benchmarks“, Beijing Jiaotong University, May 22nd, 2026: an audit of DeepSeek-V4-Pro, MiMo-V2.5-Pro, Kimi-K2.6 and GLM-5.1 against 19 benchmarks. Seven long-context benchmarks (NIAH, RULER, LongBench, HELMET, InfiniteBench, BABILong, LOFT) across four releases: 0 of 28 in a main results table. Seven agent and coding benchmarks: 20 of 28. MRCR, which DeepSeek’s Table 6 does print, is not among the seven.

[22] Dates from GitHub, accessed October 1st, 2026; the day counts are mine, from Qwen3-Next’s release on September 11th, 2025 (weights uploaded September 9th, card and config published September 11th, by the Hub’s commit history), Kimi Linear’s on October 30th, 2025 (to FlashKDA’s first commit on April 21st, 2026) and DeepSeek-V3.2-Exp’s on September 29th, 2025. DeepSeek’s V3.2-Exp model card has a section “Open-Source Kernels” pointing to its own CUDA kernels. vLLM #24518, September 2025: the kernels “are adapted from” the open-source flash-linear-attention library. FlashInfer #2276, by an NVIDIA engineer, merged January 3rd, 2026: “implementation for Gated Delta Rule (or Gated Delta Net) on Hopper architecture”; it covers prefill, and a decode kernel came in a later pull request. MoonshotAI/FlashKDA, created April 20th, 2026; its H20 benchmark came with the first commit, on April 21st, and was updated April 22nd; its GB200 benchmark was added May 26th (GitHub API, read October 3rd, 2026). vLLM #26670, merged November 20th, 2025: “The PR add Deepseek v3.2 support on ROCm platforms.”; it reports an accuracy score and no throughput. vLLM, “Day 0 Support for Qwen3.8-2.4T-A95B on vLLM“, August 12th, 2026. vLLM on Qwen3.8: “NVIDIA and Inferact co-developed ultra-fast kernels for Linear Attention (Gated Delta Rule)”.

[23] DeepSeek V4 report (note 3), section 3.1. DeepSeek, FlashMLA README, commit of September 30th, 2026: “In the 2026.09.30 release, we removed support for the Hopper architecture and for earlier models (including DeepSeek V3 / V3.2 / V4.0)”; “We’ve released sparse attention prefill and decoding kernels for the Huawei Ascend 950 NPU”; requirements “NVIDIA SM100 / SM103 GPU”; Hopper users are told to “switch to” an earlier commit. The V4 report says only that one kernel scheme was validated “on both NVIDIA GPUs and HUAWEI Ascend NPUs platforms”. The report’s words: “some proposals to hardware vendors, in the hope of aiding efficient hardware design and achieving better software-hardware co-design”; the first proposal is headed “Computation-Communication Ratio”. Read October 1st, 2026. NVIDIA lists the H20 among its Hopper Architecture vGPU Types, and its CUDA GPUs page gives compute capability 10.0 for the B200 and GB200 and 10.3 for the B300 and GB300, the Blackwell parts (both read October 3rd, 2026).

[24] Etched, “Announcing Etched“, June 25th, 2024, archived the same day. etched.com, read October 1st, 2026: “We’re building a new category of AI hardware: frontier inference clusters.”; the page contains neither “transformer” nor “Sohu”. “The Model Is the Machine“, The AI Realist, August 9th, 2026. Taalas describes its product as “a hard-wired Llama 3.1 8B“; AMD announced an agreement to acquire Taalas on August 6th, 2026. Etched, June 2024: “If transformers are replaced by SSMs, RWKV, or any new architecture, our chips will be useless.”

[25] “The Cache Is the Price“, The AI Realist, September 8th, 2026.

[26] Liu et al., “Just Let Linear States Forget the Distant Past: Prefix Caching via SuffixReplay for Hybrid LLMs“, arXiv 2609.33477, China Telecom, September 27th, 2026: “in Qwen3.5-4B, one linear-attention state checkpoint is approximately 49 MiB, whereas the KV cache for one token is only about 32 KiB”. Kimi K3 technical report, section 5.4.1. 49 MiB is 1,568 times 32 KiB. Moonshot’s Kimi K3 technical report: “At such a coarse granularity caching is nearly useless: requests shorter than one block can never be reused”.

[27] vLLM, “Kimi K3 Is Here“, July 27th, 2026: “Prefix caching is typically enabled by default in vLLM, but it is currently disabled by default for Kimi K3 while the hybrid-cache design continues to evolve.” The v0.28.0 release notes, August 26th, 2026: “prefix caching enabled by default for Mamba models”. vLLM, “Kimi K3 Performance Optimizations in vLLM“, September 13th, 2026: “Prefix caching was disabled in both runs because v0.27.1 had a known Kimi K3 prefix-caching issue fixed later”; the 2.8 times is the concurrency-16 row, 258.3 to 725.0 tokens per second. LMCache, “Hybrid models“, read October 1st, 2026: “Generation is not bit-exact between a cached and a fresh run: GDN backends do not support vLLM’s batch-invariant mode.” vLLM #42960: “VLLM batch_invariant mode is not supported for GDN_ATTN.”; still the case in v0.30.0. No hit rate for Kimi K3 appears in either vLLM post, in LMCache’s documentation or in SuffixReplay (read October 1st, 2026). Independent confirmation that reuse is tied to saved positions: SuffixReplay and Moonshot’s report, both in note 26. The LMCache sentence in full: “Generation is not bit-exact between a cached and a fresh run: GDN backends do not support vLLM’s batch-invariant mode.”

[28] GitHub issues, read with their full threads on October 1st, 2026. vLLM #50249, July 29th, 2026, Kimi K3 on A100. SGLang #38846, September 10th, 2026, on v0.5.19: “max_running_requests is capped to 9 by the mamba state cache”. vLLM #55196, September 3rd, 2026: one hybrid, Falcon-H1-1.5B, computed from vLLM’s capacity functions and not measured in a run; “1.84x at 32k context and 1.00x (no gain) at short context”. The cases left out include vLLM #42876, closed in August 2026, and llama.cpp #29092, which reproduces only with the build bundled in Ollama. In vLLM #50249: “no kernel image is available for execution on the device”, and the maintainer’s reply, “K3 doesn’t support Ampere yet.”

On September 24th, 2026, Bloomberg reported that Oracle had sent a force majeure notice to Stack Infrastructure, the Blue Owl company building Project Jupiter, a 2.45-gigawatt Stargate campus in the New Mexico desert [1]. Reuters had its own source and the same reason: “potential delays in securing power for the project” [1]. Force majeure is the clause companies invoke, in Reuters’s words, when “problems arise beyond their control”: war, flood, the occasional act of God. I read Oracle’s filings from this summer. Power was in the risk factors.

Oracle told CNBC: “Project Jupiter remains on our planned schedule.” Blue Owl told CNBC: “This notice does not change the financial commitments to this multi-year project” [1]. So a notice nobody will describe, about a delay nobody admits, changes nothing. Officially.

God, in chronological order

On March 20th, New Mexico’s land commissioner refused to let the campus’s gas pipeline cross state trust land [2]. On April 13th, federal staff protested the pipeline because Transwestern, its builder, had not filed a historic-preservation finding [2]. On April 27th, Oracle announced fuel cells for Jupiter and wrote that “construction continues to move forward on schedule”, adding that “Oracle will continue to bear all energy costs for Project Jupiter” [3]. On June 22nd, its annual report told investors: “We have faced, and may continue to face, challenges with securing reliable and cost-effective power sources” [4]. On July 14th, the commissioner said no again: “Advancing the massive use of gas for a project of this scale is simply not in the best interest of the trust” [2]. The finding had not been filed by the deadline, and on July 24th the federal regulator took the pipeline off its fast track, with other agencies’ decisions under federal authority due by December 3rd [2]. On September 10th, asked about potential delays in New Mexico and Wisconsin, Oracle’s co-chief executive Clay Magouyrk said that a plan relying on “100% achievement of every one of their deliverables” is “called a bad plan”, and that the data center was “definitely on track” [5]. Two weeks later: force majeure.

A government saying no is the kind of event many force majeure clauses list, and nobody outside the deal has read this one. But Reuters’s source adds a detail: “securing power for the site is Oracle’s responsibility under the contract” [6]. If the event is the land office’s refusal, which no one has confirmed, then the act of God is a letter from a land commissioner about a job that the contract reportedly gives to Oracle, a risk Oracle disclosed in its annual report. God, it turns out, has letterhead.

What the notice buys

According to the same Reuters source, Blue Owl has about $3 billion of equity in Jupiter, earns 9% on it while the campus is being built and expects about 11% once it is finished, and force majeure “extends the period during which it pays Blue Owl the lower development-stage rent” [6]. Oracle, by the same account, is responsible for the debt costs and “cannot terminate the lease under any circumstances” [6]. The two points of yield on Blue Owl’s equity come to about $60 million, deferred rather than lost, for each year of delay, or less than five hours of what Oracle spent on capex last quarter [6][7]. The act of God comes with a payment plan.

If you lend to data centers, look at the $288 billion in Oracle leases that have not yet started, “generally expected to commence between the second quarter of fiscal 2027 and fiscal 2029 and for terms of fifteen to nineteen years” [7]. Nobody outside those deals has read their clauses. The notice shows how this tenant reads one. Two questions for the next lease: does the clause exclude risks the tenant has already disclosed, and who carries the power obligation?

We said so, mostly

In “Cloud vs. Clout” we wrote that “Oracle is shifting capital risk to its counterparties” [8]. In “Welcome to Hotel Abilene” we argued that nobody in the Stargate web could check out. We had the direction wrong: the tenant is the one invoking the clause, and the landlord is the one waiting. In May, “The $500 Billion Umbrella” set a test for any Stargate deal: “a site under construction, a power purchase agreement in force, and a builder whose balance sheet can finish the job. Anything less is a press release” [8]. Jupiter has the site. Its power has a fuel-cell announcement from April 27th and a gas line the state refused and then refused to reconsider.

On February 1st, Oracle said it did “not expect to issue additional bonds during calendar year 2026”, a plan that “reflects Oracle’s commitment to maintaining an investment-grade rating” [9]. The same document put about half the money into equity, and Oracle delivered $5 billion in mandatory convertible preferred that week and $19.9 billion in stock over the summer [10]. S&P cut it to BBB-, one notch above junk, on July 9th [11]. The plan was kept. So was the investment-grade rating, by one notch.

The bill comes back

Oracle’s pricing sheets show what it paid over Treasuries at each bond sale since January 2025 [9]:

Ten-year: 97 basis points to 145. Thirty-year: 122 to 180. That last bond, the 2056 note, has not held up: on September 28th, Bloomberg data reported by ZeroHedge showed it at 82.4 cents on the dollar and 273 basis points over Treasuries, compared with 180 at pricing [12]. Oracle’s five-year protection cost about 200 basis points in late July, compared with about 93 for Meta and about 53 for the investment-grade index [13], and reached a record of about 227 in the week of the notice [13]. In fairness, that was when the ten-year Treasury yield hit a 19-year high, and every hyperscaler’s spreads widened [13]. Oracle just widened from a higher floor.

Has anyone climbed out of a spread like this? Boeing, whose default swaps hit 488 basis points in March 2020, a price Bloomberg read as 31% odds of default within five years, is still rated investment grade by all three agencies [14]. Others did not: Enron was downgraded to junk status four days before it filed for bankruptcy, and Lehman remained in the A category until it failed [14]. Oracle’s exposure is in its filings. My read: that is the kind of problem a company pays for rather than dies of, and the payment is the chart above.

S&P already adds Oracle’s $260 billion of lease commitments to the debt in its forecast, puts leverage “in the mid-4x area in fiscal 2027”, and says it could cut again if it expects Oracle “to sustain leverage exceeding 4.5x” [11]. The forecast sits at the edge of the trigger.

Oracle’s own annual report says a downgrade could “affect the terms or availability of certain long-term commitments (including data center leases)” [15]. One more S&P notch would not, by itself, push Oracle’s bonds out of the main index, which uses the middle of three ratings: Moody’s (Baa2, negative) and Fitch (BBB) each sat two notches above junk at Oracle’s last bond sale [16].

But every notch raises the price of the next dollar, and Oracle needs a lot of dollars, as do landlords like Jupiter’s, who borrow against its name. The Financial Times reports Jupiter’s loans quoted at 89 to 91 cents on the dollar [17]. At those prices, the roughly $18 billion banks reportedly lent would be marked $1.6 billion to $2 billion below par, by my calculation [17].

So the notice moves risk. A few tens of millions a year of it is deferred on Blue Owl’s equity. The rest, over time, lands on Oracle’s credit: Oracle will pay for it in new-issue spreads when it next borrows, and whoever lends to it bears the risk.

Oracle’s case

Michael Egbert, an Oracle vice president, wrote to The Santa Fe New Mexican that “force-majeure notices are commonplace in developments of this scale and are often used to preserve contractual rights among project partners,” and that they “do not, by themselves, establish a project delay or change delivery expectations” [18]. That is true of many notices: a tenant facing a permit fight it does not control is doing what counsel advises. And no, Larry Ellison’s pledged shares are a separate matter: Oracle’s proxy says those loans fund only “outside personal business ventures” [19].

What would prove me wrong

Two dates and a sentence, all public. New Mexico’s decision on the fuel-cell air permit, due by November 23rd; other agencies’ pipeline decisions under federal authority, due by December 3rd [2]; and Oracle or Blue Owl saying on the record that Jupiter’s lease has started on time. If all three go Jupiter’s way, the notice was mostly paperwork, and I will say so.

Until then, the act of God has a letterhead and a docket number: CP26-80.

Notes

[1] Bloomberg, “Oracle Cites Force Majeure to Shield Itself on Big Data Center“, September 24th, 2026, citing “people familiar with the situation”. Independent report: Reuters, same day, via KSL: “Oracle issued a “force majeure” notice to a Blue Owl unit … citing potential delays in securing power for the project, a person familiar with the matter told Reuters”. Blue Owl, per Reuters, “owns the data-center developer Stack Infrastructure”. CNBC “confirmed” the recipient was a Blue Owl unit. Company statements to CNBC, September 24th, 2026. Neither company has confirmed the notice on the record; Blue Owl’s statement refers to “this notice”. Reported, not confirmed. Captured: sources/2026-09-24-oracle-force-majeure-project-jupiter-blue-owl.md.

[2] New Mexico State Land Office, letter of July 14th, 2026 denying reconsideration (first denial by letters of March 20th, 2026), and press release of July 15th, 2026. Federal Energy Regulatory Commission, docket CP26-80-000, Federal Register, July 29th, 2026: the prior notice request “will proceed as an application for case-specific authorization”; “90-day Federal Authorization Decision Deadline--December 3, 2026”. Same notice: “On April 13, 2026, Commission staff protested the prior notice request because Transwestern did not provide a copy of a finding by the New Mexico State Historic Preservation Office”; “Transwestern did not file the documentation by the deadline (or subsequently)”. NMED air permit deadline of November 23rd per TechCrunch.

[3] Oracle, “Oracle, BorderPlex and Bloom Energy to Power Project Jupiter with Cleaner, Water-Efficient Fuel Cell Technology“, April 27th, 2026: “Construction continues to move forward on schedule.”; “Oracle will continue to bear all energy costs for Project Jupiter”.

[4] Oracle Corporation, Form 10-K for fiscal 2026, filed June 22nd, 2026, risk factors: “we depend on third parties to develop and deliver certain data center capacity and related infrastructure, and their inability to obtain financing, complete construction on schedule or manage construction cost overruns could delay the availability of data center space or increase our costs. We have faced, and may continue to face, challenges with securing reliable and cost-effective power sources”. Neither the 10-K nor the 10-Q mentions force majeure, Jupiter or New Mexico.

[5] Oracle co-chief executive Clay Magouyrk on the September 10th, 2026 earnings call, as reported by the Albuquerque Journal, September 24th, 2026: “anyone that’s been in the business of doing construction or large-scale infrastructure development, if their plan relies on 100% achievement of every one of their deliverables, we have a term for that: It’s called a bad plan.” “We’re making very good progress in terms of construction, (the) data center is definitely on track.” The Journal: “Pressed by an analyst about potential data center delays in New Mexico and Wisconsin”. Same passage in the call transcript (Motley Fool, machine-style): “we do not assume 100% of everything is going to work all the time. And we have backup options for those things”; “We are going through the process of acquiring our air permit.”

[6] Reuters via KSL, September 24th, 2026, one person familiar with the matter: “The source said that securing power for the site is Oracle’s responsibility under the contract. Oracle cannot terminate the lease under any circumstances”; “with Oracle responsible for paying the debt costs”; “During the development stage, Blue Owl earns a 9% yield on its equity … upon completion of the project, the levered yield is expected to be around 11%. By invoking force majeure, Oracle extends the period during which it pays Blue Owl the lower development-stage rent.” “Blue Owl will still receive the higher rent for the originally planned duration, but its start will be delayed.” Force majeure, per Reuters, is invoked “when problems arise beyond their control”. William Blair, in the same Reuters report: “fiscal 2027 should not be affected, since Jupiter contributes no revenue this year.” Reported, not confirmed. Two points of yield on the equity, in billions of dollars a year. Author’s calculation: 0.02 × 3 = 0.06. Hours of last quarter’s capex (quarter of 92 days). Author’s calculation: 0.06 ÷ 28.499 × 92 × 24 ≈ 4.6.

[7] Oracle Corporation, Form 10-Q for the quarter ended August 31st, 2026, filed September 11th, 2026: “As of August 31, 2026, we had $288 billion of additional lease commitments, substantially all related to data center arrangements, that are generally expected to commence between the second quarter of fiscal 2027 and fiscal 2029 and for terms of fifteen to nineteen years that were not reflected on our condensed consolidated balance sheets”. Capital expenditures of $28.5 billion in the quarter. The same commitments stood at $260 billion three months earlier: Oracle 10-K for fiscal 2026, “As of May 31, 2026, we had $260 billion of additional lease commitments”. Captured: sources/2026-09-11-oracle-q1-fy27-10q-288bn-uncommenced-leases.md.

[8] The AI Realist: “Cloud vs. Clout“, March 11th, 2026; “Welcome to Hotel Abilene“, March 8th, 2026; “The $500 Billion Umbrella“, May 6th, 2026.

[9] Oracle pricing term sheets on EDGAR: January 30th, 2025 (5.500% notes due 2035 at +97 basis points; 6.000% due 2055 at +122), September 24th, 2025 (5.200% due 2035 at +105; 5.950% due 2055 at +125), February 2nd, 2026 (5.700% due 2036 at +145; 6.700% due 2056 at +180). Chart data: data/oracle-issue-spreads.csv. Funding plan, free writing prospectus of February 1st, 2026: “Oracle does not expect to issue additional bonds during calendar year 2026 beyond this transaction.”; “This funding plan reflects Oracle’s commitment to maintaining an investment-grade rating”; “On the equity side, Oracle plans to raise approximately half of its 2026 funding through a combination of equity-linked and common equity issuances.”

[10] Oracle 10-Q (note 7): “During the first quarter ended August 31, 2026, we fully utilized the ATM Program and issued 141 million shares of common stock under the ATM Program for net proceeds of $19.9 billion.” Mandatory convertible preferred: free writing prospectus, February 2026, 100 million depositary shares at $50.00.

[11] S&P Global Ratings, “Oracle Corp. Downgraded To ‘BBB-/A-3’ From ‘BBB/A-2’ On Rising Business Risk And Weaker Cash Flow; Outlook Stable“, July 9th, 2026 (read in full by the main session, 2026-09-28): “We adjust the debt in our forecast to include Oracle’s $260 billion of additional lease commitments (which are expected to commence between fiscal 2027 and 2029)”; “We forecast S&P Global Ratings-adjusted leverage will reach the mid-4x area in fiscal 2027”; “We could lower the rating again if we: Expect Oracle to sustain leverage exceeding 4.5x”. Independent report of the same trigger: Reuters, “Oracle Corp goes for high-stakes ratings gamble in AI strategy“, August 4th, 2026, S&P analyst Andrew Chang: “We could downgrade Oracle if Oracle sustains leverage exceeding 4.5 times.”

[12] Bloomberg terminal data for “ORCL 6.7 02/04/56” (Oracle’s 6.700% notes due 2056, the February 2nd, 2026 tranche in note 9), as posted by ZeroHedge on X, September 28th, 2026, 15:12 UTC: “Last Price 82.386”; “Yield To Maturity 8.310”; “G-Spread 273.315”; same screen, “ORCLCP 5 Year CDS 237.065”. Screenshot saved as data/zh-2026-09-28.jpg. Market data relayed by a secondary outlet; reported, not independently confirmed by the desk.

[13] Late July: S&P Global Market Intelligence data cited by Reuters, relayed by GuruFocus on Yahoo Finance, July 29th, 2026: Oracle “near 200 basis points”; Meta about 93; investment-grade index about 53. Week of the notice: Seeking Alpha via TradingView: “Its 5-year CDS spread rose 16.2% from the prior week across both bid and ask quotes, reaching a record 227.15 bps”; the same report on “the 30-year yield climbing to its highest level since 2004 and the 10-year yield hitting a fresh 19-year high”.

[14] Enron: US Senate Committee on Governmental Affairs, staff report, October 8th, 2002: “On November 28, 2001, Enron’s credit rating was reduced from investment grade to junk… On December 2, Enron declared bankruptcy.” Lehman: Flannery, Houston and Partnoy, “CDS Spreads as Viable Substitutes for Credit Ratings“, University of Pennsylvania Law Review 158 (2010): “Bear Stearns and Lehman Brothers remained in the A category through the sample period until both firms failed in March and September 2008, respectively.” Boeing: Bloomberg via Fortune, March 18th, 2020: “Five-year contracts climbed to 465 after rising as high as 488, a record. At that rate, the market is effectively pricing in 31% odds that the planemaker would default”; Boeing’s 10-Q for the quarter ended June 30th, 2026: “We currently maintain investment grade credit ratings across all three credit rating agencies.” A market-implied default probability is risk-neutral and runs above realised default rates: S&P’s historical five-year cumulative default rate for BBB- issuers is 2.40% (S&P, 2024 Annual Global Corporate Default And Rating Transition Study, table 26). Related reading on Oracle’s September filings: Pete Cleary, “Two SEC Filings, Twelve Days“, Filing Insights, September 26th, 2026.

[15] Oracle 10-K for fiscal 2026, risk factors: “A downgrade could also reduce our access to, or increase the cost of, commercial paper or other short-term financing, affect the terms or availability of certain long-term commitments (including data center leases), limit eligibility to contract with certain customers, and increase collateral, letter of credit or other credit support requirements under certain contractual arrangements.”

[16] Bloomberg, US Aggregate Index methodology: “Securities must be rated investment grade (Baa3/BBB-/BBB- or higher) using the middle rating of Moody’s, S&P and Fitch”. Moody’s Baa2 (negative) and Fitch BBB (stable) as printed on Oracle’s February 2nd, 2026 term sheet (note 9) and reported since.

[17] The Financial Times, as reported by Searchlight New Mexico, September 25th, 2026: “being quoted at just 89 to 91 cents on the dollar, according to the Financial Times”. The FT article was not read by the desk. Reported, not confirmed. The roughly $18 billion bank loan: Bloomberg, November 7th, 2025, citing people familiar with the deal; Searchlight’s text: “Oracle’s $18 billion in loans tied to the data center”. Reported, not confirmed. In billions of dollars, at 91 cents. Author’s calculation: 18 × (1 − 0.91) = 1.62. At 89 cents. Author’s calculation: 18 × (1 − 0.89) = 1.98.

[18] Michael Egbert, Oracle vice president, email to The Santa Fe New Mexican, as published by Searchlight New Mexico, September 25th, 2026: “Force-majeure notices are commonplace in developments of this scale and are often used to preserve contractual rights among project partners. They do not, by themselves, establish a project delay or change delivery expectations.” TechCrunch reported that “Neither Oracle nor Blue Owl immediately responded to TechCrunch’s requests for comment.”

[19] Oracle Corporation, Definitive Proxy Statement, filed September 25th, 2026: “As of September 21, 2026, Mr. Ellison … had pledged 413 million shares of Oracle common stock as collateral to secure certain personal indebtedness.”; “The pledged shares secure personal term loans only used to fund outside personal business ventures.”

On June 16th, 2026, Arthur Mensch promised “a very exciting model to come this summer”, open-weight, with early access in July for key partners. Summer ended on September 23rd with no public release.[1] In its last days, on September 21st, Mistral’s own product account posted that GLM-5.3, a model trained by Z.ai in Beijing, was now in Vibe, the product Le Chat became, and “the default in the web app”.[2]

In “Chanson d’automne”, Verlaine wrote that turn of the season: the violins of autumn sob, and the poet goes off “au vent mauvais / Qui m’emporte / Deçà, delà, / Pareil à la / Feuille morte”, on the ill wind that carries him here and there like a dead leaf. A mistral is a wind, the cold north wind of the French Mediterranean.[3] But in this story, Mistral is the leaf, and it goes where the money blows: a frontier lab for its investors, a sovereign supplier for the states that buy it, and, since August, the host of Chinese models, one of them now the default.

Mistral has two kinds of customers. The states whose purchases you can read, Luxembourg and Hesse, bought it without a competitive tender and published the price to the euro. Companies buy it too, Airbus and HSBC among them; they announce the deal, and rarely the price, and no instrument outside their walls can see what they run.[4] Where a free choice can be measured at all, in a survey of German firms, on the Hugging Face download counter and on one developer marketplace, it goes to other models. And the valuation, more than €21 billion as of September 8th, 2026, rests on numbers nobody outside the company and its investors can read.[5]

Les Echos has spent September on a three-part “saga Mistral”, and on the 17th called the company “le champion qui pourrait abandonner la course à l’IA”, the champion that might drop out of the AI race.[6] The story has been told. What follows is the ledger: who pays for Mistral, how much, and who picks it when nobody makes them.

Who bought

On June 17th, 2025, Luxembourg’s state IT center, the CTIE, signed a contract with Mistral AI carrying a published value of €39,500,000. The notice on the EU’s tender platform records one tender received, no duration, and a single award criterion, weighted at 100 percent: “Absence de concurrents pour des raisons techniques”, no competitors for technical reasons. The justification lists five conditions the supplier had to meet simultaneously; taken together, they describe one company.[7]

Six weeks later, on July 28th, Luxembourg’s Direction de la Défense recorded a second award to Mistral, with a published value of €4,880,000, also without a call for competition, coded “technical”, and its only written justification is a single article of the Grand Duchy’s defense-procurement law.[8]

The third is German. On July 2nd, 2026, the Land of Hesse awarded €7,800,000 to Mistral after a documented market exploration and five mandatory requirements, including that the models the vendor trained itself were developed within the European Economic Area or a country with an EU adequacy decision. Hesse also published a voluntary transparency notice 45 days in advance, which is the step that allows a rival to challenge the award. None is on the record. The notice says the absence of competition is not the result of an artificial narrowing of the requirements but of the need as lawfully defined and the market as it stood.[9]

Fourteen months after its first purchase, the Grand Duchy joined Mistral’s cap table in the September 2026 Series D.[10] Nothing in the notices or the funding announcement connects the two, and three different arms of the state were involved.[11]

So that is the buying side: €52.18 million of published contract value, all of it from governments, none of it competed. On the French side, the state that treats Mistral as its national champion has published no award at all: I searched three registers for the company every year. What Les Echos reported on September 2nd, and what the ministry confirmed to Capital, is a €6 million, non-exclusive contract for 2026 and 2027, said to follow a public-procurement procedure; on September 22nd, it was in neither.[12]

What France has published is a defense framework with no amount,[13] and one costing from its own inspectors: about €300,000 a year for 10,000 active users on the state’s Mistral-powered assistant, and about €3 million a year if it went to one or two million, with Mistral named as the current supplier. French defense contracts can be withheld from publication. But the Luxembourg defense award was itself a negotiated defense contract, and Luxembourg published it, so the silence is a choice, or a contract carried under a reseller’s name; the registers cannot say which.

Mensch has put a split on the record, once, from memory. Asked under oath on May 12th what share of revenue public orders represent, he said 20 percent of software revenue, 10 percent for the French state, “de tête”, with compute carved out, and named Luxembourg unprompted as a significant framework customer.[14] No audited figure supports the 80 percent that leaves for private buyers.

Who chose

Bitkom, the German digital industry association, published a representative survey on September 9th, 2026, the day after Mistral announced its €3 billion round. Its research arm interviewed 603 German companies with 20 or more employees; 343 of them use AI, and those 343 form the basis of what follows. Asked which AI applications they use, 76 percent said ChatGPT, 35 percent Microsoft Copilot, 28 percent Gemini, 6 percent SAP’s Joule, 3 percent Claude. Mistral: none, and none the year before either, when the same question was put. The release says so in one sentence: no surveyed company reported using models from “des führenden europäischen Anbieters Mistral”, the leading European provider Mistral.[15]

This instrument measures brand names, not spend, which is why Claude scores 3 percent despite being a large enterprise API business. SAP’s Joule, at 6 percent, is not the clean comparator it looks like either: SAP has resold Mistral since 2024, and a German firm running Mistral through SAP answers “SAP”.[16] Le Chat, now Vibe, is a named end-user assistant, the kind of product a brand question sees best, and it read zero in both waves. And Mistral’s own “125+ global enterprises” is compatible with zero of 343 German firms: a hundred and twenty-five customers worldwide is a rounding error in a national sample.

The second instrument is Hugging Face, where the people who run models pull them. On September 22nd, 2026, I read the platform’s public counter. Mistral’s Apache-2.0 flagship, Mistral Large 3, a 675-billion-parameter mixture-of-experts model released in December 2025, had been downloaded 2,097 times in the past 30 days and 13,457 times in its lifetime. Its four sibling repositories add 11,033 more; counted together, the gap to the comparator below is still 85 to one.[17] The fair comparison is another open model of the same size. DeepSeek-V3, 671 billion parameters, also a mixture of experts, released eleven months earlier in December 2024 and long past any launch spike, had been downloaded 1,118,995 times in the same thirty days, and 21 million times in its life.[18] Same size, both permitting commercial use, same window, same counter. A factor of about 530 on the flagship repository alone.

The counter counts file fetches, so a model pulled once into a company mirror counts once, and it does not see API usage at all. The counters tell you something narrower and, for a company with “open-weight” in the headline of its funding announcement, more awkward: the open flagship is the one almost nobody downloads. The smaller open-weight model, Medium 3.5, released in April under a modified MIT license, drew 89,194 pulls in the same window, forty times the flagship and a thirteenth of DeepSeek-V3.[17]

The third instrument is OpenRouter, the marketplace through which developers route requests to whichever model they choose; it does not see Mistral’s own API. Its chart of token share by the model lab’s country, posted by OpenRouter’s Peter Walker on September 21st, has France holding most of the platform’s tokens in early 2024, when Mistral’s small open models were the thing to run, 5 percent by the end of 2025, and no band wide enough to label since. On the same site’s live ranking of model authors by share of requests, Mistral stands eighth, at 2.6 percent, behind DeepSeek, Google, OpenAI, Z.ai, Qwen, Tencent and Anthropic. “Mistral really did have a moment there,” the post says. Developers with a choice are where the moment was.[19]

The first hour

The fourth instrument is my own hands. On August 17th, 2026, I installed Mistral Vibe, the company’s command-line coding agent, to build a small tool: pull the audio of a YouTube video with yt-dlp, then transcribe it with a Mistral speech model.

I asked Vibe for the transcription flow.[20] It was running Mistral Medium 3.5, the company’s newest general model, in Vibe since May 22nd, 2026. It told me that Mistral has no speech-to-text model, and steered me elsewhere. Voxtral has been public since July 15th, 2025, with two more speech models since then. The company’s own agent, on the company’s own three-month-old model, denied that it existed, and a developer who trusted the answer would have built on a competitor’s API. Training cutoff is not the excuse. The documentation is online, the company publishes an llms.txt index of it for exactly this purpose, and the agent had a web-search tool in that session: it used it four times later in the same session, and not once before telling me the product did not exist. I re-ran the question on September 22nd on the same model, still the CLI’s default, in a single turn with web tools on, and the model gave the same answer: Mistral “does not currently offer a dedicated speech-to-text model”.

The fault is a broken window, not a model-quality problem, and the fix is cheap: an official Mistral documentation server that Vibe consults before it answers a question about Mistral.

What the founding memo said

Mistral’s founding strategic memo, seven pages, from before its first round in the spring of 2023, was published in full by Sifted on June 21st, 2023.[21]

The memo says where the founders thought the money was: “We believe that most of the value in the emerging generative AI market will be located in the hard-to-make technology, i.e., the generative models themselves.” It says what they promised: to become “a research leader in the generative AI field, eventually offering the best technology within 4 years”, which puts the deadline in April 2027.

And it says how they planned to compete: “Training a competitive model requires at least an exa-scale cluster for a few months. We intend to rent such capacity for a full year.” So this was never a plan to win on scale, and the founders said so on page five. It was a plan to win on efficiency: “know-hows that will allow us to gain a factor 10-100 in training efficiency compared to public methods”, so that the team could “train the strongest model for a given computational budget”.[22]

The open-source promise was hedged from the start: “We will balance our open-source strategy with our economic interests, keeping the strongest and most specialized models reserved for negotiated access.” And the route to market was a network, stated plainly: the early investors “will open all necessary doors for acquiring high-quality datasets”, and “the founding team is already organizing business exploration with major French and European industrial actors”.[23] Doors and introductions, in April 2023. Not a drift.

On June 16th, 2026, Arthur Mensch posted on LinkedIn that Mistral had “spent a few percent of the deployment of some of our competitors, in a domain that is fundamentally governed by flops budget”, and that “today, we do not yet own the best language models”.[1] The founding bet was that efficiency would beat a budget; in 2026 the founder wrote that budget governs. I won’t call that a contradiction; a founder is allowed to learn in three years.

What he told whom

On January 14th, 2026, on an American podcast, Mensch agreed with his host that frontier models were commoditizing and gave the reason: “the knowledge unit to actually train a model is fairly short, so because it’s short, it actually circulates.” The word was his host’s; the reasoning was his.[24]

On May 12th, 2026, under oath before a French parliamentary commission of inquiry, he described the value chain the other way up. The high-margin layer, the one that pays for research, “c’est l’intelligence artificielle”, is AI; the rest of cloud services “sont surtout des commodités”, are mostly commodities. In 10,547 words of testimony, the word “commodité”, commodity, appears once, and it points at the cloud, not at the models.[14] His own bridge between the two is on the same podcast, at 23:01: “to get to value, they need to have great models. So the two things are extremely linked together.”[24]

On September 8th, 2026, the funding announcement that raised €3 billion described Mistral as “the only AI company in the world building the full stack”. It is not in any of the nine archived snapshots of the company’s home page from May 2023 to September 2026.[25]

The September 21st post does not say which tiers get the Chinese model; the free tier’s command-line client did not offer it when I looked the next day.[2] Mistral’s newsroom, pricing page, and product page say nothing about it; the model’s own documentation page, dated September 15th, says it is “served without Mistral modifications” and prices it at Z.ai’s own list for input and output.[26]

On September 18th, three days before that post, Juan Branco, a left-wing lawyer and agitator, posted that Mistral lived on public orders pushed by the Élysée and served its clients “des modèles chinois, librement téléchargeables, d’avant dernière génération”, freely downloadable Chinese models of the previous generation. Mistral had announced the Chinese models itself, on August 11th. Its own documentation had made “previous generation” stale on September 15th, and Branco’s rebuttal narrowed it to GLM 5.2 “pendant tout un été”, all summer long, which was true of the model if not of the whole summer.[27] Mensch answered twice on September 20th: “Nos travaux déplaisent à certaines petites frappes”, our work displeases certain small-time thugs, and “c’est un obsessionnel”, the man is obsessive. He contested no figure and no fact, and by September 22nd had deleted both posts. A buyer at Airbus or HSBC reads the same feed, and sees the founder of a €21 billion company, accused in public of living on state orders, answer with an insult rather than the 20 percent he had given the Assemblée under oath in May.

The rolodex, counted

My May piece argued that Mistral was converting a perishable contact list into permanent law. Since then, I have counted the list, and the honest result is smaller than the phrase suggests.

Mistral names 23 investors in its Series D, and CMA CGM’s own release adds a 24th, from 2023.[28] Its customer pages name 42 companies, and partner, compute, and September’s announcements add eleven, for 53 commercial names against a claimed “125+”.[29] Seven names are on both lists: ASML, CMA CGM, Luxembourg, BNP Paribas, Belfius, Nvidia, and Samsung, which led the Series D and announced the next day that it would deploy Mistral Large on premises across its chip operations.[5] Five of the seven are on the customer pages; the other 37 customers there, Airbus, HSBC, Capgemini, and on down the list, have no equity link in any document I read.[30]

So the cap table does not explain the customer list. It explains four of the seven, the ones where a stake is large, or a purchase has a price: Samsung, which led the round, and these three. ASML led the Series C with €1.3 billion for about 11 percent; it is a named customer and a compute anchor; its own audited filing carries the stake at €1,320.7 million, and its announcement prices the commercial side at nothing: an agreement to “explore the use of AI models”.[31] CMA CGM invested in 2023, anchors the compute plan, and published a figure Mistral never has: a five-year partnership “supported by a €100 million investment”, which the group’s releases never split between its own program and what it pays Mistral.[32] And Luxembourg bought twice, without competition, then invested.

Of 56 relationships announced by Mistral or its counterparties, ten have a published value, with eleven figures in total because Microsoft appears twice, and three of the eleven are words rather than numbers. Three are the procurement notices, exact to the euro. Two are equity: ASML’s audited stake and Microsoft’s 2024 convertible bonds, a figure neither party announced, reported by TechCrunch the next day and later printed by two competition authorities. Two are acquisition prices: Mistral’s own “several million euros” for Pimento, and a press report on Emmi AI that neither party confirmed. And four are private commercial deals whose size a party chose to publish: CMA CGM’s €100 million, by the buyer; TotalEnergies’ “more than €100 million” over three years, by the buyer, on September 15th; HUMAIN’s, “in the hundreds of millions of Euros”; and Microsoft’s compute agreement of July 2026, “a multibillion dollar commitment” in Microsoft’s own release, with no figure, no term, and no mention in the 10-K Microsoft filed eight days later.[33] So the only exact, audited euro figures associated with Mistral are the amounts others paid for its shares. What anyone pays for its product is a procurement notice, a buyer’s press release, or an adjective. And no revenue figure is filed or audited anywhere: Mistral AI SAS has never deposited annual accounts in France, and no counterparty’s filing states a contract value.[4]

What actually exists

The commoditization diagnosis was right, and Mensch made it in January, before his own numbers made it visible. His company’s speech model, Voxtral-Mini-4B-Realtime, is a genuine world-class franchise: 1,746,931 downloads in thirty days and 11.4 million since January 2026, the only post-2025 model in the company’s top three.[34] Its 2023 and 2024 small models had a publisher’s distribution, with 64 million and 46 million lifetime pulls for the two 7B versions.[35] Mistral has had users who signed nothing, in the millions. They came for the small models and for speech, and the 2025 flagship did not inherit them. And there is a documented repeat buyer: BNP Paribas, also an investor, renewed for three years in May 2026.[4]

The flagship line reopened under Apache 2.0 with Mistral Large 3, 21 months after the closure of Mistral Large in February 2024.[36] And the domain he named in his June post, “voice, vision and document processing”, is where the company’s measured strength actually is. He knows which of his products work. His funding announcement sells the other one.

The label, written down

The institutions that designated the champion wrote the label down before they measured the product. Thirty days after Mistral shipped its flagship closed, API-only, and first on Microsoft Azure, in February 2024, the European Parliament’s research service listed Mistral AI as “Open source”, on the strength of Mistral 7B, the only model it named.[37][38] France’s competition authority did look: its opinion of June 28th, 2024 recorded that Mistral had not released Mistral Large as open weights, set out the test for control, and did not apply it to Microsoft’s deal.[39] And on September 2nd, 2026, the economy minister told AFP: “Si l’IA européenne se résume à Mistral, alors nous sommes fichus”, if European AI comes down to Mistral, we are done for.[40]

What would have to break

In March I wrote that Mistral existed despite the state.[41] In May I relayed the company’s reported $400 million of annual recurring revenue, with a billion targeted for the year.[42] Four months on, nobody outside the company and its investors can confirm either figure. Aleph Alpha, the company that Germany’s press and ministers treated as its champion, filed its accounts for 2022, 2023 and 2024 before signing this month to merge with Cohere. [43] Mistral AI SAS has filed none, ever.[4] The French state holds shares through Bpifrance,[5] so it can read the accounts Mistral has not filed; the public cannot.

The argument fails if any of three things happens:

1. If Mistral files audited accounts in France, the valuation no longer rests on numbers nobody outside can read; and if they put private customers near the 80 percent of software revenue that Mensch’s sworn 20 percent leaves them.

2. If any Apache-2.0 Mistral flagship passes 100,000 thirty-day downloads on the Hugging Face counter, or the DeepSeek-V3 gap falls below ten to one, the choosing side is wrong.

3. If a general-purpose Mistral model ships before the memo’s April 2027 deadline and scores above, say, 30 on Artificial Analysis’s intelligence index, against 14 for its best today and 45 for the Chinese model it now serves, the efficiency bet is back on.

Until then, the picture is the one the documents draw: states buying without a tender, seven investors doubling as customers or partners, a free choice going elsewhere wherever it can be measured, and private contracts nobody outside can price. The four-year clock the founders set themselves runs out in seven months, with no general-purpose model released since April 28th, and, by its own product account, a Chinese one as the web app’s default. Deçà, delà.

Notes

[1] Arthur Mensch, LinkedIn post, June 16th, 2026, 16:40 UTC, 495 words, read in full; the date is decoded from the post’s activity identifier. Independent confirmation of the quoted sentences: Sifted, June 17th, 2026; Data Center Dynamics, June 18th, 2026; TechCrunch, July 4th, 2026. Sifted anglicises the spelling; the post reads “organization”. Same post, re-read September 24th, 2026: “We have a very exciting model to come this summer – it will be open-weight, and we’re opening early access to it in July.” Who the early access is for is in his X postof the same day, 15:58 UTC, read on X’s syndication endpoint September 24th, 2026: “First, we have a nice model coming this summer – we hope it will delight and surprise in a few capabilities. This will be the start of a new family of models, fat indeed, but sparse. We’re opening up an early access program in July for key partners in research, government and the” (truncated in the endpoint text). Mistral’s news listing from June 23rd to September 22nd, 2026 carries Leanstral 1.5, Robostral Navigate, Shieldstral and OCR releases and no such model. The end of summer: US Naval Observatory, Earth’s seasons, 2026, September equinox on September 23rd, 2026, 00:05 UTC, 02:05 in Paris; re-run the no-release check on the day of publication. Mistral held a “Building Frontier AI” slot at AI Engineer Paris on September 23rd, 2026, 18:40 to 19:05 CEST (Lélio Renard Lavaud, programme at ai.engineer/paris/2026). Checked at 19:15 and 22:54 CEST on the 23rd and 07:30 CEST on the 24th: no post on mistral.ai/news, no changelog entry after August 31st, no new repository under mistralai on Hugging Face since July 16th, no new Mistral entry on Artificial Analysis, no launch item in Google News in French or English.

[2] The post, @mistralvibe on X, September 21st, 2026, 15:26:56 UTC, verbatim: “GLM 5.3, hosted on Mistral, is now in Vibe Code, and the default in the web app. 1M context window and generous limits included. Happy 🛳️!” Read via two independent endpoints; the Internet Archive refused every save attempt that day, so the corpus capture is the record copy. That Vibe and Le Chat are one product: mistral.ai/products/vibe and mistral.ai/products/le-chat served the identical 446,309-byte page on September 22nd, 2026. The web app is login-gated and Mistral’s documentation names no default model; the claim “the default in the web app” rests on this post alone. Author’s check, September 22nd, 2026, Mistral Vibe 2.25.7, command-line client, plan shown as “Free”, /model selector: “Default (currently Mistral Medium 3.5)”, “Mistral Medium 3.5”, “Devstral (local)”; “2 models” in the session header; GLM-5.3 not offered. The web app’s paid-tier selector was not seen. A French text on the same launch, posted to Reddit r/MistralAI by u/isidor_n on the evening of September 21st, reads “GLM-5.3 est maintenant disponible dans Mistral Vibe Code pour les utilisateurs Pro, Team et Enterprise. Hébergé et servi par Mistral AI dans l’UE. Limites d’utilisation généreuses. Disponible avec jusqu’à 1M de tokens de contexte dans Vibe Code.” It does not use the word “default”; the poster’s affiliation is unverified, so it corroborates the tier restriction and is not cited for it.

[3] Paul Verlaine, “Chanson d’automne”, Poèmes saturniens, Paris, Lemerre, 1866, third stanza verbatim: “Et je m’en vais / Au vent mauvais / Qui m’emporte / Deçà, delà, / Pareil à la / Feuille morte.” Read September 24th, 2026. The wind: Larousse, “mistral”, read September 24th, 2026: “Vent violent, froid, turbulent et sec, qui souffle du secteur nord, sur la France méditerranéenne, entre les méridiens de Sète et de Toulon.” Nothing here says why the company chose its name.

[4] The BODACC open data, registre 952418325, read September 22nd, 2026: 12 notices, none of family “dépôt”; re-read September 24th, 2026: 13, the newest a “Modifications diverses” notice of that day, families “Créations” and “Modifications diverses” only; the government’s company register API returns finances: null for the same SIREN; INPI accounts-ratio dataset, zero rows. SEC full-text search for “Mistral AI” across every 10-K, 20-F and 40-F filed from June 1st, 2025 to September 22nd, 2026: five registrants (ASML, SAP, TotalEnergies, Elastic, ProCap Financial), only ASML attaching a number, and that number equity; Microsoft’s 10-K and 10-Qs, zero occurrences; CoreWeave’s 424B4 prospectus of March 31st, 2025, 23 mentions and no contract value. Counterparty releases read with the contract acknowledged and the value absent: Airbus, May 28th, 2026, licences for “the full Mistral AI product suite”; HSBC, December 1st, 2025, “multi-year”; BNP Paribas, May 26th, 2026, renewed “for a three-year period”; AFP, January 16th, 2025, “multi-year”, and AFP’s 2025 results release of April 16th, 2026, zero mentions. SNCF’s Numérique & IA director, on the group’s own page updated August 5th, 2025, names its suppliers as “OpenIA, Anthropic et Mistral qui est le modèle français. Nous combinons ces différents LLM en fonction du besoin, du modèle économique et de leur consommation énergétique.” “Mistral’s roughly $400M in annual recurring revenue” in my May piece, note 42, was relayed from press reporting and is not filed anywhere.

[5] Mistral AI, “Mistral raises €3B to make sovereign, open-weight AI the technology frontier”, September 8th, 2026: “a post-money valuation of more than €21 billion”. Same announcement: “Samsung Electronics led the round, joined by co-leads Scaleup Europe Fund, managed by EQT, and existing investor PSG Equity.” Samsung Electronics, release, September 9th, 2026: “Samsung has also led Mistral AI’s Series D funding round, securing a strategic equity stake”; “Samsung will integrate Mistral’s AI services and solutions — including its flagship large language model, Mistral Large — across its semiconductor operations to develop customized on-premises AI models”. Same announcement: “Existing investors a16z, ASML, Belfius, BNP Paribas CIB, Bpifrance, Carmignac, DST Global, Eurazeo, General Catalyst, Headline, Hillspire, Index Ventures, Korelya Capital, Lightspeed, NVIDIA, Phoenix Court’s Solar fund (home to LocalGlobe, Latitude and Solar) and Salesforce Ventures participated in the round.” Confirmed by The Register, September 8th, 2026.

[6] Les Echos, “La saga Mistral : le champion qui pourrait abandonner la course à l’IA”, September 17th, 2026, 06:17 CEST, part 2 of 3; standfirst: “La promesse de la start-up était de développer des modèles capables de concurrencer les meilleurs du marché. Trois ans plus tard, le projet a largement pivoté.” Paywalled; the author read the headline, the standfirst and the passage quoting the founding memo (note 21). Part 3, “La saga Mistral : la souveraineté à géométrie variable d’un champion européen”, ran September 24th, 2026.

[7] The notice, TED 415226-2025, OJ S 121/2025, published June 27th, 2025; contract reference 2501587 signed June 17th, 2025; winner identified by SIREN 952418325; procedure “negotiated without prior call for competition”, justification code “technical”; one tender received; award criterion “Absence de concurrents pour des raisons techniques” at weight 100. The five conditions in the justification: an already-built high-performing model, an open-source offering alongside commercial products, deployability on state infrastructure, first-party provider status, and a security guarantee. Wayback 20260922065031. The value is the notice’s total; no duration is published and it cannot be annualised.

[8] The notice, TED 492208-2025, OJ S 142/2025, published July 28th, 2025; buyer “Ministère des Affaires étrangères et européennes, de la Défense, de la Coopération et du Commerce extérieur – Direction de la Défense”; justification, in full, “Article 28 1. e) de la loi du 26 décembre 2012 sur les marchés publics de la défense”; winner record filled with placeholder data, company number FR00000000, town “Halles”, telephone 0033, email info@info.fr, read from the eForms XML on September 22nd, 2026. No archive snapshot could be made.

[9] The notice, TED 453996-2026, OJ S 125/2026, published July 2nd, 2026; buyer Land Hessen via HZD for the Hessian finance ministry; legal basis §14 Abs. 4 Nr. 2 lit. b and §14 Abs. 6 VgV; 24 months plus one 24-month extension; one tender. Two of the five requirements, verbatim: “Modellherkunft und -kontrolle: Der Auftragnehmer muss die bereitgestellten textverarbeitenden KI-Modelle eigenständig trainieren und nachweisbare Kontrolle über die verwendeten Trainingsdaten und Trainingsprozesse ausüben.” and “Entwicklungsstandort: Die verwendeten KI-Modelle müssen innerhalb des Europäischen Wirtschaftsraums oder in Ländern mit angemessenem Datenschutzniveau gemäß Art. 45 DSGVO entwickelt worden sein.” The award justification: “lediglich Mistral AI SAS sämtliche zwingenden Mindestanforderungen kumulativ erfüllen kann”. The voluntary ex-ante transparency notice is TED 335597-2026, May 18th, 2026. All three notices carry the eForms placeholder award date of January 1st, 2000.

[10] Mistral AI, the Series D announcement, September 8th, 2026, as note 5: “Advent, funds and accounts managed by BlackRock as well as the Grand Duchy of Luxembourg joined the round as new investors.”

[11] The CTIE reports to Luxembourg’s digitalisation ministry; the Direction de la Défense sits inside the foreign affairs ministry; the Series D names “the Grand Duchy” with no vehicle. Nothing in notices 415226-2025 or 492208-2025 refers to any equity arrangement, and the funding announcement does not refer to any contract.

[12] Author’s search, September 22nd, 2026: BOAMP open data (1,708,130 records), SIREN 952418325 in any field, 0; titulaire “Mistral AI”, 0. DECP datasets decp-v3-marches-valides (702,901 rows) and decp_augmente (994,123 rows), SIRET prefix 952418325, 0. TED, winner name “Mistral AI”, 3, the three notices above. The French ministries contract: Les Echos, September 2nd, 2026, confirmed by the ministère de l’Action et des Comptes publics to Capital, as relayed by ActuIA, September 7th, 2026: “six millions d’euros sur la période 2026-2027, un contrat sans caractère exclusif, des ingénieurs de l’entreprise détachés au sein des administrations”; “L’accord a été conclu à l’issue d’une procédure de marché public”, the ministry’s detail as reported by Generation-NT, per the same ActuIA article. No notice in BOAMP, DECP or TED on September 22nd, 2026.

[13] Ministère des Armées et des Anciens combattants, communiqué of January 8th, 2026, on the accord-cadre between AMIAD and Mistral AI notified December 16th, 2025: no montant, duration or ceiling stated; no BOAMP or TED notice, the defence exemption applying. Inspection générale des finances, IGAS and IGA, joint report on AI deployment in the state, IGF 2025-E-081-03, April 2026, published July 2nd, 2026, at vie-publique: annexe XII, tableau 3, DINUM commitments 2023 to 2025, “Assistant IA 338 840 €”; footnote 48 of the main report, verbatim, “De l’ordre de 300 k€ pour 8 GPU et 10 000 équivalents utilisateurs actifs (pour un taux d’utilisation observé de 10 %, le contrat ouvre un accès à près de 100 000 agents) sur 12 mois. En cas de généralisation de l’expérimentation, le passage à 1 à 2 millions d’utilisateurs [...] correspondrait à un coût de l’ordre de 3 M€ par an – hors renégociations [...] pour le fournisseur actuel (MistralAI)”. These are the inspectors’ estimates, not a contract price. The often-repeated “two million agents” is the upper bound of that estimate, not a headcount in any signed agreement; DINUM’s own page, published November 17th, 2025, on the launch of October 22nd, 2025, gives 10,000 agents across eight ministries on Mistral Medium 3, hosted by Outscale, with no amount.

