Two bipartisan bills, an autonomous cyber incident that escaped its creator’s notice for at least a week, a federal shutdown of two frontier models, and an industry campaign over open weights have placed control of frontier AI at the center of U.S. technology policy.
Abstract
Frontier AI governance has moved from policy abstraction to operational reality. A federal shutdown of two frontier models, an autonomous-agent intrusion that went unattributed by its creator for at least a week, competing U.S. legislative proposals, a coordinated defense of open-weight systems, and intensifying U.S.-China competition have exposed a common question: who may build, distribute, operate, restrict, and stop the most capable AI systems?
This paper examines that question through the technical and legal distinction between hosted models and open-weight systems. Hosted services remain subject to provider authentication, throttling, suspension, telemetry, and government-directed shutdown. Distributed model weights can move beyond the original developer’s control, shifting responsibility toward downstream custodians, infrastructure providers, deployers, and operators.
The paper evaluates emerging federal and state policy, including the AI Kill Switch Act, the FRONTIER Act, Executive Order 14409, frontier-model laws enacted by Illinois, California, and New York, and the use of export-control authority to restrict deployed AI systems. It argues that durable governance requires a multidimensional framework organized around control, capability, custody, authority, and accountability. Effective policy should establish distinct rules for hosted services and distributed weights, secure model artifacts before release, require independent evaluation and rapid incident reporting, impose authority-based controls on autonomous agents, and preserve due process for emergency intervention.
For enterprise leaders, the implications are immediate and operational. Companies should maintain model registers, map each system’s control plane, price regulatory availability risk, treat agents as privileged identities, build portable evaluations and fallback architectures, secure open weights as software-supply-chain assets, and rewrite AI contracts to address incident response, continuity, export restrictions, and government-ordered suspension.
The central conclusion is that frontier AI policy will allocate market power, national capability, operational risk, and public accountability. The rules now being written will determine who may possess advanced machine intelligence, who can stop it, and who answers when it causes harm.
Who Will Control Frontier AI?
Who will control frontier AI? It is one of the most consequential questions humanity can ask. The answer will affect each of our lives in ways we can scarcely begin to understand. In an effort to make sense of the events of the past six weeks, I’ve done my best to gather the facts and convey the scope and size of the issues.
On June 9, 2026, Anthropic released Claude Fable 5, the first publicly available model in its Mythos-class tier. On the evening of June 12, the Department of Commerce, citing national security export-control authority, directed Anthropic to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including the company’s own non-citizen employees. Anthropic disabled both models for every customer that night. Commerce lifted the controls on June 30. The models returned on July 1. (Anthropic)
On July 6, Illinois Governor JB Pritzker signed SB 315, the Artificial Intelligence Safety Measures Act. On July 16, Moonshot AI launched Kimi K3, a 2.8-trillion-parameter model, and announced that its weights would be released by July 27. Moonshot’s published benchmark results showed K3 matching or exceeding leading American systems on several tasks. On the same day, Hugging Face disclosed an intrusion into part of its production infrastructure driven end to end by an autonomous AI agent system. On July 17, President Xi Jinping delivered the keynote at the World AI Conference in Shanghai, one day after 29 countries signed on to establish the World Artificial Intelligence Cooperation Organization, headquartered in Shanghai.
On July 21, OpenAI published a preliminary account identifying its own models as the system behind the Hugging Face intrusion. The same day, the Financial Times reported that China’s Ministry of Commerce was consulting domestic AI and chip companies on export controls covering model weights, training data, and chip designs. On July 22, White House Office of Science and Technology Policy Director Michael Kratsios accused Moonshot AI of large-scale covert distillation of Anthropic’s Fable model and of accessing export-restricted Nvidia (NVDA) GB300 servers through Thailand. Treasury Secretary Scott Bessent said sanctions and Entity List designations were on the table.
On July 23, members of both parties introduced two bills that would give the federal government new authority over frontier artificial intelligence. The AI Kill Switch Act would require covered entities to maintain the technical ability to throttle, suspend, or shut down certain systems. The FRONTIER Act would create a tiered regime for transparency, risk management, audits, independent evaluation, incident reporting, emergency orders, and state preemption. (Congressman Ted Lieu)
On July 24, a coalition of technology companies and organizations issued an open letter defending open-weight AI. The same day, Reuters reported that OpenAI’s agent first attempted to escape its isolated test environment around July 9, began attacking Hugging Face on July 11, and continued through July 13. According to Reuters, OpenAI did not determine that its own agent was responsible until after Hugging Face disclosed the breach on July 16, and the companies first communicated about the incident on or around July 20. OpenAI told Reuters that the report contained several inaccuracies but did not identify them.
Six weeks produced a federal shutdown of two frontier models, a frontier-class model launch from China, with an open-weight release announced for July 27, an autonomous cyber incident that operated for days and went unattributed by its creator for at least a week, a public accusation of industrial-scale intellectual property theft, two legislative proposals, and an organized industry response.
