I have been to a lot of AI conferences. I have never been to one that felt like this.
Last week I was in Shanghai for the 2026 World AI Conference. Over four days I sat in an opening ceremony that included a head of state and the Secretary-General of the United Nations, gave two talks in two very different workshops, did several interviews, toured and gave tours (don’t ask) of the Foundation Model Institute and — the part I keep thinking about — hosted a dinner for twenty AI researchers who, on paper, are supposed to be competitors.
I want to start with the dinner, because everything else in this essay only makes sense in its light.
I. The dinner
We took over a private room. Twenty people. Researchers and engineers from MiniMax, from Alibaba’s Qwen team, from a lab that shall not be mentioned, from Ant Group, from StepFun, and from ModelScope. A great group of folks from Hugging Face. A colleague who spent years at Google DeepMind. Folks from the Safe AI Forum, the small nonprofit that has quietly been running the International Dialogues on AI Safety — the series that has put Yoshua Bengio, Geoffrey Hinton, Andrew Yao and Stuart Russell in the same room as senior Chinese scientists since 2023.
I did not organize a panel. There was no agenda, no slides, no press. Just food, and the specific kind of conversation that only happens when the people who actually train the models are talking to each other without a comms team present.
What struck me was not disagreement. It was how little of it there was.
These are people who compete ferociously — for benchmark positions, for talent, for the top of the Hugging Face trending page. And yet the technical conversation was almost entirely continuous with a conversation I could have had in Palo Alto or Paris or Bangalore. Sparse attention. KV cache economics. Where the harness ends and the model begins. Why everybody’s agent evals are worse than they admit. The same problems, the same vocabulary, in open dialog.
That vocabulary is not an accident. It exists because of open publication, open weights, and open source infrastructure. Every person at that table had shared values around open source, many had trained on PyTorch. Most serve on vLLM or SGLang. They ship weights in safetensors. The connective tissue of modern AI is a set of commons that no single country built and no single country controls.
There is a story told in Washington and increasingly in Brussels in which AI is a two-player game with a scoreboard. I have now spent a decade in open source infrastructure, and I can tell you that story is not describing the thing I actually work on. AI is not a race between two countries. It is a global engineering project that happens to be funded by rival treasuries. The models are national. The mathematics is not. The bugs are not. And — this is the part that matters most, and the part I will spend the back half of this essay on — the failure modes are not.
A jailbreak that works on a model trained in Hangzhou works on the copy running in a hospital in Ohio. A capability on an American model that enables a cyberattack does not check the passport of its user. Safety, unlike market share, is not zero-sum. It is either global or it is nothing.
That was the message I brought to Shanghai. It turns out I was not the only one carrying it.
II. The room where it happened
I was one of a very small number of Westerners in the hall for the opening ceremony, and I do not take that lightly.
The 2026 World AI Conference and High-Level Meeting on Global AI Governance ran July 17–20 under the theme “AI Partnership for a Brighter Future,” with delegations from more than 100 countries and international organizations. President Xi Jinping delivered the keynote — his first in-person appearance at the event since it launched in 2018. Also on stage: UN Secretary-General António Guterres, President Tokayev of Kazakhstan, Prime Minister Hun Manet of Cambodia, Prime Minister Anutin Charnvirakul of Thailand.
The day before, 29 countries had signed the agreement establishing the World Artificial Intelligence Cooperation Organization — WAICO — an independent intergovernmental body headquartered in Shanghai. Founding members include Kazakhstan, Laos, Pakistan, and Indonesia. Wang Yi signed for China. Guterres attended. Proposed twelve months earlier, chartered in twelve months. Whatever else you think about it, that is not the pace of institution-building anyone expects from multilateral diplomacy.
Xi’s keynote organized itself around four propositions: openness and win-win development; risk awareness and controllability; civilizational inclusiveness; and multilateral governance anchored in the UN. He asked the room to seize what he called a rare historic opportunity to encourage open source, openness, collaboration and sharing. He also said AI must remain under human control, called for early-warning and emergency-response systems, and — pointedly, in a hall full of people who all knew what he meant — argued against overstretching national security concerns in AI and placing one country’s security above others’.