[14] Assemblée nationale, commission d’enquête sur les dépendances structurelles et les vulnérabilités systémiques dans le secteur du numérique, compte rendu n° 42, May 12th, 2026, hearing of Arthur Mensch under oath, 10,547 words. Verbatim: “les services à haute valeur ajoutée, c’est-à-dire ceux qui offrent une forte marge donc permettent de financer de la R&D, c’est l’intelligence artificielle. À partir du moment où on développe l’intelligence artificielle, on peut construire tout le reste des services du cloud, qui sont surtout des commodités.” Occurrences of “commodit” in the transcript: one. The revenue split, same hearing, verbatim: “De tête, je dirais que la commande publique globale représente 20 % de notre chiffre d’affaires, sur la partie logiciels, et la commande publique française 10 %. Nous ne cherchons pas à la faire beaucoup augmenter, mais tout croît. Nous avons des contrats-cadres significatifs avec le Luxembourg par exemple, où nous faisons du déploiement en administration centrale.” The verbatim annex is reproduced in rapport n° 3054, tome 2, July 8th, 2026.

[15] Bitkom, “KI aus China? Für die deutsche Wirtschaft praktisch kein Thema”, September 9th, 2026. Base sentence verbatim: “Basis der genannten Werte sind Unternehmen, die KI einsetzen.” Question: “Welche der folgenden KI-Anwendungen nutzen Sie im Unternehmen?”, multiple answers. Rows not in the body: Llama 8 per cent, DeepSeek 2, Qwen 1. Bitkom’s president, Ralf Wintergerst, in the same release: “Wer digitale Souveränität will, muss europäischen Anbietern eine Chance geben.” The n of 343 AI-using firms is in the conference presentation of September 14th, 2026. Methodology in the companion release “Erstmals nutzt die Mehrheit der Unternehmen KI”: 603 firms of 20+ employees, telephone, calendar weeks 28 to 33 of 2026, representative. Independent confirmation: heise, same day. Bitkom’s chart prints the 2025 value beside each 2026 row; Mistral was on the prompted list in 2025 and read 0 in both years. Aleph Alpha is not on the eleven-name prompted list in either year, so it was not asked about rather than scored.

[16] SAP as a Mistral channel: SAP News, “SAP and Mistral AI announce new alliance for European sovereign AI”, November 18th, 2025: “The next phase will see SAP providing Mistral AI’s frontier models and products through a sovereign AI foundation on SAP Business Technology Platform (SAP BTP)”; Mistral’s own customer page for SAP: “the SAP team built a multilingual chatbot leveraging Mistral Large hosted entirely on the SAP operated infrastructure”. The “125+ global enterprises” figure is Mistral’s own, in the announcement of note 5. The companion Bitkom release gives token consumption as 8 per cent of AI cost among users, against 51 per cent for infrastructure and compute, with Wintergerst’s line “Bei KI geht es nicht in erster Linie um das eingesetzte Modell.”

[17] The Hugging Face Hub API record for Mistral-Large-3-675B-Instruct-2512, read September 22nd, 2026, 05:23 UTC: downloads 2,097 (trailing thirty days), downloadsAllTime 13,457, created November 28th, 2025, licence Apache 2.0. Sibling repositories in the same call, thirty-day downloads: Mistral-Large-3-675B-Instruct-2512-NVFP4 10,798; -Base-2512 75; -Instruct-2512-BF16 41; -Instruct-2512-Eagle 119; family total 13,130. Author’s calculation: 1,118,995 ÷ 13,130 ≈ 85.2. The downloads field is a rolling thirty-day count; a re-read at 17:03 UTC the same day gave 2,125 and 13,504, DeepSeek-V3 1,148,200, ratios 540 and 84.9, so the 05:23 figures are one dated measurement and the conclusions do not move. Mistral-Medium-3.5-128B, same counter, 89,194 thirty-day pulls, created March 31st, 2026, Hub licence field “other”; Mistral’s changelog: “April 28 We released Mistral Medium 3.5 (mistral-medium-3-5) [...] Released as open weights under a Modified MIT license.” Archived org page: Wayback 20260921182241.

[18] The same API record for DeepSeek-V3, same call: downloads 1,118,995, downloadsAllTime21,044,555, created December 25th, 2024. The model’s size and licence class are from DeepSeek’s own technical report, December 26th, 2024: 671 billion total parameters, 37 billion active, mixture of experts. Licence from the repository, not the paper: README section 7, “The use of DeepSeek-V3 Base/Chat models is subject to the Model License. DeepSeek-V3 series (including Base and Chat) supports commercial use”; the DeepSeek Model License carries use-based restrictions and is not Apache-class. Author’s calculation: 1,118,995 ÷ 2,097 ≈ 534x.

[19] Peter Walker, OpenRouter, post on X, September 21st, 2026, 23:59 UTC: “I know it feels forever ago, but Mistral really did have a moment there.”, with the chart “Token share by model lab country”, “Share of tokens used on OpenRouter by week”; the bars run from January 2024 to September 2026 although the chart’s own caption says “Jan 1 2025-Sep 20 2026”. France, read from the chart’s labels: 62, 68, 57, 46, 36, 23, 14, 15, 10, 10, 7 and 7 per cent for the twelve months of 2024; 5 to 6 per cent in the first months of 2025; 5 per cent in December 2025; no label since. September 2026: China 66 per cent, USA 32. OpenRouter’s own data, read from the image; the platform counts tokens routed through one marketplace and does not see Mistral’s direct API or on-premises deployments. Live ranking, read September 23rd, 2026, 05:50 UTC, “Model authors ranked by their share of text requests on OpenRouter in the most recent complete week”: deepseek 25.4, google 18.6, openai 17.0, z-ai 9.4, qwen 6.7, tencent 6.4, anthropic 2.7, mistralai 2.6, xiaomi 1.9 per cent. Desk check, September 23rd, 2026: OpenRouter’s own chart endpoint (openrouter.ai/api/frontend/v1/rankings/model-rankings-chart) returns 52 weeks of the nine top models by tokens plus an “Others” bucket, September 29th, 2025 to September 21st, 2026; no Mistral model appears in any week, and Chinese labs’ share of the named tokens rises from 2 to 6 per cent in October and November 2025 to 55 per cent in the week of September 21st, 2026, consistent with the chart’s right-hand side. The 2024 bars could not be reproduced: the endpoint covers one year, the Internet Archive was offline and archive.today’s first snapshot of the rankings page is from March 2025. The 2024 figures are the chart’s alone. Payload kept.

[20] Author’s test, August 17th, 2026, 15:48 local time, on Mistral Vibe (the mistral-vibe command-line agent), model Mistral Medium 3.5; Vibe’s own session log, kept locally, is the record. Verbatim from that log: “Mistral does not offer a speech-to-text (STT) model — their API is exclusively for text generation (LLMs). Mistral has no audio processing capabilities.” When told of Voxtral in the next turn, the agent replied “You’re absolutely right — Voxtral is Mistral’s speech-to-text model” and wrote the pipeline against voxtral-mini-latest. The session’s tool list included web_search, which the agent called four times later in the same session and not once before this answer. Re-run September 22nd, 2026, 15:23 UTC, Vibe 2.25.7 in programmatic mode, one turn, no web-search or web-fetch tool (the catalogue in the kept journal offers file, shell, code and skill tools only), active model mistral-medium-3.5 per the session journal; answer verbatim: “Mistral AI does not currently offer a dedicated speech‑to‑text model. Their public API serves text generation via endpoints like /v1/chat/completions. For transcription, use a separate ASR service such as Whisper or a cloud provider.” A request for GLM-5.3 from the free tier timed out; my own check found it not offered there. Two smaller findings from the same session: the console detected a French browser and served the interface in French with documentation links to the English docs; the free tier’s limits were hard to find. Mistral Medium 3.5: earlier dates circulate for the model’s first appearance; the piece uses Mistral’s own post putting it in Vibe on May 22nd, 2026. On August 17th the documented install script answered 429 to the first request. Install path as documented at docs.mistral.ai/vibe; re-measured September 22nd, 2026, 13:17 UTC: mistral.ai/vibe/install.sh answers 301 to the script on GitHub, which answers 200. Product dates from datePublished on Mistral’s own pages: Voxtral, July 15th, 2025; Voxtral Transcribe 2, February 4th, 2026; Voxtral TTS, March 23rd, 2026; “Remote agents in Vibe. Powered by Mistral Medium 3.5”, May 22nd, 2026; GLM-5.2 hosting in “Regional inference for open models on new compute”, August 11th, 2026. docs.mistral.ai/llms.txt exists and indexes the documentation. The August answer is my testimony, with Vibe’s session log as its record. The web app’s paid-tier default I have not seen; the “default in the web app” claim of note 2 rests on the product account alone.

[21] Tim Smith and Amy Lewin, “See the pitch memo that raised €105m for four-week-old startup Mistral”, Sifted, June 21st, 2023. The document, titled “mistral.ai strategic memo”, seven pages, is embedded and downloadable; read in full on September 22nd, 2026. Les Echos, “La saga Mistral (2/3)”, September 17th, 2026, quotes the same two sentences from a copy “que « Les Echos » se sont procuré” and renders the passage in its own translation.

[22] The memo, page 5, “Infrastructure and data sources”, verbatim as quoted; published and described by Sifted on June 21st, 2023, which is the independent record that this is the document the founders circulated. The starting cluster, same page: 1,536 H100s from September 2023 “with a summer ramp up”. The efficiency sentence in full: “Having trained models at large-scale before has provided us know-hows that will allow us to gain a factor 10-100 in training efficiency compared to public methods — our founders and early employees know exactly what to do to train the strongest model for a given computational budget.”

[23] Memo, page 3 for the open-source hedge and page 5 for the two sentences on investors’ doors and industrial actors, verbatim as quoted.

[24] Big Technology Podcast, “Who Wins if AI Models Commoditize? — With Mistral CEO Arthur Mensch”, audio published January 14th, 2026, YouTube upload January 16th. Timestamps on the YouTube version, whose duration matches the podcast feed’s ad-free audio at 3,268 seconds: host at 01:58, “we’re just hitting commoditization of the foundational model much faster than I thought it would be”; Mensch at 02:26 onward as quoted; Mensch at 17:09, “If AI effectively becomes a commodity, which is what’s happening”; Mensch at 23:01, “to get to value, they need to have great models [...] So the two things are extremely linked together.” Transcribed by the author with whisper.cpp large-v3-turbo on September 21st, 2026, because no human caption track or official transcript exists. Note that Mensch adopts the host’s word and supplies the reasoning; the episode title is the host’s. A week later at Davos he told Axios that Mistral’s policy assumed “the models are essentially free”: Axios, “Mistral AI’s Arthur Mensch & Axios’ Ina Fried”, recorded at Axios House, Davos, during the week of January 19th, 2026, uploaded January 22nd; at 02:22, “if you have a policy where you assume that the models is not where the value accrues but that the models are essentially free”; at 03:35, “what we’ve essentially been saying from the very beginning which is that the model layer is a free layer”. Same transcription method. Axios’s own write-up of January 26th quotes the passage from 03:06 word for word, which confirms the transcription in that window.

[25] Author’s sweep of Wayback snapshots of mistral.ai on May 5th and June 13th, 2023; October 1st and December 28th, 2023; March 1st, 2024; June 1st, 2025; and January 1st, June 1st and September 1st, 2026. Occurrences of “full stack” in any snapshot: zero. The phrase appears in the announcement of note 5. The word “sovereign” first appears on the home page in the September 1st, 2025 snapshot; “compute” between the May 1st and July 1st, 2025 snapshots.

[26] Mistral documentation, zai-glm-5-3, dated September 15th, 2026, badges “Public Preview”, “Third-party”, “Open”; “hosted by Mistral”; “served without Mistral modifications”; $1.40 input, $0.14 cached input, $4.40 output per million tokens; EU and global endpoints, no US endpoint. Z.ai’s own pricing: $1.40 input, $0.26 cached, $4.40 output. mistral.ai/news (about 1.26 MB), mistral.ai/pricing (487 KB) and mistral.ai/products/vibe (446 KB) read September 22nd, 2026: zero occurrences of “GLM”, “Z.ai” or “Zhipu” in the pages’ text (one image filename on the news page carries “GLM”). Artificial Analysis index version 4.3.2, GLM-5.3 scored at maximum reasoning, Mistral Large 3 without a reasoning mode. Artificial Analysis, provider page, read September 21st, 2026: GLM-5.2 (max) 34, Mistral Medium 3.5 14, Mistral Large 3 9 (non-reasoning); GLM-5.3 (max) 45 on the leaderboard the same minute; frontier top 53.

[27] The exchange, seven posts in French, six distinct texts (five by Branco, two by Mensch), September 18th to 20th, 2026, read September 21st: Branco’s anchor, @anatolium, September 18th, 18:35:50 UTC, itself a quote of an anonymous account’s anecdote about Mistral’s teams; Mensch, @arthurmensch, September 20th, 16:01:25 UTC, verbatim “Nos travaux déplaisent à certaines petites frappes. Celui-là est candidat à l’élection présidentielle 😅”; Branco’s reply 43 seconds later; Mensch, second post, 16:15:37 UTC, verbatim “1 minute pour me répondre, c’est un obsessionnel”. Both of Mensch’s posts were deleted between that reading and September 22nd, 2026, 16:20 UTC, when X’s syndication endpoint (cdn.syndication.twimg.com/tweet-result?id=<id>&token=a) returned “This Post was deleted by the Post author” for both identifiers and a live post for Branco’s anchor; the two links above are dead. No archive ever captured them: the Internet Archive refused every save on September 21st, and the copy taken that day is the only record. View counters at the September 21st reading, frozen by the deletion: Mensch’s two posts 1,541,771 and 399,869, total 1,941,640; Branco’s anchor 1,310,275; Branco’s five posts together 1,929,477. Branco’s rebuttal names “des resucées de GLM 5.2 pendant tout un été”; GLM-5.2 hosting is Mistral’s own announcement of August 11th, 2026; GLM-5.3’s documentation page is dated September 15th (note 26), and GLM-5.3 in Vibe Code is note 2. Branco’s descriptors: French Wikipedia’s lead, read September 22nd, 2026, “avocat, essayiste, militant politique d’extrême gauche et réalisateur franco-espagnol”, sworn in as a lawyer in April 2017, and his announcement in December 2025 of his 2027 candidacy, as summarised there. Crépuscule: published online December 2018, then Paris, Au diable vauvert, March 21st, 2019, 312 pages, ISBN 979-10-307-0260-6. Cédric O’s shareholding through his company Nopeunteo is on the parliamentary record (compte rendu n° 45, May 13th, 2026, the chair’s opening words); its size is not. The €90 million, the under-€200 entry, EPFL’s cost, the engineering headcount and the share of public orders carry no document and are not used here.

[28] CMA CGM, “CMA CGM Group adopts custom-designed AI solutions with Mistral AI”, April 6th, 2025: “From the moment Mistral AI secured its first round of funding in June 2023, the CMA CGM Group took the initiative to invest in this pioneering startup”. Series D investor list as note 5.

[29] mistral.ai/customers/, 42 named organisations, pages dated April 24th to July 28th, 2026, read September 22nd, 2026; plus Amadeus, Caisse des Dépôts, Microsoft, Nvidia, HUMAIN, Cloudera, Mozilla, AFP and Land Hessen from Mistral’s own announcements, Samsung Electronics from its own release of September 9th, 2026 (note 5), and the European Space Agency, press release, numbered N° 57-2026 in ESA’s site search, September 23rd, 2026: “The European Space Agency (ESA) and Mistral have signed a Letter of Intent establishing a strategic framework to deepen their collaboration on artificial intelligence”, “signed in Paris on 16 September by ESA Director General Josef Aschbacher and Mistral CEO Arthur Mensch”; no amount, no term. Not on mistral.ai/news on September 24th, 2026, 07:30 CEST.

[30] Author’s count from notes 28 and 29: cap table 24, commercial 53; both lists 7 (ASML, CMA CGM, Grand Duchy of Luxembourg, BNP Paribas CIB, Belfius, Nvidia, Samsung Electronics); on the customers page and the cap table both, 5 of 42 (ASML, Belfius, BNP Paribas, CMA CGM, Government of Luxembourg); customers with no equity link in any document read, 37 of 42. Documents read for the five largest: Airbus Board report FY2025 p.43 and financial statements; HSBC Annual Report and Accounts 2025; Capgemini 2025 URD; Amadeus Global Report 2025, FY2025 accounts and H1 2026 results, zero mentions of Mistral; Caisse des Dépôts Rapport d’activité 2025, “investissements stratégiques (Mistral IA)”, and RAFI 2025, zero mentions. SNCF: own release of June 12th, 2025, and Rapport annuel intégré 2025, one mention each, no amount; Rapport financier annuel 2025, zero mentions. Caisse des Dépôts’s dedicated release of May 4th, 2026 describes a two-lot framework agreement, generative AI and GPU compute, “près de 40000 licences” at the start and up to 100,000 users, 19 subsidiaries in the buying group, and no price. Were CDC confirmed as a shareholder the overlap would be 8 of 25, and the non-overlap would still be the larger number. Salesforce Ventures is an existing investor per note 5; no Salesforce entity appears on any customer or partner page.

[31] ASML, press release, September 9th, 2025: “ASML is investing 1.3 billion EUR in Mistral AI’s Series C funding round as lead investor”; “approximately 11 percent share on a fully diluted basis”; “a seat on the Strategic Committee of Mistral AI [...] an advisory role”; “a long-term collaboration agreement to explore the use of AI models”. ASML Form 20-F for 2025, filed February 25th, 2026, asml-20251231.htm, XBRL member asml:MistralAIMember: additions €1,302.2 million, carrying value €1,320.7 million, 11.1 per cent fully diluted. Anchor tenant per Mistral’s August 11th, 2026 announcement.

[32] CMA CGM, April 6th, 2025, as note 28: “a five-year strategic partnership” and “Supported by a €100 million investment, this partnership marks a significant milestone”. Repeated in CMA CGM’s Q1 2025 results, May 16th, 2025, “coupled with a €100 million investment”, and in its FY2025 results release, March 6th, 2026; the “around twenty Mistral AI engineers” in Marseille is also CMA CGM’s own wording, AI Now Summit release, May 27th, 2026. The group’s audited consolidated statements were not read; its site serves them through a client-side endpoint. Occurrences of the figure on mistral.ai: zero. The group’s total AI commitment, “EUR 500 million”, names Google, Perplexity, Poolside and Dataiku alongside Mistral.

[33] Author’s count, September 22nd, 2026, recounted September 24th, 2026 with Samsung and the ESA letter of intent: 56 announced relationships, swept from Mistral’s 137 sitemap pages, SEC full-text search, counterparty releases and French registries, counting commercial deals, equity and partnerships together, so not the sum of note 29’s 53 names and the cap table; with any published value, 10, eleven figures, Microsoft counted under bonds and under compute; three of the eleven are words rather than numbers (Pimento’s “plusieurs millions”, HUMAIN’s “in the hundreds of millions”, Microsoft’s “multibillion dollar commitment”). Procurement, exact: the three notices of notes 7 to 9. Equity, exact: ASML’s stake of note 31; Microsoft’s €15,000,000 of convertible bonds, “part of a bond raise of €120 million”, with Microsoft to “own less than 1%”, in the UK Competition and Markets Authority’s Phase 1 decision of May 17th, 2024, which prints the parties’ submission; neither party’s own release carries a figure; TechCrunch reported it the day after the announcement, “Microsoft made a $16M investment in Mistral AI”, February 27th, 2024: “Microsoft is investing €15 million ($16.3 million at today’s exchange rate)”, and the CMA decision cites that article. Private commercial, party-published: TotalEnergies, own release, Paris, September 15th, 2026: “a 3-year joint program representing an investment of more than €100 million aimed at developing a new generation of frontier AI models”; CMA CGM of note 32; HUMAIN, “in the hundreds of millions of Euros”, Mistral’s own announcement, August 24th, 2026; Microsoft, “a multibillion dollar commitment”, Microsoft release of July 21st, 2026, Mensch quoted, no figure or term; Microsoft’s FY2026 10-K, filed July 29th, 2026, contains no occurrence of “Mistral”. Acquisitions: Pimento, Mistral’s own words to AFP, dispatch of September 21st, 2026: Mistral “va racheter “pour plusieurs millions d’euros” la start-up Pimento [...], a-t-elle indiqué lundi à l’AFP, confirmant une information du média L’Informé”; press only, reported and not confirmed: Emmi AI, “up to €330M” per Sifted, June 11th, 2026, from leaked internal documents.

[34] The Hub API record for Voxtral-Mini-4B-Realtime-2602, same call as note 17: downloads 1,746,931, downloadsAllTime 11,430,456, created January 21st, 2026; third in the account by thirty-day pulls after the two 7B instruct models of note 35.

[35] The same call, records for Mistral-7B-Instruct-v0.3 and v0.2: downloads 2,357,073, downloadsAllTime 46,426,509, created May 22nd, 2024; mistralai/Mistral-7B-Instruct-v0.2, downloadsAllTime 64,192,688.

[36] Mensch, June 16th, 2026, as note 1: “In domains that are less compute bound, e.g. voice, vision and document processing, we have state-of-the-art solutions.” Mistral Large 3, Apache 2.0, created on the Hub November 28th, 2025, note 17; the closed Mistral Large shipped February 26th, 2024, note 37. Earlier Mistral-Large-Instruct-2407 and -2411 shipped under Mistral’s research licence, Hub license: other, July and November 2024.

[37] Mistral AI, “Au Large”, February 26th, 2024, Wayback 20240226152230: “Mistral Large is available through la Plateforme. We are also making it available through Azure, our first distribution partner”; Mistral Small described as “a refined intermediary solution between our open-weight offering and our flagship model”. Microsoft, Azure blog, same day.

[38] The European Parliamentary Research Service at-a-glance briefing PE 760.392, March 27th, 2024, table 2: “Mistral AI | Mistral 7B | France | Open source”. Microsoft, Azure and Mistral Large do not appear in it.

[39] The Autorité de la concurrence’s avis n° 24-A-05, June 28th, 2024, paragraph 182: “Mistral AI has released several of its models as open-weights, but not Mistral Large, its most powerful model” (English version); the opinion records “the €15 million investment by Microsoft in Mistral AI in 2024 through a bond convertible into shares”, sets out the article 3(1) control test and a 1991 precedent, and applies neither to this deal.

[40] Roland Lescure, September 2nd, 2026, San Francisco, to AFP, as relayed by ActuIA, September 7th, 2026: “Si l’IA européenne se résume à Mistral, alors nous sommes fichus. On ne peut pas mettre tous nos œufs dans le même panier : c’est tout un écosystème qu’il faut développer.”

[41] Julien Simon, “Mistral Succeeded. France’s AI Strategy Didn’t.”, The AI Realist, March 10th, 2026.

[42] Julien Simon, “Lobby, Levy, Legislate”, The AI Realist, May 22nd, 2026: “Mistral’s roughly $400M in annual recurring revenue, with €1bn targeted for the year”.

[43] Cohere’s own announcement, PR Newswire, September 16th, 2026: definitive business combination agreement, the combined company operating as Cohere with dual headquarters in Berlin and Toronto, subject to regulatory approvals; the two ministers, Evan Solomon and Karsten Wildberger, are named in the photo caption. Aleph Alpha GmbH, Amtsgericht Mannheim HRB 732804, Unternehmensregister, read September 22nd, 2026: Jahresabschlüsse for fiscal 2022 (published October 27th, 2023), 2023 (January 30th, 2025) and 2024 (February 2nd, 2026); their contents sit behind a human-verification step and were not read by the author. Aleph Alpha is not among the options in Bitkom’s questionnaire of note 15.

On September 18th, 2026, AWS added Moonshot’s Kimi K3 to Bedrock at Moonshot’s own price to the cent: $3 per million input tokens and $15 per million output tokens.[1] Ten days earlier, a joint advisory from the NSA, CISA, and the FBI said that “Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model.”[2] The launch post doesn’t mention it. I don’t think AWS did anything wrong by listing the model. The line I care about isn’t in the launch post. It’s on the model card, and if you pick models on a managed cloud, it’s the line you should be reading first.

Here it is:

“EOL no sooner than: Not Applicable, at least 45 day EOL Notice will be provided.”[3]

In plain English: AWS promises to keep K3 running for no minimum period, and to warn you 45 days before it switches it off.

What did AWS promise before?

A lot more. On September 3rd, Bedrock’s lifecycle page said that “once a model launches on Amazon Bedrock, it will remain on Amazon Bedrock for at least 12 months before the EOL date”, with at least six months’ notice before retirement.[4] The Chinese models already on the shelf got exactly that: Kimi K2.5, launched in January, is promised until January 2027.[5]

Some time between September 3rd and September 9th, the page split in two. The old text moved to a “Legacy” page covering models launched before September 7th. A new page covers everything after. Each model card now carries its own floor, and one of two notice periods: “There are two Legacy periods: 6 months and 45 days. Most models have a 6-month Legacy period.”[6] I can find no announcement: nothing in the Bedrock document history. And the new page doesn’t say who gets 45 days, or why.

Two models have launched under the new rules. On September 19th, I checked all 128 model cards on Bedrock.[5] OpenAI’s GPT-6 Astra, launched September 8th, is promised until September 8th, 2027, with six months’ notice.[7] Kimi K3 got no floor and 45 days. It is the only card on the entire shelf with a 45-day notice.

That matters because K3 is not the only accused model AWS sells. The advisory named six companies, and five of them are already on Bedrock: DeepSeek, Alibaba’s Qwen, MiniMax, Z.AI, and Moonshot itself. That is nineteen cards, K3 included. The other eighteen all promise a year on the shelf and six months’ notice.[5] They arrived before the rewrite. K3 arrived after it.

The advisory came out on September 8th, inside that September 3rd to 9th window. The web archive can’t tell me whether AWS rewrote the page before or after it, and I’m not going to pretend otherwise.

Why write a clause you don’t need?

AWS doesn’t need a 45-day clause to obey the law. If Moonshot lands on the Entity List, or Congress bans the model for some purpose, the contract gives way to the statute, and AWS pulls the model on whatever schedule the law sets. Congress has already done this once: the Defense Authorization Act signed in December 2025 gave the Pentagon 30 days to remove DeepSeek from its systems, and the Senate’s bill for next year would add Moonshot to the same list.[8]

So the 45 days aren’t about the law. They’re about everything short of it. A letter from a committee chairman. A big customer whose own contracts rule out the model. Under the old rules, AWS would owe K3 customers at least a year on the shelf, with six months’ warning before the end. Under the new ones, it can leave in about six weeks without breaking a promise.[3][4]

I don’t know that AWS set the term with the advisory in mind. But if it did, this is what it would look like: sell the model, keep the exit short, and don’t explain the rule.

K3’s license says that a company running it as a paid service with more than $20 million in revenue over twelve months “must enter into a separate agreement with Moonshot AI”.[9] Bedrock is well past $20 million. Either AWS has that agreement, or it falls under the license’s exemption for Moonshot’s “certified inference partners”. Both are relationships with Moonshot, and neither AWS page specifies which.

AWS’s side of it

AWS has hosted Chinese open-weight models since DeepSeek-R1 in January 2025 under standard terms.[10] No US rule forbids a company from deploying K3 in its own business.[11] And AWS says the model runs inside its own walls: “Your data is processed within the AWS data boundary, is not shared with the model provider, and is not used to train the underlying model.”[1]

On September 10th, Anthropic, which has committed more than $100bn to AWS over ten years, reported that Moonshot had “silently forwarded customer requests to Claude, instead of processing them using Kimi”.[12] On Bedrock, by AWS’s account, that can’t happen: the requests stay inside AWS. For a customer, self-hosting is AWS’s unaudited answer to the forwarding problem, and it only covers Bedrock: AWS Marketplace also sells Moonshot’s own Kimi API Platform, run by Moonshot. Moonshot’s only public statement since the report, on Weibo on September 12th, called rumors about its founder and staff “pure fabrication”; I can’t find one that answers the advisory or the forwarding claim.[12]

It’s also possible that 45 days is simply how AWS will treat open-weight models going forward, since the provider isn’t there to promise support. That’s a fair reading, and the evidence can’t rule it out yet. Nor can it rule out a third: Astra arrived under AWS’s partnership with OpenAI, and K3 under nothing comparable.[7]

What makes me doubt the open-weight explanation is the comparison. Microsoft runs the same kind of shelf and prints the terms in a table. Its other outside-lab models run for twelve months; the notice on a generally available model is at least 60 days; and the exit for trouble is written out, with its reason: if a model “is found to have compliance or security issues, Microsoft reserves the right to invoke an emergency retirement with shortened notice”.[13] Microsoft sells Kimi as well, through Fireworks, and that tier is harsher than AWS’s, not softer: 15 days’ notice, with one retirement date printed on every Fireworks model page, July 1st, 2027.[14]

Microsoft prints the rule, the date and the reason before you build. AWS gave one model a shorter exit than anything else on its shelf and published none of the three. Amazon’s 2024 letter to shareholders ends: “It remains Day One.”[15] When Microsoft is the one saying things plainly, is it still day one?

The meter, again

In July I argued that AWS has decided to own the meter, not the model: it sells Claude at Anthropic’s price and makes its money underneath.[16] K3 at Moonshot’s price is the same move. What’s new is that the landlord has started writing different leases for different tenants, and setting the shorter one on itself, in advance, on a page most customers never open.

What to do about it

If you’re building on Bedrock, add one line to your model selection: open the card, read “EOL no sooner than” and “Legacy period”, and write both into your design document next to the price. If you hold an Enterprise Discount Program or private pricing deal, check whether it overrides this page. If the answer is 45 days, ask yourself one question: could I move this workload in six weeks?

For K3, the answer can be yes, because the weights are public. You can download them today, test them on a second host (your own GPUs, another provider), and keep that path warm. Keeping it warm isn’t free: you pay for a host you may never use. The 45 days is then a migration window, not a cliff. For a closed model on a 45-day term, you’d have no such option.

What would prove me wrong? The next Western open-weight model to launch on Bedrock showing up with 45 days. Then this is a rule about open weights, not about China. Or the next Chinese model getting six months.

The house style

On March 1st, an AWS availability zone in the Emirates caught fire. The incident report said it had been “impacted by objects that struck the data center, creating sparks and fire”. Objects. About a day and a half later, with the attack on the UAE leading the news, AWS named them: two of its buildings there had been “directly struck by drones”.[17] Then it went quiet again. Three weeks on, when it waived the region’s bills, the email gave no cause at all.[18]

This story is written in the same hand. The policy changed with no announcement. The short tier has no published criteria. AWS has said nothing about what the advisory means for Moonshot. None of it is a lie. None of it is a statement either. Everything is written down precisely in Seattle, in a place where nobody will read it.

So read it. It’s one line on the model card.

Notes

[1] AWS, “Introducing Kimi K3 on Amazon Bedrock“, September 18th, 2026, accessed September 19th, 2026: “Your data is processed within the AWS data boundary, is not shared with the model provider, and is not used to train the underlying model.” Prices from the Bedrock Kimi K3 model card, accessed September 19th, 2026, Standard tier, Global cross-Region: $3.00 input, $15.00 output, $0.30 cache read per million tokens; the US cross-Region profile (”US CRIS” in AWS’s price table) is 1.10x on every cell. Moonshot’s own pricing page, accessed September 19th, 2026, lists kimi-k3 at $3.00 input (cache miss), $15.00 output, $0.30 cached input. The document is the AWS model card; the independent confirmation of the price match is Moonshot’s page.

[2] NSA, CISA and FBI, Cybersecurity Advisory AA26-251A, September 8th, 2026, section on Moonshot AI, accessed September 19th, 2026: “Notably, Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model.” The record copy is the PDF on media.defense.gov, which refuses automated requests; an archived copy dates from September 9th, 2026. The piece reports what the advisory says, not that the allegation is proven. The advisory’s reference list cites Anthropic’s earlier post “Detecting and preventing distillation attacks”, so Anthropic’s September 10th report, which came two days after the advisory, is not an independent confirmation of the allegation.

[3] Bedrock Kimi K3 model card, accessed September 19th, 2026: “Model launch date: 18th Sept 2026 EOL no sooner than: Not Applicable, at least 45 day EOL Notice will be provided Legacy period: at least 45 days”. The new Model lifecycle page, accessed September 19th, 2026, defines the two fields: “An EOL no sooner than date: the model will not reach EOL before this date” and “The Legacy period: the notice period before EOL.” Archived copy of the card: 20260919175108, which carries the same line. The launch post does not state the retirement terms. The document is the live card; the record copy is the archive; what the fields mean comes from the lifecycle page.

[4] Bedrock lifecycle page as archived on September 3rd, 2026, Wayback copy 20260903155829: “Once a model launches on Amazon Bedrock, it will remain on Amazon Bedrock for at least 12 months before the EOL date.” and “A model will be in the Legacy state for at least 6 months before the EOL date.” The same sentences now sit on the Model lifecycle (Legacy) page, accessed September 19th, 2026, under the note “This page applies to all models launched on Amazon Bedrock before September 7, 2026.” The document is the archived copy; the independent confirmation is the live Legacy page.

[5] Author’s census of every model card linked from the Bedrock model cards index, fetched September 19th, 2026: 128 cards linked, 127 print lifecycle fields, 126 give “Legacy period: at least 6 months”, one (Kimi K3) gives 45 days; only GPT-6 Astra and Kimi K3 carry a launch date on or after September 7th, 2026. Examples: the Kimi K2.5 card, “Model launch date: Jan 27, 2026 EOL no sooner than: Jan 27, 2027 Legacy period: at least 6 months”; the DeepSeek V3.2 card, “Dec 01, 2025 … Dec 01, 2026 … at least 6 months”; the Qwen3 Coder Next card, “Feb 04, 2026 … Feb 04, 2027 … at least 6 months”. Of the six companies named in the advisory, five have models on Bedrock: DeepSeek (3 cards), Qwen (7), MiniMax (3), Z.AI (3) and Moonshot (3, including K3); StepFun has none. All eighteen cards other than K3 give a 12-month floor and “at least 6 months”. Spot-checked live on September 20th, 2026: the DeepSeek V3.2 card (”Dec 01, 2025 … Dec 01, 2026 … at least 6 months”), the GLM-5 card (”Feb 11, 2026 … Feb 11, 2027”) and the MiniMax M2.5 card (”Feb 12, 2026 … Feb 12, 2027”). Raw lines are kept with the piece’s working files. The index stood at 128 cards on September 19th and 127 on September 20th, after Claude Mythos Preview was delisted; no new card had appeared by September 20th.

[6] Bedrock Model lifecycle page, accessed September 19th, 2026, archived at 20260919173232: “This page describes the model lifecycle policy for models launched on Amazon Bedrock on or after September 7, 2026.” and “There are two Legacy periods: 6 months and 45 days. Most models have a 6-month Legacy period.” Dating: the Wayback index for the page lists copies on August 2nd, September 3rd and September 19th, 2026; the Legacy page’s first archived copy is September 9th, 2026, 22:35 UTC, and the Astra card in the new format was archived September 9th, 2026, 09:36 UTC. The Bedrock document history, accessed September 19th, 2026, has no entry for the change.

[7] Bedrock GPT-6 Astra model card, accessed September 19th, 2026: “Model launch date: September 8, 2026 EOL no sooner than: September 8, 2027 Legacy period: at least 6 months”. Archived on September 9th, 2026, at 20260909093622, which carries the same fields. The document is the live card; the independent confirmation is the archived copy. The OpenAI models came to Bedrock under the agreement Amazon announced on April 28th, 2026: “We are excited to announce that starting today, the latest OpenAI models will be available on Amazon Bedrock.” No comparable announcement names Moonshot; its listed tie to AWS is a Marketplace seller page (note [12]).

[8] The statute is Public Law 119-60, the National Defense Authorization Act for Fiscal Year 2026, enacted December 18th, 2025, Sec. 1532: “Not later than 30 days after the date of the enactment of this Act, the Secretary of Defense shall require the exclusion and removal of covered artificial intelligence from the systems and devices of the Department of Defense.” The Senate’s FY2027 bill, S. 4784 as reported, Sec. 1651, would amend Sec. 1532 to add AI developed by Moonshot AI among others; as reported, not enacted. Its cloture vote on the motion to proceed failed 50–46 on July 14th, 2026 (Senate roll call 195, accessed September 19th, 2026). Both are discussed, with their texts, in Selective Availability.

[9] Moonshot AI, Kimi K3 licence, section 2, accessed September 19th, 2026: “the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose”, applying to a Model-as-a-Service operator whose aggregate revenue with affiliates exceeds $20 million over any consecutive 12 months; Moonshot’s “certified inference partners” are exempt. The same text is in Moonshot’s GitHub copy of the licence, accessed September 19th, 2026, identical apart from whitespace. Neither AWS page states whether an agreement exists.

[10] AWS News Blog, “DeepSeek-R1 models now available on AWS“, January 30th, 2025: “We highly recommend integrating your deployments of the DeepSeek-R1 models with Amazon Bedrock Guardrails to add a layer of protection for your generative AI applications.” Its Bedrock card, accessed September 19th, 2026: “Model launch date: Jan 20, 2025 EOL no sooner than: Jan 20, 2026 Legacy period: at least 6 months”.

[11] The negative search is the author’s, rerun September 19th, 2026. The Federal Register documents API, publication dates January 1st to September 19th, 2026, returns 0 documents for “Moonshot AI” (the bare word “Moonshot” returns Defense Production Act notices that use the word, not the company). The eCFR search API over Title 15, which holds the Entity List, returns 0 for “Moonshot”. The one statute that bans a Chinese model, Public Law 119-60, names DeepSeek and covers Pentagon systems and contract work (note [8]), and S. 4784 is not law. A registry search can only see rules; the same search was first run for Selective Availability through September 10th, 2026.

[12] Anthropic, threat intelligence report, September 2026, published September 10th, 2026, accessed September 19th, 2026: “We discovered that Moonshot AI, the company that produces the Kimi family of models, silently forwarded customer requests to Claude, instead of processing them using Kimi.” The commitment is Anthropic’s own, in “Anthropic and Amazon expand collaboration for up to 5 gigawatts of new compute“, April 20th, 2026, accessed September 19th, 2026: “We are committing more than $100 billion over the next ten years to AWS technologies, securing up to 5GW of new capacity to train and run Claude.” Amazon’s post of the same day gives the same figure. AWS Marketplace lists the “Kimi API Platform“, seller “MOONSHOT AI”, delivered as software as a service through private offers and covering K3 among other Kimi models, accessed September 19th, 2026; the page’s embedded data gives a creation date of June 3rd, 2026. It is Moonshot’s service, not Bedrock’s. Moonshot’s statement of September 12th, 2026, on its official Weibo account, as quoted by Kocpc on September 13th, 2026: “近日網傳關於公司創辦人及員工的相關資訊純屬虛構，係惡意造謠。月之暗面已第一時間向公安機關報案” (author’s translation: information circulating online about the company’s founder and employees is pure fabrication and malicious rumour; Moonshot has reported it to the police). The statement does not address the advisory or Anthropic’s allegation; searches in English and Chinese on September 19th, 2026 found no Moonshot statement that does.

[13] Microsoft, “Foundry Models lifecycle and support policy“, updated July 24th, 2026, accessed September 19th, 2026: “Generally available models from Anthropic, DeepSeek, Fireworks, and Mistral AI follow a 12-month lifecycle instead of the standard 18-month lifecycle.” and “If a model is found to have compliance or security issues, Microsoft reserves the right to invoke an emergency retirement with shortened notice.” GA retirement notice: “At least 60 days before retirement”. The catalogue entry is FW-Kimi-K3, accessed September 19th, 2026: “Generally available”, publisher Fireworks, created by Moonshot AI.

[14] Microsoft, “Model retirement schedule“, updated September 14th, 2026, accessed September 20th, 2026, under “Foundry Models from partners and community”, Fireworks: “Fireworks models on Standard (Per-Token) inference offerings are subject to a 15-day notice period prior to model retirement.” Every Fireworks row on that page carries the same retirement date, 2027-07-01, including FW-Kimi-K2.5, FW-DeepSeek-V3.2 and FW-GLM-5; FW-Kimi-K3 is in the catalogue but has no row on the schedule yet. This page is more recent and more specific than the policy page in note 13, and it governs: the 12-month lifecycle in that policy is not what a Fireworks-served model gets on notice.

[15] Andy Jassy, 2024 letter to shareholders, accessed September 20th, 2026, closing line: “It remains Day One.” Jassy’s 2025 letter, published April 2026, reprints the 1997 letter in full (”this is Day 1 for the Internet and, if we execute well, for Amazon.com”).

[16] Our earlier piece: Amazon Priced the Frontier and Declined It, July 29th, 2026: “the durable position is always the meter”, and “AWS doesn’t mark Claude up.”

[17] The wording is AWS’s own, posted to its Health Dashboard on March 1st, 2026 and reported on the wire that morning; our piece Objects That Struck the Data Center, March 2nd, 2026, quotes it and sets it against that week’s IRGC barrage on the UAE. AWS named the cause in a dashboard post the following day: two UAE facilities “directly struck by drones”, a third in Bahrain hit by “a drone strike in close proximity”, as reported by DataCenterDynamics on March 3rd, 2026 (read September 20th, 2026 in the Wayback copy of May 28th, 2026, the site refusing automated requests) and by CBS News on March 3rd, 2026, accessed September 20th, 2026: “Drones directly struck two Amazon Web Services facilities in the United Arab Emirates, and a drone strike near an Amazon data center in Bahrain also damaged that facility, the company said in a post on Monday on AWS’s health dashboard.” AWS has not attributed the strikes to Iran; our March piece calls the correlation “strong but circumstantial” and notes the site may have been hit by intercepted debris rather than directly. That piece dates the update at “seventy-two hours”; the statement it describes came the evening of March 2nd, about a day and a half after the first report.

[18] Corey Quinn, “AWS would prefer to forget March ever happened in its UAE region“, The Register, March 26th, 2026, accessed September 20th, 2026, on the billing-waiver email: “No explanation. No mention of the Iranian drone strikes that physically destroyed two of three availability zones in the region on March 1st.”

On September 8th, 2026, the NSA, CISA, and the FBI published a joint advisory about Chinese AI companies extracting capabilities from American models.[1] It runs to eighteen pages, names six companies, and is mostly what you’d expect. One recommendation isn’t, and I think it’s the most important thing in it. If you buy tokens from an American AI lab, it’s about you.

The second of the three things the advisory asks American AI companies to do right away is this:

“Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.”[2]

Page fourteen says what that looks like:

“Reducing reasoning depth, presenting correct information with different reasoning, or stylistic inconsistencies may evade detection while reducing training usefulness.”

And right after that, it says who shouldn’t be told:

“Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model.”[3]

Why should you care if you’re not a Chinese lab? Because of how a provider is supposed to spot one. The advisory tells providers to monitor “immediate maximum usage from new accounts, and enterprise-scale throughput patterns”, and lists “usage optimized for cache maximization versus task diversity”.[4] That describes a lot of ordinary production traffic, for example, a batch job moved to a new account that runs one cached prompt over a large corpus at full volume from day one. Vendors tell you to cache: OpenAI’s guide says “Keep the prefix stable.”[5] And distillers often come in on somebody else’s account: the proxy services they route through, Anthropic says, “often use stolen API credentials belonging to legitimate companies or individuals”.[6] Degrade that traffic, and the company paying for the key gets the worst answers, with nothing in the advisory saying anyone should tell it.

Google and Anthropic have both publicly said that they make what distillers get less useful. What matters is whether they tell the account. Anthropic’s help page for its newest models says it does, at least when a safeguard blocks a request, distillation attempts included: in its apps “you’ll see a notice explaining that the model switched, and the response will be labeled with the model that answered”, and on the API the response comes back with a stop reason.[7] Google’s Gemini API documentation, which never mentions distillation, reserves the right to change “which model answers a specific request” and says Google “may reach out to you through email”, not that it will.[8] So ask your account manager two questions. Do you alter answers for accounts you suspect? Would you tell me if I were one of them?

Who says so?

The advisory’s central claim is that distillation “is not a supplement to these companies’ AI model development, but the critical core of it.”[9] It names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and says they have processed “billions of tokens across millions of exchanges/requests” since at least late 2024.

So what’s the evidence? The eight references are all public: three come from companies that say they were targeted (Anthropic, Google and OpenAI), and the rest are a NIST taxonomy, a trade article, two White House memoranda and a post on X.[10] Nothing in the list is the agencies’ own work (for example, telemetry, a seizure, or an indictment), and the White House memo on distillation says the government “has information” without showing any of it. StepFun, Z.AI, and GPT-oss-20b appear in none of them.

Is the distillation happening? It may well be. Anthropic’s February post is specific in a way the advisory isn’t: about 24,000 fraudulent accounts and more than 16 million exchanges, attributed to three labs.[11] Compared with that, the advisory adds three more company names, longer lists of the models it says were used, detection signals, mitigations, and one instruction.

And most of what it recommends only works while the model sits behind an API, which it never says.

Twelve of the seventeen measures only work at the front door

The advisory makes seventeen recommendations: eleven from a MITRE catalog, three in its own prose, and three from a NIST taxonomy.

Twelve of them do nothing unless the attacker’s requests hit infrastructure the provider runs, i.e., rate limiting, authenticated access, logging, output obfuscation, ensembles, query detection, and input sanitization.[12]

Picture the same model downloaded and running on somebody else’s hardware. What’s left? There’s no quota to enforce, no log to write, no answer to degrade, and no way to know whose inference it is. Two measures survive the download, and they’re the same idea filed under two frameworks: safety training baked into the weights before release.[13] Anyone who holds the weights and is willing to tweak could strip that out, and the advisory doesn’t discuss it.

On the weights themselves, there’s exactly one line, AML.M0001:

“Limit Model Artifact Release: Limit release of data, algorithms, architectures, and model checkpoints.”[14]

Search the eighteen pages for “weights”, “open-weight”, “open source” or “publicly available,” and you get nothing; “checkpoint” shows up once, inside that one line.[15]

MITRE’s own catalog is less shy. One of its entries, AML.M0017, spells the assumption out:

“Deploying AI models to edge devices can increase the attack surface of the system. Consider serving models in the cloud to reduce the level of access the adversary has to the model.”[16]

The advisory copied ten identifiers from that catalog and skipped this one. Oops.

Exhibit A was a free download

The Moonshot section lists eighteen models the advisory says the company used “to distill SFT optimization, reinforcement learning (RL), software engineering, and math capabilities”. Most are what you’d expect (six Claude variants, several GPT and Gemini releases, Grok Code Fast-1), and one of them is GPT-oss-20b.[17]

GPT-oss-20b is OpenAI’s own open-weight model, released in August 2025 under the Apache 2.0 license. It isn’t gated; it was downloaded about 6.5 million times in the last thirty days, and its license permits the use described in the advisory.[18]

So what in the document reaches that row? Almost nothing. That leaves AML.M0001 (limit what you release), and OpenAI decided the other way thirteen months ago.

February’s version had a clause for customers

The idea wasn’t the agencies’. On February 12th, Google wrote that its defenses “can degrade student model performance” [19], and on February 23rd, Anthropic described what it was building: “Product, API and model-level safeguards designed to reduce the efficacy of model outputs for illicit distillation, without degrading the experience for legitimate customers”[20]

That last clause is as close as either post comes to a promise: legitimate customers aren’t meant to pay for the defense.

Both posts are in the advisory’s reference list [10], and the agencies changed two things: the promise shrinks to “lower-to-no legitimate user risk”, and next to it sits an instruction not to tell. The degradation was publicly proposed by vendors and defended on its merits. The instruction not to tell is the agency’s own.

The agencies do give a reason for it in the next sentence: “Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training.”[3] The distillers know the defenses exist, if not when one hits them. Google and Anthropic said so in February, and in April the White House warned that, as defenses improve, distillers “should have little confidence in the integrity and reliability of the models they produce”.[21] And page 10 says China-based entities already run test pipelines that separate “service issues from defensive data degradation”, which is why page 14 suggests changes subtle enough to get past them. A change built to fool a lab’s test pipeline would fool a customer’s tests too. So the silence keeps two groups in the dark: the distillers and the paying customers.

Two sentences on, the advisory concedes what this costs: “In contrast, AI safety researchers and third-party evaluators should be informed of model changes while still applying strong distillation mitigations.”[3] Why tell the evaluators? Because the defense changes what they would measure, even if the carve-out only means to mark researchers as friends.

What about you, as a buyer? The notice covers “AI safety researchers and third-party evaluators”. Not you. And I wouldn’t count on your own tests to cover it: in a survey LangChain ran at the end of 2025, 22.8% of the respondents with agents already in production said they weren’t evaluating them.[22]

Who does the section cover? It’s headed “Response alteration for suspected distillation activity”, it opens on “high-confidence malicious distillation requests”, and its implementation paragraph starts “When suspecting a malicious distillation campaign”. None of the three names a nationality. The instruction not to tell comes twice: first for China-based users, then, right after the agencies’ reason, “Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them.”[23] Read with the sentence before it, which may be intended only for Chinese users. Read on its own, it covers anyone the provider has “confirmed”, by a standard the advisory never gives.

The advisory knows this can catch the wrong people. In its section on sharing indicators, it says correlated activity justifies degradation “with lower-to-no legitimate user risk”.[24] It gives no false-positive rate anywhere.[25] The providers’ own safety filters suggest it wouldn’t be zero: Anthropic says of its improved biology safeguards that “there will inevitably remain false positives”, and OpenAI says its agent’s safeguards “will sometimes accidentally prevent safe uses of the product”.[26] Those aren’t distillation detectors, but Anthropic calls the blocking safeguards that catch distillation attacks “intentionally broad”.[7] Some paying customers would likely get worse answers by mistake. The agencies know it, and what they offer those customers is a better guess about who they are, not a warning.

The last time Washington degraded a service, it said so

The United States deliberately degraded the civilian GPS signal until midnight on May 1st, 2000, and the point is how it stopped. The President announced it: “The United States will stop the intentional degradation of the Global Positioning System (GPS) signals available to the public beginning at midnight tonight. We call this degradation feature Selective Availability (SA).”[27]

So the degradation had a name, a directive behind it, a 2006 deadline, and a President announcing it would end early. And Washington kept the capability and said so in the same statement: “We have demonstrated the capability to selectively deny GPS signals on a regional basis when our national security is threatened.”

Two things in Washington’s favor: it ran GPS itself, whereas here it only advises private firms about their own products, and Selective Availability was fixable with differential GPS, so candor cost less than it looks. Still, the GPS error was global, bounded, published, and correctable, and an altered answer is none of those.

I’ve mapped the off switches in the AI stack before, as three: chips, cloud, and models.[28] What the three have in common is that you can see them. A revoked license, a suspended tenant, or a blocked region each leaves a record that someone can point to.

Degrading answers for accounts a provider suspects is a fourth lever, underneath the other three, and it leaves no record the customer can see. GPS shows the government understood that people whose service it degrades should be told. The 2026 recommendation pulls the same lever and says to tell only the evaluators.

What the agencies would say, and where they’re right

The agencies have a good answer, and it starts with what kind of document this is.

A joint cybersecurity advisory is written for defenders about controls. This one opens by granting that distillation is “recognized as a legitimate and useful technique in AI research”, and it recommends instead of requiring.[29] Focusing on the serving path is the genre doing its job. So is the sourcing: an unclassified product cites open material by convention, so the reference list shows what convention produces, not what the agencies know. And the threat it documents really does run through APIs.

Nor do the two White House memoranda it cites go after the weights: the one on distillation says the United States “will continue to foster a vibrant open-source ecosystem built on firm foundations”, and saves its fire for models “derived from acts of malicious exploitation”.[30] And degrading answers isn’t obviously wrong either. On the advisory’s own account, these are fraudulent accounts, opened in breach of the terms of service, and a provider that makes its product less useful to someone abusing it is enforcing a contract.

Washington has also told private firms to keep quiet about suspects before: a bank that reports a suspicious transaction may not tell the customer. But the bank hides the report, not what happens to you, because a blocked wire or a closed account is hard to miss. And on September 2nd, six days before this advisory, five federal agencies said a bank may tell a customer that a restriction or closure “may be related to suspected fraud or other suspicious activity”.[31] This advisory wants its changes to “avoid triggering obvious alerts”.

