What Beijing Calls Open, Washington Should Call an Operation

China is about to run the largest influence operation in history. It will not have to run it. The world will download it.

EXPERT PERSPECTIVE -- Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm - with ties to the Chinese state - that built a machine for shaping opinion abroad. Using AI, it generates personas, amplifies narratives that are favorable to Beijing and buries narratives that are not. And it’s been busy. It was used in Hong Kong to combat dissent against the National Security Law. It was used in Taiwan to sway the island’s 2024 [HWR1] elections.

Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones that anyone can download, modify and run on their own machines — become the foundation that the world builds on, then the Chinese Communist Party’s (CCP) framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. Something like this would make GoLaxy look like a dress rehearsal.

And here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy could allow it to happen. Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models (whose safeguards can be stripped away). Here’s the deal though: restrictions would not kill demand for a cheap model that a company can download and make its own. China is standing at the counter with exactly that.

Today, we talk about the AI race as if it has one finish line. But it has two. The first is for frontier capability: who builds the most advanced models. American companies lead the way today. The second finish line is for reach: whose models become the foundation on which thousands of products are built? Chinese firms may have the advantage on this one. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know and will learn in the future.

American frontier models like Claude, ChatGPT and Gemini are closed, meaning you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to. The babysitter has left the building.

This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen, even briefly, powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. But the model underneath it is not.

Here’s something else to consider: Chinese developers must operate under Communist Party rules about what may be said. Those rules then shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will focus their efforts on addressing what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.

Beijing already knows about this risk. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's AI ecosystem with information that the CCP censors. It seems to make sense that Washington should take seriously a vulnerability that Beijing recognized first.

None of this makes the open-weight safety problem smaller. In fact, just the opposite. Once a powerful open-weight model is released, its developer cannot recall it. Its safeguards can be stripped away and the model can be used for cyberattacks, the creation of biological weapons or worse. If we’re going to address this as a society, then testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.

If we constrain American developers and leave foreign weights untouched, demand will certainly shifts toward Chinese models. Theoretically, Washington could end up regulating the companies it can see while deepening its own dependence on the ones it cannot.

One answer might be to ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.

TikTok offers a glimpse of the stakes. More than 170 million Americans use it, and tens of millions say they get their news there. Washington spent five years fighting over its recommendation algorithm, and the deal that kept it in the United States required a change to that algorithm. But an algorithm only ranks videos that people make. While that fight dragged on, AI models learned to make the videos themselves — realistic footage with synced audio, from a sentence, in seconds. Three months after the deal closed, TikTok upgraded its ad tools to ByteDance’s newest video model. No rule required anyone to ask whose model was making the videos.

Now, you can see why the United States is facing a trilemma. It wants to prevent the uncontrolled release of dangerous AI capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models that are shaped inside an authoritarian system. It cannot fully secure all three.

Honest regulation starts by admitting that. Before restricting an U.S. model, ask which model developers will pick first. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.

AI leadership combines two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. AI risk also combines two things: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed us what Beijing can do with a machine to shape a belief. Now, what are we going to do about it?

Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.