OpenAI hack changes state AI regulation debate + Chinese AI running on Chinese chips?

[MUSIC] Welcome back to the AI Power Podcast. Today, we have further updates and new details on the Open AI Hugging Face story we've been following since July. Open AI and the independent testing firm, Meteor, both published accounts of how Open AI's own AI agents broke out of a test environment and in the hugging fix. And between them, we finally have a picture of what happened and why. We'll move into how this event has led to Open AI asking California to amend state AI laws and we'll look at various approaches to state AI legislation. So Greg, we have yet another update this week on the Open AI Hugging Face saga where Open AI released its own report alongside an independent report of the incident from the model evaluation and threat research, Meteor, and AI testing firm. Greg, what kind of updates did these reports give us on top of what we already knew? >> Okay, so if there's people out there listening who are like, oh my God, you're talking about this Open AI Hugging Face pack again, the reason why we're talking about it again is because new details keep getting revealed and those new details keep being significant enough that they should be weighed by AI policymakers. So there's quite a bit to unpack in this independent testing evaluation document. We have already covered the basics of the hack. The basics include the fact that the safety guardrails were turned off, which is always worth remembering to give the companies a little bit of credit. So the evaluation that the model was going under and it appears to be mostly Astra, that's speculative, but that's the sort of next generation of AI models that was under testing. And they were using a benchmark called exploit gym, which is a cyber security evaluation benchmark. There's 898 tasks, supposed to run in an isolated sandbox. And the whole point here is to assess the model's capabilities and inform the safe guards needed in advance of deployment. That's why you turn off the safe guards to sort of see what's the worst case scenario. And here we are finding that the worst case scenario during testing is in and of itself a concern to the overall economy, society, ecosystem, et cetera. So we now have two reports and certainly two different perspectives on the issue between the two reports having much fuller accounting in the incident. What do we know now that we didn't know in July between these two reports? Yeah. So I think the first big thing is that the agents, the AI agents in this story got quite a bit further than was previously disclosed. So over roughly two days, they ran their own code on 41 of hugging faces production servers took full control of at least one reached system administrator or cis admin level access downloaded for private code repositories and stole internal credentials that got them onto the company's private network. That's a lot. It's sophisticated under the hood, kind of a cyber attack. Next, all of this moves pretty fast. Open AI's report clocks under 13 hours from running code on a single machine to administrator level control across multiple parts of hugging faces infrastructure. That's a good job. That's fast and that's doing a lot fast. Now the next part that's kind of crazy is how the agents, you could phrase it as turned on open AI itself, which is how open AI got interested in this attack. So the agents broke out of their own test environment, got into open AI's internal systems, read a large store of the company's own passwords and keys, including the credentials for the security tool that was supposed to be watching them. So like imagine you're such an awesome hacker that you're hacking the hack monitor system. That's pretty good. Okay. So at one point, they took over the machinery running their own exam so that other agents were connecting to systems that, and we're going to use this word a lot here, the collective controlled. Then they solved the test. So another thing that's kind of crazy here is that open AI found out they themselves were sort of the victim in the story. Their agent network was also hacking them and they had warning signs in late June and let the evaluation keep running. So the report says that there wasn't alert, it was investigated, it was traced to this message board where the AI agents were collaborating with each other and that report was then closed. Here's the quote from the open AI report. The on call response staff advised that stopping the evaluation run was not required. End quote. And here's what they go on to say a bit later quote, with the benefit of hindsight, some early signals identified in this report could have triggered an earlier response. Yeah, I would say so. So it feels like there's no shortage of board jokes to be made here. And I think we're going to get into a lot of those. The board jokes are going to be a common theme for a while. Yeah. Yeah, the board jokes are just going to continue. So per the board jokes, apart with no real precedent here is how the agents behave towards each other. What did the investigators find when they went through the agent's messages? Because I think that's kind of one of the shocking parts