Too Dangerous for You, Free for Everyone

America locked up its best models. Europe regulates a frontier it can’t build. China gives its best to the world and is winning.

On the morning of June 26, 2026, OpenAI released its most capable model and refused to let most people use it. GPT-5.6 Sol, the new flagship, went out as a limited preview to a short list of partners whose names OpenAI had shared with the US government, with general availability promised within weeks. In the same announcement, the company objected to the arrangement it was complying with, writing that it did not believe “this kind of government access process should become the long-term default.”[1]

That afternoon, the Commerce Department signed a letter restoring a competitor’s restricted model to the hands of more than 100 vetted American organizations: Anthropic’s Claude Mythos 5, which had been dark for two weeks after the same government forced it offline.[2]

Same day. Two labs. The frontier of artificial intelligence moved behind a government desk, and one of the firms that walked through the door used its launch to complain about the door.

None of this existed 80 days ago. It is now how the frontier ships.

Three Doors, and None of Them Opens Outward

For two years, the question about frontier models was which one is best. That question is now close to useless, because the three blocs that produce and govern these models have each turned access to the best of them into a matter of state policy, in three opposite directions.

The United States gates its most powerful models to government vetting. The European Union writes rules for a frontier it does not lead, aimed mostly at models built elsewhere. China does the opposite of both: it ships its best models as free downloads, and those models now account for the majority of the world’s open-model traffic.

The question is no longer which model is best. It is which government’s hand you can tolerate on the switch, and whether any of these doors is open in the way it appears to be.

The American case is the loudest. Anthropic spent the spring restricting Claude Mythos, an unreleased model it said could find decades-old security flaws on its own, to a short list of trusted partners.[3] On June 2, the White House signed an order asking developers to grant the government up to 30 days of access to “covered frontier models” before release.[4] Ten days later, a Commerce directive pulled two Anthropic models offline worldwide in roughly 90 minutes, including one commercial product serving hundreds of millions of users.[5] Two weeks after that, the same agency let the more dangerous of the two back in, for the vetted few. OpenAI’s GPT-5.6 followed the identical pattern on the identical day.

The European case is the quietest and, on paper, the most powerful. On August 2, 2026, five weeks from now, the EU’s AI Office gains the power to demand information from frontier developers, order changes, levy fines, and recall models from the market.[6] The largest models in scope are American.[7] Europe’s own frontier model, a publicly funded open-source effort, won the right to be built six days before this writing.[8] It does not exist yet.

The Chinese case is the one nobody is regulating, and everybody is using. At the end of 2024, Chinese open-weight models accounted for about 2 percent of the tokens flowing through the largest neutral model router. By the middle of 2026, they carried roughly 60 percent of them while that router quadrupled in size.[9]

The three doors look like a menu of safety, regulation, and freedom. They are nothing of the kind, and the door that looks free is the one quietly moving the switch.

The American Door: From Secure-and-Release to Ask-Permission

To see how far the United States has moved, start with the moment it set the opposite precedent.

In February 2019, OpenAI announced a language model called GPT-2 and declined to release it, citing the risk of fake news and impersonation. The decision split the field: some read it as responsible caution, others as a marketing performance that withheld a research artifact while implying it was a weapon. Nine months later, OpenAI released the full model and reported it had seen no strong evidence of misuse.[10] The harms had not arrived.

The industry took a lesson from the episode, and it was not “withhold.” It was the opposite: secure, then ship. Red-team the model, write a system card, publish a responsible-scaling policy, and release through an interface you control. For seven years, that habit held on a single assumption: that the lab decides when a model goes out.[11]

2026 broke the assumption, and not because the labs changed their minds. The state intervened in the decision.

