Chinese AI companies have made inroads globally by giving their models away for free. Now Beijing is weighing whether to stop them. Chinese authorities have held talks with Alibaba, ByteDance, and Z.ai about whether to restrict foreign access to their most advanced models, including ones not yet released, Reuters reported today, citing three people familiar with the discussions.

Nothing has been decided yet, and the ministries involved have made no official comment, but officials have gone as far as sketching options—including a bar on public release or a limit to domestic use only.

That would be a dramatic U-turn. Most Chinese AI companies currently release their models "open-weight"—publishing the weights online so anyone can download the system and run it themselves. That openness is precisely how they have made inroads globally despite lagging America's best models by seven months on average. The models are free, and some U.S. businesses have adopted them to cut costs compared with proprietary American models.

Closing access would mean surrendering the very lever that has driven China's rise. A trailing player doesn't abandon its biggest advantage unless the concern is national security. In that sense, Beijing would be following Washington, which has already restricted Anthropic's Mythos and OpenAI's GPT-5.6 over concerns about the models' ability to find software vulnerabilities.

China will need to reckon with the reality that models that reach certain capabilities are unsafe. It is going to have the same conversations the White House has had over the last many months. China is going to have to balance the benefits of access to global markets with a desire to control a technology that is central for national security. — Scott Singer, a fellow in the technology and international affairs program at the Carnegie Endowment for International Peace.

Late last month, Z.ai released GLM 5.2, which it claimed had matched Mythos' ability to spot bugs. Once a model’s weights are published online, they are impossible to recall or add safeguards, which presents additional security challenges compared with proprietary models. It also means any forthcoming restrictions would only impact future models.

It follows an escalating tit-for-tat between the two countries. Chinese tech giant Alibaba banned Claude Code internally and asked employees to remove Claude from their work computers, the Information reported Friday. Days earlier, a developer had discovered that Anthropic quietly slipped code into Claude Code that tried to work out whether the person using it was in China or connected to a Chinese AI lab, reading signals like their time zone and network address. An Anthropic engineer, responding on X, said the code was added in March to fight a copying technique called "distillation," that stronger safeguards were now in place, and that it would be removed the next day.

“Distillation,” or using the outputs of a smarter AI model to improve the performance of a weaker one, has become a point of controversy in the AI race. Chinese AI models trail America’s best by roughly seven months on key benchmarks. To catch up, Anthropic and others say Chinese labs are distilling their models—a violation of their terms. Anthropic published a report in February claiming other Chinese firms DeepSeek, Moonshot, and MiniMax generated 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. In June, Anthropic reportedly sent a letter to U.S. officials accusing Alibaba of “brazenly” attempting to distill Claude’s capabilities. The hidden code that rattled Alibaba was built to help catch exactly this.

Anthropic frames distillation as a national-security threat, warning that foreign labs could funnel stripped-down capabilities into military and surveillance systems and let authoritarian governments "deploy frontier AI for offensive cyber operations, disinformation campaigns, and mass surveillance." There's a commercial angle too. If Chinese labs siphon American capabilities and release them open-source, they erode the very business model those labs are banking on.

Anthropic has argued since February that no single firm can solve this—hence its lobbying for a coordinated front of industry, cloud providers, and government. With Washington already deciding who may use Claude Mythos and OpenAI’s GPT-5.6, that front no longer looks far-fetched.