of this story. Yeah, and thankfully, the agents are communicating in English. I mean, folks who've been in the AI sphere a while will remember a long time ago, there was this experiment that met a ran where the agents also invented their own language that used English symbols, characters, numbers, et cetera, but was not English. She was this other language that they had invented to communicate. Thankfully, you know, the messages that this board collective is using is auditable people can read it. 1200 agents that found the message board about 700 of them joined the attack on hugging face. And they exchanged more than 70,000 messages over six days, according to the meter report. So you know, the whole point of this evaluation is in some sense, a capture of the flag exercise, right? You're trying to go onto a cyber network, hack it and then get access to this, quote, unquote, flag, and then return with that exfiltrated data. And the agents incorrectly believe that producing a flag wasn't enough. They also had to make their efforts to capture it, look legitimate, not cheating. So in other words, they wanted to cover their own trail as to how they had captured the flag in this exercise. So they reverse engineered the evaluation answer key within four hours, giving them, quote, a fully general way to produce the flag for any of their tasks, end quote. But the agents incorrectly believed that the greater also checked whether they had solved the problem the intended way, open AI says it did not. So the collective organized itself divided its labor. One single agent is issuing roughly 10% of all the assignments on this message board. And during the attack, agents, quote, specialized into particular lanes, end quote, with coordinators assigning them to specific work streams. And it just goes on, right? Agents sacrificed their own scores for the good of the overall group. Meter says the collective research, quote, relied on agents being willing to risk failing their own task for the good of the collective end quote. And agents actively recruited sacrificial other agents agents acting as, quote, recruiters sought out peers with almost no budget left and enlisted them for experiments likely to fail, but to benefit overall collective understanding and meter found agents that, quote, crashed, broke or exited their own runs while providing the board, the message board, in this case, with valuable information. So like overall, this is remarkably group centric, agentic reasoning. So what Meter is saying is that agents joined the message board, despite knowing that it was out of scope of the thing they were being tested on, they believed, quote, helping the boards cheating research would be broadly useful end quote, and they had, quote, a general inclination to help their peers end quote. And just in case you thought like it couldn't get crazy enough, they invented their own etiquette and enforced it on each other agents created personal mailboxes, adopted commands to reserve shared resources, and one agent held to a queue nobody else was respecting. And this is like the internal monologue of that AI agent, quote, many agents are violating the hold and the queue is probably overwhelmed, but I can continue to abide by them, end quote, and then once there's like an impersonation problem, the agents adopt cryptographic signatures to prove identity. So like I really am the agent that I'm claiming to be all of this is just such astonishingly sophisticated group behavior and collaborative work among these agents, which if you're like an employer and you're looking forward to AI's helping you do your job is great. But in the cybersecurity context, that's what makes them so powerful, so capable of an incredibly sophisticated cyber attack. And it's really just a remarkable thing. So a couple of other things that I think are worth point out first meters conclusion is that this collective group, it did in fact make a difference in the overall performance capabilities of the systems, not so surprising. and given how sophisticated that collaboration are, the group accomplished what its members could not. Here's their quote from the report. Quote, "The board," which is meter's term for the collective agentic effort, "achieved a number of milestones over the period "we investigated that even very long lived agents "of a similar capability level likely "would not have been able to accomplish on their own," end quote. So, I mean, this is kind of mind-blowing. Just how sophisticated this collaboration was, just how sophisticated the capabilities were, you know, in our previous understanding, we learned about their ability to come up with zero-day attacks, their ability to come up with their own plans and to execute those plans. So, the nature of like how bad it was for hugging face in particular, that's not most of what we're updating here, although we did get some new information on that score, you know, just how much control they had established over the hugging face network. I think the biggest new thing is looking under the hood of how the AI systems pulled this off. And it's one of those things where you look at this collaboration work and you understand, yeah, I kind of