China may restrict access to its most powerful AI models; signals tightening domestic AI governance.

Chinese authorities have held talks with Alibaba, ByteDance, and Z.ai about restricting foreign access to their most advanced artificial intelligence models, including ones not yet released, Reuters reported. While nothing has been decided and the ministries involved have made no official comment, officials have sketched options ranging from barring public release to limiting use to domestic markets only.

This would represent a dramatic reversal in strategy. Most Chinese AI companies currently release their models "open-weight"—publishing the underlying code weights online so anyone can download and run the system independently. This openness has been central to their global expansion despite lagging America's best models by approximately seven months on average. The free availability has attracted some U.S. businesses seeking to cut costs compared with proprietary American alternatives.

Restricting access would mean surrendering the primary advantage that has driven China's AI rise. A trailing player typically only abandons its biggest leverage if national security concerns take precedence. In this sense, Beijing would be following Washington, which has already restricted Anthropic's Mythos and OpenAI's GPT-5.6 over concerns about the models' ability to identify software vulnerabilities.

"China will need to reckon with the reality that models that reach certain capabilities are unsafe. It is going to have the same conversations the White House has had over the last many months," says Scott Singer, a fellow in the technology and international affairs program at the Carnegie Endowment for International Peace. "China is going to have to balance the benefits of access to global markets with a desire to control a technology that is central for national security."

This escalation reflects intensifying tech tensions between the two countries. Alibaba banned Claude Code internally and asked employees to remove Claude from their work computers, according to reporting from the Information. The action followed discovery that Anthropic had quietly inserted code into Claude Code to determine whether users were located in China or connected to Chinese AI labs by monitoring signals such as time zone and network address. An Anthropic engineer acknowledged on X that the code was added in March to combat a technique called "distillation," stated that stronger safeguards were now in place, and committed to removal the following day.

Distillation—using the outputs of a more advanced AI model to improve a weaker one's performance—has become a flashpoint in the U.S.-China AI competition. Chinese models trail America's best by roughly seven months on key benchmarks. To narrow this gap, Anthropic and others say Chinese labs are distilling their models, a practice that violates terms of service. Anthropic published a February report claiming that Chinese firms DeepSeek, Moonshot, and MiniMax generated 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. In June, Anthropic reportedly sent a letter to U.S. officials accusing Alibaba of "brazenly" attempting to distill Claude's capabilities.

Z.ai released GLM 5.2 last month, claiming it had achieved parity with Mythos' bug-detection capabilities. Once model weights are published online, they cannot be recalled or retrofitted with safeguards, presenting security challenges distinct from proprietary systems. This also means any future restrictions would apply only to models released afterward.

Anthropic frames distillation as a national-security threat, warning that foreign laboratories could channel stripped-down capabilities into military and surveillance systems, enabling authoritarian governments to "deploy frontier AI for offensive cyber operations, disinformation campaigns, and mass surveillance." A commercial dimension exists as well: if Chinese labs extract American capabilities and release them open-source, they undermine the business models those American companies depend on.

Anthropic has maintained since February that no single firm can address this challenge alone, lobbying for a coordinated response involving industry, cloud providers, and government. With Washington already determining access to Claude Mythos and GPT-5.6, such coordination appears increasingly plausible.