To discuss, ChinaTalk interviewed Logan Wright, partner at Rhodium Group, my former boss, and, in my humble opinion, the person with the deepest understanding of China’s macroeconomic picture of anyone following the PRC in the West. His new book is Broken China: How the Economic Miracle Shattered and What It Means for the World. Co-hosting is the great Brad Setser of CFR.

We discuss:

• Why China’s “economic miracle” has broken down and how the financial system that powered China’s growth for two decades now constrains it.

• How the world’s biggest credit expansion turned into a debt trap, with investment generating less and less growth.

• Why China’s property collapse, weak domestic demand, and surging exports are actually all part of the same story.

• How China’s push into EVs, AI, robotics, and other “new industrial sectors” can’t by itself replace the growth China used to get from property and investment.

• The jobs crisis facing China’s 12-13 million graduates per year and the ideological, fiscal, and strategic constraints that make it difficult for Beijing to address.

• What a “broken China” means for the US and the rest of the world and why Logan argues there is no longer systemic economic rivalry with China, but only a military and industrial-resilience one.

Listen now on your favorite podcast app, or watch on YouTube!

Why China is “Broken”

Jordan Schneider: Logan, is China’s economy broken? Are we sure?

Logan Wright: The title is not a prediction. It’s an explanation of how we got here. The basic argument is that it’s still underappreciated how central the financial system was to China’s growth over the past two decades, and how much the financial system’s problems now constrain that growth. Those are the parts that are broken.

China does have choices. But those options involve much slower growth in the short term. They cannot maintain the pace of the past two decades. The options they have involve restructuring the fiscal and financial systems: the way they allocate capital, the way they provide countercyclical support, how they raise tax revenue and how they allocate it.

It is not meant to be a dramatic, bearish title. It’s meant to say there’s no point in asking Beijing to fix this model, because they cannot fix this model. If they are truly constrained in their policy options and not willing to fix it, what should the rest of the world do about it?

The other key takeaway is that if growth depends so much on the financial system, and the financial system now constrains growth, then a lot of China’s external messaging — that they’re economically successful and time is on their side — is simply wrong. It will become more obvious that it’s wrong. That raises different questions for Western governments, which I raised in the Foreign Affairs article previewing the book and discuss extensively in its later chapters. It expands our options, and it means we have the capacity to use time on our side as our policy tools become more salient while China’s become less so.

Jordan Schneider: How did we get here? We had China growing at ten, eight, seven percent. Now what’s the latest Rhodium forecast — somewhere in the one to three range?

Logan Wright: At the start of the year we expected growth of 1% to 2.5%. We would argue we’re trending well below that, and we’re likely seeing negative growth in Q2 and Q3, because investment in China is contracting. The question is by what margin. The official data points to it contracting.

Jordan Schneider: That is a dramatic turnabout. We had the excuse of COVID, that things would come back. It’s the fall of 2026 ,and they haven’t. On one hand, it’s a developing economy that’s going to grow slower over time. But going from seven to maybe one and a half is a truly dramatic thing for the Chinese and global economy. Turn the page back to chapters one and two. What broke, such that an economy with so much latent potential is now totally stuck?

Logan Wright: This is a story of contingent outcomes. It was not inevitable. It is the result of distinct policy choices about how the financial system operated.

After the global financial crisis, China saw the largest single-country credit expansion the world has seen in at least the last century, possibly many centuries. China added a third of global GDP to its bank assets in just eight years. We’ve never seen anything remotely like it.

First, there was a deliberate attempt to provide countercyclical support in response to the global financial crisis. The extension after that was essentially path dependence. Growth was strong, it was dependent on investment, and it became too difficult for authorities to shut down without imperiling the overall economy. That facilitated the growth of the shadow banking system, and credit growth became increasingly disconnected from the real economy. A lot of it went into the property sector and local government infrastructure.

After the deleveraging campaign started in 2016 and intensified by 2018, you had a sharp decline in credit growth. This coincides with Xi Jinping’s rise to power and how that changes financial risk, which we should discuss separately. You now have credit that cannot expand at the same rates because the financial system is already overextended. Rather than write down the malinvestment and the losses from the shadow banking system, you have a financial system that provides everlasting life to state-owned producers and local government financing vehicles, but cannot maintain the same pace of credit growth. Credit becomes less and less efficient, generating less growth at a lower quantum of credit. The result is a decline in overall investment.

The number one cause of the rapid decline since 2021 was the collapse of the property sector. It’s critical to understand that as a proximate cause, not the ultimate cause. After the deleveraging campaign hit developers’ shadow financing channels, the property sector was reinflated by borrowing from households in the form of pre-construction sales. Developers put up showrooms and sold properties in advance, for which homebuyers borrowed. When the defaults happened, they happened largely against homebuyers waiting for their apartments. That collapse in confidence weakened construction across the economy. Property was 20% to 25% of China’s GDP at its peak. Construction has fallen almost 80%. Sales have fallen about 60%. Nothing has replaced property as a driver of growth.

The other underappreciated part is how the slowdown in domestic demand is directly related to the rise in China’s external surplus and supposed competitiveness. It’s a byproduct of falling prices, but also of continued production across industrial sectors that used to find demand in residential construction in China. Now there’s none, so they need to find markets abroad, typically by cutting prices. This has produced persistent deflationary pressure and a weakening of the real exchange rate. The domestic slowdown and the external surplus are very closely linked, but people still treat them as distinct — they argue the economy is K-shaped — when in reality these are the same phenomenon.

Brad Setser: Two questions. This massive credit expansion could be called unique not just because it was so big, but because it didn’t generate an external deficit financed by inflows from abroad, which is unusual given its size. It would be helpful to discuss why such a huge credit expansion, with such heavy investment in property, never spilled over into an external deficit.