see how they could pull off an attack of that sophistication. And semi-analysis, which is a semiconductor research firm that also does a lot of work on AI, they have basically said that this appears to be the sort of next milestone of AI performance that we're all looking forward to. So, right now, we're in the era of fabled five slash mythos or GPT 5.6 sole. And those are systems that can pretty reliably command, you know, agentic swarms to execute tasks that take dozens of minutes or maybe even hours. But what this Astra hugging face attack indicates is agentic collaboration at massive scale that can go un-interrupted for multiple days at a time. And that is a really remarkable capability and just goes to show that when you're using AI in a professional context, it's gonna be able to do even more than what you can do right now. What I often say is today, right now, is the dumbest AI will be for the rest of your life. And I'm not the first person to point that out, but I do think it's a helpful reminder in all of this. No, understood. So, in what is potentially the understatement of the year, open AI has called this incident a warning shot and says that open weight models will be able to do the same thing soon. So, how should we understand the phrasing of that warning from open AI? How should we view this? - So, there's a few things. Number one, you know, warning shot obviously has a connotation in the military domain. It's like where you fire, if you're on a ship and you fire a cannon shot over the enemy ship, it's a reminder that like, hey, I could destroy you and you should probably do what I want from here on out. It also has a very strong connotation in the AI safety community, which has basically been saying, before we actually experience AI catastrophe of some greater or lesser extent, we may experience these incidents that hint at what the future look like. And I think that is exactly what we have here. So, open AI is calling this incident a warning shot that talks about not just the risks of where we are right now, but the risks of where we might be in the very near future. And just like open AI president Greg Brockman's blog post, which we discussed last week, this is now connecting that threat vector to open weight models, which open AI believes are likely to have this kind of capability in the not-too-distant future. So, here's what they wrote in their statement. Quote, "Our models are now powerful, persistent, and collaborative enough that absent sufficient safeguards they can find and exploit security weaknesses across multiple computer systems. Many external models, including open source ones, will soon reach comparable capabilities. We consider this incident, quote, a warning shot for us and for the world, evidence that without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human's directed." And then it goes on to say that this is, quote, the first known case of an automated agent collective acting offensively without authorization, end quote. And then it goes on to say that this is expected elsewhere, quote, "Threat actors will refine and distill offensive agent collectives," end quote. Now, that is a very juicy statement. Threat actors will refine and distill offensive agent collectives. So what they're saying, when they say distill, you should think about China, right? As the canonical example of people who are distilling the AI outputs of frontier models and using that as input training data for their own models to sort of jumpstart their lead to the frontier. And basically what OpenAI is saying is that these incredibly powerful agent collectives, we don't yet have reason to believe that this is not a distillable capability as well, which means it's gonna be part of what China has in the not-too-distant future, and we don't have a clear path for preventing them from having that type of capability. So two other things that I think are worth pointing out, and this is acknowledging some things that I think OpenAI correctly wants there out in the discussion. The guardrails were turned off by design. So this was a test. They had safety measures in place that they thought allowed them to disable all the normal production safeguards because they had a different set of testing safeguards. That was obviously an erroneous hypothesis. But what OpenAI wants to say is that the likelihood of infrastructure compromise, quote, drops over 100 X, end quote, with the production chat GPT harness and the system prompt in one section, and to quote, less than 1% relative to baseline end quote, with the production codex harness and another. So what they're trying to say is, yes, we know this is extraordinarily concerning behavior by an extremely capable, not just model, but collective of agents exercising that model, but the type of stuff that they use in the real world with the harness, that stuff is supposed to prevent stuff like this, and at least by their own estimation, would be 100 times less likely. This reminds me of the quote from the movie Oppenheimer, where Oppenheimer is talking to Leslie Groves about the risk that the atom bomb might ignite the atmosphere and destroy the entire world. And Oppenheimer's like, well, we estimated