OpenAI shipped GPT-5.5 on April 23, 2026. Twelve hours later, a Chinese lab that allegedly cannot buy advanced Nvidia chips dropped a 1.6-trillion-parameter open-source model that benchmarks within 3-to-6 months of the frontier and costs roughly one-ninth as much to run.
That is the entire story of U.S. export controls in one sentence.
DeepSeek V4 Pro lists at $1.74 per million input tokens, $3.48 on output. GPT-5.5 Pro: $30 input, $180 output. Claude Opus 4.7: $5 and $25. V4 Flash, the lighter sibling: $0.14 and $0.28. That is a 98% discount on output for a model that lands within a few benchmark points of the frontier — open weights, MIT license, 1 million token context, downloadable from Hugging Face.
The next morning, White House science adviser Michael Kratsios released a four-page memo accusing China of “industrial-scale” theft of American AI through model distillation. The timing was not subtle. Neither was the math behind the accusation, which falls apart the moment you look at it.
These are three failures stitched together by the same policy logic. The hardware containment strategy failed because software routes around silicon. The narrative scaffolding being erected to explain that failure — they only beat us because they stole our outputs — is being asked to carry political weight the underlying data cannot support. And the safety premium that justified billions in valuation just lost its commercial floor.
By the time you finish this article, somebody in a Western enterprise has already swapped a Claude API key for a DeepSeek one.
The 12-hour humiliation
DeepSeek V4 launched April 24, 2026 as a Mixture-of-Experts system: 1.6 trillion total parameters with 49 billion active in the Pro version, 284 billion total with 13 billion active in Flash. One million token context window. Pre-trained on roughly 33 trillion tokens. MIT licensed. Open weights on Hugging Face. Frontierbeat covered the launch the same day.
The benchmarks tell the story. Per Artificial Analysis’s independent index, V4 Pro lands at 52 — behind GPT-5.5 at 60 and Opus 4.7 at 57, ahead of nearly every other model on the planet. MMLU-Pro: 87.5. GPQA Diamond: 90.1. SWE-bench Verified: 80.6% — neck and neck with Opus 4.6 at 80.8%. On Codeforces, V4 Pro hits a 3,206 rating, leading both Opus 4.6 and GPT-5.4. On LiveCodeBench, V4 Pro takes the lead at 93.5%.
DeepSeek’s own technical report concedes the gap: V4 Pro Max trails frontier US models “by approximately 3 to 6 months.” Three to six months. Open source. Pennies on the dollar. Running, in part, on Huawei Ascend silicon.
Simon Willison flagged it as the largest open-weights model ever released. The MoE pattern — most of the parameters dormant on any given token — is why a 1.6-trillion-parameter model can ship without the inference bill that number implies. The architecture extends sparse-attention work Frontierbeat tracked through V3.2-Exp last September.
What is new is the timing. DeepSeek shipped this 12 hours after GPT-5.5 and one day after the White House Office of Science and Technology Policy issued a memo accusing Chinese labs of stealing American AI. We will come back to that.
The compute-constrained admission nobody wanted to hear
Read DeepSeek’s launch announcement closely and you find an admission that should be screaming from every Washington op-ed page. Reuters reported the lab said V4-Pro’s service capacity is limited because of “constraints in high-end compute capacity,” and that pricing could fall sharply once Huawei Ascend 950 supernodes come online in the second half of 2026.
Translation: yes, the export controls are biting. They cannot serve as many users as they would like. They are paying for it in throughput and unit economics. Their own previous run reportedly required Huawei chips that, four years ago, did not commercially exist.
DeepSeek’s V4 white paper says it “validated its fine-grained EP scheme on both Nvidia GPUs and Ascend NPU platforms.” That is the only public statement on training hardware. Same day, Huawei announced its Ascend 950 supernodes fully support V4 inference. Tsinghua’s Liu Zhiyuan told MIT Technology Review the model “may still have been trained mainly on Nvidia chips.” The Register noted the likely reality: Nvidia for pretraining, Huawei for parts of post-training and reinforcement learning.
This is precisely the hardware mix US export controls were designed to prevent.
And they shipped anyway. Within 3-to-6 months of frontier. At one-ninth the cost.
This is the technical problem with the entire premise of the chip embargo. RAND’s Lennart Heim, who studies compute governance, has been making the careful version of this point since R1 dropped in January 2025: “It is harder for export controls to affect individual training runs, and easier for them to impact a whole ecosystem.” You cannot stop a single model with chip controls. You can only raise the price of an entire industry.