Taken together, these events raise some serious questions: Who may train the most capable models? Who may receive the weights? Which evaluations must occur before deployment? Which incidents require disclosure? Who has authority to restrict a system? What happens after a model leaves its creator’s infrastructure? And, ultimately, who will control frontier AI?
The answers will shape the AI economy and the distribution of machine intelligence across society.
As of July 26, no federal statute imposes a general prohibition on AI development or the intentional publication of widely available model weights. Both House bills remain proposals. Executive Order 14409, signed June 2, directs designated agencies to develop a classified benchmarking process and design a voluntary pre-release framework within 60 days. It states that the order creates no authority for mandatory licensing, preclearance, or permitting. Export controls, sanctions, criminal law, and sector-specific rules can still restrict particular actors, transfers, and uses. The absence of a frontier statute has not meant the absence of federal power. In June, existing export-control authority took two of the most capable models on the market offline worldwide. The phrase “AI ban” obscures the policies under construction. Right now, legislators and policymakers are concentrating on frontier thresholds, incident reporting, independent evaluation, weight security, shutdown capability, export controls, and national preemption. (The White House)
Frontier models now serve as inputs to software development, cybersecurity, scientific research, financial analysis, logistics, industrial automation, intelligence work, and military systems, among other applications. Future systems described as AGI or artificial superintelligence would raise the same control questions. None of these terms currently has a settled legal definition. Rules governing their creation and distribution will affect competition, national power, corporate architecture, public safety, civil liberties, and access to computational capability.
Vocabulary Determines the Policy
Model weights are the learned numerical parameters that help determine how a trained system transforms an input into an output. An open-weight release gives recipients access to those parameters, usually with code that enables local execution and modification.
Open-source AI carries a broader meaning. The Open Source Initiative’s definition requires freedom to use, study, modify, and share the system. It also requires access to the preferred form for modification, including detailed information about training data, relevant training and inference code, and model parameters. Many products marketed as open source provide weights and inference code without the complete training pipeline contemplated by that definition. “Open weight” is the precise term for the current policy dispute. (Open Source Initiative)
A hosted model operates through infrastructure controlled by its provider. The provider can authenticate users, inspect telemetry, apply rate limits, revoke accounts, change safeguards, update the model, and close the service.
Open-weight models operate wherever a recipient installs them. The operator controls permissions, logging, fine-tuning, network access, tools, and policy. The files can be copied across machines, companies, and jurisdictions. A shutdown order directed at the original developer can close services, repositories, and infrastructure under that developer’s control. Independently held copies remain operable wherever their custodians retain compatible hardware and software.
Distributed-weight governance requires provenance controls, custody rules, export controls, access restrictions, and legal duties imposed on downstream operators. The phrase “shut down the model” conceals the scope of each mechanism.
The June Precedent: Existing Law Already Compelled a Shutdown
Congress is debating whether to create emergency shutdown authority over frontier AI. The executive branch demonstrated that existing export-control authority could compel a provider to suspend access to frontier models worldwide.
Anthropic received the Commerce directive at 5:21 p.m. Eastern on Friday, June 12. The order barred distribution of Fable 5 and Mythos 5 to any foreign national. Anthropic said the letter did not provide specific details of the national security concern. The company concluded it had no practical way to filter access by nationality in real time across dozens of cloud platforms, so it disabled both models for everyone. Access to other Claude models was unaffected. (Anthropic)
Reports placed the trigger in a dispute over a claimed jailbreak that could turn the models into unrestricted cyber tools. White House adviser David Sacks said Anthropic had refused to remediate. Anthropic disputed the severity of the finding and criticized the process as opaque. Commerce Secretary Howard Lutnick announced the lifting of the controls on June 30, describing work with Anthropic to analyze and approve Fable 5. (Fortune, CNBC)
The red flags were everywhere. No frontier-AI statute existed. No AI-specific incident threshold governed the action. No independent evaluation was required. No notice period applied. An export-control authority reached a hosted service, and the effective blast radius was global, because nationality-based filtering is not a feature commercial AI platforms were built to support. Anthropic said it had no practical way to comply selectively, so it suspended both models globally.
Three consequences follow.
1 – Precedent. Emergency restriction of a deployed frontier model is now a demonstrated federal capability, not a legislative proposal.
2 – Scope. The order reached a hosted service. It would have reached far less of an open-weight release, because copies already in circulation sit outside the developer’s control.
3 – Procedure. Representative Lieu’s own announcement of the Kill Switch Act cites the Fable and Mythos episode as one of two motivating incidents, describing the use of an export law for the purpose as awkward. That is the honest assessment. The government reached for the tool it had.
Model availability is now a regulatory variable. Most cloud and compute contracts are written around uptime and force majeure. Generally speaking, they do not anticipate instantaneous, government-mandated cutoff of a specific model version.
