Frontier Radar #4: China has caught up, so what's left of the Western AI lead?

{ "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Frontier Radar #4: China has caught up, so what's left of the Western AI lead?", "datePublished": "2026-08-20T16:08:14+02:00", "dateModified": "2026-08-20T16:08:14+02:00", "author": { "@type": "Person", "name": "Maximilian Schreiner" }, "publisher": { "@type": "Organization", "name": "The Decoder" }, "description": "Kimi K3 and GLM-5.3 are now within striking distance of the best US models. Western labs blame distillation, and there's real evidence for it. But guilty or not, the conclusion is the same: a model lead can't be defended. This issue looks at what can.", "articleBody": "Kimi K3 and GLM-5.3 are now within striking distance of the best US models. Western labs blame distillation, and there's real evidence for it. But guilty or not, the conclusion is the same: a model lead can't be defended. This issue looks at what can.\r\n\r\nSix times a year, the THE DECODER editorial team takes a close look at one core AI topic in the \"Frontier Radar.\" It runs as a newsletter and exclusively here on the site for THE DECODER subscribers. Issue #4 is our most extensive yet and took longer than expected. Blame the topic: We look at how Chinese AI models caught up, where Western labs can still stand out, why the industry's moat has shifted, and why Europe is losing two races at once. Issue #1 covered the current state of AI agents. Issue #2 examined the measurable effects of AI on productivity. Issue #3 covered the emerging token economy of AI.\r\n\r\nA year and a half ago, DeepSeek R1 caused a shock. A Chinese lab was suddenly competing with OpenAI's o1, the first commercial reasoning model, and had reportedly done it for far less money. Markets got nervous. Billions in market value evaporated within days. Was the planned infrastructure buildout overblown?\r\n\r\nThe picture back then was murkier than the headlines suggested. In DeepSeek's own report, R1 beat o1 on individual tests like AIME 2024 but trailed clearly on others, such as factual knowledge (SimpleQA). Later benchmarks exposed more gaps. Chinese models only reached the top in individual disciplines, not across the board.\r\n\r\nAs recently as late June, when we started working on this issue, Z.ai's GLM-5.2 still showed the same pattern. Then came the latest Chinese open-weights models: Moonshot's Kimi K3, Alibaba's Qwen3.8-Max, and GLM-5.3.\r\n\r\nChinese models now sit near the top of almost every broad, demanding evaluation. They handle long knowledge tasks, code across many steps, and coordinate tools far more reliably than their predecessors.\r\n\r\nMeasured by common benchmarks, the often-cited gap of a few months has shrunk enough to become an investor problem. According to the Wall Street Journal, Anthropic is fielding uncomfortable questions ahead of its upcoming IPO and points to its remaining lead at the top in its defense. Below that tier, the field belongs largely to open, far cheaper models from China.\r\n\r\nInvestors worry that raw model performance can barely carry a business anymore. Whatever a model can do exclusively today, a freely downloadable one can do a few months later.\r\n\r\nTwo accusations are in play: Chinese labs allegedly tapped Western models as teachers, a practice known as distillation. And they allegedly tune their models for strong benchmark scores without the broad capabilities to match - so-called benchmaxxing.\r\n\r\nThe American lead hasn't disappeared. But it has retreated to a few, ever-narrower areas of the so-called frontier, the leading edge of what's technically possible. Where that lead still sits, and what it's worth economically, is the first question of this issue.\r\n\r\nThe second follows from it. If the model alone can't make a clear difference anymore, what does the lead rest on? Our thesis: less and less on the model, and more and more on the overall system around it, meaning the system where ongoing work produces the next models.\r\nWhat's left of the lead\r\nAt launch, Artificial Analysis had K3 in third place on its Intelligence Index with 57 points, right behind then-leaders GPT-5.5 and Opus 4.8. K3 improved most on agentic tasks, so exactly the hands-on work that matters in enterprise use. On AutomationBench-AA, K3 even debuted in first place until Anthropic answered with Opus 5.\r\n\r\nOn CEO-Bench, where an agent runs a fictional software company for 500 simulated days, K3 posted the best published single run at $22.15 million. Chinese models, including its predecessor K2.7, had regularly failed these long hauls. Qwen3.8-Max reaches a similarly high overall level. One caveat remains: Newer Chinese models sometimes burn far more tokens than Western ones, which eats into part of their price advantage. The cost-per-task math still applies.\r\n\r\nThe edge of current model capabilities has been growing at uneven speeds for a while, what researchers call the \"jagged frontier.\" Individual capabilities advance at different rates, which is why the much-quoted months-long gap always depended on who measured what. What's new is where a Western lead is still measurable at all. Three areas remain.\r\n\r\nThe first is abstract specialty tests. Shortly after K3's launch, Opus 5 retook the top of the index with 61 points, a small gap over K3's 57. On ARC-AGI-1, a test of abstract pattern recognition using small puzzle grids, K3 and Fable 5 - Anthropic's flagship line for coding and agent work - sit practically even at 94.5 and 98.5 percent. Only on ARC-AGI-2 does the gap widen: 60.4 versus 89.2 percent. But ARC-AGI deliberately measures abstract pattern recognition far removed from everyday tasks. There's no guarantee this gap predicts practical differences. It could simply stay economically irrelevant in most cases.\r\n\r\nThe second is reliability. The AA-AnalystAgent benchmark, launched August 12, tests agentic data analysis on real tables and documents. It only counts a task as solved if a model gets it right in five out of five independent runs, a measure the operators call pass^5. Opus 5 leads with 54 percent, ahead of GPT-5.5 at 50. K3 is the best open model at 39 percent.