In the United States, opposition to a policy that would collectively shut out Chinese-made open-weight AI has emerged from both Anthropic, which offers closed models, and GPU giant NVIDIA. An industry letter published on NVIDIA's site on July 24, signed by companies including OpenAI, Google, and Meta as well as open-source organizations, was followed on the 27th by Anthropic CEO Dario Amodei stating clearly that his company is not calling for a blanket ban.
What's surprising is not that the two arrived at the same safety argument. NVIDIA's side argues that open weights strengthen both competition and cyber defense, while Amodei counters that with models possessing dangerous capabilities, the offense could gain the advantage. Where they agree is on a single point: that a policy which uses a model's nationality or release method as a proxy for danger, and bans it outright, is too crude.
This difference changes what the US actually needs to manage. If the target is broken down from "Chinese-made open-weight" into dangerous capabilities, access to compute resources, and unauthorized capability extraction, it becomes possible to design security measures while preserving competition. However, as long as evaluation thresholds and legal mechanisms remain vague, there remains a risk of simply reproducing a blanket ban under a different name.
Two documents that rejected the blanket ban
The debate's starting point was not a formally decided ban. Axios reported on July 20 that in 2025 the US Department of Commerce considered a plan to add multiple Chinese AI labs to the Entity List, and that safety recommendations from government agencies, a draft executive order requiring hosting providers to guarantee safety and accountability, and a draft rule using authority to protect supply chains had all circulated within the administration. In each case, officials cautious about regulation blocked the move at the time, and both the White House and the Department of Commerce did not respond to Axios's inquiries.
This movement stands in tension with "America's AI Action Plan," which the White House published in July 2025. That plan assessed that open-source/open-weight models allow startups to avoid dependence on closed-model companies, and let businesses and governments operate without sending sensitive data outside their control. It also states that whether to release a model openly or not is the developer's decision, and that the federal government should build an environment that supports open models.
The open letter of July 24 is a document pushing back against this official policy from industry's side. The letter argues that open weights expand competition not only among model companies but across cloud providers, semiconductor makers, and applications and services. For NVIDIA too, a market in which models spread across various companies' clouds and their own on-premise infrastructure, generating compute demand for each use case, aligns with its own business. Given this interest, the letter functions not merely as a statement of principle but also, as a practical policy effect, as a check against the AI market consolidating around a small number of APIs.
Open weight, not open source
The reporting and policy documents in question conflate "open source" and "open weight," but if regulatory targets are to be decided, the two must be distinguished. Open weight refers to a state in which trained parameters can be obtained and run or fine-tuned on one's own compute infrastructure. It does not necessarily mean that details of the training data, or code that reproduces the process from data handling through training, are made public.
The Open Source Initiative's "Open Source AI Definition 1.0" requires, in addition to freedom to use, study, modify, and share, information about training data as well as training and inference code, and model parameters. Simply being able to download the weights does not satisfy what this definition calls open source AI. If a policy that is actually targeting the release of weights is called an "open source ban," the scope it sweeps in—from research code and inference infrastructure to model licenses—becomes illegible.
Releasing weights carries an irreversibility that closed APIs do not. Once distributed, copies cannot be recalled; even if the developer updates its monitoring classifiers or suspends users, this does not reach copies already running locally. Even a model trained to refuse certain requests can be readily re-tuned once its weights are accessible. At the same time, users can avoid sending sensitive data externally, can audit the model, adapt it to specific uses, and distance themselves from pricing changes or shutdowns imposed at the provider's discretion. The same technical property produces both benefit and danger.
A safety debate split by a 4-to-7-month gap
The clash between NVIDIA's side and Anthropic comes into sharpest focus in the cyber domain. The open letter argues that if attackers use advanced AI, defenders need models of comparable capability as well. Because a broad base of researchers can examine the model, find vulnerabilities, and fix them, openness, in this view, raises safety.
Amodei does not assume this offense-defense symmetry. While defenders may sometimes benefit in the cyber domain, he holds that in the biological domain, providing the knowledge needed for an attack happens quickly, while developing and deploying countermeasures takes, at best, years. For this reason, he argues that safety should not be determined by release method, but that sufficiently high-capability models should be tested before release, with judgments made according to measured risk.