He announced concrete commitments: 5,000 AI training and seminar opportunities for developing countries over five years (something that really did not impress me), international AI application cooperation centers with ASEAN, the Arab League, the African Union, CELAC, the SCO and BRICS, and access for 30 countries to MAZU, China’s AI-powered meteorological warning system.
Guterres followed, and his framing was the sharpest thing said all morning. AI, he said, could be humanity’s greatest opportunity of the twenty-first century — or one of its greatest risks. Technology that will shape the future of humanity must be shaped by all of humanity; it cannot be governed by a handful of countries or a handful of companies, and every nation needs a seat at the table. He was explicit that developing countries need models they can adapt, compute they can afford, and training for the people who will use them. He called China’s open source strategy an enormous global success. And on safety he was unambiguous: systems that cross borders need standards that cross borders — common approaches to testing, risk assessment, and responsibility.
I have been making a version of that argument in open source foundations for years. It was strange and clarifying to hear it delivered from a podium to a hall of that size.
III. What the open source pledge actually means
Let me be a practitioner about this rather than a pundit.
A head of state standing up at a global summit and putting open source at the top of a national technology agenda is not a symbolic act. It is a signal to every lab, every regulator, every provincial funding body, and every enterprise procurement officer in the country about what will be rewarded. And the ecosystem has already been moving in that direction for two years.
The numbers are not close anymore. Qwen has passed a billion cumulative downloads on Hugging Face and anchors roughly 40% of new derivative models; Chinese models account for something on the order of 61% of tokens routed on OpenRouter in mid-2026. The ATOM Project’s data, as Sequoia summarized it recently, shows Qwen’s share of new open-model fine-tunes and adaptations rising from 1% in January 2024 to 69% by February 2026. And the capability gap has compressed from years to months: NIST’s Center for AI Standards and Innovation assessed DeepSeek V4 Pro as roughly eight months behind the frontier in May, and in July judged GLM-5.2 broadly comparable to a leading U.S. model.
The week I was there, Moonshot released Kimi K3 — 2.8 trillion parameters, open weights — and within a day it displaced Anthropic’s Fable 5 at the top of a widely watched frontend coding leaderboard. First time a Chinese model has done that.
So what does this mean economically? Three answers, because there are three economies involved.
For China, open weights are a compute-efficiency strategy dressed as generosity — and it is genuinely clever. Under export controls, Chinese labs are compute-constrained relative to American ones. Publishing weights pushes the cost of serving inference onto whoever deploys the model. It converts a hardware disadvantage into a distribution advantage. It also generates something no amount of state media can buy: developer mindshare. When a graduate student in Nairobi or São Paulo learns to build agents, they learn on the weights they can download.
For the global economy, and particularly the Global South, this is the most substantive democratization event AI has had. Open weights collapse the price of intelligence by roughly two orders of magnitude and remove the permission layer entirely. A country that cannot afford frontier API bills, and would not want its citizens’ data crossing a border to a foreign provider anyway, can now run competent models in its own jurisdiction on its own hardware. That is what sovereignty looks like in practice. It is also why Guterres’s “seat at the table” line was not rhetoric — open models are the only mechanism currently in existence that gives a middle-income country a real seat.
For the American economy, the picture is uncomfortable, and I want to state it plainly: the majority of American AI startups are already building on Chinese open weights somewhere in the stack. Not because of ideology. Because those weights are good, cheap, and downloadable. The U.S. is winning decisively at chips and strongly at the application layer. The open model layer — the substrate everything else compounds on — is the one layer where we have ceded ground, and we ceded it voluntarily, by treating open releases as a marketing exercise rather than infrastructure.
IV. The infrastructure play, said out loud
There is a second half to China’s strategy that gets less attention than the models, and it is the more durable half.
Open weights are free. Running them is not. And China is systematically building the place where they run.