There’s also an argument that this credit expansion ended without a crisis. Nothing like the US in 2008, nothing like Spain’s banking sector. There’s never been a moment of catharsis when key parts of the financial sector lose access to financing. Why was it possible to have such a big credit expansion without it ending in something that approximates the financial crisis most countries experience?

Logan Wright: On the crisis moment first. The story in the book is not one of crisis or collapse but of decay: the decay over time of policy tools, of an attempt to forestall immediate crises at the cost of longer-term adjustment. Decay is an easier political choice for China’s leaders — accepting slower growth and inefficient policy tools rather than risking crisis. The path to crisis is not an external shock in China, where everyone assumes the government will provide support. The path to crisis is reform.

And I would argue China had that cathartic moment. It’s exactly what the book leads off with: the protests in the lobby of Evergrande’s headquarters on September 13, 2021. China’s largest firm in its most important industry could no longer meet its obligations to its own employees, who were basically lending money to the firm. They protested and were ultimately not repaid. When China’s largest firm in its most important industry effectively defaults — later on its external obligations, and later on homebuyers — it raises the question of what else is going to provide growth.

If you told me an economy had a financial crisis at date X and asked what the consequences would be at X plus five years, which is where we are now, I’d say this is entirely consistent with the aftermath of a financial crisis. Highly impaired policy tools that cannot deliver the same countercyclical response. Persistent deflationary pressure. Continued default pressure, as credit risk has migrated from the periphery to the center: from peer-to-peer lending in 2018, to small banks in 2019, to trust companies in 2020, to property developers in 2021, to mortgages in 2022, to local government financing vehicles in 2023. Much slower growth and reliance on external markets because of the inability to generate domestic demand. Everything you’d expect from an impaired, zombified financial system is taking place. The consequences are the same.

On external financing: China’s post-crisis credit expansion was essentially externally financed through steady inflows of deposits into the banking system from exchange rate intervention and reserve accumulation, until about 2013. The change in that pattern in late 2013 and 2014 is exactly what forced increasing reliance on non-core liabilities, with banks competing for wealth management products on higher interest rates. You got huge maturity mismatches between higher-rate short-term financing and a rising pool of assets, because you no longer had steady deposit growth. So there was an external financing component, though I take the broader point that it never spilled over into an external deficit.

Subscribe now

Jordan Schneider: Let me spotlight some of Logan’s prose:

“For years, long-term trends in China’s economy and financial system have appeared unstable. Everyone asks when the crisis is coming. But the more precise question is: how long can these trends continue before China faces the same economic outcomes as a financial crisis? The answers are clearer, as these consequences are already apparent in China’s economy and the decay of the financial and fiscal systems. China has already seen a sharp slowdown in economic growth, led by its vitally important property sector and local government infrastructure investment. Private sector credit remains weak, similar to the effects of a shock to aggregate demand. The downshift in economic growth is structural in nature, as the economy is unlikely to recover to previous growth rates.”

Even though we didn’t get something as dramatic and nationwide as 2008, what you’re living with is a version of permanently suppressed growth like post-bubble Japan in the mid-1990s.

Logan Wright: Japan is probably the closest analogy in recent history, with differences. Japan had zero-bound monetary policy and therefore had to rely on fiscal stimulus to solve the balance sheet recession. China probably still has more space with monetary policy. The constraint is the exchange rate and the stability of the financial system, not getting rates lower. They could get rates lower; it would just introduce different trade-offs.

The constraint China faces is fiscal. You’re already running a fiscal deficit of nine and a half percent of GDP, about two trillion dollars last year. You can run that to 15% or 16% of GDP, but you’re not going to generate much more economic activity unless you fix the underlying system. It’s not that there are no choices to offset short-term pressures. It’s that without resolving the structural issues, you shouldn’t expect a fundamental improvement in the outlook.

And the property crisis was nationwide. As I argue in the book, you had a bank run. It just wasn’t at a bank. You had homeowners wanting their money back in the form of “we want our properties built,” and developers unable to deliver because they had borrowed forward to keep buying land.

Xi’s Rebuttal

Jordan Schneider: All right, Logan — Western PhD who thinks he’s got all the answers. Let’s say I’m Xi Jinping. I’m here to stabilize party rule and make China a world power. I’m not defining national power by ghost cities and second homes for middle-class people in Hebei. I’m defining it by the ability to build everything the world needs, get the world dependent on my manufacturers, and capture the commanding heights of the twenty-first-century technology economy. If that means squeezing consumers so they have slightly worse healthcare and services, if it means stressing people out so they don’t have savings and can’t get a good return on the money in the bank, fine. I inherited an economy working toward goals that weren’t in line with national rejuvenation. Now it is. Look at all the world-leading, technologically vibrant manufacturing powerhouses built over the past fifteen years. What’s wrong with that?

Logan Wright: It’s fair to say, Mr. General Secretary, that we’re not talking about the same things. The simplest response is that if the underlying economy is not growing, your ambitions to develop those industries will face pretty fundamental limits. They already face limits from your own capacity to fund them through the domestic fiscal and financial system.

The limit is that for everything being developed in China, the marginal source of demand is outside China rather than inside. If China remains an investment-led economy — the largest source of investment in the world — it can only grow, and your national rejuvenation can only occur relative to the rest of the world, by displacing others’ export market share, by fighting over a shrinking pie. That pie shrinks further if China’s export prices keep declining and drive disinvestment in the rest of the world, which means your customers, who are largely outside China, are increasingly unable or unwilling to afford everything you’re producing. Those are the limits of the model.

