OpenAI and Google sell AI to blacklisted Chinese firms via Singapore

The whole story turns on a single technical distinction that most people assume works the other way around. US export controls, as they stand, police two things: named places and named entities. Mainland China is a restricted destination; Singapore is not ^[1]. What the rules do not police is corporate ownership - the question of who ultimately controls the customer sitting on the other end of the API call.

That gap is exactly wide enough to drive a subsidiary through. Alibaba, Baidu, and Tencent are all on the Pentagon's 1260H list, the roster of companies Washington accuses of ties to the Chinese military ^[3]. But their AI services were bought not by the Beijing parent - they were bought by Singapore-registered affiliates. Same corporate family, different passport. Because the account resolves to Singapore rather than mainland China, it clears the controls automatically. OpenAI and Google both confirmed the arrangement, and neither had to break a rule to enter it ^[2].

The current regime does block direct access to a handful of frontier models from inside China, but it stops well short of a blanket ban on Chinese-headquartered firms - even the ones on the 1260H list - using cutting-edge AI software ^[1]. Google, for its part, has effectively conceded the limit out loud, acknowledging that geographic borders carry limited enforcement value when the customer's true center of gravity is elsewhere ^[2]. That admission is the tell: the enforcers know the map they are drawing lines on is not the map the money moves on.

Export-control loopholes are the headline, but the more concrete national-security worry is a technique called distillation: pointing your own training pipeline at someone else's frontier model, harvesting its outputs at scale, and using them to teach a cheaper rival system. It is the difference between renting a tool and quietly photographing the blueprints while you use it. And it appears to be happening at industrial scale. Anthropic accused Alibaba of spinning up roughly 25,000 fraudulent accounts to generate more than 28.8 million interactions with Claude, allegedly in violation of its terms of service ^[1]. OpenAI, separately, detected suspected distillation from Alibaba-linked users, cut off their API access, and reported the activity to the US government ^[3].

What makes this striking is the response it provoked. OpenAI, Google, and Anthropic are locked in a brutal commercial fight for the same enterprise dollars - yet on distillation detection they have started sharing information with one another, an unusual patch of cooperation among firms that agree on almost nothing else. On X, the tech-press framing captured the oddity of it directly, treating cross-lab intelligence-sharing on Chinese distillation as a genuine break from business as usual.

The policy implication is sharper than the loophole story. A geographic control that could be closed with a stroke of the pen is one problem; a leak that flows through millions of ordinary-looking API calls is another entirely. Distillation does not care which country the account is registered in. That is why national-security law voices argue the answer has to be enforcement against the labs doing the siphoning, not just a redrawn map of restricted destinations.

Cutting China off sounds clean until you look at the commercial plumbing. Alibaba Cloud already offers OpenAI-compatible APIs through its own Singapore infrastructure ^[1]- meaning the interfaces, the developer habits, and the routing are all built to make swapping between American and Chinese models nearly frictionless. In that world, a US ban does not create a wall so much as it hands the customer a reason to switch.

That is the crux of the pragmatist case, and it is loud in the community reaction. On Reddit, the discussion split sharply between security hawks who wanted the sales treated as something close to treason and pragmatists whose position boiled down to 'sell it before they steal it.' The commercial-migration crowd has receipts: developers in the local-model communities point out that as OpenAI and Anthropic pricing climbs, enterprises are increasingly reaching for cheaper Chinese open-weight models like Qwen, GLM, and DeepSeek, and that US labs have shown little appetite to price-compete. One widely shared commentator argument goes further, claiming China deliberately commoditized the model layer by giving away strong open models to erode American labs' pricing power - and asserting that a meaningful slice of US AI usage now routes through Chinese models weekly.

Experts on the hawkish side reject the fatalism. Chris McGuire of the Council on Foreign Relations argues the government keeps saying it needs to beat China on AI while declining to use export controls, the one instrument that could actually slow China down ^[1]. National-security lawyer Joe Kambam frames the stakes as fairness plus leverage: Chinese labs get the advanced capability without paying the computing, engineering, and safety costs American firms shoulder ^[1]. The unresolved tension - is the leak inevitable, or is inevitability just an excuse for inaction? - is the whole debate in one line.

The most under-appreciated wrinkle is that the restriction reflex is starting to run in both directions. Even as Washington debates tightening access to American AI, Beijing is reportedly weighing curbs on overseas access to its own top models, following meetings with firms including Alibaba, ByteDance, and Z.ai. If that materializes, the open-weight abundance that today makes Qwen, DeepSeek, and GLM an easy off-ramp for cost-conscious Western enterprises could itself become a controlled export.

That possibility reframes the current fight. The pragmatist argument - 'they'll get our models anyway, so we might as well sell' - assumes a permanently open Chinese model ecosystem as the fallback. A Chinese mirror of US export controls would puncture that assumption, turning today's frictionless model-swapping into a two-sided game of gates. It would also complicate the containment logic on the US side: if both superpowers start treating frontier models as strategic exports, the Singapore-style routing gap stops being a quirk of American rule-drafting and becomes the default battleground where each side tests the other's enforcement.

Community sentiment already reads this as symmetry rather than escalation - the dominant framing around the reported Beijing deliberations was that it is a mirror image of US export controls, not a novel provocation. That is the quiet signal worth watching: the AI-access fight is converging on a mutual, and mutually leaky, system of controls.