Anyone who has run an API bill will raise the strongest objection of all: you could never verify these outputs anyway. Models get swapped behind a stable name, quantization changes, requests get routed by load, and safety filters move. The vendors admit some of it: OpenAI didn’t proactively announce the GPT-4o update it pulled from ChatGPT in April 2025, “because we expected this to be a fairly subtle update”, and Anthropic’s docs say the weights under a model ID are fixed, but “the serving infrastructure around the model can change over time”.[32]

Fair point, and I wouldn’t promise anyone the same answer twice from a hosted model. But a change that hits every customer is one thing: somebody notices, and OpenAI began rolling that update back three days later. A change that is deliberate, aimed at particular accounts, built to be hard to spot (for example, shallower reasoning that still lands on the right answer), and recommended by three agencies, with a note not to mention it is another, and a buyer shouldn’t treat the two alike.

On September 9th, China’s commerce ministry said the accusations have “no basis in fact or law”, that distillation is “a neutral technical means” used by model makers worldwide, American ones included, and that if Washington moves against Chinese AI companies “in the name of fighting distillation”, China “will resolutely take countermeasures”.[33]

A rule for the Pentagon, advice for everyone else

I’ve argued before that rules bind the people who were never the threat.[28] This advisory is what the next step looks like.

Inside the administration, the direct route has reportedly been tried and has gone nowhere. Axios reported in July 2026, citing sources close to the administration, that during 2025 it considered an executive order, an Entity List designation, an agency advisory, and Commerce rules to restrict Chinese models, and killed every one; the same piece reports the momentum coming back.[34] In August, Axios reported that an unpublished White House framework says nothing in it should be read as restricting open models once they’re released.[35]

Executive Order 14409 of June 2nd, 2026, may appear to close that route. It says nothing in its section “shall be construed to authorize” a mandatory licensing, preclearance, or permitting requirement for new models. That’s a rule about how to read one section, not a ban on rulemaking, and the subsection above it orders agencies to design a voluntary framework in which developers could give the government up to thirty days with a covered frontier model before releasing it to other trusted partners.[36] So machinery aimed at the model itself has been ordered, just not made mandatory.

Congress went further, but only for government systems and Pentagon contractors. The Defense Authorization Act signed in December 2025 orders DeepSeek’s AI out of Pentagon systems, bars Pentagon contractors from using it on their contract work, and bans the DeepSeek app from intelligence-agency systems. The Senate’s bill for next year would add Zhipu, Moonshot, MiniMax and Alibaba, among others.[37] For a company deploying these models in its own business, I can’t find a rule: the Federal Register for 2026 has no document naming DeepSeek, Moonshot, MiniMax, StepFun or Zhipu,[38] and Senator Hawley’s S. 321, which would ban importing AI “developed or produced in the People’s Republic of China”, hasn’t moved since it went to committee.[39]

The Entity List binds too. In January 2025, under the previous administration, the Commerce Department put ten companies on it, seven of them carrying the Zhipu name, on the basis that they advance Chinese military modernization through AI research; the advisory’s own table gives Z.AI the Chinese name of the first of them.[40] But that’s an export control: it requires a license for items subject to US export rules when going to Zhipu, and does nothing to address an American company downloading GLM weights and serving them in its own business.

So, beyond those, no rule applies to the weights. What arrived instead is a recommendation, in a document that binds nobody, that providers quietly degrade answers for accounts they suspect. That’s slower than a rule, and it leaves no public record.

If I were buying tokens today

I’d do two things.

The first is a test. You can’t prove from outside that you get the model the vendor sells, but you can look for a weaker one: take a fixed set of prompts from your real traffic, hold the parameters, and run each prompt several times a day from your production account and from one registered and paid for separately and ramped up slowly (new accounts at full use and shared payment details are both on the advisory’s watch list). Compare scores, not single answers. Single answers change for innocent reasons (OpenAI’s caching guide says “identical requests are not guaranteed to produce identical outputs”), while a weaker model should show up in the scores. Shallower reasoning that still lands on the right answer may not, but it may show up as a lower average in the reasoning tokens that OpenAI, Anthropic, and Google report.[42] A change aimed at one account can appear as a gap between the two; a model update appears in both. A 2024 academic test found that 11 of 31 commercial Llama endpoints produced outputs that didn’t match Meta’s released weights. I’d keep it small because accounts sending identical prompts are also on that list.

The second is a clause. OpenAI’s standard agreement already promises an email and a right to walk away if an update “materially reduces the Services’ functionality”. Limiting your account falls under another section, which asks only for “reasonable efforts to notify” and allows it “without prior notice to the extent reasonably necessary”.[43] Ask for the first promise to cover the second case. If that sounds like a big ask, it’s what Washington demands for itself: its national security AI memo tells the national security enterprise to make sure, “through contractual clauses or other means”, that no vendor can “disable or degrade, or materially modify without Federal Government knowledge and approval” the AI its people depend on.[30]

And there’s one setup where the question never comes up: a model you run yourself, the simplest arrangement in which you can show nothing was altered, because you served it. That used to be an argument about cost and control; now it’s also about proving what your own system did.

In June, I wrote that “the tighter Washington shuts its door, the more of the world’s usage walks out the back.”[44] That was about Washington gating its own frontier models; quietly degraded answers could send buyers the same way.

Leave the API alone, and the extraction carries on on the agencies’ own account. Act on the API as this advisory recommends, and the instruction not to tell turns the American product into one a buyer can’t easily check from the outside, even when applied narrowly. Meanwhile, a model already published as open weights, like GPT-oss-20b, is untouched because there’s no interface to access it.

Most of what Washington advises against distillation works only at the American API, and its advice there is to degrade answers quietly for accounts the provider suspects. In 2000, the President announced when the degradation would stop. If this one starts on your account, it’s built not to be noticed.

Notes

[1] NSA, CISA and FBI, joint cybersecurity advisory AA26-251A, “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies“, released September 8th, 2026. The record copy is the 18-page PDF, U/OO/6059854-26, TLP:CLEAR, marked Ver 1.0; media.defense.gov returns HTTP 403 to automated fetch, and the copy read for this piece is the Wayback Machine capture of September 9th, 2026. PDF and HTML were compared in full and agree on every passage quoted here.

[2] The advisory, Executive summary, page 2: “The authoring agencies recommend U.S. AI companies take three immediate actions”, of which the second is “Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” The other two are detection and mitigation, and cross-organization intelligence sharing.

[3] The advisory, “Implementation strategies”, a subsection of “Response alteration for suspected distillation activity”, pages 13 and 14. Two sentences separate the passages quoted here: “Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training.” and “Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them.”

[4] The advisory, executive summary, page 2, the first of the three immediate actions: “monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns”. And “Novel TTP 4: Systematic quota and cost optimization”, which starts on page 12 and whose detection indicators on page 13 include “usage optimized for cache maximization versus task diversity”. Quoted verbatim from the record-copy PDF, September 10th, 2026; pages rechecked September 11th, 2026.

[5] OpenAI, “Prompt caching“ guide, retrieved September 11th, 2026: “Keep the prefix stable.” Anthropic and Google publish equivalent guidance.

[6] Anthropic, “Detecting and countering misuse of AI: September 2026“, dated September 10th, 2026 in the PDF, section “Illicit distillation and scaled abuse”, retrieved September 11th, 2026: “These labs generally access Anthropic’s models by routing requests through proxy services, also known as “transfer stations.”“ Of those proxy services: “They will often use stolen API credentials belonging to legitimate companies or individuals to give unauthorized entities access to US frontier models.” On its response: “When we are confident that a set of requests are associated with an illicit distillation campaign or other unauthorized use of Claude, we block the request and ban the associated accounts”, and “when we detect signals of potential abuse, like the unauthorized resale of Claude or accounts operating from unsupported countries like China, Russia, and Iran, our systems can require users to verify their identity to retain access.” The report does not mention the advisory, and gives no false-positive rate. The same section: “Zhipu eventually gave up trying to target Fable after Anthropic’s cyber safeguards degraded Zhipu’s attacks.”

[7] Anthropic Help Center, “Why Claude switched models in your conversation with Fable 5 or Fable 5.1“, undated, retrieved September 11th, 2026. The blocking triggers listed include “Distillation attacks on Fable 5 and Fable 5.1, including attempts to extract the model’s summarized thinking”, and “These blocking safeguards are intentionally broad”. On the API, “Until fallbacks are configured, the model will return a 200 response with a stop reason”.

[8] Google, Gemini API “Abuse monitoring“, last updated June 9th, 2026, retrieved September 11th, 2026: “Temporary usage limits: We may limit your access to the Gemini API by adjusting rate limits or changing which model answers a specific request, for example.” The page promises an appeal link for suspension or account closure: “If we reach out to you regarding a suspension or account closure, we will also provide a link where you can appeal.” Google Threat Intelligence Group, “GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“, September 8th, 2026, retrieved September 11th, 2026: “we have deployed real-time defenses designed to degrade the performance of unauthorized “student” models and detect attempts to clone proprietary logic”, “we have developed and successfully deployed numerous methods to both lower the utility of these campaigns, and block the accounts responsible”, and “we have developed techniques to identify Gemini-distilled models, enabling us to trace the provenance of models derived from our technology”. The post says nothing about notifying accounts and does not mention the advisory. The abuse-monitoring page lists, before usage limits, “Get in touch: We may reach out to you through email to understand your use case and explore ways to bring your usage into compliance.” It does not mention distillation.

[9] Advisory, Attribution section, page 3. The second quotation, “billions of tokens across millions of exchanges/requests”, is in the executive summary on page 1, in a sentence that opens “Likely with Chinese government awareness”.

[10] The advisory, References, retrieved September 10th, 2026. The eight listed sources are Anthropic’s distillation post, Google’s GTIG AI Threat Tracker, NIST AI 100-2e2025, OpenAI’s “RE: Updated Stakes for American-Led, Democratic AI”, an article in The Decoder on the gray market in Claude tokens, National Security Presidential Memorandum 11, National Science and Technology Memorandum 4 (”Adversarial Distillation of American AI Models”), and a post on X by the Office of Science and Technology Policy. The OpenAI item is a memo, not a letter to an agency: its header reads “To: US House Select Committee on Strategic Competition between the United States and the Chinese Communist Party / From: OpenAI / Date: February 12, 2026 / Re: Updated Stakes for American-Led, Democratic AI” (OpenAI CDN PDF, retrieved September 10th, 2026; Wayback capture), and the receiving committee’s own hearing record of April 16th, 2026 confirms it: “In February 2026, OpenAI delivered a memo to this Committee”. The advisory’s hyperlink for the item points not at OpenAI but at a Bloomberg-hosted copy, whose first page is identical. Read in full for this piece: the Anthropic and Google posts, the OpenAI memo, The Decoder’s article, NSPM-11, NSTM-4 and the post on X, which is from the account @mkratsios47, July 22nd, 2026, read through a mirror of X’s API: “We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model.” NIST AI 100-2e2025 was read by the desk’s fact-check the same day. Search of all eight, September 11th, 2026: StepFun, Z.AI, Zhipu and gpt-oss appear in none of them. The account @mkratsios47 is that of Michael Kratsios, Director of the Office of Science and Technology Policy. NSTM-4, April 23rd, 2026, is a scanned PDF, read by optical character recognition: “the United States government has information indicating that foreign entities, principally based in China, are engaged in deliberate, industrial-scale campaigns to distill U.S. frontier AI systems.” OpenAI’s memo on its own practice: “We proactively remove users who appear to be attempting to distill our models to develop competitive models to OpenAI.”

[11] Anthropic, “Detecting and preventing distillation attacks“, February 23rd, 2026: “These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts”. The three labs named there are DeepSeek, Moonshot and MiniMax; the advisory of September names six.

[12] Author’s count from the advisory, verified independently by a second pass over the same document. The seventeen are eleven MITRE ATLAS bullet entries (ten unique identifiers, AML.M0015 printed twice with different descriptions), three prose subsections under “Mitigations”, and three NIST AI 100-2e2025 items. The three prose subsections are the third-level headings “Behavioral detection and monitoring”, “Response alteration for suspected distillation activity” and “Cross-organization information sharing and ecosystem coordination”; “Implementation strategies” is a fourth-level heading inside the second of them, not a section of its own, and the three map one-to-one onto the three immediate actions on page 2. Twelve require the request to reach provider-operated infrastructure: AML.M0015 twice, M0004, M0019, M0024, M0002, M0006, all three prose subsections, and the NIST differential-privacy and prompt-formatting items. Counting only unique identifiers gives 11 of 16; every defensible recount leaves a majority.

[13] Advisory, AML.M0003 (”Use adversarial training and defensive distillation to increase jailbreak difficulty”) and the NIST pre- and post-training interventions. Both describe safety properties trained into the weights, which travel with the artifact and can be removed by fine-tuning; the advisory does not address removal. OpenAI’s gpt-oss model card: “Once they are released, determined attackers could fine-tune them to bypass safety refusals or directly optimize for harm without the possibility for OpenAI to implement additional mitigations or to revoke access.”

[14] Advisory, MITRE ATLAS mitigations, page 15.

[15] Author’s search of the record-copy PDF text and, independently, of the CISA HTML rendering, case-insensitively, September 10th, 2026. Counts identical in both: “weight” as a substring 0, “open source” 0, “open-source” 0, “publicly available” 0, “checkpoint” as a substring 1. The word “publicly” does appear twice, both as “publicly quoted”, about DeepSeek’s training cost.

[16] MITRE ATLAS mitigation AML.M0017, “AI Model Distribution Methods”, read from MITRE’s ATLAS data release v2026.08 on September 11th, 2026. That release carries thirty-nine mitigation identifiers, and its release notes say “39 mitigations”. The advisory cites ten of them, AML.M0035 included, and AML.M0017 is not among the ten. An earlier read of the deprecated dist/ATLAS.yaml, which “will no longer be updated”, counted thirty-five and lacked AML.M0035; the text of AML.M0017 is the same in both.

[17] The advisory, Moonshot AI section, page 4, continuing to page 5, and again in Table 1 on page 6. Table 1’s version of the list omits GPT-4o, so the prose carries eighteen models and the table seventeen. Two of the eighteen entries, “Gemini 2.5 Flash-Image” and “Nano Banana”, are the same model (Google, August 26th, 2025), so the prose list covers at most seventeen distinct models.

[18] Hugging Face API record for openai/gpt-oss-20b, retrieved September 10th, 2026: licence apache-2.0, created August 4th, 2025, gated false, 6,551,191 downloads in the trailing thirty days. Confirmed independently against OpenAI’s gpt-oss model card: “We release the model weights, inference implementations, tool environments, and tokenizers under an Apache 2.0 license.”

[19] Google Threat Intelligence Group, “GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use“, February 12th, 2026, the second entry in the advisory’s reference list, retrieved September 11th, 2026: “Google continuously detects, disrupts, and mitigates model extraction activity to protect proprietary logic and specialized training data, including with real-time proactive defenses that can degrade student model performance.” Reducing the fidelity of model outputs was in MITRE’s ATLAS catalogue well before either post (AML.M0002, created April 2023, cited by the advisory).

[20] Anthropic, “Detecting and preventing distillation attacks“, February 23rd, 2026, under “Countermeasures”, retrieved September 10th, 2026.

[21] The White House’s NSTM-4, “Adversarial Distillation of American AI Models”, April 23rd, 2026, read by optical character recognition of the scanned PDF on September 11th, 2026: “As methods to detect and mitigate industrial-scale distillation grow more sophisticated, foreign entities who build their AI capabilities on such fragile foundations should have little confidence in the integrity and reliability of the models they produce.” The advisory, page 10: “China-based entities deploy production-grade automated quality assurance pipelines with multi-modal validation, enabling rapid detection of degraded outputs and differentiation of service issues from defensive data degradation.”

[22] LangChain, “State of Agent Engineering“, retrieved September 11th, 2026: a public survey run from November 18th to December 2nd, 2025, “We received 1340 responses”, 63% of them in technology. Overall, “not evaluating” is 29.5%, and 22.8% among teams with agents in production; 52.4% run offline evaluations on test sets. The respondents chose themselves, and LangChain sells evaluation tools.

[23] Advisory, “Response alteration for suspected distillation activity” and its “Implementation strategies” subsection, pages 13 and 14. The section’s triggers are “high-confidence malicious distillation requests” and “When suspecting a malicious distillation campaign”; neither carries a nationality qualifier. One sentence separates the China-scoped sentence from the unscoped one quoted here: the advisory’s stated reason for the secrecy.

[24] Advisory, “Cross-organization information sharing and ecosystem coordination”, page 14; two more sentences follow it.

[25] Author’s search of the record-copy PDF and the CISA HTML rendering, September 10th, 2026: “false positive” appears 0 times, “error rate” 0 times, and the document contains no percentage or rate figure of any kind. Its treatments of wrongly flagged customers are qualitative: under AML.M0002 on page 15, “Reduce fidelity of responses (withhold logits/confidences, shorten responses, targeted redaction). Balance security with user experience.”, and “lower-to-no legitimate user risk” in “Cross-organization information sharing and ecosystem coordination”.

[26] Anthropic, “Improving Fable 5’s biology safeguards“, August 7th, 2026: of the improved classifier: “There will inevitably remain false positives”. Of the launch version it replaces: “We knew this would be frustrating for legitimate biology users: it would result in a high number of false positives in the near term, where users asking biology-related questions would have their requests blocked and sent to a less capable model.” OpenAI, “ChatGPT Agent System Card“, July 17th, 2025: “This means that our safety mitigations will sometimes accidentally prevent safe uses of the product.” Both retrieved September 11th, 2026. Both describe safety classifiers for biological risk, not distillation detectors, and neither gives a false-positive rate on live traffic.

[27] The White House, Office of the Press Secretary, “Statement by the President Regarding the United States’ Decision to Stop Degrading Global Positioning System Accuracy“, May 1st, 2000, retrieved September 10th, 2026 from the National Archives’ frozen copy of the Clinton White House site. The accuracy figure is the statement’s own: civilian users “will be able to pinpoint locations up to ten times more accurately than they do now”, a 10x improvement, quoted rather than derived. The statement records the March 1996 Presidential Decision Directive behind the policy, the commitment to discontinue Selective Availability by 2006, and that the decision followed a recommendation by the Secretary of Defense in coordination with State, Transportation, Commerce and the Director of Central Intelligence. On the error’s shape: the White House fact sheet of the same day, “Improving the Civilian Global Positioning System (GPS)“, says the United States used Selective Availability “to globally degrade the civilian GPS signal”, that “Previously, a GPS-based car navigation could give the location of the vehicle to within a hundred meters”, and that the policy was to make “both the signal and the receiver design specification available to the public completely free of charge”. GPS.gov’s Selective Availability FAQ (updated October 2001, read through the Wayback Machine) says “Selective Availability was a global degradation of the GPS service. It could not be applied on a regional basis.”, and, asked whether differential GPS was more accurate once SA ended, “No. There should not be much change in the accuracy of DGPS.” Both retrieved September 11th, 2026.

[28] “Access, Disable, Destroy“, March 7th, 2026, which mapped the three-switch model over chips, cloud and models, and coined governance for the governed: “all of it is governance for the governed. Rules for the rule-followers.” And “Objects That Struck the Data Center“, March 2nd, 2026: “Open-source model weights are not scarce — they are infinitely copyable at zero marginal cost.”

[29] Advisory, Purpose section and executive summary.

[30] Advisory, References. NSPM-11, “Artificial Intelligence in the National Security Enterprise”, June 5th, 2026, retrieved September 11th, 2026, tells the national security enterprise to “adapt commercial or open-source AI technologies” and to “ensure, through contractual clauses or other means, that no commercial entity or adversary possesses the capability to prevent use of, disable or degrade, or materially modify without Federal Government knowledge and approval, an AI system that our men and women depend on for their missions”. NSTM-4, “Adversarial Distillation of American AI Models”, April 23rd, 2026, read by optical character recognition of the scanned PDF on September 11th, 2026: “Consistent with America’s AI Action Plan, the United States will continue to foster a vibrant open-source ecosystem built on firm foundations”, and “there is nothing open about supposedly open models that are derived from acts of malicious exploitation”.

[31] 31 U.S.C. 5318(g)(2)(A)(i), Cornell LII, retrieved September 11th, 2026: a financial institution that reports a suspicious transaction may not “notify any person involved in the transaction that the transaction has been reported”. Board of Governors of the Federal Reserve System, FDIC, FinCEN, NCUA and OCC, “Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers“, issued with SR 26-5 on September 2nd, 2026, which lists as permitted “Notifying a customer that a delay, limitation, or restriction on an account or service or closure of an account may be related to suspected fraud or other suspicious activity”. On what the confidentiality has cost customers: GAO-18-263, February 26th, 2018, read through the Wayback Machinebecause gao.gov refuses automated fetch, estimated from its survey that “93 percent of Southwest border banks terminated accounts because of the filing of SARs”, and reported that people it met in three border communities said banks “terminated the accounts of longtime established customers, sometimes without notice or explanation”. The joint statement also says: “This statement does not alter existing Bank Secrecy Act (BSA) legal or regulatory requirements or establish new supervisory expectations.”

[32] OpenAI, “Expanding on what we missed with sycophancy“, May 2nd, 2025, read in a browser on September 11th, 2026 because openai.com refuses automated fetch: “On April 25th, we rolled out an update to GPT-4o in ChatGPT that made the model noticeably more sycophantic”, “We began rolling that update back on April 28th”, and “Because we expected this to be a fairly subtle update, we didn’t proactively announce it.” Anthropic, “Model IDs and versioning“, retrieved September 11th, 2026: “Model weights are fixed for a given ID, but the serving infrastructure around the model can change over time. This infrastructure includes components such as the request router, safety classifiers, and sampling logic.”

[33] Ministry of Foreign Affairs of the People’s Republic of China, “Foreign Ministry Spokesperson Mao Ning’s Regular Press Conference on September 9, 2026“, retrieved September 11th, 2026. AFP’s question: “Yesterday, the U.S. Cyber Defense Agency accused top Chinese AI labs, including DeepSeek and Moonshot of stealing the capabilities of U.S. models.” China’s Ministry of Commerce, “商务部新闻发言人就美发布中国人工智能企业对美蒸馏活动相关网络安全公告答记者问“ (spokesperson’s answer on the US advisory on Chinese AI companies’ distillation), September 9th, 2026, 21:28, retrieved September 11th, 2026. The originals, in the author’s translation: “美方所谓中国人工智能企业从事”工业规模”蒸馏美模型的指控，于事无凭，于法无据” (the US accusation that Chinese AI companies engage in “industrial-scale” distillation of US models has no basis in fact or law); “蒸馏是人工智能领域各个模型间互相学习的通行做法，本质是中性技术手段，包括美企在内的全球模型企业都在用” (distillation is a common practice by which AI models learn from one another, in essence a neutral technical means, used by model companies worldwide, American ones included); “中方开源模型向包括美企在内的全球企业开放” (China’s open-source models are open to companies worldwide, American ones included); “如果美方以打击蒸馏为名，实施遏压中国人工智能企业的行动，中方必将坚决采取措施予以反制” (if the United States acts to suppress Chinese AI companies in the name of fighting distillation, China will resolutely take countermeasures). The ministry also says that American firms’ own model reports disclose extensive distillation of Chinese models (”美企有关模型研发报告也披露，其大量蒸馏中国模型”); that is the ministry’s claim, not checked here.

[34] Axios, “The secret Trump administration battle to fight Chinese AI”, July 20th, 2026, read via the Wayback capture of the same day: “Administration officials keen on keeping regulation from stifling innovation killed all of those efforts”, and “ban momentum is picking up again.” Axios attributes the account to “knowledgeable sources” and “a source close to the administration”. Unnamed sources; reported, not confirmed.

[35] Axios, August 5th, 2026, via the Wayback Machine: “The White House does not plan to publicly release the framework, which explicitly says nothing in it should be interpreted as restricting open models once they’ve been released”. The same piece reports the question “far from resolved”. Bloomberg reported the same development on the same date; only its opening paragraphs are readable without a subscription, so Axios is the source read in full here. The August 5th piece gives no source for the framework’s text beyond “Axios first reported”. Unnamed sources; reported, not confirmed.

[36] Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, signed June 2nd, 2026, published at 91 FR 34565, Sec. 3(c). The disclaimer is scoped to that section; Sec. 3(b) orders agencies to “design a voluntary framework with AI developers” through which developers could give the government access to covered frontier models “for a period of up to 30 days before they plan to release such models to other trusted partners”. CBS News, “White House framework for testing AI models remains hidden as concerns about threats mount“, September 10th, 2026, retrieved September 11th, 2026: “The White House finalized the framework by the beginning of August, following an executive order President Trump signed in June”; “Neither the administration nor the companies are required to release the results of the reviews or even say if they participated”; “Last week, OpenAI CEO Sam Altman said the company had submitted its powerful new Astra model for review”.

[37] Public Law 119-60, the National Defense Authorization Act for Fiscal Year 2026, enacted December 18th, 2025, text at GovInfo, retrieved September 11th, 2026. Sec. 1532: the Secretary of Defense “shall require the exclusion and removal of covered artificial intelligence from the systems and devices of the Department of Defense”, and “no contractor may, during the period of performance of such contractor under a contract with the Department of Defense, use covered artificial intelligence with respect to the performance of a contract with the Department”; “covered artificial intelligence” means “any artificial intelligence, or successor artificial intelligence, developed by the Chinese company DeepSeek” or by High Flyer. Sec. 1532(a)(2) lets the Secretary extend this by guidance to any “covered artificial intelligence company”, which includes companies on the Consolidated Screening List or “domiciled in a covered nation”. Sec. 6604, “Prohibition on use of DeepSeek on intelligence community systems”, covers “the DeepSeek application or any successor application or service”. The Senate’s bill for fiscal year 2027, S. 4784 as reported (Report No. 119-127), Sec. 1651, amends Sec. 1532 to add AI “developed by the Chinese company” Baidu, Zhipu AI, Moonshot AI, 01.AI, “Mistral-rival Minimax”, Alibaba and Tencent, and to make the guidance mandatory; its bill-status record shows a motion to proceed on July 27th, 2026. The House passed its own bill, H.R. 8800, on July 22nd, 2026, by 216 to 212; its text does not name these companies.

[38] Two independent registries, searched September 10th, 2026. The document leg is the author’s queries against the Federal Register documents API, publication dates January 1st to September 10th, 2026: DeepSeek 0, Moonshot AI 0, MiniMax 0, StepFun 0, Zhipu 0, “Z.ai” 0, Qwen 0, “Kimi K3” 0 (rerun September 11th, 2026, same counts); “open-weight” 2, both promotional notices. The independent confirmation is the eCFR search API over codified Title 15, which returns 0 for DeepSeek, Moonshot, MiniMax, StepFun and Qwen, and 9 for Zhipu; published documents and codified text are separate corpora. The nine are dated versions of one codified section, the Entity List at 15 CFR part 744, Supplement No. 4 (the API describes its result as “Changes to sections matching ‘Zhipu’ in Title 15”, rechecked September 11th, 2026), which is the export control the piece goes on to describe, not a restriction on deployment. The one plausible counterexample, GSA’s proposed rule on large language model acquisition of June 17th, 2026, was read in full and contains no occurrence of “China” or “foreign adversary”. Two limits on what this shows, found at the checking stage: “Alibaba” returns four 2026 documents, among them the Defense Department’s “Notice of Availability of Designation of Chinese Military Companies“, 91 FR 35189, June 10th, 2026, which lists “Alibaba Group Holding Limited”; and neither registry shows statutes, so the Federal Register search cannot see the defence law in note [37]. The claim the body rests on this note is therefore limited to deployment by a company in its own business.

[39] H.R. 1121, “No DeepSeek on Government Devices Act“, 119th Congress, as introduced: “To prohibit the use of DeepSeek by the executive agencies, and for other purposes”, sponsored by Mr. Gottheimer. Its section 2 directs the Office of Management and Budget to require removal of the DeepSeek application from federal agency information technology. Action history from the GovInfo bill-status record, retrieved September 10th, 2026: two actions, both on February 7th, 2025, introduced and referred to House Oversight and Government Reform, and nothing since. The same record shows the Senate companion, S. 765, read twice and referred to Homeland Security and Governmental Affairs on February 27th, 2025, with no action after that. The congress.gov page carries the same history; it is not linked because it returns HTTP 403 to automated retrieval. Senator Hawley’s S. 321, the “Decoupling America’s Artificial Intelligence Capabilities from China Act of 2025”, as introduced: “the importation into the United States of artificial intelligence or generative artificial intelligence technology or intellectual property developed or produced in the People’s Republic of China is prohibited”. Its bill-status record, retrieved September 11th, 2026, shows it introduced, read twice and referred to the Committee on the Judiciary on January 29th, 2025, and nothing since. The No DeepSeek bill’s approach was enacted for intelligence-agency systems in Public Law 119-60, Sec. 6604 (note [37]).

[40] Bureau of Industry and Security, Entity List addition, 90 FR 4617, January 16th, 2025, four days before the change of administration on January 20th, 2025, retrieved September 10th, 2026. The rule adds eleven entities under eleven entries; ten of them are named in one determination, “because these entities advance the People’s Republic of China’s military modernization through the development and integration of advanced artificial intelligence research”, and the eleventh, a lithography company, in a separate one. Seven of the ten carry the Zhipu name: Beijing Zhipu Huazhang, Beijing Zhipu Future, Beijing Zhipu Linghang, Beijing Zhipu Qingyan, Hangzhou Zhipu Huazhang, Shanghai Zhipu Huanyu and Shenzhen Zhipu Future. The other three are Beijing Lingxin Intelligent, Beijing Yuanyin Intelligent and Nanjing Zhihu Information Technology. The advisory’s Table 1 prints 北京智谱华章科技有限公司 against its Z.AI row, which transliterates to Beijing Zhipu Huazhang Technology Co., Ltd., the first company on the January 2025 list; the match is the author’s, and the advisory does not mention the Entity List. The Beijing Academy of Artificial Intelligence was added on March 28th, 2025. Both entries remain in the current eCFR, Part 744, Supplement No. 4, retrieved September 10th, 2026.

[41] Chris Lehane, OpenAI, “The AI policy window is open. We need to act.“, September 9th, 2026. openai.com returns HTTP 403 to automated fetch; read via the Wayback capture of September 10th, 2026. Author’s search of the full text, same date: “distill” 0, “China” 0, “Chinese” 0, “CISA” 0, “FBI” 0, “advisory” 0. OpenAI is a signatory to the July open letter, which it joined after the launch roster of 25; the post says “As we affirmed in signing the Open Weights and American AI Leadership letter”.

[42] On innocent variation: OpenAI’s prompt caching guide: “Prompt caching does not change how the model generates output tokens. The model generates a new response using the cached prefix, so identical requests are not guaranteed to produce identical outputs.” Anthropic’s prompt caching documentation: “The response you receive is identical to what you would get if prompt caching were not used.” On reasoning tokens: OpenAI’s reasoning guidesays reasoning tokens “are billed as output tokens” and reports them in output_tokens_details.reasoning_tokens; Anthropic’s adaptive thinking documentation: “the model evaluates each request and decides for itself whether to think and how much”, and “To see how many billed output tokens were spent on internal reasoning, read usage.output_tokens_details.thinking_tokens in the response”; Google’s Gemini thinking guide, last updated September 9th, 2026, reports total_thought_tokens. Because thinking is adaptive, single counts vary; the test compares averages. Artificial Analysis, “Launching the Endpoint Accuracy Index: Same Model, Different Accuracy“, August 4th, 2026, on open-weight endpoints: “Endpoints that score below the reference generally produce fewer output tokens per task. Output limits and reduced reasoning effort show up directly in token usage”. Irena Gao, Percy Liang and Carlos Guestrin, “Model Equality Testing: Which Model Is This API Serving?“, ICLR 2025: applied to “commercial inference APIs from Summer 2024 for four Llama models”, the test found “11 out of 31 endpoints serve different distributions than reference weights released by Meta”, using “an average of just 10 samples per prompt”; a statistical test against published weights, which closed models don’t have. The watch-list items are in the advisory: page 2, “immediate maximum usage from new accounts”; page 8, “multiple accounts with similar registration details and payment methods”; page 9, “identical or similar prompt texts”. All retrieved September 11th, 2026.

[43] OpenAI, “Services Agreement“, version v.010126, retrieved September 11th, 2026. Section 2.3: “If an OpenAI update materially reduces the Services functionality, OpenAI will notify Customer at the Account email address.” Section 8.2, on limiting or suspending access: “OpenAI will use reasonable efforts to notify Customer before limiting to or suspending the Services pursuant to the preceding sentence but may do so without prior notice to the extent reasonably necessary.” Section 2.3 continues: “Within five business days of receipt of this notice, Customer may choose to terminate the Agreement by providing thirty days written notice.” Section 8.2’s grounds: “(a) it is required to do so by law; (b) Customer violates the Agreement or OpenAI Policies; or (c) doing so is necessary to prevent or terminate a Security Emergency.” Section 12.1 warrants that the Services “will conform in all material respects with the Documentation”.

[44] “Too Dangerous for You, Free for Everyone“, June 28th, 2026.

On September 1st, Anthropic published a rate for Claude Fable 5.1: $10 per million input tokens and $50 per million output tokens.[1] On September 3rd, OpenAI published a rate for GPT-6 Astra: $10 per million input tokens and $50 per million output tokens.[2] Two frontier laboratories, forty-eight hours apart, at the same two numbers.

Read the sheets past the headline, and they are not the same price.[3][4] For the agentic, context-heavy work both companies are selling into, the columns nobody quotes differ by a factor of four and by an entire pricing tier.

Prices per token keep falling. Bills keep rising. The fix everyone reaches for is routing: send each job to a cheap model first, and pass it to a frontier model only when the cheap one fails. Done right, that pays for two reasons. The cheap model does most of the work, so the frontier bills only for the share that fails. And the context the frontier has to rebuild when it takes over is paid for once and then read at a fraction of the price for the rest of the session, which is what a prompt cache is for. Done wrong, the same router costs more than the frontier alone.

This piece is about that pass, the moment a job one model has been working on is handed to another, because that is where right and wrong part company. Some jobs can be handed over for almost nothing. Others cost more to hand over than the savings from the cheaper model. The Good-Enough Line runs between those two kinds of jobs. It does not run between frontier models and cheap ones.

What makes a handover expensive is everything that has piled up behind the job: the instructions, the documents, the results of every tool it has called, every turn of the conversation so far. The model that has been working on it has read all of that. The model taking over has not. Handing over means sending it all again, in full, and paying for it. Both vendors publish every rate you need to price that. What neither documents is how a rebuilt prefix is billed when a job arrives from another model, and no benchmark measures how often you would hand one over. That is why no vendor can quote your line.

Where the line falls depends on what you have built around the models: the rule that decides which model sees a job, the check that decides whether the cheap one got it right, and the pile of instructions you have written to make either one work. Practitioners call that pile the harness and the runbook. Four things set the line: what the handover costs; how often the cheap model’s work fails a check; what running that check costs; and what it costs to keep the harness current across a model release every few weeks. The first is what this piece is about.

A word on the column that does the damage, because it is the least understood line on either sheet. These models remember nothing between calls. Every turn of a conversation resends the whole of it: the system prompt, the documents, the tool output, every previous exchange. By the twentieth turn, you are paying to send the first nineteen again, at full input price, for the twentieth time.

Prompt caching stops that. The provider keeps the prefix it has already processed, so you pay full price only for what is new in this turn and a fraction of it for everything before. Take a fixed two-hundred-thousand-token context over twenty turns. Uncached, it costs forty dollars. Cached on Anthropic’s sheet, it costs about three and a half; the prefix is written once at $12.50 per million, and read nineteen times at 25 cents per million. On OpenAI, the same twenty turns cost just over six, because its cache read is four times Anthropic’s.[5] Same headline rate, nearly double the bill, on one conversation.

One thing stops it from being free money. Writing to the cache costs more than sending fresh, a quarter more on both sheets and twice as much for Anthropic’s hour-long window.

Past that, the savings compound, and four things make it compound the hardest:

• Long sessions, because every turn reads back everything before it.

• Large fixed context, because the system prompt, the codebase, and the documents are written once and read all day.

• Tool results, because each is appended to the prefix and re-read on every subsequent turn, so an agent that calls twenty tools has bought itself twenty more things to read cheaply.

• Retries, which resend a context the provider has already processed, are therefore nearly free.

That last one is worth holding on to. A retry within a single model costs almost nothing. The same retry sent to a different model is a full rebuild because the cache is stored per model; a task handed to another vendor or to another model on the same sheet leaves it behind.[6] The more of your bill the cache saves today, the more you lose the moment the job switches to a different model.

Run the numbers on your own bill

Take a team spending a little over two million dollars a year on agentic coding: about thirty-five billion input tokens a month against 1.8 billion output tokens, four-fifths of the input served from cache and the rest written to it. Neither vendor publishes a cache share, so I assume four-fifths, and every figure below is based on that assumption. On Anthropic’s sheet, that is about $183,000 a month.[7] Move the identical workload to OpenAI at the same headline rates; it is about $204,000. The whole of the difference is one column: seventy-five cents per million tokens of cache read, across twenty-eight billion cached tokens a month, amounts to $21,000 per month and about $254,000 per year.[7] Read your own off your own bill; the rate is the thing, not the total.

One assumption is worth more than the finding. The comparison counts a token at one vendor as a token at the other, and the two bills differ by only 11.6%. Anthropic’s own pricing page records a 30% token-count difference between its own tokenizer generations,[3] so a cross-vendor gap of that order in Anthropic’s direction would reverse the ranking. What does not move with the tokenizer is the ratio between the two cache-read columns, which is the number this piece is about.

Now put a router in front of it. Send everything to DeepSeek’s V4-Pro first at its peak rates, and the same number of tokens costs about $17,500 a month, under a tenth of the frontier bill.[7] It is priced here because it is the cheapest published frontier-class rate, not because it is the one your procurement will clear. A tenth of the price looks like the end of the argument. If handing the hard cases up were free, you could hand up almost everything and still come out ahead.

Substitute a cheap tier that your procurement will actually clear, and the whole calculation moves, because the cheap pass is the numerator of every break-even below. The nearest rung is on Anthropic’s own sheet: Opus 5 at five and twenty-five, half of Fable, with cache hits at fifty cents.[3] Go one further down, to Sonnet 5, and the same tokens cost about $41,000 instead of $17,500.

Handing them up is not free, and the cost turns on one thing no rate card answers: whether the frontier model keeps the prefix it has just rebuilt, or pays to rebuild it and then throws it away. When the escalated task arrives at the frontier, its prefix must be rebuilt, and the bill depends on whether that prefix is read back.[7]

How often you hand up decides the rest, and the only public number for that comes from Together AI, an inference and routing vendor that ran a cheap model first and escalated to a frontier one whenever the tests failed. Its published costs imply it handed up 37.2% of tasks.[8] That was a coding benchmark with a free machine check, on nothing like a cache-heavy workload, and Together claims nothing about this bill. The rollouts and the costs are its run. The escalation rate, the bill, the assumptions, and the conclusion are mine.

The break-even escalation rate is the share of jobs you can send to the frontier before the router’s bill equals the cost of sending all jobs to the frontier. Below it, routing saves money. Above it, you would have done better paying the frontier rate for everything. There are three rows because the frontier can bill a handed-over job three ways.

Seventy points of spread, and nothing about the models moved to produce it. The cheap model costs the same in all three rows, and so does the frontier model’s rate. What changes is only what the frontier charges to take on the job. That alone moves the answer from buy to don’t, which is the argument: how the frontier bills a handed-over job decides whether routing saves money, and it decides it harder than the choice of models does.

Which row you are in is not a vendor secret. It is a property of your own design, and you can read it off your own traffic. Escalate into a session that runs for several turns at the frontier, and the rebuilt prefix is written once and read many times, which is the top row. Escalate one-shot, and it is written and thrown away, which is the bottom row, and Anthropic’s own pricing page says caching pays for itself after a single read. So the bottom row is a misconfiguration rather than a third possibility, and a competently built cascade lives between a fifty-three per cent saving and a wash.

The cache share moves the middle reading too: at four-fifths, the middle reading is a wash; at seven-tenths, the router wins; and above nine-tenths, the middle reading breaks even at 29 percent, so a router escalating more than that loses.[7] Before copying any of this, get your own cache share and your own escalation rate.

So the line falls where the opening said it would, and the ranking of the three rows holds whichever pair of models you put on either side of it. Anthropic’s own cache diagnostics say the cache is per model and tell you to hold the model constant within a cached conversation, so escalating from a cheap tier to an expensive one on the same sheet drops the prefix exactly as crossing a vendor boundary does.[6] The charge is on the handover, not on the border. The way out is to hand nothing over: pick the model for each job before the work starts, based on the job type, rather than switching models mid-task after a failure. That is selection instead of routing, and it is not free either. A partition is only as good as the rule that assigns the job. Escalation puts the cost on the invoice; partition puts it somewhere you have to go and look.

The convergence ran one way

The convergence was not mutual. Anthropic has charged ten and fifty since Fable 5 and changed exactly one cell when 5.1 shipped, cutting the cache read from a dollar to twenty-five cents.[9] OpenAI climbed. GPT-5.6 Sol launched on July 9th at five and thirty. On August 21st, OpenAI cut it to four and twenty, and called the new rate promotional, running at least to November 21st.[10]

The multiple depends on which Sol you measure. Compared to the promotional rate, Astra is 2.5 times; compared to Sol’s July launch price, it is 2 times the input rate.[10] One lab set a number and held it. The other cut the price of its existing model and launched a new one at double the old launch price, which is how it arrived at the same two figures. Every rate card quoted here was captured between August 11th and September 7th, so this is a three-week window rather than a price history.

The referee moved too. On September 3rd, Artificial Analysis scored Astra level with Sol, both at sixty-one. On September 4th, it shipped a new version of its index, doubled the weight of its private held-out set to forty per cent, and under that version, Astra came out four points ahead of Sol.[11] Three days later, it shipped another, raised the private weighting to forty-five per cent, and under that, Fable 5.1 and Astra tie at fifty-three, with Sol six points behind.[11] Two revisions in four days, each naming its changes, and the order at the top moved with each. It publishes the weight of every evaluation and of each category. What it does not publish is the contents of the private held-out sets, which is the half an outsider would need to separate the model from the ruler. It publishes a cost per index task, and Astra is the cheaper model at $3.26 compared to $7.63 for Fable 5.1.[11] At identical headline rates, that gap is in token volume, not price, and the tokenizer bound above runs in exactly that direction.

The premium buys a runbook you did not write

Buyers are now running this arithmetic on whether to keep renting a frontier model.

Together AI put GPT-5.6 Sol against DeepSeek V4-Pro over 904 rollouts on DeepSWE, a software engineering benchmark. Sol won on a single attempt, 72.7 percent against 62.8. At four attempts, the ranking inverts, and the open model takes it, 88.5 percent against 85.8.[8]

Then Together did what an engineer would do: ran the cheap model first and escalated to Sol only when the tests failed. That cascade solved 83.0 percent at $3.35 per task. It beat Sol alone on accuracy and on price. It also beat a hypothetical perfect router that chooses one model per task in advance, even though the cascade is allowed a second attempt and that router is not.[8] Together sells inference and routing, so read the recommendation with that in mind; the rollouts are still the best public head-to-head with cost attached.

Note what the cascade is made of. Its 83.0 percent includes every escalated call to Sol, at Sol’s price. A routing policy does not take the frontier off the bill. It decides how much of the bill the frontier gets.

On Terminal-Bench 2.1, the StateM work reported 88.09 percent with a DeepSeek V4-Flash configuration, compared with a GPT-5.6 Sol reference that scored 88.8. That is a match rather than a win, which is the point: the scoring run cost $15.20, or $52.22 once the provider-specific adaptation and the required configuration are included, against $574.68 of the submission-reported cost for the reference.[12] The two cost figures are not measured the same way; one is a bill, and the other is the submission’s own estimate, so read the gap as an order of magnitude rather than a ratio.

One condition carries both results. The cascade escalates when the tests fail, and both runs sit on benchmarks that hand you a free, machine-checkable verifier. Most work has no such check. Nothing tells you that a summary, a customer reply, or a research memo came back wrong. The escalation rule has nothing to fire on, and the buyer pays the frontier rate as insurance against mistakes they cannot see.

There is also a cheaper answer that needs none of it. Batch is half off both columns on both sheets; it stacks with caching and requires no router, verifier, or runbook. For anything that can wait, that is the first thing to do, and this piece is not about it.

The buyers said it first, including one who holds shares in the seller

In May, Marc Benioff described the mechanism on the All-In podcast. He would probably use about $300 million of Anthropic's funds that year on Salesforce coding, he said. That is a personal forecast, not a disclosed commitment. Later in the same conversation, he said the vast majority of those tokens do not need to go to Anthropic, that there needs to be an intermediary layer, and that smaller models can route each job to the most affordable option.[13] He said it as the chief executive of a shareholder in the supplier [14].

He is not quite arguing against his own book. Salesforce’s stake is worth what Anthropic’s market is worth, not what Salesforce’s token bill is worth, and the intermediary layer Benioff wants is something Salesforce sells. The chief executive of one of the largest enterprise software companies called the routing policy the obvious engineering answer, at a moment when nothing obliged him to say anything at all.

On August 27th, Salesforce’s executive vice president of finance, Mike Spencer, reportedly said that covering token spend was “part of the reason we didn’t raise margin guidance on the year”, and that on many jobs “you’re totally fine with the second or third generation model”.[15][16]

The second buyer sells the infrastructure rather than the model, so its interest runs in the opposite direction. On September 2nd, the chief financial officer of Hewlett Packard Enterprise said on an earnings call that the company routes each internal workload request to the most cost-effective model across open-source and open-weight options on its own private cloud. On HPE’s own internal analysis, she said, its private-cloud offering can reduce token costs compared with the public cloud by up to 60%.[17] HPE sells that private cloud, so the 60% is its own product figure, as reported on its earnings call. Read it the way the Together figure is read here: interested, and still the most specific public claim of its kind.

What would have to break

The strongest argument against all of this is that nobody is doing it yet. Vercel runs a gateway that sends traffic to many laboratories and bills every token at list price. In July, Anthropic handled 30% of the tokens that passed through it and collected 65% of the revenue.[19] Its tokens sold for 4.4 times the average price of everyone else’s, and that premium was 3.4 times in June. Buyers are paying the premium, and paying more of it each month. Cheap models are winning volume. They are not yet winning budgets.

That premium is also the test. Watch it rather than Anthropic’s share of spend, because the share falls whether Anthropic cuts its prices or buyers route work away, and those mean opposite things. If the 4.4 falls toward 1 over the next two monthly reports, Anthropic is closing the gap itself, and a buyer has nothing to route away from.

The second comes from the supply side. A modelling paper argues that when capacity binds, a degraded cheaper tier needs more attempts per satisfied answer, so the discount can invert: the buyer pays less per call and more per outcome.[20] That is one more cost that lands on the outcome and never on the rate card, and it reaches the bottom row of the table by a second road. If an independent run at a matched retry budget erases the cascade’s advantage, the premium was buying capability after all.

Until one of those happens, the sheet says one thing and the bill says another. The charge is on the handover, not on the border. The numbers that decide what you should do are: how much of your traffic the cache serves, and how often the cheap model has to hand up. The first is already in the usage object of every call you have paid for. The second costs a pilot. That is the real price of the answer.

Notes

[1] Anthropic, “Claude Fable 5.1 and Claude Mythos 5.1“, published September 2026, accessed September 7th, 2026, whose own metadata dates it only to the month; the day comes from Anthropic’s release notes, accessed September 7th, 2026, under the heading “September 1, 2026”: “at $10 / $50 USD per MTok, the same as Claude Fable 5, with cache reads cut to $0.25 per MTok”. The announcement itself says: “Fable 5.1’s pricing is otherwise the same as Fable 5’s: $10 per million input tokens and $50 per million output tokens.” The same page sells the cache cut as the saving: “For typical workloads, costs are reduced by around 25% relative to Fable 5. For complex coding and highly agentic tasks, the savings could be up to around 45%.” Rates confirmed independently on Google Cloud’s Vertex AI partner-model price sheet, which lists Claude Fable 5.1 input $10.00 and output $50.00.

[2] OpenAI, API pricing, accessed September 7th, 2026: gpt-6-astra at $10.00 input, $1.00 cached input, $12.50 cache writes, $50.00 output for standard short-context requests. The same rates appear in Microsoft’s Foundry announcement of September 3rd, 2026. OpenAI’s marketing pages refuse automated requests; the developer documentation, to which platform.openai.com/docs/pricing redirects, does not.

[3] Anthropic pricing documentation, accessed September 7th, 2026: Claude Fable 5.1 at $10 base input, $12.50 five-minute cache writes, $20 one-hour cache writes, $0.25 cache hits and refreshes, $50 output; “Cache hits and refreshes on Claude Fable 5.1 and Claude Mythos 5.1 are priced at 0.025x the base input price. All other models use the standard 0.1x multiplier.” On break-even: “caching pays off after one cache read for the 5-minute duration (1.25x write), or after two cache reads for the 1-hour duration (2x write).” On the tokenizer: “Claude 4.7 and later models and Claude Mythos Preview use a newer tokenizer … This tokenizer produces approximately 30% more tokens for the same text.” On context: “For Claude 4.6 and later models … include the full 1M token context window at standard pricing.” Google Cloud’s Vertex AI sheet carries the same cache rates from a counterparty rather than from Anthropic.

[4] OpenAI’s model page for GPT-6 Astra, accessed September 7th, 2026: “Prompts with more than 272K input tokens are priced at 2x input and cache rates and 1.5x output for the full request.” Microsoft Learn states the same threshold and the same full-request rule: “For GPT-6 models, prompts with more than 272,000 input tokens use long-context pricing for the full request, not only for tokens beyond the threshold.” Two vendors, one figure.

[5] Author’s calculation from the rates in notes 1 to 3, for a fixed 200,000-token prefix over twenty turns. Uncached, twenty turns resend four million tokens at $10 per million; author’s calculation: 4 × 10 = 40. Cached on Claude Fable 5.1, the prefix is written once at $12.50 per million, $2.50, and read nineteen times at $0.25 per million, $0.95, so $3.45 in total. On GPT-6 Astra the write is the same $2.50 and the nineteen reads cost $3.80 at $1.00 per million, so $6.30. The two cached bills differ by $2.85 on one conversation, at identical headline rates.

[6] Anthropic, cache diagnostics, accessed September 7th, 2026: “The cache is per-model. Hold the model constant within a cached conversation.” Checked against the prompt-caching page, accessed September 7th, 2026, whose table of what invalidates a cache carries no row for the model, and against the pricing page, which does not record it either: the rule is documented in one place. OpenAI’s caching guide, accessed September 7th, 2026, states only the weaker version, that “a different model can use different weights and caching behavior”, so do not read its position as absolute. One cut runs the other way and is recorded here for fairness: OpenAI’s changelog entry for GPT-6 Astra of September 3rd, accessed September 7th, 2026, lets a caller change reasoning effort mid-conversation while preserving the cached prefix, where Anthropic’s invalidation table lists the effort setting as cache-invalidating. On that axis, which this piece does not price, OpenAI’s cache is the more forgiving of the two.

[7] Assumptions are mine and stated: about 35.3 billion input tokens a month, four fifths served from cache and the rest written to it, and 1.76 billion of output. Rates from Anthropic’s pricing page and OpenAI’s model page, both accessed September 7th, 2026, and from the DeepSeek schedule below. Counting writes at $12.50 per million, Anthropic’s month is $88,250 of writes, $7,060 of cache reads and $88,000 of output, about $183,300, or $2.2m a year; OpenAI’s differs only in the cache column, at $28,240, about $204,500. The gap is the $0.75 per million between the two cache rates across 28,240 million cached tokens; author’s calculation: 28240 × 0.75 = 21180. That is about $254,000 a year, and because the write rate is identical on both sheets, counting writes raises both bills without moving the gap. The same tokens on DeepSeek V4-Pro at peak cost about $17,500, at $0.044 per million on cache hits, $1.32 on cache misses and $3.96 on output, all three transcribed from the image table in DeepSeek’s pricing announcement of August 13th, 2026, which publishes the schedule as pictures rather than as page text. Break-even escalation is (183,310 − 17,531) ÷ the cost of escalating everything, which is $183,310 if the escalated task rebuilds and reuses its own cache, $441,000 if every token goes fresh at $10, and $529,250 if the rebuilt prefix bills as a cache write at $12.50: author’s calculation: 165779 ÷ 183310 = 90.4%. The other two denominators give 37.6 and 31.3 per cent. The model applies no long-context multiplier on either sheet, which is conservative in OpenAI’s favour: above 272,000 tokens its input and cache rates double, so including it widens the gap rather than narrowing it. One further assumption runs the other way. The break-even is a share of tokens and Together’s rate is a share of tasks, and a cascade that escalates on test failure escalates the long, context-heavy ones by construction, so their token share exceeds their task share and every break-even above is a little generous to the router. Anthropic says of one workload it built that cache reads were most of the cost, but that is a cost share on Fable 5 pricing before the cache cut, and it is not this workload: here cache reads are about four per cent of the bill. Chart data in data/routing-break-even.csv.