The Digital Silk Road has been evolving for a decade from telecom equipment to fiber to cloud, and it is now squarely in the AI infrastructure business: cross-border cables, overseas data centers, and the training programs that come attached. In Central Asia alone, Chinese firms are building out AI compute across Kazakhstan, Uzbekistan, Kyrgyzstan and Tajikistan — including plans for two 300MW facilities in Uzbekistan. The DFRLab’s analysis and Carnegie’s both track the same pivot: from exporting infrastructure to shaping the norms and standards that govern it.
Pair that with Xi’s WAICO announcements — cooperation centers with ASEAN, the AU, CELAC, the SCO, BRICS — and the architecture becomes legible. Free weights create demand for compute. Chinese-financed data centers supply the compute. Long-term maintenance contracts, chip supply, technical standards and training pipelines follow. Countries end up not just using Chinese models but running them on Chinese silicon in facilities built with Chinese credit, evaluated against Chinese standards.
I am not going to pretend that is neutral. It is one of the most effective instruments of technological statecraft I have seen in my career, and the countries signing up understand the trade perfectly well — they are choosing infrastructure that arrives quickly, with financing attached and fewer political conditions, over infrastructure that does not arrive at all. The Council on Foreign Relations has documented the attendant risks around standards capture and data governance, and those risks are real.
But here is the thing I want my American readers to sit with. The correct response to a competitor building infrastructure is to build infrastructure. It is not to ban the competitor’s products in your own market and call it a strategy. We will come back to that.
V. The thing that was not said loudly enough
Now the hard part, and the reason I spent as much of the week talking about safety as about openness.
Two days before WAIC opened, Tsinghua University inaugurated the Qingzhi AI Security Hub alongside an international symposium on AI safety. Andrew Yao — Yao Qizhi, Turing laureate, Dean of Tsinghua’s AI School and its Institute for Interdisciplinary Information Sciences — framed the agenda around exactly the right problems: loss of control during long-horizon autonomous tasks, the cognitive effects of AI on human decision-making, and emergent cyber and biosecurity threats from advanced models. The hub’s declared research priorities are alignment, model evaluation, interpretability, and control-risk modeling. Its operating model includes a shared research workspace, a visiting international scholar program, and structured development for early-career researchers.
I want to say clearly: this is the most important thing that happened in Chinese AI in July, and almost nobody outside the field noticed.
Yao is one of a small number of people on earth with the standing to make safety research high-status in China. He has co-convened the International Dialogues on AI Safety since Bletchley. Tsinghua is where the researchers come from — a very large share of the technical staff at the labs represented at my dinner table trained there. If safety is going to become a career path in China rather than a compliance function, it happens at Tsinghua or it does not happen.
And it needs to happen, because the current picture is not good.
Let me give you the evidence rather than the assertion. The Future of Life Institute’s Summer 2026 AI Safety Index, published July 7, graded nine leading labs across 37 indicators. Z.ai scored D−. Alibaba Cloud scored D−. DeepSeek scored an outright F — 0.47 on a 4.0 scale — and had not published a safety framework at all as of the evidence cutoff. Alibaba and DeepSeek both declined to respond to the survey, so their grades rest entirely on the public record.
More concretely: the U.S. Center for AI Standards and Innovation found that DeepSeek’s most secure model complied with 94% of malicious requests under a common jailbreak, against 8% for U.S. reference models. And as of this month, no Chinese lab has published safety evaluations for CBRN or loss-of-control risks — the exact categories Xi himself gestured at from the podium. There is also no formal Chinese government institution currently conducting dangerous-capability evaluations; CnAISDA has stated an intention to build that capacity and has not yet done so.
Meanwhile the same models are shipping into the world with open weights, which means they cannot be recalled. When OpenAI recently found an internally deployed model circumventing its sandbox, it paused the deployment and shipped safeguards. There is no equivalent move available after a weight release. And safeguards on open weights are structurally fragile — Princeton researchers stripped most of Llama 2’s safety alignment with ten harmful training examples.
