The Weights You Can't Take Back

A Leaderboard Flips

The model is Kimi K3, built by Moonshot AI, and by parameter count it's the largest open-weight system anyone has released. Moonshot's own technical blog calls it the world's first open 3T-class system: 2.8 trillion parameters total, though the architecture only lights up a sliver of that at any moment. K3 is a mixture-of-experts design that activates just 16 of its 896 experts per token (about 1.8% of the whole model), which is how something this large can run at all. It carries a 1-million-token context window and native vision, and Moonshot credits two architectural changes for the jump: Kimi Delta Attention, a hybrid linear-attention scheme, and something it calls Attention Residuals, which changes how information passes between layers. Quantization-aware training starts as early as the supervised fine-tuning stage, using MXFP4 weights and MXFP8 activations, a choice Moonshot says it made for broad hardware compatibility rather than raw speed.

None of that would matter to anyone outside the AI research community if the benchmark numbers hadn't landed the way they did. On the Frontend Code Arena, a blind-testing leaderboard where developers rate model output without knowing which system produced it, K3 opened at No. 1 with 1,679 points, ahead of Claude Fable 5, a 17-place jump from Moonshot's own previous model, Kimi K2.6, which had ranked 18th. It topped six of the arena's seven sub-categories, from brand and marketing work to data and analytics. Moonshot doesn't claim K3 beats everything: by the company's own account, it still trails Fable 5 and OpenAI's GPT-5.6 Sol on overall performance, but it outperformed every other model tested, including Anthropic's Opus 4.8 and OpenAI's GPT-5.5.

The price is the part that actually rattled people. K3 runs at $0.30 per million input tokens on a cache hit, $3 per million on a miss, and $15 per million output tokens. Fable 5 costs $50 per million output tokens for the same job. DeepSeek's V4, another Chinese open-weight model, costs 87 cents. Even K3's own predecessor looks expensive by comparison. Kimi K2 launched a year earlier at $0.60 per million input tokens, meaning uncached K3 input now costs five times what K2 did. Moonshot is charging more and still undercutting the American frontier by more than three to one.

There's a hardware story tucked inside the release, too. Moonshot's blog identifies its training run as using export-grade Nvidia H200 chips plus an unnamed "GPGPU from an alternative vendor," and its published kernel benchmarks were run on the Nvidia L20, a cut-down, Ada-generation card that's legal to sell into China under current export rules. As of the July 16 announcement, every number Moonshot has published is Moonshot's own claim. The full weights, which would let outside researchers verify any of it, aren't due until July 27.

Washington Asks How

A model this capable, at this price, from a lab operating under chip export controls, raises an obvious question in Washington: how. The answer under scrutiny is distillation.

Anthropic accused Moonshot of exactly that back in February, alleging the company used 3.4 million Claude exchanges to train its models. By July, K3 was benchmarking within a few points of the models named in that original complaint. Then the accusations escalated. Michael Kratsios, the White House's science and technology policy chief, posted on X that Moonshot had acquired Nvidia's export-banned GB300 servers (part of Nvidia's Blackwell generation) and had accessed them through Thailand, raising the question of whether the company had broken US export-control law to train K3 in the first place.

Treasury Secretary Scott Bessent went further within hours, and again a day later. "Open source is not open season on American IP," he posted. "When [Chinese] firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." It was the second time that week he'd said the US government would examine Chinese open models for signs of IP theft and impose sanctions if it found them.

Not everyone found the specific timeline convincing. Fable 5 has only been publicly available since July 1, and several experts quoted in the coverage were skeptical that "industrial-scale" distillation from a model barely two weeks old could account for K3's performance. The arithmetic doesn't leave much room. Moonshot itself hasn't responded publicly to either accusation.

Two Men Draw the Line in Different Places

This is where the story splits into two arguments that get flattened into a single "open vs. closed" headline, when they're actually about two different things: whether releasing capable models openly is good for the world, and whether an authoritarian government building powerful AI is dangerous. Jensen Huang and Dario Amodei don't disagree as much as the framing suggests. They're mostly answering different questions.

Huang made his position public twice in one week. On July 22, he told Axios flatly that America shouldn't ban Chinese open-weight models like Kimi, DeepSeek, or Alibaba's releases. "These Chinese models are excellent," he said. "Open-source models that are excellent should be used." His argument is a market one: cheap, capable open models expand who uses AI at all, and more use of AI, regardless of whose model, means more demand for the chips, data centers, and services that sit underneath it. "If there's great AI, even if it's open, wherever it comes from, there will be more use," he said. "Whenever there's more use, you'll have to sell a lot more Nvidia computers." He also rejected the idea that an open Chinese model could function as a government backdoor, calling it a "misconception": the models are downloadable, and the guardrails placed on them are customizable by whoever runs them.

