All articles
AIAnalysis

China Is Building, the US Is Banning

October 21, 2026·12 min read

DHS published a DeepSeek ban the same week four Chinese organizations shipped open-licensed AI artifacts. The order is a data-flow rule wearing an artifact-ban costume — and the real fight ahead is over who owns the devices and the compute the free models land on.

Intel source: Alexey Fateev on X — the originating postView original →

On Monday, the US Department of Homeland Security published an order kicking DeepSeek out of every federal civilian-agency IT system. On the same Monday, the same week, four Chinese organizations pushed open-licensed AI artifacts into the public commons: an MIT-licensed frontier checkpoint, an Apache 2.0 computer-use stack, MIT-licensed audio models, and an agent model whose weights are due within days.

My first read of that contrast came from a post by Alexey Fateev (@superalesha), who listed the releases and closed with: “I know who is building and who is banning.” It’s a good line, and it earned its 740 likes. But a good line is not yet an argument, and the argument actually cuts in a more interesting direction than the tweet suggests: the ban and the open releases are not really about the same thing. Confusing them is how you end up with bad policy and bad security.

In this article, I’ll do four things: verify what actually shipped last week, separate it from what the DHS order actually says, state where Delta V stands on open source and why, and give you the practical playbook if you’re deciding what to run (and where).

What actually shipped (October 17 to 20)

Four distinct artifacts, each verified against primary sources as I write this (October 21):

  • DeepSeek-V4.1-Flash-1017 (October 17, MIT). Pushed to Hugging Face at 02:40 UTC with no launch post: forty-eight safetensors shards, and a model card that calls itself a “minor update” to the September V4.1-Flash. The safetensors index counts 763,205,315,794 parameters. DeepSeek’s own tests put DeepSWE v1.1 at 77% (up from 74.2% for the September checkpoint), and the API price did not move.
  • MiniMax M3.1 Flash (October 19, API first). The successor to June’s M3, roughly three times faster with agent-task usage costs down 70%. Pricing is $0.15/$0.60 per million input/output tokens. The weights are not out yet: MiniMax announced they land on October 23.
  • Ant Group / inclusionAI Ming-3.0-audio. A 126-billion-parameter audio-language model (6.5B active per token), released October 19 with weights and inference code on Hugging Face, ModelScope and GitHub under MIT, plus a compact 9.3B sibling.
  • Alibaba Tongyi MAI OpenGCUA (arXiv:2610.22200, Apache 2.0). A full stack for generalist computer-use agents: harness, evaluation trajectories from eight frontier models, a real-device macOS harness, a Cross-Device SDK. On the team’s numbers, it lifts eight frontier models by an average of 19.6 points on OSWorld-v2 while cutting the steps each task needs by 53%. No new model in this release; it wraps existing ones.

Add one dataset to the picture: Qwen passed 2.045 billion model downloads in 2026 alone and crossed half of all global open-source model downloads as of March (SCMP). The open-weights center of gravity isn’t an accident; it’s a strategy that has been compounding for two years.

A caveat before you quote Alexey’s post anywhere: three of his numbers run ahead of the leaderboard. The “equal #2 open model on Artificial Analysis” isn’t on the board (the September V4.1-Flash checkpoint scores 39, ninth of 120, and no 1017 row exists as of October 18); “weights on 23 October” (MiniMax) was a promise from the launch post, not a fact; and of the “5 speech models” from Ant, I can verify two (flash and tiny, both MIT). None of this changes the thesis. It changes what you’re allowed to claim while defending it.

What the ban actually says (and what it does not say)

The DHS order is worth reading on its own terms rather than through either tribe’s framing.

What it does: ordered July 24, published on the Federal Register on October 19, it requires federal civilian agencies (Treasury, State, Justice, and others, plus their prime contractors) to remove DeepSeek-related technology, bans procurement of it, and reaches third-party products and services built with the company’s models. The Department of Defense is excluded from the order.

Why it says so: the notice charges that DeepSeek’s account generation collects personally identifiable information and fingerprints users, that its hosted, prompt-and-response services “may result in the transfer of sensitive data to the PRC”, that such transfers could “produce actionable intelligence on US persons” (PRC laws give its government broad authority over private company infrastructure), and that the models and apps “may contain malware or other security vulnerabilities”, citing open-source research on critical vulnerabilities in the iOS app. Notice how narrow and concrete all of that is: it is about where the servers are, who collects what, and how the data flows. It is a procurement decision about DeepSeek-hosted infrastructure.

What it does not do: it does not ban the math. It does not ban the architecture. And critically, it does not (and legally cannot, in any clean way) ban MIT-licensed weights you have already downloaded and run inside your own perimeter, where no data ever travels to a PRC server because no connectivity to one exists.

That distinction is the whole article.