The opening move was Anthropic’s. In April, it launched Project Glasswing around Claude Mythos, a model it kept out of public release and handed to roughly a dozen launch partners and a few dozen more organizations under usage credits. Anthropic backed the restriction with findings, not just adjectives: it said Mythos had autonomously surfaced vulnerabilities that had survived decades of human review, including a 27-year-old flaw in OpenBSD’s networking code and a 16-year-old one in one of the most widely used media libraries in the world.[12]

Those specific findings hold up. The patches exist. The advisories are public. But the framing around them deserves the scrutiny that the access restriction prevents. When independent researchers got hold of cheaper, openly available models, several of the showcase bugs fell to them too, one to a model costing a fraction of a cent per query.[13] A widely respected security commentator who is hard on AI hype judged the danger credible, and noted in the same breath that calling your model too dangerous to release is an excellent way to build buzz around it.[14] Both things are true at once. A safety claim and a capability advertisement are not mutually exclusive, and when the model is locked away, the advertisement cannot be checked.

You cannot benchmark what you cannot run.

The second move was the government’s. On June 2, the White House issued an order creating a voluntary path for developers to give the government up to 30 days of pre-release access to the most capable models, paired with a classified, NSA-led process to define which models qualify based on their cyber capabilities. The order is careful to bar any mandatory licensing scheme.[15] It is an invitation, not a law.

The third move showed what the invitation is worth when the government decides not to wait for it. On June 9, Anthropic launched Claude Fable 5, a commercial model it described as a Mythos-class system made safe for general use, with sensitive requests routed to a tamer model.[16] Three days later, at 5:21 p.m. Eastern, a Commerce export-control letter required a validated license before either model could reach any foreign national, including Anthropic’s own foreign-national staff. Unable to filter users by citizenship in real time, the company took Fable 5 and Mythos 5 down everywhere. A model serving hundreds of millions of people went dark in about 90 minutes, over a jailbreak Anthropic said was narrow and reproducible on other public models.[17]

Read those three moves in sequence. The decision about whether the public can use the best American model has migrated from the lab to Washington. OpenAI says the broad release of GPT-5.6 is only weeks away, and it may be; staging is not the same as exclusion. But the most capable tier, in the window that decides who gets the edge first, is gated by government vetting, and “weeks away” is a promise, not a shipped product. The public gets the safe-for-general-use version, or it waits. GPT-5.6 on June 26 was not a new direction. It was the second lab arriving at the same door.

OpenAI was candid that Sol had not crossed its own threshold for critical cyber risk. The model was gated not because the lab judged it too dangerous to ship, but because the government asked and the lab agreed, while the two worked out the access framework that the June 2 order set in motion. What governs release now is not the model’s capability. It is who gets to say yes.

This is not a tidy story of state capture. The June 2 order is voluntary and forbids licensing. OpenAI publicly protested the very vetting it submitted to. And Anthropic is suing the administration that gates its models, after the Defense Department tried to brand it a supply-chain risk for refusing to drop two narrow limits on its product: no mass domestic surveillance, no fully autonomous weapons.[18] The contradiction runs deep enough to be comic: the United States government simultaneously treats Anthropic as a national-security risk and as the only frontier model it has cleared for use up to the Secret level.[19] Read charitably, that is two arms of government disagreeing in good faith about a real tradeoff. Read at the level of what happened on the ground, with a model pulled, a company branded, and a competitor handed the contract, it looks less like a safety policy than a fight over who holds the switch.

There is one more piece, and it belongs to the man who built the model that got pulled. Two days before Commerce pulled it, Anthropic’s chief executive published an essay calling for binding rules on frontier AI modeled on the FAA and aircraft: testing, auditing, and a government power to block a release it judges unsafe.[20] The authority that hit him two days later was not that one. A pre-release safety review is not an export-control recall, but the through-line is the same, and it is the uncomfortable part.

The labs that built the frontier are now, in their different ways, asking the state to hold the switch they once held themselves. They may not like the hand that takes it.

And here is the loop that makes the American door self-defeating. Each turn of the gate raises the cost and the political risk of depending on a controlled American model. Every enterprise that feels that cost starts looking for an alternative, the United States cannot reach. There is one. It is open, cheap, and Chinese. And the action that pulled Mythos was, by the government’s own reported concern, about keeping that very model away from China, which means Washington’s defense against Chinese AI is quietly herding the market into China’s arms. The tighter Washington shuts its door, the more of the world’s usage walks out the back.

The European Door: A Customs House on a Road It Doesn’t Own

Europe’s posture is the strangest of the three, because it is built around a gap.