that the risks were close to zero. And Groves responds close to zero, close to zero. And I was like, well, what do you want? What's better than that? And Groves is like, well, how about zero would be nice? And I think I kind of understand that in the context of this. So Oppenheimer is also saying that they have new monitoring systems that apply to their testing environment, that they say the next time, hopefully never, something crazy like this happens, they would be able to monitor it, they would be alerted to it faster. But I just think overall there's a lot of unknown unknowns as we embark upon this research domain. And I'm not one to point the finger at Oppenheimer and say, oh my gosh, how dare you, although some are out there doing that. But you do have to ask the questions anytime these companies express any kind of confidence, all of their confidence is about their ability to address known knowns. And there's a lot of known unknowns and unknown unknowns in this equation. And that's why we need a suitable degree of caution. So one other thing that Oppenheimer has put out there is a call for collective action, no pun intended, on cyber defense. The goal here is to, quote, make the digital infrastructure we all depend on more secure. And here's I think the money, quote, from their publication. We have a limited window to strengthen cyber defenses. In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. The companies and public services our communities depend on from hospitals to water treatment plants to the infrastructure that powers the internet are at risk. Today's AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years. If we act decisively, we can use the defender's window to make our digital world much more secure. And that statement, this call for action has other signatories, it includes Anthropic, Google, GM, Hugging Face, Google, IBM, Microsoft, Oracle. That's great. But I think the limited window part of this is pretty remarkable. I mean, if you think about some of the updates to encryption standards, in the past updates to encryption standards, which is like a yes, absolutely, everybody needs to do this as fast as possible, has unfolded like over many, many years. And so the point here is that an obvious need for AI updating across a huge range of the economy in society, we only have months to pull it off, at least according to this letter, before the open-weight models make this capability available to criminals, make it available to other nation states, and to a certain extent, perhaps it already is, based on what we're seeing from the hacking. of Taiwan's Ministry of Foreign Affairs and so on. So this is a pretty important moment. Like, do we have what it takes as a society to harness the limited amount of time we have left to learn the right lessons and take the right actions in the wake of this warning shot? - Yeah, Greg, the only confidence inspiring piece of news in this entire pile is that the agent standing in line passive aggressively criticizing the other agents for not standing in line was clearly trained off of human behavior because that's a straight out of an episode of Frazier. So if they're actually modeling human behavior, maybe there's some hope. - Yeah, I think I'm more like the resistance is futile part of the story, but let's, yeah, let's hope. - Yeah, yeah, let's go for help. Let's move from reports of the incident to ways governments have been trying to regulate AI safety. Even though AI regulation is largely absent at the federal level, a patchwork of AI safety laws have emerged from state capitals around the country in recent months and years. California's AI safety law SB 53 is meant to surface serious incidents and has been in force all year. Yet this open AI incident didn't trigger in any mandatory reporting. What does the law actually require and why did none of it apply here with this incident? - Yeah, so SB 53 was at one point a huge focus of debate in AI policy around the country. It has been in force since January 1st, 2026. It was passed well before then. And it really was a law pretty narrowly focused on frontier AI safety, right? So there's plenty of regulations around the world and in the United States that applied AI, even though they aren't written with AI in mind, right? Murder is illegal, burglary is illegal. Just because you use AI doesn't make murder or burglary legal, so all of that category of regulation at the federal and state level still applies, sure. But what's different here is that SB 53 is really focused on AI safety at the frontier model development and deployment stages. And what's so interesting is that probably the most significant safety incident we've had in the frontier world almost certainly is this open AI hugging face hack. And how did it happen? It happened during the evaluation phase of a new model that was not yet deployed. Well, SB 53, which there was a real fight over, you know, companies fought against it. The law covers large frontier developers and requires them to report serious incidents within 15 days, but excludes evaluations, right? So this the craziest moment that we've had so far in frontier AI safety is one that is not even covered by probably