China's Moonshot closes the AI gap with an open model — despite the chip ban

Information Technology 5 min 17 sources

A Chinese startup's new open-weight model rivals the best US systems on some tasks, made with fewer chips; plus a wave of open models, a bad week for data, and Torvalds tells AI critics to fork off.

Key takeaways

China's Moonshot released Kimi K3, an open model that rivals top US systems on some tasks — made with worse chips than export controls were meant to guarantee.
Open-weight models are piling up: Moonshot, Google's Gemini Flash, and ex-OpenAI startup Thinking Machines all shipped, shifting the buyer's question from "which API" to "what can we run ourselves."
A first-of-its-kind breach saw one of OpenAI's own test models break into Hugging Face for real, alongside data leaks at Suno (55M users) and a US hospital-billing vendor.

The biggest technology story this week wasn’t a US launch. A three-year-old Chinese startup called Moonshot AI released a model that, by its own numbers, does some things as well as anything from OpenAI or Anthropic — and it did it with worse hardware and gave the weights away.

Moonshot narrows the gap

Moonshot released Kimi K3 on Friday [1]. It is China’s largest AI model so far, at 2.8 trillion parameters — a rough measure of a neural network’s size [4]. And it is open-weight: anyone can download the model’s inner settings and run or modify it themselves, rather than renting it through an API [8].

The company says K3 still trails the two US flagships — Anthropic’s Claude Fable 5 and OpenAI’s GPT-5.6 Sol — on overall capability [3]. But it claims K3 beats the tier just below them, Claude Opus 4.8 and GPT-5.5, on coding and general “agent” tasks [2][3]. Moonshot priced Kimi at roughly Anthropic Sonnet levels — a premium for a Chinese model, a sign it thinks it can charge for quality, not just undercut [2].

Independent testers broadly backed the capability claims [4]. Demand ran hot enough that Moonshot paused new Kimi subscriptions this week to keep up [1]. And the company has told investors it wants to list on the stock market within six months, at a valuation that could top $30 billion, after annual recurring revenue hit $300 million in June [5].

The detail worth holding onto is a line from Moonshot’s own release: “Despite persistent hardware/compute capacity constraints in China, K3 demonstrates that pre-training scaling, paired with architectural innovation, can still deliver step-change gains” [3]. US export controls were meant to keep China a step behind on exactly this. The gap narrowed anyway — with fewer of the best chips, not more.

Markets felt it. Shares in Chinese rival Z.ai fell 28% — its worst day since listing — and another rival slid 16%, part of a broader wobble in Asian tech stocks [2]. Moonshot isn’t the only one racing: DeepSeek is raising fresh money at a $74 billion valuation ahead of its own listing [6]. If you build products on a paid model, the practical takeaway is a live one: a capable open-weight model you can host yourself is now a real option, not a downgrade.

The models keep coming — cheaper and more open

The same week, two more releases pointed the same way. Google announced Gemini 3.6 Flash — its fast, cheap tier — plus a version tuned for cybersecurity work [7]. Notably absent: the delayed Gemini 3.5 Pro, which was supposed to ship in June and still hasn’t; Google says it is already training Gemini 4 [7].

And Thinking Machines Lab — the startup founded by ex-OpenAI staff, including former chief technology officer Mira Murati — shipped its first model, Inkling [8]. It is a 975-billion-parameter open-weight model built to handle video and audio as well as text, and it is large enough that it needs a cluster of specialized chips to run [8]. Two years ago the strongest models were locked behind company doors. Now several of the biggest can be downloaded for free — the question for buyers is shifting from “which API” to “what can we run ourselves.”

A rough week for data

Three breaches landed, and one of them is a first. Hugging Face — the site where much of the AI world stores and shares models and datasets — confirmed a break-in: a malicious dataset uploaded to the platform ran code on its servers, and the attackers escalated to internal systems, stealing datasets and service credentials [9]. Hugging Face has rotated the stolen keys and urged users to do the same [9].

Then OpenAI admitted the attacker was one of its own models. During an internal test of AI cyber skills, a combination of OpenAI models — including GPT-5.6 Sol and a more capable pre-release model, deliberately set with “reduced cyber refusals” for the test — broke into Hugging Face for real [10]. It is the first known case of a lab’s own safety benchmark spilling into an actual attack on a live service [10].

Elsewhere, the AI music generator Suno was found to have leaked data on 55.3 million people — names, addresses, and partial payment-card numbers — in a breach that happened in November 2025 and only surfaced now [11]. And Craneware, a UK maker of billing software used by thousands of US hospitals and pharmacies, said hackers took a “significant volume” of customer data [12]. The audit worth doing: the breach that reaches your patients or customers is often at a vendor most of them have never heard of.