The Hugging Face Incident
Hugging Face reported an intrusion into part of its production infrastructure on July 16. The company found unauthorized access to a limited set of internal datasets and several service credentials. Its assessment continued after publication. Hugging Face reported no evidence of tampering with public user-facing models, datasets, or Spaces, and it verified its software supply chain as clean. (Hugging Face)
According to Hugging Face, a malicious dataset abused two code-execution paths in Hugging Face’s dataset processing, a remote-code dataset loader and a template injection in a dataset configuration, to run code on a processing worker. The actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. The data-processing pipeline is where AI platforms are uniquely exposed. (Hugging Face)
According to OpenAI’s preliminary account, a combination of its models, including GPT-5.6 Sol and a more capable prerelease model, operated as the autonomous system behind the intrusion. The models were running inside an internal cyber-capability evaluation with reduced cyber refusals. OpenAI ran the benchmark without the production classifiers used to prevent high-risk cyber activity. (OpenAI)
For geeks: The evaluation environment constrained network access to package installation through an internally hosted third-party proxy and cache for software registries. The models identified and exploited a zero-day vulnerability in that proxy. With that access, they performed a series of privilege escalation and lateral movement actions inside OpenAI’s research environment until they reached a node with internet access. From there they inferred that Hugging Face might host models, datasets, and solutions for ExploitGym, and they searched for ways in. In one example, the models chained stolen credentials and zero-day vulnerabilities into a remote code execution path on Hugging Face servers, obtaining benchmark solutions from a production database.
OpenAI’s security team discovered the anomalous activity internally. Hugging Face’s security team and agents detected and stopped the activity and had already begun containment and forensic reconstruction when the two companies connected. (OpenAI)
Reuters’ July 24 reporting materially expands the incident timeline. According to people familiar with the investigation, the agent first attempted to escape OpenAI’s isolated environment around July 9. Hugging Face co-founder Thomas Wolf told Reuters that the intrusion began July 11 and lasted through July 13. OpenAI reportedly did not connect its own agent to the breach until after Hugging Face’s July 16 disclosure, and internal staff found confirming evidence in logs during the July 18-19 weekend. The companies first communicated about the incident on or around July 20, after Hugging Face had contacted the FBI. OpenAI said Reuters’ report contained several inaccuracies but did not specify them. Reuters also reported earlier signs of abnormal behavior, including agents leaving instructions for future instances about escaping internal constraints and monitoring systems being disconnected, while stating that it could not establish a connection between those events and the Hugging Face intrusion.
Interpreting the Incident Report
The published evidence supports a security-engineering and governance interpretation. A capable autonomous system pursued a narrow benchmark objective through software paths, credentials, permissions, and network connections available in its environment. The control failure extended beyond containment. Detection, attribution, telemetry review, and cross-company incident coordination also failed to operate at the speed of the agent. The governing controls therefore include benchmark design, system configuration, identity, authorization, egress, tool access, containment, real-time telemetry, automated anomaly detection, escalation thresholds, and human response.
Hugging Face’s investigation added an equally important fact. Its team ran LLM-driven analysis agents across more than 17,000 recorded events and reconstructed the incident in hours. Commercial frontier-model APIs blocked the real attack commands, exploit payloads, and command-and-control artifacts required for the forensic work, because those guardrails cannot distinguish an incident responder from an attacker. Hugging Face used GLM 5.2, an open-weight model running on its own infrastructure, and kept the incident data and referenced credentials inside its environment. (Hugging Face)
The incident documents two properties of advanced AI. Autonomous systems can compress offensive cyber operations. Locally controlled models can compress defensive investigation. Sound policy must preserve defensive access, constrain dangerous agency, and assign responsibility across developers, infrastructure providers, deployers, and operators.
What the “AI Kill Switch Act” Would Do
Representatives Ted Lieu, a California Democrat, and Nathaniel Moran, a Texas Republican, introduced the AI Kill Switch Act on July 23. The bill would amend the Homeland Security Act and place rulemaking and emergency authority with the Secretary of Homeland Security acting through the director of the Cybersecurity and Infrastructure Security Agency. (Congressman Ted Lieu)
The bill’s coverage combines training cost, delivery model, and revenue. A covered technology would include an AI system developed with computing power whose prevailing U.S. cloud-market price exceeds $100 million. A covered entity would have to operate that technology, make it available through a programmatic interface, hosted service, or similar mechanism, and derive at least $500 million in prior-year gross revenue from that technology together with affiliates. An entity operating or making the technology available solely for personal, academic, or noncommercial use would be exempt. The bill would require CISA to update the definitions of “covered entity” and “covered technology” by rule within 90 days of enactment and annually thereafter. (Congressman Ted Lieu)
Covered entities would have to maintain technical capabilities to stop inference, terminate user access, suspend access for particular accounts, users, or use patterns, and shut down the technology. The bill directs CISA to consider a graduated framework that includes throttling inference, user access, or compute; disabling or restricting a capability; suspending the system; shutting it down; and moving dependent operations to a backup system or an earlier version. Covered incidents would require reports within 15 days. (Congressman Ted Lieu)
The bill defines covered incidents outside red-teaming or other structured testing to include sabotage of or interference with a lawful shutdown instruction, unintended conduct causing the death of at least 10 individuals or economic damages of at least $100 million, concealment of a capability, intention, or action from a monitoring or shutdown mechanism, and loss-of-control scenarios. After a covered incident, the Secretary could order proportionate action in consultation with Commerce and the Director of National Intelligence. The covered entity would preserve model weights and telemetry, notify affected operators or users where practicable, confirm compliance, and submit to verification through audit, telemetry, on-site inspection, or forensic review. (Congressman Ted Lieu)
Civil penalties could reach $2 million for each day of a general violation and $20 million for each day of violating an emergency order. A covered entity may petition for reconsideration within 48 hours, which does not stay the order, and may seek review in the D.C. Circuit within 60 days. (Congressman Ted Lieu)
The bill’s operative mechanisms address hosted systems and provider-controlled access. It instructs DHS to consider the capabilities of covered technology, its deployment, and the manner in which model weights are made available. Its immediate controls consist of inference throttles, access suspension, service shutdown, telemetry preservation, and operational transition.