The EU AI Act sorts general-purpose models by the compute used to train them. Cross a threshold of ten-to-the-25th operations and a model is presumed to carry “systemic risk,” which brings obligations to test it adversarially, assess and reduce its dangers, report serious incidents, and secure it.[21] These rules have been on the books since August 2025. What arrives on August 2, 2026, is the enforcement: from that date, the AI Office can compel information, mandate changes, fine a provider up to 3 percent of global revenue, and order a model pulled from the European market.[22]

The trouble is what that threshold now catches. 10^25 operations was the size of GPT-4 in 2023; the frontier has since run more than an order of magnitude past it, and the largest training run on record sits some fifty times above the line.[23] Dozens of models from a dozen labs now clear it. So the tier that the EU polices is not just the frontier. It is a rung below the leaders, who are American. Europe does have a lab on the other side: Mistral signed the same code. But it trails the models the danger conversation is about, and the continent has no model at the frontier that the rules were written to govern. Its answer to that gap is a consortium, selected on June 19, that won the right to build an open-source frontier model in all 24 official languages on European supercomputers, running on Nvidia silicon.[24] The model is a plan. The regulator is operational.

The European door mostly governs models built in America, which run on infrastructure largely owned by Americans. It is a customs house on a road it does not own. Yet, the rules have teeth, the fines are large, and governing the compliant is not nothing. Europe’s deeper power is the market itself: the threat of exclusion from 450 million consumers has bent more than one American product to Brussels rules before. But a recall and a market ban are both switches on someone else’s model.

When the EU pulls a frontier model, it removes a product from its market that isn't made by a European company, and that will keep selling it everywhere else.

The bloc that talks most about digital sovereignty has arranged to hold the off-switch for everything except a model it controls.

The Chinese Door: Why “Open” Doesn’t Mean Unlocked

China runs the opposite play, and on the numbers, it is winning.

While the United States restricts and Europe regulates, Chinese labs ship. DeepSeek, Alibaba’s Qwen, Zhipu’s GLM, Moonshot’s Kimi: a steady cadence of frontier-adjacent models released as free downloads under permissive licenses. The usage curve is the whole argument.

Chinese open-weight models went from about 2 percent of the tokens on the largest neutral model router at the end of 2024 to roughly 60 percent by the middle of 2026.

That router measures where developers send cost-sensitive work, not a census of all AI use, and over the same stretch, it grew fourfold, with coding rising to more than half of all traffic.[25] A separate count agrees from a different angle: on the world’s main model hub, Chinese developers accounted for roughly 41 percent of downloads over the trailing year, overtaking the United States.[26] The silicon underneath is increasingly China’s own, too; the leading open labs now train and serve on Huawei’s Ascend chips rather than Nvidia’s, so the diffusion no longer runs on hardware Washington controls. China did not just take a share. It took the majority of a market that quadrupled.

This is where the obvious objection arises. An open-weight model on your own machines has no off-switch. Nobody can revoke a file you have already downloaded. If that is true, then China’s door is not a door at all. It is an open field, and the symmetry of this whole piece collapses.

It does not collapse, because open weights are not open access.

Consider the model at the top of the open leaderboard. Zhipu’s GLM-5.2 has 744 billion parameters: about 1.5 terabytes of weights at full precision, roughly half that at the compressed precision most deployments use, every byte of which must sit in graphics memory at once. The reassuring figure you will hear, that only 40 billion parameters are active at a time, is a statement about speed, not memory: the whole model still has to be resident to run. In practice, that means a multi-node cluster of high-end accelerators, not a workstation or a laptop.[27] That is why the usage the router measures is hosted usage: these models are reached through an endpoint, DeepSeek’s own or a Western reseller’s, not run on the premises of the firms using them.

The switch, then, does not disappear. It relocates. It moves to the hosted endpoint, which can be suspended, rate-limited, geo-blocked, or repriced. And it moves to the data, because every prompt and every output now travels to whoever runs the endpoint: a provider under Chinese law if you call DeepSeek directly, or a Western intermediary with its own logs if you route through one. Calling a Chinese model through Azure removes the question of Chinese jurisdiction over your data while preserving the cost advantage; calling it directly does not.[28] The only path that escapes the endpoint entirely is self-hosting, and self-hosting the frontier is gated by capital, which puts it within reach of roughly the same set of organizations that could afford to buy into an American-vetted tier.