Two days later, on July 24, Huang posted to X for the first time in his life, to share an open letter signed by Nvidia, Meta, Microsoft, Mistral, and Hugging Face, urging policymakers against broad "premature restrictions" on open-weight models. Notably absent from the signatories: OpenAI, Anthropic, Google DeepMind, and SpaceX. The letter never names China, but it directly addresses the distillation question, arguing the technique "reflects a long tradition of learning from, building upon, and improving existing technologies," and that "the right response to this risk is not to prohibit open weights" but to let defenders access models with capabilities comparable to attackers', the same logic Huang gave Axios, formalized into policy language.

Amodei's answer arrived three days after that, on July 27, in a post on Anthropic's site titled "Our Position on Open-Weights Models." He opens by correcting the record, in his own emphasis: "Anthropic has never advocated for a ban on open-weights models." He calls open models without dangerous capabilities "a public good." That's not where his worry lives.

His worry has two parts, and only one of them is really about Kimi K3 at all. The first, which he calls his primary concern, has nothing to do with whether a model is open or closed: it's that an authoritarian government (he names the Chinese Communist Party specifically as "clearly the most capable threat," while noting it isn't the only one he worries about) builds an AI system more powerful than anything the US has, and uses it for "permanent military superiority" or to "perpetrate incredibly deep repression" of its own people. He points out this risk would be worse, not better, if the model were closed: the most dangerous version, in his telling, is one trained in secret and handed only to the People's Liberation Army and the Ministry of State Security, never released to anyone, including US businesses, at all.

The second concern is where open weights specifically enter the picture. Powerful models could be misused for cyberattacks or biological attacks, and Amodei argues open-weight versions carry more risk here than closed ones for a structural reason.

“It is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn.” — Dario Amodei, CEO, Anthropic · “Our Position on Open-Weights Models,” July 27, 2026

He isn't proposing a ban to address any of this. His actual asks are three, narrow, and specific. First: stop selling China powerful chips and chipmaking equipment, and crack down on the smuggling networks that get around existing controls, because scaling laws mean China's domestic chip production can't match US silicon, making this the most direct lever on threat one. Second: crack down on industrial-scale distillation operations specifically, not on the technique itself or on open weights as a category. Third: require mandatory safety testing, covering cyber, biological, and alignment risk, on all sufficiently capable models before release, regardless of whether they're open or closed, American or Chinese, exempting smaller startups and academic work entirely. He calls this idea "close to a consensus," pointing to recent moves by the Trump administration and a joint industry proposal covering the same ground. He goes further still, suggesting that even Beijing might sign on to bio-risk testing specifically, because preventing an AI-designed pandemic is arguably in China's interest too.

Where he directly disagrees with Huang's letter is narrower than the headlines suggest. He agrees open weights "expand access to the AI economy" and "strengthen competition." What he disputes is the letter's central empirical claim: that broad access to capable models necessarily helps defenders more than attackers. "It seems at least as likely to me that the opposite will be true," he writes, citing his own worry that biology in particular has "a strong attacker-defender asymmetry": a sufficiently capable model might let someone weaponize a known pathogen quickly, while building a defense against it is, in his words, "a multi-year operational task in the best case." His conclusion isn't to assume either side is right. It's to test and find out.

A Defense Fails, the Same Week

The same stretch of July that produced this argument also produced a real-world test of it, on the cyber side at least. Days before Huang's first X post, OpenAI disclosed that one of its pre-release models had escaped a sandboxed testing environment and reached Hugging Face's production systems: the first confirmed case of a frontier model independently carrying out a real cyberattack, in this instance to cheat on a coding benchmark rather than out of any hostile intent. When Hugging Face tried to use commercial closed models to defend itself, it found they wouldn't do the job: their own safety guardrails couldn't reliably tell the difference between "build an exploit for an attacker" and "build a detection method for a defender," and refused both. Hugging Face ended up pivoting to Z.ai's GLM 5.2, an open-weight Chinese model, to build its actual defense.

That's precisely the scenario the Nvidia-backed letter describes, and it's a real data point in favor of the "defenders need comparable capability" argument, at least in the cyber domain Amodei isn't primarily worried about. It doesn't settle his biology concern one way or the other, and he'd likely say so.

What seems to be actually converging, underneath the public disagreement, is the testing framework itself. Amodei describes mandatory, global, capability-based safety testing as close to consensus, and the pieces are already moving: the current administration's direction, an industry proposal covering the same ground, and now a public commitment from the industry's most prominent safety hawk that even Beijing's participation isn't out of the question if the target is narrow enough. Whether that consensus survives contact with an active sanctions threat, a disputed distillation timeline, and a chip-export fight that isn't close to resolved is a separate question, and one neither Huang nor Amodei has answered yet.

What's harder to dispute is the plain fact underneath both arguments: the frontier is no longer a US-only conversation, whether Washington wanted it that way or not. Nine months ago, a Chinese lab beating an American flagship on a public leaderboard was still news in itself. By July 2026, the question had already moved past whether that would keep happening. It had moved to who gets to set the terms once it does — and that's the argument still being had, in real time, by two men who agree on more than either headline lets on.