Helen Toner, who runs CSET at Georgetown and used to be on OpenAI’s board, has said the original strategically sound case was for controlling semiconductor manufacturing equipment, the actual chokepoint. The case for chip-level controls was always weaker, and it has been “poorly implemented” on top of that. The official posture rounds her nuance to zero.
Jensen Huang already wrote the eulogy
Nvidia’s CEO has been telling anyone who will listen that the policy is a disaster. At Computex in Taipei in May 2025, Jensen Huang said: “All in all, the export control was a failure,” and that “the fundamental assumptions that led to the AI diffusion rule in the beginning, in the first place, has been proven to be fundamentally flawed.”
On the Dwarkesh Patel podcast on April 15 — nine days before V4 launched — Huang sharpened the point: “China’s AI moves on with or without U.S. chips. The question is whether one of the world’s largest AI markets will run on American platforms.”
He was in a position to know. Nvidia’s China data-center market share went from roughly 95% in 2022 to around 50%, then to what Huang called “effectively zero” in the high-end segment. The H20, the chip Nvidia designed specifically to comply with the Biden-era controls, was banned in April 2025, generated a $4.5 billion inventory charge, and forfeited an estimated $15 billion in sales. Then it was un-banned in July 2025 in exchange for a 15% revenue share to the U.S. government. Then in December 2025, Trump approved H200 sales to China at a 25% revenue cut.
The chips became a tariff. The national security frame quietly became a revenue model. As of April 2026, Commerce Secretary Howard Lutnick has confirmed Nvidia has not sold a single H200 to China — not because Washington blocked the sale, but because Beijing did. The Chinese government would prefer its companies buy domestic now. A draft Commerce rule, meanwhile, would license every advanced AI chip sale on the planet, an extraterritorial reach that COCOM at its Cold War peak never attempted.
Chris Miller, the Tufts historian who wrote Chip War, has documented what happened the last time this was tried. The Soviets stationed roughly 60 KGB officers around Silicon Valley to steal chip designs. They built their own Zelenograd fab. The strategy “condemned them to backwardness” because Moore’s Law made every reverse-engineered chip obsolete by the time it was reproduced. Today’s China is a profoundly different adversary: globally integrated commercial firms, half the world’s AI researchers, 60% of chip manufacturing capacity. The COCOM analogy was always backwards. Chinese diffusion is the strength, not the weakness.
The smuggling enforcement record, meanwhile, is a black comedy. Three executives at Supermicro were indicted in March 2026 for diverting $2.5 billion in AI servers through Southeast Asian shell companies, with at least $510 million reaching China. That single ring moved more compute than DeepSeek reportedly used to train R1 in the first place.
The distillation memo and the math that destroys it
Anthropic published “Detecting and preventing distillation attacks” on February 23, 2026. Headline numbers: roughly 24,000 fraudulent accounts, 16 million total exchanges. Of those, 150,000 attributed to DeepSeek, 3.4 million to Moonshot, and 13 million to MiniMax. Anthropic concluded the campaigns “reinforce the rationale for export controls.”
Two months later, on April 23, 2026, Kratsios released his OSTP memo, “Adversarial Distillation of American AI Models.” Frontierbeat covered the announcement. The memo declares foreign entities “are engaged in deliberate, industrial-scale campaigns to distill U.S. frontier AI systems.” Kratsios’s X post that morning was blunter: “industrial-scale distillation campaigns to steal American AI.”
Now do the math.
Nathan Lambert, head of post-training at the Allen Institute and author of the RLHF Book, estimates roughly 10,000 tokens per Claude exchange. DeepSeek’s 150,000 exchanges therefore translate to roughly 1.5 billion tokens.
DeepSeek V4 was pretrained on 33 trillion tokens.
The alleged distillation corpus is 0.0045% of the training data. Two orders of magnitude apart from the volume that could plausibly shape a 1.6-trillion-parameter model. The MiniMax 13 million is large enough to matter for a smaller system. The DeepSeek 150,000 is not.
Lambert’s verdict on the 150,000 number, posted the day after Anthropic’s report: “In the scale of training a language model, 150K samples is only scratching the surface as a substantive experiment. This usage of Anthropic’s API will have a negligible impact on DeepSeek’s long-rumored V4 model.”
