The US Built Its AI Controls for Physical Chips. The Threats Travel Through Software.

The US government is tightening an AI control architecture built for shipping containers: chip crates stopped at ports, subsidiaries tracked through Commerce filings, end-users verified against entity lists. The capabilities that matter now move through API requests. The instruments with actual enforcement force — export controls, entity lists, and Commerce licensing requirements — all work on things you can intercept at a border. Alibaba showed what happens when the threat has no cargo. The company used roughly 25,000 fraudulent API accounts to extract 28.8 million exchanges from Claude, distilling frontier capabilities into rival models ^[1][2]. Anthropic told Congress the consequence plainly:

Distillation attacks turn hundreds of billions of dollars in American investment and [research and development] into a massive subsidy for our geopolitical competitors — Anthropic

The same failure surfaces at the physical layer. Chinese military-linked universities, including blacklisted Beihang and Northwestern Polytechnical, are leasing H200 chips through remote compute arrangements that bypass export controls designed to stop physical shipments ^[3]. If chip controls can't prevent remote access, model controls face a harder problem: a software request has nothing to inspect. Two instruments touch software access, and both are inadequate. The foreign-national access directive blocks foreign nationals from reaching US-hosted models — a blunt measure that does nothing about API distillation or remote compute ^[2]. The June 2 executive order's voluntary review framework is the only instrument that operates where AI capabilities actually move. It gives Commerce's Center for AI Standards and Innovation 30 days to assess frontier models before public release ^[4][5]. But it is voluntary, and the order explicitly bars the mechanism that would give it force:

The change in the EO from a 90 day to 30 day period is a game changer because it allows our AI labs to comply with the voluntary framework without delaying new model releases. — David Sacks

Voluntary, in practice, means a lab can simply decline. Meta, the only major AI lab that has not signed the framework, said it expects to join soon — under government pressure, not legal obligation ^[6]:

While we are working through the details, we hope to sign the agreement soon — Meta

The implicit threat is that non-cooperation could trigger a harsher instrument, as it did for Anthropic, which received a separate export-control directive after a jailbreak of its Mythos 5 model ^[5][7]. But that directive is a physical-goods authority repurposed for software. It is the same tool, not a new one. The order also sets no published standard for what counts as a covered frontier model. The threshold is determined by a classified NSA benchmarking process ^[4]. Rep. Lori Trahan called the result government appointees deciding company by company who gets access, with no law, no process, and no oversight; OpenAI, which complied to negotiate a staggered release of GPT-5.6, said the arrangement should not become permanent ^[5]. Anthropic's own policy paper identifies three Chinese methods for closing the AI gap: distillation attacks, chip smuggling, and offshore datacenters ^[8]. The government's instruments address smuggling — the physical vector. They do not address distillation or offshore data access, the software vectors. The one mechanism that could create a real software-native access gate — mandatory licensing of model access through APIs — is the one the order forbids. The gap is not closing. The order's own text ensures it persists.