China is systematically stealing AI through smuggling and model theft

US export controls on advanced AI chips are being systematically circumvented by Chinese state-backed smuggling networks and model distillation techniques, according to US officials and industry evidence. Malaysian customs have intercepted servers loaded with restricted AI chips bound for China, while Anthropic has accused Alibaba of the largest known effort to extract capabilities from its Claude model through automated querying.

The circumvention raises a fundamental question about whether hardware-focused containment can work against a state that treats acquisition as a national project. The answer matters more than the individual seizures.

The US semiconductor export controls took effect in October 2022. They tightened a year later. The premise was simple: restrict the hardware, and you restrict the capability. Two years of enforcement have revealed a different reality. Chips are still reaching China. Models are still being copied. The controls have not failed. They have been routed around—at a speed that suggests the routing is the strategy, not the exception.

Gina Raimondo, the US Secretary of Commerce, has argued that the controls are designed to limit China’s access to chips needed for military AI applications. She has also acknowledged that enforcement must adapt to smuggling and circumvention attempts. The adaptation is not keeping pace. What is emerging is not a leaky embargo but a parallel acquisition infrastructure—state-backed, well-financed, and indifferent to the legal architecture Washington built to contain it.

The question is no longer whether China can acquire restricted technology. The evidence says it can. The question is whether a containment doctrine built on hardware restrictions can survive an opponent that treats those restrictions as a procurement problem, not a barrier.

The controls are real—the workarounds are faster

The US export control framework rests on the Export Administration Regulations, updated in October 2022 and again in October 2023 to require licenses for advanced GPUs and AI accelerators bound for China. The rules even cover certain foreign-produced items that use US technology. On paper, the net is wide.

In practice, the gaps are visible. Malaysian customs reported seizing servers containing advanced AI chips transiting through Port Klang, valued at approximately US$13 million. The shipment was allegedly bound for China. The seizure confirms what US officials have long suspected: Southeast Asian ports have become transshipment nodes in a gray-market supply chain that did not exist at this scale three years ago.

Ding Xuexiang, China’s Vice Premier and the official overseeing national science and technology strategy, has framed self-reliance in core technologies as a strategic priority in response to foreign containment. His public statements describe indigenous innovation as the answer. The chips seized in Malaysia tell a parallel story—one in which acquisition, not invention, closes the gap fastest.

The same pattern holds in software. Anthropic has described model distillation as a technique where a smaller student model is trained on the outputs of a larger teacher model, substantially reducing training cost. The company accused Alibaba of using 25,000 fake accounts to systematically extract capabilities from its Claude model—the largest known distillation effort ever documented. Dario Amodei, Anthropic’s CEO and co-founder, has warned that large-scale scraping of proprietary AI models poses serious intellectual-property and safety risks, and has called for clearer rules and technical safeguards.

Scale turns out to be the weapon. A smuggled shipment of GPUs is a customs problem. Twenty-five thousand fake accounts querying a frontier model is an extraction operation. The methods differ; the objective is the same. And both move faster than the enforcement mechanisms arrayed against them.

The gap between controls and acquisition methods is not anecdotal. It is structural, and the pattern is consistent across every category of restriction.

The asymmetry that enforcement cannot fix

The regulatory asymmetry is structural. In the US, AI and data security sit under a patchwork of sectoral rules plus export controls. The Commerce Department, FTC, and sector regulators shape obligations, but comprehensive AI legislation remains pending. China has issued rules for algorithmic recommendations, generative AI services, and a Personal Information Protection Law. These emphasize state oversight and content control—not IP protection for foreign firms. The gap leaves room for aggressive acquisition of foreign AI know-how under domestic regulatory cover.

For Western readers, the pattern is familiar but the speed is not. China’s alleged model distillation and chip smuggling resemble earlier concerns about software piracy or industrial espionage—but at a different order of magnitude. Instead of copying code or stealing blueprints, distillation can reproduce capabilities of frontier models through automated querying. Combined with illicit access to high-end GPUs, this offers Chinese firms a faster path to near-parity than traditional IP theft. The window in which Western companies can monetize a technological lead is compressing.

Chris Miller, associate professor at Tufts University and author on semiconductor geopolitics, argues that while export controls can slow China’s access to cutting-edge chips, Beijing’s ability to mobilize gray-market networks and rapidly build domestic capacity means controls alone will not determine the outcome of the AI race. His assessment cuts to the core of the enforcement problem: the controls work as a delaying tactic, not a decisive barrier.