\r\n\r\nThe gap comes almost entirely from poor repeatability. K3 solves 73 percent of tasks at least once in five attempts, practically even with Opus 5 at 74. Reliability doesn't follow the usual intelligence-index rankings either. Even GPT-5.6 Sol falls behind its own predecessor here.\r\n\r\nCommercially, reliability weighs heavily, as the operators explain in their launch article. An analyst agent only saves work when its answers hold up without review. Multiple runs and checkers can compensate, but they drive up the cost per accepted result.\r\n\r\nThe third is cybersecurity. Here the gap is best documented. A joint assessment by the UK's AISI and the US CAISI found that K3 lags far behind leading US models in offensive cyber capabilities.\r\n\r\nOn ExploitBench, a test for developing exploits, K3 scored 32 percent. The top US models averaged about 76. K3 failed all 41 tasks that required executing code on a target system; leading US models solved 20 on average. And in a simulated attack, K3 made it to step 17 of 32, the US leaders to 28.5 on average.\r\n\r\nBut this gap is shrinking too. GLM-5.3, unveiled August 14, scores 54.4 percent on ExploitBench by Z.ai's own measurement, landing on more than double of its predecessor GLM-5.2. That cuts the distance to the US leaders roughly in half within a month. On finding and validating vulnerabilities in source code (CyberGym), GLM-5.3 even edges past the leading US models.\r\n\r\nAt the same time, cybersecurity is the one area where providers don't openly sell their strongest capabilities. Anthropic's best cyber model, Mythos 5, which hits 78 percent on ExploitBench, is only available under controlled conditions through Project Glasswing. Its public sibling Fable 5 effectively stays at the level of the older Opus 4.8 at 40 percent, because upstream safeguards intercepted 407 of 410 test episodes.\r\n\r\nOpenAI takes a similar approach with Daybreak and specialized cyber variants. GPT-5.6 Sol reaches 73.5 percent on ExploitBench in OpenAI's own evaluation but stays below Critical, the highest level on OpenAI's risk scale. With the upcoming Astra, OpenAI can't rule out for the first time that one of its own models crosses that threshold. If it does, the Preparedness Framework kicks in much harder, up to a full development halt. OpenAI has already paused some internal Astra work.\r\n\r\nAnd with GLM-5.3, a Chinese lab is adopting this pattern for the first time. Z.ai is delaying the weights release by about two weeks for extra safety work and plans to limit the most sensitive cyber functions to verified users.\r\n\r\nThe remaining lead adds up like this: The gap in abstract specialty tests is measurable, but its economic value is unclear. The reliability gap matters most commercially but is the least settled - when a newer model falls behind its own predecessor within the same lab (GPT-5.6 Sol vs. GPT-5.5), that ranking is clearly in flux.\r\n\r\nThe cybersecurity gap involves capabilities almost no customer can buy through regular channels, and even that gap has narrowed sharply of late. Only the few dangerous capabilities can be walled off. The commercially valuable rest, like coding, research, agent work, has to stay accessible through APIs, or there's no business. And that's where the lead shrinks within months.\r\n\r\nThe obvious suspicion is that the two are connected. Chinese labs could be using Western models as teachers through their APIs\u00a0 (the distillation mentioned earlier) and the lead would then hold exactly where that access is missing. There are good reasons for this suspicion, and we'll get into how Chinese labs might profit from the knowledge inside Western models below.\r\n\r\nBut first, for the strategic assessment, the question of guilt is almost secondary. If the suspicion is true, every capability sold eventually migrates to the competition, because there's still no reliable way to prevent the skimming. If it's not true, Chinese labs caught up on their own, and the lead was worth even less.\r\n\r\nBoth readings lead to the same place. A model lead only holds where the product isn't broadly offered in the first place, and you can't build a business on that. A close look at distillation is still worthwhile, because its mechanics decide whether any defensible model capabilities exist at all.\r\nDistillation explains the pace, not the breadth\r\nOpenAI and Anthropic accuse Chinese companies of using their models at scale to build their own. According to Anthropic, industrial campaigns by DeepSeek, Moonshot, and MiniMax ran more than 16 million interactions through around 24,000 fraudulent accounts. The campaign attributed to Moonshot targeted agent reasoning, tool use, coding, and reasoning traces with more than 3.4 million interactions. That fits with Together AI finding a 0.72 correlation between the task-level success rates of K3 and Fable 5 on real software problems, and with a style analysis by Typebulb placing K3 closest to Fable 5.\r\n\r\nCritics counter that the window between Fable 5's release and K3's was too short to influence training. But Opus 4.8, a closely related model, was available much longer, and the same studies show clear overlaps there too. OpenAI describes a similar pattern with DeepSeek in its memorandum to the US Congress. None of the labs has published verifiable evidence, though, and our inquiries with OpenAI and Anthropic turned up nothing new.\r\n\r\nStill, the known accusations and several research papers make it possible to reconstruct how Moonshot, DeepSeek, and others could benefit from distillation during training.\r\n\r\nIn pretraining, a model learns basic capabilities from massive amounts of text. Midtraining switches to less but higher-quality data, and post-training shapes behavior through supervised fine-tuning and reinforcement learning. Distilled data can plug in at almost any of these stages.