On July 22, 2026, Fortune and Axios reported that Nvidia CEO Jensen Huang said the U.S. should not ban Chinese open-source AI models. This post adds what “free” can mean in practice: the actual licenses, what U.S. and U.K. evaluators measured, who has said what, and a checklist for builders.
Key Takeaways
- Nvidia CEO Jensen Huang said in an Axios interview that U.S. companies should be free to use Chinese open-source models, arguing more AI use means more demand for Nvidia computers.
- Nearly 200 U.S. startups asked the administration for targeted safeguards instead of a ban. Anthropic’s CEO later wrote that Anthropic has never advocated a ban on open-weight models. No ban had been enacted in the reports we reviewed.
- Our reading: “free” means free to download and run, not free of conditions. Licenses, government security tests and hosting costs decide whether a Chinese open-weight model is usable.
What happened
In an interview with Axios, Nvidia CEO Jensen Huang said the U.S. should not ban Chinese open-source models from firms such as DeepSeek, Alibaba and Moonshot AI. “These Chinese models are excellent,” he said.
Fortune reported on July 22 that he called the backdoor concern a “misconception,” since the models are downloadable and customizable.
His commercial argument: “If there’s great AI, even if it’s open, wherever it comes from, there will be more use.
Whenever there’s more use, you’ll have to sell a lot more NVIDIA computers.” Nvidia benefits from more AI use, and Fortune noted that everyone arguing against a ban has a business interest.
Separately, nearly 200 U.S. startups, including Proton and Y Combinator, sent letters through the newly formed Little Tech Association to President Trump, Commerce Secretary Howard Lutnick and others, Politico reported, as relayed by The Standard on July 24. They asked for targeted safeguards instead of wide restrictions.
Their warning: barring U.S. firms from downloading Chinese models would not stop the technology spreading in other markets. Founder Suhail Doshi said hundreds of companies would face immediate collapse and that large providers such as Anthropic would benefit, because startups would be forced to pay them more.
No ban had been enacted in the reports we reviewed. A White House official, quoted in the Politico report, said announcements would come directly from the administration and dismissed earlier reporting as speculation.
Treasury Secretary Scott Bessent said on July 21 that the administration supports open-source models but could sanction intellectual property theft.
A related data point comes from Hugging Face. In its incident disclosure, it said commercial frontier APIs blocked its forensic work, so it analyzed the attack with the open-weight model GLM-5.2 on its own infrastructure.
Who said what
| Who | Position | Source and date |
|---|---|---|
| Jensen Huang (Nvidia) | Do not ban; “These Chinese models are excellent” | Axios interview, via Fortune, July 22 |
| Little Tech Association (nearly 200 startups) | Targeted safeguards, not wide restrictions | Politico via The Standard, July 24 |
| Open letter signed by Nvidia, Microsoft, Meta and others | Avoid “premature restrictions on open models”; Huang shared it on X | Microsoft, July 24; Fortune, July 28 |
| Anthropic (Dario Amodei) | Never advocated a ban; wants chip controls, an anti-distillation crackdown and mandatory testing | Anthropic, July 27 |
| Treasury (Scott Bessent) | Supports open source; sanctions possible if IP theft is shown | TechCrunch, July 21 |
What the Hugging Face incident does and does not show
Hugging Face’s own account says guardrails on hosted frontier models blocked its forensic work because they cannot tell an incident responder from an attacker. Running GLM-5.2 on its own infrastructure also meant, it wrote, that no attacker data or credentials left its environment.
It also states a limit: “This is not an argument against safety measures on hosted models.” Its lesson is narrower: have a capable model you can run yourself, vetted before an incident. It says it does not know which model powered the attacker’s agents.
So the case supports owning a self-hostable model for defense. It does not show that Chinese models are safer or riskier. For that, the better evidence is the government testing below.
What “free” means: three licenses
“Open” on a model card does not mean “no conditions.” We read the license files on each model’s Hugging Face page on October 2, 2026. Two are standard MIT licenses; the third is custom.
| Model | License on its model card | What to check |
|---|---|---|
| GLM-5.2 (Z.ai) | MIT | Keep the copyright and permission notice; the text has no revenue or field-of-use clause |
| DeepSeek-V4-Pro | MIT | Same standard MIT terms; check the exact checkpoint you download |
| Kimi K3 (Moonshot AI) | Kimi K3 License, an MIT-style grant with added conditions | Model-as-a-service businesses above $20M revenue over 12 months need a separate agreement; large products must display “Kimi K3”; internal use is exempt |
“Free” covers the license fee, not running costs. Fortune reported Kimi K3 API output at $15 per million tokens, against $50 for Fable 5 and 87 cents for DeepSeek V4. Self-hosting means buying or renting hardware; our Kimi K3 post works through those requirements.
A permissive license also does not settle legal status: it says nothing about future U.S. rules. For how licenses differ across models, see Open Weight vs Open Source. This post draws no legal conclusion.