You’ve identified the worldview of He Lifeng and the industrial policy planners well. There’s a fair line of argument in response, which I’m happy to engage with: that I’m measuring the wrong things. That GDP growth doesn’t account for the ways China is developing industrial dependencies and unlocking future growth drivers through industrial clusters, and that there’s a path-dependent process to this industrial development that will be sticky even if external trade defenses go up.

Look at minerals processing. How did China become the dominant force in global metals and minerals processing? It’s a combination of stories. One is cheap credit. Two, state-owned producers willing to keep committing resources to largely unprofitable lines of business, because there’s enough industrial clustering and proximity to downstream consumer electronics and manufacturing that it still makes sense on economies of scale, which makes it very difficult for others to compete. The other is cheap, subsidized power for energy-intensive enterprises like aluminum. Aluminum is basically congealed energy. There’s a reason copper and aluminum smelting have concentrated in China: the downstream consumer electronics and battery businesses benefit from it. Those are measures of comprehensive national power that my book doesn’t fully address.

But from the macroeconomic perspective, those arguments can only go so far, because fundamentally this economy is not growing at nearly the same rates. My further response to Chairman Xi is: are you aware that the United States has outgrown China over the last five years? And has a pretty good chance of outgrowing China over your fourth term, and a near certainty of outgrowing China over your fifth term, if you wanted to be around that long. Western economists are going to point out that China is still number two in the world for a long period of time. You might not care about that. You might downplay those headlines. But it means people will think about China’s inevitable rise differently as long as your domestic economy isn’t expanding.

The other problem is that if import growth in China isn’t rising, it’s harder and harder to maintain trade relations with everyone. And if the marginal demand for everything you produce is outside China, how your consumers are feeling and behaving really does matter for the industrial policy project you’ve embarked on. But it’s a fair argument that relative influence, national rejuvenation, and economic statecraft tools aren’t captured solely through a GDP lens or a policy-transmission-efficiency lens. I concede that.

Jordan Schneider: Premier Setser, care to dogpile on Logan?

Brad Setser: I wonder if President Xi sees the world a bit differently. He looks out and says: everybody talks about GDP growth. I care about supply chain dominance. My industrial sector is clearly the world’s number one, and it’s becoming ever bigger relative to the world economy. There’s an ever-expanding set of sectors where Chinese production is central to global supply chains. Everyone says there are limits to how much you can grow through external demand, but those limits have yet to manifest. I’m still getting 10% year-over-year export growth. My exports are growing at two times global trade, because of the incredible productivity and technological advances that have occurred inside China under my rule.

Moreover, I’ve identified a way to make this seemingly unsustainable outcome sustainable. If you don’t want my exports, I’m going to cut off your supplies of the critical inputs you need for your remaining industry. Supply chain dominance allows China to sustain export growth way past what conventional theory would say.

Arguably that’s what has played out. The US is still importing from China; we just import through Vietnam. Europe is reluctant to risk renewed supply chain warfare and is continuing to import more EVs. Perhaps we’ve underestimated how much even a large economy like China can grow without a strong internal growth engine.

Logan Wright: Brad’s response is exactly where the threat from China’s growing export share is manifest today, and it’s a different threat than we were considering five years ago. It’s not that China is going to become the world’s largest economy and maintain these capabilities ad infinitum. It’s that they can use this pattern of export displacement and supply chain dominance to lock it in for a longer period, fighting over a shrinking pie of global demand, because it will be that much more difficult for countries to respond.

The answer is that it’s a lot easier for other developed economies to reinvest and counter this disinvestment pressure with their own policy response than it is for China to maintain the same growth and demand, even if, as Brad says, there’s capacity to extend this model further than we would have expected.

A Billion People Outside the Champions

Jordan Schneider: I had a little Claude chart: percent of Chinese GDP on one axis, productivity growth as the bars, bar width as share of the economy. What it illustrated is that even in the scenario Brad laid out, where the export champions keep kicking ass, you’re still left with a billion Chinese people in industries that don’t seem to have any future. Continue the optimistic Xi case: the world doesn’t block us off, we keep exporting. What are the domestic downsides if, given the credit mess, you’re still stuck throwing money into LGFVs and central SOEs and propping up property, and you don’t have growth from anywhere besides this pretty small slice of economic activity?

Logan Wright: The irony is that you’re saying the most optimistic case for China’s development is one in which they have no control over the pace of development. Domestic controls and policy levers don’t work, so they’re beholden to the global economic cycle and whether external demand rises or falls. They can capture an increasing share of it, but they can’t control the global business cycle. China can grow as fast as its customers grow. It can’t grow relative to the rest of the world. It can’t rise in economic influence over that timeframe as long as it isn’t generating domestic demand.

Domestically, that’s really difficult, and here’s where demographics and employment come to the forefront. Many reporters coming back from China these days tell me: basically, we just want to write stories about the employment crisis. We just want to write stories about jobs, and our editors just want us to write stories about tech. It’s not surprising that’s where the demand function is, but it shows you the disconnect.

There’s a structural problem with leaving the economy unbalanced when your labor force has completely changed. China graduates 12 to 13 million college graduates a year out of a new labor force cohort of 17 to 20 million. It’s an astonishing proportion, but the economy hasn’t readjusted to provide opportunities for them. As that increases, and because birth rates have fallen over the last two decades, the problem becomes more pronounced.

The new development engine Xi is pursuing isn’t very large as a proportion of the economy. We added up all of China’s strategic industries, the new champions, using the 2023 input-output tables: NEVs, all investment in AI data centers and hyperscaler build-out, advanced robotics. We get something like 6.5% of GDP. We could be wrong, but not by a factor of two. There’s not a hidden ten trillion yuan of additional investment out there. Changes in domestic consumption would have a far greater impact on aggregate growth if you could shore up consumption.