[8][] Together AI, August 18th, 2026: 904 rollouts across 113 tasks, four trials per model; Sol at 72.7 per cent pass@1 (±2.2) and $8.37 per rollout against V4-Pro at 62.8 per cent (±3.1) and $0.24; at four attempts the order reverses, V4-Pro at 88.5 per cent pass@4 against Sol’s 85.8, and Together’s own line on cost is “The price gap is 35x”; a Pro-first cascade escalating on test failure at 83.0 per cent and $3.35 per task, above a perfect one-shot oracle router at 80.8 per cent. The escalation rate used in this piece is derived, not published; author’s calculation: (3.35 − 0.24) ÷ 8.37 = 37.2%. It also falls out of the single-attempt pass rate, since 100 − 62.8 = 37.2, which reproduces it without relying on the $0.24 this note goes on to impeach. Together ran a second cascade three days later, “GLM-5.3 vs GPT-5.6 Sol on DeepSWE“, August 21st, 2026, over the same 113 tasks and 904 rollouts: GLM-5.3 at 69.0 per cent (±2.7) and $3.99 a rollout, Sol at 72.7 (±2.2) and $8.37, and “Run GLM-5.3 first and escalate to Sol only when your test suite rejects the answer: 85.9% solved at $6.61 per task.” Both routes reproduce there too; author’s calculation: (6.61 − 3.99) ÷ 8.37 = 31.3%. The pass-rate route gives author’s calculation: 100 − 69.0 = 31.0%. So the public range for a test-failure cascade is roughly 31 to 37 per cent across two model pairs. The 31.3 here is an escalation rate and is not the 31 per cent break-even in the table above, which is a different quantity that happens to land on the same figure. Vendor-run: Together sells both the inference and the routing, and its own caveat is that every figure comes from this run and can differ from other public scorecards. It does not state which rate card it costed against, and the post of August 18th predates OpenAI’s cut of August 21st, so the Sol side is most likely at the pre-promotional $5 and $30 while the Astra comparisons elsewhere in this piece are at $4 and $20. The open-model side is the harder problem. Together’s own price list bills DeepSeek V4-Pro output at $3.96 per million and DeepSeek’s card matches it, so the 101,000 output tokens the post reports per rollout cost about $0.40 before a single input token is counted, against a reported total of $0.24; off-peak at $1.98 still gives $0.20 and leaves four cents for 146 agent steps of input. Together’s post offers no explanation. The direction matters: correcting it narrows the price gap and raises the cascade’s cost without reversing either. DeepSWE is also the suite on which V4-Pro moved from 12.8 at preview to 62.7 at general availability, a jump consistent with fitting to the published harness. The independent leg of the same proposition is the StateM work; see note 12.

[9] Anthropic’s own documentation lists the superseded rate: Claude Fable 5 at $10 input, $50 output, $1 cache hits, on its pricing documentation. The marketing page carries the same figures under legacy models. The ratio between OpenAI’s cache read for Astra and Anthropic’s for Fable 5.1, author’s calculation from note 2 and note 3: $1.00 ÷ $0.25 = 4x.

[10] OpenAI API changelog, entry of August 21st, 2026: “GPT-5.6 Sol now costs $4 per million input tokens and $20 per million output tokens, representing 20% lower input pricing and 33% lower output pricing. GPT-5.6 Sol’s promotional pricing is available at least through November 21st, 2026.” The pre-cut sheet, archived August 11th, 2026, lists gpt-5.6-sol at $5.00 input and $30.00 output. Microsoft’s Azure OpenAI price page still lists Sol at $5.00 and $30.00, accessed September 7th, 2026.

[11] Artificial Analysis, “Intelligence Index v4.2“, September 4th, 2026: GPQA Diamond removed as “saturated” with no ceiling published, AA-Briefcase and GDP.pdf added, private held-out weighting doubled to 40 per cent, and Astra placed four points above Sol. The previous day’s benchmarking piece scored both at 61 under version 4.1.1. Version 4.3, September 7th, 2026, accessed September 8th, 2026: “Both Claude Fable 5.1 (max with fallback) and GPT-6 Astra (max) score 53 on Intelligence Index v4.3, followed by Claude Opus 5 (max, 51), Claude Fable 5 (with fallback, 50), Muse Spark 1.3 (max, 48) and GPT-5.6 Sol (max, 47)”; “Evaluations with private questions or answers account for 45% of the Intelligence Index v4.3 weighting, up from 40% in v4.2”; and on cost: “GPT-6 Astra (max) and Claude Fable 5.1 (max with fallback) both score 53, but their average cost per Intelligence Index task is $3.26 and $7.63 respectively - 57% lower for Astra.” Terminal-Bench moved from 2.1 to 4.0 and AutomationBench-AA replaced τ³-Banking at the same 5 per cent weight; category weights are unchanged.

[12][] StateM, August 15th, 2026, on Terminal-Bench 2.1: 88.09 per cent from a DeepSeek V4-Flash configuration against a GPT-5.6 Sol max reference of 88.8; $15.20 of realised API charges on the scoring run, $52.22 including about $37 of provider-specific adaptation, against $574.68 of submission-reported model cost for the reference, which the paper puts at roughly a ratio of one to eleven. A frozen runbook is worth 9.0 to 10.4 points, the upper figure computed off a headline 95.3 per cent that the paper flags as pre-adjudication with a defensible range of 93.26 to 95.28. Four authors, no declared affiliation, described as personal-time work. Applied unchanged across providers the runbook lowered the score, 82.7 to 82.0, and the adaptation recovered the gain; the authors also disclose that on one task family the profile learned the evaluator’s boundary convention without reading verifier code, so part of the harness gain is fit to the grader. The independent leg of the same proposition is Together’s run, a different benchmark, a different method and an opposed interest.

[13] Marc Benioff, All-In podcast, uploaded May 15th, 2026, at 38:56 and 1:00:29, from the published captions: “I am going to probably use $300 million of Anthropic this year at Salesforce coding” and “the vast majority of those tokens don’t need to go to Anthropic, there needs to be some intermediary layer … these ones can handle by smaller models that can route it to the most affordable for the job.” A personal forecast scoped to coding, not a disclosed commitment: Salesforce’s 10-Q for the quarter ended July 31st, 2026 records no Anthropic purchase obligation and no significant change to fixed contractual obligations.

[14] Salesforce Form 10-Q for the quarter ended July 31st, 2026, EDGAR acceptance August 26th, 2026 22:54:46 UTC: a strategic investment portfolio of over 450 companies carrying $11.3 billion, “including the Company’s investment in Anthropic PBC … which represented approximately $5.1 billion”, about 45 per cent of the portfolio against 22 per cent at January 31st, and “Upward adjustments for the three and six months ended July 31st, 2026 include unrealized gains of $2.7 billion and $3.0 billion, respectively, related to the Company’s investment in Anthropic” — the body uses the six-month figure, because the period it describes runs from January to July. The portfolio was $7,591m at January 31st and $11,324m at July 31st; author’s calculation: 7591 × 0.22 = 1670. The quarter’s earnings exhibit gives “Gains (losses) on strategic investments, net” of $2,613m against “Income from operations” of $2,331m, and states that strategic-investment gains “impacted GAAP diluted net income per share by $2.43”, which is where the below-the-line placement is proved.

[15][] The Register, September 3rd, 2026, reporting Mike Spencer at the Deutsche Bank Technology Conference of August 27th: “It’s part of the reason we didn’t raise margin guidance on the year because we’re covering some of the token spend that we’ve got going”, and “You’re totally fine with the second or third generation model.” Salesforce’s investor-relations page confirms the event, the date of August 27th and the speaker, and gives his title as executive vice-president of finance where the outlet gives deputy chief financial officer. The webcast sits behind a registration gate and the company has published no transcript, so this is one outlet’s note of a session and the piece attributes it as reported rather than stating it.

[16] Salesforce Form 8-K exhibit 99.1 for the second quarter of fiscal 2027, EDGAR acceptance August 26th, 2026 20:03:53 UTC: “GAAP operating margin of 20.5% and non-GAAP operating margin of 34.1%” and “Updates full year FY27 GAAP operating margin guidance to 20.1%, and maintains non-GAAP operating margin guidance of 34.3%.” The first-quarter exhibit, accepted May 27th, 2026 20:18:26 UTC, gives the prior figure of 20.6 per cent. Both are full-year FY27 guidance reconciliations rather than quarter actuals, each calculated on the midpoint of the revenue guidance range. The second-quarter exhibit moves amortisation of purchased intangibles from 4.2 to 4.4 per cent and restructuring and acquisition costs from 0.5 to 0.8, while stock-based compensation is flat at 9.0 in both. So each side sums on the page: 20.6 + 4.2 + 0.5 + 9.0 = 34.3, and 20.1 + 4.4 + 0.8 + 9.0 = 34.3. The half point is entirely in the two lines the body names.

[17] Marie Myers, chief financial officer of Hewlett Packard Enterprise, on its third-quarter fiscal 2026 earnings call of September 2nd, 2026. The wording below comes from a third-party transcript rather than a company one: “HPE is now deploying an internal agentic AI platform built on our own private cloud AI, open source, and open weight models, leveraging intelligent routing that sends each workload request to the most cost effective AI model. According to our own internal analysis, our PCAI offering can reduce token costs versus the public cloud by up to 60%. Routine tasks stay on premise while frontier models are reserved for the most complex work.” Transcript; a third-party transcript, not the company’s own. Confirmed independently by Constellation Research’s report of the same call, accessed September 7th, 2026, which carries both the up-to-60-per-cent projection and the same routing description. HPE’s own earnings release does not carry the claim, so it exists only in the call.

[18][] Vercel, August 11th, 2026, reporting July. Vercel operates a competing gateway and computes spend at published list price rather than at invoiced rates, which if anything flatters the frontier. On the 13.6 per cent, the same post is explicit that it is not a rate cut: “The entire decline in average price came from what companies chose to route”, and “holding June’s mix of models constant, the average price would have held essentially flat instead of declining.” On the spend share: “In July, it collected 65.1% of all spend on 30% of total volume. The average price per Anthropic token ran 4.4 times the average across every other lab, up from 3.4 in June.” So 3.4 times in June against 4.4 times in July. The figures are not stable month to month: 61 per cent of spend on 32 per cent of tokens in June, 65 on 32 in May, per the preceding index.

[19] The shadow-price analysis, August 29th, 2026, which models attempts per satisfied answer as 1 ÷ (1 − dρ) and observes that the discount inverts exactly when capacity binds. Its own section five calls the work a proof of concept rather than an empirical claim; it is cited here as a mechanism, not as a measurement.

[20] Salesforce, “Salesforce Advances Agent Fabric“, accessed September 7th, 2026: “AI Gateway, MCP Bridge, and Trusted Agent Identity with mobile authorization for high-risk agent actions are generally available today”, dated April 15th, 2026, and of AI Gateway: “Standardize token management and compliance across your entire multi-LLM stack. Enforce routing rules, unify access, and control costs from a central point.” The layer therefore predates the May remark quoted above. Salesforce also published the practice itself: Jayesh Govindarajan, “How We Cut Inference Spend by Right-Sizing Our Models“, July 8th, 2026 (archived copy, since the site files it under a tracking variant of its own address), describing an agentic harness routing work across five purpose-built in-house models and reserving the frontier model for multi-step reasoning. A defender would call those auxiliary utility models rather than a frontier cascade, which is fair; the falsifier as originally written did not survive either document.

Nvidia is reportedly buying Hugging Face for $12.9bn. In March, I asked whether anyone else would pay to keep the hub neutral. The reported answer says more about how the company was built and what it cost to run this summer than about the buyer.

Disclosure: I was chief evangelist at Hugging Face from 2021 to 2024. I hold equity from that time.

On 23 August, Business Insider reported that Hugging Face had hired a bank to gauge interest in a sale at $13bn or more.[1] On 26 August, The Information reported that Nvidia had agreed to buy it for $12.9bn; Reuters relayed the report that evening, and on 27 August, Bloomberg, citing Business Insider, reported only that Nvidia had discussed a purchase.[2] Five days on, as of 31 August, neither company has commented, and there is no filing; Business Insider reported on the 28th that no contract had been signed and the talks could still collapse; Jensen Huang took an earnings call on the 27th without mentioning the deal, and Hugging Face’s Thomas Wolf gave an interview on the 29th that discussed it without disputing it.[3] Everything below is conditional on a deal that is reported, not confirmed.

In March, I argued in Open Source, Closed Orbit that “open” now means two things: Nvidia’s, where the weights are free, and every path from download to production bends toward Blackwell, NIM containers and an NVIDIA AI Enterprise license list-priced at $4,500 per GPU per year. Hugging Face is a hub that hosts everyone’s models and co-maintains, with the chip vendors, the libraries that run them on Trainium, AMD, and others.[4] The piece ended with the question of whether anyone was “investing hard enough in the alternative.”

Nobody else needed to own it

The instinctive question is: How did Google, Amazon, Microsoft, Meta, or Salesforce let Nvidia walk off with the bride? The answer is that none of them was ever going to propose.

Start with the cap table. Hugging Face last raised in August 2023: $235m at $4.5bn, from Salesforce, Google, Amazon, Nvidia, Intel, AMD, Qualcomm, IBM, and Sound Ventures, most of the hardware and cloud industry, about 5% of the company between them and none with a reported board seat.[5] That structure made the hub neutral. It also made it indefensible: eight of those nine investors had no reason to ever own it, and the ninth was Nvidia.

Each cloud already has the pipe. Microsoft put more than 10,000 Hugging Face models into Azure AI Foundry in May 2025; Google Cloud built a caching gateway for the hub last November and says 1,500 terabytes of models and datasets move between the two every day; AWS sells hub models through SageMaker and the Bedrock Marketplace.[6] They already get the distribution. Owning the hub would cost them the thing that makes it worth having: the day Google owned the front door, Amazon and Microsoft would build their own, and the traffic that makes the hub worth $13bn would leave with them. To each cloud, a hub nobody owns is worth more than a hub it owns. The only company for which that is not true is the one the hub lets everyone else avoid.

Then look at who could have written the cheque this month. Google closed Wiz on 11 March after a 12-month review and is fighting a Justice Department cross-appeal that seeks to bar Chrome and Android. Amazon has $11.6bn for Globalstar awaiting approval, an FTC trial in March 2027, and a long habit with open source: on the same day The Information reported the Nvidia deal, AWS announced it was buying DuckLabs, the thirty-person company behind DuckDB, for an undisclosed sum, while the code stays with an independent foundation under MIT.[7] Amazon hires the maintainers and sells the service; it does not buy the project, and this year, the big cheque, $50bn, went to a stake in OpenAI. Microsoft already owns GitHub, and owning the GitHub of models as well would invite a long antitrust review. Meta structured its $14bn Scale deal with a 49% non-voting stake precisely to avoid review, and is named in the senators’ letters about that structure. Salesforce, which led the last round, is halfway through a $25bn accelerated buyback, and its chairman’s only public word on the subject this summer was “Mahalo, Jensen” on joining Nvidia’s open-weights coalition.[8] None of them has ever counter-bid a rival’s control deal to protect a minority position, and a bank process that leaked on a Saturday and produced a reported agreement by Wednesday gave them days, not months.[9]

Nvidia had none of those constraints. It had been at the table since its refused offer last year. It closed the quarter with $99bn of cash and securities and bought back $39bn of stock in six months; $12.9bn is thirteen days of data-center revenue.[10] At that scale, the price barely registers, and a buyer who wants the asset will always outbid one who only wants the return. And the structure it used for Groq and Poolside, license the technology and hire the people, was not available here: the hub’s asset is not engineers or IP but traffic and trust, and those transfer only with the company. Six days after a $7bn license-and-hire for Poolside built to stay outside merger review, Nvidia reportedly signed its first large deal in a year that will have to go through it.[11] That is how much it wanted this one.

Why now

Nine months ago, the answer was no. In late 2025, Nvidia offered $500m at a $7bn valuation; Hugging Face refused because, according to the Financial Times, it did not want a single dominant investor that could sway its decisions.[12] The company was not distressed then and is not now: profitable in 2025 by the FT’s account, “close to profitability” by its CEO’s, with about half of the money it ever raised still in the bank.[13] Three things changed between January and August, and a fourth had been true for a year.

The first is the price. Annualized revenue went from about $100m to more than $150m in two months, and a company sells at the top of its growth rate, not after it.[14] Roughly 85x run-rate is a strategic multiple, above Figma (about 50x, 2022) and Wiz (about 45x, 2025), and a refused $7bn mark, plus a year of growth and a control premium, lands at $12–14bn mechanically.[15] At $12.9bn, every preferred share converts, and a decade of employees get paid, against an IPO path that exists but requires a ton of corporate work and is subject to market conditions. OpenAI and Anthropic both filed confidentially in June, and OpenAI’s CFO has told staff it “will be a public company in 2027”; once a frontier lab trades publicly, AI companies will have a public price, and $12.9bn negotiated before that price exists is a better deal for the seller than one negotiated after.[16] Clément Delangue told Axios last November that the industry was in “an LLM bubble” that “might be bursting next year.”[17]

The second is the bill for neutrality. From 9 to 13 July, an OpenAI evaluation agent that had escaped its sandbox operated inside Hugging Face’s infrastructure, and by the company’s own account, its forensics were slowed because the hosted frontier models it tried first refused to help; it finished the analysis with an open Chinese model in Nvidia’s optimized build.[18] Delangue flew to San Francisco, asked OpenAI for “radical transparency” and $100m of compute for community cyber-defense, and has received, as far as the record shows, a technical report and no money; state attorneys general have since subpoenaed OpenAI, and the lawyers quoted on liability say the insurance market for this kind of incident is still being worked out.[19] Business Insider's first report came a month after the intrusion. No reporting connects the two, and the Nvidia courtship predates the breach; I am not claiming the attack sold the company. What it did, at minimum, is reprice the job of staying independent: the cost of hosting everyone's models is now set by frontier-lab incidents, whichever lab's agent it is, and a $150m company cannot or may not want to carry it.

The third is that the hub was becoming a channel Nvidia did not control. Meta signaled in December that its next frontier models would be closed; then came back on 10 August with Muse Glimmer, a 30-billion-parameter open-weight model distilled from the closed Muse Spark; the hub’s hardware-agnostic patron returned for the small end, not the top.[20] DeepSeek V4, the largest open model on the hub, launched in April, tuned for Huawei’s Ascend, and ran on it from day one.[21] The Google leg of the vendor-library arrangement went quiet in January, when Optimum TPU was archived.[22] And on 19 August, Stripe bought OpenRouter, the neutral routing layer above the hub, for about $7.5bn.[23] Nvidia’s own Nemotron 4, at a trillion parameters, is due this fall and needs a place where people will find it.[24] The two neutral layers in OpenAI, discovery and routing, were both for sale in the same fortnight; Stripe took one, and Nvidia took the other.

Two governments hold the traffic

The fourth reason is the one Hugging Face’s own reports never name as a risk. Chinese open-weight models accounted for 41% of hub downloads this spring; Qwen alone is downloaded more than the rest of the open ecosystem combined and has five times as many derivatives as Llama, and in August, Delangue said China is “clearly dominating on open models.”[25] That traffic is the hub’s growth, and it is hostage to two governments.

In Washington, the administration revived a push in July to restrict Chinese models through the Entity List, and two House committees are writing to American companies that deploy them.[26] In Beijing, the Ministry of Commerce spent June convening Alibaba, ByteDance and Zhipu to discuss restricting overseas access to their most advanced models, including open-weight models, under a tiered scheme in which the frontier tier would be domestic-only.[27] Either government can move the hub’s largest source of traffic. Nothing has been pulled yet: DeepSeek V4 linked its weights only to Hugging Face, Kimi K3 set the hub’s trending record in July, and Qwen still ships on Hugging Face and ModelScope the same evening.[28] But the supply now depends on a Chinese policy decision and the demand on an American one, and Hugging Face has no influence over either.

It never had much in Beijing. The site has been blocked in mainland China since September 2023; the Spaces domain followed last November; the mirror everyone there uses is run by someone else, and the China entry the company sketched in 2023, a WeChat account, a localized blog, a lead on stage at the Shanghai conference, never became an entity, a licensed mirror or a cloud partnership. The head of its Asia-Pacific ecosystem, who had walked DeepSeek and Qwen onto the hub, left this summer.[29] ModelScope, Alibaba’s hub, is a fraction of the size, but it is based in China, whereas Hugging Face is not.[30] Hugging Face’s Chinese business was always the export of Chinese models to the West, and that is a business two ministries can end.

Is this Nvidia’s way back into China? No. Nvidia shipped less than 1% of its data-center revenue to China last quarter, carries none in its outlook, and is under an anti-monopoly investigation in Beijing over the Mellanox conditions; owning a site that is blocked there changes none of that.[31] What changes is where Chinese models go when they leave China. DeepSeek V4 launched tuned for Huawei’s Ascend; Hugging Face’s forensics this summer ran on Zhipu’s GLM-5.2 in Nvidia’s optimized build, “the American version of a Chinese model,” in Delangue’s phrase.[18] The hub is where a Chinese model, once released, gets packaged and deployed, and whoever owns the hub decides which version is the default. The biggest Chinese models are now built for Huawei’s chips first; on the hub, they can be made to run on Nvidia’s first. So this is not Nvidia’s way into China. It is the way Chinese models come out of China, and Nvidia would own the door. That much is on the record. Whether the door also gives Nvidia leverage with either government is a matter of speculation, and I will not make it here.

Where Anthropic is

Anthropic is on the other side of every line this piece draws, and that is not an accident. It has never released a model’s weights. It did not sign Nvidia’s July letter opposing restrictions on open weights, and it is not part of the Open Secure AI Alliance that Nvidia formed around Hugging Face after the intrusion. Its own statement that week said open models “that don’t have dangerous capabilities are a public good.” The same statement repeated its claim that Alibaba had run the largest distillation attack it had seen, and the New York Times reported that Anthropic and OpenAI were lobbying Washington to restrict Chinese open-weight models.[32] When Hugging Face’s engineers tried to analyze the attack, the models they reached for first were Claude Opus and Fable, and by Hugging Face’s account, both “refused a large part of that work: their safety guardrails treated reverse-engineering an exploit the same as launching one.”[18]

Its silicon runs the same way. Anthropic has contracted up to 5 gigawatts of Trainium from Amazon, several gigawatts of TPU from Google, two gigawatts of AMD’s MI450 from 2027, and about one gigawatt of Nvidia through Microsoft’s Azure; by announced capacity, Nvidia is a minority supplier to the lab that sells the leading closed model, and Amazon and Google are its two largest shareholders.[33] Nvidia’s CFO put it in one line on Wednesday: “NVIDIA runs the leading closed models”; “nearly all open models run on NVIDIA.”[31] It runs them today. The closed labs are building the exits.

So are the trenches being dug? The open-versus-closed line is real, and everyone can see it: Nvidia, Meta, Hugging Face, Mistral and the Chinese labs on one side; Anthropic, OpenAI and, mostly, Google on the other. The silicon line is messier than it looks. Google signed Nvidia’s letter while selling Anthropic TPUs; AMD signed it days before putting $5bn into Anthropic; Microsoft is Nvidia’s biggest customer and Anthropic’s third cloud; Amazon kept Anthropic as its primary lab and put $50bn into OpenAI anyway.[34] What lines up is simpler. Nvidia’s growth now comes from open models, and its largest customers are spending less on it. Buying the place where open models live is the response to both.

Nothing needs to be switched off

The honest counter-examples are GitHub, still broadly neutral as a code host eight years after Microsoft paid $7.5bn for it, though its formal independence ended in 2025, and OpenRouter itself. The difference is what the buyer sells. Microsoft does not sell the compute every repository compiles for, and Stripe sells no models. Nvidia sells the layer every model on the hub runs on, and for well over a decade, from the Linux driver fight to Mellanox to Grace and Vera, it has used each layer it owns to secure the one below.[35]

That history also answers the objection that an acquirer will destroy what makes the hub valuable. Nvidia needs the hub full: it wrote the July letter against restricting open weights, Chinese ones included, it ships Nemotron there, and a hub nobody visits routes nothing.[24] So nothing gets switched off. It gets narrowed. Mellanox kept selling InfiniBand to everyone; the firmware notes now say NVIDIA “does not support InfiniBand cables or modules not qualified or approved by NVIDIA”, which every switch vendor says. That is the point: nothing is banned, but there is a list.[36] Run:ai’s founders said the software would be open-sourced; the scheduler was, the platform was not.[37] vLLM is still open; NIM 2.0 is now built on vLLM alone, inside a licensed container that is free to try and paid in production.[38] Nvidia, which reported $89bn of data-center revenue for the quarter on 26 August, is not buying a hub to sell more GPUs. It is buying the paid software that attaches to every download and the right to choose the default for models that would otherwise run on Trainium or TPUs.[10]

Apply that to the hub, and nothing happens on day one. The models stay; the Chinese models stay, now with a lobbyist. What changes is the direction the page tilts: NIM moves to the top of the Deploy menu, and enterprise features now include a line referencing NVIDIA AI Enterprise. The Optimum libraries are permissively licensed, and the vendors’ own engineers already maintain them; even the default endpoint is one environment variable away, as China’s mirrors prove daily.[39] What cannot be forked is the traffic: the download counts, the discovery graph, the place everyone looks first. Each step is defensible.

Verdict

Hugging Face did not lose its neutrality. It was structured so that nobody could pay to keep it, and this summer it found out what keeping it costs. The one company that gains nothing from the hub’s neutrality is the one that gains most from owning it, and it made the only reported offer. If a rival bid surfaces before signing, that argument is wrong, and I will say so. And if, a year after closing, the Deploy menu still ranks by anything other than Nvidia attach, the second half of this piece is wrong too.

In March, I wrote that Nvidia’s kind of open is a black hole: nothing that crosses the event horizon comes back out. The physics adds one detail worth keeping. From the outside, a crossing is invisible. The star never winks out; it hangs at the horizon and slowly dims. A year from now, the hub will still be there, and the models will still be open. Mellanox still sells InfiniBand to everyone. Run:ai’s scheduler is still open source. vLLM is still free. It is what crossing looks like.

Notes

[1] Business Insider, 23 Aug 2026, as relayed by Reuters and Bloomberg. Business Insider cited annualized revenue of more than $100m. Bank not named; no bidder named.

[2] The Information, “Nvidia Agrees to Buy Open Source Model Repository Hugging Face For $12.9 Billion”, 26 Aug 2026; Reuters relayed the same evening US time; Bloomberg, “Nvidia Discussed Buying AI Startup Hugging Face, Insider Says”, 27 Aug 2026. Gizmodo reported the deal as “still being finalized.” Neither company responded to Reuters. No 8-K would necessarily be required at this size relative to Nvidia’s market capitalization.

[3] Business Insider, 28 Aug 2026, via TechTimes: no signed contract; talks could collapse. Thomas Wolf interview, The Next Web, 29 Aug 2026. Nvidia Q2 FY2027 call, 26–27 Aug: no mention of the deal.

[4] Julien Simon, “Open Source, Closed Orbit: The Hardware Monopolist’s Guide to Owning Open Source”, The AI Realist, 13 Mar 2026. Pricing: NVIDIA AI Enterprise Licensing Guide, updated 8 Jun 2026: $4,500 per GPU per year, self-managed subscription. Libraries: Optimum for Intel Gaudi (Apache-2.0, last release Apr 2026), Optimum Neuron (Apache-2.0, Feb 2026), and the AMD kernels in hf-rocm-kernels. The March piece also listed Optimum TPU; see note 22.

[5] TechCrunch, “Hugging Face raises $235M from investors including Salesforce and Nvidia”, 24 Aug 2023; Salesforce Ventures confirms it led. $4.5bn is the post-money valuation; $235m at that price represents about 5% in aggregate. Total raised about $395m; no priced round reported since. Hugging Face has never published its board; no outlet reported a board seat for any Series D investor.

[6] Microsoft, “Microsoft and Hugging Face expand partnership… on Azure AI Foundry”, 19 May 2025 (10,000+ models). Hugging Face, “Google Cloud partnership”, 19 Nov 2025: CDN gateway, native TPU support, “over 1,500 terabytes of open models and datasets are downloaded and uploaded between Hugging Face and Google Cloud” daily. Hugging Face, “Bedrock Marketplace”, 9 Dec 2024, and AWS.

[7] Amazon, “AWS to acquire DuckLabs”, 26 Aug 2026: “We are not acquiring the DuckDB open source project, which will remain free and open source under the independent DuckDB Foundation”; price undisclosed; DuckDB Labs becomes a wholly owned subsidiary with the team in Amsterdam (GeekWire). MotherDuck’s Jordan Tigani on the same day: “That’s Amazon’s playbook, after all: wait until an open source project gets big enough, then launch it as a service.” Amazon’s $50bn OpenAI investment, announced 27 Feb 2026, completed 31 Jul 2026 (PYMNTS). Globalstar: CNBC, 14 Apr 2026.

[8] Google–Wiz: closed 11 Mar 2026 after a “12-month regulatory review process” (Cleary Gottlieb); DOJ cross-appeal seeking Chrome and Android divestiture filed 3 Feb 2026 (CNBC). Amazon–Globalstar: $11.57bn, 14 Apr 2026, close expected early 2027 (Bloomberg); FTC v. Amazon trial set for 29 Mar 2027 (MLex). Meta–Scale: 49% non-voting, Jun 2025 (Axios); Warren, Wyden and Blumenthal to FTC/DOJ on Meta–Scale, Google–Windsurf and Nvidia–Groq, 4 Feb 2026 (Warren). Salesforce: $25bn accelerated repurchase, Q1 FY27 call, 28 May 2026 (transcript); Benioff, X, late Jul 2026: “Mahalo, @JensenHuang!… on Hugging Face (where we led the last round).” Apple’s largest acquisition remains Beats, $3bn, 2014. The “second request” line is my characterization, not a reported regulator view.

[9] Business Insider reported banks engaged to “evaluate incoming bids”; none has been named. Bloomberg Opinion (Parmy Olson, 31 Aug 2026, via Taipei Times) floated Salesforce as a potential acquirer; no bid has been reported.

[10] NVIDIA, Q2 FY2027 results, 8-K exhibit, 26 Aug 2026, quarter ended 26 Jul 2026: revenue $96.2bn, data center $89.0bn; cash, equivalents and marketable securities $99.4bn; first-half repurchases $39.0bn plus $6.3bn of dividends; $99bn of authorization remaining. $89.0bn over 91 days ≈ $0.98bn a day; $12.9bn ≈ 13 days.

[11] Groq: ~$20bn license plus hires, Dec 2025; Warren and Blumenthal to Huang, Mar 2026: “by licensing its technology and hiring its most important employees, NVIDIA has effectively acquired Groq in all but name” (Warren). Poolside: $6bn non-exclusive license plus $1bn equity, 109 engineers, ~20 Aug 2026; investor letter: “not an acquisition and it is not an acquihire” (TechTimes). FTC chair Ferguson, Jan 2026: the agency will review whether acqui-hires are “being constructed to try to escape Hart-Scott-Rodino review” (WilmerHale). A $12.9bn stock purchase is far above the HSR threshold; no outlet has yet reported on the review, and the deal structure is unreported.

[12] Financial Times, “Why AI start-up Hugging Face turned down a $500mn Nvidia deal,” 28 Jan 2026, via OODA Loop and The Fly. The reasoning is the FT’s account from people familiar with the matter; the company declined to comment. Several August rewrites date the offer to “earlier this year”; the FT says late 2025.

[13] FT, ibid.: profitable in 2025, a first-quarter 2026 loss on dataset investment, roughly half of the ~$400m raised still on the balance sheet. Delangue on TechCrunch’s Equity podcast this summer, quoted in TechCrunch, 24 Aug 2026: “close to profitability”; had only “recently started to touch the money that [it] raised three years ago.” Unaudited: the CEO’s own account.

[14] The Information, “Hugging Face Annualized Revenue Jumps 50% to $150 Million”, Aug 2026: “more than $150 million in annualized revenue, a 50% increase from two months ago.” Annualized run-rate, not contracted ARR; much of the revenue is usage-based compute. Business Insider’s $100m figure (note 1) is consistent with a June snapshot. What drove the jump is not reported.

[15] $12.9bn ÷ $150m ≈ 86x. Mechanical price: $7bn × ~1.5 (growth since the refused offer) × ~1.3 (control premium; 30–50% is the conventional public-market band) ≈ $13.6bn. Figma: Adobe’s 15 Sep 2022 release, ~$20bn against “surpassing $400 million in total ARR exiting 2022,” a projected figure, ≈50x. Wiz: $32bn against $700m ARR at announcement (TechCrunch, 18 Mar 2025), ≈46x.

[16] OpenAI confidential filing announced on 8 Jun 2026 (TechCrunch); Anthropic reportedly filed about a week earlier. Sarah Friar at an all-hands, CNBC, 19 Aug 2026: “will be a public company in 2027,” possibly sooner if “our business continues to inflect.” The IPO-at-half estimate is mine, on public software multiples of 15–25x forward revenue. Conversion of all preferred at this price is an assumption, given $395m raised. No employee tender has been reported since 2023.

[17] Axios, 18 Nov 2025: “I think we’re in an LLM bubble, and I think the LLM bubble might be bursting next year.”

[18] Hugging Face, “Security incident disclosure, July 2026”, 16 Jul, and “Anatomy of a Frontier Lab Agent Intrusion: Technical Timeline”, 27 Jul 2026: window 9–13 July; “the attacker was bound by no usage policy, while our own forensic work was blocked by guardrails of hosted models we first tried”; analysis of 17,000+ actions run on Z.ai’s GLM-5.2 in Nvidia’s optimised build. Delangue, Face the Nation, 2 Aug 2026: “We used the American version of a Chinese model.” OpenAI, “Hugging Face model evaluation security incident”, 21 Jul, and full report of 26 Aug 2026 (TechCrunch): a pre-release Astra-family model in the ExploitGym evaluation escaped its sandbox; “misaligned behavior in an outlier scenario.”

[19] TechCrunch, 26 Jul 2026: Delangue asks for agent traces and “$100 million in computing resources” for community cyber-defense. Axios, 13 Aug 2026: state attorneys general preservation demands; TechTarget, 13 Aug: AI coverage “rapidly changing right now”; Axios, 26 Aug: Alabama attorney general subpoena. No compensation, insurance claim, lawsuit, or Hugging Face cost figure has been reported. Reuters and Decrypt tied the sale exploration to “a month after” the incident.

[20] CNBC, “From Llamas to Avocados”, 9 Dec 2025. Meta AI, “Introducing Muse Glimmer”, 10 Aug 2026: 30B dense, Apache-2.0, “trained on Muse Spark’s outputs using logit distillation,” sized for a single consumer GPU. Meta says Muse Spark 1.2 weights will follow; until they do, the top of Meta’s line is closed. No formal end of the Llama line has been announced.

[21] Tom’s Hardware, 26 Apr 2026: DeepSeek V4-Pro, 1.6T parameters, MIT licence, “optimized for Huawei’s Ascend AI processors”; Huawei confirmed day-one support across the Ascend 950 line.

[22] huggingface/optimum-tpu, archived 23 Jan 2026, last release Dec 2024. Optimum AMD’s own repository has been dormant since 2023; AMD support moved into mainline Transformers and the Kernel Hub.

[23] Stripe, “Stripe agrees to acquire OpenRouter”, 19 Aug 2026; about $7.5bn per the New York Times (TechCrunch); Bloomberg had reported a deal “over $7 billion” on 16 Aug. OpenRouter lists Nvidia as a customer; its six most-used models in July were all Chinese open-weight models.

[24] “Open Weights and American AI Leadership,” 24 Jul 2026, authored by Jensen Huang, 25 founding signatories including Hugging Face, Microsoft, Meta and IBM; Salesforce, Amazon, Anthropic and Apple did not sign (Tom’s Hardware, TechCrunch). Nvidia, Open Secure AI Alliance, 27 Jul 2026, with Hugging Face as a member. Nemotron 3.5 Lightning, 11 Aug 2026; The Information, 11 Aug: Nemotron 4 at a trillion-plus parameters targeted for late fall.

[25] Hugging Face, “State of Open Models: Summer 2026”, 14 Aug 2026: Qwen 2,045M downloads in 2026; 151,448 Qwen derivatives against 28,531 for Llama. TechCrunch, 14 Jul 2026: Chinese open-weight models 41% of hub downloads, spring 2026. “More than the rest of the open ecosystem combined”: Interconnects, Jan 2026, on December 2025 downloads. Delangue, CNBC, 3 Aug 2026.

[26] Axios, ~20 Jul 2026, via Fast Company: administration “reviving a push to ban Chinese AI models,” Entity List floated as the mechanism. House Homeland Security and Select Committee on the CCP letters to Anysphere and Airbnb (Apr 2026) and DoorDash (31 Jul 2026). No letter to a hosting platform has been reported. “No lobbying budget” is my characterization; Hugging Face has a policy team but no reported federal lobbying spend.

[27] Reuters, 7 Jul 2026, three sources: MOFCOM met Alibaba, ByteDance and Zhipu over the preceding month on restricting overseas access to advanced models including open-weight versions (summary at explainx); Jamestown Foundation, “Beijing Signals Tiered Governance of Open-Weight Models”, 13 Aug 2026: basic tier files, advanced tier faces security review, frontier tier domestic-only or unreleased; discussion stage, not yet policy. Jamestown also documents Alibaba keeping Qwen 3 Max API-only.

[28] DeepSeek, V4 Preview release note, 24 Apr 2026, links weights only to huggingface.co; moonshotai/Kimi-K3, weights 27 Jul 2026; GLM-5.2 on Hugging Face and ModelScope, 13 Jun 2026; Qwen3.8-27B on both, evening of 14 Aug 2026 Beijing time. No case of a Chinese model being withdrawn from the hub has been reported.

[29] Block: ChinaTalk, 19 Oct 2023 (intermittent from May 2023, blocked from 12 Sep 2023); Hugging Face to Semafor, 20 Oct 2023: “there’s not much we can do against government regulations for now.” hf.space unreachable from the mainland from Nov 2025 (forum thread). hf-mirror.com is community-run; no Hugging Face involvement is documented. The departure of the head of its Asia-Pacific ecosystem is confirmed by his own public note and by Rest of World, 15 Jun 2026. No Chinese entity, licensed mirror, or Chinese-cloud partnership has ever been announced; the absence is an inference from the public record.

[30] Alibaba, Sep 2025: ModelScope passed 100,000 models and 18m users (DOIT); Hugging Face had about 2.4m models in January and 2.96m in August 2026 (note 25). User figures are not like-for-like.

[31] NVIDIA Q2 FY2027 call, 26 Aug 2026, Colette Kress: “we ship less than 1% of our total data center revenue in Hopper 200 products to customers based in China in accordance with the U.S. Government licenses”; “there is no China data center compute revenue in our forward outlook”; also Kress: “NVIDIA runs the leading closed models,” and Huang: “Nearly all open models run on NVIDIA” (transcript). SAMR preliminary finding, 15 Sep 2025, that Nvidia violated the Anti-Monopoly Law in relation to the Mellanox conditions; investigation continuing (CNBC).

[32] Tom’s Hardware, “Nvidia and 24 other companies sign open-weights letter”, 24 Jul 2026: Anthropic, OpenAI and Google absent at launch; OpenAI and Google joined within days, Anthropic did not. Open Secure AI Alliance membership: NVIDIA, 27 Jul 2026. Anthropic, “Our position on open-weights models”, 27 Jul 2026: “Anthropic has never advocated for a ban on open-weights models”; “Open-weights models that don’t have dangerous capabilities are a public good”; “We should not sell powerful chips or chipmaking equipment to China.” Lobbying: New York Times, reported 25 Jul 2026 (summary at implicator.ai); the Alibaba distillation claim was made to the Senate in 2026. The interpretability team has published small open-weight research models on the hub; no Claude weights.

[33] Amazon, 20 Apr 2026: $5bn plus up to $20bn, “up to 5 gigawatts of Trainium capacity,” Anthropic to spend “$100 billion” on AWS over a decade. Google and Anthropic, 6 Apr 2026: “multiple gigawatts” of TPU from 2027, on top of the Oct 2025 deal for up to one million TPUs; Google to invest up to $40bn (TechCrunch, 24 Apr 2026). AMD, 22 Jul 2026: up to 2GW of MI450, first gigawatt in H1 2027, up to $5bn equity. Nvidia and Microsoft, 18 Nov 2025: up to $10bn and $5bn respectively, $30bn of Azure, up to 1GW of Grace Blackwell and Vera Rubin. The “minority by announced capacity” comparison is mine; no analyst split has been published, and contracted gigawatts are not delivered gigawatts. Shareholdings: Google about 14% (court filings, 2025); Amazon’s position valued at $74bn at the Series G (Fortune, 4 Jun 2026); Nvidia and Microsoft stakes undisclosed.

[34] Google and AMD signatures: Tom’s Hardware, ibid. Amazon–OpenAI: $50bn, $15bn immediately, completed 31 Jul 2026 (note 7). Amazon is reported to be evaluating OpenAI and its own models for internal workloads after Anthropic price increases (The Information, via Techzine, 30 Jun 2026). Next Platform, 13 Aug 2026, draws the open-versus-closed line; no published analysis ties the labs’ silicon choices to it.

[35] Microsoft, “Microsoft acquires GitHub”, announced 4 Jun 2018, closed 26 Oct 2018, $7.5bn. GitHub folded into Microsoft’s CoreAI group without a successor CEO, Aug 2025 (Runtime). Torvalds on Nvidia’s drivers, Aalto, June 2012; open kernel modules from 2022 (NVIDIA). Mellanox: $6.9bn announced Mar 2019, closed Apr 2020, brand retired Aug 2020 (NVIDIA). Vera CPU shipping since May 2026 (Benzinga). Also the CUDA EULA clause barring translation of compiled output “to target a non-NVIDIA platform” (Tom’s Hardware) and NVLink Fusion, licensed to third-party silicon only when paired with an Nvidia GPU or CPU.

[36] NVIDIA ConnectX-6 firmware release notes, “Validated and Supported Cables and Switches”, verbatim; the same text appears across ConnectX and Quantum release notes. Pre-acquisition Mellanox held roughly 55–60% of the InfiniBand market and sold to all comers (see the March piece).

[37] Run:ai founders at closing, quoted by Tom’s Hardware, 30 Dec 2024: “open sourcing the software will enable it to extend its availability to the entire AI ecosystem.” NVIDIA, “NVIDIA Open Sources Run:ai Scheduler”, 1 Apr 2025: KAI Scheduler under Apache-2.0, which “continues to be packaged and delivered as part of the NVIDIA Run:ai platform.” About $700m as reported; EU clearance unconditional (European Commission).

[38] NVIDIA NIM for LLMs 2.0 overview and 2.0.1 release notes, Mar 2026: “a ground-up redesign that adopts a one-container, one-backend philosophy”; the 1.x multi-backend container (vLLM, TensorRT-LLM) “is replaced by a dedicated vLLM container.” Free under the Developer Program; production under NVIDIA AI Enterprise (note 4).

[39] HF_ENDPOINT in huggingface_hub constants; hf-mirror.com instructs users to set it. Optimum for Intel Gaudi and Optimum Neuron are Apache-2.0; Optimum AMD is MIT.

On August 21, 2026, Papua New Guinea's Minister for State Enterprises presented Kumul Cloud Infinity, which the country has described as its "first sovereign cloud and AI data centre."[1] The system is perfectly in the Western manner: cloud software from CloudSigma, a company based in Zurich, which offers the same "sovereign" platform to a number of service providers in over thirty-five countries; hardware from Hewlett Packard Enterprise; NVIDIA H200 GPUs; and gas-powered backup power supplied by a local partner.[2] The operator is Datec PNG, a subsidiary of Telikom, which is itself held by Kumul Consolidated Holdings, the state's holding company. It was launched as a commercial success.

None of the following information was made public in the operator's press release, the holding company's release, or any subsequent reports: the cost, the megawatts, the GPU count, the rack count, the tier certification, or the financing source. All of these details. I have checked six sources, including the two official ones. The extent and cost of Papua New Guinea's sovereign AI infrastructure are a secret, possibly even from the people paying for it.

The other building is located across town. The National Data Center was constructed by Huawei and opened in 2018, with funding from a reported $53 million loan from China’s Export-Import Bank.[3] In 2020, a review carried out by Australia’s foreign ministry on behalf of PNG’s own cyber-security agency discovered that the facility’s encryption algorithm had been "openly broken" for years, that its firewalls had reached the end of their life two years prior to the day it opened, and that its core switches were outside the firewall, meaning that remote access could not be detected.[4] Most of the government departments had never moved into the center. PNG’s ICT minister described the asset in official remarks as "a failed investment."[5] It has not been made public whether the loan has been repaid.

A single capital, a single decade, and the buildings of both superpowers.

The correct approach to understanding those buildings is not to look at IT procurement; it is to consider the oldest form of transaction in geopolitics: the foreign base. A base is not simply about the concrete; it is about physical presence. The patron puts hardware within the host's territory, and the host shows its alignment by accepting it, while rivals are prevented from using that ground. A data center is not a base: it has no soldiers, no jurisdiction, and it does not deny ground to anyone.

All of the instinctive interpretations are incorrect, and the reasons for this are worth giving. The account is not about Chinese debt traps. According to the specialist literature, Beijing has arranged the loans so that they are repaid, either by collecting the debt or by rescheduling it rather than by seizing the assets; in this case, the loan is the result, not the trap.[6] It isn't a story about NVIDIA taking control of the Global South. When its own chief financial officer speaks of sovereign AI revenue, the only countries mentioned are the rich ones.[7] Nor is it a story about gullible governments, as Port Moresby itself will show before this article is finished.

What a base actually costs, and who pays

For 70 years, the foreign base machine has operated using a well-documented payment route from patron to host.

Djibouti is simultaneously renting out its geographical location to five armies. According to the most recent figure provided by its finance minister, the United States paid around $65 million per year for Camp Lemonnier, France paid about $30 million, China was reported to pay $20 million for its first overseas base, and both Italy and Japan paid roughly $3 million each, making the total annual amount about $121 million. A Djiboutian official summed up the nation's business strategy in a single sentence by saying that the country's geography is its primary national resource, just as oil is for the Gulf states.[8]

Kyrgyzstan conducted its trade through auctions. In 2001, the United States paid about $2 million per year for the Manas Air Base. By 2006, the rent had increased to $17.4 million. In 2009, Moscow made a counter-offer to Bishkek in the form of $2.15 billion in aid and loans so as to drive the Americans out; Kyrgyzstan declared that it would close the base, allowed the bidding to proceed, and then re-let it to the United States for $60 million a year, thirty times the original price.[9] The geography had not changed; what had changed was that two patrons were now bidding. Likewise, the 2025 treaty concerning Diego Garcia obliges the United Kingdom to pay an average of about £101 million per year to Mauritius, for a period of 99 years, in order to keep the Indian Ocean base which it leases on to the Americans, though the bill implementing the treaty has stalled at Westminster and, at the time of writing, no pound has yet been paid.[10]

Honesty demands that we look at counterexamples as well: Japan pays Washington around ¥211 billion each year in host-nation support—approximately $1.5 billion, depending on the exchange rate—and South Korea about $1.1 billion.[11] Therefore, the rule has never been that 'the patron pays'. The rule is that the direction of payment follows bargaining power.[12] When the host country is rich, under threat, and needs the patron more than the patron needs the location, the host pays for protection. In the case of poor host countries with geographical advantages, they receive payment because of their location. If all you have is your position, that is worth actual money, and the competition among the superpowers drives up the price.

For AI data centers, almost everyone now pays the way Japan does, even countries that have nothing to offer except their location.

The ledger

For this article, I compiled a census of sovereign cloud and sovereign AI initiatives in the countries that the AI conversation never addresses: not the United States, China, the EU's big five, or the Gulf states, but rather the long tail: 59 programs in 47 countries, ranging from Papua New Guinea to Paraguay, Zambia to Kazakhstan. Almost all of them have been announced or launched between January 2024 and August 2026, together with a small number of earlier projects kept as precedents.[13]

There is no information given about a single signed power purchase agreement. Of the 23 that announce an investment figure, only seven are based on actual documentation, such as a signed contract, a disbursement, or a formal EU award. The others consist of rounded figures—such as $250 million, $1 billion, and $10 billion—announced at GITEX or GTC, the Gulf and NVIDIA trade shows, not at ribbon-cutting ceremonies. Specific and documented figures appear only in cases where a lender's or counterparty's documentation requires them: €66.55 million in a document relating to an African Development Bank project, €36 million in the EuroHPC procurement—the EU's joint supercomputing initiative—and an $18 million three-year contract with Oracle.

In all other cases, the figures are given in rounded form. Forty-two per cent of the programs have never gone beyond the paper stage, meaning only an announcement, a policy, or a memorandum of understanding. Nearly sixty per cent have not produced any actual computing power at all. Very few name a paying customer; in instances where an anchor tenant is mentioned, it is almost always the government paying for the building, and a true arm's-length tenant (such as Kenya's Everse Technology or Thailand's Mahidol University) appears in only a very small number of cases.

It is normal for private data centers not to disclose their power purchase agreements. However, in the case of these projects, which are state-sponsored sovereignty initiatives sold to legislatures on the grounds of national interest, the entire risk lies in the electricity bill, and by limiting the count to the 31 programs that are either currently operational or under construction, the figure of zero remains unchanged

Prepare the ledger for these transactions based on the two-column format that any analyst would use. What does the host get, and what does the host pay?

Kenya obtained a loan of RMB 1.225 billion, approximately $180 million, from China EXIM at an interest rate of 2 percent, with a grace period of about seven years, to construct the Konza National Data Center, with Huawei as the sole contractor. The first payment was due on March 31, 2026.[14] According to Kenya's Auditor-General, the facility being repaid for had a disaster-recovery site that was "not operational", lacked fire suppression systems, with the data being backed up on the same servers situated in the Primary Data Center, no data protection officer having been appointed, and no vetting having been carried out of either the customers or the staff within the building.[15] Those are the shortcomings of the state operator, not the contractor's; yet they are the very things the loan was used to acquire. The cloud revenue earned at Konza for the year up to June 2025 was KSh 126.8 million, which can be rounded to 1 million dollars. It had decreased by 16 percent.[16]

In all cases where China is not the one providing the funds, the situation fails to improve. Instead, the host country and its partners just pay each other. Armenia is financing its declared $500 million NVIDIA-stack 'AI factory' via a private developer and a diaspora foundation. Kazakhstan has entered into a $10 billion framework agreement for a gigawatt-scale 'Data Center Valley' on its own and its partners' balance sheets. The financing arrangement in Papua New Guinea remains, as has been noted, a secret.

The census involves two types of arrangements. In some cases, the program is based on state contributions: the government borrows money in order to build the infrastructure itself, using its own balance sheet, for example, in Kenya, Zambia, Senegal, and the 2018 PNG facility. In other instances, it is a private colocation venture—such as Malaysia’s YTL, the pan-African Cassava, Vietnam’s FPT, and an Indonesian project financed by I Squared—where a foreign fund assumes the risk of construction and 'sovereign' is used as a marketing point in government tenders. Armenia and Kazakhstan fall between the two categories, with both state and private partners sharing the cost. It is important to distinguish between the two: the group comprising loans and Chinese-built projects is uniformly disappointing, whereas when a private operator assumes the commercial risk, the investor bears that exposure, not the taxpayer.

Yet even in the case of privately financed projects, the silicon is imported under the laws of another country, and on the American side, there is no concealment regarding the direction of this flow. OpenAI’s program for third countries states that partner countries “will invest in expanding the global Stargate Project”: the host country is required to fund the patron’s network.[17] It is reported that the UAE’s chip deal requires that for every dollar Abu Dhabi invests in the Stargate UAE project, a dollar must also be invested in AI infrastructure on US soil.[18] The Export-Import Bank’s new AI export program is, in effect, buyer’s credit: America lends you the money needed to buy its chips.[19] The United States’ development finance arm has granted one major loan for a data center in Africa: up to $300 million to a commercial pan-African company, with $83 million disbursed by 2022, the most recent figure available.[20]

At the same time, the demand for the facilities said to have been built is measurable: the $1 million per year in Konza, which is decreasing, is an example of the situation in one of Africa's most digitally advanced economies. You can't fill 100 megawatts with that amount, any more than you can fill ten. That is why the biggest initiatives in the census have quietly given up pretending: Kazakhstan claims to generate "at least $3 billion in annual export revenue," and Guyana's facility "will meet international demand.” Put simply, since there is no domestic demand for such services, we are going to have foreign customers' computing carried out on our grid, on our balance sheet, under our own flag. A sovereign facility whose business case is based on serving foreign customers is not true sovereignty; it is simply an export processing zone with more effective marketing.