The freedom is real at the license and illusory at the rack.

None of this shows up in the price comparison that pulls enterprises toward the Chinese door in the first place. The headline is real: the leading open models run at roughly a sixth of the per-token cost of the American frontier. But the rate card flatters the invoice. These models reason at length before they answer, spending tens of thousands of tokens on a single task, so the gap on the bill comes out narrower than the gap on the price list.[27] And the firm that tries to escape the endpoint by self-hosting trades the API bill for a six- to seven-figure cluster and a team to operate it. Most do the rational thing and stay on the hosted endpoint, which means staying on the switch. The cost advantage that makes the door attractive is the same force that keeps the buyer renting access instead of owning it. Cheap is the lure. The endpoint is the hook.

There is a second lock most analyses miss, and ordinary use does not pick it. The content controls are baked into the weights. Independent testing finds that Chinese open models, including DeepSeek and Qwen, refuse or steer away from Taiwan, Tiananmen, and Xinjiang, and that this steering persists in the weights even in locally run copies. Standard fine-tuning does not remove it. It can be stripped: the abliteration methods that tear the safety scaffolding out of open models also work here. But doing so takes deliberate effort, costs capability, and never fully succeeds, and the fact that you must operate on the weights at all to get a neutral answer is itself the tell. An open-weight model is not neutral. It ships with a foreign government’s preferences embedded in its parameters, and the zero price that makes it spread carries those preferences along.[29] That split is the whole posture. At home, China runs one of the tightest content systems in the world, every public-facing model registered and assessed by the state; abroad, it gives the models away.

Control where it governs, diffusion where it competes.

One last item belongs here, and it weighs against the American gate, not the Chinese door. On June 10, Anthropic told the Senate Banking Committee that operators tied to Alibaba and its Qwen lab had run roughly 25,000 fraudulent accounts and 28.8 million exchanges against Claude to copy its abilities by extraction rather than training.[30] Treat it as an interested party’s allegation, because it is one: it comes from the company with the most to gain from the gating system, filed the same week its chief executive called for government power to block model releases. But if it is true, it lands on the gate, not the open door. You cannot lock up a capability that walks out through your own interface, 28.8 million exchanges at a time.

The Same Switch, Installed Three Ways

Readers of this publication have seen this shape before. An earlier piece mapped a three-layer off-switch over any AI dependency (the chips, the cloud, and the model) and asked what happens when someone throws it on purpose rather than by accident.[31] What 2026 added was the installation of that switch at the national policy level across three countries at once, by three governments that agree on almost nothing.

The seven-year settlement that followed GPT-2 rested on one quiet premise: the lab decides when a model ships. All three blocs have now broken that premise from different directions. The United States moved the decision to Washington and made the best models a government-vetted tier. Europe claimed a veto, the recall, over models it did not build. China dissolved the decision at the license layer and reinstalled it twice, at the endpoint and inside the weights.

What the three share is not motive. The United States is keeping its frontier from China and fighting itself over who holds the gate, Europe is compensating for an industry it lacks, and China is doing what a challenger does when it cannot win the top tier outright: giving away the layer below it, whether by design or by the plain logic of competition, until the incumbent’s moat is a commodity. What they share is the result, and the result lands on the same person every time: the enterprise downstream of all three now depends on a switch it does not hold, and on a body of law it did not write.

What Would Have to Break

On the only number that compounds, usage, the open door is winning. “Too dangerous for you” is losing to “free for everyone” in the market by a wide and widening margin.

But winning hides the trap. The enterprise that routes to the Chinese stack to get out from under the American switch lands on the Chinese endpoint’s switch and under Chinese data law, carrying a model with Beijing’s editorial line inside it. It did not escape control. It swapped Washington’s switch for Beijing’s, and took on Chinese data law in the bargain. Most of the firms making the move have not priced that.

Three developments would break this read, and each is worth watching.

1. A frontier-parity model small enough to self-host cheaply (a step change in compression, or a model under 100 billion parameters that matches the leaders) would open a switch-free door for real, and the argument that there is no such door would fail.