The closer you look at the demographic headwinds, the more acute they are, not only because of the decline in aggregate and working-age population, which hits consumption directly, but because of the structure. An economy that has not seen structural reform will have significant problems generating employment. All of these strategic industries are far more capital-intensive than labor-intensive.

The China scholars engaged in this debate think the constraint on China’s growth model is domestic, and the trade folks think it’s external. Eventually there’ll be pushback. It may be a combination of the two. But one way or the other, none of this looks sustainable. There are far more forces of entropy than inertia here.

Jordan Schneider: Hu Jintao comes to the US in 2006, and George W. Bush, he’s a China guy, asks: what keeps you up at night? I’m stressed about terrorist attacks. Hu Jintao says: creating 25 million new jobs every year. You recount the story of youth unemployment rising past 20% and the statistics disappearing in 2023.

It doesn’t really matter if you have a BYD that costs ten grand if your kid can’t get a job. Remember how freaked out people were in America when unemployment was 6% in 2009 and 2010? The social malaise generated when big swaths of the economy can’t get a job at all, or a job that befits all the hard work of the gaokao, of being the first in your family to go to college — and then they’re stuck delivering packages or going back home — is an enormous social challenge. Xi must appreciate that at some level. How does it cash out in his head?

Logan Wright: I co-taught with Michael Pettis for years at Beida in his shadow central bank seminar after the global financial crisis. I’ve interacted with a lot of Chinese students and had several as research assistants. The intensity of the social pressures in that hyper-competitive environment, relative to how an American educational environment is structured, is really difficult to describe. You’re exactly right.

How they think about it is a different question. Fundamentally, this is a Marxist worldview of development: we’re building the industrial structure and industrial capacity, and from there, growth has always come from investment; employment has always come from investment. That’s how the model has worked, and you can’t demonstrate that it’s not working now. Yes, there’s a youth unemployment problem, but maybe that’s part of a transition; once these new industries are up and running, things get better. We had these problems when we joined the WTO in the late 1990s. So they downplay it. They don’t think it’s structural; they think it’s cyclical. I can see those arguments percolating within the system. But honestly, I’m not sure they are.

The thing we know least about at this point in the Chinese policymaking process is how information flows from ground-truth economic reality into filtered argumentation at the top. We read Qiushi, the party journal, pretty carefully. These are not reassuring messages that they really get it, or that economists within the system who do get it are having success filtering messages into the party apparatus. Qiushi had an article in mid-August asking, essentially, why are people’s lived experiences of the economy different from our stated growth rates? I urge you to read it. The response basically comes back: well, they haven’t adopted new technologies yet, and if they use more AI in their daily lives it’s going to be better.

Jordan Schneider: Biden tried that argument. It didn’t turn out super well for him.

Logan Wright: The analogy is extremely overextended, but normal people aren’t reading Qiushi. This isn’t a form of campaigning.

Can AI Save It?

Jordan Schneider: The book makes a pretty compelling case that there are no easy outs. All the reforms are hard, and all have serious political downsides, from rearranging power structures to making people unhappy, such that we’re stuck. Take that as a premise: we’re in a low-growth universe, and it’s unclear where the jobs come from. Logan, is AGI going to give us the jobs? Can humanoid robots or DeepSeek V7 save China’s economy?

Logan Wright: You’re asking rhetorical questions. The entire purpose would be to displace manufacturing labor.

Jordan Schneider: Fewer jobs as robots take over, AI doing more work for fewer people.

Logan Wright: Marginal labor productivity can increase while overall labor force participation collapses, which is a likely path.

On AI: we’ve just done a deep dive on China’s AI financing. People assume the state can maintain AI financing indefinitely. It doesn’t really look that way. The frontier models collectively look like they’re generating single-digit billions of dollars in revenue — about $11 billion at this stage for all the frontier models. The hyperscaler build-out is in the range of 930 billion yuan, about $135 billion, this year, and looks like 1.2 trillion yuan, around $160 billion, next year. That’s about 15% to 20% of the US build-out as of now.

The problem is that it depends largely not on the bond market but on the equity market, and on the equity market maintaining extreme valuations. Government guidance funds provide some portion of financing, but just for the hardware, the chip purchases. If China is compute-constrained and increasingly finance-constrained, you’re setting up a situation where the call on industrial policy to fund this new strategic industry keeps rising, for business models that do not look self-sustaining.

So what is this for? That becomes the notion of embedding China’s tech stack in consumer electronics and using it for geopolitical leverage and supply chain dominance, which is a different argument. But it’s not for making money, it’s probably not for making jobs, and it’s probably not for making AGI either.

Jordan Schneider: These are toy companies, and OpenAI and Anthropic are not. They’re making tens, hundreds of billions of dollars.

Logan Wright: They’re not making money.

Jordan Schneider: Right. But they have real revenue to point to, which DeepSeek and Kimi can’t. Alibaba can, but not from the model stuff.

Logan Wright: Moonshot just posted a new number, but it’s all ARR based on four weeks of best performance.

ByteDance has had the largest marginal expansion this year, and my understanding is they’re funding it through an offshore loan, so it’s not necessarily a domestic system. But they’re not generating a lot of revenue right now either, based on what we can see.

From Shadow Banking to Finance as a Utility

Brad Setser: Logan, one of the strengths of your book is how you highlight that the state financial system went through phases of evolution. It hasn’t been one constant set of five state banks providing a constant stream of financing to the same borrowers for twenty-plus years. Some of what we called shadow banking, some people in China thought of as the first steps toward a true market and more competitive banking, but that phased out. Now you’re arguing that weakness in the system has led it to center once again around the state and lenders with a state equity backstop. What’s the next phase? What does China need to do to have a more functioning financial system?