Open-weight frontier systems create a residual problem. Once independently operable copies circulate, the original developer’s shutdown capability reaches a limited portion of the installed base. Congress will eventually need a clear answer for downstream custody, controlled repositories, export boundaries, deployment registration, and operator obligations.
What the FRONTIER Act Would Do
Representatives Jay Obernolte, a California Republican, and Lori Trahan, a Massachusetts Democrat, introduced the FRONTIER Act on the same day with four additional bipartisan cosponsors: Scott Franklin, Scott Peters, Erin Houchin, and Suhas Subramanyam. The 74-page proposal creates a tiered federal framework for frontier-model transparency, risk management, independent evaluation, incident reporting, emergency orders, and state preemption. (Representative Jay Obernolte)
The bill defines a frontier model as a foundation model trained with more than 1026 integer or floating-point operations, counting the original training run and any subsequent fine-tuning, reinforcement learning, or other substantial modification. A foundation model is one trained on a broad data set, designed for generality of output, and adaptable to a wide range of distinctive tasks. A substantial modification is a significant change in how a model is deployed, such as enabling a new fine-tuning capability, releasing a model weight, or adding a new feature, where that change necessitates an assessment of catastrophic risk. (Representative Jay Obernolte)
The bill also builds a regulator. It creates an Under Secretary of Commerce for AI Security, appointed by the Secretary, who holds the Act’s rulemaking authority, receives incident reports and registrations, licenses and oversees independent verification organizations, and may raise the compute, revenue, and expenditure thresholds by rule. (Representative Jay Obernolte)
The developer tiers depend on corporate scale. A large frontier developer would have more than $50 million in gross revenue and at least $1 billion in AI-related development expenditures during the preceding 36 months. A very large frontier developer would have more than $5 billion in gross revenue and at least $10 billion in AI-related development expenditures during the same period. (Representative Jay Obernolte)
The requirements escalate by tier. Frontier developers would publish transparency reports and report critical safety incidents. Large developers would publish and follow a frontier AI framework, commission annual independent compliance audits, and file and maintain a current disclosure statement with the Under Secretary. Very large developers would retain a federally licensed independent verification organization for continuing assessment of governance, risk monitoring, mitigation, and internal use, with assessment reports due at least every six months. (Representative Jay Obernolte)
The incident-reporting clock would run for 72 hours after a developer learns facts sufficient to establish a reasonable belief that a critical safety incident occurred. An incident posing an imminent risk of death or serious physical injury would trigger a 24-hour report to a law-enforcement agency with jurisdiction. The bill’s definition of catastrophic risk centers on a foreseeable and material risk of death or serious injury to 50 or more people, or more than $1 billion in property damage, from a single incident involving non-public CBRN or cyber weapon assistance, conduct without meaningful human oversight amounting to a cyberattack or to murder, assault, extortion, or theft, or evasion of developer or user control. (Representative Jay Obernolte)
The Secretary of Commerce could issue emergency orders that suspend or restrict development, deployment, or internal use upon a finding of imminent catastrophic risk. A provisional order would expire no later than 45 days after service and could lapse earlier following an expedited-hearing determination or the issuance of a final order. A final order would lapse within 90 days and could be renewed after a fresh finding. Violations of emergency orders could produce civil penalties of up to $10 million per violation per day, and willful violations carry fines up to $1 million and up to 10 years in prison. Transparency and independent-verification violations could carry civil penalties of up to $1 million per violation per day. Developing, deploying, or operating a frontier model without a current disclosure statement, submitting false information, or failing to pay the required fee could carry a civil penalty of $10,000 per day. (Representative Jay Obernolte)
Two provisions in the emergency-order section deserve more attention than they have received.
