The U.S. used its AI kill switch in June. China appears to be building one for July.

Beijing has spent the past month in quiet talks with its biggest AI companies about restricting who gets to use them, according to Reuters.

Chinese authorities held meetings with Alibaba, ByteDance, and startup Z.ai about potentially limiting overseas access to China’s most advanced AI models—including those not yet released—per Reuters, which cited three people familiar with the discussions.

The sessions were convened by China’s Ministry of Commerce, Reuters reported, citing three sources who spoke on condition of anonymity.



Participants discussed putting limits on both closed-source models and open-weight ones—the kind developers can download, run locally, and modify. Officials also raised making any unauthorized disclosure or theft of proprietary AI technology an offense under China’s national security law, according to Reuters. Separately, participants floated new measures to restrict which investors can fund domestic AI startups.

The scope of any potential restrictions is still being debated. Two sources told Reuters the measures may only apply to future models, not existing ones. No timeline has been set, and it’s not certain anything will come into force.

The AI Pyramid

How any restrictions would work in practice is unclear, but hints surfaced in a summary published in a Supreme People’s Court journal from a May roundtable of Chinese legal experts on open-source AI regulation. Participants proposed a three-tier structure: basic open-source tools would require a simple government filing; more advanced technologies would face security reviews before release; the most sensitive frontier models would be barred from public release or restricted to domestic use only.

That structure would mark a sharp reversal for Chinese AI companies, whose global gains have come almost entirely from openness. Alibaba’s Qwen series has built a large following on Hugging Face, the world’s largest repository of open-source AI models. ByteDance’s Doubao is one of the dominant AI products inside China. Z.ai’s GLM-5.2 has attracted attention from U.S. researchers for matching top American models on some benchmarks while pricing API access at a fraction of the cost.

Any decision to restrict overseas access would likely raise costs for businesses that have come to rely on Chinese models as cheaper, less restricted alternatives to U.S. frontier systems. Officials also grew alarmed that Anthropic’s Mythos—the cybersecurity model the Donald Trump administration restricted in June—could be reverse-engineered and turned against Chinese systems, adding a defensive urgency to the discussions.

The U.S. went first

In the late afternoon hours of June 12, Anthropic received a letter from the Commerce Department’s Bureau of Industry and Security ordering the company to suspend all access to Claude Fable 5 and Mythos 5 for any foreign national—including Anthropic’s own non-citizen employees. Because there’s no clean way to fence a live API endpoint by passport, Anthropic pulled both models globally within hours. It was the first time the U.S. applied export controls to a deployed AI model rather than the chips that train it.

The models came back online June 30, after Anthropic retrained its safety classifiers and the Commerce Department lifted the restrictions. Four days earlier, the same pattern had already played out with Anthropic’s chief competitor, OpenAI. The company released GPT-5.6 Sol, Terra, and Luna, disclosing it had previewed the models with the U.S. government and, at Washington’s request, was initially releasing them to roughly 20 trusted partners individually vetted by federal officials.

OpenAI said government-gated access “shouldn’t become the long-term default.” President Trump’s June 2 executive order on AI had already asked developers to voluntarily submit frontier models for a federal cybersecurity review before public release. A framework defining what counts as a “covered frontier model”—and when government pre-release access applies—is due August 1.

Beijing has been watching

Beijing had reasons to pay close attention. Officials grew alarmed that Anthropic’s Mythos—the cybersecurity model the Trump administration restricted in June—could be weaponized against Chinese infrastructure to exploit software vulnerabilities, per reporting from Quartz. Adding to that, the concern that Anthropic may be employing spyware-like tactics to track Chinese users also raised concerns in China.

Qihoo 360 founder Zhou Hongyi made the alarm explicit at ISC.AI 2026 in Beijing, calling for China to build a domestic equivalent while unveiling Tulong Feng, a homegrown AI vulnerability agent.

The tiered structure proposed in China’s Ministry of Commerce discussions maps directly onto how the U.S. has handled chip export controls for three years—a policy history that narrowed China’s capability gap rather than widened it.

Beijing had already been tightening the perimeter. Its state planning agency ordered Meta to unwind a $2 billion deal for AI startup Manus in April, under China’s foreign investment security review mechanism. It required Moonshot AI and StepFun to obtain government approval before accepting U.S. capital in funding rounds, and a broader regulatory package released in early June extended scrutiny to cross-border transactions touching Chinese technology and data.

The escape valve closes

The dominant logic since DeepSeek R1 went viral in early 2025 was simple: U.S. restrictions on frontier AI create a natural market for Chinese open-weight models. Chinese open-weight models climbed from less than 2% of total token usage on OpenRouter—a critical hub for global AI distribution—in late 2024 to roughly 61% by mid-2026. The U.S. playing defense handed Beijing a global distribution advantage it didn’t earn through raw technical superiority alone.

That logic only holds if Chinese models stay open. If Beijing restricts overseas access to its frontier systems—closed-source or open-weight—the escape valve closes. Z.ai’s GLM-5.2 built its pitch entirely around borderless access under an MIT license; restricting that distribution cancels the pitch.

The Lawfare analysis of the June controls flagged a structural problem that applies equally to Beijing: “national” AI restrictions don’t stay national. The U.S. order on Anthropic covered foreign nationals inside the United States, including Anthropic’s own non-citizen employees. More than two-thirds of top-tier AI researchers working in the U.S. were trained abroad; at the leading labs, the foreign-born share runs up to 70%, per MacroPolo data.

A nationality-based access control aimed at adversaries ends up locking out the engineers needed to fix the vulnerabilities that triggered the control in the first place. China faces the same problem in reverse. ByteDance and Alibaba are pulling humanlike agent features ahead of Chinese AI regulations taking effect July 15—showing that when Beijing decides to restrict a capability, it moves on a schedule that doesn’t wait for market feedback.

This may spell trouble for small labs and developers all over the world who trust and build on open-source technologies, since China has up to now led in that area.

French President Macron warned at the G7 summit that European governments would stop buying U.S. AI products if access could be cut off on a day’s notice. Canadian Prime Minister Carney called concentrated AI dependence a “strategic mistake.” Both reactions assumed Chinese AI was the unconstrained alternative.