China is about to run the largest influence operation in history. It will not have to run it. The world will download it.
Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm with ties to the Chinese state. It built a machine for shaping opinion in other countries: A.I. that generates personas, amplifies the stories Beijing wants believed and buries the ones it does not. It was used in Hong Kong. It was used in Taiwan. That is an influence operation built by hand, one persona at a time.
Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones anyone can download, modify and run on their own machines — become the foundation the world builds on, the Party's framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. GoLaxy would look like a rehearsal.
Here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy is what is putting them there.
Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models whose safeguards can be stripped away. Restrictions would not kill demand for a cheap model a company can download and make its own. China is standing at the counter with exactly that.
We talk about the A.I. race as if it has one finish line. It has two. The first is for frontier capability: who builds the most advanced models. American companies lead today. The second is for reach: whose models become the foundation under thousands of products. Chinese firms may be building the advantage there. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know.
American frontier models such as Claude, ChatGPT and Gemini are closed: you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to.
This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen even briefly powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. The model underneath is not.
Chinese developers operate under Communist Party rules about what may be said. Those rules shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will tune what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.
Beijing already believes this. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's A.I. ecosystem with information the Party censors. Washington should take seriously a vulnerability Beijing recognized first.
None of this makes the open-weight safety problem smaller. It makes it bigger. Once a powerful open-weight model is out, its developer cannot recall it. Its safeguards can be stripped and the model turned toward cyberattacks, biological weapons or worse. Testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.
Constrain American developers and leave foreign weights untouched, and demand shifts toward Chinese models. Washington ends up regulating the companies it can see while deepening its dependence on the ones it cannot.
Washington could ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.
TikTok offers a glimpse of the stakes. More than 150 million Americans use it, and more than 50 million regularly get news there. Add DeepSeek or Qwen to generate the content TikTok’s algorithm selects and distributes, and China could supply both the information and the system that delivers it to an enormous audience.
The United States therefore faces a trilemma. It wants to prevent the uncontrolled release of dangerous A.I. capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models shaped inside an authoritarian system. It cannot fully secure all three.
Honest regulation starts by admitting that. Before restricting an American model, ask which model developers will pick instead. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.
A.I. leadership is two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. A.I. risk is two things as well: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed what Beijing does with a machine for shaping belief. Open weights are how it gets one in every pocket. And right now, Washington is holding the door.
Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