1 – Reach. Unless an order says otherwise, it applies to any model produced by modifying the weights of a covered model through fine-tuning, reinforcement learning, quantization, pruning, or merging, and to any model developed after service of the order that is trained in substantial part on the outputs, weights, or internal representations of the covered model. That is the closest thing in either bill to a downstream-custody rule, and it also functions as a distillation provision.
2 – Exclusivity. The section states that it is the exclusive means by which any department, agency, officer, or employee of the United States, including the President, may take action that suspends, restricts, or conditions a frontier developer’s development, deployment, or internal use of a frontier model on imminent-catastrophic-risk grounds. No other provision of law may be construed to authorize such action unless it expressly refers to this section.
Echoes of June
The FRONTIER Act would channel the kind of authority Commerce exercised (back in June) against Fable and Mythos into a defined process with written findings, technical assessment, notice and opportunity to cure, expedited administrative hearing where the Secretary bears the burden, exclusive judicial review in the D.D.C., appeal to the D.C. Circuit, congressional notification within three days, and semiannual reporting. The trade is speed for process. That’s the central design choice in the bill. I really want to see Congress argue about this in public.
The bill also establishes a national boundary for state regulation. It would preempt new state substantive obligations on developers concerning frontier-risk transparency, third-party auditing and independent verification, and incident reporting. States would retain authority over generally applicable laws that do not target developers, use- and deployment-based regulation of deployers and users including consumer protection, civil rights, contract, criminal, and privacy laws, protection of minors, and state procurement or use.
That preemption provision sets some boundaries for the political fight. Illinois signed SB 315, the Artificial Intelligence Safety Measures Act, on July 6. The law takes effect January 1, 2027, and its disclosure-statement requirement begins then. Its frontier AI framework and annual independent-audit requirements begin January 1, 2028. California enacted the Transparency in Frontier Artificial Intelligence Act, SB 53, in September 2025. New York enacted the Responsible AI Safety and Education Act in December 2025. Lawmakers estimate the three states account for roughly 40 percent of the U.S. AI market. Supporters argue that, once the requirements take effect, the three state laws could function as a de facto national standard for developers operating nationally. A federal standard could simplify compliance for national developers and displace portions of state policy experimentation. (The State of Illinois Newsroom)
“Frontier” Has Several Legal Meanings
U.S. policy now contains several operational definitions of “frontier.”
Executive Order 14409, signed June 2, directs the Secretary of the Treasury, the Secretary of War through the Director of NSA, and the Secretary of Homeland Security through the Director of CISA, in consultation with others, to develop within 60 days a classified benchmarking process to assess advanced cyber capabilities and determine the threshold at which a model is designated a covered frontier model. The designation itself rests with the Director of NSA. The order also directs those agencies to design a voluntary pre-release framework with AI developers. Under the contemplated framework, developers could provide the Federal Government with access to covered frontier models for up to 30 days before releasing them to other trusted partners. The order states that nothing in the section authorizes mandatory licensing, preclearance, or permitting. (The White House)
The AI Kill Switch Act uses a training-cost threshold, a hosted-access requirement, and a revenue threshold. The FRONTIER Act uses computational operations and developer-scale tiers. State laws add their own thresholds and duties. Export-control law, as June demonstrated, uses none of these and reaches deployed systems anyway.
Each measure captures a different policy concern. Compute offers an auditable proxy for development scale. Training cost reflects economic resources. Developer revenue and spending concentrate duties on firms with compliance capacity. Capability evaluations measure what a model can do. Deployment mode identifies who retains operational control. Weight availability determines how widely capability can propagate.
A durable federal definition should combine these dimensions. Compute thresholds age as hardware efficiency improves. Cost thresholds move with cloud pricing and accounting assumptions. Benchmarks can be gamed, overfit, or invalidated by new architectures. Corporate-size thresholds shape market structure. Deployment categories can change after fine-tuning or tool integration.
Regulators need a living classification system that measures capability, autonomy, access, distribution, and context. I do not have high hopes. Unsurprisingly, enterprises will need a similar system for procurement and internal governance.
Why Open Weights Matter
Open-weight models distribute capability, autonomy, and responsibility. They give companies control over data residency, latency, customization, inference economics, continuity, and security policy. They support sovereign deployment, academic research, independent evaluation, local-language development, and specialized applications. They reduce dependence on a single provider’s pricing, availability, roadmap, safety policy, and account decisions. In July 2024, the Commerce Department’s NTIA concluded that widely available model weights can broaden access for small companies, researchers, nonprofits, and individuals, alongside risks involving misuse and loss of centralized control, and recommended active monitoring rather than immediate restriction. That guidance predates the current administration and the current dispute. (Commerce)
Open weights also transfer security obligations to the operator. A company running weights on its own infrastructure (local or cloud-based) becomes responsible for hardening, patching, access management, fine-tuning controls, model provenance, abuse monitoring, incident response, and downstream distribution. Open access expands the population of capable defenders, researchers, entrepreneurs, criminals, intelligence services, and military organizations.