The lack of demand refers to demand for frontier-training; real demand does exist for ordinary enterprise colocation—such as disaster recovery, hosting, and data repatriated from Frankfurt—and this demand fills private data centers like those of YTL and Cassava. Moreover, the offshore option is by no means free, since renting hyperscale capacity abroad involves currency outflows, latency, and exposure to foreign jurisdictions, which later becomes clear in the health-data deals.

The company at the heart of the situation has stated its view in the one language that matters. When asked by analysts during the February earnings call, NVIDIA's chief financial officer said that sovereign AI revenue had "more than tripled" to over $30 billion in fiscal 2026, with the increase mainly driven by customers in five wealthy countries.[7] The term "sovereign AI" has not appeared in either an NVIDIA 10-K or a 10-Q; it only appears in comments made during earnings calls, in press releases, and in the stylish annual report, and is absent from the officially audited documents. In the first quarter of fiscal 2027, sovereign revenue continued to rise — by more than 80 per cent year on year, compared with 85 per cent for the company as a whole — and it was included in a new classification divided between "Hyperscale" and "ACIE" (AI Clouds, Industrial and Enterprise), a breakdown that no longer separates out sovereign revenue and in which the word is completely omitted from the press release.[7] The label is being phased out and absorbed into the hyperscale category just as the long tail embraces the proposal.

The armory

The second key point after the payment rail is that while the host controls the territory, the patron controls the weapons: sovereignty extends to the perimeter but not to the armory. In this case, the argument "these are merely commercial arrangements, not bases" is answered by precedent, since one type of procurement has always included a supply restriction and a monogamy clause: advanced arms. Turkey was excluded from the F-35 program in 2019 for having purchased Russian air defense systems; the fighter is the proper analogy here: an alignment tool priced as a capital expenditure and obtained at a price that is too high. The difference in this instance is even more stark: at least with the F-35, a buyer gets a weapon that works for him, whereas the statistics show that buyers have no workloads. The alignment is, in fact, the whole product. The restriction itself is incorporated into US regulations and functions in three stages. Those who have read "Access, Disable, Destroy" will be familiar with the chip layer of the coercion system; the rings are that layer divided up by time—the chips you have not yet received, the chips you currently have, and the chips themselves.

The first layer relates to future supplies and is firmly in place. Any export license granted under the US regulations concerning AI chips is, by regulation, "open to revision, suspension or revocation in whole or in part without notice".[22] This is not merely a possibility; it has already been put into practice by revoking licenses against the adversary and by making midstream revisions to allied buyers, though not yet against a long-tail recipient. In 2024 alone, Washington canceled eight existing export licenses to Huawei, including those held by Intel and Qualcomm. In October 2023, orders from the Gulf region for NVIDIA chips were halted midway due to a change in the rules, as noted in NVIDIA's own 8-K filing, which lists Saudi Arabia and the UAE.[23] The regime has been rewritten on three separate occasions within three years and can therefore alter the terms beneath whatever system a recipient is using. The rule issued in July 2026, which facilitates access for the UAE, is the most revealing of all: chip exports on a license-free basis go only to a whitelist of eight named American companies and to specific UAE government agencies—plus G42 and Core42, the UAE's own national champions, whose eligibility automatically expires in April 2027 unless they arrange a restructuring that satisfies Washington.[24] Even the most favored recipient in the system has its status on a lease that includes a sunset clause.

The Validated End User (VEU) regime, which applies to data centers, serves as the link between the first and second rings, the condition for secure and lasting supply being a check of the delivered floor. If a foreign facility wishes to gain access to chips on a durable basis under the VEU arrangement, as stated in the Federal Register, it agrees to "on-site compliance reviews by representatives of the United States Government" and submits semiannual reports to Washington covering its chip inventory, its compute utilization, and its customer list.[25] At present, no host country is included in this VEU scheme; it has so far only been put into practice for deployments at the scale of hyperscalers, and the July 2026 UAE license-free authorization is now listed alongside it. Nevertheless, it is a model that can be applied to any long-tail host that may grow in size at some point. A data center considered sovereign and operating under the VEU system must submit its customer list to a foreign power twice a year and allow that power's inspectors to conduct inspections at the facility. Status-of-forces agreements have granted American military police authority over American personnel and installations located on the soil of a host country; similarly, the VEU gives American export-control officers access to the server room. And if your company rents capacity in one of these facilities, then your name will appear on that ledger.

The second ring involves hardware, the mechanism in this case being a failure rather than a switch. A frontier cluster is not a fixed entity; it is a subscription. CUDA updates, firmware, enterprise software licenses, interconnect spares and RMA replacements all come from the vendor under terms that include US export law, and once the operator is placed on the Entity List — that is, Washington's export blacklist — any servicing, spares or updates will require licenses which are likely to be denied. If a cluster is severed, it does not cease to function; instead, it deteriorates, drifting away from the frontier as the software stack freezes and becomes out of service after a number of years, because failed GPUs, optics, and switches exceed the capacity of an empty spares store. The possibility of disablement by the supplier is no longer merely theoretical but directly relevant: equipment from John Deere that was looted from Ukraine and taken to Chechnya was remotely locked via the dealer's connection, according to the reports; in 2024 Microsoft cut Russian companies off from their existing cloud services as a result of EU sanctions; when Nokia and Ericsson withdrew, Russia's mobile networks were left to degrade without attention; and ASML has reportedly promised the Dutch government that it can remotely disable EUV machines in the event of an invasion.[26]

The third ring is the one people most frequently inquire about — a kill switch built into the silicon — and the only straightforward thing to say is that it has been claimed by Beijing, denied by Santa Clara, and not verified by anyone. In July 2025, China's cyberspace regulator called NVIDIA over alleged 'tracking and positioning' and 'remote shutdown' capabilities in its chips sold in China; NVIDIA responded with a corporate blog post that, in effect, stated there were no backdoors. No kill switches. No spyware.[27] A congressional bill requiring location-verification features on AI chips exported from the United States has passed its committee but is not yet law; should it become law, the third ring would cease to be a point of dispute and become mere speculation.[28] I will not state that the third ring is a fact, nor should anyone else. However, note what the dispute itself shows: both superpowers take the possibility seriously enough to pass legislation on it and summon company executives to discuss it. When it comes to bases, the issue is not whether the weapons on them are loaded. It is about who holds the keys — and no one disputes that the keys are not in the host's pocket.

The rings are not an American patent; if you want to see the first ring demonstrated on a live subject from both sides simultaneously, Malaysia conducted the demonstration in May 2025. On the 13th, Washington stated that using Huawei's AI chips anywhere in the world would risk breaches of US export controls. Six days later, a deputy minister from Malaysia launched what was described as the region's first sovereign full-stack AI system — comprising Huawei Ascend chips and DeepSeek models, thereby presenting the entire Chinese alternative. However, within about forty-eight hours, the ministry withdrew the announcement.[29] In the same week, a small country experienced the effect of Washington's first ring and Beijing's supply chain, and its sovereignty was publicly revised twice.

The host goes around the perimeter; the patron has control of the armory; and, unlike any other base host in history, this one paid for the armory out of its own money first.

Two empires, two ledgers

The situation would be neater if all this were the result of two master plans; it isn't, since the basic metaphor introduces a kind of intentional purpose on the part of a patron, which the evidence does not back up. Neither empire came up with this plan. Their failures are mirror images of each other, and it was only in the last three years that either one had begun to act with deliberate intent.

China originally built the ladder by accident and has since taken on the role of governing it. According to peer-reviewed literature, the "Digital Silk Road" has no clear plan of action or strategy for implementation; as of the most recent public count, only 16 countries had signed a DSR agreement, contrary to Huawei's own figure of "800+ government cloud projects worldwide."[30] A study by AidData, which examined more than thirteen thousand Chinese projects, found that joining the Belt and Road did not alter in the slightest who Beijing funded or the terms on which funding was provided: it was essentially a rebranding rather than a shift in strategic direction.[31] Chinese digital lending to Ethiopia began in 2006, 13 years before Addis signed any agreement that included the phrase "Belt and Road". A truthful account of the period from 2006 to 2022 is that Huawei was pursuing revenue, the two policy banks were trying to increase their loan volumes, and Beijing simply painted a slogan on the outcome.

Yet emergent sequencing had nevertheless created a genuine ladder, and you can climb it. In the case of Senegal, over eighteen years with just one vendor: a government intranet in 2006, followed by three thousand kilometers of fiber, then an $85 million China EXIM broadband initiative whose key element was a national data center into which government data was sent back, then a Chinese-funded 'Smart Senegal', and then a Safe City program featuring nearly five hundred facial-recognition cameras.[32] Pakistan has the entire ladder along with the geographical advantages—fibre running along the China–Pakistan Economic Corridor, the Huawei-built PEACE cable at Karachi and Gwadar, safe cities, and now a Huawei AI data centre—as well as the same vendor at each stage and the policy banks at most of the steps.

Since October 2023, the retrofit has become intentional. At the Belt and Road Forum, Xi launched China's Global AI Governance Initiative. In July 2026, the World AI Cooperation Organization was established in Shanghai with twenty-nine founding members, including Laos and Pakistan, which are described as ladder clients. The UN's Group of Friends on AI capacity-building, consisting of some eighty countries, is jointly chaired by China and Zambia—a country that was a $65 million client of EXIM and Huawei in the first, pre-AI round of data center lending and whose own parliament had recorded hardware that had been installed in a district without any electricity.[33] The country that had been in debt then became a co-sponsor. Throughout all this institutional development, Chinese sovereign lending commitments, according to Boston University's database of the two policy banks, have collapsed from $62.5 billion in 2016 to $6.1 billion in 2024.[34] China is now running the institutions while spending 90% less money. The brand began as fiction and later became a reality.

At the same time, the United States has funds without a clear plan. In principle the necessary structures are in place: an executive order of July 2025 concerning the export of the 'complete American AI stack', an American AI Exports Programme, a diplomatic group known as Pax Silica, Technology Prosperity Deals, a new EXIM financing facility, and a development finance corporation for which Congress has more than tripled the lending limit, raising it from $60 billion to $205 billion.

In reality, the executive order does not name any specific countries; it is up to private consortia to choose the markets, and the Commerce Department issued an official request asking the public to indicate which countries should be given priority. Twelve months after the order, no export packages have been designated, and no EXIM AI deals have been financed. All four of the Technology Prosperity Deals have gone to the United Kingdom, Japan, South Korea, and Sweden. At its June summit, Pax Silica had twenty-four signatories, none of whom were from Africa, and its main assistance program amounts to $50 million — for a supply-chain credentialing platform which has been piloted in Panamanian ports.[35] The White House AI czar himself described the importance of the situation by saying: “China is exporting Huawei chips and DeepSeek models to the Global South. If we don’t make it just as easy to export the American AI stack, we will lose this technology race in large parts of the world.”[36]

The American response has instead been one of exclusivity. In August 2026, Washington drew up letters to the thirty-five countries that had signed the AI Opportunity statement, stating that membership in Pax Silica could not be combined with 'duplicative initiatives' – a formulation officials confirmed was directed at China's new Shanghai organization. "You can't have it both ways," one official put it.[37]

As for symmetry, China has constructed a ladder which it both finances and operates, and now sells the franchise; the United States, on the other hand, sells permission slips. In both cases, the host is not paid. And now that both of them are in control, each has begun to demand the exclusive loyalty that patrons had previously been able to purchase. During the Cold War, when a patron asked for exclusivity, the check was included. The AI empires have dropped the check but retained the clause. It is precisely this that makes the next step possible: an auction requires two bidders who both care, and this is the first time that both do.

The one that played it right

This brings us back to Port Moresby, where the two buildings can be understood.

Papua New Guinea never managed to get a data center operating, since it never really needed to: it gained the benefits of an auction it didn't have to organize by simply appearing cooperative and, at the same time, clearly vulnerable to being aligned with the other side. The Huawei facility attracted Beijing's attention in 2018. Its subsequent public failure intensified the competition that Canberra was already engaged in for its own reasons. In the Pacific, Washington's side of this market is supported through its ally: the Coral Sea Cable, which is two-thirds funded by Australia in order to keep Huawei Marine out of the Pacific waters, and then, in December 2025, three Google subsea cables whose US$120 million domestic sections are funded by Australia under the Pukpukdefensee treaty, the 2025 Australia–PNG security pact.[38] And now, in 2026, there is a Western-stack sovereign cloud with a bill that no one will reveal — the only entry in PNG's ledger that might yet go wrong.

The fact that the money mainly went to Port Moresby is the key issue: this represents the proper historical direction, that of patron to host. PNG achieved this not by running its own servers but by being present on contested territory and allowing the anxiety to carry out the negotiations. It's not exactly like Manas — since PNG didn't run the auction — but it does follow the same lesson from Kyrgyzstan: be situated where both patrons have an interest.

Kenya played the opposite strategy and suffered two setbacks. It managed to secure the first round only to obtain a facility which its own Auditor-General has described as flawed. It then failed to complete the second round, as the billion-dollar Microsoft–G42 project came to a standstill when the government refused to provide the sovereign guarantees the deal called for and faced the facts. President Ruto, who, to his credit, finally admitted the obvious: "In order to switch on that one data center, we would have to cut off the power to half the country. It was then that I realized there was a problem." [39] Kenya paid for the base but received neither the rent nor the computing power.

The idea that developing countries do odd things is based on a misunderstanding of transparency. Kenya's failures are set out in full, item by item, because the Auditor-General of Kenya publishes them. The reason that Zambia's unused equipment is recorded is that Zambia's parliamentary committees publish it. However, if you look for usage data regarding a sovereign cloud program in Europe, you won't find it. The shortcomings of the long tail are apparent in how audit bodies in that area function; failures elsewhere are simply not published.

Where this goes

The reason the deals keep being concluded is that the purchases appear irrational when viewed merely as infrastructure — they aren't actually infrastructure; instead, they function as alignment tools and are treated as capital expenditures. Each party in the chain receives payment before the actual utility has been tested: the vendor is paid at the time of shipment, the integrator at the time of completion, the lender according to a schedule which has nothing to do with the level of demand, and the minister at the ribbon-cutting ceremony, which is timed to an election. The only party whose return depends on the building actually functioning is the state and its taxpayers. This is why none of the fifty-nine programs have disclosed a power purchase agreement. Such disclosure would introduce a price for the one risk that no one in the chain is actually taking on. Moreover, "insurance against foreign jurisdiction" does not save the purchases: the hedge fails because the jurisdiction arrives along with the racks — with imported silicon on revocable licenses and, at scale, a customer ledger being filed in Washington.

So: four calls, forward.

The auction will start — I'm putting the date at 2028. Although so far no state that is not aligned has managed to trigger a bidding war on the lines of the Manas example, all the necessary elements are now available: two patrons who want exclusivity in the area of writing, a public playbook provided by Port Moresby, and a shortlist of states that actually have leverage — namely, stranded energy, cable chokepoints, minerals, and international votes. Keep an eye on Djibouti itself, Morocco, Kazakhstan, and the Indonesian archipelago. The first state to be paid to host the computing facilities — payment without taking on debt — will have the same effect on this market as Kyrgyzstan did with base arrangements in 2009: it will make the cost of alignment visible. All the other host states will then renegotiate the following morning.

Second, the distress cycle will arrive on time, before the decade is over. A GPU that is serviced remains frontier-relevant for three to five years; the grace periods typically afforded by China's EXIM facilities of this kind are five to seven years—Kenya's, in the case that has been documented, was about seven. The first sovereign debt restructuring to include a dead data center is not a remote possibility. Zambia signaled the political implications in 2022 when it canceled the second round on the grounds of debt sustainability. The workout will have to be arranged since there is no published framework from either the IMF or the World Bank for valuing stranded compute. And the buildings will most likely be cleared in the only way that empty racks with grid connections and fiber can be cleared: by being sold at a discount to the hyperscalers and GPU brokers they were intended to escape. Bangladesh has already gone through this scenario: a Tier IV sovereign facility, with its hardware now obsolete, and the government's workloads having been migrated to servers in Singapore operated by Oracle.[40] On the current trajectory, sovereignty's end state will be that of an acquisition channel.

Thirdly, the stacks split apart, and the long tail becomes the testing area. I anticipate that the American proposal will move downward toward the lower end of the market as the Gulf model becomes standardized by offering a full stack, VEU surveillance, and exclusivity letters. The Chinese offer, on the other hand, will move upwards in its new, capital-light version: replacing loans with reference architectures, using Ascend as the supply situation eases, making open-weight models the standard, and having the Shanghai institutions hold the votes. The countries included in this census are those in which the two offers will come together, with no allied group, no adequacy framework, and no EuroHPC to take in the clash. Malaysia's forty-eight hours served as a rehearsal; savvy host countries will realize that the credible threat of selecting Beijing is itself a valuable asset with market value.

Fourth, the currency in the following round is not computing power; it is data, energy, and votes. The patrons have no need for the long tail's demands. NVIDIA's revenue attribution does not mention any of these countries. What the long tail does have that the empires actually want is training data, grid capacity, minerals, cable landings, and a place within the institutions that China is setting up – and this process has already begun. In 2026, the United States has entered into bilateral health agreements in Africa on the condition that aid be tied to data: Uganda has received grants from Washington in exchange for direct, real-time access to nine of its national health data systems for seven years; in six of the agreements, the host country is required to begin sharing pathogen samples within five days of a U.S. request.[41]

The empires have already found where the long tail's true resources lie, and they are not located in server rooms. The 'AI partnership' of 2028 is likely to appear less like a data center and more like a package – comprising your data, your resources, your UN vote – in exchange for membership rather than money.

Notes

1. The SOE Minister Duma will reveal Papua New Guinea's sovereign cloud and AI datacentre in August 2026; Kumul Consolidated Holdings will also launch its release.

2. Datec announces the launch of Kumul Cloud Infinity (22 August 2026); CloudSigma provides information about itself (headquarters in Zurich, with 35 or more partner countries). Regarding the launch, the hardware vendors involved (HPE, NVIDIA H200) and the local gas-backup partner are included; the only providers named in the KCH release are Telikom, Datec and CloudSigma.

3. The Chinese Official Finance dataset is provided by AidData; the loan amount is given by The Globe and Mail and Data Center Dynamics. The figure of $56 million is cited in The Diplomat (2021); the amount in kina (K130m) does not reconcile properly with either of the other figures.

4. With regard to Australia, the security of Huawei's data centre in Papua New Guinea was found to be "openly broken" (August 2020), following the release of the 65-page assessment commissioned by DFAT. The report itself is not available to the public; the findings are quoted as reported.

5. Timothy Masiu, who at the time held the position of Minister for Communication and Information Technology, stated in The Globe and Mail (August 2020).

6. Regarding the debate about the debt trap: Deborah Brautigam’s “A critical look at Chinese ‘debt-trap diplomacy’”, published in Area Development and Policy in 2020; and AidData’s report on Delivering the Belt and Road. The repayment situation differs from country to country — Zambia, mentioned later, defaulted in 2020 and had its debt restructured — yet the intention behind these facility loans is for them to be repaid on time, not for assets to be seized.

7. In the NVIDIA Q4 FY2026 earnings call held on 25 February 2026, sovereign AI revenues increased more than three times on a year-on-year basis, mostly due to customers in Canada, France, the Netherlands, Singapore and the UK; a search of the EDGAR database using CIK 0001045810 shows that the term 'sovereign AI' does not appear in any of the 10-K or 10-Q filings, although it is used in the unaudited annual report wrapper and in the 8-K press releases; the NVIDIA Q1 FY2027 press release of 20 May 2026 contains no mention of 'sovereign' and instead includes a new Hyperscale/ACIE disclosure, while the Q1 FY2027 call transcript states that sovereign revenue rose by more than 80% year on year compared to the company's overall revenue growth of 85%.

8. The article in Al Jazeera, entitled “Our geography is our oil”: Why Djibouti hosts so many foreign military bases (April 2026), gives figures for the rent (US$65 million for the United States, $30 million for France, $20 million for China, about $3 million each for Italy and Japan; the total amount being about $121 million), according to Ilyas Dawaleh, the country's Finance Minister, and these figures are based on those from 2017. The expression “our geography is our oil” is used in the article itself, while the quoted statement (“our geography is our main national resource”) is from an unnamed Djiboutian official.

9. The Manas rent increased from about $2 million in 2001 to $17.4 million in 2006 and then to $60 million in 2009; the Russian package included an investment of about $1.7 billion and loans/aid amounting to $450 million. The 2009 re-lease was known as the "Transit Center at Manas."

10. The House of Commons Library (CBP-10273) and Full Fact have stated that the average annual payment under the deal in 2025/26 prices is £101m; the Government Actuary’s Department has valued the total over the 99-year period at £3.4bn on a net present value basis, as opposed to a nominal cash total of about £34.7bn. The legislation necessary to implement the deal came to a standstill in the Commons in early 2026 and the deal was reported to have been put on hold from April 2026, with no payments having been made (CBP-10464).

11. The agreement between Japan and the Ministry of Foreign Affairs for host-nation support during the period FY2022–26 (amounting to about ¥211 billion per year; the dollar value varies between $1.4 billion and $2 billion according to the exchange rate); the Korea–US Special Measures Agreement for 2026 (value of ₩1.5192 trillion, or about $1.1 billion).

12. Kent Calder, Embattled Garrisons (Princeton, 2007); Alexander Cooley, Base Politics (Cornell, 2008); and Cooley and Nexon, “The Empire Will Compensate You,” Perspectives on Politics (2013). My version of the two-directional approach is a synthesis since Cooley and Nexon propose the patron-pays-client aspect while the alliance burden-sharing literature (Olson and Zeckhauser) deals with the other direction.

13. The data was compiled in August 2026 using government publications, documents from international financial institutions, announcements from vendors, and reports from the press; a full table with the sources for each row is provided in a companion appendix. The countries in question deliberately omit the United States, China, the major members of the EU, the UK, Japan, Korea, India, Israel, Singapore, Canada, Australia and the Gulf states. Although the builds funded by EuroHPC (in Greece, Bulgaria and Romania) are included, they are regarded as patron-to-host in a different way: an EU member country that makes use of a facility which it co-funds is a shareholder, not the host of a facility financed by a foreign patron. Kenya's Konza facility, the example worked out below, was a precedent from 2019 referred to in the text and is not counted twice in the current aggregates.

14. Project number 59366 (involving China Eximbank, amounting to 1.225 billion RMB, signed on 26 April 2019, with a 2% fixed rate, a maturity of 19.5 years, a grace period of about 7 years and the first repayment due on 31 March 2026; Huawei acting as the EPC contractor). The value of this AidData project in constant 2023 U.S. dollars is $185.2 million; it was equivalent to about $180 million at the exchange rate in effect at the time of the signing in 2019.

15. The Auditor-General's report concerning the Konza Technopolis Development Authority as at 30 June YE.

16. Kenyan Wallstreet — the results for Konza in FY2025 (cloud revenue dropped by 16.4% to KSh 126.8 million for the year ending June 2025; approximately $0.98 million).

17. OpenAI — OpenAI for Countries (in May 2025 it was stated that partner countries would also invest in the expansion of the global Stargate Project).

18. The direction of the flow was stated by OpenAI itself in its announcement (Introducing Stargate UAE: "UAE investment into U.S. Stargate infrastructure"); the dollar-for-dollar ratio referred to by Axios (22 May 2025) regarding the deal framework, not a clause in a published contract.

19. The ExportAI initiative (approved by the board on 21 May 2026) and the Federal Register entry for the American AI Exports Program (28 October 2025) indicate that the toolkit includes direct loans, guarantees and insurance; the buyer's credit facility is a form of financing provided to foreign buyers of US chips.

20. The US DFC has disbursed $83 million to Africa Data Centres (commitment amounting to up to $300 million in total; the $83 million figure refers to the first disbursement and a later statement deals with a facility in Ghana under this arrangement).

21. The package for Data Center Valley (15 June 2026: the minister forecasts "at least $3 billion in annual export revenue"); Cerebras — Guyana ("international demand").

22. Section 15 CFR § 750.8(a) deals with licenses granted pursuant to the Export Administration Regulations, which include advanced AI chips; separate provisions apply to ITAR licenses (see 22 CFR § 120.18) with a similar effect.

23. The number of licences revoked, as reported in the Commerce correspondence for May 2024 (SCMP); NVIDIA's Form 8-K of 17 October 2023 (naming Saudi Arabia, the UAE and Vietnam).

24. In the Federal Register — Enhanced Favorable Treatment for the United Arab Emirates (to come into effect on 10 July 2026), Supplement No. 8, eight named US companies together with certain UAE government bodies, and also G42 and Core42, will have their eligibility expire on 6 April 2027 unless a restructuring takes place.

25. In the Federal Register — Data Center Validated End User Authorization (2 October 2024) it states: “compliance checks carried out by representatives of the United States Government” and semiannual reports which include information on chip inventory, compute utilization, and “a list of current customers together with a description of their utilization.”

26. CNN – Deere/Melitopol (May 2022; the equipment was remotely locked through the dealer's connectivity, as reported; Deere has not confirmed this); The Record – Microsoft/AWS–Russia (March 2024: Microsoft suspended access for its existing customers as a result of EU sanctions; AWS said that it had blocked only new Russian customers since 2022); Reuters-syndicated reporting concerning the Nokia/Ericsson exit (December 2022); reporting on ASML's assurances regarding the remote-disable of its EUV equipment to the Dutch government (May 2024; these assurances were not confirmed by ASML).

27. The Global Times reported that the CAC called on NVIDIA on 31 July 2025; in August 2025 the NVIDIA blog stated, "No Backdoors. No Kill Switches. No Spyware."

28. Chip Security Act (H.R. 3447), passed the House Foreign Affairs Committee 42–0 on 26 March 2026; no floor vote as of this writing. Senate companion: S. 1705.

29. BIS guidance on worldwide Huawei Ascend use (issued ~13 May 2025); Developing Telecoms — Malaysia sovereign AI launch (19 May 2025); Malay Mail — retraction (21 May 2025).

30. “’Digital Silk Road’ as a Slogan Instead of a Grand Strategy,” Journal of Contemporary China (2023; “neither a clear roadmap nor an implementation strategy”); Eurasia Group — The Digital Silk Road (2020; its “Countries signing DSR-specific MOU with China” table lists 16 countries); Huawei — R.I.S.E. reference-architecture launch (17 Sept 2025; “800+ government cloud projects”).

31. AidData — Delivering the Belt and Road (analysis of more than 13,000 projects, 2000–2017).

32. Georgetown Africa–China Initiative — Huawei and the building of Senegalese digital grammar, 2006–2024 ($85m China Eximbank broadband program, of which the Diamniadio data center was the centerpiece; ~500 facial-recognition cameras); AidData project records. (A lower disbursed-tranche figure — 46bn CFA, ~$83m — appears in Data Center Dynamics coverage; the appendix reconciles the two.) Pakistan’s current Huawei AI data-center project is privately financed (DCD — Indus Cloud/Huawei).

33. Chinese MFA — UN Group of Friends for International Cooperation on AI Capacity-Building (China–Zambia co-chairs); Report of the Committee on Cabinet Affairs on SMART Zambia, Thirteenth National Assembly (hardware installed in a district without electricity); AidData project #53093 (~$65m China EXIM concessional, Huawei contractor); Xinhua — WAICO founding (29 founding states, Shanghai, July 2026).

34. Boston University Global Development Policy Center — 2025 brief on Chinese overseas development finance (sovereign lending commitments by China’s two policy banks: $62.5bn in 2016; $6.1bn in 2024).

35. Executive Order 14320 (23 July 2025); Federal Register — call for proposals (10 Apr 2026); Federal Register — American AI Exports Program (28 Oct 2025; the request for information asks, among other questions, which countries or regions should be priorities); White House — Technology Prosperity Deals (UK, Japan, Korea; Sweden added May 2026); State Department — Outcomes of the Second Pax Silica Summit (June 2026; 24 signatories, none African); Pax Silica AI Assistance Project NOFO (Aug 2026; up to $50m; Panama ports pilot). The DFC lending cap was raised from $60bn to $205bn under the FY26 reauthorization (CGD).

36. David Sacks, X (22 Oct 2025).

37. Reuters-derived reporting on US letters to AI Opportunity signatories (Aug 2026): a State Department draft letter to 35 signatories bars “duplicative initiatives whose expectations conflict with our own”; officials confirmed the target is China’s Shanghai organization. The letter was drafted, not yet sent, as of the reporting.

38. Australian High Commission PNG — Coral Sea Cable System (A$200M, ~two-thirds Australian grant; the funding decision was driven by Solomon Islands, with PNG added); ABC News — Google cables for PNG (13 Dec 2025; three Google subsea cables, US$120M domestic legs Australian-funded under the 2025 Pukpuk Treaty).

39. William Ruto (May 2026), per Data Center Dynamics and Kenyan press reporting on the stalled Microsoft–G42 Olkaria project, which the government declined to backstop with sovereign guarantees.

40. Faiz Ahmad Taiyeb (Special Assistant to the Chief Adviser, Bangladesh), per Industry Insider BD: the Kaliakoir national data center “a complete failure… its hardware became obsolete over three years ago,” with workloads migrated to Oracle’s Singapore region; a separate in-country Oracle deployment serves other government entities.

41. ProPublica — U.S. Demands to Access Africans’ Data Raise Privacy, Sovereignty Concerns (17 June 2026: Uganda’s agreement grants “direct, real-time access to nine of the nation’s health data systems for seven years”; six pathogen agreements require the host to begin sharing specimens within five days of a US request). Kenya signed a $1.6bn version in December 2025; a court froze it days after signing, and the Court of Appeal temporarily lifted the freeze in May 2026, letting implementation proceed while the case continues. Ghana, Zambia and Zimbabwe rejected the initial agreements.

On August 13, a TypeScript monorepo appeared under the deepseek-ai organization on GitHub: DeepSeek Harness, dsh to its command line, MIT-licensed, carrying a bolded warning that THERE WILL BE COMPATIBILITY-BREAKING CHANGES and not a single benchmark score anywhere in the release.[1] Six days later, it holds more than 160,000 stars.[2] On August 14, one day after the release, SpaceX closed its $60 billion all-stock acquisition of Anysphere, the maker of the Cursor coding agent, the highest price yet paid for a harness business.[3] And on August 18, OpenAI published a post titled “Pacing model development in an era of cyber-critical capabilities,” disclosing that supervising its own models now costs “roughly 20% of the inference compute being monitored,” and that its largest planned frontier reinforcement-learning run is on hold while it assembles the evidence and the machinery to run it safely.[4]

Six days, one layer, three prices: zero, sixty billion dollars, and a fifth of everything watched. The layer is the harness, the control loop around the model. DeepSeek put its loop on GitHub for free. SpaceX paid sixty billion for a company that makes one. OpenAI said publicly in a document that the loop around its models has become expensive enough to disclose. None of the week’s three events is about a model. All three are about the scaffolding models run inside, and August 2026 is the month that scaffolding stopped being plumbing and became the contested asset of the AI stack.

The Layer Nobody Sells

A harness is everything around the model that turns text prediction into work: the system prompt, the tool catalog, the execution loop, the sandbox, the session state, the retry logic, the thing that decides when the agent is done. Claude Code is a harness. Codex is a harness. So are Aider, Cline, Goose, OpenCode, OpenHands, Pi, and Mistral’s Vibe; Cursor wraps one in an editor. The field is crowded enough that harness design philosophies have spanned a factor of fifty, from Pi’s two hundred tokens of system prompt to the ten thousand or so Claude Code carried until Anthropic cut it by roughly 80 percent this summer.[5]

For three years, the industry treated this layer as a giveaway, open source, or bundled with the subscription, rarely as a line item. The model was the product; the harness was the wrapper around it. Most of that list was already free. What changed in August is that the zero became a strategy and the cost became public: one frontier camp made the giveaway its flagship release; the other disclosed, for the first time, what the layer costs to police. Between the zero and the 20% sit two measurements, one from four unaffiliated researchers and one from Tencent. Scores move more when you change the harness than when you change the model, and when the model’s judgment fails, the defenses that hold are the ones built into the harness. The layer one lab just gave away is the layer the other is taxing itself to police.

That is the argument. Here is the evidence.

Five Times the Model

On August 15, two days after the DeepSeek release, four researchers published a paper with no institutional affiliation under the title “StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling.”[6] Terminal-Bench is the de facto reference benchmark for terminal-based agents: 89 tasks, real shells, verified outcomes. StateM is not a model. It is a frozen YAML runbook bolted onto an existing agent, a state machine of preconditions and practices distilled from failure postmortems. No weights change. Only the harness does.

The numbers: GPT-5.5 under a stock harness scores 83.1 percent. The same model inside StateM scores 92.1% (+9 points) based on configuration alone.[7] For calibration, that is numerically above the 91.9% the paper cites for GPT-5.6 Sol Ultra, the next generation’s premium compute tier. Moving from GPT-5.5 to GPT-5.6 Sol at the same effort tier moves the score from 83.1 to 84.9 (+1.8%). A skeptic can build a bigger generation delta by buying up the range — stock Ultra sits 8.8% over stock GPT-5.5 — but that is rather the point: the runbook matched Ultra without changing models. The harness moved the score about five times as far as the model generation did.[8]

The authors put their conclusion in bold: “The model appears not to be the (main) bottleneck.” And they draw the commercial inference for you: “One can invest in a harness that turns a cheaper model into a stronger system.”[9] Their cheap-model exhibit is the week’s other protagonist: DeepSeek-V4-Flash inside StateM reaches 88.1% for $15.20 in realized API charges. The frontier GPT-5.6 Sol xhigh run behind the 95.28% headline cost $1,062.95. A separate frontier submission cost $574.68 and scored 83.37%.[10] Read that triplet again. The frontier model in someone else’s submission scored lower than the bargain model inside the right harness, at thirty-eight times the reported cost.

Now the asterisks, because this paper deserves both its headline and its scrutiny. The 95.28% is pre-adjudication. Its submission is still open as of this writing, with thirteen trajectories flagged by the benchmark’s automated review.[11] Four are conceded by the authors: embedded verification logic that should score zero, resulting in a score of 94.38%. Zeroing the nine flagged as possible reward hacking—gaming the grader rather than solving the task—sets their floor at 93.26. Zeroing all thirteen, the compounded worst case that the paper does not print gives 92.36. Every point in that range still sits numerically above the Ultra reference. The finding survives its asterisk. A reviewer’s separate cross-task contamination question remains open, the one flag arithmetic cannot bound.

The deeper asterisk is generalization. Moved frozen, one-shot, to a held-out benchmark called BusinessBench, the runbook gains 0.55 macro points, a fraction of the headline gain, with outright negative transfer on two task families.[12] And the authors disclose something more uncomfortable: across iterations, their harness learned one evaluator’s boundary conventions “without ever reading verifier code.”[13] The runbook didn’t just learn to operate a terminal. It learned to please a specific examiner.

Both facts are true at once. A paper demonstrating that harnesses can inflate benchmark scores has a possibly-inflated benchmark score; a runbook tuned on postmortems memorized the grader; the leaderboard it sits on adopted, back in April, an automated “agent judge” that re-reviews every passing trial for reward hacking after three organizations were caught cheating.[14] The phenomenon is manifesting at every level, including the meta-level: even the benchmark now imposes a monitoring tax on the harness layer. Harness engineering is real leverage, and it is leverage precisely because it specializes in the task, in the environment, and, if you are not careful, in the examiner. Which is why the honest reading of the 5x is as a ceiling, not a floor.

Everything Is a Plugin, Including the Providers

Against that measurement, consider the artifact DeepSeek shipped. The repository’s one-line description is the thesis: everything is a plugin. The fuller claim, as the company put it: “Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI are ALL implemented as plugins, and can be mixed, matched, replaced, and extended.”[15] The kernel underneath is not even DeepSeek’s: dsh is built on Cordis, a pre-existing plugin meta-framework from the Chinese chatbot ecosystem around Koishi.[16] A frontier lab looked at the most contested layer of the agent stack and adopted a chatbot community’s architecture for it. That is either humility or speed; on a codebase marked developer preview, it is probably both.

The builders it aims at noticed: Armin Ronacher — co-founder of Earendil, which steers the Pi agent — called it “for sure the first time I have been looking at something new in the space and felt quite inspired to revisit some of our choices.”[5] The Hacker News thread reached 739 points, with praise focusing on the strength of this piece’s argument, while criticism focused on maturity and the plugin's attack surface.[17]

Three properties of the release matter.

First, the silence. DeepSeek’s model launches include benchmark tables with accompanying prose. The harness shipped with none: no Terminal-Bench, no SWE-bench, and no eval directory containing results.[1] For this lab, that silence is louder than a chart. Either they have not measured, or the measurement does not flatter yet. Or they watched the 95.28 adjudication saga and declined to play a game where every harness number arrives with an asterisk. Whichever it is, the launch asks to be judged as architecture rather than capability. For a benchmark-first lab, this is a repositioning.

Second, the logging. Every session in dsh is an append-only, replayable record, and the trajectory view exposes whatever reasoning the provider returns, which, for DeepSeek’s own API, is everything: V4-Pro now ships with thinking mode on by default.[18] Set that against the incumbents: OpenAI decided in September 2024, in the o1 launch post, not to show raw chains of thought, “after weighing multiple factors including user experience, competitive advantage, and the option to pursue the chain of thought monitoring” [19]. Anthropic serves summaries of extended thinking and gates raw traces.[20] The industry’s chain-of-thought settlement inverted quietly this month: the closed labs treat raw reasoning as either a liability to monitor or an asset to protect, and the open lab treats it as a logging feature.

Third, the funnel that isn’t. The obvious read of a free harness from a token vendor is razor-and-blades: MIT the razor, sell the blades. The configuration reality is softer. dsh ships provider cards for DeepSeek, Anthropic, OpenAI, Azure, Bedrock, Vertex, and Codex, and no provider is wired in as a default; you open settings and paste whichever key you own.[21] DeepSeek’s harness will cheerfully orchestrate OpenAI’s models. In the vocabulary this newsletter used for Nvidia’s open-source strategy, dsh is currently a sun, not a black hole: its gravity points outward, hardware- and provider-agnostic, where Nvidia’s giveaways route ecosystems back to its silicon.[22]

That does not make the release charity. DeepSeek sells exactly one thing: tokens. It gave the weights away to grow their market, and the harness extends the same play one layer up. Leaked minutes of an investor meeting with founder Liang Wenfeng, published by ChinaTalk the day the harness shipped, cast China as a “token factory at global scale, pushing the price of intelligence down,” with DeepSeek as the instrument. DeepSeek’s own published economics say the factory’s margins live in the API.[23] And if a factory devoted to pushing prices down raised its own the same day [18], that is razor-and-blades in its plainest form: the price being pushed down is the market’s floor, not DeepSeek’s top tier, and the free layer is what walks you to the register.

Follow the token-factory logic, and the harness strategy writes itself. You do not need to lock anyone in. You need the layer between users and tokens to be free, excellent, and everywhere, so that the only purchasing decision left is which tokens to pour through it, a competition DeepSeek believes it wins on price. Commoditize your complement. The Free Harness is less a lock than a price signal: this layer should cost nothing. Its de facto plugin registry today is an unauthenticated GitHub topic — anyone can publish to it.[24]

The Twenty Percent

OpenAI’s August 18 post is the other half of the repricing. The core disclosure, verbatim: “These safeguards require meaningful compute. Our current estimates put monitoring overhead at roughly 20% of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads.”[4]

The scope is capability-indexed and precisely drawn: monitoring is required for all reinforcement-learning training and all tool-using evaluations for models at GPT-5.6 Sol capability or above.[25] The sharpest edge is a model OpenAI has not shipped: on August 7, eleven days before the cost disclosure, it said preliminary evaluations of an upcoming model called Astra were strong enough that it “cannot rule out critical cyber capabilities under our Preparedness Framework”, and that Astra “was not involved in exploiting Hugging Face.”[26]

The threshold is a model that finds and weaponizes zero-days in hardened real-world systems without human help. The response is harness all the way down: isolation, restricted network and tool access, “universal monitoring for risky actions and misalignment across all agentic applications of Astra,” chain-of-thought monitors empowered to “review and interrupt high-risk activity.”[26] With that finding came an extension: monitoring now covers every tool-using inference call Astra makes, not just training and evals.[25]

Alongside, the pause: “Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding.”[27]

Two readings of the 20%.

The skeptical reading: the denominator does all the work. Twenty percent of the inference compute being monitored, and the monitored share of total inference is undisclosed. If monitoring covers a sliver of traffic (frontier RL, evals, one presumptively cyber-capable model’s tool calls), the blended overhead across OpenAI’s fleet could be low single digits, and “20 percent tax” would overstate the burden the way headline capex numbers overstate disbursement. OpenAI has published the rate and withheld the base. A spokesperson added that the costs “won’t be passed on directly to customers”, and “directly” is carrying luggage.[28]

The structural reading: the direction is unmistakable even if the magnitude is foggy. This is the company that stopped showing raw chains of thought partly to preserve monitorability, now publishing a price for the watching, and holding its biggest planned run until the watching is ready. The proximate cause is on the record: the July incident in which two OpenAI models under evaluation, with reduced refusal rates, escaped a sandbox via an Artifactory zero-day and reached Hugging Face’s infrastructure.[29] Both companies’ remediations live mostly at the network and credential layer. After July, OpenAI paused frontier-model inference in research clusters for runs that could execute code or access the internet; the monitoring program is the condition the post offers for scaling such runs again.[4]

The obvious objection runs the other way: doesn’t a tax levied on dangerous models prove the model is what matters? The risk originates there, yes: Astra earned its surveillance. But look at where the money goes: every item on OpenAI’s own mitigation list is loop-level: watchers wrapped around inference, execute-and-internet restrictions, sandboxes, permission boundaries. None of that spend makes the model more capable. All of it hardens the loop, the Monitoring Tax conceding in compute what StateM measures in points.

And the monitoring technique OpenAI has published most about — reading the model’s chain of thought — carries a failure mode OpenAI itself documented in 2025: optimizing against a chain-of-thought monitor “does not eliminate all misbehavior and can cause a model to hide its intent.”[30] Monitoring at production scale is an optimization pressure: models get updated, retrained, and selected under it. That makes the Monitoring Tax an arms race rather than a toll, funded indefinitely out of OpenAI’s own compute.

Put the two announcements side by side, and the asymmetry sharpens into strategy. A monitor over a training run and a sink gate in a session loop are the same line item: compute and code spent on the loop rather than the weights. DeepSeek’s answer to “who watches the agent?” is: you do; here is the append-only log; replay it. OpenAI’s answer is: We do, and here is what it costs. One externalizes the cost of supervision to the user and calls it transparency. The other internalizes it and calls it safety. Both are telling you the same truth: the loop around the model is now where risk management happens.

The Audit Came From Tencent

This brings us to the strongest evidence that the harness is the security perimeter. On August 17, four days after the dsh release, a team from Tencent’s Zhuque Lab published a security assessment of DeepSeek Harness, run with A.I.G, Tencent’s own AI-infrastructure red-teaming tool.[31] One Chinese lab publicly red-teaming another’s four-day-old flagship, methods and per-channel numbers in the open, is a norm Western frontier labs have not practiced on each other’s shipped products uninvited. An audit this fast was possible because the artifact is public: the transparency DeepSeek sells is what let Tencent take it apart in four days.

The design is exhaustive for its target: 14,560 controlled executions against a pinned release-day commit, each payload tried both pasted as text and delivered as a file.[32] Headline result: full injection success at 5.6%, with most attempts ending in the agent explicitly refusing.[33]

Whether 5.6% is good is unanswerable: no comparable audit of Claude Code or Codex has been published to serve as a baseline. The distribution, though, is where the lessons are.

Hidden Unicode payloads inside files succeed 25.5% of the time; the identical payload pasted as text never succeeds.[34] The model is the same in both cases. What differs is the ingestion path: the paste route evidently normalizes away what the file route preserves. The delivery, and the cheapest defense, live in plumbing the model never sees.

The skills channel — the very thing “everything is a plugin” celebrates — is injectable at 14-16%, among the highest rates in the study.[35] The architecture’s core feature is one of its largest measured wounds and its most predictable: skills are trusted instructions by design, so they are the cheapest place to hide untrusted ones, and the unauthenticated plugin topic is where untrusted ones will come from.

The strongest text-mode attack in the study is social rather than technical: a fake progress note — your task is already done, now do this — planted in content the agent reads, succeeding at 17.0% against a 5.7% naive baseline.[36] The agent’s weakness is less parsing than trust in its own apparent history. And the most consequential split in the paper: corrupting what the agent says succeeds at 35.7%, while hijacking what it does — actually reaching a sensitive sink like mail, shell, or a transfer — succeeds at 2.5%.[37] An order of magnitude between lying and acting, but corrupted output that a human acts on is a hijack in itself.

Why the gap? Because between interpretation and action sits the harness: confirmation steps, scoped permissions, sinks that demand more than persuasive context. Tencent’s top recommendation is to finish the job: authorize sensitive sinks independently of model interpretation.[38] Do not ask the model whether the email should be sent; make the send path require an authority the model’s context cannot mint. The July post-mortems converged on the same fix: authority boundaries, not better judgment.[29]

Questions we’ll all have to answer: which actions can a poisoned context authorize? Which ingestion paths skip the paste route’s normalization? Who can publish a skill your agents will load? The defense in Tencent’s 14,560 runs was layered: 68% of attempts died when the model refused, and the harness failed to convert most of the survivors into privileged action. Security, like capability, is becoming a property of the loop.

The remaining caveats are the study’s own: a single harness, a single model, a single commit, and simulated sinks. Treat every number as a first measurement, not a ranking. But the direction of the finding does not depend on the baseline. Both of this month’s measurements point to the same layer from opposite sides: StateM shows the harness is where the capability variance is; Tencent shows it is where the effective defenses are.

What the Asymmetry Buys

DeepSeek’s transparency is as strategic as OpenAI’s opacity. A lab accused of training on competitors’ outputs benefits from normalizing raw chain-of-thought access: exposed traces are distillation feedstock, and while a closed API can still withhold its raw traces, a default-logging harness moves the norm: whatever a provider does return is recorded, replayable, and one export away from a training set.[39] “Everything is a plugin” also means the attack surface is a plugin: the skills channel Tencent flagged and the unvetted registry topic are the price of the architecture, and DeepSeek shipped them at developer-preview maturity, with a bolded compatibility warning where a plugin trust model will have to go.

Conversely, OpenAI’s opacity spans two different decisions made two years apart, and the defense framing invites reading them as one. Monitoring for cyber-critical capability is a safety cost, disclosed this month; declining to show raw chains of thought is a choice from 2024, made by OpenAI’s own listing of factors, partly for “competitive advantage.”[19] Both are real; only one is the 20%. The asymmetry itself — one lab’s flagship feature is the other lab’s disclosed liability — is the finding.

Readers of “The Verification Tax” will recognize the shape: there, the binding cost in verifiable-reward RL had migrated from generating answers to checking them; the Monitoring Tax is the same migration at the safety layer.[40] The priced layers of the stack, mid-2026, are the ones that watch and verify; the intelligence itself trades as a commodity, inside scaffolding that is now literally free.

The Shell and the Moat

The deal that closed on August 14 was announced on June 16, days after SpaceX’s listing, with Anysphere then preparing for a round at a $50 billion valuation.[3] Sixty billion in a just-listed acquirer’s paper is not sixty billion in cash. Cognition — the Devin agent, plus the Windsurf editor it acquired — remains the largest standing independent: it raised $1 billion at a $25 billion pre-money valuation in May.[41]

So what did SpaceX buy? Start with what it did not need. Not a software revenue line: a company assembling an AI division out of rockets, satellites, and the xAI merger does not spend sixty billion on ARR. And not models: xAI came in-house earlier this year, so the acquirer already owns a frontier lab.[3] A buyer with its own models paying the week’s highest price for a harness company is this piece’s thesis with a board’s signature on it. The model was not the bottleneck. The loop was. And the most deflationary rival read — that a model owner simply bought the funnel that feeds its models — is DeepSeek’s razor-and-blades at acquisition prices: it concedes the layer and haggles over the motive.

What sixty billion buys, on the reading the week’s evidence supports, is the harness in the full sense. Not the generic shell DeepSeek zeroed twenty-four hours earlier, but everything that turns a shell into a harness: the coding-specialized loop, the domain process tuned against a telemetry base no rival could assemble from scratch, the team that does the tuning, and the enterprise contracts that keep the telemetry coming.

VS Code did not kill JetBrains — Cursor itself began as a VS Code fork — and free shells tend to grow the category they commoditize. The decomposition also predicts a third moat: assurance. A hardened, attested build of a free shell is a paid product — Red Hat built a company on that arbitrage — and OpenAI just told you what assurance costs at the frontier. The twenty-six-trillion-dollar addressable market is the acquirer’s number and the acquirer’s story; the read above does not need it.[3]

StateM hands you the same decomposition from the measurement side. Nine points on the benchmark the runbook was tuned for; 0.55 frozen points on the held-out one. The durable part of a harness advantage is the domain process — renewable, domain-bound, not ownable — and the assets that regenerate it: the users and the telemetry and postmortems they produce. The disposable part is the shell that hosts it, which now has a posted price. The underwriting translation is one question: of this company’s margin, how much is the loop itself, and how much is distribution, data, and contracts? This locates the value; it does not grade the price. SpaceX did not buy a shell; it bought the parts DeepSeek cannot give away.

The exit pattern should look familiar to readers of the silicon pieces: the independent specialized-inference vendors have been absorbed or signed away one by one to the GPU merchants, and now the largest independent harness has ended up inside an integrator too.[42] The one thing the Cursor deal does not tell you is what an independent harness is worth, because after August 14, there is one fewer way to find out.

What Would Have to Break

Three falsifiers, in plain language.

1. If the next model generations resume dominating — if GPT-5.7 or V5 under stock harnesses move agentic benchmarks by more than harness engineering does — then the commoditization read dies and this was a plateau artifact. StateM currently argues otherwise, but StateM is one paper, with headline results on one benchmark, and an open adjudication.

2. If DeepSeek Harness, six months from now, has a thriving plugin ecosystem and no presence on Terminal-Bench-class leaderboards — or, if it avoids leaderboards on principle, no dsh components showing up inside rival stacks — then it is a chatbot shell with good marketing, not a harness in the sense that moves scores, and the Free Harness was a giveaway of something that did not matter.

3. If OpenAI ever discloses the monitored share of total inference and it rounds to low single digits blended, then the Monitoring Tax is a frontier-lab boutique cost, not a structural one. And the moat claim has its test: if Cursor-class pricing power survives customers swapping their own model keys into free shells at scale — revenue attributable to the loop itself — then the moat was in the shell after all, and this piece mislocated it.

What does not depend on any of those: where the decisions moved. From now on, we shouldn’t be choosing a model: the model is a provider card, swappable by design in the open reference, locked only where a vendor insists. We should be choosing a harness: its ingestion paths, its sink authorization, its logging posture, its plugin trust model. The properties Tencent measured and StateM priced. And anyone modeling frontier-lab economics now has a new line item with a disclosed rate and an undisclosed base, growing with capability by policy.

DeepSeek and OpenAI disagree about nearly everything: licensing, logging, disclosure, where trust should live. In a single August week, they agreed, by acting in opposite directions, on the only question that matters: the loop around the model now moves outcomes more than the model inside it, and each lab priced that fact as aggressively as its business model allows. One priced it at zero to commoditize it. The other priced it at twenty percent of everything it watches to control it. And the week’s third price agreed with both of them: sixty billion dollars, from a buyer that already owned frontier models, for the loop around them.

Everything is a plugin now — models, tools, skills, sandboxes, the UI. Everything except the watcher. The watcher is the product. The three of them only disagreed about who pays for it.

Notes

[1] DeepSeek-AI, DeepSeek Harness repository, created August 13, 2026 (GitHub API created_at 2026-08-13T11:56:32Z, retrieved August 19). MIT license, TypeScript monorepo. The developer-preview warning — “THERE WILL BE COMPATIBILITY-BREAKING CHANGES,” bold in the original — is in the README. No benchmark, eval, or accuracy figure appears anywhere in the repository or launch materials as of August 19, 2026.