Building vs banning: the real contrast

Alexey’s closing line lands because the week’s irony is real: Washington was writing a procurement ban while Hangzhou was shipping weights. But look closer at what each side is actually banning or building, and the symmetry the tweet implies (“they build, we ban”) is the wrong frame:

  1. The ban targets the service, not the openness. The threats the DHS describes (data transfer, fingerprinting, app vulnerabilities) exist because the risky configuration is trusting a third party’s hosted stack. A US federal agency downloading V4.1-Flash-1017’s MIT weights and serving them on its own hardware would present almost none of the charged risks, and the order doesn’t remotely address that configuration.
  2. Openness is what dissolves the trust problem. When the weights are MIT-licensed and verifiable, you do not have to trust DeepSeek to benefit from DeepSeek’s work. You can audit, quantize, sandbox and serve the model where things break down to your controls, not the vendor’s privacy policy. Trust problems are solved by possession, not by trust.
  3. Bans are hard to scope upstream of themselves. The order covers “products built with DeepSeek’s models.” Remote-work suites, contractors and contractors of contractors now inherit a provenance compliance burden for a lineage question (was some component trained with or built with these models?) that is nearly impossible to audit. That is the supply-chain hole the provenance part of the order opens; ITPro made the same point.
  4. So the deeper claim isn’t “the US should build openly.” It’s that the response to open competition should look like the competition itself: build the capability, verify it, own it. A ban that treats an artifact category as the enemy produces neither. Open weights, run inside a serious perimeter, do.

If you want the pattern the last month keeps confirming: Chinese labs are building openly and fast; governments are banning the insecure use pattern (hosted third-party stacks) while their institutions risk reading the wrong lesson from it.

The short circuit: where the value actually goes

Now widen the lens, because last week’s four releases make more sense inside a larger pattern, and this is the pattern I find genuinely interesting (it’s also more and more my read of where this is all heading, so take it as analysis, not news).

The metered-token inference economy is being commoditized on purpose. Look at the pricing page, not the tweets: mini-class frontier agents at $0.15 per million input and $0.60 per million output tokens; cache reads at $0.015 (a hundredth of the output price); DeepSeek upgrading its flagship flash model with a 77% DeepSWE score and leaving the API rate card untouched; free calls through Claude Code, Codex and DeepSeek Harness until November 1. When trace-class reasoning gets this cheap, the Western business model built on $20-month subscription plus enterprise token resale starts to feel like reselling tap water. The West’s inference economy charges rent per token. Open MIT weights are what the rent pays for, handed out at marginal cost of bandwidth.

So where does the profit go when the model itself is free? Two places, and both happened to be scheduled by the same governments that shipped the weights:

Embedded AI in hardware. Token revenue is nothing; hardware margin on billions of devices is everything. The state machinery around this is explicit: on June 18, China’s Ministry of Commerce and seven departments published the “AI + consumption” implementation guideline: 17 measures pushing new-generation AI phones, smart appliances, smart kitchens and lighting, wearables, and AI robots for elderly care and companionship, with subsidies for next-generation smart terminals folded into the ¥250 billion (~$37B) consumer trade-in programme (15% subsidy on eligible devices, capped at ¥500). The state subsidized 108 million digital and smart devices through the programme by August; smart-glasses sales on major platforms rose 120% in the first eight months of the year; one forecast places China’s 2026 consumer AI-hardware market (phones and cars excluded) above ¥1.27 trillion. Now replay last week’s release list with that in mind: Ant’s Ming-3.0-audio-flash (a 6.5B-active audio-language model that answers in text or synthesized speech) plus its 9.3B “tiny” sibling, both MIT: that is not a research curiosity, that is a toy, appliance and companion-robot voice stack at zero licence cost. OpenGCUA is the interaction layer for devices that touch real screens and real kitchens. Even the ban itself reads differently here: nobody’s fridge or robot toy needs to phone a PRC datacenter if its MIT model runs on-device.

City-scale AI-ready infrastructure. Shenzhen published its Action Plan for Building a Leading AI City (2025–2026): a national computing hub around Pengcheng Cloud Brain III, training vouchers (¥500M), data vouchers (¥50M) and model vouchers (¥100M), a first-of-its-kind municipal AI Bureau, and a core AI industry that generated roughly ¥220 billion in 2025. Huawei and China’s State Information Center jointly released an “AI CITY” development report with a full technical reference architecture (OpenHarmony terminals to Ascend compute, device-edge-cloud collaboration) and, notably, a “Token Factory” cross-border model: consume power locally, keep data within borders, export AI services globally. Meanwhile local governments across Guangdong, Zhejiang and elsewhere are racing to gigawatt-scale intelligent computing centers, with the “Eastern Data, Western Computing” policy having already concentrated over 100 new data-center projects in the west (Guizhou alone supplies about 23% of national computing capacity).

