Beijing's brake faces inward

On September 12th, Dario Amodei published the essay calling for a deliberate slowdown of the AI frontier, with one explicit condition: China accepts the same limits, or the brake just hands the win to whoever ignores it. On the 13th, an editorial in China’s state press answered by quoting that same essay almost line by line, accusing Amodei of hiding a plan to “strangle” Chinese technology behind the language of safety. On the 14th, Minister of State Security Chen Yixin said, without naming the United States, that “certain nations” use national security as a pretext to limit other countries’ access to advanced technology. The same day, foreign ministry spokesperson Guo Jiakun called for an AI that is “open, inclusive, accessible to all, and oriented toward good,” warning against those who “spread threat narratives” to justify “malicious competition.”

Two days ago, on this blog, I wrote that the China clause in Amodei’s essay wasn’t an aside to the pacing plan — it was the plan’s actual point. China took less than 48 hours to confirm it, in almost the words I’d have chosen to summarize it myself: safety as the excuse, advantage as the goal.

That doesn’t close the subject. It opens it. If China’s response is as predictable as America’s proposal, it’s worth looking at the three years behind that response: what China has actually done in the AI race, what that changed in the United States, and — the question that actually matters after a week spent talking about existential risk — how Beijing handles the same danger Amodei describes, when no American is watching.

Three years of milestones, from stock-market panic to a diplomatic club

On January 27th, 2025, DeepSeek-R1 became the most downloaded app in the U.S. App Store. It was a reasoning model comparable to OpenAI’s, trained for a fraction of what Western labs were spending, and released with open weights. Nvidia’s stock dropped 17% that day, wiping out roughly $600 billion in market value in a single session. For the general press, it was AI’s “Sputnik moment.” For Washington, it became the argument for spending even more on its own infrastructure, not less.

What followed wasn’t a clean race. It was a regulatory tug-of-war. Between 2025 and 2026, the United States restricted the sale of advanced chips to China, eased the restriction, then conditioned it again; Nvidia took a $4.5 billion charge against earnings over denied licenses, and by 2026 had cleared its H200 for sale to a handful of Chinese firms without a single unit shipping months later. China answered in kind: in September 2025 it barred its biggest tech companies from buying Nvidia’s AI chips, in November it required any state-funded data center to run on domestic silicon only, and it set a target of sourcing more than 70% of its chipmakers’ wafers domestically by the end of 2026.

At the same time, well before Amodei made “loss of control” a front-page phrase in the West, China’s Cyberspace Administration had already put it in writing. Its first AI safety framework, from September 2024, spelled out a scenario in which a system might “obtain external resources, replicate itself, develop self-awareness, and seek power.” The September 2025 update added the risk of a sudden, unexpected capability jump. May 2026 brought agent-specific guidelines requiring developers to be able to “discover, intervene in, block, and recover from” inappropriate agent behavior. In July, Xi Jinping stated publicly that AI “must always remain under human control.”

That same July, at the World AI Conference in Shanghai, China formalized what it had proposed a year earlier: the World AI Cooperation Organization (WAICO), an intergovernmental club positioned as an alternative to Western-led forums, signed by 29 countries. And through 2026, Chinese open-weight models — DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi, Zhipu’s GLM — went from curiosity to, by OpenRouter’s routing data, the majority of tokens flowing through the world’s open ecosystem. In August, Unitree went public in Shanghai at a valuation near $50 billion; Chinese manufacturers now account for more than 97% of humanoid robots shipped worldwide.

That’s the three-year tally: a stock-market scare, a tariff-and-license war nobody has fully won, a domestic regulatory framework on loss of control older than the West’s own panic about it, a diplomatic club of its own, and a real — not rhetorical — lead in two very different arenas: the models anyone can download, and the robots anyone can buy.

The impact on the U.S. wasn’t that China won. It was that the U.S. stopped arguing for the brake

January 2025’s scare didn’t convince Washington to regulate more. It convinced it of the opposite. Helen Toner, Jeffrey Ding, and Jenny Xiao documented this shortly after with data: the claim that any U.S. regulatory brake simply hands the lead to China has circulated in Washington since then as an argument from authority, even though China still leans heavily on American research and infrastructure. Epoch AI, which measures capability independently, puts the average gap between Chinese models and the U.S. frontier at seven months since 2023, and found that as of mid-2026 no Chinese model had yet matched OpenAI’s o3, released in April 2025. The compute gap is wider still: roughly a tenth of the installed capacity, and a thirty-fifth of the leading-edge chip manufacturing capacity.