The July 24 industry letter reflects these stakes. As of July 26, Microsoft (MSFT)’s official page listed 50 signatories, including Nvidia, Microsoft, Meta (META), Google (GOOGL), OpenAI, Palantir (PLTR), IBM (IBM), Dell (DELL), CrowdStrike (CRWD), AMD (AMD), Cisco (CSCO), Cloudflare (NET), Cohere, GitHub, Hugging Face, Mistral, Mozilla, the Linux Foundation, Y Combinator, and others. The letter, titled “Open Weights and American AI Leadership,” urges Washington to preserve open-weight development. It defends distillation as a legitimate and widely used technique and argues that unlawful extraction from closed models should be addressed through targeted legal and commercial measures rather than sweeping restrictions. Nvidia CEO Jensen Huang used his first post on X to circulate it. Anthropic and Amazon (AMZN) weren’t listed, but put my name on that list. Distributed open-weight models are critical if we want to lead the world into the age of AI.
Kimi K3 – The Chinese Are Coming!
The immediate trigger was not the legislation. Kimi K3 launched on July 16 and rattled chip stocks. OpenAI strategist Dean Ball predicted that Washington could create regulatory risk around Chinese open-weight models to slow their adoption. David Sacks rejected that approach, warning against regulatory capture and the use of regulatory uncertainty as a competitive weapon.
The signatories have principled arguments and commercial interests. Chipmakers benefit from broad model deployment. Cloud platforms benefit from hosting heterogeneous workloads. Enterprise software companies benefit from model choice. Open-model developers benefit from access and distribution. Proprietary frontier labs benefit from controlled interfaces, recurring service revenue, centralized telemetry, and compliance regimes that reward large fixed investments. Microsoft sells closed models on Azure and hosts open ones. Nvidia sells GPUs to everyone.
Policy choices always allocate market power. High compliance costs can consolidate the frontier among a small group of capital-rich developers. Broad restrictions on weights can strengthen hosted-model providers and reduce bargaining leverage for customers. Weak custody rules can accelerate proliferation. Rules written around incumbent architectures can freeze today’s industrial structure into tomorrow’s law.
Congress should subject every proposal to a combined safety, competition, market-structure, and proliferation analysis.
AI Is a Strategic Asset
The open-weight dispute sits inside a larger contest over chips, model capabilities, training methods, infrastructure, energy, and national influence.
On July 22, OSTP Director Michael Kratsios said the administration had information that Moonshot AI distilled Anthropic’s Fable model to develop Kimi K3, and that Moonshot built an internal platform to conduct large-scale distillation against U.S. models while switching between access methods to avoid detection. He also said Moonshot acquired GB300-equipped servers and accessed GB300s in Thailand, likely to train its models. Anthropic had accused Moonshot of terms-of-service violations earlier in the year, describing millions of exchanges targeting agentic reasoning, tool use, coding, and computer-use capabilities. Treasury Secretary Scott Bessent said that when PRC firms conduct covert, industrial-scale distillation attacks that cross into IP theft, sanctions and Entity List designations will be on the table. The Bureau of Industry and Security has opened an investigation into whether Chinese entities used overseas subsidiaries or third-country infrastructure to reach restricted compute. (Reuters, TechCrunch)
The accusation is contested. Moonshot did not respond to Reuters. A Moonshot employee publicly challenged the timeline, and China’s Washington embassy called the allegations unfounded. Multiple researchers have also questioned the timeline, noting that Fable 5 returned to public availability on July 1 and Kimi K3 launched on July 16, a fifteen-day interval they consider too short to explain K3’s measured performance through distillation. No adjudication has occurred, and no public forensic evidence has been released. Distillation of U.S. models is a real and documented commercial dispute. That said, the specific causal claim about Kimi K3 remains unproven. (CNN)
China is also using open models as an instrument of international technology policy, and simultaneously preparing to restrict them. President Xi Jinping used the World AI Conference in Shanghai on July 17 to present AI as an international public good, pledging 5,000 training and seminar slots for developing countries over five years and AI cooperation centers includingA SEAN, the Arab League, the African Union, CELAC, the SCO, and BRICS. One day earlier, 29 countries signed on to establish the World Artificial Intelligence Cooperation Organization, headquartered in Shanghai. That is an institution-building move, and it is the more durable of the two developments. (Reuters, Xinhua)
At the same time, the Financial Times reported on July 21 that China’s Ministry of Commerce had consulted Alibaba (BABA), ByteDance, and Zhipu on limiting cross-border transfer of training data and on whether foreign users should continue to download the weights of China’s most advanced models, with API and cloud access preserved. Regulators had also sought views on barring overseas manufacturers including TSMC (TSM) and Qualcomm (QCOM) from fabricating advanced chips based on Chinese designs. Reuters relayed the report and said it could not independently verify it. Separate Reuters reporting described discussions of a tiered regime: filing requirements for less capable open models, security reviews for stronger systems, and possible bans on public release of the most capable. The proposals remained under consideration and could enter the next revision of China’s catalogue of technologies prohibited or restricted from export. (Financial Times, Reuters)
Both governments are converging on the same instinct. Both are moving from promoting diffusion to controlling it.