2. A US public tier that ships at full capability, with no detuned version held back, would end the two-class frontier and turn the vetting into a formality.

3. A government-vetted model that visibly stops harm and openly available models that would go on to cause harm would be the first evidence that the gate does safety work rather than turf-holding.

None of the three has happened yet. Until one does, the pattern holds.

The lesson for anyone allocating capital or choosing a stack is not a recommendation for one door over another. It is that the doors were never the choice they appeared to be.

You are not picking the best model. You are picking which government’s hand rests on the switch, and whose law your prompts live under.

So price the switch as what it is: not an outage risk to be solved with a second region, but a control risk that earns its own line in the vendor register, with a tested path to a second model and the standing assumption that the vetted tier and the open tier each carry a different hand, not no hand.

The one door that looks like freedom only moved the switch to a place you were not watching, and the bill for not watching comes due the first time someone decides to throw it.

---

Notes

[1] OpenAI, “Previewing GPT-5.6 Sol: a next-generation model”, June 26, 2026. The GPT-5.6 series (Sol, the flagship, plus Terra and Luna) launched as a limited preview to a small group of partners whose participation OpenAI said it had shared with the US government, with general availability planned within weeks. OpenAI objected to government-gated access as a long-term default and tied the step to its work with the Administration on the cyber Executive Order framework. System card: GPT-5.6 Preview. OpenAI states the model does not cross its critical cyber-risk threshold under its Preparedness Framework; the gating reflects caution and government request rather than a declared red line.

[2] US Department of Commerce letter from Secretary Howard Lutnick to Anthropic chief compute officer Tom Brown, Friday June 26, 2026, lifting the export-control license requirement for Claude Mythos 5 for entities named in the letter’s Annex A and their foreign-national employees. Mythos 5 only; the letter is silent on Fable 5, which remained restricted, with talks reportedly moving toward its release on an unclear timeline. Lutnick wrote that “appropriate safeguards are in place to permit certain trusted partners” to access the model. Reported by Semafor (Reed Albergotti and Ben Smith), “US releases powerful Anthropic model Mythos to some US companies”, June 26, 2026. The move came the same day as OpenAI’s GPT-5.6 limited release.

[3] Anthropic, “Project Glasswing: Securing critical software for the AI era”, April 7, 2026 — Claude Mythos Preview restricted to 12 launch partners (AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, with Anthropic) plus roughly 40 additional critical-infrastructure organizations under $100M in usage credits; later expanded to about 150 more.

[4] The White House, Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, June 2, 2026 — Section 3 creates a voluntary framework for up to 30 days of pre-release government access to “covered frontier models,” designated through a classified, NSA-led benchmarking process; the order expressly bars any mandatory licensing, preclearance, or permitting requirement.

[5] See [17].

[6] European Commission, “Regulatory framework on AI”; AI Office enforcement powers (information requests, mandated mitigations, fines, model recalls) apply from 2 August 2026.

[7] The largest in-scope models by training compute are American (OpenAI, Google, Anthropic, xAI); see [23].

[8] European Commission, “Commission selects EUROPA consortium as the winner of the Frontier AI Grand Challenge”, 19 June 2026. The Domyn-led EUROPA consortium will build an open-source frontier model (400+ billion parameters, Mixture-of-Experts) in all 24 official EU languages, on EuroHPC supercomputers (up to 2.5% of capacity for one year) plus a reported 6,000-chip NVIDIA Blackwell cluster. The model does not yet exist.

[9] OpenRouter token-share data, corroborated by an OpenRouter–Andreessen Horowitz study of ~100 trillion tokens (relayed by South China Morning Post, December 8, 2025 — note SCMP is owned by Alibaba; cite the underlying study) and by Data Gravity, “China’s Open-Weight Takeover”, May–June 2026. Figures are hosted-API traffic on a developer-skewed router, not enterprise deployment.

[10] OpenAI, “GPT-2: 1.5B Release”, November 5, 2019 — full model released after a staged rollout, with no strong evidence of misuse reported.

[11] the-decoder, “From GPT-2 to Claude Mythos: the return of AI models deemed ‘too dangerous to release’” — on the industry’s shift to “secure-then-release.”