Put the three pieces together and the plan-of-record reads: give away the intelligence (MIT/Apache), withdraw the metered-token market from under the Western API economy, then collect the return where prices are defensible: in silicon, appliances, companion robots, smart-city compute and sovereign-token exports, in cities that are being rebuilt as AI-ready while Western city governments are still drafting their cloud-procurement risk memos. The ban debate (which model may an agency rent, and with whose data) is being held two jumps behind the board: the question that matters is who owns the devices and the compute those free models land on.

I want to be precise about epistemic status here, because our rule is that analysis is allowed and slippage isn’t: the documents, subsidies and architectures above are sourced and verifiable; the strategy connecting them (short-circuit the inference economy, monetize devices and cities) is my synthesis of those facts, and it is falsifiable in the ordinary way (watch whether Chinese labs keep free/floored token pricing while hardware subsidies and city-compute capex keep compounding).

What a serious open-source stance looks like (Delta V’s position)

We publish our own position here plainly, because everyone seems to expect vendors to be some blend of neutral and cagey about it (the live order makes this question unavoidable this month):

  • We build on open weights, deliberately, and we will keep doing it. Every serious capability we depend on in the last quarter (Qwen in the local stack, DeepSeek running behind a gaming PC under Apache 2.0 inference engines, GLM-5.3 post-crack, Z.ai’s disclosed security ledger, and now OpenGCUA on computer use) came from the open commons. That’s not a preference; that is where the cost-performance frontier actually lives.
  • Openness only pays off with possession. The commons is a good deal when you run it yourself: your hardware, your controls, your audit trail. Pull from origin checkpoints, verify checksums, treat community re-uploads as untrusted diffs. What this month’s order makes clear: operating an artifact safely and trusting an operator are two entirely different questions.
  • A model’s provenance is not a foreign-policy question; it’s a data-flow question. Classify by where data goes, not by where the training run happened. The federal ban is a defensible procurement constraint on hosted PRC services. The same document’s implicit message against “built with” open weights is not defensible, and agencies who read it as an artifact ban will overcomply their way into worse options (opaque, closed, equally unverified but somehow US).
  • The goal is to be a builder anyway. Not for the slogans. Because the group that ships and shares keeps compounding advantages: OpenGCUA is explicitly “built together with the community”; Z.ai disclosed emergent offensive capability and shipped on schedule. Builders’ paperwork is visible in public; banners mostly produce notices.
  • Go where the models actually live: on-device and in-place. If the thesis in this article is right, the next ownership fight is not over which API a company rents; it’s over who owns the hardware the free models get baked into and the compute they run on. Our lane stays the same at any layer of the stack: open weights, local execution, attested data flows, no operator you have to trust. A tool with no cloud bill has nothing to leak through a subpoena.

The Love Equation we run this company by (dE/dt = I·(C − D)E) has been pointing at the same place all year: maximize cooperation in every handoff. Open weights are cooperation at scale, expressed in safetensors. A wide, well-scoped procurement ban is at least a state knowing what it is restricting. A ban whose language starts migrating from the operator to the artifact is the defection-shaped move, and defection loses to the compounding commons almost every time it has been tried.

If you’re deciding what to run this week (the practical playbook)

The reader who closes this article should know exactly what to do next, so here it is:

  1. Classify by data flow, not nationality. If your threat model includes “customer or government data should not leave my perimeter”: no hosted PRC-fronted service, of any flavor, nationalities aside. This was true before Monday’s order.
  2. The four artifacts above are all legitimately yours to run. V4.1-Flash-1017 is on Hugging Face under MIT (origin repo: deepseek-ai/DeepSeek-V4.1-Flash-1017). The Ming-3.0 audio models are on HF (inclusionAI), ModelScope and GitHub under MIT. OpenGCUA’s harness, trajectories and macOS driver are on GitHub under Apache 2.0 (Tongyi-MAI/OpenGCUA). M3.1 Flash weights land on October 23 (watch MiniMax’s channels).
  3. Your ten-minute test. Pick the artifact closest to your actual workload, pull it into a disposable instance (a spare VPS or a gaming-PC class box is enough for the small audio model or a quant of the flash-class model; the 763B checkpoint needs serious hardware or a quant), verify checksums against the origin repo, and run one end-to-end task you actually care about. For OpenGCUA specifically, the interactive lab at tongyi-mai.github.io/OpenGCUA will show you the harness behavior before you install anything.
  4. Weights are code: vet them. Share the origin checkpoint, not a community mirror; treat any downstream edit (abliterations, “helpful” uncensor builds) as an unaudited weight diff. That rule has survived every one of these months unchanged, and it survived this week too.

The people building in public keep shipping. The people banning keep writing notices about servers they can’t see. You get to pick which playbook you join, and you should pick it now, while the choice is still surprising to anyone watching.

This article is for informational purposes only and constitutes neither legal nor investment advice. Do your own research, especially on anything you’re about to deploy at work. If it was useful, share it.

Sources

Delta V Intel pipeline — Generated and verified through the Delta V intelligence system.

Explore IntelHub →

Want high-signal intel like this in your inbox?

Get in touch