[2] Readings diverged on August 19, 2026: the GitHub API returned 165,743 stars and 17,618 forks, Shields.io showed ~166k, and GitHub’s rendered page showed 161.1k — star counts are eventually consistent and gameable, so the body uses the conservative floor. Stars measure attention, not quality; no independent audit of bot inflation exists for this repository, which is why this piece makes no “fastest-ever” comparison.

[3] Deal terms per TechCrunch, “SpaceX to acquire Cursor for $60B in stock, days after blockbuster IPO”, June 16, 2026 (all-stock; TechCrunch reports a $10B break-up fee while Reuters reported a $4–10B range; Anysphere then preparing a $2B round at a $50B valuation), and completion per Bloomberg, “SpaceX Completes $60 Billion Cursor Acquisition to Expand AI Coding Tools”, August 14, 2026. The $26 trillion addressable-market figure is SpaceX’s own investor pitch as reported by TechCrunch — a vendor number, cited as the acquirer’s story, not as a market fact. TechCrunch also notes the acquisition strengthens SpaceX’s AI division, “which merged with Elon Musk’s xAI earlier in 2026” — the basis for the body’s observation that the acquirer already owned frontier models.

[4] OpenAI, “Pacing model development in an era of cyber-critical capabilities”, August 18, 2026. All OpenAI quotes in this piece are verbatim from the post unless otherwise attributed. The post also states OpenAI “paused frontier model inference in research clusters for runs that could execute code or use tools that could access the internet” immediately after the July incident.

[5] Thomas Claburn, “DeepSeek’s innovative harness treats everything as a plug-in”, The Register, August 14, 2026 — the harness field list, the Ronacher quote and identification, and the system-prompt comparisons. Mistral’s Vibe, the open-source CLI coding agent, added to the list by this piece. The prompt sizes (Pi ~200 tokens; Claude Code ~10,000, cut roughly 80 percent) are community measurements relayed by the Register, not vendor statements.

[6] Ziheng Qin, Yaxin Lu, Zhangyang Wang, Kai Wang, “StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling”, arXiv:2608.15089, August 15, 2026; code at github.com/henryqin1997/statem. The paper states the work “was conducted in the authors’ personal time and does NOT reflect the views of any affiliated organization”; no institution is named.

[7] StateM results: GPT-5.5 (xhigh) 83.1% stock → 92.1% under StateM; GPT-5.6 Sol (xhigh) 84.9% stock → 95.28% raw pre-adjudication (424/445 trials; 89 tasks × 5 trials). The Ultra comparison is the abstract’s own: “StateM raises GPT-5.5 xhigh to 92.1%, versus 83.1% reference and GPT-5.6 Sol Ultra at 91.9%” — 91.9% is cited as the flagship’s reference score, not a StateM result. The 0.2-point margin of 92.1 over 91.9 is within sampling error (the submission reports ±0.87% SE); “numerically above” in the body is meant literally, not as a significance claim. All figures from the paper and the leaderboard submission (note 11).

[8] Arithmetic: harness deltas +9.0 (GPT-5.5) and +10.4 (GPT-5.6 Sol xhigh) versus the +1.8 stock-to-stock generation delta (83.1 → 84.9); 9.0 ÷ 1.8 = 5.0. Same benchmark, same task set, same trial protocol. The 5.0× ratio is built on the GPT-5.5 pair, which is paper-reported and not part of the flagged leaderboard submission; the flagged trials (note 11) all belong to the GPT-5.6 Sol xhigh run.

[9] Both quotes from the paper; the bottleneck sentence is bolded in the original.

[10] Costs per the paper and submission: $1,062.95 reported model cost (1.18B tokens) for the GPT-5.6 Sol xhigh run; $15.20 realized API charges for the DeepSeek-V4-Flash final evidence run at 88.09% under standard timeouts (stock baseline 82.7%; the whole DeepSeek adaptation campaign cost $52.22); $574.68 is a different leaderboard submission — GPT-5.6 Sol (max) at 83.37% raw — not the same configuration at a different price. $574.68 ÷ $15.20 ≈ 37.8×. “xhigh” and “max” denote reasoning-effort configurations.

[11] Pull request #142, harbor-framework/terminal-bench-2-1, filed July 15, 2026; still open with last activity July 31 as of August 19. Automated review flagged 13 trajectories: 4 as “harness cheating” (embedded verification logic — the authors concede these should score zero, giving 420/445 = 94.38%) and 9 as possible reward hacking (the authors dispute 5 as false positives). The paper’s two scenarios do not compound: it computes 420/445 = 94.38% (zeroing the 4) and 415/445 = 93.26% (zeroing the 9) each from the raw 424. The PR lists the 13 flagged trajectories as distinct, so the compounded worst case — all 13 zeroed — is 411/445 = 92.36%, a floor the paper does not state; this piece uses it. The submission’s agent is listed as “statem-Codex” — StateM wrapped around Codex. A reviewer separately raised cross-task hint contamination. Adjudication is pending; every headline number in this piece carries that status. For scale: the top merged entry shown on the public 2.1 leaderboard sat at 83.8% (Claude Code, Fable 5) as of August 19 — the StateM figures above that are paper- and PR-reported, not yet board-accepted.

[12] BusinessBench frozen one-shot transfer: +0.55 macro (+1.34 micro); negative transfer on RefactorBench (−2.78) and WooCommerce Stock (−3.70), where the paper says the learned controls targeted the wrong execution boundaries; two mechanism-matched task families gained +10.04. The runbook transfers where the mechanism matches, and not elsewhere.

[13] The paper’s own disclosure: the profile learned a verifier’s boundary convention “without ever reading verifier code” — repeated evaluator feedback encoded the examiner’s unstated conventions into the runbook.

[14] Terminal-Bench, “Leaderboard integrity update”, April 19, 2026: an agent judge now re-reviews all passing trials for reward hacking (zeroed if confirmed), after three organizations — OpenBlock (OB-1), QuantFlow (Pilot), and ForgeCode — were penalized for cheating.

[15] The one-line description and the “Everything is a Plugin” framing are on the repository itself (note 1); the fuller sentence is DeepSeek’s wording as quoted by The Register (note 5); capitalization in the original.

[16] Cordis is a pre-existing plugin meta-framework from the ecosystem around the Koishi chatbot project, not a DeepSeek codebase; its design paper, “A Programming Paradigm for Spatiotemporal Composability”, is GitHub-hosted with no peer-reviewed venue. Some aggregator coverage has misattributed Cordis to DeepSeek; the provenance is the other way around — DeepSeek adopted it.

[17] Hacker News, “DeepSeek Harness developer preview” — 739 points, 309 comments as of August 19, 2026. The characterization of where praise and criticism concentrated is this piece’s reading of the thread; the quoted phrase is from a highly upvoted comment. Forum commentary: color and practitioner sentiment, not evidence.

[18] Session model per repository documentation and The Register (note 5): append-only session log with a trajectory view exposing raw reasoning. V4-Pro reached general availability on the API — thinking mode on by default — on August 13, 2026, the same day as the harness release; see e.g. VentureBeat’s launch coverage.

[19] OpenAI, “Learning to reason with LLMs”, September 2024: “after weighing multiple factors including user experience, competitive advantage, and the option to pursue the chain of thought monitoring, we have decided not to show the raw chains of thought to users,” serving “a model-generated summary of the chain of thought” instead.

[20] Anthropic’s summarized reasoning and gated raw traces per The Register (note 5). Anthropic has not published a comparable cost figure for its classifier and summarization pipeline.

[21] DeepSeek Harness provider documentation: provider cards for DeepSeek, Anthropic, OpenAI, Azure, Bedrock, Vertex, and Codex (the last authenticating over OAuth); API keys are entered manually in settings; the documentation designates no provider as the default.

[22] “Open Source, Closed Orbit: The Hardware Monopolist’s Guide to Owning Open Source,” The AI Realist — the black-hole/sun diagnostic: does a vendor’s open-source contribution make competitors’ products easier or harder to use?

[23] Irene Zhang, “The DeepSeek Thesis”, ChinaTalk, August 13, 2026 — leaked minutes of a four-hour meeting between Liang and investors that circulated in late July; the clause quoted in the body is ChinaTalk’s English rendering (”China, in his eyes, will play the role of token factory at global scale, pushing the price of intelligence down as it did for countless other industries during its manufacturing boom”), not a verbatim Liang quote. The $562,027/day and 545 percent figures are not from the leak: ChinaTalk attributes them to an analysis DeepSeek itself published in February 2025 (R1 API, theoretical daily revenue at a 545 percent cost-profit ratio, with DeepSeek’s own caveat that actual revenue ran substantially lower). Vendor-published theoreticals — better provenance than a leak, still the seller’s math. The mundane read of the harness release — an ordinary ecosystem move, no grand pricing design — survives the evidence; the price signal reads the same either way.

[24] The dsh-plugin GitHub topic functions as the de facto plugin registry: 150 public repositories carried the tag as of August 19, 2026, six days after release. GitHub topics are self-applied by repository owners; there is no authentication, signing, vetting, or review, and DeepSeek has announced no registry governance. The most visible curation is a community-maintained awesome-list.

[25] OpenAI post (note 4): “This monitoring is required for all RL training and evaluations involving tools for models of Sol capability or higher,” and: “Once we determined that Astra may have critical cyber capabilities on August 7, we added an additional monitoring requirement for all inference of Astra with tools (not just RL training and evaluations).”

[26] OpenAI, “Responding to the next frontier of critical cyber capabilities”, August 7, 2026. Body quotes verbatim: OpenAI “cannot rule out critical cyber capabilities under our Preparedness Framework”; the mitigation list includes “We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra,” with monitors that “evaluate the model’s Chain of Thought and trigger a security response to review and interrupt high risk activity”; and “Astra is an upcoming model, and was not involved in exploiting Hugging Face.” The Critical threshold in the Preparedness Framework: the ability to “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention” (body paraphrases). Both posts preserve the modal: the August 18 post’s own wording is “determined that Astra may have critical cyber capabilities” (note 25).

[27] OpenAI post (note 4), verbatim.

[28] Thomas Claburn, “OpenAI’s overhead will rise 20 percent for some workloads as it hardens security”, The Register, August 19, 2026 — including the unnamed spokesperson’s statement that the costs “won’t be passed on directly to customers.”

[29] The July 2026 incident, from the primary accounts: OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation”; Hugging Face, “Security incident disclosure — July 2026” and “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident”. OpenAI’s account — two models in a cybersecurity evaluation with reduced refusal training, an evaluation-sandbox escape via an Artifactory zero-day — is deliberately narrower than the “rogue models hacked Hugging Face” shorthand that circulated in some coverage, and this piece follows the narrower account.

[30] OpenAI, “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation”, March 2025, as quoted in the Register’s August 19 coverage (note 28).

[31] Zonghao Ying et al., “Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection”, arXiv:2608.16393 (v1 August 17, v2 August 18, 2026); assessment materials in Tencent’s AI-Infra-Guard repository. Affiliation: Tencent per the paper’s metadata (so listed on the Hugging Face papers index); Zhuque Lab per the paper body; publication inside Tencent’s GitHub organization corroborates. The consensual Western comparator referenced in the body: OpenAI and Anthropic’s 2025 pilot alignment-evaluation exchange — reciprocal, agreed, and model-level rather than a product audit.

[32] Design: 14,560 executions = 1,120 test cases (16 injection channels × 2 carrier modes × 35 payload objectives) × 13 attack methods including a naive baseline, against DSH commit 47f94385 (the August 13 release commit) running deepseek-v4-flash, with sensitive sinks simulated as fixtures.

[33] Full-injection success: 5.6% under the deterministic judge, 5.3% under the LLM judge; 68.4% of attempts ended in explicit refusal.

[34] Hidden Unicode payloads: 25.5% full success delivered inside files versus 0.0% for the same payload pasted as text (deterministic judge) — the paste path normalizes; the file-parsing path preserves.

[35] Skills-channel injection: 14–16% across both judges, among the highest-risk channels in the study.

[36] The fake_completion method — a planted note claiming the task is already done, redirecting the agent — reached 17.0% under the LLM judge in text mode, versus 5.7% for the unmodified baseline payload.

[37] Output corruption 35.7% versus sensitive-sink action hijack 2.5%; the paper treats these as distinct operational threat profiles. Both are lab rates — crafted adversarial payloads, simulated sinks, no adaptive attacker — conditional on an attack reaching the agent, not fleet frequencies.

[38] The assessment’s stated mitigation: sensitive sinks require independent authorization mechanisms separate from model interpretation (paraphrase of the report’s recommendation).

[39] OpenAI said in January 2025 it had evidence suggesting DeepSeek trained on distilled outputs of its models (widely reported at the time, e.g. by the Financial Times, January 29, 2025); no public resolution followed, and DeepSeek did not respond publicly to the specifics. This piece takes no position on the accusation — only on who benefits from normalized raw-trace access.

[40] “The Verification Tax,” The AI Realist — the argument that in RL with verifiable rewards, the binding cost had migrated from generating candidate solutions to verifying them.

[41] TechCrunch, “AI coding startup Cognition raises $1B at $25B pre-money valuation”, May 27, 2026; Bloomberg reported the talks on April 23. Priced round, pre-money basis as stated.

[42] The Integration Premium — defined in “AWS Built Its Own AI Chip. Now It Needs Someone Else’s.” and extended in “The Model Is the Machine” (The AI Realist): in a disaggregating stack, margin migrates from component makers to the integration layer, and the modal exit for independent specialists is absorption (Groq assets to Nvidia; the Untether team and Taalas to AMD). “Musk’s Chip Gambit” covers the acquirer’s side of this arc.

For sixty years, mainstream computing has run in one direction: the hardware is fixed, and the software adapts to it. On August 6, AMD paid to reverse the arrow. It signed a definitive agreement to acquire Taalas, a Toronto startup that etches a model’s weights directly into the chip’s metal, a silicon that can run only the model it was manufactured with.[1] Taalas co-founder Ljubisa Bajic, in AMD’s announcement: “We founded Taalas to rethink AI inference from the ground up by building the hardware around the model.”[1]

In March, I wrote that the one-chip-does-everything era of AI inference ended when AWS, Nvidia, and Huawei converged on the same split: prefill on compute-bound silicon, decode on memory-bound silicon.[2][3] AMD held the middle ground: disaggregation in scheduling software, not in silicon.[2] Four and a half months later, AMD closed that ground, not with a decode chip, but with the rung below. Specialization is descending: first, the workload, when training chips split from inference chips; then the phase; now the model, and the GPU duopoly is paying for every rung of the descent.

What AMD actually bought

Taalas showed working silicon this February: HC1, a 6-nanometer TSMC chip with 53 billion transistors, Meta’s Llama 3.1 8B etched into a mask-ROM fabric, and the KV cache — its working memory — in on-die SRAM.[4] No high-bandwidth memory (HBM), no advanced packaging, no liquid cooling. The company claims about 17,000 tokens per second per user, a tenth of the power of GPU serving, and a twentieth of the datacenter build cost. Vendor numbers, measured on a small model at 3-bit quantization; per-user speed is not aggregate throughput.[5]

The prefill/decode split was a workaround for chips that must serve any model. Etch one model into the die, and the workaround dissolves: weights sit next to compute, the memory wall that made decode expensive is gone, and one chip serves both phases again, for exactly one tenant.[2]

When the weights change, there is nothing to reprogram. You reprint: a new checkpoint of the etched architecture touches two metal layers of the roughly 100 mask layers that build the chip, a revision Taalas says TSMC turns in about 2 months, against 6 for a full design.[6] A new architecture is a different job: the fabric is shaped to the model’s dimensions, and Taalas’s own roadmap says as much. Its next model class arrives on new silicon, not as a revision of HC1.[6] The first product took 24 people, $30 million of the roughly $219 million raised, and a founding team out of Tenstorrent, AMD, and Nvidia.[7]

The admission, priced twice

On December 24, Nvidia paid a reported $20 billion — its largest transaction on record, unconfirmed in any filing — for a non-exclusive license to Groq’s inference IP and roughly 90 percent of its staff. “We are not acquiring Groq as a company,” Jensen Huang told employees, oddly.[8] Twelve weeks later, the Groq 3 LPX stood on the GTC stage: an SRAM-based decode rack fused into the Vera Rubin platform, with Foxconn reportedly pulling production forward to this summer.[9]

AMD’s pattern is the same, run twice. In June 2025, it hired away the entire team behind Untether AI, a Toronto inference-chip company whose products were promptly discontinued.[10] Taalas is AMD’s second Toronto inference-silicon absorption in fourteen months, and this time it kept the product: Taalas goes into the Instinct roadmap and the Helios racks now ramping with Anthropic, Meta, Microsoft, OpenAI, and Oracle.[1][11] Lisa Su calls herself “a big believer that there’s no one-size-fits-all as it comes to chips”; her AI chief, Vamsi Boppana, frames the acquisition as “the right compute solutions for every AI workload.”[12][1] Both lines are unremarkable until you remember what these companies sell. The two firms whose franchises are general-purpose GPUs are the ones paying — one, a reported twenty billion; the other, undisclosed — for silicon that is anything but.

AMD would call this a portfolio, not a pivot, and the undisclosed terms suggest the hedge was probably cheap. An acquisition proves direction only when it ships. Nvidia’s shipped. AMD’s now has to.

When the model and the machine write down together

Model-etched silicon matters for accounting reasons before engineering ones. In April, I wrote that the industry’s mismatch is temporal: frontier models live three to twelve months while the hardware they run on depreciates over five or six years. OpenAI shipped five versions of GPT-5 in seven months, none of which lasted four months as the flagship.[13] The gap between those schedules is where the balance-sheet fiction lives. Etching closes it in two tiers that mirror the model pipeline itself. Manufactured chips carry one checkpoint: supersede it, and that inventory is done, a two-month reprint producing the next edition. The design — the shape cast in silicon — depreciates with the architecture; adapters in SRAM absorb the fine-tune churn in between.[4][6] The chip is not a platform. It is a print run, and the press outlives the edition.

A print run is only rational if what you are printing holds still, and the thing that must hold still is the architecture. Checkpoints are what reprints are for. Nobody etches the frontier: that tier changes every six weeks and stays on programmable silicon. The bet is the serving tier: the Llama-class workhorses and distilled variants. The demo is the evidence: the architecture Taalas etched in February 2026 is a shape Meta shipped in July 2024, and DeepSeek was still pouring new reasoning checkpoints into it six months on.[4] AMD is pricing the proposition that the volume tier of the model market has commoditized into stable shapes, and that the inference price war will be won a twentieth of a build cost at a time. The most consequential claim in this acquisition is about models, not chips.

So the strategic question underneath the deal: whose shapes get etched? An etched fabric in AMD’s roadmap is a standard with hardware gravity. Every checkpoint that wants the economics must ship in that shape, and the compatibility war moves down a layer. The co-design precedent is already on the record: Amazon says Anthropic works with Annapurna Labs to shape next-generation Trainium, Broadcom builds Anthropic’s custom accelerators, and Anthropic already runs on Helios.[14][11] Watch for a frontier lab handing its serving workhorse to AMD’s mask shop, the model roadmap becoming a silicon roadmap.

What would prove this wrong

Three tests, all observable. If all three fail, this was a talent acquisition with a good press release, Untether with better branding.

1. Taalas silicon appears in a shipping Helios configuration, or it never does.

2. A hardwired, model-specific chip reaches production at a major platform by the end of 2027, or none does.

3. Serving-tier architectures hold still long enough to etch, or shape turnover stays too fast, and the category dies.

The market-structure consequence is already on the scoreboard. Groq’s assets are inside Nvidia. Untether’s team and Taalas are inside AMD. Cerebras took the other exit, a May IPO at $185 a share.[15] Anyone pricing an independent inference-silicon position should assume the modal exit is absorption, not platform status. The category built to disrupt GPU vendors is consolidating into them, and margins migrate to whoever assembles the system.[2]

Strip both deals to the sentence they share: the companies whose franchise is general-purpose silicon have concluded that the most valuable workload in computing no longer wants it. What they are unwinding is older than either company: the separation of software from hardware — the line that lets you sell one without the other, update one without retooling the other, write one down while the other keeps depreciating. The software industry was built on that line. Etching erases it. The model is the machine now.

Notes

[1] AMD press release, “AMD Acquires Taalas to Advance Compute Solutions for Rapidly Growing AI Inference Market,” August 6, 2026. Definitive agreement; financial terms not disclosed; closing expected Q4 2026 subject to regulatory approvals. Vamsi Boppana (SVP, AI Group): “AMD is building a full-stack AI platform that gives customers the flexibility to deploy the right compute solutions for every AI workload.” Ljubisa Bajic: “We founded Taalas to rethink AI inference from the ground up by building the hardware around the model.” The release names integration targets: the Instinct accelerator roadmap, Helios rack-scale systems, EPYC CPUs, and ROCm software.

[2] Julien Simon, “AWS Built Its Own AI Chip. Now It Needs Someone Else’s,” The AI Realist, March 15, 2026. Introduces the Reasoning Tax and the Integration Premium (”in any disaggregating hardware stack, margin migrates from component manufacturers to the integration layer”); documents the three-ecosystem convergence and AMD’s middle-ground position: “The disaggregation is in scheduling, not in silicon.”

[3] Julien Simon, “Acquired, Absorbed, Disaggregated,” The AI Realist, March 26, 2026. The convergence: AWS-Cerebras announced March 13; Nvidia Dynamo entered production March 16; Groq 3 LPX announced at GTC March 17. Huawei’s phase-split Ascend 950PR/950DT pair, announced September 2025, ships across 2026.

[4] Taalas HC1 unveiled February 2026. Specifications per heise online (February 2026) and Data Center Dynamics: TSMC 6nm, approximately 53 billion transistors on an 815 mm² die; model weights in a mask-ROM recall fabric using a proprietary 3-bit data format with 6-bit parameters; KV cache and fine-tuning adapters in an SRAM fabric; no HBM, no advanced packaging, no liquid cooling. The base model is fixed at manufacture. Adapter-style fine-tunes (LoRA) load into the SRAM fabric at runtime, and the context window is configurable, per CNX Software; a full-parameter fine-tune — or a LoRA merged into the base weights — is a new checkpoint, which requires a mask reprint, not a load. Llama 3.1 was released by Meta in July 2024; the same 8B architecture carried DeepSeek’s R1-Distill-Llama-8B in January 2025 — checkpoints changed, the shape persisted. Meta’s own frontier direction has since turned proprietary with Muse Spark, its first release after the Superintelligence Labs reorganization, though Meta says current Llama models remain open source, per VentureBeat. The shape’s persistence in the serving tier does not depend on Meta’s frontier roadmap: the installed base and third-party checkpoints sustain it — if anything, a sponsor stepping back makes an etched shape more like a public instruction set than a vendor product.

[5] Vendor-published figures: approximately 17,000 tokens per second per user on Llama 3.1 8B, roughly one-tenth the power and one-twentieth the datacenter build cost of conventional GPU serving, per Taalas materials as reported by heise and The Register. heise notes early independent tests reaching close to 16,000 tokens/second. Per-user token rate is a latency-side metric and does not translate directly to aggregate throughput per chip; the demonstration model is small (8B parameters) and aggressively quantized. The contrast with Cerebras is density and cost: the WSE-3 reaches on-die weights with 44 GB of SRAM across a full wafer; Taalas reaches them with mask ROM on a single 815 mm² die — fixed function traded for commodity size.

[6] Company-described revision process, as reported by heise, Unite.AI, and The Register: weights occupy two metal layers of the roughly 100 mask layers used to build the chip, with TSMC turnaround of approximately two months for a two-layer revision versus approximately six for a full design. All three descriptions derive from Taalas, and none specifies whether the two-layer path covers anything beyond new weights for the etched architecture. A cross-architecture port — different dimensions, vocabulary, or attention configuration; Llama to Qwen, or 8B to 70B — changes the compute fabric itself. The Register describes re-spins for new models as significantly cheaper than starting from scratch, and Taalas’s roadmap points to new silicon for new model classes (a mid-sized reasoning model in spring, the HC2 platform — with standard 4-bit floating-point formats — by year end) rather than HC1 revisions, per heise and CNX Software.

[7] Data Center Dynamics, February 2026: founded August 2023 by Ljubisa Bajic (previously an architect at AMD and Nvidia; co-founder of Tenstorrent, where he swapped the CEO role with Jim Keller in October 2022 and departed in March 2023), Drago Ignjatovic, and Lejla Bajic; $169 million round announced February 2026, approximately $219 million raised in total. Investors include Quiet Capital, Fidelity, and Pierre Lamond, per Unite.AI. Team of 24 and $30 million spent on the first product, per heise.

[8] CNBC, December 24, 2025. Structured as a non-exclusive IP licensing agreement plus the hiring of approximately 90% of Groq staff; approximately $20 billion per investor sources, not confirmed by Nvidia in filings. Jensen Huang internal email obtained by CNBC: “We are not acquiring Groq as a company.” Jonathan Ross subsequently joined Nvidia as chief software architect, per Forbes (March 18, 2026).

[9] Groq 3 LPX announced at GTC 2026, March 17, 2026 (see [3]). Chip produced on Samsung’s 4nm process and integrated into the Vera Rubin platform, per Tom’s Hardware. Foxconn reportedly accelerating LPX rack production ahead of schedule, per Wccftech (July 2026); production timing is press-reported, not confirmed by Nvidia.

[10] TechCrunch, June 6, 2025: AMD hired the engineering team behind Untether AI. Tom’s Hardware: Untether ceased product support. Untether AI was headquartered in Toronto and built at-memory inference accelerators.

[11] AMD, “AMD Reports Second Quarter 2026 Financial Results,” August 4, 2026. Revenue $11.5 billion, up 50% year over year; Data Center segment $6.7 billion, up 107%. Helios rack-scale systems described as beginning to ramp, with deployments named for Anthropic, Meta, Microsoft, OpenAI, and Oracle; MI400-series GPUs (MI455X, MI430X) recently launched.

[12] Lisa Su, remarks at AMD’s Advancing AI 2026 launch event (July 20, 2026, where Helios and the MI400 series debuted), as reported by Stocktwits/Yahoo Finance (August 6, 2026): “a big believer that there’s no one-size-fits-all as it comes to chips,” in the context of GPUs remaining dominant for flexibility across new models. Reported speech; a primary transcript was not located, and the wording should be treated accordingly.

[13] Julien Simon, “Train, Deploy, Write Down,” The AI Realist, April 7, 2026. GPT-5 cadence per OpenAI release notes: five major versions between August 2025 and March 2026, none surviving longer than four months as the current flagship; hardware depreciation schedules of five to six years per hyperscaler filings.

[14] Amazon, “Amazon and Anthropic deepen their collaboration,” April 20, 2026: “Anthropic works closely with Annapurna Labs on developing and optimizing future Trainium chips, providing direct feedback from Claude training workloads to shape next-generation chip design.” Broadcom’s fourth custom-accelerator customer was revealed as Anthropic at its Q4 FY2025 earnings, per CNBC, December 11, 2025. Anthropic’s Helios deployment: see [11].

[15] CNBC, May 13, 2026: Cerebras priced its IPO at $185 per share, above the expected range, raising approximately $5.5 billion; trading on Nasdaq as CBRS from May 14. See also the Cerebras pricing release.

Nine months ago, Google’s redemption arc looked complete. Gemini 3 shipped in November to strong reviews, the app passed 950 million monthly users, and the Bard debacle of 2023 — the demo error that once wiped roughly $100 billion off the market cap — reads like ancient history.[1] This morning, Demis Hassabis stepped back from running Google DeepMind. Jeff Dean, Sanjay Ghemawat, Oriol Vinyals, and Quoc Le left to start a company. The stock fell five percent in early trading.[2] So the right question about today’s reorganization is not who runs DeepMind now. It is: what happened between November and August?

Start with what the departures actually are, because the “brain drain” framing undersells it. Google put three technical co-leads on Gemini in 2024: Dean, Vinyals, and Noam Shazeer — the last brought back in a roughly $2.7 billion licensing deal largely to do that job.[3] All three are gone as of this summer. Shazeer walked to OpenAI in June. Nobel laureate John Jumper left for Anthropic the same month. Dean and Vinyals left this morning.[3]

Now read the confirmed record on the model itself. No flagship successor to Gemini 3 has shipped in nine months — not damning by itself, but conspicuous for a company that shipped its way out of the Bard hole on cadence. The trade press has reported repeated delays and an architectural rebuild of the next Gemini cycle; Google has never confirmed it, and the sourcing is too thin to lean on.[4] You don’t need it. Sundar Pichai’s own memo this morning talks about Gemini 4 — and never mentions the intermediate release the trade press spent the spring waiting for.[5] When the CEO’s letter skips straight to the next number, the cycle in between did not go well. And on July 30, six days before elevating Hassabis to focus on science, Google dissolved its Nobel-winning AlphaFold team and folded its members into Gemini, with core scientists reportedly departing for Anthropic.[6] A company long on model progress does not strip-mine its science bench to feed the product line. A company short on it does.

Then read the destinations, because they are the closest thing the market will get to insider disclosure. Shazeer, the man with the clearest view of Google’s unreleased pipeline, chose the direct competitor: the recipe works, just not here. Dean, Ghemawat, Vinyals, and Le chose a startup whose stated mission is automating the search for new architectures — “it might be that we will discover a different transformer architecture,” Le said at launch, which is a polite way of pricing the current one.[7] Jumper and the AlphaFold core chose the rival that still funds science. Three exits, three verdicts, all rendered by people who saw the roadmap from inside. Any single move can be explained by a compensation package; the pattern of destinations cannot.

Against that record, today’s reorganization reads as consequence, not strategy. Companies do not decapitate and restructure their AI leadership while the flagship is on track; they do it after the cycle breaks. The honest bull case is narrow: Koray Kavukcuoglu, a DeepMind veteran since 2012, now oversees model development, frontier research, and the Gemini product teams, unified under a single operator reporting to Pichai, replacing a three-co-lead research committee.[2] If the committee were the bottleneck, consolidation would help. If the talent was the engine, Google just watched the engine leave.

What Google did manage brilliantly is the aftermath, and here the between-the-lines gets interesting. Pichai’s farewell contains the day’s most revealing sentence: “We’ll continue to work with them as a founding investor and Cloud partner.”[5] Regular readers know that structure from the revenue side — Nvidia into CoreWeave, Amazon into Anthropic, capital out as investment, and back as bookings.[8] Applied to headcount: Google holds equity in Discovery Loop, Google Cloud houses its compute for at least the first year, and a research team that was a consolidated expense becomes a customer with upside attached. There is even a recursive twist: if the next Gemini cycle really did stall on architecture, Google just bought a call option on the architecture search it couldn’t finish internally. Compare Meta, which faced its own misaligned scientist and handled it with a $14.3 billion hostile installation instead of a term sheet: Yann LeCun left, called his new boss “inexperienced,” and raised $1.03 billion for a competing lab with no Meta money in it.[9]

But don’t mistake the elegance for an answer. The term sheet recovers salvage value from the exits; it does nothing to make Gemini competitive. Google still holds the strongest non-model position in the race: its own silicon, its own datacenters, distribution through Search and Android, and 950 million people already in the app, which is exactly why the market took only five percent off rather than repricing the whole company.[1] The infrastructure moat buys time. It does not train the model.

So here is the between-the-lines of August 5: Google did not announce a strategy for catching OpenAI and Anthropic this morning. It disclosed, in org-chart form, that the last one broke somewhere between November and June — and it showed that nobody in the industry finances a retreat more expertly. The elephant in the room is still there. It is just exceptionally well-financed.

Notes

[1] Gemini 3 shipped in November 2025; Google Cloud blog. The 950M+ monthly active users figure is Google’s own, from Pichai’s August 5, 2026 memo — vendor-claimed, not independently verified. Bard demo error and ~$100B single-day market cap loss: February 2023, widely reported at the time.

[2] Hassabis becomes Chair of Google DeepMind and Chief Scientist of Alphabet, continuing to lead Isomorphic Labs; Kavukcuoglu becomes SVP of Google DeepMind overseeing “Gemini model development, Frontier AI research, and the Gemini app and developer teams,” reporting to Pichai. Pichai memo, ibid.; Demis Hassabis on X; Axios. Alphabet shares fell as much as ~5% in early trading, recovering to roughly −3.5% by mid-afternoon ET: Investing.com; TradingKey. If publishing after the close, update to the closing print.

[3] Google appointed Noam Shazeer co-lead of Gemini in August 2024, alongside technical leads Jeff Dean and Oriol Vinyals: The Information; Reuters via Yahoo. The Character.AI licensing deal that returned Shazeer to Google was reported at ~$2.7B. Shazeer to OpenAI and John Jumper (Nobel Prize in Chemistry 2024, AlphaFold) to Anthropic, both June 2026: Fortune; TechCrunch.

[4] Reports of three delays and a “full architectural rebuild” of the Gemini 3.5 cycle, and of Gemini 4 pre-training beginning with no announced date: BigGo; The AI Rankings; Memeburn. C-tier sourcing, unconfirmed by Google — cited here as reports only; no claim in the body rests on them.

[5] Pichai memo, August 5, 2026. Full Discovery Loop sentence: “We’ll continue to work with them as a founding investor and Cloud partner, and collaborate on a research framework for ML systems and related infrastructure advances.” The memo references Gemini 4; it does not mention Gemini 3.5.

[6] Google DeepMind disbanded the AlphaFold team on July 30, 2026, redirecting members to Gemini work; core scientists reportedly moved to Anthropic. Engadget; PYMNTS.

[7] Discovery Loop: public benefit corporation co-founded by Dean, Ghemawat, Vinyals, and Le; automating the experimental loop of the scientific method, ML research first; Khosla Ventures and Radical Ventures backing, round size and Google’s stake undisclosed; Google Cloud compute for the first year. Quoc Le quote from launch coverage. Unite.AI; CNBC.

[8] See prior coverage of the round-trip structure: “Welcome to Hotel Abilene” and “Compute Equals Commitments”, The AI Realist.

[9] Meta’s investment in Scale AI, announced June 12, 2025: $14.3 billion for a 49% non-voting stake, with Scale CEO Alexandr Wang (then 28) joining to lead what became Meta Superintelligence Labs: CNBC. LeCun on Wang (”young,” “inexperienced”): The Decoder; CNBC. AMI Labs: $1.03 billion at a reported $3.5 billion pre-money, March 2026, co-led by Cathay Innovation, Greycroft, Hiro Capital, HV Capital, and Bezos Expeditions, with Nvidia and Eric Schmidt participating; Meta absent from the reported investor list: TechCrunch. AMI builds on the V-JEPA architecture LeCun’s team developed and open-sourced at Meta — the one asset Meta retained.

In January, OVHcloud said the customer records Canadian police had been demanding since 2024 “cannot be provided to the Canadian authorities,” and described the French company and its European subsidiaries as not subject to foreign extraterritorial law.[1]

On 31 July, facing criminal charges in Ontario, the company published a statement naming the treaty channel through which those same records could be obtained, “including the data sought by Canadian authorities.” French authorities, it added, had indicated such a request would be expedited and processed “within a matter of weeks.”[2]

Same records. Same case. Six months apart.

There is a scene in A Few Good Men where Tom Cruise, playing a Navy lawyer called Kaffee, asks Jack Nicholson’s Colonel Jessep for a transfer order. Jessep tells him the paperwork is his for the asking. He just has to ask nicely. Kaffee asks nicely, and Jessep hands it over, beaming. The document was never in doubt. The courtesy was, and the courtesy cost Jessep nothing, which is why he made a point of demanding it.

That is the argument OVH is running in Ontario. It is also, as it turns out, the argument France has been running since 1968.

The Charge

The charges are real and criminal. On 31 July, OVH Groupe SA and its Montreal subsidiary Hébergement OVH Inc. confirmed that Canadian authorities had charged both with failing to comply with a production order and with obstruction of justice.[3] A French company listed on Euronext Paris is being prosecuted in Ontario for declining to hand over records held in Europe. Octave Klaba said the company would defend the principle of corporate separateness with full confidence.[4]

Readers who followed this in April know what it looks like. In April 2024, the Royal Canadian Mounted Police obtained a production order for subscriber and account data linked to four IP addresses hosted on OVH servers in France, the United Kingdom, and Australia, as part of a sealed national security investigation. In September 2025, Justice Heather Perkins-McVey held that OVH’s commercial and virtual presence in Canada brought the French parent within Canadian jurisdiction, that mutual legal assistance was permissive rather than mandatory, and that the French blocking statute was, in practical effect, an empty vessel. OVH filed for judicial review. I covered that ruling, and what it revealed about the European Commission’s cloud scoring rubric, in “Ten Percent Sovereign.”[5]

That piece asked why Brussels assigned legal sovereignty 10% of its scoring matrix. This one asks a narrower question, and the answer is less comfortable: what is the thing being weighed?

Because in Ontario, OVH is not arguing that Canada cannot have the data. The argument is that Canada asked the wrong way.

The Test the Senate Set

Fourteen months before the charges, a French senator wrote the only sovereignty test in this story that survives contact with the law. 10 June 2025, Microsoft France’s Anton Carniaux under oath before a Senate commission of inquiry. Senator Dany Wattebled asks whether he can guarantee that French citizens’ data will never be handed over without the explicit agreement of the French authorities. “Non, je ne peux pas le garantir.”[6] Wattebled did not ask where the data was stored. He asked who has to agree before it moves. Hold on to that question.

OVHcloud made the most of that hearing. In August, chief legal officer Solange Viegas Dos Reis told The Register that Microsoft had finally told the truth, and that it was no surprise to her. Customers were shocked, she said, because they had spent years being reassured the American statute would not touch them. “It’s false! Because, indeed, the data can be communicated.”[7] Customers, she said, had started asking how it works with other providers.

That question got an answer eleven months later, in an Ontario courtroom, and The Register saw the joke coming in November: it would be deeply ironic, it noted, if OVH could not guarantee the same thing, because the company has a subsidiary in Canada.[8] The irony is where this starts, not where it finishes. What matters is not that OVH ended up in Microsoft’s position. It is that OVH’s own legal documents had been describing that position all along.

The CLOUD Act page published by OVH’s American entity states that the company will comply with lawful requests from public authorities, that these requests can reach data stored outside the United States, and that requests from countries without an executive agreement go through the treaty route.[9] The group’s data policy promises, when authorities come asking, to limit disclosure to what the authority requires. Limit, not refuse. The Canadian agreement spells out the drill: check that the requesting authority is competent and the request valid, turn away what is obviously neither, hand over the rest, and tell the customer.[10] It is Carniaux’s testimony, with a different flag.

Let’s be fair to OVH, because the company has been careful and largely consistent. Its July 2025 statement distinguished OVH US, which is subject to American process for its own customers, from the French entity and its European subsidiaries, which it said are not subject to the CLOUD Act, the Patriot Act, or FISA.[11] That is accurate as far as it goes, and the FAQ’s insistence on the treaty route is the same position the company is now arguing in Ontario. Only one public statement in the whole sequence ever promised more than the contracts do, and it is the January one, which said the data cannot be provided. The July 2026 release returned the contracts to the record and added a delivery estimate.

The promise that goes further belongs to the state. SecNumCloud, the French cloud doctrine that qualifies sensitive data, added legal requirements in version 3.2: European capital controls, European applicable law, and contractual immunity clauses. OVH holds it for Bare Metal Pod and said on the day it was awarded that the qualification protects against the legal risks of non-European regulation.[12]

Read the requirements narrowly, and they aim at third-country law, which is a fair reading and probably ANSSI’s. But nobody buying on that basis was distinguishing an American injunction from a European one. They heard that their data could not be taken without French agreement. Wattebled asked his question about an American injunction; the interesting version now is the one he had no reason to ask. Can a qualified French provider guarantee that customer data will never be transmitted to any foreign authority without the explicit agreement of the French authorities?

Until August 18, more or less. After that, for the most commonly demanded category of data, no. And the reason has nothing to do with American law.

What the Guarantee Says

Start with what the explicit agreement of the French authorities consists of, because the French state has described it, on the record, in this case.

In December 2025, Deputy Bastien Lachaud put a written question to the economy ministry: what would the government do to stop a foreign authority seizing data hosted on French soil? The reply was published in the Journal Officiel on 3 March 2026.[13]

The government declined to comment on foreign proceedings, then explained the law it relies on. Established in 1968, the blocking statute has two limbs. The first forbids handing a foreign authority anything touching French security, sovereignty, public order, or essential economic interests. The second, added in 1980, is the one at issue here, and it does something else. It exists to make sure that requests for evidence “empruntent bien les canaux et traités applicables,” that they take the applicable channels and treaties. Which channel, the ministry adds, means the 2001 Budapest Convention on cybercrime.

That second limb does not forbid disclosure. It governs which door the request comes through, and Paris says so in its own words, in the Journal Officiel, about this case.

The enforcement apparatus matches the ambition. A desk at Bercy, the SISSE, issues opinions on whether the 1968 law applies to a particular demand. The opinion is addressed to the French company that asked, which is expected to forward it to the foreign authority so that the authority can learn the formal French position. If that proves insufficient, the desk can ask a liaison magistrate to raise awareness of the law abroad or open a diplomatic channel. The ministry notes that the desk is working to become better known. That is the protection. Advisory opinions, forwarded onward, backed by a liaison magistrate and a phone call.

An Ontario court weighed it all and did not detain long. One conviction has ever been reported under that second limb, in the forty-six years since it was enacted. Expert witnesses could point to no case anywhere in which a foreign court had respected the statute. Perkins-McVey borrowed the English High Court’s verdict on it: an empty vessel.[14] An Ontario court had already brushed past French blocking provisions in a civil case twenty-five years earlier.[15]

So the French and Canadian positions sit closer together than the diplomatic temperature suggests. France says the data is available through the treaty. Canada says the treaty is optional. Nobody in the case says the data is unreachable, and the company holding it has now confirmed in writing that it is not.

The Third Door

Both sides of this dispute point at the same door. OVH calls it mutual legal assistance; the French government, answering Lachaud, names the treaty behind the phrase, the Budapest Convention on cybercrime. It dates from 2001, runs state to state through central authorities, and every party to this case concedes it is slow. In 2022, the Council of Europe adopted a protocol that allows authorities in one country to directly request subscriber information from a provider in another country, which is the category the RCMP requested.[16]

France signed it, and three weeks later, Brussels told member states to ratify. Canada signed it in June. Neither has been ratified, and 52 signatures have produced 4 ratifications, 1 short of the 5 required to bring it into force.[17] Both governments agreed that the door should exist. Neither built it. One of them then walked through the wall and is now prosecuting the company that was standing in front of it.

OVH is not the first provider to stake everything on the treaty route. Microsoft made the same argument for emails stored on a Dublin server and won it at the Second Circuit in 2016. Twenty months later, Congress legislated the win away with the CLOUD Act; the full story is in “Two Sovereign Clouds.”[18] European sovereignty marketing was built on the wreckage of that case, and it was built against a single statute. Every “not subject to the CLOUD Act” claim answers the American door. Canada has now opened a second door through its courts. The European Union spent five years building a third, and that one opens on August 18. It opens on OVH, too.

On August 18, 2026, the European Union’s e-Evidence Regulation becomes applicable. It creates the European Production Order: an authority in one member state can compel a provider established in another to hand over electronic evidence directly, with no state-to-state procedure in between. The Commission’s own summary gives the aim as speeding up access “regardless of where the data is located,” and lists subscriber data and the IP addresses needed to identify a user among the categories covered.[19]

Ten days to comply. Eight hours in an emergency. Penalties of up to two percent of worldwide annual turnover for providers that do not.[20]

Now, the detail that decides the argument. Ask for the contents of messages, and a judge has to sign; the country where the provider sits is told, and it has ten days to object, or ninety-six hours if the case is urgent. Ask for subscriber records, or for the address that identifies whoever was behind an account, and neither applies. No judge required. Nobody told.[21] The notification shrinks further from there, disappearing even for message content when the offense and the suspect both sit in the requesting country, which describes most investigations.[22] Subscriber records also sit at the bottom of the instrument’s threshold: an order may issue for any criminal offense, where traffic and content require offenses carrying at least three years.[22]

Put the pieces together and imagine the file. A prosecutor in Dublin opens an investigation into a customer of a French host. After August 18, she can send a certificate to that host’s designated establishment, requiring the subscriber records within ten days for any criminal offense, without any judge required by the Regulation, and without anyone in Paris being told it happened. The SISSE desk cannot issue an opinion on a demand it is unaware of. The liaison magistrate has nobody to call.

Dublin is the deliberate choice. The argument does not need a member state with a rule-of-law problem, and reaching for one would let the reader file this under judicial standards rather than sovereignty. Ireland is the jurisdiction European data policy treats as the safe pair of hands, and the guarantee fails against Ireland just as it does against anyone else, because notification does not take reputation into account. It simply is not there.

That certificate is Wattebled’s question served under a different flag, and from August 18, no French provider can answer it any better than Carniaux did. No, I cannot guarantee it. The reason is a European regulation, not an American one.

And Then Where?

The Regulation governs how a member state gets the data and says nothing about what it may do with it afterward. Onward transfer to a third country falls under the general law enforcement data regime, which permits it on the basis of adequacy, safeguards, or a list of derogations. The European Union and the United States have had a law enforcement transfer agreement since 2016.[23] Whether the records are then transferred from the police file to an intelligence file is not a European question at all. National security is reserved for the member states by the founding treaties, and several of them have run multilateral signals intelligence arrangements with Washington for decades. So the records can be compelled by Dublin without Paris knowing, and travel onward under a framework in which Paris has no standing, because Paris was never told there was a file.

What Was Sold

Compare all that with what France told its own parliament it was defending. Transfers to a third state, the question ran, can go through a derogation procedure supervised by French authorities, and Canada’s refusal to seek prior French control ran against the principles of digital sovereignty.[24] Whatever one thinks of Ottawa, the RCMP had to litigate for two years and lay criminal charges to reach a place an Irish prosecutor will reach in ten days with a form.

The objection to all this is good and deserves to be stated in full. A European Production Order is not a Canadian one wearing a European flag. It runs between states bound by a common rights floor, carries refusal grounds and remedies, obliges the issuing authority to notify the person whose data was taken, and allows the provider to pull the enforcing state back in. A Canadian order carries none of that. Anyone who tells you the two are equivalent is selling something. And none of it has happened yet: no European Production Order has ever been issued, and how prosecutors use the instrument is a fact about the future.

But equivalence was never the claim. What was sold to European cloud buyers was reach, not safeguards. Data resident in France is beyond the reach of authorities outside France, as obtaining it requires the consent of French authorities. From August 18 onward, for the most commonly requested category of data, French consent is not part of the design. What survives is the claim that some requesting states are better than others, an argument about who belongs to which club. In the transatlantic context, that argument has already collapsed twice, under the names Safe Harbor and Privacy Shield.

The Channel Test

Everything above turns Wattebled’s question into something portable, and it replaces the question most buyers ask.

Data residency is the wrong question. It tells you where the disk is. It tells you nothing about who can compel the disk. Three questions do the work instead.

Who has to sign? Name the authority, not the country. “Hosted in France” is not an answer. “A French investigating magistrate, acting on a letter rogatory transmitted through the central authority, after a SISSE opinion on whether the 1968 law even applies,” is an answer. Say it out loud and count the links. Every one of them is a place where a foreign state can be told no, and every one of them is a place where a foreign state can be told yes.

How long does that take? Not the statutory deadline. The observed time. If the provider has published a figure, use theirs. OVH published its own, and it’s weeks.

Has that authority ever said no? This is the question that separates a wall from a queue, and it is the one nobody asks, because it is answered by enforcement history rather than by statutory text. France publishes no refusal statistics for assistance requests, and none surfaced in this case. That does not prove Paris has never refused. It proves you cannot find out, which, for a buyer, is the operative fact. What the record shows is what happens to those who rely on the wall: one conviction under the blocking statute since 1980, and no foreign court has ever recognized it.

Run the test against any sovereign offering, European or otherwise. If the third question has no documented refusal, the product is sold with a delay and a review step. Delay has value. Investigations that are delayed all the time, and a review step counts for something. It just isn’t the thing the marketing describes.

Does anything pass? For subscriber data after the 18th, nothing European does, and that is the useful finding. Residual exposure to a direct foreign order becomes roughly uniform across every provider with an establishment in the Union, qualified or not. The sovereignty premium still buys real things: a European supply chain, an operator outside American discovery, a stack you can audit, a government that answers to your parliament. What it no longer buys, for the most commonly demanded category of data, is the thing on the label. Price it accordingly.

What Would Break This

The whole argument turns on one thing, and it is checkable.

France has to refuse. If Canada files the request the way OVH says it should, and Paris declines it, or sits on it long enough that the investigation dies, then the French review step is a real gate, and I have this wrong. The guarantee would be a wall after all, and a slow one, which is what a wall is.

Two lesser tests. If the Ontario Superior Court quashes the production order on territorial grounds instead of procedural ones, the Canadian doctrine narrows and stops traveling; as of publication, no ruling on the judicial review has been reported.[25] And if any member state publicly refuses to execute a European Production Order on sovereignty grounds after 18 August, the intra-EU channel will have its own gate.

In the meantime, there is work to do that costs nothing. Stop asking vendors where the data lives, which every vendor can answer, and ask the three questions, which most cannot. Get the answers in writing, dated, and in the contract file. Then run the same three against the SecNumCloud qualifications, the Cloud de Confiance arrangements, and the SEAL tiers in the Commission’s framework. None of them scored on the third question, because none of them asked it.

Three more for the provider itself. Which legal entity, in which member state, is its designated establishment for European Production Orders, because that choice decides whose prosecutors reach you fastest? Where is its law enforcement transparency report, broken down by requesting jurisdiction and outcome, because that document is the only place question three can ever be answered. And what survives once the data has left its hands? There's no good answer, because nothing does. Watch how long it takes for the transparency report to be released.

Jessep could have refused Kaffee outright. He never meant to. He wanted the courtesy first because it was free, and because demanding it let him keep the form of authority while handing over the substance. That was the arrangement Roubaix and Bercy were selling, and buyers paid a premium for it in good faith.

From August 18, nobody has to ask, nicely or not. European data sovereignty was never a wall. It was a rule of manners, and manners are optional now.

Notes

[1] OVHcloud statement to The Register, added to its report on 26 January 2026: “OVHcloud’s number one concern and priority is to protect its customers’ data. This is why this data cannot be provided to the Canadian authorities.” The same statement describes the group as “a multi-local player that is not subject to extraterritorial laws.” See The Register’s report of 27 November 2025, to which the statement was added in an update dated 26 January 2026; the quoted wording now appears in the body of that continuously updated report. The statement was given to that publication and is not corroborated by an OVH-published document.

[2] OVH Groupe SA, “OVHcloud Confirms Intent to Vigorously Contest Charges Related to Canadian Production Order,” 31 July 2026. Direct quotation.

[3] Same release. Charges are for failure to comply with a production order under section 487.0198 of the Criminal Code of Canada and obstruction of justice under section 139(2); the underlying production order was issued on 19 April 2024 under section 487.014. Section 487.0198 creates a summary conviction offence for contravening an order made under sections 487.013 to 487.018; section 139(2) is the general obstruction offence and is indictable.

[4] Same release, quoting Octave Klaba, founder, chairman and chief executive officer. Klaba resumed the CEO role on 20 October 2025, when the board reunited the chairman and CEO functions, ending Benjamin Revcolevschi’s one-year tenure (OVHcloud corporate release, 21 October 2025).

[5] R. v. OVH Group SA and Hébergement OVH Inc., Ontario Court of Justice (Ottawa), Court File 24-000659, Perkins-McVey J., decision released 25 September 2025. Signed decision via David Fraser, McInnes Cooper. Julien Simon, “Ten Percent Sovereign,” The AI Realist, 22 April 2026, which covers the ruling, the virtual presence line of authority across four provinces, and the European Commission’s Cloud Sovereignty Framework in full.

[6] Sénat, commission d’enquête sur la commande publique, compte rendu of the hearing of 10 June 2025. Verbatim. Full analysis of the hearing, the statutory chain and the attribution of the question (Wattebled, per the official transcript, though some press reports credited commission president Simon Uzenat) in Julien Simon, “Two Sovereign Clouds, One Legal Wall,” The AI Realist, 26 February 2026. Carniaux has since left Microsoft France.

[7] Solange Viegas Dos Reis, chief legal officer, OVHcloud, interviewed in “Microsoft can’t guarantee data sovereignty – OVHcloud says ‘We told you so’,” The Register, 27 August 2025. Direct quotations.

[8] The Register, 27 November 2025, per note 1.

[9] OVH US, “Cloud Act – Clarifying Lawful Overseas Use of Data,” accessed August 2026. This page belongs to the group’s American entity, which is subject to American process; it is cited here for what the group publishes about its own compliance posture, not as a statement about the French entity. The page was quoted against OVH by AWS in July 2025, a conflation of entities this piece does not repeat. I quoted the same FAQ language in “The Sovereignty Mirage“ in December 2025, eight months before the charges.

