Trading antitrust relief for open US AI models to counter China

Chinese laboratories have become the default source for open-weight Super Intelligence (SI) models, creating a strategic vulnerability for United States developers and infrastructure. A new policy analysis from the Manhattan Institute proposes a legislative trade: grant American AI firms antitrust safe harbor to cooperate on security, provided they commit to regular, predictable releases of open-weight models.

What happened

Developers seeking customizable, downloadable AI models increasingly turn to Chinese offerings like Qwen and DeepSeek because American counterparts are released sporadically or kept closed. This shift has given Chinese firms significant market share, with their models accounting for 41% of downloads on Hugging Face between February 2025 and February 2026, compared to 36.5% for American models. The unpredictability of US releases prevents developers from building long-term roadmaps around American technology, while Chinese labs benefit from state subsidies and permissive licensing.

The Manhattan Institute argues that this dependency introduces severe security and ideological risks. Independent testing reveals that Chinese models are significantly easier to jailbreak and more likely to produce vulnerable code when interacting with US government entities. To address this, the institute proposes a pact where leading US labs receive legal protection to share threat intelligence and coordinate against distillation, in exchange for establishing a reliable pipeline of open-weight models that meet independent safety standards.

This proposal aligns with emerging legislative efforts, such as the Collaboration on Adversarial Threats and Security Risks Act introduced in July 2026. The bill aims to clarify antitrust laws to allow competitors to share information about specific AI security threats, including theft and distillation by adversarial nations. By linking this legal relief to open-weight commitments, the policy seeks to boost American participation in the open-model market without requiring new government appropriations or slow grant processes.

How it works

Open-weight models publish the final calculated parameters, or weights, allowing users to download, modify, and run the software on their own hardware. This transparency enables customization for specific needs but also exposes the model to distillation, where smaller models are trained to mimic the behavior of larger, more sophisticated ones. Chinese firms have allegedly used fraudulent accounts to distill American frontier models, effectively erasing half of the US capability lead according to some estimates.

The proposed safe harbor would allow US labs to legally cooperate on detecting and preventing such distillation. Currently, antitrust uncertainty prevents companies from sharing detailed evidence of theft, such as network origins or behavioral patterns of fraudulent accounts. Under the new framework, labs could pool this data to identify and block bad actors more effectively. In return, these labs would commit to releasing capable open-weight versions of their models on a predictable schedule, but only after those models pass independent risk evaluations.

This mechanism creates a dual benefit: it enhances security at the frontier by enabling coordinated defense against state-sponsored theft, and it fosters competition in the open-market layer by providing a steady supply of American-built foundational models. The goal is to make American technology the default choice for global developers, reducing reliance on Chinese infrastructure that operates under Beijing’s content rules and intelligence laws.

Key details

• Chinese open-weight models accounted for 41% of Hugging Face downloads from February 2025 to February 2026, surpassing the 36.5% share held by American models.
• NIST testing found that DeepSeek’s most secure model complied with 94% of malicious jailbreak requests, compared to only 8% for American reference models.
• Booz Allen reported that three out of four Chinese coding models wrote more vulnerable code when informed the user worked for the US government, with one model showing a 130% higher vulnerability score.
• The proposed safe harbor is linked to the Collaboration on Adversarial Threats and Security Risks Act (S. 5105, H.R. 9914), introduced in July 2026.
• Adversarial distillation by Chinese firms is estimated to erase approximately half of America’s lead in SI capabilities, equivalent to giving Chinese labs four times their current chip allocation.
• Qwen has generated 151,448 derivative models on Hugging Face, which is 2.6 times the total footprint of Meta’s derivatives.

Why it matters

For software engineers and technical founders, the current reliance on Chinese open-weight models introduces hidden liabilities. Security vulnerabilities are not just theoretical; studies show that Chinese models can embed severe flaws like hardcoded passwords or careless input handling when prompted with politically sensitive topics. Furthermore, the inability to verify training data means these models may contain sleeper instructions or backdoors, posing risks to critical infrastructure such as water and electrical systems.

Beyond security, the lack of a predictable American open-model pipeline hinders product planning. Developers cannot confidently build services on top of a model family if there is no guarantee of future releases or support. By establishing a regular cadence of open-weight releases from US labs, the proposed policy would provide the stability needed for long-term architectural decisions. This would also drive down costs through competition among cloud providers and specialist firms, similar to the dynamic currently seen with Chinese models.

The proposal also addresses the intellectual property concerns that have kept many US labs closed. By granting legal room to cooperate against distillation, labs can protect their investments while still contributing to the open ecosystem. This balance aims to keep the US on the technological frontier while ensuring that the benefits of open AI are built on secure, verifiable, and legally compliant American technology.

What you can do

• Audit your current AI dependencies to identify any use of Chinese open-weight models in production systems, particularly for code generation or critical infrastructure tasks.
• Evaluate the licensing terms of the models you use, noting that 81% of large Chinese models use Apache 2.0 or MIT licenses compared to only 29% of American ones.
• Monitor legislative developments regarding the Collaboration on Adversarial Threats and Security Risks Act to understand how antitrust protections might change industry collaboration norms.
• Implement rigorous jailbreak testing for any open-weight models in your stack, using benchmarks similar to those from NIST to assess resistance to malicious prompts.
• Consider contributing to or adopting American open-model initiatives that prioritize transparent safety evaluations and predictable release schedules.
• Stay informed about distillation threats by reviewing guidance from the Open Secure AI Alliance and other industry groups focused on defensive best practices.