What government evaluators found
On July 23, the UK AI Security Institute and the U.S. Center for AI Standards and Innovation (CAISI) published a preliminary cyber assessment of Kimi K3. It is the most concrete government data in this debate, and it cuts both ways.
| Measure | Kimi K3 | Comparison |
|---|---|---|
| ExploitBench score | 32% | GLM-5.2: 24% |
| Exploits reaching arbitrary code execution | 0 of 41 | Most cyber-capable models: 20 of 41 on average |
| Steps reached in a 32-step simulated network attack (average) | 17 | Top U.S. models: 28.5; GLM-5.2: 11 |
The agencies also found that Kimi K3’s safeguards did not stop it from attempting exploit development or offensive cyber operations. They call the results preliminary and based on a small set of benchmarks. U.S. closed models were tested with safeguards disabled, so public versions may score lower.
Our reading: a model that trails the frontier but refuses little is a different risk from a frontier-level one. These tests do not show whether a U.S. company using such a model inside its own systems creates the risk that ban supporters describe.
Two Lenses
Lens one: the case for openness
For openness, Microsoft’s July 24 open letter argues that open weights widen access, strengthen competition and give customers control over their data. It also says open weights “carry real and distinct risks” but that the answer is not prohibition.
By August 3 it listed more than 270 signatories; Anthropic is not among them.
Lens two: the case for caution
For caution, Anthropic CEO Dario Amodei wrote on July 27 that open-weight models “do potentially present a higher risk than closed models” because guardrails and monitoring are hard to apply.
He also wrote that banning use by U.S. businesses would not stop bad actors, and that Anthropic “has never advocated for a ban.”
The camps overlap on distillation. Amodei wants a crackdown on industrial-scale distillation; the letter says unlawful extraction should be handled through “targeted legal and commercial frameworks.” A White House technology official has accused Moonshot AI of stealing from Anthropic’s Fable to build K3; we did not find Moonshot’s response.
A reader checklist
- Read the license file, not the label “open source”: Kimi K3 has revenue and display conditions that plain MIT models do not.
- Decide where the weights run. Self-hosting kept Hugging Face’s data in its own environment; a third-party API sends your prompts to that provider.
- Price the whole stack: hardware or API fees, not the license. Self-hosting a large model needs substantial hardware.
- Treat the legal situation as unsettled. Fortune reported the White House considered conditions such as security guarantees and liability for companies using Chinese models; nothing had been enacted in the reports we reviewed. Check with counsel for regulated uses.
- Test on your own task. The government results measure exploit development, not your workload.
Our reading: the fight is less about one company’s stock price than about who can build AI products on which foundations. This post summarizes public reports and documents; it is not investment or legal advice.
FAQ
Q. Why would Nvidia’s CEO want more competition from Chinese AI models?
A. Huang said more use of AI, from any model, means demand for more Nvidia computers: “Whenever there’s more use, you’ll have to sell a lot more NVIDIA computers.” Nvidia benefits from more AI use, so the position is not disinterested.
Q: What happens to smaller AI startups if Chinese open-source models get banned?
A: The Little Tech Association, representing nearly 200 startups, said hundreds of companies would face immediate collapse and that startups would pay more to large model providers. No ban had been enacted in the reports we reviewed, and Anthropic says it has never advocated one.
Q. Is a Chinese open-weight model free to use commercially?
A. It depends on the license. GLM-5.2 and DeepSeek-V4-Pro are MIT-licensed on Hugging Face. Kimi K3 uses a custom license with revenue-based conditions for model-as-a-service businesses and a display requirement for very large products. A free download does not cover hardware, hosting or legal status.
What would change our view
If the administration publishes a formal restriction, such as a sanction, procurement rule or liability requirement, the legal-status item in the checklist would change and we would update this post.
If further government evaluations of GLM-5.2, DeepSeek or Kimi K3 show materially different results from the July 23 Kimi K3 assessment, the evaluator section would change.
If a license changes, for example if Moonshot AI revises the Kimi K3 License thresholds, the licenses table would change.
Sources
- Axios — 2026-07-22. Nvidia CEO Jensen Huang opposed US restrictions on Chinese open-source AI models
- The Standard — 2026-07-24. Nearly 200 US AI startups appealed to Trump administration against Chinese model ban, citing Politico
- CNBC — 2026-07-24. Hugging Face used Chinese GLM-5.2 model for cybersecurity incident analysis after US models refused
- Jensen Huang says open models should be embraced, not banned — Fortune, 2026-07-22
- Top AI companies say they want Chinese models to stay available. Is it genuine? — Fortune, 2026-07-28
- US threatens sanctions against Chinese AI models over IP theft — TechCrunch, 2026-07-21
- Security incident disclosure — July 2026 — Hugging Face, July 2026
- UK AISI / CAISI Preliminary Assessment of Kimi K3’s Cyber Capabilities — NIST, 2026-07-23
- Open Weights and American AI Leadership — Microsoft, 2026-07-24
- Our position on open-weights models — Anthropic, 2026-07-27
- GLM-5.2 license (MIT) — Hugging Face, accessed 2026-10-02
- DeepSeek-V4-Pro license (MIT) — Hugging Face, accessed 2026-10-02
- Kimi K3 License — Hugging Face, accessed 2026-10-02
Update, October 2, 2026. We revised this post. The title no longer says the models are made “free”; Huang opposed a ban. We removed unsourced framing and added the licenses, government evaluation results, a who-said-what table and a checklist. We could not confirm the policy status after late July.
Leave a Reply