Export Controls in AI Security

In 1942, Soviet physicist Georgy Flerov noticed something odd: the scientific world had gone quiet. For years, papers on nuclear fission and neutron behaviour had been appearing regularly. Then, suddenly, silence. No new publications, no data, no discussion. Flerov took this absence as the loudest signal of all. He warned Stalin that the Americans were almost certainly working on a secret bomb. Stalin believed him, and the USSR’s atomic programme began. The pattern was clear: when scientists stop talking, something serious is happening. There is growing, documented evidence of rising secrecy in frontier AI development. The signals are not speculative. They are measurable and accumulating. According to Stanford’s 2025 AI Index, the performance gap between leading open-weight and closed models narrowed sharply from 8% to just 1.7% on some benchmarks within a single year. Yet access to frontier systems remains increasingly restricted, offered only via APIs rather than as open-weight models. Google DeepMind now enforces a six-month embargo on strategic generative AI research, as reported by the Financial Times. Internal vetting procedures require multiple levels of approval for each paper. OpenAI’s GPT-4 technical report explicitly states that it contains no details about the model’s architecture, size, training compute, dataset construction, or training methods. This contrasts with earlier models such as GPT-2 and GPT-3, which disclosed substantially more technical information. The United States has enacted export controls on high-end AI chips, including Nvidia’s A100 and H100 processors, restricting their sale to China and other countries. These controls were first introduced in October 2022 and expanded in October 2023. China, in turn, requires state approval through security assessments and algorithm filings before companies can release generative AI services to the public, with these rules taking effect in August 2023. This pattern of increasing secrecy across models, publications, and state controls suggests a clear shift away from open science towards strategic competition in AI development. The combination of restricted model access, publication embargoes, extreme opacity around flagship systems, and government-led export controls mirrors historical indicators of strategic technology mobilisation. Unlike World War II, there is no single global project. Yet the decentralised actions of corporate labs and states together form a picture of geopolitical competition with classified dimensions. Taken together, these trends mirror the same warning signs Flerov observed in 1942: a sharp decline in open discourse in the face of strategic sensitivity. The difference is that this time there is no single government programme. The secrecy is decentralised, managed by corporate labs, enforced through commercial NDAs, guided by national security agendas, and shaped by geopolitical tension.

Why did NVIDIA, the darling of the AI market, drop 2.5% today? The Biden administration dropped the mic (and some weighty export controls) on AI chips and models—arguably the most aggressive attempt yet to regulate the flow of transformational tech. Let’s break it down: 🧩 A Three-Tier System of Access ⏩ 🥇 Top Tier: AI flows freely for 19 nations (G7 + allies like Japan, South Korea, and Taiwan). 🥈 Middle Tier: Most of the world faces caps but can negotiate for more chips by aligning with US policy interests 🥉 Bottom Tier: China and Russia? Completely locked out—no chips, no dice, no exceptions. 🔐 Locks on AI’s Crown Jewels ⏩ Firms must keep 75% of their AI computing power in the U.S. or allied nations, with no more than 7% in any other country. Data center operators like Microsoft and Google will need accreditation to trade AI tech freely, tightly aligning with U.S. security goals. 🤖 New AI Model Parameters ⏩ For the first time, restrictions extend to the very DNA of AI: model weights. Overseas data centers must implement strict safeguards to protect this intellectual property. Officially, it’s about national security: keeping AI away from adversaries like China and Russia. But unofficially? It’s about locking in dominance. It’s a strategic move to control the future of AI innovation and adoption. Pushback is already fierce. Nvidia has called the rules “misguided,” warning that global buyers will pivot to non-U.S. suppliers. Restricting friendly nations like Israel, Mexico, and Switzerland could also strain diplomatic ties. And let’s not forget the unintended consequence: Balkanization of the AI ecosystem. Countries and companies excluded from the U.S.-led framework may double down on domestic R&D or turn to less-restricted alternatives (hello, China). That could erode America’s soft power over time. This is the tech Cold War. Chips are the new oil. Code is the new currency. If these controls stick, the big question is whether they will cement U.S. dominance—or just fuel the competition.