\r\n\r\nA leading Western model answers tens of thousands of selected tasks, complete with solution paths and tool calls. The best answers flow into midtraining or fine-tuning, and the student model picks up the teacher's solution patterns.\r\n\r\nFor reinforcement learning, the teacher doesn't even need to be live anymore. The collected data can be used to build reward models.\r\n\r\nAnthropic's report shows this is no thought experiment. In the campaign attributed to DeepSeek, Claude processed grading tasks at scale using predefined rubrics, effectively serving as a reward model for someone else's reinforcement learning. Research on multi-teacher on-policy distillation and reward model distillation shows how the method works across entire training pipelines.\r\n\r\nThe hard limit is access: Anyone distilling through a foreign API only sees what the interface returns. Weights, internal evaluations, and search processes stay hidden. Research on black-box distillation describes exactly this constraint.\r\n\r\nThe rise of reasoning models opened another door, however: reading out the reasoning chains. Labs deliberately restrict that visibility. OpenAI provides only summaries of the chains of thought, Anthropic shows extended thinking in limited form, and xAI transmits reasoning encrypted.\r\n\r\nThe extraction was never fully preventable, though. A study published August by a team led by security researcher Alexander Panfilov shows that the encrypted reasoning traces of top models could be read out through an API vulnerability. The providers have since closed the gap.\r\n\r\nThe same paper delivers the most specific evidence yet for the distillation thesis. When K3's reasoning is prefilled with a few tokens from decrypted Opus reasoning traces, its answers shift measurably toward Opus. And individual Claude and GPT reasoning passages could be extracted from K3 up to six orders of magnitude more easily than from the next-most-similar model. The team also reads K3's weak cyber results as a clue: a strong teacher was hard to reach there, because Anthropic shields those capabilities with extra safeguards.\r\n\r\nThe Chinese labs' own substance argues against distillation as the full explanation. Moonshot's report documents a training pipeline built entirely in-house, and DeepSeek regularly publishes architecture improvements at the deepest level. GLM-5.3 also puts the cyber clue in perspective. Z.ai attributes its own jump to post-training effects - its own training environments, in exactly the area where a Western teacher is hardest to reach.\r\n\r\nDistillation isn't a Chinese specialty either. Elon Musk confirmed under oath that xAI used OpenAI models for it. ByteDance, meanwhile, claims to have post-trained Doubao-1.5-pro without data from other models.\r\n\r\nThe targeted labs are calling for government protection, and Washington seems willing to deliver. The White House has declared distillation campaigns against US models a national security threat by memorandum, the Deterring American AI Model Theft Act cleared committee unanimously, and senators followed up with the BLADE Act. Anthropic's Mythos 5 and Fable 5 are now under export controls - the first time the US government has controlled access to a model itself.\r\n\r\nThe broader step of restricting open models or distillation in general lacks wide support, though. In late July, 25 companies including Nvidia, Microsoft, and Meta warned against premature restrictions. OpenAI and Anthropic didn't sign.\r\n\r\nMark Zuckerberg then even declared learning from everything observable, including distilling competing models, a principle worth protecting. That's self-serving - Meta trails on closed models and wants to take on China with American open-weights models. But it shows something. When a company with these resources elevates learning from other models' outputs to a principle, it considers this one of the fastest ways to catch up.\r\n\r\nIn short: distillation can explain much of the pace, and the clues are plentiful. But as long as Anthropic and OpenAI don't disclose more, clues are all they are.\r\n\r\nEither way, everything US providers' APIs put out currently migrates to the competition within months. What they hide may only buy time, and no law makes outputs unobservable.\r\n\r\nThe only thing that holds is what's never offered in the first place - and you can't sell any of that. If the American lead is going to last, it has to live somewhere other than the model.\r\nWith agents, the whole system becomes the unit that matters\r\nDean Ball, co-author of the American AI Action Plan and now at OpenAI, argued before his move that systems acting autonomously for days raise entirely different questions than chatbots, like about liability, oversight, and control of running processes.\r\n\r\nWhat applies to responsibility applies equally to competition. Once value comes from workflows that run for days, it's no longer just models competing but the systems that carry those workflows: the control software around the model, the compute it gets, and the environment where it works with tools, permissions, and restore points.\r\n\r\nHow much this scaffolding matters can be measured, at least partly. The UK AI Security Institute shows that software engineering results rose about 25 percent when a model got ten million tokens per task instead of one million. Some cyber tasks only became solvable above that threshold.\r\n\r\nThe harness, meaning the control software, has an even bigger effect. When OpenAI merely kept the reasoning state between steps and compressed context differently in an ARC-AGI-3 evaluation, Sol's score nearly tripled, from 13.3 to 38.3 percent, at a sixth of the output tokens. Same model, different system, triple the performance.\r\n\r\nBut the control software only goes so far as a moat. Anyone who queries a foreign agent system intensively sees the tool calls alongside the answers and can learn orchestration patterns from them. And the harness is software in the end, as Anthropic learned this spring. In the Claude Code leak, an accidentally shipped source map exposed roughly 513,000 lines of source code, and the takedowns went nowhere because clones had long since preserved the architecture in public. Comparable harnesses are open anyway. OpenAI's Codex is open source, as are DeepSeek's agent tools.