A Fifth of US AI Startups Run on Chinese Models. Washington Controls the Chips but Not the Models.

Four rounds of export controls secured the hardware layer. At the software layer, close to one in five US startups builds on Chinese open weights, and no government tracks it.

Every chief executive now knows what shadow AI is: Employees run tools the company never approved, processing company data through models the security team cannot see. Optro’s 2026 Risk Intelligence Report, which surveyed more than 800 governance and IT decision-makers across global firms, found that 85 percent of organizations had folded AI into core operations but only a quarter held comprehensive visibility into how employees actually use it. Around 80 percent of those firms described unsanctioned use as moderate or pervasive.

Source: Optro (formerly AuditBoard), 2026 Risk Intelligence Report, “The AI Oversight Gap,” Mar 2026; n = 800+ global GRC and IT decision-makers.

That same structure now operates at the level of the state, where the stakes move from a compliance fine to a strategic miscalculation. A national AI strategy is a declaration made where leaders can see chips secured, data centers permitted, grid reinforced, and export licenses issued. But the AI models actually executing inside those buildings sit one layer down, where no government keeps a map: A country can hold every visible instrument of sovereignty and still run its intelligence on foundations, on AI models, which it did not build and does not track.

The United States is the proof case because it tried the hardest. Washington has run four rounds of export controls since 2022, covering two dozen categories of semiconductor equipment and well over a hundred entities, with the explicit goal of denying China the compute to reach the AI frontier. The wall at the hardware layer is real. The entry at the software layer is still open.

A widely repeated figure held that 80 percent of US AI startups run Chinese open-source models. The number is wrong, and the correction is the more interesting fact.

Martin Casado of Andreessen Horowitz, the original source, clarified that he meant 80 percent of the 20 to 30 percent of startups that build on open source at all, which nets to roughly 16 to 24 percent of the startups his firm sees. The inflated version traveled anyway. It reached the U.S.-China Economic and Security Review Commission, the congressional body that reports to Congress on exactly this question, which wrote in its March 2026 report that "some estimates suggest that around 80 percent of U.S. AI startups now use Chinese open-source models." A venture capitalist's offhand pitch-meeting estimate became a hedged line in a national-security assessment, uncorrected. That is the provenance gap stated openly: the arm of government built to track Chinese technological dependence borrowed a number, and borrowed the wrong one.

Sources: Martin Casado / a16z, correction posted Nov 2025 (“20–30% use open source; of those ~80% Chinese-based; closer to 16–24%”); USCC report, Mar 24 2026; Reuters, Mar 24 2026.

Even the corrected number is still remarkable. A fifth of new US ventures, inside the regime built to deny China AI capability, choose to build on weights that come out of China. The cohort that does so clusters where iteration speed decides outcomes. Shayne Longpre, an MIT researcher who tracks model release patterns, points out that Chinese labs ship open models on a weekly or biweekly cadence against the semi-annual rhythm of American labs, and that volume drives familiarity and adoption. On OpenRouter, one of the largest model-routing platforms, Chinese models reached about 61 percent of token consumption among the top ten models in February 2026, and the share has widened since.

Sources: Shayne Longpre / MIT, via implicator.ai (Nov 2025); OpenRouter token data via digitalinasia (Feb 2026); Hugging Face Spring 2026 State of Open Source (Qwen cumulative downloads surpassing Llama).

Visible-layer figures are slow-moving; provenance-layer figures verified at time of writing, June 2026.

The obvious objection is that open weights are inert. When a startup runs Qwen on a server in Virginia, no data travels to Hangzhou; the weights are a file. But the exposure was never exfiltration. It runs along two other lines. First, behavior travels with the weights: documented value-aligned outputs that activate on sensitive topics arrive embedded in the model and surface in the application built on top, a point the US-China commission flagged directly. Second, roadmap dependency: when a fifth of a startup base standardizes on a foreign release cadence, the national innovation pipeline inherits another state’s schedule and priorities.

Sources: USCC report and public remarks by Vice Chair Michael Kuiken, Mar 2026; implicator.ai analysis of embedded model behavior (Nov 2025).

Justin Lin, who leads Alibaba’s Qwen models, has put the odds of a Chinese lab leapfrogging the frontier in the next three to five years below 20 percent. That is precisely why distribution, not capability, is the play. An open model does not need to be the best to become the default, and the default is what shapes a generation of downstream applications. Winning the substrate is the rational move for a player who expects to lose the frontier.

Source: Bloomberg interview with Justin Lin, Alibaba Qwen (Jan 2026).

A jurisdiction can score perfectly on physical compute and run its inference on foreign foundations, and nothing on the official dashboard will show the divergence.

Two practical implications follow. For policymakers: map provenance before legislating the buildout. An export-control regime aimed only at chips leaves the software layer unwatched, which is where the dependence is actually accumulating. For investors: when foundation models are free, the value moves up a layer, to deployment, integration, and the proprietary data and physical systems built on top of the weights. That is where returns concentrate, and where provenance matters least.

A note on independence: All opinions shared in this newsletter are my own and do not reflect the views of dmg events, ADIPEC, or any affiliated organizations. This is personal analysis, not institutional positioning.