As a former chip designer, this one was especially interesting to write.  My latest piece for The Economist investigates the shadow supply chains keeping China in the AI race—despite increasingly strict U.S. export controls. Key takeaways: 👉 Chinese firms lease restricted chips through offshore data centres, especially in Malaysia 👉 Singapore, with few actual chip end-users, is now Nvidia’s second-biggest market 👉 Smugglers route chips via third countries using doctored paperwork and front companies 👉 U.S. enforcement is stretched: one officer covers all of South-East Asia 👉 Ideas like a “kill switch” are really bad 👉 I am sympathetic to Nvidia's view that these controls are not the right way to beat China, innovation is. Read the full story here: https://lnkd.in/eZmfaGNb #AI #Semiconductors #Nvidia #China #Geopolitics #Chips #TechPolicy #TheEconomist

Today, the Select Committee on China released a new investigation, Buy What It Can, Steal What It Must: China's Campaign to Acquire Frontier AI Capabilities, detailing how China uses legal and illegal means to build its own semiconductor production and the development of artificial intelligence.   "Artificial intelligence sits at the center of U.S.-China competition, and both governments treat leadership in AI as a national security priority," the investigation writes.   "Beijing wants control of the full AI stack, not just competitive applications," it continues. "Beijing is pursuing that autonomy to strengthen its military, harden itself against foreign pressure, and keep the technologies underpinning future economic and military power under Party-state control."   During the investigation, the committee found that China: ➡️ Remains the largest market for chipmaking equipment despite restrictions. ➡️ Lawfully procures large volumes of advanced AI chips. ➡️ Utilizes sophisticated smuggling networks to acquire restricted AI chips. ➡️ Extracts frontier capabilities from American AI developers through industrial-scale fraud. The investigation concludes that America and its allies still control key chokepoints that will dictate China’s AI potential. It also makes several policy recommendations, including: ➡️ Passing the MATCH Act (H.R. 8170), which would require the State Department and the Commerce Department to first seek aligned restrictions with U.S. allies and then close any remaining gaps on their own through foreign direct product rules, minimum U.S.-content thresholds, or end-use controls. ➡️ Passing the AI OVERWATCH Act (H.R. 6875) to require export licenses for advanced AI chips destined for countries of concern, replacing the current review process with affirmative government oversight of the most consequential transactions. ➡️ Passing the SCALE Act to set export limits based on China’s own production capacity. This prevents China from importing advanced American AI chips when it has no at-scale alternative. ➡️ Passing the Remote Access Security Act (H.R. 2683) to give BIS the authority to restrict cloud access in the same way that it controls exports, which would simplify the implementation of cloud restrictions. Full report: https://lnkd.in/gDv_2p7u

⚠️ Export Control Intelligence: The EU has just made national control lists much more visible. Are you ready? Today, 3 July 2026, the European Commission published the first Compilation of National Control Lists under Article 9(4) of the EU Dual-Use Regulation (EU) 2021/821. This may look like a simple administrative publication. It is not. It is another sign that export controls are evolving beyond a single EU control list into a dynamic, multi-layered regulatory environment. The compilation includes national controls adopted by several Member States, including Spain, Finland and the Netherlands, covering technologies such as: ✅ Advanced semiconductor manufacturing equipment ✅ AI processors and high-performance integrated circuits ✅ Quantum computers and related technologies ✅ Photonic integrated circuits ✅ Hybrid bonding equipment ✅ Advanced lithography and metrology equipment ✅ Certain energetic materials and critical chemicals ✅ Telecommunications surveillance technologies But perhaps the most important point is not what is listed. It is how the system works. Under Article 10 of Regulation (EU) 2021/821, other Member States may decide to introduce export authorisation requirements based on another Member State's national control list. In other words: ➡️ National controls can increasingly influence export licensing decisions across the EU. For exporters, this creates a new reality: Monitoring Annex I is no longer sufficient. National measures must also be monitored. Compliance becomes a continuous intelligence exercise—not a once-a-year legal review. This is precisely why export control is moving from a compliance function to an intelligence function. At WZ52, this evolution is at the heart of what we are building: an intelligence platform capable of monitoring regulatory changes, connecting them with products, technologies, customers and transactions, and turning regulatory complexity into actionable business intelligence. Because in export controls... The companies that detect change first will make better decisions first. #ExportControls #DualUse #EUCompliance #Semiconductors #QuantumTechnology #TradeCompliance #ComplianceIntelligence #ExportControlIntelligence #WZ52 #RiskManagement

