The leak

Frontier weights are not a stockpile. They are a file. Files copy. The United States is paying to discover capabilities that appear, months later, in cheaper foreign systems trained on those discoveries.

How the leak works

Adversarial distillation: query the American model, keep the answers, train a student. Terms-of-service bans catch some of it. They do not catch enough of it. Insider theft of weights is a stated intelligence concern. Open-weight Chinese models then ship the inherited competence at a price American labs cannot match if they must amortize the original cluster.

Those open models are not neutral utilities. They are built under rules that forbid harming the state’s image and require cooperation with security services. A world that offloads drafting, coding, and targeting support onto those weights is not just buying cheap inference. It is buying a filtered cognition layer.

Why this kills the “win the race” story

A race needs a finish line and a prize that stays won. AI has neither. The gap compresses to months. Every military and most non-state groups will touch similar tools because the commercial sector publishes them. A six-month lead in a chatbot is not the four-year nuclear monopoly. Treating it as one produces export theater and capex theater.

What still does not leak as fast

Tacit knowledge in yards. Qualified rocket-motor lines. Undersea quieting. Quiet relationships with allies who will berth a submarine. Those are slow assets. They are also the assets this series keeps returning to. Software secrecy is the weakest secrecy.

Bottom line

Assume every capability demonstrated in a public American model is available to Beijing on a lag measured in months. Plan the force that still works after the lag. Do not plan the force that only works if the file stays home.