\r\n\r\nOnly one part of an agent system stays uncopyable: its running operation. The anchoring in customers' systems - credentials, test environments, logs, intervention rights - can't be queried or leaked. A competitor can only build it themselves, with their own infrastructure and their own customers.\r\n\r\nWhy is this position worth more than a model lead? The biggest driver of agent capabilities is reinforcement learning in purpose-built training environments, meaning programming tasks with tests, simulated tools, tasks with verifiable results, plus purchased expert knowledge, long since a billion-dollar market.\r\n\r\nBoth are available to anyone who can pay, including Chinese labs, which partly explains the catch-up. What can't be bought is knowing which tasks actually come up in real companies, where models fail there, and what customers accept as a result.\r\n\r\nArnaud Fournier, CTO of OpenAI's deployment subsidiary DeployCo, described how this feedback channel works in an interview with our editorial team. OpenAI doesn't train on customer data \"unless someone explicitly asks us to,\" and such research partnerships are rare, he says.\r\n\r\nInstead, the channel runs through model weaknesses and tool needs. If a team at a customer finds that document understanding works poorly, the research side sources targeted data and fixes it. That's how the solution built for the major bank BBVA improved markedly from GPT-5.0 to 5.5. And customers' orchestration needs first produced the open-source repository Swarm, then the Agent SDK.\r\n\r\nSo the channel carries less raw data than knowledge about what to build next. That's exactly what distillation doesn't copy. It copies the shipped model, never the access to the work the next one learns from. Whoever has that access builds training environments that match real work. Whoever only copies always learns from yesterday's state. The key contract question becomes what providers may carry over from customer deployments into their models and training environments.\r\n\r\nThis feedback channel shouldn't be overstated, though. Most progress still happens inside the labs, not at the customer. How much it will be worth depends on an open research question: how deployment experience turns into model capability at all.\r\n\r\nDwarkesh Patel sees the central obstacle to truly capable working agents in models' lack of continual learning, that is the ability to fold experience into their weights on the fly instead of learning only from model generation to model generation. Andrej Karpathy therefore puts agents about a decade away from true coworker status.\r\n\r\nNathan Lambert argues those weight updates are dispensable, because scaling plus better memory systems delivers practically the same thing. If he's right, the accumulated experience would live in data the customer controls, and the lock-in to the operator would be weaker.\r\n\r\nFor this issue's question, it makes no difference. The more real work agents take on, the more access to that work decides who can build the right models. A finished model can be copied. Access to the work the next one grows from cannot.\r\nUS labs tie model, compute, and platform together\r\nNo one is working harder to lock in that access than the labs whose model lead is shrinking. GPT-5.6 coordinates four agents by default at its highest effort level, OpenAI's Codex runs multiple tasks in parallel, now fully in the cloud, and Anthropic has comparable offerings in Claude Code and Claude Cowork. OpenAI's Ona acquisition adds secure execution environments, where customers control access, credentials, and security boundaries themselves.\r\n\r\nThe structure of DeployCo shows how seriously OpenAI takes this feedback channel. The company is a genuine spinout, launched together with 19 private equity firms, and embeds forward deployed engineers directly inside corporations - explicitly also to carry lessons back into product and research. Meanwhile, the Frontier Alliance with Accenture, Capgemini, BCG, and McKinsey scales the sales side.\r\n\r\nEven Nvidia is pushing the same development from the hardware side. The new Vera Rubin generation integrates sandbox environments for tool calls, context memory for long-running agents, and orchestration as part of the platform. The chip supplier increasingly sells the agent system, not just the accelerator.\r\n\r\nOn top of this and other hardware, the labs are building a second, physical line of defense: compute infrastructure.\r\n\r\nOpenAI co-founder and president Greg Brockman states the calculation most clearly. Open models aren't magically cheap, everything ultimately runs on the same hardware, and OpenAI is building out chips and data centers to make the cheapest offer for every task.\r\n\r\nBecause if the model becomes a commodity, the price per accepted result decides, and whoever integrates the stack from energy through their own chips to the model pushes that price down.\r\n\r\nIf the bet pays off, even a perfect model copy loses commercially, because the original offers the same capability cheaper at scale. That's still a goal, not reality, as the price advantages of Chinese models show.\r\n\r\nInfrastructure only becomes a moat in combination with the feedback channel. It provides the training capacity to turn deployment knowledge into the next generation, and the inference capacity to run agent swarms in parallel.\r\n\r\nThe buildout is still a bet. It only pays off if agent demand grows faster than models get more efficient. Sam Altman himself shows how open this math is when he calls the costs for businesses a huge problem.\r\n\r\nChina can neither distill this layer nor rent it through regular channels, since US export controls block access to the latest hardware. That leaves workarounds. One is smuggling - Operation Gatekeeper alone covered GPUs worth at least $160 million. The other is renting compute abroad.