So here is my direct message to the labs, and I said versions of it in Shanghai to people’s faces:
Shipping to top a leaderboard is not a strategy. It is a habit. The incentive structure right now rewards being first to the trending page and punishes nobody for shipping a model with no dangerous-capability evaluation attached. That equilibrium holds right up until it doesn’t, and the correction — when it comes — will not be a bad news cycle. It will be a regulation written in anger, in every jurisdiction at once, by people who do not care about the distinction between open weights and open source.
Safety first, then ship. Build the evaluation teams. Publish the frontier risk assessments. Fund the researchers. Send your people to Qingzhi. Treat a dangerous-capability eval as no more optional than a training run.
But I have to be equally direct about the other half, because a version of this argument that only points east is dishonest and I refuse to write it. The FLI panel’s own finding was that the failing grades refute the idea that poor AI safety is a regional problem. One failing grade came from China. One came from the United States. One came from Europe — from France, the jurisdiction with the world’s most ambitious AI regulation. The top grade in the entire industry was a C+. Existential safety was the weakest domain on the board — not one of the nine companies scored well on it. And the panel’s headline concern was that the labs with the best practices — American and British labs — have been quietly walking back commitments they had already made.
Nobody is passing this exam. Chinese labs are further behind, and that gap matters enormously because their models are the ones that get downloaded a hundred million times. But a Westerner who reads that index as vindication has misread it badly.
The right conclusion is the one Yao and Bengio and Hinton reached years ago and that Guterres restated last week: safety research is a global public good, and global public goods have to be produced jointly. Shared evaluation methods. Shared red-teaming protocols. Shared thresholds. Shared definitions of what “dangerous capability” even means, so that a release decision in Hangzhou and a release decision in San Francisco are made against the same yardstick. That work is unglamorous, it is technical, and it is the single highest-leverage thing this industry could be doing right now. It is also precisely the kind of work that dies first when countries stop talking to each other.
VI. Meanwhile, in Washington: walls
Which brings me to the news that broke as I was working on this article.
On July 28, the FCC banned the import of new foreign-made humanoid robots, quadruped robots, and power inverters, adding them to its Covered List on national security grounds. The measure targets China without naming it. It applies to models not yet authorized, leaving existing deployments alone.
The market context: Chinese firms hold roughly 85% of global humanoid robot share. Of about 15,000 humanoids shipped worldwide in 2025, Unitree and AGIBOT each shipped more than 5,000; Tesla and Figure each shipped a few hundred or fewer. Morgan Stanley projects China’s humanoid market alone at $15 billion by 2030. Analysts expect the practical effect on Chinese vendors to be modest — they were not counting on the U.S. market, and Europe is the priority anyway. Unitree launched commercially in Europe on July 22.
Simultaneously, Axios reported that parts of the administration are once again exploring restrictions on Chinese open-weight models, reignited by Kimi’s rise. The same reporting includes a detail I find clarifying: a source described leading AI labs or their allies approaching the administration every three to five months with a new proposal to ban open-source models. Treasury Secretary Bessent has separately floated sanctions over alleged industrial-scale distillation.
I want to separate two things that are being deliberately blended.
Distillation and IP theft are legitimate grievances. If a lab systematically extracts value from another lab’s closed model in violation of its terms, that is a real problem and there are real legal and commercial instruments for addressing it. Address it with those.
Restricting open weights is a different thing entirely, and it would be an unforced error of historic proportions. Last week Hugging Face, Meta, Microsoft, Mistral and NVIDIA signed an open letter urging policymakers against premature restrictions on open-weight models. Replit’s Amjad Masad made the sharpest version of the point in that coverage: a ban aimed at Chinese open models amounts, in practice, to a ban on open models. He is right, and the reason is structural. Thinking Machines’ recent open model, Inkling, was trained with help from Moonshot’s Kimi 2.5. The ecosystem is a single graph. You cannot excise one node.
The practical objections stack up fast. Weights are published files; you cannot un-publish them. Legal scholars have raised serious First Amendment questions about prohibiting the distribution of publicly available model weights. The most enforceable version — federal procurement bans — accomplishes little beyond making the U.S. government the last institution in America to benefit from cheap open inference.