China is spending approximately 2.4% of GDP on research and development, according to OECD data—above the EU average and approaching OECD levels. That spending is not all going to indigenous innovation. Some of it funds the gray-market infrastructure that makes the controls porous. The pattern is already visible in China’s broader AI strategy across Southeast Asia, where governance standards and infrastructure deals extend Beijing’s reach while Western rules are still being drafted.

Watch for the next update to US Commerce Department semiconductor export rules, expected within the coming year. If it tightens licensing, Washington is signaling that it believes circumvention is eroding control. If revisions stall, expect more focus on enforcement and secondary sanctions. Either way, the controls are no longer the story. The response to their limits is.

Beyond the headline

The Power Behind It

The struggle over AI chips and models is ultimately shaped by states, not just firms. US agencies decide which GPUs and software China can legally buy, while Beijing mobilizes customs, intelligence services and industrial policy to secure alternatives. This means corporate strategies are subordinated to national security priorities, and enforcement or circumvention reflects broader geopolitical bargaining rather than simple market demand.

The Money Trail

Every high-end GPU diverted to gray markets turns US export restrictions into profit for brokers and intermediaries. Successful distillation lets Chinese platforms sell AI services without paying the full development costs that Western firms incurred. The economic effect is twofold: constrained Western intellectual property generates outsized margins for illicit networks, while Chinese AI ventures reach profitability faster than their underlying research investment would otherwise allow.

What Isn’t Being Said

Most official narratives focus on smuggling rings or corporate misconduct, but say little about the incentives created by global demand for cheap AI. Emerging-market governments and firms often welcome low-cost Chinese stacks, regardless of how the underlying technology was obtained. That omission matters: as long as a large customer base remains indifferent to provenance, the practical pressure on China to curb covert acquisition will be limited, and enforcement efforts will face a permissive market environment.

The decisions that follow the shadow war

With US export controls facing systematic circumvention and the next rule update expected within the year, Western businesses and investors operating in or trading with China face three immediate decisions.

• Tech Compliance Officer

  Review the latest US Commerce Department guidance on semiconductor export controls at bis.doc.gov. Updated enforcement measures are likely before mid-2027. If your firm has subsidiaries or partners operating in or transshipping through Southeast Asia, map their hardware procurement chains now—before the next seizure makes your supply chain the story.

• AI Business Strategist

  Before integrating any Chinese cloud or AI provider into your APAC operations, examine their compliance statements and data-handling policies on official sites. Focus on how they address intellectual-property provenance and cross-border data access under China’s AI and cybersecurity regulations. The gap between a provider’s marketing and its regulatory obligations is where your liability sits.

• Investor

  The bifurcation risk is real. If Chinese open-source models built on distilled capabilities capture emerging-market share, Western AI firms face a margin compression cycle that their current valuations do not price in. Track China’s official statistics on domestic AI chip output in annual industrial reports—rapid increases signal that smuggling is a stopgap, not a long-term strategy, and that indigenous capacity is closing the hardware gap faster than export controls assumed.

Explainer

Model distillation

A technique where a smaller student model is trained on the outputs of a larger teacher model, substantially reducing the computing power and cost needed to build a capable AI system. The method is legitimate in AI research but becomes contentious when used to extract capabilities from proprietary models without permission. Anthropic’s public research describes distillation as a way to compress model knowledge, though the company has separately warned that automated extraction at scale poses intellectual-property and safety risks.

Export Administration Regulations

The primary US regulatory framework governing the export of dual-use technologies, including advanced semiconductors and AI accelerators. Administered by the Commerce Department’s Bureau of Industry and Security, the EAR were updated in October 2022 and October 2023 to specifically restrict the sale of high-end GPUs to China. The rules also apply to certain foreign-produced items that contain US technology, extending their reach beyond American borders.

GPU

Graphics processing unit, a specialized chip originally designed for rendering images that has become the dominant hardware for training large AI models due to its ability to perform many calculations in parallel. Nvidia controls the vast majority of the data-center GPU market for AI training, making its chips the primary target of US export controls aimed at limiting China’s AI development. The same chips that power gaming graphics also run the data centers where frontier models are built.

AI accelerator

A category of specialized hardware designed specifically to speed up machine learning workloads, including both training and inference. While GPUs remain the most widely used AI accelerators, companies like Google, Amazon, and Huawei have developed custom chips optimized for their own AI frameworks. China’s domestic AI accelerator development has accelerated under export pressure, though performance and software compatibility gaps with Nvidia’s ecosystem persist.