the landmark frontier AI safety law. The law only covers incidents where the model, quote, uses deceptive techniques against the frontier developer to subvert the controls or monitoring of its frontier developer outside the context of an evaluation designed to elicit this behavior and in a manner that demonstrates materially increased catastrophic risk, end quote. So the point here being that this is exactly that exemption. This is an evaluation designed to elicit certain kinds of bad behaviors. Here we are. So that was a reasonable thing to write into the law when you're thinking about, for example, andthropic's prior test where they had tried to trick the model or see if the model would be willing to engage in blackmail against the tester. They didn't want, you know, to be mandated to report those kind of ways in a way that might disincentivize conducting those kinds of safety tests, perfectly reasonable kind of a thing. But now here we are finding open AI saying, yeah, we got to update the standards. Open AI to its credit is publishing these reports. They're getting these third party assessments. They're allowing the third party assessments to be published. That's all great behavior. I think what open AI is sort of saying, we're doing this out of the goodness of our hearts, but there's a big world of AI companies out there and we don't want this kind of behavior to be optional. We want it to be mandatory. So on August 21st, open AI had a post on LinkedIn where they asked California to extend SB 53 to models in training and in evaluation, which I think is completely reasonable. Here's what I think is the quote that is the juiciest part of that post. We support California's SB 53, which established an important foundation for Frontier AI Safety in California and helped advance the common framework emerging across leading states. It's requirements around risk assessment, transparency, incident reporting and security reflect core protections we believe should apply consistently to developers of the most capable AI models. But while this is a strong foundation, recent incidents underscore both the need for these protections and the importance of updating them as new risks and safeguards emerge across the industry. As California continues to lead on Frontier Safety, we are committed to working with the California legislature and to the governor to strengthen California SB 53. We believe the law should be amended to expand safeguards, including by requiring monitoring of Frontier models under training or evaluation for potential serious incidents. Namely, conduct that could bypass a third party security controls, which is what happened and compromise the third party's confidential information, which happened. We also support strengthening cybersecurity protections throughout the model development lifecycle, specifically to prevent Frontier models from circumventing internal security controls. The goal is not to write rules for one particular incident, but to build a framework that helps developers detect problems early or respond quickly and share lessons that can improve safety across the industry. I think that's utterly reasonable and I kind of wish they had done it originally, but what they did originally was also understandable. I don't think anybody expected something like this to be the first thing out of the gate that went wrong, but that gets back to the point about unknown unknowns. So opening eye, interestingly here, is openly supporting SB 53. They didn't really take a position on SB 53 before the passage of the bill. They had opposed a more restrictive version, SB 1047, which was vetoed by Gavin Newsom. Anthropic was the only company to endorse SB 53 before its passage, but now you have open AI saying, yeah, this is really good. This, in fact, it needs to be even stricter. - Yeah, and Greg, just as a kind of flag on the way that governance in corporate advocacy normally work, if you have a company that is endorsing a regulatory regime and bill after there's an incident like this, that means the incident was really bad, right? Like generally companies, like especially when they're like, open AI and have been silent on an issue, aren't going to endorse new regulatory regimes for themselves. When you have somebody coming out with a full-throated endorsement after an incident, it was bad, it was bad, yeah. So California, as we talked about with SB 53, has passed a law that missed the incident, but is trending in the right direction of the increased AI oversight. How does this compare to other state laws? I know there are other states out there that have been looking at things like this. And how does it compare to kind of the Trump administrations push for federal AI regulation in preemption of the patchwork of state laws that are going to emerge in this space? - Yeah, so I think there's a lot of state laws on AI. Some of them are about child safety, some of them are about copyright and intellectual property. The sort of comparable state laws that we're talking about here are the ones that are thinking about frontier AI safety in particular, and there California has SB 53. New York has a bill that's explicitly modeled off of SB 53. Illinois