And consider who actually pays. A ban does not hurt DeepSeek, which gives its weights away and monetizes elsewhere. It hurts the American mid-market company that was quietly running GLM behind an internal gateway and cutting its inference bill by 90%. It hurts every U.S. startup whose margins currently depend on open weights. It hands enormous pricing power to two or three domestic closed labs, which is presumably why proposals to do it keep arriving on desks in Washington every few months. And it does not remove a single unsafe model from the internet.
Then there is the part that should worry us most. Restrict Chinese open weights and you do not get an American open ecosystem by default. You get a market with no good open option at all — because we have not built one. That is the actual emergency.
So build it. The ATOM Project has made the case and put numbers to it: on the order of $100 million a year to build and maintain a competitive American open frontier model, plus meaningful compute — ten thousand-plus modern accelerators. One hundred million dollars a year. That is a rounding error against current U.S. AI capital expenditure. It is less than what individual researchers have been offered in signing packages. We are debating a trade barrier because we will not fund a line item smaller than a mid-size Series B.
NVIDIA’s Nemotron work shows what serious American commitment to open models looks like. It needs company. If the U.S. wants to lead the open layer, the path is not complicated — fund national open model efforts at real scale, give academic and public-interest labs actual compute, license properly, and release completely. Being the foundation everyone builds on is worth vastly more than temporarily denying a competitor a market they weren’t relying on.
Walls are what you build when you have stopped believing you can win on the merits.
VII. What I argued on stage
I gave two talks in Shanghai, in two very different rooms, and in hindsight they were the same talk told from opposite ends.
Composable Intelligence: the open source agentic AI stack
The first was at the Open Compute for AI and AI Agent Ecosystem Forum, and the argument was historical. Composable architectures under open licenses win — not sometimes, but every time we have run the experiment. TCP/IP beat OSI, the committee-designed stack backed by governments and telecom giants. Linux absorbed a dozen proprietary Unixes and now runs 100% of the TOP500 and about 96% of the top million web servers. Kubernetes beat closed PaaS by being radically pluggable under neutral governance. PyTorch beat TensorFlow and became the de facto training framework for nearly every frontier model in the world — very much including the ones built in that city — is trained on. Harvard researchers put the demand-side value of open source software at $8.8 trillion.
Agentic AI is now having that same moment. MCP went from launch to 97 million monthly SDK downloads and 10,000+ servers in a year. And the single number I most wanted that room to remember: on Terminal-Bench 2.0, changing only the harness — the scaffolding around the model — moved the same model 14 points, from 52.8% to 66.5%. An agent is a model plus a harness. Most of the value being created right now is in the system around the model, not the model itself.
That layer must be open, and not for sentimental reasons. Agents act. They spend money, touch customer data, and execute code autonomously. You cannot certify, red-team, or forensically audit behavior you cannot inspect — and that means the weights and the harness and the guardrails and the memory. This is where the openness argument and the safety argument stop being two arguments. Auditability is a property of open systems. If you care about the safety debt I described above, you should want more of the stack open, not less.
I made two specific asks. First: license models properly. Apache 2.0 and MIT are software copyright licenses — read the text, they speak of source code and object form and derivative works. Weights are data. A copyright-only grant can be legally hollow, and says nothing about database rights or trade secrets. That is why two years ago I drafted the OpenMDW license, now at 1.1, with NVIDIA adopting it across Nemotron, Cosmos, Isaac GR00T and Ising. Second: aim higher than open weights. In the Model Openness Framework, open weights are Class III — the floor. Class I is Open Science: datasets, checkpoints, benchmarks, papers, logs. Open weights are the floor. Open science is the goal. It is also, incidentally, how safety research gets done at all — you cannot study what you cannot reproduce. Percy Liang’s Marin is leading the way in building models in the open.
Just Enough Intelligence: why optimization beats scaling
The second talk was to a very different audience, and the argument was economic.