So why did the Kratsios memo lead with DeepSeek? Because DeepSeek is the political target. Because V4 had not yet shipped when the memo was being drafted, and DeepSeek was the lab that broke the export control narrative in January 2025. Saying “MiniMax distilled Claude” would not produce the same headline.
The legal framing collapses on the same examination. Querying an API and training on its outputs is a breach of Anthropic’s terms of service. It is not, on any established reading of U.S. law, “theft.” Anthropic’s own terms assign output rights to the customer. There is no copyright in API responses. There is no trade-secret claim against information you sold to anyone with a credit card. Anthropic has not filed a single lawsuit against DeepSeek, Moonshot, or MiniMax. The legal foundation, which is rubble, would be the obvious place to start if the framing matched the evidence. The Huizenga bill moving through the House would create new civil remedies precisely because the existing toolkit is inadequate.
This part should sound familiar. In October 2018, Bloomberg ran “The Big Hack,” alleging Chinese intelligence had implanted spy chips on Supermicro motherboards inside Apple, Amazon, and U.S. government data centers. Apple’s Tim Cook called for a retraction: “It is 100 percent a lie.” Amazon’s Andy Jassy did the same. The NSA said it was “befuddled.” The named source publicly disavowed the story. No physical chip was ever produced. Bloomberg never retracted, and the story became part of the policy bedrock for everything that followed.
The Kratsios memo is not the Bloomberg story. The distillation campaigns are real. Twenty-four thousand fraudulent accounts is not a fabrication. But the gap between “150,000 API calls” and “industrial-scale theft that justifies export controls” is the same kind of gap, asked to do the same kind of political work.
The safety industrial complex gets its moat
While Anthropic was framing distillation as a national security threat, its own balance sheet was telling a different story about what kind of company it has become.
Anthropic has raised approximately $67 billion across 17 rounds. Its February 2026 Series G closed at a $380 billion post-money valuation. Secondary-market activity has since pushed implied valuations past $1 trillion. Annualized revenue is reportedly running near $30 billion. The company is in talks with Goldman, JPMorgan, and Morgan Stanley about a possible October 2026 IPO that could raise $60 billion.
The selling proposition has been Constitutional AI, the 23,000-word Claude Constitution launched at Davos in January, EU GPAI Code signature, the works. The pitch to enterprises: pay Anthropic’s premium because Claude won’t help with bioweapons.
Look at the price chart instead. Claude Opus 3 launched in March 2024 at $15 per million input tokens and $75 per million output. Opus 4 in May 2025: same. Opus 4.1 in August 2025: same. Then in November 2025, Anthropic dropped Opus 4.5 to $5 and $25 — a 67% sticker cut at the top of the line. Opus 4.6 and 4.7 stayed at that price, though Opus 4.7’s new tokenizer adds 0-to-35% more billed tokens depending on content type, which softens the “cheaper” framing considerably.
Compare to DeepSeek V4 Pro at $3.48 output. Anthropic is roughly seven times more expensive at the top of the line. The constitutional AI brand commands a premium. So does the national security positioning.
What enterprises actually noticed is also documented. Per Menlo Ventures’ enterprise survey, Anthropic’s market share rose from 24% to 40% of enterprise LLM spend during 2025. The driver Menlo cites by name is coding — what partner Deedy Das calls “a $4 billion category that has become the gateway to enterprise workflows.” The share gains correlated with Sonnet 3.5 and Sonnet 4 launches, not constitutional updates. The premium was a frontier-capability premium dressed up as a moral one.
Now look at where the enterprise is actually moving. Airbnb CEO Brian Chesky said publicly his company “relies heavily” on Alibaba’s Qwen for AI customer service: “Qwen is very good. Also fast and cheap.” Cursor’s Composer 2 was Moonshot’s Kimi K2.5 in a different wrapper. Cognition’s SWE-1.5 builds on Zhipu’s GLM-4.5. Chamath Palihapitiya moved his workflows from AWS Bedrock to Kimi K2 because, in his words, it was “way more performant.” Lambert again: “I have personally heard of many high-profile cases where the most valued American AI startups are training models on Qwen, Kimi, GLM or DeepSeek.”