The one person who actually read the report that got #Fable and #Mythos export-controlled says the #jailbreak was: "fix this code." Katie Moussouris - who wrote the bug bounty playbook the rest of us use, and who sat on the team that fixed the Wassenaar export controls last time they swept up defenders - is the only outside expert who read the paper. Her summary: researchers handed the model code with known and planted bugs, asked it to review for security issues (Fable refused), then asked it to fix this code and wrote some test scripts by hand. That's it. That's the munition. Her line is going on a t-shirt: "fix this code" on the front, "this shirt is a munition" on the back. If you were around for the crypto wars, you've seen this movie - they tried to export-control #PGP source code too. Here's why it isn't funny. ~54 of us signed an open letter to Commerce on this - Alex Stamos, Paul Vixie, Chris Wysopal, Dan Lorenc, Rachel Tobac, Casey Ellis, security leads from NVIDIA, Vercel, Sophos, Socket, Chainguard. People who agree on almost nothing about #AI regulation, agreeing on one thing: you cannot export-control your way to cyber resilience. The capability under control is "ask the model to find and fix the bugs in my own code." That is the single most useful thing AI does for defense - the find-fix-test loop every security team runs every day. You cannot remove it without making the model worse at defending. And the attackers don't care: #GPT-5.5, #Opus, #Sonnet, and Chinese open-weight models like #Kimi 2.7 do the same thing, today, beyond the reach of any US export control. So the control does exactly one thing: it takes the best tools away from defenders and leaves them with adversaries who never used the export channel in the first place. Find the same bugs attackers find and fix them faster. That's the whole game. Don't kneecap the people trying to play it. Kathie's blog: https://lnkd.in/eEc6UveZ Lift the controls: freefable.org #freefable #braveaiworld

A new paper from Tsinghua University, Microsoft Research Asia, and Wuhan University demonstrates why export controls matter and why they're not sufficient. The research team developed SynthSmith, a synthetic data pipeline that trained a 7 billion parameter coding model to outperform models twice its size—using zero real-world data. All of it running on 128 NVIDIA H20 chips and 32 H200s. Three observations: First, the study's lead author explicitly stated that computational constraints—not limitations of the pipeline itself—are what's preventing them from scaling to 100B+ parameter models. This is quiet validation that compute restrictions have real effect. When Chinese researchers cite GPU access as their binding constraint, it suggests the export control framework is creating meaningful friction. Second, the synthetic data trend deserves serious attention as a potential offset to that friction. Techniques that allow smaller models to match larger ones, or that reduce dependence on scarce real-world training data, represent exactly the kind of algorithmic efficiency gains that can partially compensate for hardware limitations. Expect more research in this direction. Third, and most directly: why is Microsoft Research Asia co-authoring papers that advance Chinese AI capabilities? The chips question gets the headlines, but corporate research collaboration may be the more significant channel for technology transfer. Export controls on hardware mean little if American companies are helping develop the methodologies that make the most of constrained resources. The AI competition isn't just about who has the most GPUs. It's increasingly about who can do more with less—and whether US policy addresses all the vectors that matter. Link to the article in the comments. #AICompetition #ExportControls #USChinaTech #TechPolicy