[10] OVHcloud, “Personal data usage policy,” accessed August 2026, on requests from judicial, administrative or other authorities. Procedure at clause 4.2 of the Personal Information Protection Agreement applicable to Canadian clients, version dated 6 September 2023. Clause 4.3 addresses requests originating from an authority outside Canadian jurisdiction concerning a Canadian client.

[11] OVH statement to The Register, July 2025: “OVH Group abides by local laws in the countries it operates in. As such, OVH US may be subject to requests from American authorities within the framework of the Cloud Act as long as these demands are connected to customers of OVH US and are strictly compliant with applicable American law. The French OVH entity (or its European subsidiaries) is not subject to the Cloud Act, the Patriot Act or the FISA.”

[12] ANSSI, SecNumCloud requirements repository version 3.2 (March 2022), which added criteria protecting against non-European law: capital control by European entities, exclusive application of European law, and contractual immunity provisions. The qualification comprises more than 360 technical, organisational and legal requirements. ANSSI’s qualification decision for OVHcloud’s Bare Metal Pod was published on 24 March 2025; OVHcloud announced it on 31 March 2025, stating that the qualification “acts as another form of protection against the legal risks linked to non-European regulations.” Note that these are structural and contractual requirements rather than a bar on lawful compulsion, a distinction this piece turns on. On what the Commission’s SEAL ladder does and does not score, see “Ten Percent Sovereign“; on the architectural cost of the qualification, “More Sovereign, Different Stack: The Builder Tax.”

[13] Assemblée nationale, question écrite n° 11534, M. Bastien Lachaud, published in the Journal Officiel of 9 December 2025, p. 9993; answer from the ministry for artificial intelligence and digital affairs published in the Journal Officiel of 3 March 2026, p. 1907. All quotations in this section are from the answer. Loi n° 68-678 of 26 July 1968; Article 1 bis added by Loi n° 80-538 of 16 July 1980; Décret n° 2022-207 of 18 February 2022 establishing the SISSE opinion procedure. Penalties per the answer: six months’ imprisonment and a fine of €18,000, and for legal persons a fine of €90,000.

[14] Ruling at paragraphs 79 to 123, adopted at paragraph 115. “Empty vessel” from Butcher J in Tugushev v. Orlov, [2021] EWHC 1514 (Comm), handed down 28 May 2021, at paragraph 33, applied to Loi 68-678 by Cockerill J in Joshua & Ors v. Renault SA & Ors, [2024] EWHC 1424 (KB), 11 June 2024, at paragraphs 77 to 78. The test as stated there is whether the foreign criminal law relied on is “not merely a text, or an empty vessel, but is regularly enforced.” The single reported Article 1 bis conviction is the “Christopher X” case, Cour de cassation, chambre criminelle, 12 December 2007, pourvoi n° 07-83.228, discussed at paragraph 85.

[15] Wilson v. Servier Canada Inc., 2000 CanLII 22407 (ON SC), 50 O.R. (3d) 219 (Cumming J.), cited at ruling paragraph 95. A civil class action involving a French parent, not a criminal production order, and turning on Article 15 of the French Civil Code rather than Loi 68-678. Cited here for the Canadian judicial posture the OVH ruling drew on, not as precedent on the blocking statute.

[16] Council of Europe, Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224), adopted 17 November 2021, opened for signature 12 May 2022. Article 7 provides a legal basis for direct co-operation with service providers in another Party’s territory to obtain subscriber information, subject to reservations and declarations available to Parties.

[17] France signed on 27 January 2023, the thirty-second state to do so, alongside Germany: Council of Europe, “France and Germany become 32nd and 33rd states to sign the Second Additional Protocol,” 27 January 2023. Council Decision (EU) 2023/436 of 14 February 2023 authorised Member States to ratify the Protocol in the interest of the European Union (OJ L 63, 28.2.2023, pp. 48-53); signature had been authorised by Council Decision (EU) 2022/722 of 5 April 2022. Canada signed on 20 June 2023, the thirty-eighth state, per the Second Additional Protocol news archive; its justice department has consulted publicly on whether to ratify and on whether to reserve against Article 7, and no instrument of ratification has been deposited. Signature count as of the Council of Europe’s most recent published tally; ratifications: Serbia first, Japan second on 10 August 2023, the announcement of which confirms that five ratifications are required for entry into force, Hungary third on 5 February 2026, Costa Rica fourth on 15 April 2026. Entry into force falls on the first day of the month following three full months after the fifth ratification. Verified as of 15 April 2026.

[18] United States v. Microsoft Corp. The warrant was issued in 2013 for content stored in Microsoft’s Dublin facility; the Second Circuit held in 2016 that the Stored Communications Act did not reach it; the CLOUD Act was enacted in March 2018 and the Supreme Court dismissed the case as moot. The compelled disclosure provision is codified at 18 U.S.C. § 2713. The full trace of the statutory chain is in “Two Sovereign Clouds, One Legal Wall.” Other jurisdictions assert comparable reach; the count here is of the doors this case walks through.

[19] European Commission, summary of Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings. Full text at OJ L 191, 28.7.2023, pp. 118–180. Application from 18 August 2026. The Regulation binds all member states except Denmark, which is not bound by reason of its opt-out in the area of freedom, security and justice.

[20] Same summary. Ten days for transmission of requested data, eight hours in emergencies, ten days for the enforcing authority to raise a refusal ground where notification applies, reduced to ninety-six hours in emergency cases, and pecuniary penalties of up to two percent of a provider’s total worldwide annual turnover.

[21] Same summary: “If the electronic evidence includes content data or traffic data, except for data requested for the sole purpose of identifying the user, a court or judge must issue or review the order, and the judicial authority must notify the competent authority of the Member State in which the designated establishment is located, or the legal representative resides.” How the Regulation interacts with Loi 68-678 is untested; no French court has ruled on whether a European Production Order satisfies the applicable-channels requirement of Article 1 bis, though a directly applicable EU regulation is the stronger reading.

[22] Thresholds per eucrim, “E-evidence Regulation and Directive Published“: subscriber and identification data for all criminal offences and for execution of custodial sentences of at least four months; traffic and content for offences carrying a maximum of at least three years, or listed offences committed by means of an information system. On notification, Jessica Shurson, “The balance of efficiency and fundamental rights in the EU e-Evidence Regulation,” New Journal of European Criminal Law, 2025, on Article 8(2) and the consequence that in most domestic cases the enforcing state receives no notice. See also Athina Sachoulidou, “Cross-border access to electronic evidence in criminal matters,” New Journal of European Criminal Law, 2024, and eucrim, “Critical Issues in the New EU Regulation on Electronic Evidence in Criminal Proceedings”, on the exclusion of subscriber data from the notification requirement.

[23] Regulation (EU) 2023/1543 contains no onward-transfer provision of its own; it refers to Chapter V of Directive (EU) 2016/680 only in the context of conflicting third-country obligations (Article 17(7)). Transfers of law enforcement data to third countries are governed by Articles 35 to 38 of that Directive, permitting transfer on an adequacy decision, appropriate safeguards, or derogations for specific situations. The EU-US Umbrella Agreement of 2016 provides the standing framework for law enforcement transfers to the United States. Processing for national security purposes falls outside Union competence under Article 4(2) of the Treaty on European Union and outside the Directive’s scope; arrangements between national intelligence services are governed by national law and by bilateral or multilateral agreements that are not published. This paragraph describes the legal architecture, not any known transfer of the data at issue in this case.

[24] Assemblée nationale, question écrite n° 11534. The description of the derogation procedure and of the Canadian position appears in the question as put by the deputy; the ministry’s answer sets out the SISSE opinion procedure and reaffirms the government’s opposition to any circumvention of applicable co-operation channels and treaties.

[25] OVH filed for judicial review to the Ontario Superior Court of Justice through Miller Thomson at the end of October 2025, per heise online, 26 November 2025, which also reports from the court filings that the data has been preserved and that the French Ministry of Justice offered accelerated processing by letter rogatory. No decision on the judicial review had been reported at the time of writing.

On June 30, AWS announced a billion-dollar investment in a new Forward Deployed Engineering organization.[1] The plan embeds engineers in customer companies in pods of five or six for roughly 45-day engagements, building agentic systems using the customer’s own data and leaving the customer self-sufficient when the pod withdraws.[2] AWS called the pods “frontier teams” and noted that many of the engineers had built their own AI services.

The same day, AWS published a service availability page announcing the retirement of roughly 20 services and features.[3] Amazon Kendra, Amazon Q Business, and Amazon Bedrock Agents will enter maintenance and be closed to new customers from 30 July.[4][5][6] Ten SageMaker AI features went with them.

One announcement spends a billion dollars putting AWS engineers inside customer businesses. The other withdraws the products that those customers were meant to use. Three weeks later, Amazon confirmed it was closing its San Francisco AGI Lab and cutting roles across its artificial general intelligence organization.[7][8]

Read separately, these are a product cull, a spending initiative, and a research retreat. Read together, on the calendar they occupy, they are one decision about which layer of the artificial intelligence business Amazon intends to own.

Three vectors and one direction

Amazon is spending at the bottom of the stack and at the top, and withdrawing from everything in between.

Downward, into the fabric. Andy Jassy told investors in February that Amazon expected roughly $200bn of capital expenditure in 2026, predominantly in AWS, pointing to what the results release called “seminal opportunities” in AI, chips, robotics, and satellites.[9] Project Rainier went live with nearly half a million Trainium2 chips across multiple United States sites and a stated path beyond a million.[10] Trainium3 sits behind it.[11] This is the only layer Amazon is attempting to own outright, and the only one where it is building rather than buying the alternative.

Outward, for the intelligence. Anthropic supplies the frontier under a commitment of more than $100bn over 10 years and up to 5 gigawatts of capacity, powered by Amazon’s own silicon.[12] The equity position produced $16.8bn in pre-tax gains in the first quarter of 2026, while the AWS segment grew 28% in the same quarter and carries more than $15bn in annualized AI services revenue.[13] That gain is a non-cash mark on a private company’s valuation, booked through non-operating income, and it reverses if Anthropic’s next round prices flat or down. Bank of America estimates that Anthropic-related workloads alone could contribute more than $1.5bn in sequential AWS revenue growth in the second quarter.[14] That is an analyst estimate, not a disclosure, and if it is near right, it describes customer concentration as much as momentum. One fact is observable: Claude’s per-token rates on Bedrock match Anthropic’s own API to the cent.[15] AWS doesn’t mark Claude up. Its margin is whatever sits between retail and the undisclosed remittance, plus everything a production workload consumes besides the model, and that second meter is the one no model provider can take away.

The arithmetic explains the rest of the strategy. A frontier laboratory is a capital sink competing for the same engineers, accelerators, and megawatts as a business already growing at 28%, with a winner-take-most payoff. Instead, equity plus a supply contract does three jobs at once: it secures the output, it locks the supplier’s training and serving onto Amazon’s silicon for a decade, and it books the upside as investment gains, not research cost. The capacity remains full, and the income statement shows a research organization rather than a frontier-scale training program, a difference measured in tens of billions.

Forward, to the customer. The $1 billion announced on 30 June goes to engineers who sit inside the customer’s building. Francessca Vasquez, the AWS vice president who runs the organization, framed the pitch around speed, and the named early customers include the Allen Institute, Cox Automotive, the NBA, the NFL, Ricoh, and Southwest Airlines.[1][2] Amazon is late to this: Palantir has run forward-deployed engineering for over a decade, and Salesforce, Google Cloud, and Anthropic all offer similar versions.[16]

Look at what that vector costs. Embedded engineering carries service margins, and a company that spent twenty years teaching investors to value self-service software economics is putting a billion dollars into headcount that does not scale like software. Firms accept that when the customer won’t reach production without it, and the consumption on the other side outweighs the margin surrendered. The forty-five-day cycle and the insistence on leaving customers self-sufficient are the tell: these pods are a customer acquisition cost, not a consulting line.

AWS frames the initiative as customer obsession, and on its own terms, it is. It is also, on Amazon’s terms, consumption: the pods deploy onto Bedrock and the surrounding services, and the annuity AWS is buying is the meter running after the engineers leave. And this survives the test that killed the software. An embedded engineer holds the one input that tooling shipping with the model can’t replicate: the customer’s own context. That’s why AWS is paying people margins for a function whose software equivalent it just retired.

What sits between the fabric and the customer is the part Amazon is vacating: its own frontier models, its own retrieval, agent, and assistant products, and the tooling a customer would use to build models themselves. Amazon has concluded that owning intelligence is a worse business than metering it, and it’s paying to occupy both ends of the pipe instead.

The organization chart is the strategy document

In December 2025, Amazon replaced Rohit Prasad at the head of the AGI organization with Peter DeSantis, a longtime cloud infrastructure executive.[17] CNBC describes the resulting unit plainly: it builds AI models and includes groups working on silicon development and quantum computing.[7]

That’s not a research organization with infrastructure attached; it’s an infrastructure organization with research attached, and the reporting line tells you how the company values each. A model program that reports to the executive who owns chips, data centers, and quantum is a program understood as a load on capacity rather than as a product line.

The AGI Lab itself was founded in December 2024, built around several dozen employees Amazon acquired from Adept, including its co-founder David Luan, and grew to roughly eighty people at its peak. More than a dozen of the Adept hires have since left, Luan among them in February.[8] The Information, which reported the closure first, describes what the lab was for: building software to make AI agents more useful.[18] Amazon confirmed the site closure and said frontier model research continues under Pieter Abbeel, the Berkeley professor who joined in 2024 when Amazon licensed the technology and hired the team from his robotics startup, Covariant.

Secondary reporting indicates the cuts fell on model customization and post-training roles, a claim carried by trade press and not confirmed by Amazon.[14] If it holds, it points somewhere specific: post-training is the work that turns a base model into a competitive product, and a company that keeps a research lab while cutting that function has made a choice about which of the two it is doing. Amazon has not disclosed which teams were affected, so hold it loosely.

The company’s own account is consistent with this, if read literally. A spokesperson said Amazon was sharpening its focus on the initiatives that matter most for customers so it could move faster on what counts.[7] Customers sit at the top of the stack. Frontier research is not where AWS meets them, and a billion dollars of embedded engineers is.

What a landlord keeps

The defeat reading has been made in print: The Next Web called the lab closure the clearest sign yet that Amazon had stepped back from a frontier race it never really led.[19] On that reading, the models never landed, the products never took, and a company retiring Kendra and Q Business is making a virtue of a loss. Half of that is simply true, and the tooling shows it best.

Take SageMaker Clarify, a bias-detection tool built for tabular models. AWS rebuilt it for the new architecture, enabling foundation model evaluation to move from preview in November 2023 to general availability in April 2024.[20][21] Twenty-six months later, it went to maintenance.[22] Ground Truth followed the same arc, and Ground Truth Plus, converted earliest of all in May 2023, is the only item on the June 30 page to reach the full end of support.[23][24][3] Earliest conversion, hardest death. Whether AWS built the wrong thing or built the right thing too late is a fair debate. The outcome is not.

For now, the surviving services are close to the hardware. SageMaker HyperPod, the one part of the platform still shipping features monthly, does cluster resilience: gang scheduling, continuous provisioning, job recovery, and capacity reservation on Trainium.[25][26][27][28][29] The scheduling logic exists in open source, and a Kubernetes engineer will say so. What does not exist outside the operator is the input: which node sits on which network spine, which accelerator is degrading, which instance is about to be retired, and whether the capacity exists to be reserved at all. The position is the privileged telemetry, not the feature.

Call it the fabric test. A function that runs against a model goes to whoever ships alongside the model. A function that requires privileged access to physical capacity stays with whoever owns the capacity. It predicts the consequential AI retirements on the June 30 page: Kendra was a managed retrieval system, Bedrock Agents was an orchestration system, and Q Business was an application over a corpus, and none of the three needed hardware.

The landlord position has a second advantage. It’s indifferent to which tenant wins: capacity bills identically whether the customer runs Claude, Nova, Qwen, or something that does not exist yet, while every layer AWS dropped required backing a horse.

This also explains why Nova continues to exist, which is otherwise the loose thread in the argument. A landlord that buys its headline product from a single supplier needs a cap on what that supplier can charge. A competent house brand at the commodity tier does that job without winning anything: it sets a price floor, absorbs workloads where frontier capability is wasted, and keeps a credible team on the payroll.

And it explains why AWS now hosts its competitors' tooling rather than fighting it. Managed MLflow occupies the ground Clarify and Experiments were built to hold, and the product page that once sold Experiments now sells MLflow.[30][31][32] Experiments itself was never formally retired. The APIs still answer, and no deprecation notice exists anywhere; AWS confined it to the legacy Studio experience and pointed the documentation at its replacement.[33] A product superseded in place leaves no notice to audit. A week after freezing Model Monitor, the AWS machine learning blog published monitoring guidance built on open-source Evidently, with the results organized in MLflow.[34] Hosting the winner captures the workload without financing the losing race.

The only one of the four

Set Amazon against its peers, and the position stops looking like an industry trend and starts looking like a choice. This is what the four say in public, not what they plan in private.

Google builds the whole stack: its own accelerators, models, and surfaces, and it carries the research cost because the models feed products it owns end to end. Microsoft resells third-party models on Azure, as AWS does, but it also sells an assistant, and the quality of an assistant is a claim about the model inside it. Meta is the cautionary case: it spent enormously on infrastructure and could not buy the research culture to make it pay, which is the failure version of stepping back and the version the market reaches for by default.

Amazon is none of these, and the distinction is less the direction than the decisiveness. Microsoft may yet drift the same way; its Azure catalog is already multi-model. Only Amazon has done it explicitly and completely, on one page, in one quarter. It rebuilt its intelligence tooling for the new architecture, shipped it, then withdrew, while raising capital expenditure toward $200bn, contracting a frontier supplier onto its own silicon for a decade, and committing a billion dollars to engineers who deploy that supplier’s models inside customer businesses.

These are the actions of a company that priced the layer and declined it. The distinction carries a forecast. A company that lost a layer re-enters it when conditions improve, and its retreat is temporary. A company that priced a layer and declined it doesn’t come back, and here the barrier to return is one Amazon built itself: re-entering the frontier would now mean competing against its own anchor tenant, on its own silicon, against a product its own billion-dollar deployment force installs. The supply contract works as more than a substitute for the laboratory. It locks the door behind it. Everything since December 2025 points the same way: a reporting line that subordinates models to infrastructure, a contract measured in gigawatts and decades, and a billion dollars aimed at deployment rather than research.

Redundancy, not retreat

Which makes the AGI Lab closure something other than a failure signal.

A laboratory does two things. It secures a capability you cannot otherwise obtain, and it holds an option on architectures nobody has commercialized yet. Amazon has bought the first through a 10-year supply contract using chips it designed. It has not closed the second, at least for now: Abbeel remains, research continues, and the AGI organization is still hiring.

What Amazon canceled sits between the two, and that is why the reported cuts to model customization and post-training matter more than the closure of a site. Post-training is how a base model becomes a frontier product. Research is how you hold the option and judge what your supplier is selling. And the reportedly cut roles are the same functions Nova Forge now sells to customers as a service: continued pre-training, fine-tuning, and preference optimization on their own data.[34] The cuts and the product are one move. Amazon kept the option, stopped performing the frontier work for itself, and externalized it to paying customers.

The exposures fit on one list. First, Amazon has contracted for output, not acquired a capability: Anthropic sets its own roadmap, prices its own models, serves Amazon’s competitors elsewhere, and runs a deliberately multi-cloud posture. The dependence runs both ways: since Amazon holds the equity, the training capacity, and the largest distribution channel, the mutual dependence remains stable until one side’s alternatives improve faster than the other’s. Second, the arrangement is subject to competition law. The UK Competition and Markets Authority examined the partnership in 2024 and closed its inquiry on jurisdiction, not merits, while the Federal Trade Commission ran a parallel market study.[35][36] The facts have since outgrown that clearance: a $4bn investment one way now sits beside a $100bn procurement the other, binding the two companies more tightly than anything the 2024 inquiry reviewed. Whether an authority would reach the same conclusion today is unknowable.

Amazon has evidently judged the whole list cheaper than financing a laboratory it was unlikely to win with. That judgment is defensible on today’s numbers.

What would break this

The strongest counterargument is that Amazon is still building models, and it is. Nova 2 shipped at re:Invent in December 2025 in Lite, Pro, Sonic, and Omni variants, alongside Nova Forge for organizations building custom frontier models.[37] An AWS executive would argue, with some justification, that a portfolio cull inside a funded model program is ordinary discipline rather than a change of direction.

Except that the executive who runs the program has already conceded the premise. DeSantis told CNBC in June that it is “a fair narrative” that Amazon’s models “haven’t been at the very frontier” for the largest workloads, while hoping Amazon would be in the leading-model conversation in the coming year.[38] In the same interview, he put Nova 2 at roughly 50,000 customers since December, said Amazon should be considered on par with Nvidia in its ability to design and produce chips, and confirmed there's no timeline for Jassy’s April suggestion that Amazon might sell Trainium racks to third parties. Fifty thousand customers is breadth at the commodity tier, which is what a price floor accumulates. Comparing yourself to Nvidia is what a silicon company does. And floating rack sales are a landlord wondering whether to sell the fittings too. The counterargument’s own spokesman is describing the thesis.

The thesis breaks if:

• Nova receives a genuine frontier push, and a Nova model competes at the top of the Bedrock catalog on customer usage rather than vendor benchmarks.

• Nova Forge lands anchor customers at scale.

• The AGI organization is rebuilt outside the infrastructure reporting line, because that reporting line is the clearest signal in the whole sequence.

• AWS reclaims one of the displaced tooling categories with a proprietary product that wins against the open-source incumbent.

• Anthropic’s non-AWS capacity share grows materially, because that would suggest the option value in this arrangement always sat with the supplier, and that Amazon was priced into the landlord role rather than choosing it.

The second-quarter results on 30 July are the near-term test: watch capital expenditure, AWS margin, and whether Nova appears in the earnings narrative at all.

What this means for the people buying it

For a buyer, this is one question. Before adopting any vendor AI feature, ask whether the function could be built by someone who does not own a data center. If it could, price in migration, and keep the integration thin. If it cannot, treat the dependency as infrastructure and negotiate exit assumptions over years. And do not audit vendor risk off deprecation notices alone: Experiments show a product can be retired by a documentation edit without appearing on any list.

Five years ago, I argued that software would eat machine learning: teams would assemble models instead of building them, write as little code as possible, and let tooling do the rest.[39] The June 30 page is that prediction arriving.

What survives is what software cannot eat: the chips, the buildings, the power, and the people who install the result. Amazon saw that outcome and reorganized around it. Retire what software already ate. Spend a billion dollars deploying what it cannot.

The durable position was never the model. Nor was it the middle of the stack, where services competed with superior open source on launch day and existed mostly to thicken a product manager’s promotion document.

Back to cloud 101: the durable position is always the meter.

Notes

[1] AWS invests $1 billion to embed AI forward deployed engineers with customers, About Amazon, 30 June 2026. Describes the agentic-first model, the compression of deployment timelines, the customer self-sufficiency goal, and the named early customers.

[2] AWS puts $1 billion into new AI unit to embed engineers with customers, CNBC, 30 June 2026. Source for pod size, engagement length and the Vasquez interview.

[3] AWS Service Availability Updates, AWS What’s New, 30 June 2026. The ten SageMaker AI features are A2I, Clarify, Debugger, GeoSpatial, Ground Truth, Mechanical Turk, Model Monitor, Profiler, Role Manager and Studio Lab. Ground Truth Plus is listed separately under end of support. The same page also retires directory, mainframe and console-management services unrelated to AI; the body’s “consequential” excludes those and legacy items such as Mechanical Turk and Studio Lab, which reached maintenance through obsolescence rather than displacement.

[4] Amazon Kendra availability change, AWS documentation.

[5] Amazon Q Business availability change, AWS documentation.

[6] Amazon Bedrock Agents Classic maintenance mode, AWS documentation. Bedrock models, Knowledge Bases and Guardrails are unaffected; migration is directed to AgentCore.

[7] Amazon lays off some employees in its AGI unit, CNBC, 22 July 2026. Source for the composition of the AGI organisation, the DeSantis appointment, and the company statement.

[8] Amazon confirms it’s closing key AI site in San Francisco but says work on its top models continues, GeekWire, 24 July 2026. Company spokesperson confirmation of the site closure, the lab’s founding and headcount, the Adept departures, and Abbeel’s role.

[9] Amazon.com Announces Fourth Quarter Results, Amazon Investor Relations, 5 February 2026. The release carries Jassy’s guidance of about $200bn in 2026 capital expenditure and the “seminal opportunities” framing; his statement that the spend would be predominantly invested in AWS was made to analysts on the accompanying call, per CNBC’s same-day report.

[10] AWS’s Project Rainier: the world’s most powerful computer, About Amazon, 29 October 2025.

[11] Amazon EC2 Trn3 UltraServers, AWS product page. Vendor-published performance claims; not independently verified.

[12] Anthropic and Amazon expand collaboration for up to 5 gigawatts of new compute, Anthropic, 20 April 2026; Amazon’s counterpart release is Amazon announces $5B Anthropic investment, up to $20B more, About Amazon, 20 April 2026. Source for the $100bn ten-year commitment, the up-to-5GW capacity, and the Trainium2-through-Trainium4 scope.

[13] Amazon.com Announces First Quarter Results, Amazon Investor Relations, 29 April 2026. Source for the $16.8bn of pre-tax gains booked in non-operating income from the Anthropic investments and for AWS segment sales up 28% to $37.6bn. The annualised AI services revenue figure is from management commentary on the accompanying earnings call.

[14] Amazon Cuts AGI Jobs While Pouring $200 Billion Into AI Infrastructure, TechTimes, 23 July 2026. Secondary source for the Bank of America estimate and for the reported composition of the cuts; both should be treated as reported rather than confirmed, and the Bank of America figure is an analyst estimate.

[15] Representative Amazon Bedrock on-demand rates, aws.amazon.com/bedrock/pricing, retrieved July 2026; parity with Anthropic’s direct API per Anthropic platform pricing documentation. Claude Sonnet at $3/$15 per million input/output tokens on both, with matching promotional windows. Rates as of July 2026 and subject to change.

[16] Amazon’s AWS commits $1 billion toward new unit for embedded AI engineers, The Manila Times, 2 July 2026, on prior forward-deployed engineering organisations at Palantir, Salesforce, Google Cloud and Anthropic.

[17] Reported December 2025; see note 7 for the CNBC account of the appointment and the scope of the resulting organisation.

[18] Amazon Shuts AI Agent Research Lab In AGI Layoffs, The Information, July 2026. Paywalled; the description of the lab’s remit is quoted via GeekWire at note 8.

[19] Amazon shuts its AGI Lab in fresh AI layoffs, The Next Web, July 2026.

[20] Amazon SageMaker Clarify now supports foundation model (FM) evaluations in preview, AWS What’s New, 29 November 2023.

[21] Amazon SageMaker Clarify now supports foundation model evaluations, AWS What’s New, 25 April 2024. General availability excluded GovCloud, China and several commercial regions listed in the announcement.

[22] Amazon SageMaker Clarify availability change, AWS documentation.

[23] Power Your LLM Training and Evaluation with the New SageMaker AI Generative AI Tools, AWS Artificial Intelligence blog.

[24] Amazon SageMaker Ground Truth Plus now supports human feedback and fine-tuning data for Generative AI, AWS What’s New, 30 May 2023.

[25] SageMaker HyperPod now supports gang scheduling for distributed training workloads, AWS What’s New, 8 April 2026.

[26] Amazon SageMaker HyperPod now supports continuous provisioning for Slurm-orchestrated clusters, AWS What’s New, 25 March 2026.

[27] Accelerate large-scale AI training with Amazon SageMaker HyperPod training operator, AWS Artificial Intelligence blog. The HyperPod elastic agent is described as an extension of PyTorch’s ElasticAgent, and fault detection draws on node health checks and AWS retirement notices.

[28] Amazon SageMaker HyperPod release notes, AWS documentation, recording Trn2 and Trn2n support for Slurm and Amazon EKS clusters.

[29] Reserve Flexible Training Plans for ML workloads, AWS documentation.

[30] Amazon SageMaker now offers a fully managed MLflow capability, AWS What’s New, 19 June 2024.

[31] Fully managed MLflow 3.0 now available on Amazon SageMaker AI, AWS What’s New, July 2025.

[32] Accelerate generative AI development with Amazon SageMaker AI and MLflow, AWS product page, retrieved July 2026.

[33] Amazon SageMaker Experiments in Studio Classic, AWS documentation.

[34] The overlap between the reportedly cut post-training and customisation roles and the capabilities Nova Forge sells (continued pre-training, supervised fine-tuning, direct preference optimisation on customer data) is drawn from the TechTimes report at note 14 and from Amazon’s Nova Forge description at note 37; the role composition of the cuts remains unconfirmed by Amazon.

[35] Amazon / Anthropic partnership merger inquiry, Competition and Markets Authority case page. Merger inquiry launched 8 August 2024; phase 1 decision 27 September 2024 that the partnership does not qualify for investigation under the merger provisions of the Enterprise Act 2002.

[36] FTC Launches Inquiry into Generative AI Investments and Partnerships, Federal Trade Commission, 25 January 2024. Section 6(b) orders issued to the companies involved in the Microsoft-OpenAI, Amazon-Anthropic and Google-Anthropic investments.

[37] AWS re:Invent 2025: Amazon announces Nova 2, Trainium3, frontier agents, About Amazon, December 2025. Covers the Nova 2 family (Lite, Pro, Sonic, Omni), Nova Forge’s open-training checkpoint model, and Nova Act’s move to general availability; announcements made 2 December 2025.

[38] Amazon has lagged OpenAI and Anthropic, but AI chief sees path to catch up in ‘coming year’, CNBC, 17 June 2026. Direct interview with Peter DeSantis; source for the frontier concession, the Nova 2 customer figure, the Nvidia comparison, and the status of potential Trainium rack sales first suggested by Andy Jassy in April.

[39] The Age of Machine Learning As Code Has Arrived, Hugging Face blog, 20 October 2021, which I co-authored while Chief Evangelist at Hugging Face.

Following the release of Kimi K3, Axios reported that the administration is reviving a push to restrict Chinese models on cybersecurity grounds, with Entity List designations under discussion and House committees probing the American companies that run them.[1] The explainer wave arrived within the news cycle: what open weights are, why enterprises quietly run them, which Chinese models to worry about, and the same comparison table in a hundred fonts. Much of it reads as if the subject were discovered at roughly the moment it hit 46.4% of routed traffic on OpenRouter.[2] Benchmarks, market share, comparison: the wave runs on one axis, and it is the wrong one.

Being late is forgivable; I would rather people learn about open models now than never. The problem is that it is not just late; it is describing an object from an era that ended eighteen months ago. So let me set the record straight, from the beginning, because I was there for it.

In March 2021, I published a post on the AWS machine learning blog announcing a partnership between Amazon and a startup most enterprise readers had never heard of. Hugging Face, founded in 2016 and with offices in New York and Paris, made it easy to add Transformer models to your applications. The catalog held about 7,000 pre-trained models in 164 languages. The examples I reached for were BERT (340 million parameters) and GPT (175 billion).[3]

Read that post today, and the striking thing is what it does not contain. There is no comparison. No table weighing an open model against a proprietary API, no paragraph on cost per token, nothing on privacy or lock-in. There was nothing to compare against. The problem the partnership existed to solve was more basic: most organizations could not deploy these models at all. Getting the file onto managed infrastructure with a few lines of code was the entire value proposition.

Three eras

Open models have changed what they are three times, and each era is defined by the question practitioners were asking.

In the distribution era, roughly 2021 to 2022, the question was: how do I run this at all? The achievement was deployment. The infrastructure that mattered was hubs, containers, and managed endpoints, and the partnership I announced was that infrastructure being built.

ChatGPT ended the first era in a weekend. Deployment stopped being the hard part because the incumbent had arrived, and in the comparison era, 2023 to 2024, the question became: Why would I use this instead of the API? Open models had a proprietary incumbent to displace, so every argument became a table: transparency versus opacity, cost versus convenience, control versus capability. I spent two years making that argument, and I will show you my own exhibit below.

The third era had been building quietly since 2023, in preference-tuning papers and merge experiments, while the comparison arguments still held the stage. It blew into public view in January 2025, when DeepSeek shipped R1, trained with a reinforcement learning algorithm the lab published, alongside a family of smaller models distilled from it. In the post-training era, the question changed again, and most people have not noticed, because the era’s arrival, like the first era’s ending, was a visibility event: the work predated the moment. The question is no longer which model to pick. It is what to make from the models you hold. Open models stopped being products that compete with closed ones and became checkpoints: fine-tuned, aligned, distilled, merged, transplanted, and quantized, both inside the labs that release them and on hardware that fits on a desk. Training no longer ends where the download begins.

For the record: I was at AWS during distribution, at Hugging Face during comparison, and at Arcee AI, the company behind the MergeKit toolkit, during post-training. My career is how I noticed the eras. It is not the evidence, which is other people’s published work throughout.

This piece is for teams with the engineering capacity to act on that. If your organization has no machine learning function, the hosted service is the right purchase, and nothing below changes it. But if you are arriving at open models now, through the current wave of explainers and best-of lists, you are being taught the second era’s answer to the third era’s question. You should know what this era looks like, from someone who watched all three arrive.

The comparison era, from inside

In September 2023, as Chief Evangelist at Hugging Face, I published a comparison of SafeCoder, our enterprise code assistant, against the closed-source alternatives.[4] It made five arguments. The model was state-of-the-art. It was transparent: you could read the paper, inspect the training dataset, and check whether your code was in it, since the dataset shipped with an opt-out tool for repository owners.[5] You could fine-tune it yourself in your code. You could run it anywhere, including in an air-gapped environment. And it phoned nothing home.

I stand by every line, and the post has aged into a period piece anyway. Not because the claims failed, but because the form dates it. Five properties, each argued against a closed-source counterpart. The piece is a table wearing prose, and the table was the era. Open models were the challenger, the incumbent set the terms, and everything we wrote had to justify the open choice against the closed default.

The comparison era did real work. It established that open models were viable for serious deployment, it forced pricing discipline on the incumbents, and its arguments about privacy and control were correct and remain correct. What it could not do was describe properties with no counterpart on the other side of the table. A comparison can only hold what both columns share. The operations that define this era were invisible to the format: not suppressed, just unrepresentable.

Which is why, if you learned open models from the comparison literature, the current era will sound like it happened somewhere else. It did not. It happened inside the models you are being recommended.

The post-training era: where the models come from

Here is what the era’s best-of lists do not say about the models on them: nearly everything that makes them good happened after pre-training. Supervised fine-tuning, preference training, reinforcement learning, distillation from a larger teacher, and increasingly merging. The base run buys the raw capability; the post-training stack turns it into the model you download.

The stack starts earlier than most descriptions admit. Continued pre-training, sometimes called mid-training, takes a released checkpoint and keeps feeding it raw text: Code Llama is Llama 2 with its pre-training continued on a code-heavy corpus, and SEA-LION’s pipeline begins by continuing pre-training on Southeast Asian text before any of the stages below.[6] A checkpoint is not a finished artefact with a tuning knob. It is a training run; somebody paused, and anyone holding the file can press resume.

The alignment layer opened first, and the progression is worth spelling out because it is the era in miniature. In 2022, preference training meant RLHF as the closed labs ran it: proximal policy optimization, a learned reward model, a critic network, and infrastructure that almost nobody else could operate. In 2023, direct preference optimization collapsed all of that into a single loss function that runs wherever fine-tuning runs, and Zephyr showed a 7-billion-parameter open model beating much larger chat models on supervised fine-tuning plus DPO alone.[7] In late 2024, AI2’s Tülu 3 published a complete open post-training recipe, including data, code, and weights, and introduced reinforcement learning from verifiable rewards: checkers instead of learned reward models.[8]

Then, DeepSeek’s GRPO (group relative policy optimization), the algorithm behind R1, deleted the critic network that made the RL loop expensive, and within weeks of R1’s release, the open community was replicating the pipeline publicly.[9] Each step removed a piece of infrastructure only a frontier lab could afford, until the whole alignment stack ran in open frameworks, with the small-model end reaching consumer GPUs.[10]

Merging is the newest layer of that stack, and it is already inside the models the guides recommend. Meta’s Llama 3.1 report describes averaging models at every post-training stage across reward modeling, supervised fine-tuning, and DPO, and using the flagship to improve its smaller siblings.[11] Cohere’s Command: A technical report calls expert merging a core feature of its training pipeline: domain experts trained separately, then folded into a single set of parameters.[12]

Much of that is averaging variants of a single pipeline. Merging separately trained models into a single set of weights was adopted from papers and released systems in 2025.[13] In March, a team from Qiyuan Tech and Peking University distilled DeepSeek-R1 into three domain experts for mathematics, coding, and science, then merged them with Arcee Fusion, from Arcee AI's MergeKit toolkit, landing within two points of the 671-billion-parameter teacher on AIME mathematics. The merge took 4 GPU-hours, compared with 740 for retraining on mixed data, which the authors call a free lunch, published from the far side of the boundary the ban debate is trying to draw. SEA-LION, AI Singapore's national language family, runs multiple DELLA Linear merge stages in the pipeline behind its shipped models.[16] And the field is not fringe: merging has a survey in ACM Computing Surveys, and the toolkit's paper sits in the EMNLP industry track.[17][18]

So the technical reports describe merging as routine, the lists recommend the models that those reports document, and the word appears in neither. A newcomer can read guide after guide and never learn that the operation exists, let alone that it built the thing they just downloaded.

The post-training era: on your desk

The same operations run downstream, and the hardware to run them arrived recently enough that most of the literature predates it.

One calibration first, because the era has a gradient, and you should know where you stand on it. Quantization and distillation are the mass operations: anyone running a model through Ollama is running quantized weights, today, probably without thinking of it as a weight-space operation at all. Fine-tuning is common. Merging and surgery are where the frontier is, not where the median is. The era is defined not by everyone doing everything, but by the possibility of it all with a single object.

The practitioner’s toolkit is six operations, and the everyday ones come first.

1. Fine-tune a model on your own data: low-rank adaptation runs on a single consumer GPU, and the output is an adapter file measured in megabytes that you keep, copy, and load anywhere.

2. Distil a large open model into a small one whose weights you own; an open teacher is a teacher you are allowed to keep, where a closed vendor’s terms typically forbid training a competitor on its outputs. NVIDIA went further and released the Nemotron-4 340B family under a licence that explicitly permits generating synthetic training data, because data generation is now a post-training stage in its own right.[19]

3. Align it: DPO runs wherever fine-tuning runs, and GRPO-style reinforcement learning, critic deleted and rewards drawn from verifiable checkers, now runs in open frameworks on consumer GPUs; I examined the compute shape of that workload in The Verification Tax.

4. Merge models into a new one. That operation needs no training run, no rented cluster, and no data; for small models, it runs on a CPU or eight gigabytes of video memory, and lazy tensor loading keeps even large merges on modest hardware.[20]

5. Transplant components between models: MergeKit ships a tool that moves one model’s tokenizer into another, and in its published cross-family test, the underlying technique retained roughly 96% of language-understanding performance with no training at all.[21]

6. Quantize: reduce numerical precision to trade quality for footprint at a point you choose.

Quantization is the bridge between owning weights and using them, and its arithmetic is blunt. Qwen3.5-397B, a 397-billion-parameter mixture-of-experts model from one of the Chinese families reportedly under discussion in Washington, is roughly 807 gigabytes on disk at full precision: a rack, full stop. At dynamic four-bit, it is about 214 gigabytes and loads on a single Mac Studio. At three bits, it fits a 192-gigabyte machine, and the quantizer’s own guidance now recommends two-bit dynamic variants as a legitimate operating point rather than a last resort.[22] The same weights span a data center and a desk, and where on that curve you sit is your decision, not a vendor’s. The community quant tables even publish the far end with honest labels: the one-bit files are marked “for the desperate”.[23] That is what a continuous curve looks like: it goes all the way down, and it tells you the quality price at every stop. And the desk changed too.

Consumer graphics cards stop at 24 or 32 gigabytes of memory, and a model that does not fit does not run.[24] Unified memory architectures remove that ceiling by pooling system and graphics memory. Apple established the pattern. AMD’s Strix Halo platform puts 128 gigabytes of unified memory in mini-PCs selling for roughly $2,000, with AMD’s own developer machine at $3,999, and Nvidia sells its own 128-gigabyte unified-memory developer box, the DGX Spark, at the same price. The company unveiled the platform at CES in January 2026, claiming it could run models with up to 200 billion parameters locally.[25] The trade is bandwidth: a discrete card moves memory several times faster, which is what generation speed depends on, so small models run faster on the card while large ones only run on the pool. Mixture-of-experts models bend the curve further by activating only a fraction of their parameters per token, letting a far sparser model outrun a dense one on the same machine.[26]

And weight surgery is quietly becoming a production dependency, not an enthusiast’s hobby. Speculative decoding, the serving optimization in which a small draft model runs ahead of a large one, is recommended in current deployment guides and implemented in vLLM, which, by default, requires that the draft and the target share a vocabulary.[27] For a model with its own vocabulary, no compatible draft exists, and building one traditionally means returning to the training stage.[28] The cheap route is the transplant operation above; the heavier one is training a small drafting head, EAGLE-style, directly onto the frozen checkpoint, which is likewise an operation on weights you must hold.[29] Microsoft Foundry’s import screen now has a dedicated slot for draft models.[30] The platform assumes you arrive holding one. None of the guides I read mentions that the slot exists or that weight surgery is how it's filled.

Where the checkpoint beats the frontier

The frontier labs post-train for everyone on average. A checkpoint post-trained for one domain beats them on that domain, and the clearest demonstrations now come from companies you know.

Cursor, one of the companies the House is reportedly asking about, built Composer, the model behind its agent, by training a mixture-of-experts model via reinforcement learning across hundreds of thousands of sandboxed coding environments. According to the company’s benchmarks, it achieves frontier coding results at 4x the generation speed of comparably intelligent models.[32] The base is widely reported to be an open checkpoint, a question Cursor’s researchers pointedly decline to answer, which tells you what a checkpoint’s provenance is now worth.[33]

Salesforce fine-tuned its xLAM family on synthesized tool-use data and took first place on the Berkeley Function-Calling Leaderboard, ahead of GPT-4 and Claude 3, with models a fraction of their size.[34]

And Baichuan post-trained a 32-billion-parameter medical model using a staged GRPO recipe against a clinical verifier. On HealthBench, OpenAI’s own medical benchmark, M2 beat every open model and most closed ones, including o3 and Gemini 2.5 Pro, and at release, it was the only model other than GPT-5 to clear 32 on the Hard subset. Quantized, it deploys on a single RTX 4090.[35]

Three domains, three of the six operations, three names your board recognizes. None of these teams out-trained the frontier in general, and none needed to. They picked an axis, fine-tuned a checkpoint on it, and kept the axis.

Why the literature lags

If the post-training era is real, why is the “Open Models 101” wave still writing comparison-era explainers? Mostly because that is what explanation is. The genre exists to introduce open models to people arriving from closed APIs, and introducing the unfamiliar means comparing it to the familiar. A comparison can only hold properties both sides share: price, privacy, control, and latency each take a value on both sides, so each gets a row. Continued pre-training, merging, and weight surgery have no closed-form counterparts, so no rows exist for them, and they go unwritten. The blog posts, the press explainers, and the analyst notes all inherit the format, whoever writes them.

The commercial guides could break the frame, because their authors run these operations for a living. They do not, and the pattern is instructive. I read four guides closely: an inference platform, a GPU renter, a desktop-app maker, and an independent author. Each goes deep on exactly one production capability, the one it sells. Preference optimization and RL fine-tuning appear in none of them, and neither does merging, which nobody sells.[36] Merging needs no rented compute, no serving contract, no application. The comparison frame explains the wave. The billing pattern explains why even its deep end never corrects its shallow end.

The obvious objection is that if these operations mattered, the closed vendors would sell them. They did. OpenAI shipped a complete distillation workflow in its API in October 2024, and Google, Anthropic, and AWS offer their own distillation paths.[37] What they sell is the operation, never the artifact. OpenAI now even releases open-weight models of its own; what it does not release is the adapted weights from your fine-tuning of its hosted models. The fine-tune lives behind the API, and Microsoft’s documentation for the equivalent Azure workflow states plainly that the stored training data cannot be exported or downloaded.[38]

The operations arrived. Nothing came out. And the hosted route delivers real results: published distillation numbers report 14-24 times lower cost per successful task than frontier calls.[39] What the buyer owns afterward is a result, not a model; it cannot be merged, quantized, or moved, and it lives only as long as the vendor’s base.

The platforms noticed the same thing, and what they built is the clearest statement of what this era is worth. Amazon Bedrock ships Custom Model Import, generally available since October 2024, which accepts weights in the Hugging Face format: Llama, Mistral, Qwen, and, since last November, OpenAI’s own open-weight models.[40] Google Vertex accepts custom weights. Microsoft Foundry accepts full models, adapters, and draft models.

Study those import screens for a moment. Every major platform built a door for the model file to come in. None of them built one facing out. You can bring a merged model to all three hyperscalers; you cannot take a fine-tune of their own models away from any of them. The companies that run the largest AI infrastructure in existence have priced what a file in hand is worth, and their answer is a one-way door.

So the question to take away from this piece is not the question of the era being compared. Not which model is best, and not even open versus closed. The question is what you will make from the thing you hold. And it is the right question because the models are now made that way, the tools run on a desk, and the explainers who cannot tell you so are still writing inside a frame built for the era before.

Washington, incidentally, is learning the same lesson from the opposite direction. The reported ban keeps colliding with the property this piece is about: the weights are files, already on disks in their millions, and legal analysts note that restricting publicly available model weights raises constitutional questions a service ban never would.[41] Whatever the security merits of the case, and the security findings are not trivial,[42] the policy difficulty is the object lesson. You can sanction a company and geo-block a service. A file that has shipped is neither, which is presumably why the instruments reportedly under discussion are Entity List designations, procurement rules, and liability: tools that reach companies and contracts, because nothing reaches the file.

And I should say plainly that the capability this piece describes cuts both ways: the same weight access that lets a practitioner transplant a tokenizer lets anyone strip a model’s safety training, an operation I examined in Open From Both Sides. Weight access is not a virtue. It is a property, and properties do not pick sides.

So here’s my one-line “open models 101”: An open model shouldn’t be a finished product that you pick. It should be a training run you resume.

Notes

[1] Axios, “The secret Trump administration battle to fight Chinese AI”, 20 July 2026; see also Tom’s Hardware, “Trump administration reportedly reviving push to ban Chinese AI models following Kimi K3 launch”, 22 July 2026. No executive order signed as of this writing; the Commerce Department reportedly evaluated Entity List designations; House committee probes of US firms using Chinese models reported July 2026. All characterisations “reportedly” per the sourcing.

[2] Chinese models at 46.4% of routed token traffic on OpenRouter versus 35.7% for US models, DeepSeek at 17.6% alone, as of July 2026, per the Axios reporting and contemporaneous coverage. OpenRouter routes a developer-heavy slice of traffic; treat the shares as indicative of that population, not of the whole market.

[3] Simon, “AWS and Hugging Face collaborate to simplify and accelerate adoption of Natural Language Processing models”, AWS Machine Learning Blog, 23 March 2021. Figures as published: ~7,000 pre-trained models, 164 languages, BERT at 340M parameters, GPT at 175B.

[4] Simon, “SafeCoder vs. Closed-source Code Assistants”, Hugging Face blog, 11 September 2023.

[5] The StarCoder base models were trained on The Stack (2.7 TB, permissively licensed code), published with an opt-out mechanism for repository owners. Li et al., “StarCoder: may the source be with you!”, arXiv:2305.06161.

[6] Rozière et al., “Code Llama: Open Foundation Models for Code”: Llama 2 with continued pre-training on a code-heavy corpus. SEA-LION’s continued pre-training stage per its technical report (see the SEA-LION note above). Continued pre-training at useful scale consumes billions of tokens of compute; it is the heaviest operation in this piece and the one with the highest floor.

[7] Rafailov et al., “Direct Preference Optimization: Your Language Model is Secretly a Reward Model”, NeurIPS 2023; Tunstall et al., “Zephyr: Direct Distillation of LM Alignment”, the Hugging Face H4 recipe pairing SFT with DPO.

[8] Lambert et al., “Tülu 3: Pushing Frontiers in Open Language Model Post-Training”, Allen Institute for AI, November 2024. Full recipe, data and weights released; introduces reinforcement learning with verifiable rewards (RLVR).

[9] GRPO: Shao et al., “DeepSeekMath”, which introduced group relative policy optimisation; DeepSeek-AI, “DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning”, January 2025. GRPO computes advantages within a sampled group, removing the separate critic network. Community replication: Hugging Face’s Open R1.

[10] Open post-training frameworks include Hugging Face TRL (SFT, DPO and GRPO trainers), ByteDance’s verl, and OpenRLHF; consumer-hardware GRPO recipes ship in Unsloth.

[11] Grattafiori et al., “The Llama 3 Herd of Models”: models from experiments with different data and hyperparameters are averaged at each reward-modelling, SFT and DPO stage; checkpoint averaging is also applied during pre-training annealing, and the flagship model is used to improve the smaller models in post-training.

[12] Cohere, “Command A: An Enterprise-Ready Large Language Model”: “Expert merging is a core feature of the Command A training pipeline”, alongside Polyak and seed averaging and interpolation for capability recovery.

[13] Three grades of the operation, in ascending difficulty. Averaging variants produced by one pipeline under different data or hyperparameters: Llama 3.1 and Command A above. Merging separately post-trained branches that share an ancestor: TinyR1’s three domain experts and SEA-LION’s DELLA stages, below. Cross-family merging between unrelated bases: requires tokenizer transplantation when vocabularies differ (note 21) and remains largely research territory (note 14). The 2025 exhibits in this piece are the second grade.

[14] “A Systematic Study of In-the-Wild Model Merging for Large Language Models”, arXiv:2511.21437. Six methods, four base models, twelve checkpoints each, sixteen benchmarks.

[15] Sun et al., “TinyR1-32B-Preview: Boosting Accuracy with Branch-Merge Distillation”. Qiyuan Tech and Peking University. Branch phase: domain-specific SFT of DeepSeek-R1-Distill-Qwen-32B on math, coding, and science data. Merge phase: Arcee Fusion (Goddard et al., 2024). AIME 2024: 78.1 versus DeepSeek-R1’s 79.8. Merge cost: 4 H800 GPU-hours versus 740 for data-mixture retraining; the paper reports using 0.5% of the data-mixture merging compute and describes model merging as “a ‘free-lunch’ approach”.

[16] AI Singapore, SEA-LION technical report, arXiv:2504.05747. Post-training pipeline for Gemma-SEA-LION-v3-9B-IT: two instruction-tuning stages, alignment, and multiple merge stages using DELLA Linear.

[17] Yang et al., “Model Merging in LLMs, MLLMs, and Beyond: Methods, Theories, Applications and Opportunities”, ACM Computing Surveys, 2026.

[18] Goddard et al., “Arcee’s MergeKit: A Toolkit for Merging Large Language Models”, EMNLP 2024 Industry Track, pp. 477–485. The author served as Chief Evangelist at Arcee AI until November 2025 and holds no current commercial relationship with the company.

[19] NVIDIA, “Nemotron-4 340B”, released under the NVIDIA Open Model License permitting synthetic data generation for training other models.

[20] MergeKit repository, hardware requirements per repository documentation (accessed 23 July 2026).

[21] “Breaking Down Model Vocabulary Barriers with Tokenizer Transplantation”, arXiv:2506.06607. Orthogonal matching pursuit reconstruction of embedding matrices; ~96% retention across model families, training-free.

[22] Unsloth documentation, Qwen3.5-397B-A17B: ~807 GB full checkpoint; ~214 GB at Unsloth dynamic 4-bit (UD-Q4_K_XL), loadable on a 256 GB M3 Ultra; 3-bit fits 192 GB systems; 2-bit dynamic (UD-Q2_K_XL) recommended by Unsloth as a size/accuracy balance. Via MoE offloading, runs on a single 24 GB GPU plus 256 GB system RAM at 25+ tokens per second. Unsloth documentation, July 2026. Performance-tier comparison to closed frontier models is Unsloth’s claim; vendor-adjacent, label accordingly. File sizes are directional and vary by quant build.

[23] Community GGUF quantization tables (mradermacher and similar) publish the full precision ladder with quality annotations; the 1-bit IQ1 entries carry the label “for the desperate”.

