WASHINGTON—Last week, Shanghai welcomed more than 1,400 executives and investors to its World AI Conference, where Chinese President Xi Jinping and other top officials pitched China as a responsible steward of artificial intelligence development. This conference took place at an awkward moment, as the Trump administration has focused much of its attention this summer on reducing the risk of access by adversary countries such as China to frontier AI models like Fable and Mythos, which are known for their advanced cyber capabilities. On Tuesday, US Treasury Secretary Scott Bessent announced an investigation into Chinese intellectual-property theft and potential US sanctions against China, following speculation that a Chinese company, Moonshot AI, leveraged the intellectual property of American companies to train its model Kimi K3. As the United States works to construct a framework to control the risks of adversary access to frontier AI and counter the actions of (mostly) Chinese companies to distill the outputs of US models to accelerate their own capabilities, policymakers should learn from the spyware industry.
In June, Anthropic briefly suspended access to Fable and Mythos to comply with a US Department of Commerce directive, restoring access on July 1 after those restrictions were lifted. This episode was a brief exercise in utilizing export controls to limit adversary access to frontier AI models, similar to what the United States has previously done with semiconductors. Having tried and quickly reversed course on this tactic, the US government has turned back to a company-first approach, where individual companies determine which customers receive access and which customers present national security risks. This approach is quickly showing cracks.
Recently, The Financial Times reported that OpenAI and Google have supplied AI services to Singapore-based subsidiaries of Alibaba, Baidu, and Tencent. All three parent companies sit on the Pentagon’s 1260H list of firms with likely ties to China’s People’s Liberation Army, which restricts the Department of Defense’s own procurement. The list is often viewed as one of the clearest public signals of which Chinese companies the US views as national security threats. Private companies that do business with the US government must also comply with this list, but under current export control law, subsidiaries of parent companies are not restricted in the AI category. Therefore, a restricted Chinese parent company can legally route access through an unrestricted Singaporean subsidiary.
A second and related problem, distillation, complicates the picture further. Distillation is the practice of training a rival model on a frontier model’s output. Moonshot’s Kimi K3 is only one example of companies pointing to distillation as a leading factor in how Chinese models have caught up to US models so quickly. While distillation is distinct from subsidiary routing, as one concerns protecting intellectual property and the other concerns uniformly restricting access, both center around a core enforcement problem—controlling who is on the other end of a sale and whether that buyer can be trusted to not turn the seller’s own tools against its interests. As such, it is important to consider how various companies handle this issue.
Google, OpenAI, and Anthropic have each built their own safeguards to keep Chinese entities from misusing their systems, and the differences among their safeguards matter. Google has stated that it permits services in Singapore and Hong Kong under usage policies that ban distillation. OpenAI has stated that it permits some Chinese-owned companies to use its services in jurisdictions where it can enforce protections, restricting access in China and Hong Kong. Last month, the company suspended Alibaba-affiliated API users (developers who integrate models into their own applications through an application programming interface) over suspected distillation. And the third, Anthropic, limits access to its models in China and Hong Kong.
Last month, Anthropic sent a letter to the US Senate committee on Banking, Housing, and Urban Affairs accusing Alibaba of distillation by using approximately 25,000 fraudulent accounts and nearly 29 million exchanges with its model Claude. Anthropic has also reportedly cracked down on China-based distillation that utilized Singapore-based subsidiaries. On the public-sector side, the White House weighed in on this issue in an April 2026 memorandum, which framed distillation of US models as a national security concern.
The spyware playbook
Verifying who is really on the other end of an account is not a new problem—it is a classic spyware industry challenge. In 2013, dozens of countries agreed to expand the post-Cold War Wassenaar Arrangement restricting the export of arms and dual-use technologies, adding spyware to the list. But some states never joined the regime, and others only loosely enforced the restrictions. When one jurisdiction tightens its controls, vendors simply relocate, breaking down the same country-based model that AI policy has been following thus far. Policymakers can learn from the spyware industry as they begin to construct policies to curb the use of frontier AI models to develop offensive cyber capabilities for US adversaries.
The Atlantic Council’s Mythical Beasts project, which maps the global spyware market from 1992 to 2024, highlights this relocation trend. It found that vendors systematically engaged in jurisdiction hopping—the practice of establishing subsidiaries across borders specifically to bypass restrictions, such as export controls, in any single country. For example, Israeli spyware vendor QuaDream established a subsidiary outside of Israel to reach the European market once it was restricted with export controls. Similarly, the project found that investment capital crosses borders in a similar way, making beneficial ownership difficult to trace.
Change the industry from spyware to artificial intelligence and it is the same picture. Restrictions on named entities and jurisdictions are static. Corporate structures, and in the case of distillation the technical means of extraction, are not. Therefore, policy responses must be equally dynamic. That’s not to argue for abandoning export controls on frontier AI, but rather to underscore that controls built solely around named entities and named countries are already behind the market they are meant to constrain.
What to do now
To counteract these challenges, policymakers should:
1. Create policy for the entire market, not just the big names. A core Mythical Beasts’ recommendation was to treat the ecosystem of subsidiaries, resellers, and investors as the unit of regulation, rather than playing “whack-a-mole” one firm at a time. Extending “Know Your Vendor” and beneficial-ownership disclosure requirements down the full chain of AI resellers and enterprise customers would apply that logic directly to frontier-model access. Expanding the US Commerce Department Bureau of Industry and Security’s new Affiliates Rule can be a good start.
2. Monitor individuals, not just corporations. Spyware founders and staff routinely resurface at new companies once their old ones draw scrutiny or become unprofitable. AI export policy should track key personnel with ties to restricted entities (corporate officers, controlling owners, and named beneficiaries of entities already on a restricted list) the same way, rather than treating a new corporate name as evidence of a “clean” operation.
3. Screen outbound capital like inbound access. Cross-border investment makes spyware ownership opaque. The Treasury Department’s nascent outbound-investment screening rules, built mainly around semiconductors, should explicitly extend to investment in offensive AI capabilities.
4. Pursue multilateral action. AI restrictions that bind only Anthropic, OpenAI, and Google accomplish little if Chinese labs can fill the capability gap through subsidiaries outside US jurisdiction. The US should pull in allies and partners to make meaningful change to curb distillation.