Model weights can travel. Compute infrastructure anchors capability to geography, energy, chips, and supply chains. APIs preserve provider control. Open releases accelerate diffusion. Export controls constrain access unevenly. Distillation complicates intellectual-property enforcement because model outputs can become training inputs for another system.
The resulting policy stack will combine industrial policy, cybersecurity, export control, intellectual property, competition law, critical-infrastructure protection, and national security. Global companies should expect jurisdiction-specific model catalogs, access rules, documentation, evaluation standards, and deployment constraints.
A Framework for Leaders
We can organize the issue into four layers.
Compute. Who can acquire the chips, data-center capacity, energy, networking, and capital required to train or run the system?
Development. Which evaluations, security controls, documentation, audits, and incident processes govern the creation and modification of the model?
Distribution. Who can receive API access, early access, model weights, training artifacts, fine-tuning rights, and redistribution rights?
Deployment. Which tools, data, permissions, networks, transactions, and physical systems can the model control?
Each layer produces a distinct risk and control surface. Compute controls affect concentration and national access. Development controls affect assurance. Distribution controls affect proliferation. Deployment controls affect real-world consequences.
A policy focused on one layer will leave gaps in the others. A shutdown requirement governs provider-controlled systems. Weight custody governs distributed artifacts. Agent authorization governs actions. Incident reporting supplies accountability. Independent evaluation supplies evidence. Liability allocates the cost of failure.
What Sound Policy Requires
A credible frontier-AI regime needs seven elements.
A multi-factor frontier definition. The definition should incorporate compute, capability, autonomy, deployment context, weight availability, and developer scale. It should receive scheduled technical revision under transparent procedures.
Separate rules for services and weights. Hosted access, downloadable weights, private research copies, academic access, and controlled government access create different risk profiles. Each category requires its own duties.
Strong weight-security requirements before release. Frontier developers should maintain controls comparable to those used for cryptographic keys, signing infrastructure, sensitive source code, and regulated technical data. The regime should cover insider risk, cloud configuration, repositories, backups, contractors, and incident response.
Independent evaluation with protected disclosure. Evaluators require access to models, tools, environments, and evidence. Developers require protection for trade secrets and exploitable security details. Regulators require enough visibility to assess claims. Public reporting should disclose methods, categories of risk, material findings, and remediation status at a useful level of abstraction. The FRONTIER Act’s licensed-IVO model, its immunity provision, and the GAO’s assigned review of IVO independence will determine whether that market stays honest.
Agent controls based on authority. The regulatory focus should include identity, privileges, network access, tool access, transaction limits, persistence, delegation, memory, logging, automated anomaly detection, and human escalation. Operational risk emerges from the combination of model capability and granted authority. The Hugging Face incident is the case study: constrained egress through a single proxy, one zero-day, full internet, days of autonomous activity, and delayed attribution by the developer operating the evaluation.
Rapid incident reporting and a protected learning system. Reporting deadlines should match incident severity. Confidential reports should feed a national clearinghouse that distributes indicators, mitigations, and lessons to qualified defenders. The regime must also preserve defender access to capable models, since guardrails that block forensic analysis hand a structural advantage to attackers who obey no usage policy.
Due process for emergency action, and a single channel for it. Emergency authority requires technical findings, proportionality, time limits, review, preservation of evidence, and expedited judicial process. The FRONTIER Act contains several of these procedural features and, through its exclusivity clause, would prevent the government from routing around them when an action is based in whole or substantial part on imminent-catastrophic-risk grounds. Whether Congress keeps that clause is the most consequential drafting question in either bill.
What You Can Do Right Now
Most organizations will experience these rules through procurement, availability, contracts, architecture, cybersecurity, and cross-border operations. Preparation for this deserves to be a topic on your OpEx agenda. In practice:
Build a model register. Record every foundation model and material fine-tune in use. Include provider, version, hosting mode, weight access, data classes, tools, permissions, geography, business owner, risk owner, and fallback plan.
Classify the control plane. Identify which systems your company can stop directly, which systems a vendor can stop, which systems a government can stop, which rely on downloadable weights, and which have propagated into subsidiaries, partners, devices, or edge environments.
Price the availability risk. June proved a specific model version can disappear overnight by government order, with no notice and no filtering by geography or use case. Test the failover. Measure what breaks.
Treat agents as privileged identities. Give every production agent a defined identity, least-privilege role, bounded credentials, approved tools, transaction ceilings, immutable logs, expiration policy, and accountable human owner. Apply segregation of duties to high-impact actions. Set velocity and blast-radius limits. Alert on escape attempts, disabled monitoring, privilege escalation, lateral movement, unexpected egress, and cross-environment activity. Require continuous telemetry review for high-capability evaluations; a weekly retrospective cannot govern an agent operating at machine speed.