\r\n\r\nNeither replaces a sovereign stack, so China has to industrialize one, so far by throwing more hardware at the problem. Huawei's CloudMatrix384 links 384 Ascend accelerators and, according to SemiAnalysis, delivers more memory and peak compute than Nvidia's GB200 NVL72, but at about four times the power, with five times as many accelerators. The physical base is growing. China's energy administration already counts 42 AI clusters for 2025, each with at least 10,000 accelerator cards.\r\n\r\nBut more energy replaces neither memory chips nor software quality. SemiAnalysis currently sees HBM as the main bottleneck in Ascend production. And while Huawei's CANN - the counterpart to Nvidia's CUDA, the software layer of drivers, libraries, and programming tools developers use to run Ascend chips - supported DeepSeek V4 from day one for the first time, Nvidia's GB300 was clearly ahead in throughput.\r\n\r\nChina's policy therefore aims to spread its own stack beyond its borders, with a government action plan for data, compute, and standards. Open weights are becoming the bridge. As long as Chinese models run best on Nvidia's CUDA, they still indirectly strengthen the American stack. But if they get optimized for Ascend early, they make Chinese hardware attractive in third countries too. Nvidia CEO Jensen Huang warned about exactly this coupling, and DeepSeek V4's day-one support is early evidence the effort is paying off.\r\n\r\nThe conclusion cuts two ways. The benchmark race is winnable for China, as K3 and GLM-5.3 have shown. The industrialized overall system, by contrast, can't be copied, only built - and there the US labs are ahead. Not forever, but longer than a model advantage ever would be. Only what doesn't fit through the API is defensible: the knowledge from real work and the infrastructure to exploit it.\r\nDeploying a model means importing values\r\nFor everyone deploying models instead of building them - which describes the vast majority of European companies - another question comes up. What exactly do you take on when you adopt a model? Post-training decides which questions a model answers and which it refuses, which sources it treats as credible, and what it treats as proven. These decisions are normative, no benchmark measures them, and they come along unbidden at deployment.\r\n\r\nA recent audit by NewsGuard of chatbots from seven Chinese providers, including DeepSeek, Qwen, Kimi, and Z.ai, exactly the model families whose open weights see growing use, documents how large the differences are. On ten provably false pro-China claims, the Chinese bots left the misinformation unchallenged in 53 percent of cases. Western comparison systems: 24 percent.\r\n\r\nMost of this gap comes from silence. The Chinese bots refused to answer in 24 percent of cases, Western ones in 0.5 percent, and 88 percent of the refused prompts concerned Taiwan.\r\n\r\nBehind this is regulation that demands political conformity without defining its terms. Fittingly, the Chinese bots cited state media in 38 percent of cases, Western ones in 16 percent. The field isn't uniform. MiniMax debunked 85 percent of the false claims, while Baidu's Ernie repeated them 60 percent of the time.\r\n\r\nThis is dangerous mainly because the trained-in boundary sometimes only surfaces when a rare topic meets a real decision. The deeper the model sits in agent chains, the later the problem shows up and the further it cascades.\r\n\r\nIt can become a business problem fast: Asked about an alleged blockade of Taiwanese ports, DeepSeek confirmed the event in detail, even though it never happened. Anyone basing supply chain or investment risks on that is calculating with an invented world.\r\n\r\nAt least it isn't hardwired. According to NewsGuard, the lab CTGT reported that a model distilled from DeepSeek didn't carry over the political censorship. Values apparently sit in different training layers than capabilities. But someone has to do that work first.\r\nEurope needs system sovereignty\r\nFor Europe, this shift holds good news and bad. The good news: the race Europe lost most clearly, the one for the strongest finished model, is losing strategic value, because every model sold gets copied within months.\r\n\r\nThe bad news weighs more.:The layer where leads will be defended in the future can't be downloaded or skimmed. It has to be built. And there, the starting position is lopsided. The EuroStack initiative estimates that Europe imports over 80 percent of its digital infrastructure, and European providers hold only about 15 percent of the cloud market.\r\n\r\nThe convenient explanation is regulation, but the deficit predates the AI Act. AI builds on the infrastructure of previous digitalization waves, and Europe lacked both things that mattered there: platform giants with global clouds and the cash flows for billion-scale model training. Then there's the capital squeeze. By European Investment Bank calculations, US companies attract six to eight times as much venture capital each year, and a foreign investor leads four out of five large European funding rounds.\r\n\r\nAnd whoever puts up the money often moves the company abroad or buys it outright, as DeepMind, ARM, and most recently Silo AI show. Research isn't the problem. According to the JRC, about 21 percent of the world's publications on generative AI in 2023 came from the EU , but only about 2 percent of the related patent filings. Europe invents, others industrialize.\r\n\r\nThe reflex, common in parts of the European debate, to dismiss large language models as statistical parrots hasn't helped either. Whether transformers are the most elegant path to real intelligence is a different question from whether you need to control the systems built on them.\r\n\r\nMistral, of all companies, shows the direction is right. Europe's model champion has evolved into a full-stack provider and announced on August 11 regional endpoints, hosting for third-party open-weights models on its own platform, and pooled European compute demand, with up to one gigawatt of capacity planned by 2030.