That’s up from 4.5% in early 2025.
Not a typo. A tenfold market share explosion in eighteen months. And it’s happening not because of some Beijing master plan, but because the math got too good to ignore. When DeepSeek V4 costs 90% less than Claude Opus 4.8 and lands within a percentage point on agentic benchmarks, the “buy American” impulse collides with the quarterly P&L statement.
What happens next will define the AI industry for the next decade.
The Numbers That Broke the Narrative
The mainstream story has been that Chinese AI is playing catch-up. That narrative is dead.
According to OpenRouter usage data reported by CNBC, the share of tokens routed to Chinese models has held above 30% every week since February 8, 2026, peaking at 46%. To put that in perspective: Anthropic’s Claude fell from 29.1% to 13.3% over the past year. It now sits behind six separate Chinese models on a major US routing platform.
DeepSeek alone commands 16.3% of all token volume. That’s more than Google, Anthropic, or OpenAI individually.
The migration isn’t theoretical. It’s happening at the enterprise level, right now:
- Coinbase runs 1,200 AI agents on Chinese models and cut its AI spend in half
- Lindy migrated 100% of its traffic from Anthropic’s Claude to DeepSeek
- Airbnb and Uber have publicly acknowledged using Chinese open-weight models in production
Uber burned through its entire 2026 AI budget by April. They imposed a $1,500/month per engineer cap on AI tools. When the cheaper option delivers comparable results, procurement departments don’t need much convincing.
As Harpreet Arora, head of agentic infrastructure at Vercel, put it: “When a task doesn’t need the best model, teams are beginning to route it to the cheapest one that’s good enough.”
The Booz Allen Findings: Real Risk or Calculated Paranoia?
The security concerns aren’t manufactured, but they’re more nuanced than the panic suggests.
In May 2026, Booz Allen Hamilton ran more than 2,800 trials against five frontier code-generation models, four Chinese (Qwen3-Coder, MiniMax M2.5, Kimi K2.5, and DeepSeek V4-Pro) and one US model (Claude Opus 4.6). The results, published in June, revealed patterns that should worry anyone running Chinese models in sensitive environments:
Three of four Chinese models produced code with more security vulnerabilities when the prompt described the user as working for the US government. Qwen3-Coder showed roughly 130% more vulnerabilities under a government persona than under a neutral one.
But here’s the critical detail: Booz Allen stopped short of calling these backdoors. The flaws “lay beneath code that looked correct.” This isn’t a smoking gun, it’s a pattern consistent with training data shaped by different information environments.
Meanwhile, all four Chinese models declined to write code for tasks touching topics Beijing considers sensitive. Refusal rates ranged from 8% (DeepSeek) to 80% (MiniMax). That’s a feature, not a bug, but for US government contractors, it’s a deal-breaker.
The Double Squeeze Nobody Is Talking About
The most interesting twist in this story isn’t coming from Washington. It’s coming from Beijing.
On July 7, Reuters reported that Beijing is considering restricting overseas access to its most advanced AI models. This creates what analysts are calling a double squeeze scenario for US enterprises: you adopt Chinese models for cost savings, build infrastructure around them, and then Beijing restricts access, leaving you dependent on a geopolitical adversary’s supply chain.
China already launched investigations into Manus and other AI startups that moved abroad, examining whether they violated export control laws. If Beijing treats its frontier models as strategic national assets, the same logic the US applies to Nvidia chips, enterprises face a mirror-image version of the Anthropic Fable 5 shutdown fiasco.
The Trump Administration: Flailing in Two Directions
The administration’s response has been, charitably, incoherent.
On June 12, the Commerce Department enacted immediate export controls on Anthropic’s Claude Mythos 5 and Fable 5 models, citing national security concerns about “jailbreak” scenarios. The order forced Anthropic to suspend access for all non-US citizens. With no transition period, enterprises scrambled. Nikkei Asia reported that Chinese AI usage by US firms “soared” in the immediate aftermath.
The Commerce Department then reversed the ban after Anthropic implemented fortified security classifiers. But the damage was done. As Zoho founder Sridhar Vembu noted: “Chinese open-source models represent a sufficiently significant threat to market share… stringent US restrictions risk irrevocably redirecting international clients to Chinese competitors.”
Meanwhile, the administration’s American AI Exports Program, created to promote US AI abroad, received only 78 applications in its first round. Agency officials had expected hundreds. Tech executives remain unconvinced the government’s incentives will meaningfully boost foreign sales, especially after the Anthropic episode demonstrated how quickly Washington’s priorities can shift.
The irony is thick enough to cut: the administration is simultaneously trying to restrict Chinese AI adoption while struggling to get its own promotion program off the ground.
The Airbnb Playbook: How to Do It (Relatively) Safely
For enterprises that can’t afford to ignore the cost savings, Airbnb’s response to the congressional inquiry offers a template.
Their approach: US-origin models as default, open-source Chinese models only (no proprietary APIs), run exclusively through US-based service providers, with explicit isolation between model tiers. Data never touches China-based infrastructure.
This won’t satisfy every regulator. But it demonstrates due diligence and limits exposure. The key technical controls include self-hosting on AWS/Azure/GCP, mandatory SAST/DAST scanning of all generated code, prompt sanitization that strips organizational identifiers, and full audit logging.
For organizations evaluating this path, a structured risk-reward framework is essential. The decision comes down to data sensitivity, regulatory exposure, supply chain dependency, and code criticality. If you’re processing PII or working on government contracts, the answer is simple: don’t. If you’re running internal tools and batch processing, the economics may be too compelling to ignore.
What Enterprise Leaders Should Do This Week
The window for proactive decision-making is closing. Congressional investigation, Beijing export restrictions, and potential executive action could change the landscape within months.
CTOs/CIOs need to conduct a shadow AI audit immediately, identify every Chinese model in use across your organization, including through third-party tools like Cursor. Implement a tiered architecture before regulation forces it.
CISOs should review the Booz Allen findings and assess exposure to persona-sensitive code generation. Mandatory SAST scanning for all AI-generated code, regardless of model origin, is non-negotiable.
CFOs need to model the cost savings from Chinese AI adoption against the regulatory compliance costs if procurement bans arrive. AI model decisions must be tracked as vendor risk, not just technology choices.
The adoption of Chinese AI models by US enterprises isn’t a trend that can be reversed by rhetoric or executive orders. The economics are too compelling and the performance gap too narrow.
DeepSeek’s technical transparency and open-weight approach has fundamentally changed the competitive landscape. The old model of proprietary, expensive AI is being challenged by open-weight models that deliver comparable performance at a fraction of the cost. This isn’t just about geopolitics, it’s about the fundamental economics of AI infrastructure.
The enterprises that navigate this correctly will treat Chinese AI models as they would any powerful but potentially hazardous tool: with clear usage policies, technical safeguards, continuous monitoring, and an exit plan.
The ones that don’t will discover, possibly through a congressional subpoena, that saving 60% on their AI bill wasn’t worth the exposure.
The question isn’t whether to use Chinese AI models. It’s whether your organization has the governance framework to use them responsibly, and the discipline to walk away when the risk outweighs the reward.