An evaluation by the UK's AI Security Institute gives this dispute a timeline. In June 2026, the open-weight model GLM-5.2 performed on par with closed models released four months earlier on limited-duration cyber challenges, and seven months earlier on extended attack exercises. The gap of 6 to 10 months seen in 2025 has narrowed to 4 to 7 months. The preparation window left for defenders—before attack capabilities present in today's closed models migrate into open weights, where monitoring and access suspension are difficult to apply—is shrinking.
Cost differences also cannot be ignored. In the same institute's exercises at a scale of 100 million tokens, Opus 4.5 and 4.6 cost about $85, GLM-5.2 about $46, and DeepSeek V4-Pro $1.19. This is limited to a specific cyber evaluation and pricing available at the time, and cannot be generalized to biological risk or general capability. Even so, it is clear that policy needs to track the speed at which high capability spreads cheaply and in forms resistant to shutdown.
What to regulate instead of banning
The alternative Anthropic has proposed breaks down into three parts. The first is curbing exports, smuggling, and circumvention of high-performance chips and manufacturing equipment to China. The second is stopping industrial-scale unauthorized distillation, in which massive numbers of responses are extracted from closed models to train competing models. The third is imposing mandatory safety evaluations on sufficiently high-capability models, regardless of whether they are open or closed.
This breakdown also clarifies the differences among policy tools. The US Department of Commerce's Entity List is a mechanism that, when a listed party is involved in a transaction, requires a license from the party exporting, re-exporting, or transferring domestically the designated items subject to US Export Administration Regulations. It is not necessarily a mechanism that outright bans, by itself, the act of a US company downloading and using a Chinese company's model. If the aim is to broadly halt transactions between US persons and a designated party, using OFAC sanctions such as SDN designation via the Treasury Department would work more directly. Rules excluding a party from government procurement, or conditions on cloud hosting, have yet different effects.
Therefore, the single word "ban" does not settle who is being stopped from doing what. Is it halting the supply of compute resources to a model development company? Halting adoption by US companies? Restricting it to government use only? Halting distribution of the weights? Each requires different grounds and carries different side effects. The 2025 AI Action Plan called for evaluating Chinese-made models and investing in evaluation technology, but it did not establish the kind of mandatory pre-release evaluation for all high-capability models that Amodei is calling for.
The same kind of separation is needed for anti-distillation measures as well. In February, Anthropic announced large-scale access by three AI labs. It named DeepSeek, Moonshot, and MiniMax, explaining that roughly 24,000 fraudulent accounts had exchanged over 16 million interactions with Claude. This is a finding based on the company's own usage records, and provides material for considering how to address unauthorized acquisition. However, distillation is also a common training technique used to shrink one's own models. If illegality, contract violation, and access spoofing are lumped together with the technique itself, legitimate research and competition get halted as well.
The 2.8-trillion-parameter Kimi K3 that forced the issue
Moonshot AI's Kimi K3, which reignited the debate, is according to the company's own materials a Mixture-of-Experts model with 2.8 trillion total parameters, activating 104 billion parameters per inference and handling a context of 1 million tokens. Its weights are open, and it can be run on one's own infrastructure or through compatible inference services. Because the benchmark figures include Moonshot's own measurements, they need to be distinguished from independent evaluation, but it can be confirmed that the scale and use of open weights has itself approached the frontier.
The US government has claimed that Anthropic's Fable 5 was distilled in the development of Kimi K3, but has not disclosed evidence for this. Researchers interviewed by TechCrunch raised doubts about the Kimi K3-specific claim, pointing out that the time between Fable 5's release and Kimi K3 is too short, and that the closer a model gets to the frontier, the harder it becomes to transfer capability from a teacher model's responses alone. The large-scale access Anthropic confirmed in the past and the training pathway of Kimi K3 are separate propositions.
In 2024, the US government, in an NTIA report, judged that there was insufficient evidence to immediately restrict open weights, and chose instead to monitor capability gaps and marginal risk in preparation for future measures. Since then, the cyber capability gap has narrowed to 4 to 7 months, and enormous Chinese-made models have been released as open weight. The conditions for turning monitoring into policy are drawing closer.
However, that condition is neither nationality nor the label "open." What capability, exceeding what threshold, in pre-release evaluation should change distribution conditions; what evidence should be used to establish unauthorized distillation; and which of the Entity List, OFAC sanctions, or procurement rules should be applied to whom. Whether the US administration can turn these three points into something concrete will determine whether the result is capability-based regulation that avoided a blanket ban, or market exclusion under a different name.