\r\n\r\nThat makes Mistral the only European provider with all three building blocks: its own models, its own platform, and planned compute capacity.\r\n\r\nThe offering still isn't complete. The endpoints don't yet support the agentic workloads this issue is about. And hosting others' open models has two weaknesses. Whoever runs Qwen collects the deployment knowledge, but Alibaba trains the next Qwen generation - Europe can only translate that knowledge into better models itself. Meanwhile, the model's trained-in value judgments run along unfiltered unless someone adjusts them in post-training.\r\n\r\nThe competition, meanwhile, is building the missing block right on European soil. OpenAI's DeployCo took over about 150 deployment specialists with Tomoro and is opening offices in Paris, London, and Munich.\r\n\r\nOn paper, the EU has recognized the problem. InvestAI is meant to mobilize 200 billion euros, 20 billion of it for AI gigafactories. The Cloud and AI Development Act is supposed to at least triple data center capacity, and Jupiter in J\u00fclich is running as the first European exascale system. Little of it is built. The gigafactory tender has been delayed several times, with the first facilities expected in 2027 at the earliest - while the four largest US companies alone are likely to invest around $700 billion in AI in 2026, three times the entire European initiative, which is stretched over years.\r\n\r\nAbove all, the money funds only part of what makes up the US labs' lead. As the previous chapters showed, that lead rests on a cycle: compute capacity trains models, the models work in agent systems at customers, and that deployment produces the knowledge for the next generation.\r\n\r\nThe gigafactories only cover the first step. It's a necessary one, because without your own compute, every layer above stays open to coercion, as China's forced hardware detours show. But the cycle doesn't close in the data center. It closes at deployment.\r\n\r\nThat leaves the obvious answer of betting fully on American and Chinese open-weights models. Three objections stand against it.\r\n\r\nThe first concerns supply. There's no entitlement to the next open generation, and its release remains a revocable business decision. Meta held back its announced Behemoth model. Multimodal Llama models never shipped to EU companies for licensing reasons. The US put export restrictions on Fable 5 and Mythos 5, which for Fable 5 only lifted again after 18 days. According to Reuters, Beijing is weighing restrictions on foreign access to China's best models, explicitly including open ones. And even Z.ai is initially holding back the weights of GLM-5.3.\r\n\r\nBehind this looms a deeper break. In an interview study with 25 researchers at leading labs, only four of twenty respondents expected that models capable of automating AI research itself would ever ship as a product. The majority expects the strongest versions to stay in-house, where they widen the lead instead of selling it.\r\n\r\nThe accessible market, open or via API, would then only reflect the second tier. That also tempers the good news from the start of this chapter: only what's sold can be copied.\r\n\r\nThe second objection follows from the previous chapter. Whoever deploys a foreign model takes on its trained-in worldview - state-mandated censorship with Chinese models, and the content policies of private corporations with American ones, which can shift with every change of power in Washington.\r\n\r\nSystem sovereignty therefore also needs a normative layer: independent evaluation infrastructure that measures information integrity and refusal behavior alongside capabilities, plus the capacity to adjust open models in post-training. The CTGT finding shows it's technically possible. Whether anyone in Europe does it systematically and auditably remains open.\r\n\r\nThe third objection: even homegrown models don't add up to sovereignty, because sovereignty is vulnerable on every layer of the stack individually. China, of all places, proves the point. Alibaba and ByteDance control the model layer and own domestic data centers. But the latest Nvidia chips can't enter the country, the available alternatives deliver far less per chip and watt, and both companies have reportedly fallen back on rented Nvidia hardware at foreign operators to train their flagship models.\r\n\r\nAnd Europe has experienced firsthand how quickly a layer someone else controls turns into a political weapon. When the US sanctioned the chief prosecutor of the International Criminal Court, Microsoft cut off his email access. Sovereignty is only ever as strong as the weakest layer someone else controls.\r\n\r\nA decisive new layer is now joining these: access to real work. Freely available internet data is largely tapped out. What makes models better going forward is expert knowledge, process know-how, and deployment experience - partly as purchased training data, a market that became a billion-dollar business in short order, but above all as knowledge about which capabilities are worth training.\r\n\r\nA finished model can be copied. Access to the work the next one learns from cannot. Whoever runs the systems this work flows through earns twice: from the current model's work, and from knowing what the next one needs to do, made possible by reinforcement learning.\r\n\r\nFor Europe, more is at stake than a business opportunity, because this touches the foundation of its position in the world. Europe's weight comes from its single market, its power to set standards, and its high-value knowledge work.\r\n\r\nThat work is under pressure from two sides. AI devalues it, already visible in the shrinking entry-level market for junior developers, and AI simultaneously transfers it into foreign systems.\r\n\r\nOn top of the familiar drain through company sales comes a second, faster channel. Expertise now flows piecemeal into foreign models through data vendors that broker experts to the labs, and through deployment units that embed themselves in core European processes. It would be an exodus not to lower-wage countries, as manufacturing once saw, but into foreign AI models. This time, it's intellectual capital leaving.