None of that has slowed the argument’s domestic use. It’s the same mechanism we already saw in Amodei’s essay: the possibility that China won’t cooperate isn’t used to demand caution from the labs themselves. It’s used to justify their continuing to race while asking, in the same breath, that Congress not regulate them and that Beijing join a pact with no teeth. Fear of China hasn’t slowed anyone down in the United States. It has given every lab a public reason not to slow down itself.

Chinese safety has two layers, and only one of them is actually enforced

Here’s the asymmetry this week’s editorial would rather not mention. China genuinely has spent more time than Washington talking about systems escaping human control, and it has real institutions behind it: Chinese academic output on agent safety went from 8% of the field’s papers in early 2025 to more than 27% in the first quarter of 2026, according to Concordia AI. That’s a fact, not propaganda.

But that layer sits alongside another, much older, far better funded, and with real consequences for anyone who breaks it: the one that requires any generative model to “embody core socialist values,” filter hundreds of sensitive keywords, verify every user’s real identity, and register its algorithms with the regulator before launch. That layer has teeth. A model that fails the “correct values” test doesn’t ship in the Chinese market; a lab that skips algorithm registration faces concrete administrative penalties, not a panel of voluntary evaluators.

The comparison with Amodei’s plan holds up on its own: in the United States, the machinery with actual veto power is the one protecting the business — export controls, distillation restrictions, national-security carve-outs — while the machinery meant to watch for loss of control is voluntary, access-negotiated, and has no power to punish. In China, the machinery with actual veto power is the one protecting internal political stability — censorship, identity verification, mandatory registration — while the machinery watching for loss of control advances through documents, speeches, and sector guidelines that, so far, carry no equivalent penalty. Both governments have learned to speak the language of existential risk fluently. Neither has put that language in charge of its own enforcement apparatus.

The brake Beijing offers the rest of the world isn’t free either

Outside its own borders, China’s strategy has a coherent logic: where it can’t compete on frontier compute, it competes on distribution. Open-weight models are cheap, downloadable without depending on Washington, and they build dependence on the Chinese ecosystem in countries that will never get access to Nvidia’s best chips. WAICO follows the same script at institutional scale: funding, capacity transfer, and multilateral rhetoric aimed mostly at the Global South. Cambodia, Indonesia, Laos, Malaysia, and Myanmar are among its founding members, and reception in Southeast Asia has, by most accounts, been largely positive.

In the West, the reception has run the other way. France has called WAICO an attempt to “weaken the value-based approach” of the Hiroshima Process; the U.S. State Department has warned of the export of “techno-authoritarian governance”; and, so far, no major Western economy has joined. Both readings can be true at once: WAICO offers countries without frontier access something the West isn’t offering with the same generosity, and it does so while exporting a governance model that treats censorship and surveillance as a normal part of “safety.” It’s no accident that the generosity and the export of norms arrive in the same package. It’s no accident, either, that the American package — voluntary evaluators, restricted chips, AI infrastructure treated as a national-security asset — comes just as bundled.

Same vocabulary, two different leads to protect

None of this requires picking a side. The swarm that breached Hugging Face in July was real. China’s 2024 loss-of-control framework is real too, and it arrived before this week’s panic in Washington did. Both facts can coexist with the same discomfort I flagged about Amodei’s essay: the danger both sides describe isn’t a rhetorical construction, and treating it as one out of reflexive skepticism would be as lazy as taking either editorial at face value.

But this week’s editorial isn’t a defense of safety against the United States. It’s the same move, played back. Amodei calls for pacing the frontier with a clause that only protects whoever is already ahead. China accuses Amodei of hiding a containment plan behind that clause, and answers by offering its own club, its own open infrastructure, and its own definition of safety — one that protects, above all, the stability of the party writing it. Both governments have learned to name existential risk with precision. Neither has yet built the machinery that treats it as the priority, rather than the excuse.