Washington has spent four years building the most ambitious technology containment regime since the Cold War. On 8 September, the National Security Agency, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency told American artificial intelligence companies that some of their customers are a foreign state’s collection programme. The joint advisory describes industrial-scale distillation that systematically extracts the proprietary capabilities of United States frontier models. It names six China-based laboratories, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and records billions of tokens drawn across millions of exchanges since late 2024, routed through grey-market proxies and pooled accounts to defeat attribution. The agencies judge this likely occurred with Chinese government awareness, an inference rather than a documented finding. No system was breached. The models answered as they were built to answer.
Containment rests on a proposition inherited from the industrial age: technological power can be held because the things that create it must move. Chips cross borders, lithography machines travel in crates, uranium changes hands, and a state commanding the choke points slows the spread of strategic capability. The Bureau of Industry and Security has drawn and redrawn those lines since 2022, and in January moved chips below 21,000 TPP to case-by-case review for Chinese buyers. Those lines decide who can build a frontier model. They have stopped deciding who can use frontier-level capability, and that separation is now the central fact of the contest.
The transfer the advisory describes contains no item. A rival penetrates no data centre and obtains no weights. It asks questions, at enormous scale and with great care, then trains its own system on the answers, reproducing behaviour that cost billions of dollars to discover. Call this a behavioural export: the movement of capability through the authorised use of a system, leaving no shipment to inspect and no crossing to police. Every control regime in the democratic world is built to see matter in motion.
Capability now leaves a country as behaviour rather than as cargo, and no customs regime has ever been designed to stop a conversation.
Capability now leaves a country as behaviour rather than as cargo, and no customs regime has ever been designed to stop a conversation. In May, the Center for AI Standards and Innovation judged DeepSeek V4 to lag the frontier by about eight months, performing much as GPT-5 had eight months earlier. That is Washington’s own conservative figure. DeepSeek claims parity. Anthropic, reporting its detection of distillation campaigns against Claude, named the consequence: the practice lets foreign laboratories close the competitive advantage export controls exist to preserve. In August, researchers showed that encrypted reasoning objects returned by the interfaces of OpenAI, Anthropic and Google could be replayed and decoded using those providers’ own weaker models, recovering 315,320 hidden thinking blocks from public agent trajectories. The vendors closed that route. The principle stands, because the product discloses the method.
Britain ran this experiment and lost it. The Crown prohibited the export of textile machinery and the emigration of skilled artisans, the two things that could carry the Industrial Revolution abroad. In 1810, the Boston merchant Francis Cabot Lowell toured the mills of Lancashire and Scotland as a welcome guest, studying the Cartwright power loom American manufacturers could not reproduce. British agents searched his baggage in Nova Scotia on the voyage home and found nothing. He had memorised what mattered. With the engineer Paul Moody, he rebuilt the loom at Waltham in 1814, the first fully integrated textile mill in the world. Britain protected the machine. It could not protect what an intelligent observer learned from watching it operate.
What those prohibitions bought was time, and time was always the asset. Strategic leadership has never demanded a permanent monopoly, only enough time to convert invention into military capability and geopolitical influence. Behavioural export attacks the one thing every technology leader depends upon: time. Washington has concentrated on raising the cost of building frontier systems inside China. Beijing works the other side of the equation, lowering the cost of catching up by learning from systems the West has already paid to develop. America bears the cost of discovery. A follower eight months behind is close enough to compete.
The strongest objection holds that a distilled model is derivative by construction. A student cannot exceed its teacher, the copier is condemned to permanent second place, and the leader keeps setting the pace. The White House made that point in April while accusing foreign entities of deliberate, industrial-scale campaigns to distil American frontier systems, observing that those campaigns fail to replicate full performance. The objection is correct and insufficient. Western strategy never rested on leading by a nose. It rested on a lead long enough to field a capability inside institutions and armed forces before a rival held it. Distillation attacks the duration rather than the direction, and duration was always the part that mattered.
States have always protected strategic technology by controlling possession. Nuclear material can be secured, weapons designs classified, machine tools embargoed. Frontier artificial intelligence dissolves that method, because capability becomes economically useful through exposure. A model held inside a laboratory stays secure and creates nothing. The moment it becomes a product, an interface, an agent or an embedded service, its capabilities become observable. The commercial imperative is to distribute intelligence. The strategic imperative is to ration access to the behaviours that decide a contest.
A digital fortress would be the wrong answer. Democracies forfeit their advantage the moment security strangles adoption and market share, and Beijing would welcome a Western ecosystem frightened into surrendering the rest of the world to Chinese models. The task is to separate ordinary access from strategic extraction, which is the practical content of the advisory’s mitigations: identity assurance, detection of coordinated campaigns, and intelligence sharing across competing providers and platforms. Allied access then becomes an instrument of statecraft. In the industrial age, alliances pooled ships, factories, bases and weapons. In the intelligence age, the most consequential alliance privilege is trusted access to cognition.
AUKUS is the natural place to build it, and Australia should arrive in Washington with a proposal rather than wait for one. The Defence Trade Controls Amendment Act created a licence-free environment for transfers of controlled technology between Australia, the United States and the United Kingdom, on the judgement that allied friction cost more than it protected. That framework governs technology moving between people and organisations. It says nothing about a system that absorbs allied technical knowledge by being asked to help solve a problem, now the likelier route by which sensitive work leaves the network.
Export controls must keep governing the machinery of intelligence. The perimeter has to expand from what a technology is to what it reveals when used. States will choose between competing cognitive ecosystems as they once chose telecommunications standards, and access to the most capable systems becomes a geopolitical asset. For two centuries, the West protected its advantage by controlling who possessed powerful tools. The question now is who is permitted to learn from them.
Britain’s industrial secrets crossed the Atlantic inside the memory of a merchant, and the looms stayed in Lancashire long after the industry had gone. The powers that inherit this century will be those that recognised early that an advantage which can be queried at scale is an advantage already on loan.
The Behavioural Export