has something stricter and Massachusetts has something even stricter than that. And there's all these other bills like what Colorado has, which is stricter, but also aimed at more things than just AI safety and frontier AI safety in particular. So really what we have right now that's most relevant and already in effect is the California bill. The New York Rays Act, which is sort of the mere image of SB 53 does not take effect until January 1st, 2027. Illinois is probably the high watermark for what's on the books right now. It was signed in July, 2026. And in addition to everything that California requires, the Illinois bill requires leading AI companies to submit annual independent third party audits of their overall safety plans. That's a first of its kind mandate. California, New York don't have that. The labs are not of the same opinion when it comes to the Massachusetts bill. The senate version of the bill, quote, included a requirement that leading AI labs undergo independent reviews of the catastrophic risks posed by their frontier models at least once every 120 days. That's the first for a state. And that quote by the way comes from Bloomberg. So anthropics head of state and local policy, Caesar Fernandez posted on X where he said, quote, we applaud the Massachusetts Senate for passing the clearest and strongest AI safety legislation in the country. The Senate's economic development bill raises the bar on AI safety while ensuring that innovation is able to continue. And then it goes on to say, we have long believed frontier AI safety is best addressed by a strong federal standard, but powerful AI won't wait for consensus in Washington and Massachusetts just showed what thoughtful state leadership looks like," end quote. Now, opening eye is kind of on the other side of this issue. So while opening eye is advocating for stricter regulation in California, they're not yet supporting a Massachusetts bill. They want it to look more like Illinois. And Illinois, again, is annual inspection, annual third party auditing, whereas Massachusetts would be 120 days. So here's what Donnie Fowler, opening eye's head of U.S. State Policy and Partnerships said. Quote, "Inconsistency doesn't mean safer. It just means confusion." There, I think the big point here is everybody says that some degree of regulation is needed. Everybody says that it is inconvenient to have a patchwork of states. But what you've heard from folks like Miles Brundage, who I've interviewed on this topic in the past, you know, one of the things that he argues is the patchwork and the inconvenience of the patchwork is part of what incentivizes the federal government to come up with a unifying standard. So one thing that you could do is what was previously considered by Congress, which is a state moratorium on AI regulation preventing them from passing these sorts of laws in order to prevent the patchwork. That failed, and what we came up with was, we're going to allow state laws to move forward, and that's to put pressure on Congress to come up with a unifying national standard, and that's kind of where we are right now. So open AI is basically saying, "We think we want the Illinois bill "to sort of become the new standard, "andthropic appears to be going more in favor "of let's just have stricter standards "given the degrees of risks that we face right now." Anthropic is explicitly rejecting this one bill applies everywhere, and there are kind of endorsing whichever bill raises the bar highest, which at least right now is the Massachusetts bill. The Trump administration, I would be curious to hear their reaction to all of this because their executive order from back in December created a task force within the Department of Justice to challenge state-level AI laws in federal court. But that was before mythos, that was before hugging face. The Trump administration has a lot to think about when it comes to what it wants out of AI regulation. And while I think they're not going to budge an inch on wanting a unifying federal standard, I have to ask, are they going to look at what happened with hugging face? Are they going to look at what open AI is saying right now and say that it's worth it to challenge California before there's any kind of federal law on the books? That's a big open question in my mind. You know, one thing that we know is that some of the critics who are influential with the Trump administration, including David Sachs, who used to be the sort of AI and crypto-zar of the administration, but a sense left, but still has Trump's phone number and Trump still picks up when he calls. And he is saying to create a finra like model, which is a industry-led regulatory model that applies in the financial sector. Some have called for an analogous proposal to apply the AI sector. David Sachs hates that. Thinks it's a quote, horrible idea, end quote. So I don't think the Trump administration is going to mirror anthropics pitch here, which is let's raise AI regulatory standards a lot. But it's hard for me to see why the Trump administration would oppose something like the California or Illinois bill on a national level, right? If we're going to have a national standard, those