[12] Anthropic Frontier Red Team, “Assessing Claude Mythos Preview’s cybersecurity capabilities”, April 7, 2026 — autonomous discovery of zero-day vulnerabilities including a 27-year-old OpenBSD TCP SACK remote-code-execution flaw and a 16-year-old flaw in a widely used media library (FFmpeg, H.264), among thousands across major operating systems and browsers; a related 17-year-old FreeBSD NFS RCE was assigned CVE-2026-4747.

[13] AISLE (Stanislav Fort, founder), “AI Cybersecurity After Mythos: The Jagged Frontier”, April 7, 2026, with the full prompts and model responses published on GitHub. AISLE isolated the code behind Anthropic’s showcase vulnerabilities and ran it through small, cheap, open-weight models: eight of eight tested models detected the flagship FreeBSD bug, including a 3.6-billion-active-parameter model at $0.11 per million tokens, and a 5.1-billion-active open model recovered the core chain of the 27-year-old OpenBSD flaw. Corroborated by VentureBeat and CNBC, which note other firms (watchTowr, Vidoc) likewise reproduced Mythos results with public models. AISLE’s thesis: the moat is the system, not the model.

[14] Simon Willison, commentary on the Mythos restriction and on “too dangerous to release” as a buzz-building move, April 2026.

[15] See [4].

[16] Anthropic, “Claude Fable 5 and Claude Mythos 5”, June 9, 2026 — Fable 5 is the generally available Mythos-class model (a tier above the Opus class), carrying cybersecurity, biology, chemistry, and distillation safeguards that defer flagged queries to Claude Opus 4.8 (triggering in under 5% of sessions); Mythos 5 is the same model with those safeguards lifted, restricted to Project Glasswing partners. Both priced at $10/$50 per million tokens.

[17] On June 12, 2026 (5:21 p.m. ET), Commerce’s Bureau of Industry and Security issued an “Is Informed” letter to Anthropic under the Export Control Reform Act of 2018 (50 U.S.C. § 4817(b)(1)) and EAR § 744.22(b), requiring an individually validated export license before either model could reach any foreign national worldwide, including Anthropic’s own foreign-national staff (a “deemed export”). This is a license requirement under existing export-control authority, distinct from the June 2 executive order and not a finalized EAR rule. Unable to filter users by nationality in real time, Anthropic disabled Fable 5 and Mythos 5 globally and characterized the cited jailbreak as narrow and reproducible on other public models. Per Semafor’s reporting, the underlying US concern was that Mythos had reached partners seen as too closely linked to China (reportedly a South Korean telecom). As of publication, Fable 5 remained restricted. Reporting: Semafor (June 13 and June 26, 2026); The Conversation, “Why the US government shut down Anthropic’s latest Claude AI model”; Greenberg Traurig client alert, June 2026.

[18] Congressional Research Service, “Federal Government and Anthropic: Considerations for AI Innovation and Competition”; NPR, “OpenAI announces Pentagon deal after Trump bans Anthropic”, February 27, 2026. Dispute centered on Anthropic’s refusal to permit mass domestic surveillance and fully autonomous weapons use; DoD moved to designate Anthropic a supply-chain risk; a federal court blocked most of the designation as punitive.

[19] Center for American Progress, “The Trump Administration Is Trying To Make an Example of the AI Giant Anthropic”, March 4, 2026 — Claude described as the only frontier model cleared for US government use up to the Secret level.

[20] Dario Amodei, “Policy on the AI Exponential”, June 10, 2026 — proposing FAA-style mandatory third-party testing and auditing of frontier models, with government authority to block or reverse a release that fails safety standards. A pre-release certification proposal, distinct in kind from the June 12 export-control action.

[21] EU AI Act, Articles 51 and 55; presumption of systemic risk above 10^25 training FLOP; obligations include model evaluation, adversarial testing, systemic-risk mitigation, serious-incident reporting, and cybersecurity.

[22] European Commission, AI Act enforcement timeline; from 2 August 2026 the AI Office may issue information requests, require corrective measures, levy fines up to 3% of global turnover or €15M (whichever is higher), and ultimately restrict or withdraw a model from the EU market. “Recall” is used in the body as a plain-language gloss for that withdrawal/restriction power.