Logan Wright: Their answer right now is that a more functioning equity and bond market will provide meaningful diversification from the state system. That’s how Pan Gongsheng, the PBOC governor, talks about it: we have these new industries, they’re less dependent on the state banking system, therefore it’s okay that loan growth is slowing. Not an unreasonable argument. The problem is the limits of the equity market, the scale of participation in it, and especially the bond market, where there isn’t effective pricing of capital because everything is still priced on implicit state guarantees in some form.

But you’ve put your finger on one of the key stories of the book. Between 2012 and 2016, you had virtually an entire transformation in how the Chinese financial system operated, and almost no one noticed until it was over. You went from a system with a very steady deposit funding base, engaged in financial repression, making loans to state-owned enterprises that were inefficient but where you understood where the money was going, with persistent capital inflows and no external funding problems. By 2016, all of those parameters had changed. The marginal source of growth was a loan to an unregulated entity: a property developer, a third-party asset manager, a local government financing vehicle. The marginal funding came from a wealth management product or some other non-deposit liability. And there was a lot of volatility in the balance of payments, responding not to trade flows but to short-term capital flows and interest rate differentials.

This changed so quickly that you’ve had a recentralization. The trend now is more party governance of the financial system and treating finance as a utility. It’s underappreciated that in 2018 China created for the first time a super-regulator, the Financial Stability and Development Committee and Commission under Liu He, to regulate shadow banking and get all the regulatory bodies under one roof to prevent regulatory arbitrage. Five years later — very quickly in Chinese bureaucratic terms — this was thrown out. Liu He is gone, He Lifeng is the relevant Politburo member for economics and finance, and instead you have party commissions, the Central Financial Commission and the Central Financial Work Commission, conducting the anti-corruption investigation within the financial system. That has reportedly recently ensnared Fang Xinghai, one of the primary Western interlocutors, which sends a chilling signal to the rest of the reformers.

In this environment, if you’re a younger financial technocrat, this is not the time to raise your hand and say, “I have a great idea.” There’s oversight everywhere you look: crackdowns on salaries, oversight of expenses, ongoing anti-corruption investigations. The net result is: lend to state-owned enterprises and go home. The classic line was 3-6-3 — borrow at 3%, lend at 6%, on the golf course by 3. I don’t think anyone’s going to the golf course, but people aren’t spending a lot of time thinking about where money should be allocated.

Look at the last three years. People do not realize the extent to which credit has slowed. In marginal new financing from the state banking system, we’re talking about roughly a ten-percentage-point-of-GDP decline on a flow basis. Credit growth went from an aggregate of 18% a year from 2007 to 2016, to 9% from 2017 to 2024. We are now at five. Bank assets net of government bonds are growing 4.9%. Renminbi loans are at 5%. Loans to consumers are contracting outright. These are the structural problems. These are not conditions, in which consumers are deleveraging and household income growth is slowing, where you can expect any explosion in consumption, outside of a massive fiscal reorganization and a massive change in how the government raises and distributes revenue.

Property, Taxes, and the Fiscal Fix

Brad Setser: Two precise questions. The IMF has said China needs to do a big cleanup of the housing sector: budget government money to assure all the pre-sales are completed, recognize losses, shut down some property companies, recap the banks if necessary. Do you agree? Second, one of the more striking lines in the book, at least to me, is that the taxation system needs to be reorganized and consumption taxed more. That’s striking, given that if you want consumption to grow, you don’t normally tax it.

Logan Wright: The property sector is a bit of a distraction at this point. There’s a lot of official rhetoric, and rhetoric from the IMF, focusing on property. It’s not that it isn’t important, but the story has played out. Further repair of the property sector is going to have a pretty low marginal impact on growth. There’s not much demand for property. Home ownership rates are relatively high. Developers are still impaired. What are you bailing out, and why? It’s a distraction from the fundamental nature of the entire financial system to think that if you solve this one sector, you solve the overhang over the economy.

China claims they’ve already solved the pre-construction sales problem by putting new systems in place to stop developers from using pre-construction financing, and by our accounts this is not a huge overhang anymore. Instead you have a bifurcated market. In interior cities there’s tons of supply, no one’s moving in, there’s not going to be demand, and you’ll have to write off those assets. In coastal cities there’s a mismatch because nothing was built for three years, people are still moving in, and the secondary market is capturing a lot of sales. There’s no real incentive for new construction, and upgrading demand is very patient. So which developers do you bail out, and what do you get in future growth by doing it?

On consumption tax: this is a contradiction that reveals exactly the constraint they face. You can’t change the growth model if tax revenue depends entirely on investment-led growth and trade, which is what’s going on. You have to broaden the tax base, but in broadening it you end up taxing consumption, which you’re trying to encourage. One way around that is luxury taxes or taxes on higher-value items.

The fintech revolution has changed this too. My colleague Allen Feng points out all the time that the effective tax rate of the catering industry has basically collapsed over the last ten years, because small service businesses collect payments on WeChat Pay and Alipay with no tax reporting obligation whatsoever. There are ways to broaden the base just by catching up with changes in the structure of the economy. They will be noticed, they will affect consumption, and they’re arguably long overdue. Property taxes have long been discussed but were too difficult to implement: no national land registry, local enforcement problems, corruption.