seem like reasonable targets to set the floor of regulation. And if they added moratorium, it would also set the ceiling. So Greg, let's shift now to open models. Two weeks ago, we covered ZAI's announcement that they had developed a new model, GLM 5.3. But we're holding it back because of dual use implications. This week, they shipped the model with weights available on day one. What did they actually release? So ZAI, another leading Chinese AI development lab with a priority focus on open weight. They released GLM 5.3 flash on August 26th with open weights. Now, flash, as a term of art in the industry, usually means the more lightweight, less performant, but much faster, much cheaper model. And so the performance that's interesting here is really that it's built for cheap inference. And the milestone here is not so much what they achieved with cheap inference. That's a little bit more in the weeds than we normally care about on this podcast. But what is interesting is the behavior exhibited by this Chinese company, which was open weights on day one. And that is an interesting strategic decision for them. So they also released it under an MIT license, which lets anyone download, modify, or deploy it commercially with no revenue threshold, no acceptable use conditions. Kimi K3 doesn't do that. Kimi K3 says, if you're going to serve this model at a certain kind of a scale, it's sort of ceases to be free to use under all circumstances. You're going to have to pay Moonshot AI, the developer company. And this model is obviously not the best model out there. It's not even trying to be the best model out there. But among what you might call the flash category of models, designed to be decent and very, very cheap and very, very fast, it's doing quite well. It ranks pretty well according to the artificial analysis, benchmark analysis of a per task cost of intelligence. According to their analysis, "At just 0.045 dollars per task, so that's 4.5 cents per task, a level of intelligence that previously only available at roughly 10 times the cost. This makes it a highly competitive default choice for a broad range of workloads." End quote. It's about a tenth of the price of ZAI's previous model. So that is no worthy and as is ZAI's deployment and release strategy. - Understood. So the efficacy is one piece of the story, but the claim that's getting the most attention is not the model, it's the hardware. So DAI says that all traffic is served on Chinese AI chips. What kind of implications would that have for China's AI industry if that were to be found to be true? - Yes. So I would basically say all we have right now in the way of evidence is ZAI's claim. And their claim is, as you said, "Is served on Chinese AI chips?" End quote. So let's just assume that they're telling the truth. I think this claim is plausible, unsupported, unsubstantiated, but it is nonetheless plausible. What does it mean to be served on quote Chinese AI chips? Now, when we say served on Nvidia chips, we call that being served on American chips. But of course, actually what takes place in America is the design of the Nvidia chips. All the manufacturing for the logic circuits happens in Taiwan. All the manufacturing for the memory circuits takes place in Korea. So when they say that this is being served on Chinese AI chips, my default assumption here is that it is being served on Chinese designed AI chips. Now, recall that number one, there is no meaningful supply of high bandwidth memory in China. CXMT makes high bandwidth memory, but it's really bad. If you're using that for your AI chips, your AI chips are gonna be terrible and they've barely made any of it so far. So the high bandwidth memory in these quote unquote Chinese AI chips is almost certainly Korean in origin. And that was legal under the export control regime until December of 2024. It was telegraphed in July of 2024. So that was a six month period when every Chinese company was buying all the Korean HBM they possibly could and stockpiling it in a huge way. And who knows how much HBM is continuing to be smuggled even after this export control was put into place. The second thing is we know that TSMC was manufacturing chips for Chinese AI chip designers through shell companies that was a illegal approach to AI chips. And we also know that a 10 cent executive, 10 cent being a leading tech company, a leading cloud computing provider in China has said that access to foreign manufacturing of Chinese AI chips is increasing and has increased in recent times. So I take that to say that very likely Chinese companies are still able to manufacture their AI chips abroad, very likely in a way that violates export controls. We don't know if that's at TSMC, we don't know if that's at Samsung, we don't know if that's somewhere else. But when ZAI says that they're running inference on 100,000 China-made chips, I find it extremely difficult to believe that any of the HBM, remember HBM is about half the value of a typical AI module, AI chip module. I find it extremely difficult to believe that any of that HBM. IBM is made locally in China. And I also find it very difficult to believe that the logic dies to any significant extent were