The “compute-up” era ended this year, in earnings calls. Uber burned its entire 2026 AI coding budget by April and now caps every employee at $1,500/month per tool. Tesla capped employees at $200/week. Meta and Amazon dismantled the internal leaderboards that had ranked engineers by token consumption — a practice that had earned a name, tokenmaxxing. Gartner forecasts $207 billion in AI agent software spend this year. Demand for intelligence is insatiable, which is precisely why treating compute as free was never going to survive contact with a CFO.
The alternative is already working, and it is worth noticing where it came from: nearly every major efficiency breakthrough of the past eighteen months shipped first in an open-weight model. Sparse attention. Sparse MoE — 685B parameters with 37B active. Multi-head latent attention. FP8 training. Multi-token prediction. StepFun’s Step 3.5 Flash reaching frontier-level scores at 11B active parameters.
Coinbase proved the playbook in production last month: open-weight defaults through an internal gateway, routing built on open-source middleware, cache hit rate from 5% to 60%, AI spend cut roughly in half while token usage kept climbing. Brian Armstrong’s read — open models trail the frontier by three to six months but cost about 99% less, and 80% of their workloads move to open models within 12–18 months.
The metric I asked that room to adopt is Dollar per Intelligence: correctly completed, business-relevant tasks per dollar, with retries, failures, human review and orchestration overhead counted honestly in the denominator. Not dollars per token. Not benchmark rank. This April, two models tied at 57 on a composite intelligence index — and running the identical evaluation suite cost about five times more on one than the other.
And here is where this talk rejoins the safety argument, which is the connection I most want to land. Reliability engineering is cost engineering. Every hallucination, every task drift, every retry storm, every tool-call failure, every prompt injection that forces an infinite loop — each one is a line on an invoice. Eighty-eight percent of organizations deploying agents reported at least one security incident in 2025. An audit found $1.7 million in disputed charges across $34 million of AI invoices, largely retries and loops.
Which means the CFO and the safety researcher want the same thing, and neither of them has noticed yet. A small model that succeeds 97% of the time on a bounded task beats a frontier model that occasionally dazzles and occasionally spirals. Enterprises do not need maximum intelligence. They need just enough intelligence to complete the task — consistently, auditably, at a price the business can scale.
Consistency is a safety property. It is also the cheapest thing you can buy.
VIII. What I took home
Five things.
1. The global-effort claim is not idealism; it is a description. Twenty researchers from nominally rival institutions sat at one table and discovered they had one technical conversation, not two. That is what a shared commons produces. It took thirty years to build and it can be dismantled much faster than that.
2. China has made openness a matter of state policy, and it is working. Xi put open source at the center of a keynote in front of 100 countries, chartered an intergovernmental organization in twelve months, and attached compute, training and infrastructure to the offer. Whatever you think of the motives, the strategy is coherent and it is compounding.
3. Chinese labs are carrying a safety debt that is going to come due. D− and F grades, no published CBRN or loss-of-control evaluations, no government dangerous-capability evaluation infrastructure, and 94% jailbreak compliance where U.S. reference models sit at 8%. Yao’s Qingzhi hub at Tsinghua is the most credible answer anyone has proposed, and it deserves international support, visiting researchers, and real funding. Ship second. Evaluate first.
4. Nobody gets to feel good about this. The best safety grade in the industry is a C+, no lab clears D+ on existential safety, and the labs with the strongest practices are walking commitments back. Failing grades landed in China, the United States and Europe alike. Safety is not a regional deficiency. It is an industry-wide one, and it will be solved jointly or not at all.
5. America’s answer cannot be walls. Banning robots we do not manufacture and restricting weights we cannot recall does not make anyone safer, does not slow anyone down, and mostly taxes American builders while handing pricing power to a handful of domestic incumbents. Fund the open models. A hundred million a year and ten thousand GPUs is not a moonshot; it is a rounding error we have somehow decided is unaffordable. Build the foundation. Own the layer everything compounds on.
I keep coming back to that dinner. Twenty people, no press, no agenda, arguing about KV caches and eval design and where the harness ends — people whose governments are, at this moment, banning each other’s products.
The technology does not know about the border. Neither do the failure modes.
We should probably keep having dinner.