Anthropic just published something that deserves more attention than it will probably get. The company disclosed this week that three Chinese AI labs—DeepSeek, Moonshot AI, and MiniMax—ran coordinated, industrial-scale operations to secretly extract capabilities from Claude. The technique is called "distillation": generate massive volumes of outputs from a stronger model, then train your own weaker model on those outputs. Legitimate when you do it with your own models. Theft when you do it with someone else's. The numbers: across ~24,000 fraudulent accounts, the three labs generated over 16 million exchanges with Claude. They used commercial proxy services running "hydra cluster" architectures—sprawling account networks mixing distillation traffic with legitimate requests to defeat detection. When Anthropic banned accounts, new ones took their place. When Anthropic released a new model mid-campaign, MiniMax pivoted within 24 hours. That's not opportunism; that's a disciplined program. Attribution is unusually specific. Anthropic traced campaigns to individual researchers at DeepSeek through IP correlation, request metadata, and infrastructure indicators—cross-checked with industry partners who observed the same actors on their own platforms. The national security dimension matters most. Frontier labs build safeguards into their models to prevent assistance with bioweapons development, offensive cyber, and mass surveillance. Distilled models are unlikely to retain those safeguards. The dangerous capabilities propagate; the guardrails don't. This also lands squarely in the export control debate. Critics argue chip restrictions are futile because Chinese labs are advancing anyway—DeepSeek's January breakthrough being the prominent exhibit. Anthropic's counter: those advances depend significantly on illicitly extracted American capabilities. The rapid progress isn't purely indigenous innovation. And distillation at scale still requires the advanced chips the controls are designed to restrict. The strategic logic is familiar to anyone who has watched China's long history of technology acquisition by other means. When legitimate channels close, Beijing finds different ones. The mechanism is new. The pattern is not. The full disclosure is worth reading—the operational detail is unusually specific for a public document. https://lnkd.in/eqa_6ZaS

On Friday evening, the White House made Anthropic's two most powerful models - Fable 5 & Mythos 5 - vanish for every customer on earth with a single export-control directive. Regardless of how this episode ends, it's not a one-off - there's a lesson here for C-suites' and boards' AI strategies. And that lesson is playing out just before the G7 France, with AI security and sovereignty at the center of the agenda. Washington, Brussels, and Ottawa each rolled out competing AI strategies this month with a shared theme: don't depend on infrastructure someone else can switch off. My friend and Council on Foreign Relations fellow Eddie Fishman has written about chokepoints in the global economy. What's clear is that frontier AI models are now also chokepoints - not only for nations but also the businesses that drive them. The reality for firms adopting AI: if you run your workflows on any one lab's flagship models, you will have de facto embedded a single point of failure that is outside your control. An export restriction, a jailbreak disclosure, a lawsuit, or a geopolitical change can rug pull you at any time. AI sovereignty isn't just a G7 talking point. It's becoming for all enterprises and their boards an operating risk, addressed with diversification.

I have been thinking about Bernstein v. United States all week. For those who do not remember, Bernstein was the 1990s case that established software source code as protected speech, after the federal government tried to classify encryption as a weapon and investigated the cryptographers who shared it. The crypto wars are how the modern internet has end-to-end encryption at all. Three days ago, the federal government invoked export-control authority to bar foreign nationals from accessing Anthropic's Fable 5 and Mythos 5 models. Anthropic was forced to shut both models down worldwide. Even compliant U.S. customers lost access. The parallels to the 1990s are uncomfortable, and I think security leaders should be paying attention. Here is what I keep coming back to. Export controls did not prevent encryption from going global. They delayed it, transferred it, and ultimately handed an advantage to anyone willing to ignore the rule. The math was already out. The same is true of AI today. The model weights, the techniques, the capability, already global. A U.S. export action moves the capability around. It does not eliminate it. What that means for security leaders is concrete. Your threat model should assume adversaries already have frontier bug-finding at machine speed, regardless of what any export rule says. Your business continuity plan should assume your AI tools can be cut off by government action, not just outages. Your AI deployments should be logged, baselined, and alerted on, because no vendor can fully prevent their safeguards from being bypassed. Matt and I covered all of this on Cyberside Chats this week. The episode and the source links are here: https://lnkd.in/eP2pNf4c This is one of those moments where the policy decision and the defender's work are going to play out together, and the security community needs to be part of the conversation. #Cybersecurity #AISecurity #ExportControls #CISO