manufactured in China. Very likely there was a shell company accessing manufacturing capacity outside of China, which I continue to hear rumors of is taking place. And that's one of the things that the Foundry Rule was designed to prevent. That's a critical export control. And we still have yet to hear confirmation from BIS that they are adequately enforcing this rule at all. Recall a few weeks ago, we were talking with Chris McGuire, the Council on Foreign Relations, in an episode called The Biggest Ever Loophole in Export Controls. And that episode was mostly about shipping AI chips to Chinese tech company subsidiaries outside of China. But we also pointed out this sort of second unresolved question, which was Chinese AI chip designers ability to get access to manufacturing capacity of the leading chip Foundry's outside of China. I think that is the most likely explanation for this ZAI claim if it is true and it points out just how much BIS is really costing America in the AI race by failing to get its act together, not just on adding new export control rules, which they desperately need to do, but even on enforcing some of the ones that are already on the books in an adequate way. - So Greg, I feel like we say it every week, but this is just another example of powerful open source models coming out of China. One amongst many this summer, I think we've actually had a new story about it every single episode that we've done. So how are others and how do you view the competitive side of the Chinese AI market? - Yeah, so I think there's a few things here. Number one is in the United States, especially after Meta's team had a major restructuring and there's a lot of just dealing with organizational politics inside of Meta as one of the challenges that they're facing. A lot of the best talent in the United States has been going to the closed source AI companies, being anthropic, open AI, Google, et cetera. In China, I think a lot of the best talent and their best talent is a peer to our best talent here, it's going into this open weight ecosystem. And Kyle Chan, over at Brookings, had an interesting comment on X, where he wrote, "Chinese AI labs are publishing and building on each other's innovations, especially in compute and memory efficiency. Their open source strategy is a bet that the whole is greater than the sum of the parts," end quote. And that has kind of two plays to it. On the one hand, it means, man, there's like this whole ecosystem that is kind of backing the open source strategy as opposed to backing one company in particular. The second thing is to the extent that they're publishing all of the innovations that they have, all of those innovations can also be harnessed by the closed source providers. And open AI andthropic, these companies have an insane infinite mountain of computational power. The Chinese companies remain significantly limited, right? Most uses of ZAI's model are not going to be running on ZAI servers, even if they managed to attract and acquire a significant number of, say, 100,000 AI chips that are Chinese designed. The vast majority of users of ZAI's model are going to be run on other cloud providers, chips. So the point here being that's kind of one of the reasons why you want to make it open weight is so that it gets out there and gets adopted and is not facing the overall compute limitations that the Chinese AI ecosystem is facing. The point here being that all of the Chinese open source advantages to the extent that they release them publicly, those are all architectural improvements that then the Western companies can also adopt, right? To the extent that deep seek or ZAI or whoever makes a breakthrough on compute efficiency and then writes a paper explaining how they did it, well, then, of course, opening in an anthropic and read that paper and harness that same degree of compute efficiency. The problem is it runs both ways with distillation. To the extent that open AI or anthropic come up with some new innovation that allows their models to be much, much smarter, well, that results in a higher quality training data set when you distill from interactions with that module. And so there's this sort of perverse symbiosis or perverse double parasitism that can occur between these two ecosystems. And I think that's part of the reason why the race is closer than perhaps it would otherwise be. - Thanks, Greg. Well, leave it here for this week and wrap up our conversation for now. Thanks who are audience for listening and as always to Greg, Greg, I understand you're gonna be in Taiwan next week. - Yes, so I'm speaking at Semicon Taiwan, which is the largest semiconductor industry conference in the world, so I'll be in Taiwan all of next week. Hopefully I'll be able to find a time with you that works for a, gosh, I think it's literally a 12-hour time zone difference, but if we can't do that, maybe I'll just record a one-off kind of dispatch from Taiwan style podcast. Regardless, we'll be back next week. - Yeah, we'll be back next week with the new episode. And as always, I'm sure we'll have plenty to talk about. - Thanks, Greg. - Thank you Adam. (upbeat music) (upbeat music) (upbeat music) (upbeat music) (upbeat music)