You need an extra four to five percentage points of GDP in tax revenue one way or another, or at least a path to get there. Investment-led growth keeps declining, so that’s not a stable source of revenue either. What have they done? They’ve cracked down on overseas individual income tax evasion, which has actually increased individual income tax revenue, but that’s a little over 1% of GDP anyway, so it won’t move the needle. They’ve cracked down on local governments’ tax exemptions to companies in the name of a unified national market. That hasn’t had much impact yet but could pick up. And there are one-off tax treatments hitting listed companies’ revenues this year that are getting noticed but aren’t sustainable. There’s increasing awareness of the revenue problem, even if it isn’t acknowledged. Ultimately, you have to change the entire system, and that’s dramatic for local government investment, because it likely means local government investment and overall growth slow if you change how the tax system incentivizes these forms of output.

How Much Economic Reform Is in the De-Stalinization Speech?

Jordan Schneider: Xi has laid his cards on the table. He’s been around long enough to have danced with the economic reformers and peered over the ledge. We’ve had you on to talk about Huarong and Evergrande, about 2015 and 2016. Every time, he’s internalized the potential downside of disruptive reform that would actually unlock the economy, put credit in the right places, stoke domestic demand, and probably produce more productivity and employment, and he’s said: no, this is too dangerous. As you allude to, he’s led China down the path Yakov Feygin describes in his book, which we covered on a prior episode: the Brezhnev era. Let dead economic dogs lie and keep plodding on. He can comfort himself with the bet on manufacturing, exports, and technologies of the future. As long as he’s running the show, that bet probably isn’t going to change.

So let’s think through the bounds of what whoever succeeds him will be playing with. Not revolution — someone who has won a Joseph Torigian knife fight over the next five to seven years and is thinking about economic priorities slightly differently from Xi. How much operating room will that person have?

Logan Wright: This is one of the critical questions. We pithily describe it as: how much economic reform is in the de-Stalinization speech? And I mean that seriously. Not only has Xi Jinping created new financial risks through policy actions hitting particular sectors, but there’s an inverse relationship between the centralization of power and the credibility of countercyclical policy.

The book argues China’s future is highly contingent. We should not assume these trends continue inevitably; many of them are unsustainable, so they will change. The question is how, and by whom. There’s an optimistic version where Xi Jinping, because he controls enough of the levers of power, abruptly changes his previous pattern of governance. No one in the party stops Xi Jinping from going on television tomorrow and saying: comrades, the fiscal and financial systems we’ve had worked for the last ten to fifteen years, but they won’t work for the next ten to fifteen. We’re going to tax the wealthy, break up SOEs, dismantle local government financing platforms, shore up migrant workers’ pensions with the proceeds, sell a bunch of assets. That means slower investment growth, but everyone will be better off and it’s a more sustainable future. There is no physical obstacle to that speech. That’s the optimistic case.

Why won’t he do it now? First, he doesn’t really believe it. Second, the East is rising and the West is declining, and the East can’t have a problem this fundamental. There’s an ideological question. But the other reason is that as long as strategic competition is a meaningful constraint on Xi’s or his successor’s policy, those considerations will prevent China from acknowledging these problems. So one of the critical issues is how you mitigate strategic competition, and how China sees paths out of it in terms of the space it has to operate.

On Feygin’s work: thank you for mentioning it, because it’s really underappreciated. I set out about three years ago to answer the question of how the Soviets internalized their economic decline. I kept looking in the 1980s, and others finally directed me to the 1960s, because that’s when the debate actually happened. Yakov’s is the only book with deep work from the Soviet archives chronicling the Soviet economic reform debate, and he reaches exactly the conclusion you describe: Brezhnev chose decay. He chose decay, the scientific-technical revolution, and cybernetics, because the Soviets thought technology would work for them — we’re better planners, so we’ll use technology to allocate resources effectively. Kevin Rudd has recently published on how China thinks about AI the same way: AI is the way we get out of relying on markets, because AI will tell us how to allocate resources. It’s ideologically where they’re coming from.

The key point of the Soviet history is that the Soviets regularly relaxed the assumption of strategic competition. That gave way to periods of détente. The Cold War was persistent, but competition was more intense at some times than others. If China relaxes strategic competition with the West on multiple fronts, there will be ample opportunity to reconsider a lot of these options. It’s worth considering what the future of export controls looks like: I don’t think any export control practitioner would have imagined AI model distillation as their key threat, but doesn’t that present a more fundamental threat than many of the things they’re trying to prevent? That’s where the scope is open, under Xi Jinping or his successor.

To sum up something I think about all the time: the longer Xi is in power and the more the status quo persists, the more probable a break from these patterns becomes. But if there were a succession in 2027, or a clear delegitimization of Xi in 2027, I’d argue a break is less likely — a successor would more likely continue this, because there’s no obvious pushback from the rest of the world yet, no obvious message that the model is failing. That’s another theme of the book: this will probably not fail on its own. But China will notice when things fail. They’ll notice when they cannot export at the same rates. They noticed when local governments went bankrupt, on Xi Jinping’s trip to Gansu in 2024, and panicked. This is a responsive system, and it will respond to the model changing. It’s grinding and decaying, but it has not been forced to change yet.

Jordan Schneider: You focus on the external signals. I wonder if the internal ones come first. I think it comes down to unemployment. You could be the leader of China and see the unemployment statistics and say: this is not tenable, I need to change it tomorrow. Even if it’s a Xi Jinping heart attack in 2027 — a Li Qiang or whoever, we can go down the list, I had a tier ranking made of who wins the fight in 2027 — I could see at least half of those guys becoming a nerd about unemployment numbers. Not caring about unemployment is something that only happens after a long time in power. Even Xi in 2013 or 2014 would probably be more freaked out about it. Not that there’s going to be a revolution tomorrow, but this is the core issue. What has been his core economic focus? Anti-poverty and commanding heights. His conception now is that anti-poverty is solved, so we don’t have to worry about the social stuff. You could still have risen to the top of the State Council today, look at the median city-dwelling Han Chinese national, and say: this is not good long term. I need to reorient.