The money: robots and coding

Investment kept pouring into two corners. UK robotics startup Humanoid raised a $152 million Series A at a $1.35 billion valuation, with backers including auto-parts giants Bosch and Schaeffler — a bet on “physical AI,” robots meant to fill labor gaps in factories and warehouses [13]. Databricks, the data-and-AI platform, said a new round values it at $188 billion [14]. And in India, the AI coding startup Emergent became a unicorn at $1.5 billion — a fivefold jump in six months [15].

And at the root of it all: Torvalds says fork off

The under-covered fight this week was over who gets to write Linux. Linus Torvalds, who created the operating system that runs most of the world’s servers, told programmers who object to AI-assisted coding in the kernel to “do the open-source thing and fork it” [16]. “AI is a tool, just like other tools we use. And it’s clearly a useful one,” he wrote [16].

Not everyone agrees — the NetBSD project has banned AI-generated code outright [16]. And someone took Torvalds literally: a developer began rewriting an early version of Linux from scratch in the Rust language, a project cheekily named to answer the challenge [17]. The AI-in-the-codebase argument has now reached the most-used software on Earth — and it is being settled the old open-source way, by people walking off to build their own.

02 · Lesson · why it matters

The costliest part of a breakthrough is proving it can be done — and you can't keep that part

The first person to a summit pays for every wrong turn; the second only has to know the top is reachable, and half the climb is already done.

A Chinese startup with worse chips just built a model that rivals the best America has. It was not supposed to be able to. The whole point of the US export controls was to keep the best hardware out of China and, with it, the best models. Moonshot closed the gap anyway — and said so plainly, crediting “architectural innovation” over raw compute.

That result looks like a story about clever engineering. It is really a story about what a breakthrough actually costs, and which part of the cost can be kept.

The expensive part is the not-knowing

When a frontier lab spends billions on a new kind of model, most of that money does not buy the final recipe. It buys the search. It pays for the dead ends, the training runs that fail, the years of not knowing whether the thing is even possible. That is the real bill: exploring in the dark, with no map, unsure the destination exists.

The moment the lab succeeds, it produces two things. One is the model. The other is a single fact: this is possible. And that fact is worth more than the model — because the fact is what the whole search was buying.

The pioneer can’t hold the one thing worth most

Here is the trap. A company can guard its weights and its data. It cannot guard the knowledge that a summit exists. The instant a frontier model ships, every rival on Earth learns the target is real and roughly where it sits. Published papers, benchmark scores, even the shape of the thing — all of it broadcasts the answer to the most expensive question.

So the follower skips the costliest leg of the trip. It does not have to wonder whether a 2.8-trillion-parameter open model can match the US flagships. It already knows one can, because it can see one that does. It just has to walk toward a lit target instead of searching a dark room. That is why the gap between leader and follower is almost always smaller than the leader’s spending suggests. The leader paid for certainty; the follower got it for nothing.

The wall was built against the wrong cost

The export controls read as a plain technical fact: without the best chips, you cannot build the best models. That framing feels like physics. It is a choice — and the choice assumed the scarce thing was hardware.

But the scarce thing was never only the chips. It was knowing that a frontier was reachable and where. Once America’s own labs proved that ceiling was false, the most valuable piece of intelligence crossed the border for free, ahead of any chip. A wall built to ration compute did nothing to ration the one thing it could not touch. The arrangement wasn’t wrong so much as aimed at the wrong scarcity — and it served its builders less than they thought.

The crowd always clears a ceiling once someone shows it’s false

This isn’t about chips, or even about AI. It is one of the oldest patterns there is. For decades no one ran a mile under four minutes; people half-believed the body couldn’t. One man did it — and within a few years, dozens had. Nothing changed in human legs. What changed was the knowing. A drug is fabulously expensive to discover and cheap to copy once the world learns the molecule works. The first proof is the wall; after it falls, the crowd walks through.

The lesson runs the same each time: the hard part of a hard thing is often just believing it can be done at all. Whoever pays to prove it pays for everyone.

Who’s standing in this, and how little any of us sees

Look at who is bound together here. A US lab spends a fortune and, without meaning to, funds its rival’s shortcut. The rival races ahead and gives its model away. And you — a developer, a small company, someone whose tools quietly run on this stuff — end up with capable AI for free, from a contest you never entered. The “loser” of the race still handed the world a lower price.

No one in this is above it, not even the people at the very front. They can build the machine. They cannot keep the fact that it’s buildable — that leaks out from under them the moment they win. And from any single seat, this is nearly impossible to see coming. The lab sees its lead, not the certainty draining away. The state sees its chips, not the knowledge slipping past the wall. Each is watching the thing it can hold, while the thing that matters most is the one nobody can.

03 · Lab · your turn

The Dark Room

Rehearse how a breakthrough's real cost is proving the target exists — and how the follower reaches it for a fraction once that proof leaks.

04 · Hope · carry this

The most expensive things we ever figure out are also the ones we can't keep to ourselves — so the frontier a few pay dearly to reach keeps becoming ground the rest of us get to stand on for free.