That positioning has been profitable for Anthropic in another direction too. The company launched Claude Gov in June 2025, custom variants for top-secret deployments that “refuse less when engaging with classified information.” The Pentagon awarded Anthropic a contract with a $200 million ceiling. Then the relationship broke down spectacularly: in February 2026 SecDef Hegseth demanded Anthropic remove restrictions on autonomous weapons and domestic mass-surveillance use cases. Dario Amodei refused. Trump ordered federal agencies to drop Anthropic. The Pentagon designated Anthropic a supply-chain risk — the first U.S. company so labeled. Anthropic sued. Frontierbeat has tracked the company’s gatekeeping arc through Project Glasswing and Claude Mythos, the model Anthropic now says is too dangerous to release.
You do not have to disagree with Amodei’s safety concerns to notice that “keep advanced AI scarce” is also the strategy that lets a $5/$25 closed model out-charge a $1.74/$3.48 open model by 700%. Safety became a moat. The moat needed a wall. The wall is the export control regime. The regime needed an explanation when it failed. Distillation became the explanation.
The market already voted
On January 27, 2025, the day after R1 went viral, Nvidia lost roughly $589 billion in market capitalization in a single trading session — the largest one-day loss in U.S. market history. Satya Nadella tweeted that morning: “Jevons paradox strikes again. As AI gets more efficient and accessible, we will see its use skyrocket.”
He was right and the panic was wrong. Nvidia’s fiscal 2026 revenue closed at $215.9 billion, up 65% year-over-year, with Q1 FY2027 guidance at $78 billion. Cheaper inference produced more inference, not less.
The same period saw US AI infrastructure commitments reach numbers that no longer have a referent. Stargate: $500 billion over four years. Top-five hyperscaler 2026 capex: $602–700 billion, roughly 75% AI-tied. Goldman Sachs projects $1.15 trillion in hyperscaler capex 2025–2027. Morgan Stanley puts the Big Five at $3 trillion through 2028, with operating cash flow covering only about half. Paul Kedrosky’s BEA-derived calculation: AI capex contributed +0.66 percentage points of the 0.7% annualized US GDP growth in Q4 2025. The rest of the economy added 0.04 points. Statistical noise.
DeepSeek V4 Pro at $3.48 per million output tokens implies a unit economics regime in which Anthropic’s $380 billion valuation and OpenAI’s $300 billion Oracle commitment both depend on enterprises continuing to pay 5-to-10x the marginal-cost rate for capabilities the open-weights tier is closing on within months.
U.S. enterprise direct adoption of DeepSeek itself remains tiny — only 0.2% of U.S. corporations by end of January 2025, per Ramp data, and at least 17 states plus the Navy, NASA, and Pentagon have banned the company outright on government devices. But the indirect adoption — Cursor on Kimi, Cognition on GLM, Airbnb on Qwen — is the part the official narrative cannot square with itself. American AI companies are using Chinese open weights right now. They just don’t advertise it.
The official narrative says Chinese AI is contaminated, dangerous, possibly stolen, and bad. The companies actually building things are quietly fine-tuning it.
What is actually true
DeepSeek V4 trails the U.S. frontier by 3-to-6 months. It costs roughly 14% of GPT-5.5’s output price. It runs on Huawei silicon. Its parent company is currently raising its first outside round at a $10 billion valuation. Anthropic is worth $380 billion. The disparity in the inputs and the disparity in the outputs are pointing in opposite directions, and that should be the first clue that the export control regime has not done what it was advertised to do.
Chip controls did not stop a Chinese frontier model. They produced one that ships open-source on Huawei chips and undercuts every American closed-weight competitor by an order of magnitude on price. The Anthropic distillation report identified 150,000 DeepSeek API calls — roughly 1.5 billion tokens against a 33 trillion token training corpus, a 0.0045% slice that Lambert and other researchers say is too small to meaningfully shape a 1.6-trillion-parameter model. The Kratsios memo upgraded that number to “industrial-scale theft” without producing the technical evidence the framing requires.
The next checkpoint is concrete. DeepSeek’s Huawei Ascend 950 supernodes are scheduled to come online in the second half of 2026, which DeepSeek says will let it cut V4 Pro pricing further. Anthropic’s rumored October 2026 IPO will require S-1 disclosures on government contracts, pricing, customer concentration, and the actual revenue impact of the Pentagon supply-chain designation. Nvidia’s next earnings will report whether U.S. hyperscaler capex absorbed the H200 China revenue Beijing refused to authorize. GPT-5.5 Pro’s $180-per-million output tokens has to meet DeepSeek V4 Pro’s $3.48 on enterprise procurement tables for the next three quarters.
Three numbers, three timelines, one question the policy never wanted to answer: what was the embargo actually for?