Logan Wright: You may be right that the internal pushback is more severe. Many of the China scholars I trust think that’s the case — that Europeans will never push back against Chinese trade faster than Chinese workers will call for change. The problem is: what do they ask for, other than jobs? There’s a big gap between “we have a jobs problem” and “we have a structural economic issue that requires a multi-year fix.” It’s one thing to call for more subsidies to improve the cost of living. It’s quite another to call for structural change. There are people thinking about it within the system, for sure.

One of the lowest-hanging fruits they have is equalizing the rural and urban pensions of migrant workers. It costs roughly 130,000 renminbi per person, for 250 to 300 million people — about a 30%-of-GDP problem. But it can be financed, and you don’t have to do it all at once. You can have the central bank buy special bonds, a trillion yuan a year. You can start with the young, so they have a social safety net, see a future and can spend more aggressively. But they’re not doing any of this. It’s been discussed: Liu Shijin called for 10 trillion yuan in these kinds of bonds in 2024, and it’s been part of the new-urbanization dialogue for some time. Instead, the fiscal pressures manifest as: we can’t do it; we need to tell the companies to do it. So they tell Meituan to do it, and it happens in dribs and drabs. Not the reassuring reform you’d want.

So there are pressure points. I just don’t know how they produce the kind of change we’re talking about in how the model operates. The dilemma is that you have to envision Xi Jinping changing his mind. That was the zero-COVID problem as well. China is a one-party state with a technocratic elite. How could they have such a botched exit from zero-COVID in November and December 2022? The answer is simple: Xi Jinping wasn’t allowing it, until he did. Then there’s no explanation and no discussion; the world moves on, and we’re not criticizing that decision anymore. That’s harder to do with these kinds of pressure points.

Jordan Schneider: The other issue: you spotlight Zhu Rongji as a guy who made tough decisions, there was pain, and then China got multiple points of GDP growth for five or ten years. The other playbook is the 1980s, where market liberalization goes haywire with inflation and things almost completely collapse. The payoff matrix Zhu Rongji expected on the other side was double-digit growth. What do we get on the other side of the Logan platform? Three percent growth, two or three years later? Is that going to make up for the near-term pain and all the political fights it kicks off? You need a real hold on the party to force this through, because you’re forcing people with power, money, and influence to take haircuts.

Logan Wright: That’s a very good point. It’s hard to marshal support for “we’re going to get back to roughly the growth rate we were at, at a more sustainable rate, less dependent on the rest of the world.” But it’s not just China’s leaders who should think about that. American leaders, and the rest of the world, should think about what happens after this model changes: how do you create the political space to facilitate that accommodation once you’ve seen the path out?

That’s exactly why my book is not a prediction. It’s an explanation of how we got here. The future is highly contingent. It depends on exactly the choices you’re describing, whether from Xi in response to a failing model or from the next generation of Chinese leaders, and also on how the rest of the world accommodates it, and whether there’s a path out of or to mitigate strategic competition on the other side.

What It Means for the Rest of the World

Jordan Schneider: I remember doing a report at Rhodium on US-China relative GDP out to 2050. For China to be number one, it needed to grow two to three percentage points faster than the US for a few decades. If we’re in the world you’re describing, where that’s not even close to happening — the US grew what, four percent last year, in nominal terms, and China’s stuck at half a percent —

Logan Wright: It’s nominal dollars. And that can happen with a massive depreciation of the dollar and under almost no other circumstances.

Jordan Schneider: Taking that as a premise: what’s the takeaway for policymakers around the world if China is maybe growing as a share of global manufacturing but not as a share of global GDP over the next decade-plus?

Logan Wright: This is what I address in the Foreign Affairs article. The takeaway is that you don’t have a systemic economic rivalry with China in the sense of worrying about China overtaking the Western democracies in economic power over time. What you worry about is that China’s concentration of industries and manufacturing power is exceeding the red lines of resilience that we want in Western democracies for our defense industrial bases and our economic security, especially in light of China’s weaponization of supply chains, which has made previous conceptions of economic efficiency far less relevant in a world where trade is fragmenting.

The net result: China has not been successful with this model, and is under more pressure than everyone thinks to maintain access to open markets for its manufactured goods. The rest of the world has a lot more leverage over China than it is currently using. That leverage is best delivered collectively, because China is less vulnerable to trade restrictions from any individual country, including the United States. But China’s tools of restricting supply will become less salient over time than tools that threaten China’s access to Western, or G7, demand, which will become more salient as long as China cannot grow relative to the rest of the world without displacing export share abroad. As long as China can’t grow faster than its customers, and the marginal demand for everything it produces is outside China, they face these strategic headwinds.

It’s not a short-term versus long-term problem. There’s a military and security threat from China. There’s an industrial and technological competitiveness threat. But there is no longer really a systemic economic rivalry. And that makes those first two threats deterrable, not inexorable.

Jordan Schneider: Brad, do you buy it?

Brad Setser: I would not go so far as to say there’s no systemic economic rivalry. There are ways of measuring economic competition other than the competition to have the world’s largest GDP. There are many areas of the global economy where the US and China compete, and they’re competing to demonstrate that their respective models give them more leverage than the other, even though those models generate different sources of leverage. At least for now, the perception is that China’s supply chain controls have been more potent than the US’s demand-side restrictions. Until that perception changes, the notion of rivalry will persist.