[23] The EU AI Act presumes systemic risk above ten-to-the-25th training FLOP, a level calibrated to GPT-4-class compute in 2023. By mid-2025, Epoch AI’s database identified 30+ models from roughly a dozen developers over that threshold — OpenAI, Google, Anthropic, Meta, xAI, and Mistral among them, alongside Chinese labs — with the count rising through 2026. The largest known training run, xAI’s Grok 4, is estimated at ~5×10^26 FLOP, roughly fifty times the line, and Epoch notes monitoring thresholds “may need to rise correspondingly over time” to stay focused on frontier capability. The systemic-risk tier is therefore a wide field below the capability frontier, not a roster of the most advanced models.

[24] See [8].

[25] See [9]. Router growth from roughly 5 trillion tokens per week (April 2025) to over 20 trillion (April 2026); coding rose from about 11% of usage to more than 50% over the period.

[26] Hugging Face, “State of Open Source on Hugging Face: Spring 2026”, March 17, 2026, reporting Chinese developers at roughly 41% of Hub downloads over the trailing year, overtaking US developers; grounded in the study “Economies of Open Intelligence” (851,000 models; 2.2 billion downloads). Disclosure: the author served as Chief Evangelist at Hugging Face through 2023; the Hub download figures are cited from Hugging Face’s own published report and corroborate, rather than originate, the OpenRouter traffic trend.

[27] GLM-5.2 specifications and self-hosting requirements: Z.ai model card; Simon Willison, “GLM-5.2”, June 17, 2026; Artificial Analysis. 744B total parameters (40B active, Mixture-of-Experts), ~1.5 TB of weights at BF16, all of which must reside in GPU memory; serving guides converge on multi-node accelerator clusters. Pricing runs roughly one-sixth of US frontier per token, but heavy reasoning-token usage (tens of thousands of tokens per task) narrows the real cost gap (Artificial Analysis). The capital constraint applies to frontier-parity open models; smaller self-hostable models (e.g., Qwen 3.5’s 0.8B–9B line) are not at the frontier.

[28] Data-jurisdiction handling for hosted Chinese models: calls to Chinese-operated endpoints route through Chinese-jurisdiction servers; Western intermediaries (e.g., Azure) eliminate that exposure while preserving cost. Independent provider documentation and analysis, 2026.

[29] Content controls in Chinese open models. Independent studies document that Chinese open-weight models (Qwen, DeepSeek, and MiniMax among them) are trained to refuse, deflect, or assert falsehoods on PRC-sensitive topics: Taiwan, Tibet, Xinjiang, the 1989 Tiananmen Square protests, and Falun Gong. Researchers describe this as “embedded local censorship” that sits in the base weights and persists even when the model is run locally. See, e.g., “Censored LLMs as a Natural Testbed for Secret Knowledge Elicitation” (March 2026), and “R1dacted: Investigating Local Censorship in DeepSeek’s R1”. Standard fine-tuning raises truthful-response rates only partially; weight-level intervention (abliteration / logit suppression, cf. arXiv:2505.23848) can reduce the bias at a cost in capability and never fully succeeds. The behavior tracks China’s requirement that public-facing generative-AI services be registered and security-assessed by the state (Interim Measures for the Management of Generative AI Services, effective August 2023, governing services with “public opinion attributes”). See also my earlier piece, “Open From Both Sides”, The AI Realist.

[30] Anthropic letter to US Senate Banking Committee Chairman Tim Scott and Ranking Member Elizabeth Warren, dated June 10, 2026, alleging the largest known distillation campaign on Claude — roughly 25,000 fraudulent accounts and 28.8 million exchanges between April 22 and June 5, attributed to operators affiliated with Alibaba and its Qwen AI lab, targeting agentic reasoning, software engineering, and long-horizon planning. First reported by Bloomberg (June 24); confirmed by CNBC and Reuters. Interested-party allegation; treat accordingly.

[31] “Access, Disable, Destroy”, The AI Realist — the three-layer coercion model over chips, cloud, and models.