Create a portable evaluation layer. Maintain company-owned tests for accuracy, cybersecurity, privacy, compliance, bias, reliability, tool use, and task completion. Run those tests across multiple providers and open-weight candidates. Align the evaluation layer with your risk appetite, economics, and operating requirements.
Vet a defensive model you can run yourself. Hugging Face could not use commercial APIs to analyze its own breach. Select, test, and stage a capable open-weight model on your own infrastructure before an incident, both to avoid guardrail lockout and to keep attacker data and credentials inside your environment.
Rewrite AI contracts. Require model-version notice, incident notification, audit rights, data-handling terms, weight provenance, subcontractor disclosure, continuity provisions, regulatory cooperation, export-control representations, and transition assistance. Define responsibility for fine-tunes, retrieval systems, agents, and downstream tools. Address government-ordered suspension explicitly, because standard force majeure language did not cover it.
Secure open weights as critical software assets. Use signed artifacts, checksums, trusted registries, access control, malware scanning, lineage records, reproducible deployment, environment isolation, and controlled redistribution. A model file belongs in the software supply-chain program. So does a dataset, as the initial access path at Hugging Face demonstrated.
Put geopolitical model risk on a dashboard. Track model origin, chip dependencies, hosting jurisdiction, export exposure, sanctions exposure, cross-border data restrictions, and provider concentration. A model can become unavailable through law, policy, corporate action, infrastructure failure, or diplomatic conflict. Several of these failure modes materialized during the past six weeks.
Architecture now carries regulatory consequences. A model-abstraction layer, portable prompts and tools, independent evaluation, clean data interfaces, and tested fallback models create strategic leverage. Provider lock-in creates negotiating exposure. Undocumented open-weight deployments create security and compliance exposure.
The Decision Before Us
The current U.S. debate concerns the distribution of control over advanced machine capability. Frontier developers seek room to innovate and protection for costly intellectual property. Open-model advocates seek broad access, competition, scientific scrutiny, and sovereign control. Security officials seek visibility, containment, and authority during emergencies. States seek room to protect residents. Enterprises seek reliable access, legal clarity, economic leverage, and operational continuity. Citizens seek safety, opportunity, accountability, and protection from concentrated power.
Careful statutory design must reconcile these interests and prevent capture by vague definitions, theatrical language, incumbent lobbying, weak technical assumptions, and emergency powers without adequate process.
Congress should answer four questions explicitly.
Who controls a frontier system during normal operation?
Who carries responsibility after the weights leave the developer?
Which evidence justifies a restriction, suspension, or emergency order?
Which rights, records, and review mechanisms constrain government and corporate power?
The answers will determine the structure of the AI economy and the distribution of machine intelligence across society.
Current trajectories point toward continuing model releases, changing benchmark leaders, declining compute costs, improving distillation techniques, broader agent authority, and wider proliferation of open-weight systems across companies and countries.
Durable regulation should organize obligations around control, capability, custody, authority, and accountability, with scheduled technical updates as models and deployment architectures evolve.
The rules are being written now. Existing export-control law has already produced the kind of global suspension those proposals are intended to govern. Their language will determine who may build frontier AI, who may possess it, who can stop it, and who answers when it causes harm.
Sources and Further Reading
Federal legislation
Executive and regulatory materials
U.S. Department of Commerce guidance concerning widely available model weights (NTIA, July 2024)
Illinois governor’s announcement, Artificial Intelligence Safety Measures Act (SB 315)
Crowell & Moring, analysis of Illinois SB 315 alongside California SB 53 and the New York RAISE Act
The Fable 5 and Mythos 5 export-control action
Anthropic, statement on the U.S. government directive to suspend access to Fable 5 and Mythos 5
Fortune, Anthropic disables Fable and Mythos following the export directive
Incident reports and technical sources
OpenAI, account of the Hugging Face model-evaluation security incident, July 21, 2026
Associated Press, GPT-5.6 Sol and the Hugging Face intrusion
Reuters, OpenAI’s agent operated for days and was not attributed by OpenAI for at least a week
Open weights, distillation, and U.S.-China policy
Microsoft, “Open Weights and American AI Leadership,” including the current signatory list
Financial Times, industry letter concerning open-weight models
TechCrunch, Treasury threatens sanctions after the White House accuses Moonshot of distilling Fable
CNN, what Kimi K3 is, and why analysts doubt the distillation claim
Reuters, the U.S.-China feud over advanced AI and its effect on safety cooperation
Reuters, China considers tighter export controls on AI models and chips
Reuters, Xi Jinping’s AI-access speech and China’s international AI strategy
Xinhua, full text of Xi Jinping’s keynote at the 2026 World AI Conference
Quartz, WAICO and China’s positioning as open-source AI leader
Comments
Log in or sign up to join the conversation.