\r\n\r\nAt the same time, this very work is Europe's biggest asset in this competition. It's the raw material the model race will be fought over, and Europe has a lot of it.\r\n\r\nIf it runs through foreign systems, Europe pays twice: it supplies the knowledge and buys the results back as the next model generation. If it runs through its own, the largest deployment market becomes a structural advantage for the first time.\r\n\r\nBut this opportunity expires differently than a model deficit. Access can't be copied or bought back later. It can only be claimed while it's still free. Claiming it means closing the cycle of compute, models, and deployment on European soil.\r\nThe lead is moving from the model into operations\r\nChinese open-weights models have largely caught up with the US leaders on common benchmarks. The remaining Western lead sits only in abstract specialty tests, in repeat reliability, and in offensive cyber capabilities and it's shrinking there too. From this follows the thesis of this piece: a model lead is not defensible. Everything sold through APIs can be copied within months. What remains defensible is the overall system of compute infrastructure, agent platform, and the feedback channel from real customer deployments. And exactly there, Europe lags structurally.\r\nBaseline\r\nBenchmark convergence continues. Chinese labs keep catching up in individual disciplines, while US labs hold a narrow, shifting lead in reliability and in shielded high-risk capabilities. Price competition moves the contest to cost per accepted result, while US providers cement their position through deployment units, agent platforms, and data center expansion. Distillation accusations, export controls, and legislative efforts continue without stopping the skimming in practice. Europe stays a user. Mistral builds out its own stack, EU programs kick in from 2027 at the earliest, and the feedback channel from European knowledge work runs mostly through foreign systems.\r\nAcceleration\r\nDrivers would be a working Chinese hardware stack, with the HBM bottleneck solved and a mature CANN software layer, plus early optimization of open models for domestic chips. Chinese models would then become a default choice in third countries as well. At the same time, the cycle closes faster on the US side because agents take over longer chains of work and deployment knowledge flows into training environments more quickly. The strongest models would then stay in-house as internal systems, as the cited researcher survey expects, and the accessible market would only reflect the second tier. Models would become a commodity, and margins would migrate to infrastructure and deployment. Europe would fall behind and lose its option at the same time, because access to its own knowledge work would be claimed before its own capacity exists.\r\nSlowdown\r\nThree factors act as brakes. The reliability gap on the pass^5 measure proves stubborn because it doesn't improve with scale. Agent demand lags behind the capacity buildout and makes the infrastructure bet expensive. Export controls, distillation laws, and Beijing's contemplated export restrictions slow the flow of open weights in both directions. If the breakthrough in continual learning or in viable memory systems also fails to arrive, the feedback channel from customer deployments stays a roadmap item for a long time rather than a source of advantage. The result would be a longer plateau where the model lead gains relative value because reliability stays scarce, while falling compute prices help laggards. Europe would get a window, but only those who have built compute capacity and deployment expertise by then can use it.\r\nOur take\r\nThe baseline scenario with a tilt toward acceleration is most likely. Continued convergence is supported by the fact that both possible explanations, distillation or homegrown substance, lead to the same result. None of the countermeasures so far works technically either, since model outputs can't be made unobservable. The hardware side argues against rapid acceleration: the HBM bottleneck, the efficiency disadvantages of Ascend clusters, and software maturity aren't questions of months. For European users, the choice of scenario changes little. In all three cases, what matters is whether deployment knowledge and norm-setting stay within their own reach. And whoever wants that has to run the systems themselves, not just buy the models.\r\nGround truth: sources and deep dives\r\nExternal sources:\r\n\r\n \tArtificial Analysis \/ Claude Opus 5 tops the Intelligence Index\r\n \tARC Prize \/ Moonshot Kimi K3 results on ARC-AGI\r\n \tARC Prize \/ Anthropic Claude Fable 5 results on ARC-AGI\r\n \tArtificial Analysis \/ AA Analyst Agent benchmark\r\n \tUK AI Security Institute \/ Preliminary assessment of Kimi K3's cyber capabilities\r\n \tOpenAI \/ GPT-5.6\r\n \tOpenAI \/ Responding to next-frontier critical cyber capabilities\r\n \tOpenAI \/ Preparedness Framework version 2\r\n \tTogether AI \/ Kimi K3 vs. Claude Fable 5: cost and coding performance\r\n \tTypebulb \/ Style analysis of Kimi K3 and Fable 5\r\n \tOpenAI \/ Memorandum to the US Congress on DeepSeek and model distillation\r\n \tarXiv \/ Multi-teacher on-policy distillation\r\n \tarXiv \/ Reward model distillation\r\n \tarXiv \/ Research on black-box distillation\r\n \tOpenAI Developers \/ Reasoning and chain-of-thought summaries\r\n \tAnthropic \/ Extended thinking\r\n \txAI \/ Reasoning with encrypted traces\r\n \tarXiv \/ Extracting encrypted reasoning traces from frontier models\r\n \tarXiv \/ Moonshot Kimi K3 technical report\r\n \tTechCrunch \/ Elon Musk testifies that xAI trained Grok on OpenAI models\r\n \tByteDance Seed \/ Doubao-1.5-pro\r\n \tWhite House \/ Promoting Advanced Artificial Intelligence Innovation and Security\r\n \tITIF \/ How to fix the AI model theft bill before it becomes law\r\n \tUS Senator Bill Hagerty \/ Blocking Large-Scale Adversarial Distillation Efforts (BLADE) Act\r\n \tForbes \/ Distillation: the new US-China AI fight\r\n \tCNBC \/ Nvidia, Microsoft, and Meta warn against restricting open-weight AI models\r\n \tMeta \/ The future is for everyone\r\n \tDean Ball \/ Where we are headed\r\n \tUK AI Security Institute \/ More compute, more capability\r\n \tOpenAI \/ How two settings tripled our ARC-AGI-3 scores\r\n \tInfoQ \/ Claude Code source leak\r\n \tDwarkesh Patel \/ The era of continual learning\r\n \tNathan Lambert \/ Contra Dwarkesh on continual learning\r\n \tSemafor \/ OpenAI's Greg Brockman on distillation as a technical problem\r\n \tUS Department of Justice \/ Operation Gatekeeper shuts down major China-linked AI chip smuggling network\r\n \tarXiv \/ Huawei CloudMatrix384\r\n \tSemiAnalysis \/ Huawei AI CloudMatrix 384: China's answer to Nvidia GB200 NVL72\r\n \tChina's National Energy Administration \/ AI clusters and compute infrastructure 2025\r\n \tSemiAnalysis \/ Huawei Ascend production ramp and the HBM bottleneck\r\n \tSemiAnalysis InferenceX \/ DeepSeek V4 on Nvidia and Huawei hardware\r\n \tChinese government \/ Action plan for data, compute, and AI standards\r\n \tJensen Huang \/ Dwarkesh podcast on Chinese models, hardware, and open weights\r\n \tNewsGuard \/ Audits of news quality and misinformation in AI chatbots\r\n \tBertelsmann Stiftung \/ EuroStack: a European alternative for digital sovereignty\r\n \tEuropean Investment Bank \/ The scale-up gap\r\n \tJoint Research Centre \/ Generative AI research and patents in Europe\r\n \tMistral AI \/ Regional inference, open models, and new compute\r\n \tEuropean Commission \/ InvestAI initiative to mobilize 200 billion euros for AI\r\n \tTech Policy Press \/ EU Cloud and AI Development Act tracker\r\n \theise online \/ Jupiter: Europe's fastest supercomputer comes up to speed\r\n \tarXiv \/ Interview study with researchers at leading AI labs\r\n\r\nTHE DECODER articles:\r\n\r\n \tTHE DECODER \/ Subscription\r\n \tTHE DECODER \/ Frontier Radar #1: From chatbots to problem solvers - the state of AI agents in 2026\r\n \tTHE DECODER \/ Frontier Radar #2: Why AI productivity gets lost between benchmarks and the balance sheet\r\n \tTHE DECODER \/ Frontier Radar #3: How agentic AI is turning tokens into a business metric\r\n \tTHE DECODER \/ DeepSeek R1 matches OpenAI's o1 reasoning performance in benchmarks\r\n \tTHE DECODER \/ OpenAI beats DeepSeek surprisingly clearly in Google's latest reasoning benchmark\r\n \tTHE DECODER \/ Zhipu AI's GLM-5.2 catches up to the closed-source leaders in coding marathons\r\n \tTHE DECODER \/ Like DeepSeek before it, China's Kimi K3 shakes the Western AI consensus\r\n \tTHE DECODER \/ Anthropic courts investor trust ahead of record IPO\r\n \tTHE DECODER \/ Kimi K3: New open Chinese model catches up to Western frontier models\r\n \tTHE DECODER \/ AI agents as startup CEO: benchmark has language models run a company for 500 days\r\n \tTHE DECODER \/ Qwen3.8-Max: Alibaba's strongest model guesses more often and costs more per task\r\n \tTHE DECODER \/ AGI benchmark ARC remains unsolved in 2024 despite clear progress\r\n \tTHE DECODER \/ ARC-AGI-2 benchmark stumps even the most advanced AI systems\r\n \tTHE DECODER \/ Open AI models are getting cheaper and more dangerous, shrinking the window for cyber defenders\r\n \tTHE DECODER \/ Zhipu AI releases GLM-5.3, China's new open-weights model billed as the strongest for code\r\n \tTHE DECODER \/ Anthropic releases Claude Fable 5 and Mythos 5 with a big jump in coding and science\r\n \tTHE DECODER \/ Claude Fable 5: What the first public Mythos model can do and where it fails\r\n \tTHE DECODER \/ OpenAI's GPT-5.6 Sol nearly matches Claude Fable 5 in benchmarks at a third of the cost\r\n \tTHE DECODER \/ DeepSeek, Moonshot, and MiniMax: Anthropic criticizes systematic data theft from China\r\n \tTHE DECODER \/ System 2 distillation bakes AI reasoning into language models\r\n \tTHE DECODER \/ Researchers extract hidden reasoning processes from ChatGPT, Claude, and others\r\n \tTHE DECODER \/ Meta's new open AI model ships with a plea for learning from competitor data and a 600 billion dollar question\r\n \tTHE DECODER \/ Researchers redefine AI agents: code shifts from output to operating layer\r\n \tTHE DECODER \/ The end of cheap labor: AI companies bet on expensive experts for training data\r\n \tTHE DECODER \/ In conversation with OpenAI's DeployCo CTO on winning the global B2B market\r\n \tTHE DECODER \/ OpenAI releases experimental multi-agent framework Swarm\r\n \tTHE DECODER \/ OpenAI updates Agents SDK with new sandbox support for safer AI agents\r\n \tTHE DECODER \/ Andrej Karpathy resets expectations for agentic AI\r\n \tTHE DECODER \/ OpenAI launches ChatGPT Work and makes GPT-5.6 available to everyone\r\n \tTHE DECODER \/ OpenAI launches Codex app for macOS to manage multiple AI agents\r\n \tTHE DECODER \/ OpenAI buys German AI startup Ona so Codex agents keep coding with the laptop closed\r\n \tTHE DECODER \/ New subsidiary DeployCo is meant to be OpenAI's moat against AI rivals\r\n \tTHE DECODER \/ Nvidia CEO: The idea that AI will soon destroy all software and tools is ridiculous\r\n \tTHE DECODER \/ Price war between OpenAI and Anthropic: tokens could get cheaper\r\n \tTHE DECODER \/ DeepSeek V4 runs on Huawei chips to showcase China's chip independence\r\n \tTHE DECODER \/ How China rose to the top of AI with open-weight models in 2025\r\n \tTHE DECODER \/ China exports state propaganda with cheap open source AI models\r\n \tTHE DECODER \/ Europe uses more AI than the US, but the profits flow to America\r\n \tTHE DECODER \/ China weighs an export brake for its best AI models, squeezing Europe further\r\n \tTHE DECODER \/ Meta releases first multimodal Llama 4 models, leaving the EU out\r\n \tTHE DECODER \/ On US government orders, Anthropic locks down Fable 5 and Mythos 5 worldwide\r\n \tTHE DECODER \/ US government clears Anthropic's Fable 5 for release again\r\n \tTHE DECODER \/ AI displaces entry-level workers: young software developers lose jobs fastest\r\n", "isAccessibleForFree": "False", "hasPart": { "@type": "WebPageElement", "isAccessibleForFree": "False", "cssSelector": ".paywall-active" } }