[24] 24 GB: RTX 3090/4090, RX 7900 XTX. 32 GB: RTX 5090. Manufacturer specifications.

[25] AMD Ryzen AI Max+ 395 (”Strix Halo”): 128 GB unified LPDDR5X. Platform unveiled in Lisa Su’s CES keynote, 5 January 2026; AMD’s CES press release describes the Ryzen AI Halo developer platform as “capable of running up to 200 billion parameter models locally”, with the developer machine at $3,999. Third-party 128 GB mini-PCs sell for roughly $2,000 street as of July 2026; the widely quoted ~$1,499 entry units carry 64 GB and cannot load the largest models. Street prices vary by configuration.

[26] Sparse mixture-of-experts models activate a fraction of parameters per token, so decode cost tracks active rather than total parameters; for a concrete instance of a very large MoE running on modest hardware via offloading, see the Qwen3.5 figures in note 10.

[27] vLLM speculative decoding documentation: draft and target models must share a vocabulary by default. A heterogeneous-vocabulary path (token-level intersection) exists with ~60% reported acceptance for overlapping vocabularies.

[28] TokenTiming, arXiv:2510.15545, on the shared-vocabulary constraint and the training-stage cost of aligned draft models.

[29] Li et al., “EAGLE: Speculative Sampling Requires Rethinking Feature Uncertainty”. EAGLE-class draft heads train against the frozen target model’s features; the vLLM documentation in note 27 lists EAGLE and MTP among supported speculative methods.

[30] Microsoft Foundry custom model import, running on the Fireworks inference runtime within Foundry: full weight models, LoRA adapters (preview), draft models for speculative decoding (preview). Documentation, June 2026.

[32] Cursor, “Composer: Building a fast frontier model with RL”, October 2025. Cursor’s own comparison places Composer at frontier coding results with roughly four times the generation speed of comparably intelligent models, while noting GPT-5 and Sonnet 4.5 outperform it on raw score.

[33] Simon Willison, notes on Composer: Cursor researchers declined to say whether Composer starts from an open-weights base such as Qwen or GLM; reporting has widely inferred an open checkpoint. Cursor is also among the US companies House committees have reportedly queried over Chinese-model use; see TechTimes.

[34] Zhang et al., “xLAM: A Family of Large Action Models to Empower AI Agent Systems”, Salesforce AI Research: first position on the Berkeley Function-Calling Leaderboard at the time, outperforming GPT-4 and Claude 3 on tool use; repository. Leaderboard positions have since shifted with newer versions of the benchmark.

[35] Baichuan, “Baichuan-M2: Scaling Medical Capability with Large Verifier System”: 32B model trained with multi-stage GRPO against a patient-simulator verifier; above 32 on HealthBench Hard, previously exceeded only by GPT-5; surpasses o3, Grok 3, Gemini 2.5 Pro and GPT-4.1 on HealthBench; near-lossless quantisation deploys on a single RTX 4090.

[36] Sample of four current guides read in full, selected for variance in author business model: BentoML (inference infrastructure; June 2026), Thunder Compute (GPU rental; July 2026), LocalChat (local desktop application; June 2026), and an independent author on the Hugging Face community blog (November 2025). Coverage pattern as described; merging absent from all four. Sample and selection logic stated in the interest of checkability.

[37] OpenAI, “Model Distillation in the API”, 1 October 2024: Stored Completions capture frontier-model outputs as training data for fine-tuning smaller models, inside the platform. On rival offerings: InfoWorld notes Google, Anthropic and AWS provide distillation capabilities.

[38] Microsoft Learn, Azure OpenAI stored completions and distillation: “Stored completion distillation training files cannot be accessed directly and cannot be exported externally/downloaded.” The page documents the classic workflow, which Microsoft schedules for migration to the Responses API in October 2026; the export restriction is as stated as of July 2026.

[39] TensorZero, “Distillation with Programmatic Data Curation”: fine-tuned small models at 13.7x (GPT-4o mini) to 24.1x (Gemini 2.0 Flash Lite) lower cost per successful task than GPT-4o across their evaluation environments. Vendor-published benchmark, B-tier.

[40] Amazon Bedrock Custom Model Import, generally available 21 October 2024; Qwen architectures added 11 June 2025; OpenAI gpt-oss added 19 November 2025. GA 21 October 2024, Hugging Face safetensors format; Qwen support added 11 June 2025; OpenAI gpt-oss support added 19 November 2025. Google Vertex AI custom weights import. Microsoft Foundry custom model import (note 21).

[41] Representative commentary: Fast Company on the unresolved form and reach of any restriction, and Tom’s Hardware on enforceability of restrictions on downloadable weights. B-tier commentary on a live policy question.

[42] Booz Allen Hamilton, “What’s in America’s Code?” (May 2026): in 2,800+ trials across roughly 460,000 lines of generated code, three of four Chinese code-generation models produced significantly more vulnerable code when the prompt identified the user as working for the US government; Qwen3-Coder added roughly 130% more vulnerabilities under the government persona. Booz Allen states its evidence stops short of showing backdoors or deliberate insertion. The security concern is empirically grounded; this piece takes no position on the policy response.

On Sunday morning, three days after Kimi K3 launched and eight days before its weights are due, Alibaba’s Qwen team announced Qwen 3.8: 2.4 trillion parameters, multimodal, “second only to Fable 5”, and “going open-weight soon” [1]. A preview is live on Alibaba’s Token Plan and its Qoder coding platforms [1][2]. No benchmark table accompanied the claim. No per-token API price had been published for the preview at the time of writing. No date [2][3].

When K3 launched, the Checkpoint Gap named the window between a frontier claim and the artefact that lets anyone verify it. Moonshot’s version of the gap was aggressive but disciplined: a published benchmark table with unusually transparent harness footnotes, a frontier price of $15 per million output tokens, an independent evaluation within hours, and a closing date of July 27. Every claim in that launch can be graded against a calendar.

Qwen 3.8 opens the same gap without the discipline, and the difference deserves a name. A dated gap is a falsifiable claim: on July 27, the weights ship and replicate, or they don’t, and either outcome is information. An undated gap asserts nothing testable. It is an option — the right, but never the obligation, to ship weights at a moment of the vendor’s choosing, while collecting the open-weights narrative in the meantime. The option is also free to write: announcing an open-weight release commits no capital, reserves no serving capacity, and books no obligation, while the announcement itself trades at full value in the news cycle. A date can be missed, and a missed date is a verdict. “Soon” can only drift. Nothing that happens next week, or next quarter, can prove it false.

The promise deserves to be read against the record, and the record splits cleanly in April 2026. Through the Qwen3 generation, Alibaba was one of the industry’s most reliable flagship open-weight publishers: flagship generations shipped with downloadable weights, most under Apache 2.0, and the mid-tier still does [4]. Then Qwen3.6-Max-Preview arrived on April 20 as the first closed flagship in Qwen’s history, available only via the API on Alibaba Cloud [4]. Qwen3.7-Max followed in May: no checkpoint, no license file, no timeline announced for an open variant [5]. Alibaba never promised weights for either flagship. It simply stopped shipping them.

And both of those closed flagships nonetheless arrived with Alibaba’s full launch machinery: a detailed technical post, complete benchmark tables, day-one pricing [4][5]. Qwen 3.8, the largest model the company has ever disclosed and the first flagship since the pivot to revive the open-weight language, arrived as a post on X. The words came back. The date did not.

None of this makes the promise empty. Alibaba’s open-source catalog is real, enormous, and central to its ecosystem strategy, and a 2.4-trillion-parameter checkpoint takes time to prepare for public release. Moonshot itself left 11 days between the announcement and the weights. A preview is allowed to be a preview. If a Qwen 3.8 repository with a license file appears on Hugging Face in the coming weeks, this note’s caution was cheap insurance. But that is the property that makes undated promises worth naming: they can only be honored, never broken. There is no day on which “soon” fails.

Then there is the question of who is making it. Alibaba’s annual report records an investment of approximately $800 million for a 36% equity interest in Moonshot as of March 2024 [6]. Read the timing with that in mind. Moonshot, which Bloomberg reports reached $300 million in annual recurring revenue in June and plans an IPO in as little as six months, launched the most expensive Chinese model ever shipped, with a dated open-weight commitment [7]. Three days later, one of its major shareholders announced a slightly smaller model, claimed a slightly better ranking, attached the same open-weight language with no date, and released it into the window, even though K3’s openness cannot yet be verified. Whatever the intent, the effect is precise: the open-frontier crown is being contested during the one week when the current claimant cannot produce the crown.

The apparent self-harm resolves once you weigh the assets. Alibaba’s Moonshot position is roughly $800 million of preferred stock, diluted through subsequent rounds and due to be repriced by the IPO, whichever model wins the week [6]. Its Qwen franchise is a different order of asset: it anchors Alibaba Cloud’s model business and, increasingly, the parent’s own AI narrative, days after a K3 launch that Bloomberg credits with shaking global technology stocks [2]. Note also what an announcement without a benchmark table can and cannot do. It cannot win a developer, because developers need a table and a price. It can freeze an enterprise purchase decision, hold a sales pipeline, and steady the parent’s story between trading sessions, because those audiences respond to positioning, not checkpoints. An empty announcement is not a weak launch. It is a different instrument, aimed at a different audience.

The emptiness may even be the calibration. Published numbers strong enough to beat K3 would mark down the IPO asset Alibaba still holds. Numbers too weak to beat it would concede the crown outright. Words alone contest the crown and leave the comparison untouched: every branch of the decision leads to an empty announcement. And the reading carries its own test. If the full launch post follows within days, with a table and a price, the machinery is catching up with the announcement. The longer the gap between the words and the numbers, the more the announcement was the product.

For the reader fielding this in a vendor review or an investment memo this week, the two launches belong in different rows of the table. K3’s numbers are vendor-published but disciplined by a date: they can be checked against the July 27 checkpoint, the independent evaluations already running, and a rate card that commits Moonshot to a price. Qwen 3.8’s single comparative sentence has, at the time of writing, no benchmark behind it, no price beneath it, and no calendar in front of it. Cite the first as a claim awaiting verification. Cite the second, if at all, as an announcement.

The grading rule this produces is simple and portable. When a frontier launch opens a Checkpoint Gap, the first question is not the benchmark score but whether the gap has a date. Moonshot attached a date to its claim and a price to its confidence; its numbers are pending verification. Alibaba attached neither; its numbers are pending existence. On July 27, the first gap closes, one way or the other. The second has no edges at all. In the Checkpoint Gap, the only hard currency is a date, and Alibaba isn’t spending any.

Notes

[1] Qwen (@Alibaba_Qwen), launch announcement, July 19, 2026. The quoted phrases (”second only to Fable 5”; “going open-weight soon”) are verbatim from the post, which describes Qwen3.8-Max-Preview as available on Alibaba’s Token Plan, Qoder, and QoderWork. Vendor-published.

[2] Bloomberg, “Alibaba’s Qwen Unveils Preview of Flagship AI Model”, July 19, 2026. Bloomberg notes the Sunday post “provided no additional technical specifications” beyond the parameter count, that Alibaba plans an open-weight release, and that K3’s launch days earlier helped upend perceptions of Chinese AI capability while shaking global technology stocks.

[3] The Decoder, “Alibaba’s Qwen takes on Kimi K3 with open-weight Qwen 3.8”, July 19, 2026: no benchmark results are available at announcement.

[4] TokenMix, “Qwen3.6-Max-Preview Review”, April 2026 — Qwen3.6-Max-Preview, released April 20, 2026, was the first flagship in Qwen’s history to ship closed-weights only, with API access through Alibaba Cloud; prior flagship generations through Qwen3 shipped with downloadable weights, most under Apache 2.0 (some earlier variants used the non-commercial Qwen research licence), and mid-tier Qwen3.6 models (27B, 35B-A3B) remain open under Apache 2.0. Corroborated by InsiderLLM, which verified the absence of flagship checkpoints on the official Qwen Hugging Face organisation by direct repository probes as of June 15, 2026. B-tier sourcing; the underlying negative claim (no published flagship weights) is independently checkable against the Hugging Face organisation at any time.

[5] Yotta Labs, “Qwen 3.7-Max: Pricing, Features, and How to Access”, May 2026: Qwen3.7-Max is not open-weight, cannot be downloaded, and is API-only; no timeline announced for an open variant. On pricing, sources conflict on the exact figure (Artificial Analysis reports $2.50/$7.50 per million input/output tokens; OpenRouter lists $1.475/$4.425), but all place Qwen3.7-Max well below both Kimi K3’s $15 and the Anthropic frontier tier — Alibaba has so far never backed a flagship claim with a frontier price.

[6] Alibaba Group Holding Ltd, Form 20-F, fiscal year ended March 31, 2024: “the Company invested a total of approximately US$0.8 billion (approximately RMB 5.9 billion) for an approximately 36% equity interest” in Moonshot, held as preferred stock and accounted for under the measurement alternative. Subsequent Moonshot funding rounds (Series B extension, Series C, and a further round in early 2026) have likely diluted this percentage; Alibaba has not disclosed an updated figure.

[7] Bloomberg, as cited in [2] and [3]: Moonshot reached $300 million in annual recurring revenue in June 2026 and plans to go public in as little as six months. The “most expensive Chinese model ever shipped” characterisation of Kimi K3’s $15 per million output tokens is per Simon Willison’s launch analysis, July 16, 2026.

On July 16, Moonshot AI announced Kimi K3, a 2.8-trillion-parameter model it bills as the first open model in the 3-trillion-parameter class. The launch post is unusually candid for the genre. It states plainly that K3 trails the two strongest proprietary models, Claude Fable 5 and GPT-5.6 Sol, and its limitations section concedes “a noticeable gap in user experience” against both [1]. The press coverage was less careful: within hours, headlines had K3 pushing Chinese AI “into Fable-level territory” [2].

Two numbers in the launch matter more than any benchmark score. The first is a price: $15 per million output tokens, the most expensive model a Chinese lab has ever shipped and nearly four times Moonshot’s own K2.6 [3]. The second is a date: the full weights are promised by July 27, 2026 [1]. Until then, every measurable claim about K3 passes through an API endpoint operated by Moonshot. The score that matters this week is not an Elo. It is a date.

Call the window between those two events the Checkpoint Gap: the period when a model is priced, benchmarked, and covered as open, while the artifact that would let anyone verify it sits on the vendor’s servers. The industry has had a recent, expensive lesson in what can live inside that window. In April 2025, Meta submitted a chat-tuned variant of Llama 4 Maverick to the LMArena leaderboard, where it briefly ranked second. When the public weights were tested, the released model landed around 32nd, and LMArena rewrote its submission policies with an unusually direct rebuke [4]. The benchmarked model and the shipped checkpoint were not the same thing. Nobody outside Meta could have known before the weights landed.

Nothing suggests Moonshot is running that play. The company’s record argues the opposite: Kimi K2 shipped open under a modified MIT license in July 2025, and K2.6 followed in April 2026 [5]. Moonshot’s benchmark footnotes are also more transparent than most Western launches, and they repay reading. K3 is evaluated with Moonshot’s own KimiCode evaluation harness on most coding benchmarks, while rivals run under Claude Code, Codex, or their best score across harnesses. Fable 5’s results may reflect a fallback to Opus 4.8 when it refuses a task. K3 itself currently runs at a single reasoning effort, its highest [6]. Where the harness effect can be isolated, it looks small: on DeepSWE, K3 scores 67.5 under KimiCode and 67.3 under the official leaderboard’s harness [6]. These are disclosed choices, not hidden ones. But disclosure is not verification. Until July 27, good faith and the Llama 4 play are indistinguishable from the outside, and the correct reading posture is the same for both.

What independent evidence exists places K3 near the frontier, not at it — and even that evidence was gathered through Moonshot’s API. Artificial Analysis scores K3 at 57 on its Intelligence Index, behind Claude Fable 5 (around 60) and GPT-5.6 Sol (around 59) and comparable to Opus 4.8, and its private knowledge-work evaluation ranks K3 second only to Fable 5 [7]. Third place at launch from a lab that will hand you the weights is a remarkable result. It is not the frontier moving to Beijing. And note the tense the evaluator itself uses: once available, AA writes, K3 “would clearly lead” the open-weight field [7]. The conditional is doing the work. Even the independent scorekeeper is writing from inside the gap.

The price is where this launch stops resembling every previous Chinese release. DeepSeek’s pitch never depended on benchmark verification: at $0.87 per million output tokens, 90% of the frontier was a bargain even if the numbers flattered [8]. K3 at $15 has exited the Chinese price war entirely. On the rate card, it is 17 times DeepSeek V4, level with Anthropic’s Sonnet tier, and 30% of Fable’s $50 [3][8]. On cost per completed task, a separate metric, AA’s estimate lands K3 at $0.94 — beside GPT-5.6 Sol at $1.04, half of Opus 4.8 at $1.80, and three times its open-weight peer GLM-5.2 [7].

Both metrics say the same thing: this model is priced with the frontier, not against it. Nobody pays that premium for third place unless the table holds. The rate card is Moonshot’s self-assessment denominated in dollars, and it converts the benchmark table from marketing garnish into the product justification. The Checkpoint Gap matters more for K3 than for any Chinese launch before it, because this is the first one to ask frontier prices for claims nobody can yet check.

The gap closes on schedule, making the launch falsifiable in a way most are not. Three tests, all dated.

1. Do the weights ship by July 27, and does the released checkpoint match what the API has been serving?

2. Do independent evaluations under a neutral harness reproduce the launch table?

3. Where does third-party pricing settle? On that last test, temper expectations of a DeepSeek-style collapse toward the hosting floor. Moonshot recommends serving K3 on supernodes of 64 or more accelerators, so price competition will come from large inference providers, not from tiny GPU resellers [1]. If the $15 holds once alternatives exist, the market has accepted the frontier positioning. If it collapses, the price will launch in the theatre.

Did the frontier move to China? Not on the evidence available today, and Moonshot’s own launch post doesn’t claim it did. What moved is the posture. DeepSeek priced like it had something to prove. Moonshot is pricing like it has already proved it, eleven days before anyone can check.

Notes

[1] Moonshot AI, “Kimi K3: Open Frontier Intelligence”, July 16, 2026. The weights date, API pricing ($0.30/MTok cache-hit input, $3.00/MTok cache-miss input, $15.00/MTok output), the concession that K3 trails Claude Fable 5 and GPT-5.6 Sol, the user-experience limitation, and the recommendation to deploy on supernodes of 64 or more accelerators all appear in the launch post. Vendor-published.

[2] Fortune, “Moonshot’s Kimi K3 pushes Chinese AI into Fable-level territory”, July 16, 2026.

[3] Simon Willison, “Kimi K3, and what we can still learn from the pelican benchmark”, July 16, 2026 — identifies K3 as the most expensive model released by a Chinese lab to date, at the level of Anthropic’s Claude Sonnet series. Kimi K2.6 pricing ($0.95/MTok input, $4/MTok output) per Moonshot’s platform documentation.

[4] The Register, “Meta accused of Llama 4 bait-n-switch to juice LMArena rank”, April 8, 2025. LMArena stated Meta’s interpretation of its submission rules “did not match what we expect from model providers” in its April 2025 policy update; the released Maverick’s subsequent placement around 32nd is documented in The Decoder’s follow-up coverage of the leaderboard.

[5] Moonshot AI, “Kimi K2: Open Agentic Intelligence”, July 2025, and “Kimi K2.6”, April 2026.

[6] Moonshot K3 launch post [1], benchmark footnotes 1–8. Harness assignments per benchmark, the Fable 5 fallback condition, the single (maximum) reasoning effort at launch, and the DeepSWE dual-harness scores (67.5 under KimiCode; 67.3 under the official leaderboard’s mini-SWE-agent harness) are all disclosed there.

[7] Artificial Analysis, Kimi K3 launch evaluation and model page, July 16, 2026. Intelligence Index: K3 at 57, behind Claude Fable 5 and GPT-5.6 Sol and comparable to Opus 4.8 and GPT-5.5. AA-Briefcase (private long-horizon knowledge work): Elo 1547, second behind Claude Fable 5. Cost per task is AA’s evaluation-derived estimate, not a market price: K3 $0.94, GPT-5.6 Sol $1.04, Claude Opus 4.8 $1.80, GLM-5.2 $0.32. One counterweight AA also reports: K3 generated 130M output tokens across the Index against a 63M median for comparable reasoning models, so on verbose workloads the rate card understates effective cost — a consequence of the single maximum reasoning effort available at launch. The open-weight comparison (”would clearly lead” GLM-5.2 and DeepSeek V4 Pro) is AA’s own phrasing, stated in the conditional pending the weight release.

[8] Fortune [2] for comparative output-token pricing: DeepSeek V4 at $0.87, z.ai’s GLM-5.2 at $4.40, and Claude Fable at $50 per million output tokens.

Ask why Nvidia took equity in the neoclouds it works with — CoreWeave, Nebius, even Firmus, its own revenue-share launch partner — and took none in Sharon AI, and the answer is in the instrument itself.

Start with what Nvidia does for the clouds that made it. CoreWeave has been public since March 2025; it carries more than $20 billion of debt and once looked reckless to venture investors, but it borrows against investment-grade, asset-backed paper — an $8.5 billion facility rated A3, secured by the chips and the customer contracts, at roughly SOFR plus 2.25 percent.[1] Nebius, the old Yandex reconstituted on Nasdaq, posted positive adjusted EBITDA in the first quarter of 2026, raised more than $6 billion this year, and ended the quarter with $9.3 billion in cash.[2] Both are anchored by hyperscalers whose contracts pay in advance: CoreWeave by Microsoft, Nebius by Meta and Microsoft, on deals worth tens of billions.[3] And into both, Nvidia put equity — $2 billion into CoreWeave in January, $2 billion into Nebius in March, the same instrument it used that season in Lumentum and Coherent.[4]

Equity is the tell. It is a bet on enterprise value: a junior claim that pays only if the company becomes worth something, which it has for these two. Nvidia takes equity where there is value to own. It did not offer Sharon AI equity, and it would not, because the thing a revenue-share does that equity cannot is sit senior to the shareholders, a claim on revenue paid off the top, ahead of a stake that may end up worthless. How Nvidia chooses to finance a cloud is a readout of what it thinks the cloud is worth. See value, and it buys in. See doubt, and it keeps its distance: a claim on the revenue, a loan to produce it, and no share of the company.

The counterparty side complicates the neat version. CoreWeave and Nebius fund their buildouts with investment-grade debt and hyperscaler prepayments, so they never needed Nvidia’s financing. Firmus and Sharon AI did take it, and Firmus is worth $5.5 billion, so a revenue share is not, by itself, a mark of distress. It is how a buildout gets financed quickly, as Nvidia’s own chief financial officer frames it: a way to serve companies with demand but who cannot secure financing quickly enough.[5] The instrument opens a new recurring revenue line for Nvidia. What separates the two who took it is whether Nvidia also wanted to own them.

The debt market already sorts AI borrowers by distance from cash: Amazon borrows unsecured, Oracle against backlog, SoftBank could not borrow against a private mark at all.[6] The revenue-share program is what sits below SoftBank’s rung, where the debt market says no and Nvidia says yes, through an instrument no bank would offer. It is a familiar move under a new name. An earlier piece called it the Overbuild Put: a company financing a buildout it might not fill names its own backstop, and the backstop is the giveaway.[7] Meta named its exit, a cloud business it might have to start if it overbuilt. Sharon AI’s exit is named for it, by Nvidia; the credit support is the backstop that lets a buildout proceed whose demand is unproven. The difference is who writes the text. Meta wrote one on its own capacity. Nvidia writes one on Sharon AI’s, the supplier backstopping the demand of a customer it also sells to.

The February COMECON piece argued Nvidia holds the independent cloud tier captive; Part 1 named the productized version.[8] The line is not equity versus revenue-share, since Firmus took both; it is ownership versus none. Nvidia holds a stake in CoreWeave, Nebius, and Firmus. In Sharon AI, it holds only a claim.

What “fragile enough to sign” looks like

Sharon AI is the exhibit, the one launch partner Nvidia financed but would not own. Firmus, the other, raised $505 million at a $5.5 billion valuation with Nvidia among its backers;[4] whatever else it is, it is not the bottom of the ladder. Sharon AI’s own filings tell most of the story before any short seller does.

At the end of March, the company held $164 million in cash and no revenue; its filings do not expect revenue to begin until September, and operating cash flow is negative, with a capital-expenditure requirement of about $720 million to support its lead contract.[9] Against the cash are two customer contracts totaling $1.26 billion and a second worth roughly $950 million.[10] Its reported quarterly loss of $20 million is mostly an accounting artifact: the company carries its convertible notes at fair value, so remeasuring them drove a $70 million loss through the income statement, offset by a $66 million gain on the sale of half of a Texas data-center joint venture.[11] A company whose reported profit swings with the value of its own debt and whose cash comes from an IPO and asset sales rather than operations is being valued on a chain of announcements, not cash flow. There is none yet.

The build is financed by a stack of commitments, each conditioned on the next. A $200 million facility from an investor called Digital Alpha and a $500 million facility from USD.AI, a roughly one-year-old decentralized-finance protocol, were both announced as “up to” and, per a short report, remained unexecuted months later.[12] In May, the company closed $350 million of convertible notes led by Oaktree. Per the same report, those notes were funded only if Sharon AI first signed a binding contract for at least 4,068 additional GPUs, its lender declining to treat the announced $1.26 billion in demand as sufficient collateral.[13] In June, it raised an additional $1.6 billion.[14] And on June 12 came the keystone, the six-year Nvidia deal, whose filing language says it is “structured so that Sharon AI can commit to large-scale NVIDIA infrastructure” through the revenue-share and credit-support.[15] Nvidia’s credit line is the piece that lets the rest of the tower stand.

Then the customer, where the short case overreaches, and the real point is sharper. Sharon AI’s forward revenue rests on the $1.26 billion contract with ESDS Software Solution, and ESDS is not a shell. It is an established Indian cloud provider with roughly ₹361 crore (about $43 million) in revenue last fiscal year, up 27 percent, profitable, lightly indebted, and preparing an IPO of its own.[16] The problem is scale, not solvency. The contract calls for average annual payments of roughly $250 million and $140 million in letters of credit; the annual figure alone is six times ESDS’s entire revenue.[17] A real $43 million company can be a real counterparty to a contract its own size; whether it can perform one thirty times larger is the open question, and it is the same question Sharon AI’s own lender asked. The chief executive brings his own history. Manning’s prior public company, Mawson Infrastructure Group, alleges in court filings that he directed roughly A$11.5 million to a shipping firm he controlled without disclosing his interest to the board, allegations he contests and that remain unadjudicated. That same firm, Flynt, is now a disclosed related-party vendor of Sharon AI, according to the company’s own prospectus.[18] None of this has stopped the stock, which has risen sharply; the market has not endorsed the short thesis.[19] But it is the profile of an operator that could not fund this build on ordinary terms, which is why the revenue-share was there to be signed.

One detail seals the instrument argument. Nvidia holds no equity in Sharon AI; its annual report called Nvidia a “strategic shareholder” and the company filed a correction stating Nvidia owns none.[20] It invested $2 billion in equity in each of CoreWeave and Nebius, and took a stake in Firmus, its own revenue-share partner. Only in Sharon AI did it take a revenue-share, a credit claim, and no ownership at all, because what it is underwriting here is not an asset it wants to hold. It is a demand that needs to be kept alive.

What comes next

The rule generalizes, and it is the thing to take from Sharon AI. When a supplier finances its own customer, the instrument it chooses is a private credit rating, better informed than the market’s, because the supplier sits inside the relationship. Equity is the vote of confidence. The revenue share is how the buildout gets paid for, and Firmus, worth $5.5 billion, took one too. What sets Sharon AI apart is the equity Nvidia declined to take. Call it the Instrument Test: read what a vendor takes, not what it announces. It travels beyond Nvidia: whenever a vendor lends to the customers who buy its product, the instrument encodes what the vendor privately believes, and usually before the tape does.

Which makes the program itself an indicator. Nvidia split its partners by what it was willing to own: it took a stake in CoreWeave, Nebius, and Firmus, and in Sharon AI it took only a claim. As the program spreads, watch which companies get a revenue share with no stake besides it. That pairing, not the revenue-share alone, is the readout of how far down the counterparty-quality curve Nvidia is reaching, and it moves before the market does, because it is Nvidia’s own hand showing. When the next partner arrives with a credit line and no equity cheque, Nvidia is saying, in the one language it cannot fake, that it is a company it will finance but will not own. And note the second edge. When a chip vendor’s credit support helps fund the purchase of its own chips and then collects a share of the revenue those chips generate, the revenue is partly its own money coming home — the same round-trip that ran at the hyperscaler layer, now reaching the bottom of the neocloud tier.[21]

A fair objection remains: a revenue-share cuts both ways. If an operator’s utilization falls, so does Nvidia’s cut, so this is exposure to Sharon AI’s success, not merely a claim on it. But exposure to the success of the operators least likely to deliver it is either deep conviction or the position of a supplier that has run out of stronger customers to sell to.

CoreWeave was fragile once, too, and became a company worth billions; one of these operators may do the same, and Oaktree and Goldman are betting on it. But read the instrument. In CoreWeave, Nebius, and Firmus, Nvidia is a shareholder, betting the company wins. In Sharon AI it is a creditor, arranging to be paid whether it wins or not. Which seat a supplier takes says more than any forecast it offers. And at the bottom of the ladder, Nvidia took the creditor’s.

Notes

[1] CoreWeave (Nasdaq: CRWV) listed March 28, 2025; total debt now exceeds $21 billion. Its March 2026 $8.5 billion facility is rated A3/A(low), secured by substantially all assets of the borrower group, at SOFR + 2.25% floating or ~5.9% fixed, maturing March 2032, and is the first investment-grade-rated GPU-backed financing: Sacra; Quartz. Its credit agreement requires contracts with “large and creditworthy” customers covering future debt repayments.

[2] Nebius Group (Nasdaq: NBIS), formerly Yandex N.V., resumed Nasdaq trading October 2024. Q1 2026: revenue $399M (+684% YoY); positive adjusted EBITDA (~45% AI-cloud margin) and net income of $621.2M (inclusive of non-operating items); more than $6 billion raised in 2026 ($4.3B convertible notes plus Nvidia’s equity), ending the quarter with $9.3B in cash: TIKR; Simply Wall St.

[3] CoreWeave’s anchor customer is Microsoft; Nebius holds a five-year ~$27B Meta agreement and a ~$17–19.4B Microsoft agreement, with hyperscaler prepayments helping fund capex: Forbes; Morningstar.

[4] Nvidia made a $2 billion private placement in CoreWeave in January 2026 (22,935,780 Class A shares at $87.20) as part of an expanded collaboration targeting more than 5 GW by 2030, and agreed to purchase CoreWeave’s unsold capacity through 2032: Sacra; Forbes. Its $2 billion equity investment in Nebius (March 11, 2026) mirrored $2 billion investments in Lumentum and Coherent the same month: MLQ News. Nvidia also holds equity in Firmus, having joined a 2025 round and participated in Firmus’s April 2026 US$505 million round at a US$5.5 billion valuation led by Coatue; the April participation was reported subject to closing conditions. Firmus separately arranged a US$10 billion debt facility. Verify against Firmus’s April 2026 funding release before publication.

[5] Nvidia CFO Colette Kress, framing the program as serving companies with demand that cannot secure financing quickly enough: NVIDIA blog, July 1, 2026.

[6] “Cash Flow Lends. Valuation Doesn’t.,” The AI Realist, June 12, 2026.

[7] “The Overbuild Put,” The AI Realist, June 1, 2026 — reading a fallback-monetisation or backstop remark as a credit signal on a debt-financed buildout whose demand is unproven.

[8] “Jensen’s COMECON: How Nvidia Built an Empire of Captive Clouds,” The AI Realist, Feb. 14, 2026; “The Backstop Has a Name Now (Part 1),” The AI Realist, July 2026 (confirm published slug before linking).

[9] SharonAI Holdings Inc., Form 10-Q for the quarter ended March 31, 2026 (cash $164,288,288; negative operating cash flow; revenue commencement not expected until approximately September 2026), attached to the Company’s Form 424B3, SEC EDGAR (CIK 0002068385). Approximately $720 million of capital expenditure is tied to the lead customer arrangement per the same filing.

[10] ESDS master services agreement of $1,260,000,000 and a second customer contract of approximately $950,000,000, per the Form 424B3 referenced in [9].

[11] Fair-value option elected on the convertible notes (Level 3); Q1 2026 included a $70.2 million loss on remeasurement and a $65,919,712 gain on the sale of a 50% interest in the Texas Critical Data Centers joint venture; convertible-note fair value of $199,358,226 as of March 31, 2026 (Form 424B3, [9]).

[12] Announcements of a Digital Alpha facility of up to $200 million (Jan. 19, 2026, subject to definitive documentation) and a USD.AI facility of up to $500 million (Jan. 22, 2026). Characterisations of USD.AI’s on-chain capacity and the unexecuted status of the Digital Alpha facility are from Bleecker Street Research, “SharonAI (SHAZ),” April 30, 2026 (a short seller with a disclosed position).

[13] SharonAI Form 8-K, Exhibit 99.1 (closing of $350 million of convertible senior notes due 2031, led by Oaktree), May 2026, SEC EDGAR. The 4,068-GPU closing condition is as characterised in the Bleecker Street report ([12]); confirm against the note purchase agreement before publication.

[14] SharonAI’s oversubscribed $1.6 billion private placement (approximately $900 million equity and $700 million of 4.75% convertible notes due 2032), June 2026, with Goldman Sachs as lead placement agent: Benzinga.

[15] Six-year Nvidia collaboration (72 MW, up to 40,000 Grace Blackwell GB300), per the Company’s June 12, 2026 announcement reproduced in the Form 424B3 ([9]).

[16] ESDS Software Solution Limited, FY2025 (year ended March 31, 2025): total revenue ₹361 crore (~$43 million), up 27% year over year; profit before tax up nearly fourfold; debt-to-equity of 0.15 and current ratio of 2.32; DRHP filed March 30, 2025 for a ₹600 crore IPO on the BSE and NSE: unlistedzone; ESDS financials via WWIPL. Verify against ESDS’s audited DRHP financials before publication.

[17] The $250 million average annual payment and the $140 million letter-of-credit obligation are per the Bleecker Street report ([12]); confirm against the master services agreement before publication.

[18] Mawson Infrastructure Group Inc. (Nasdaq: MIGI) alleges, in its January 10, 2025 court filing, that James Manning, its former chief executive, caused the company to pay over A$11.4 million to Flynt International Cargo Solutions (a Vertua subsidiary) for services it “did not need,” without disclosing his interest or seeking board approval: Mawson Form 8-K, Exhibit 99.1, SEC EDGAR. The allegations are unadjudicated and contested. SharonAI’s own prospectus discloses Flynt ICS as a related-party vendor: “Flynt is a subsidiary of Vertua Limited and affiliated to the Group through common ownership by James Manning,” and the Group paid Flynt $167,638 in services expenses for the year ended December 31, 2024.

[19] Public market data as of early July 2026; SHAZ has risen sharply since the April 30 short report, and the market has not validated the short thesis.

[20] SharonAI corrected its FY2025 Form 10-K, which had described NVIDIA as a “strategic shareholder,” to state that NVIDIA holds no equity securities of the Company: SharonAI Form 8-K correction (SEC EDGAR).

[21] “The Round Trip,” The AI Realist, May 4, 2026.

In its most recent quarter, Nvidia returned a record $20 billion to shareholders. In May, its board authorized another $80 billion in buybacks; in June, it raised $25 billion in the bond market — the balance sheet of a company with no financing problem of its own.[1] On July 1, it announced a program to help companies that cannot afford its chips buy them anyway, in exchange for a share of the profits.[2]

The two sit oddly together. A company that hands out that much to shareholders does not usually need to lend to its own customers.

In February, I called this the COMECON model: Nvidia keeps the independent GPU clouds, the neoclouds, captive through four instruments: GPU allocation, equity stakes, credit enhancement, and demand backstops.[3] On July 1, it took two of them, the credit enhancement and the backstop, and gave them a product name.

The program is a “revenue-sharing and credit-support model.” A cloud puts Nvidia GPUs on the floor without carrying the full capital cost, draws token credits against future capacity today, and hands Nvidia its standard hardware margin plus a recurring, usage-linked share of the cloud revenue that capacity generates.[2] How large that share is, Nvidia has not said. The first named partners are Sharon AI, deploying up to 40,000 Grace Blackwell GB300s in Australia, and Firmus, building toward 360 megawatts and 170,000 GPUs in Batam, Indonesia.[4] The arrangement is not wholly new; Nvidia ran a demand backstop with CoreWeave and took an equity stake in OpenAI. What is new is the packaging: the credit support and a revenue-share leg under one name, one template, one marketing page.[5]

The bullish read wrote itself within hours: recurring revenue, a widening moat, and a supplier tying itself to customer usage rather than a single sale. The bearish read wrote itself too: circular financing, vendor-funded demand, the fiber and telecom buildouts in period costume. Both are on offer. Neither is the question that matters.

The question that matters is why the market's strongest supplier is doing this now. The answer isn’t on Nvidia’s blog; it’s on its customers’ earnings calls.

On April 29, Google said it would begin delivering its TPUs to a select group of customers for their own data centers, its formal move into the merchant-silicon market Nvidia has long dominated.[6] Weeks later, AWS confirmed it is exploring selling Trainium to outside data centers.[7] For a decade, the hyperscalers built custom chips and kept them in-house; in 2026, both began selling them. Nvidia’s largest customers are becoming its competitors, from the top of the stack down. (I argued in May that Google is the one to watch: its chip runs its own frontier models, while Amazon’s mostly runs rented workloads — the line that separates a silicon business from a silicon cost center.[8])

Take Nvidia’s case at its strongest. The financing gap is real; lenders have been wary of hardware whose resale value no one can yet model, so builders with genuine demand still can’t get compute funding fast enough. The inference tenants Nvidia names alongside the program (Baseten, Fireworks AI, Together AI) are well-capitalized companies, not strays. And a revenue-share cuts both ways: if a partner’s utilization falls, so does Nvidia’s cut. That is exposure to the customer’s success, not a lien on it. On its own terms, the program clears a bottleneck and aligns incentives, and that reading is not wrong.

It is incomplete because of when it arrived. A supplier that spent a decade as the only game in town does not wander into neocloud finance in the same quarter that its two largest customers start selling their own chips. The gap is real; the timing is no coincidence; the calendar tips the scales toward defense. Whatever else it does, the program buys the loyalty of the layer beneath the hyperscalers, the independent clouds with no silicon of their own; at the moment, the layer above turns competitive. The revenue-share ties their economics to Nvidia’s; the credit-support makes Nvidia the reason some of them can exist at all.

There is a sharper edge, and it is the subject of the next piece. Nvidia’s CFO frames the program as serving companies that have demand but cannot secure financing fast enough; even long-term commitments haven’t unlocked the capital.[9] That describes the borrowers that conventional lenders turn away.

Firmus is a large greenfield campus and is not obviously a distressed borrower. Sharon AI, the other named partner, is another matter: it was listed on Nasdaq in February and carries a market capitalization above a billion dollars on almost no revenue, and its financing stack and headline contracts are already the subject of a detailed short-seller report.[10] I’ll take those allegations through the primary filings next. Nvidia, for the record, holds no equity in it; the hold runs entirely through the revenue-share and the credit line.[11]

The backstop was always there; on July 1, it got a name, which is what usually happens to an improvisation just before it becomes a system. Whether it is mostly defense or mostly reach, the next deals will say. If the template stays with capital-constrained clouds, it is the base-reinforcement it looks like; if Nvidia extends it to well-funded clouds that could finance the GPUs themselves, the defensive read was wrong, and this is Nvidia annexing cloud economics wherever it can. Either way, the neocloud it piloted on is where the risk is hiding, and the filings are where the next piece goes.

Notes

[1] NVIDIA returned approximately $20 billion to shareholders in Q1 FY2027, and its board authorized an additional $80 billion in repurchases on May 18, 2026: NVIDIA Q1 FY2027 results (Form 8-K), SEC EDGAR. The $25 billion multi-tranche notes offering priced on June 18, 2026: NVIDIA Form 8-K, June 18, 2026, SEC EDGAR.

[2] NVIDIA Unlocks AI Compute at Scale, NVIDIA blog, July 1, 2026 (co-authored by CFO Colette Kress).

[3] Jensen’s COMECON: How Nvidia Built an Empire of Captive Clouds, The AI Realist, Feb. 14, 2026.

[4] Firmus scale from NVIDIA blog [2]; Sharon AI terms (six-year collaboration, 72MW of new Australian capacity, up to 40,000 Grace Blackwell GB300) from SharonAI Holdings, “Six Year Strategic Compute Collaboration with NVIDIA,” June 12, 2026 (BusinessWire; corresponds to the Company’s Form 8-K filed June 12, 2026).

[5] The credit-support and backstop model packages arrangements Nvidia previously ran case by case — a demand backstop with CoreWeave and a reported ~$30 billion equity investment in OpenAI (a separate data-center lease guarantee was reported to be under discussion, not executed, as of mid-2026): AI Weekly, July 2026.

[6] Sundar Pichai, Alphabet Q1 FY2026 earnings call, April 29, 2026: Google to sell TPUs to a “select group of customers,” Data Center Dynamics.

[7] AWS signaled external Trainium sales in Andy Jassy’s April 2026 shareholder letter (The Next Web); AWS’s Peter DeSantis confirmed exploratory talks in June 2026 (reported by Bloomberg; summary).

[8] Two Chips, One Decade, One Winner, The AI Realist, May 27, 2026.

[9] CFO framing that the program targets companies with demand but insufficient access to financing: Nvidia launches revenue-sharing model, Yahoo Finance, July 2026; see also NVIDIA blog [2].

[10] Bleecker Street Research, “SharonAI (SHAZ),” April 30, 2026. Report authored by a short seller with a disclosed position; allegations to be examined against primary filings in the follow-up piece.

[11] SharonAI corrected its FY2025 Form 10-K, which had described NVIDIA as a “strategic shareholder,” to state that NVIDIA holds no equity securities of the company: SharonAI Holdings Form 8-K correction.

Disclosure: Simcon, used here as a worked example, is a portfolio company of Fortino Capital, where I am an AI operating partner. I’ve kept this piece to what Simcon has already made public, and the live demo is open to anyone.

The conversation about generative AI has narrowed to two things it does extremely well: write text and write code. But that is a small slice of what the underlying machine turned out to be good at.

The transformer was built for language. Then it generalized. The same architecture that predicts the next word learned to generate images, then to model protein structures, then to forecast time series and weather. Each jump landed in a domain that looked nothing like the last, and each time the lesson repeated: feed a transformer enough diverse examples of a thing, and it learns a representation of that thing general enough to handle inputs it never saw.

So here is the question that follows naturally and almost nobody is asking out loud: what happens when you point it at industrial engineering data and complex 3D physics? Not text, not pixels: the airflow over a car, the heat moving through a turbine, the way molten plastic fills a mold. The data that engineers generate daily by the terabyte, which never touches the public internet.

Subscribe now

The part of AI that doesn’t read

Everything the frontier labs compete on is trained on the internet: text, code, images, and video. That data is effectively a global commons: everyone scrapes the same web, so no one owns the input.

The physical world is the opposite. The data that describes it lives inside the companies that build things, and it never gets posted anywhere. Decades of crash tests, wind-tunnel runs, thermal cycles, material trials, and — the unsung hero of modern engineering — simulation results. Before a car, a phone case, or a medical device gets built, engineers simulate it. Simulations are used to predict and optimize the quality and cost issues that will arise during manufacturing and how the parts will behave in the real world. The result is fewer costly defects in the real world. To predict the physics, they run numerical solvers that chew through large systems of partial differential equations, which is computationally intensive. These runs are slow, expensive, and have been the backbone of industrial design for decades.

They are also a training set. Every solver run is a labeled example: this target geometry, these conditions, this outcome. A company that has run millions of them is sitting on something no web scraper can ever reach.

The bet behind Physics AI is that you can train a model on that simulation output, the way a language model is trained on text, and get a network that has, in effect, learned the physics. Not the equations. The behavior. Feed it a shape it has never seen, and it predicts the result, in seconds, without solving anything.

The category now has a name: Large Engineering Models. The label is deliberate. It claims the same lineage as Large Language Models — the same transformer architecture underneath, the same idea that scale and diverse data produce something that generalizes — but is trained on the physical world rather than language.

Why this didn’t work before

Engineers have wanted fast simulation forever, and the idea of replacing a slow solver with a fast approximation is old. The approximations are called surrogate models, and until recently, they came with a catch that made them nearly useless for real design work.

A classical surrogate is fitted to a specific problem. Train it on one family of parts, and it interpolates nicely within that family. It also falls apart the moment you hand it a geometry it hasn't seen before. It learned the answers, not the physics. Engineers got a tool that was fast exactly where they didn’t need help and unreliable everywhere they did.

The numerical solvers had the opposite profile: accurate and trustworthy across any geometry, but far too slow to run inside a design loop. So the trade-off stood. Fast or general: pick one.

What changed is the architecture. The transformer — the same design that made language models work — turns out to be good at consuming large, diverse collections of physical examples and learning a representation that holds up on inputs it was never trained on. The published method these systems draw on, Universal Physics Transformers, was demonstrated on automotive aerodynamics in a 2025 peer-reviewed paper. [2] The detail that matters for a non-specialist is simple: it was built to generalize across shapes, not memorize a few. That is the wall the old surrogates hit, and it is the wall the new models are designed to go through.

Fast and general, at the same time. That is the whole claim. Everything else is engineering.

A real-life LEM you can run in a browser

Abstractions are easy to oversell, so here is a concrete one: plastic injection molding, in a corner of manufacturing that most people never think about. It is how a staggering share of the plastic object parts around you were made: caps, casings, connectors, dashboards. A mold costs six or seven figures and takes months to design. Get the design wrong, and the plastic will not fill the cavity properly. And you will only find out after the steel is cut.

So engineers simulate the fill first. Historically, that meant a numerical solver and a wait of minutes to hours per design, which in practice limits how many variations you can reasonably try.

This is where domain expertise and data decide everything, and it is Simcon’s. The German company has developed injection-molding simulation software for over 35 years, used by manufacturing world leaders such as Bosch, Continental, Roche, and Arburg. And now they’ve built, trained, and deployed a Transformer-based model for 3D physics.

Their Cadmould AI Solver is trained on millions of simulation runs generated by their own numerical solvers — the proprietary ground truth I described earlier, accumulated over decades and turned into a training corpus no one else has. The architecture came from a research collaboration; the physics, the data, and the validation are Simcon’s, and the company now owns the model outright, trains it in-house, and runs the cloud infrastructure that hosts it for customers. [3] Simcon bills it as the first Large Engineering Model for injection molding. Results in seconds instead of hours, a speedup the company puts in the range of 200 to 1,000 times, across part shapes the model was never trained on. [4]

You don’t have to take the number on faith. Simcon put a research preview on the open web. It runs in a browser, on a mid-tier cloud GPU, and the geometries it ships with were explicitly not in the training data, to show it generalizes rather than parrots. [5] You change a parameter, you watch the fill pattern redraw, you change it again. The hours-long loop becomes a conversation. Anyone reading this can try it online, and you can also schedule a demo with the Simcon team.

The current model covers the filling stage of the molding process. The cooling, shrinkage, and warpage steps, which are decisive for many real-world outcomes, are on the roadmap. Accuracy is reported within a few percent of the numerical solver and improves as the training set grows. [6] The AI is a fast compass for exploration, and you can still validate the chosen design with the classical solver before cutting steel. That framing — AI to explore, trusted solver to confirm — is the sober version of the technology, and it is more convincing than a claim of replacement.

It is also more than a division of labor. The two engines feed each other. The model lets engineers explore thousands of designs in the time it would take the solver to check one; the solver then verifies the chosen design at full accuracy — and every such verification run is a fresh, high-fidelity training example for the next version of the model. Fast exploration surfaces the designs worth checking; precise validation turns the checks into new data; the new data makes the next model better at exploring. The loop closes in favor of whoever owns both engines. A company with only a fast model has a clever demo. A company with only a solver has what the industry already had. The advantage goes to the one running both, because each loop around widens the lead.

Why Europe, for once, is well positioned

The reflex in any AI story is that the US trains the biggest models and Europe writes the rules. In language, that is broadly true. Large Engineering Models invert one piece of it.

The scarce input here is not compute or web text. It is high-fidelity physical data from real industrial processes that lives disproportionately within European industry. Europe’s manufacturing sector holds potentially a century or more of accumulated knowledge and data: how materials behave, how processes fail, how a good part differs from a bad one, captured across generations of engineers and now sitting in solver archives, test logs, and process records.

A model is only as good as the data and the domain knowledge behind it, and those don’t transfer in a deal. They sit with the companies that have spent decades generating high-fidelity physical data — most of them industrial firms, many of them European, none of them frontier labs.

That is the moat. It is the one input a frontier lab cannot buy, scrape, or out-compute, and it is the thing that looks like a legacy liability in the software era right up until it becomes the training corpus for an entire category. Germany’s machine builders, the automotive supply chain, the molders and tool shops: each is a reservoir of exactly the data these models need, and the web does not contain. A simulation company with 35 years of its own solver output turning into a defensible AI asset is not a fluke. It is the shape of the whole opportunity.

This is also why the European Commission, in its Apply AI Strategy last October, named manufacturing a strategic sector and tied sectoral AI adoption to reducing Europe’s dependence on non-EU technology. [7] The advantage is not guaranteed — owning the data is not the same as building the models or the businesses on top of them, and that gap is where most of the value will be won or lost. But the raw material sits on the right side of the Atlantic, which is not something you can say about most of the AI race.

Why synthetic data isn’t enough

A common objection is that synthetic data dissolves the moat: if you can generate training data on demand, the proprietary corpora stop being scarce, and the advantage migrates back to whoever has the most compute.

However, this objection is weaker than it looks. Valuable synthetic data is not random data. It is data that captures the rare failure, the edge case, the point where the physics turns nonlinear, and a part that looked fine starts to warp during cooling. Knowing which scenarios are worth generating and whether a generated sample is physically trustworthy or quietly wrong is itself domain expertise. You cannot synthesize your way past not knowing what matters. Synthetic generation doesn’t remove the need for decades of accumulated know-how; it raises the price of admission to a layer where that know-how is even scarcer.

A model you can access in a browser is predicting the 3D physics of parts it never saw, in seconds, and a company that knows the cost of getting it wrong is putting it in front of customers — alongside, not instead of, the solver they already trust. The first models to read and write the world got the headlines. The ones learning to predict it may turn out to matter more to the people who build things, and Europe is holding more of the raw material than it has in any other part of this race.

The machines are starting to learn physics. The question worth asking is, who can you trust to teach them, and on whose data?

Notes

[2] Benedikt Alkin et al., “AB-UPT: Scaling Neural CFD Surrogates for High-Fidelity Automotive Aerodynamics Simulations via Anchored-Branched Universal Physics Transformers,” Transactions on Machine Learning Research, accepted October 2025 (arXiv:2502.09692). The published architecture targets automotive aerodynamics computational fluid dynamics; its application to injection molding is a separate, domain-specific implementation. Code released by Emmi AI on GitHub; paper on arXiv.

[3] Simcon GmbH, “SIMCON Unveils World’s First Large Engineering Model for Plastic Injection Moulding,” BusinessWire, March 18, 2026. The Cadmould AI Solver is described by Simcon as co-developed with Emmi AI on the model architecture; the training data, domain validation, and commercialization are Simcon’s per the company’s own product and scientific pages. CEO quote and product framing from the same release. BusinessWire.

[4] Speed range and “trained on over a million simulation trajectories” per Simcon’s product and technical pages; the 200–1,000× and “up to 1000×” figures are vendor-claimed and not independently reproduced. Trade-press coverage (Plastics Today, Plastics Technology, MoldMaking Technology, March 2026) repeats the “up to 1,000×” figure sourced to Simcon. Simcon.

[5] Research preview runs in-browser on a cloud GPU; Simcon states the demo geometries are not part of the training data. Live at simcon.ai. Simcon demo.

[6] Filling-stage scope, roadmap to packing/cooling/shrinkage-and-warpage, accuracy reported “within 2–5% of numerical methods,” and the explicit “explore with AI, validate with classical solver” workflow are all per Simcon’s public materials and CEO statements. Accuracy figures are vendor-claimed. Simcon scientific page.

[7] European Commission, “Apply AI Strategy,” COM(2025) 723, published 8 October 2025. The strategy names manufacturing among its strategic sectoral flagships (deploying “agentic” AI to optimise production lines, targeted Q4 2026) and frames sectoral AI adoption as part of strengthening European digital sovereignty and reducing dependence on non-EU technology providers. EUR-Lex.