To conclude: China has been growing faster than its markets. Its exports have clearly been growing faster than its markets, and its imports less fast than reported demand growth — though you’d probably say, accurately, that reported demand growth is overstated. Is that pattern worth preserving if it means China is stagnant in the rest of its economy? Are we, in some sense, better off with an unbalanced Chinese economy than a more balanced one?

Logan Wright: That’s a very valid question. Your summary is accurate: so far, political coalitions around demand-side restrictions have not been as effective as China’s supply-side restrictions. I’d argue that’s a tactical problem rather than a fundamental imbalance between the two tools. The other pushback I get on the Foreign Affairs piece, which is valid, is that there’s a difference in political objectives. In Western democracies, where you’re balancing consumer and producer welfare to a greater extent, it’s not always politically sustainable to use demand-side restrictions for strategic leverage. That’s a tactical problem too; there are ways to design around it.

But it goes to your question: maybe an unbalanced model, with global imbalances expanding, is still more beneficial for global consumers in aggregate than it is harmful to security interests and global producers. I think that argument breaks down pretty quickly, as it’s breaking down in Europe right now, based on China’s weaponization of supply chains. If China were still using more carrots than sticks, and had framed its goals slightly differently, it would be a more salient question.

The interesting thing in global imbalances right now is how much the delta in trade this year, and in Chinese surpluses relative to the US, is tied to the AI trade. Dollar recycling from China is no longer done by a sovereign reserve manager but by commercial banks acting at its behest, and it’s increasingly going into overseas portfolio assets, equities and bonds, while the US capital account surplus is increasingly funded by those same inflows rather than Treasuries and agencies. So you have Chinese hardware exports funding data center build-outs, and the recycling of those dollars in Asia back into hyperscaler bonds and tech equities, which has kept this model afloat. It goes to your question: isn’t this working out? If we saw a big disruption in those flows, we’d see a big disruption in those engines of growth at the same time.

I’d argue the domestic foundations of this in China are not sustainable, for the reasons we’ve discussed, so it will end one way or another. The question we grapple with in global imbalances is whether they end abruptly or you can smooth your way out. Historically, they’ve ended abruptly. Are the asymmetries between supply-side and demand-side restrictions tactical or structural? I’d argue there are still clear pathways to escalate pressure on the fastest-growing sources of Chinese exports without extensively impacting Western consumer prices, while delivering meaningful restraint on China’s model. The question is to what end. What industries are you trying to support? Where does it make sense to reinvest and develop industrial policy? That’s a much broader set of questions. In Germany, it’s probably easier to answer them today than in the United States. But there you are.

Brad Setser: Congratulations, Logan. It’s hard to find a better summary of how China’s financial system has evolved anywhere.

Jordan Schneider: I remember reading Arthur Kroeber’s China’s Economy: What Everyone Needs to Know close to ten years ago, and this is the sequel, explaining why growth has fallen off a cliff and won’t come back anytime soon. You’ve done it in a way that is accessible, gripping, and provocative.

What’s the theme of ChinaTalk nowadays? Chinese national power, where it’s going, and how emerging technologies fit into that. Your book, for folks who don’t have a PhD in Chinese central bank dynamics or haven’t been playing in the markets for twenty years, contextualizes how these emerging technologies relate to the broader Chinese economic system and to the party’s credibility with the population that it has the mandate of heaven. As you alluded to with the journalists, it’s fun to focus on the shiny stuff. There is real development and real delta in those industries, in a way that 80% to 90% of the Chinese economy just does not have. It’s totally stuck and will continue to be stuck for a really long time. To think that AGI brought to you by DeepSeek is going to unstick that 90% and unwind all their problems is the bet Brezhnev made in the 1960s: hoping you roll snake eyes eight times in a row and solve all your problems with a technology that, even if it hits the third standard deviation of what people hope for, will not solve the problems you needed to solve.

Logan Wright: I agree. The issue is that there’s been very little rethinking of the strategy at high levels, even after the headwinds emerged. Maybe these AI companies develop world-leading technologies; maybe we embed them in consumer electronics and advanced manufacturing; therefore, we can continue. But nobody is stepping back and asking why we’re trying to do that, and what it looks like if we succeed. There’s a lot of thinking about incremental progress in technologies that will be world-leading, without thinking about what happens if they succeed and what it’s in pursuit of. That won’t happen until there’s real external pressure. We’re starting to see that pressure mount — I’ll be interested in the debates in Europe — but China is still very complacent about the possibility of a much larger pushback.

Jordan Schneider: Is it less fun to be an analyst of a country growing at half a percent a year?

Logan Wright: I joke about that. I’ve been doing this professionally for 21 or 22 years, and there’s something new and interesting every year, even following the same economy. From interviewing Chinese pig farmers extensively in 2007 to understand the pork cycle and how it fed into CPI, to tracking trade pushback and AI financing this year, to different patterns of global imbalances — there’s always something new. We won’t run short of topics.

The other thing is that China tends to put new words on the same old concepts. “Involution” becomes the catchword because you can’t say we already tried supply-side structural reform. Instead, we’re using a word identified with Indonesian agricultural policy, because we need a new word for it. As one of my analyst friends says: “they’re just making up new slogans, so they’re not reforming.”

Jordan Schneider: It’s a long quest to expand your Chinese vocabulary, and if it takes Xi to come up with new four-character phrases, we can’t complain.

Logan, you’re tempting me back into a ChinaEconTalk renaissance. We’ll re-launch the old spin-off.

Logan Wright: As I joked with someone earlier today, when I got into this field, people just covered Chinese politics, and the economics was all very exotic. Then it became completely mainstream, and now we’re back to exotic again, because people aren’t focusing on it nearly as much.

Below the paywall…live footage of the PengYe rap battle:

We discuss…

• The Potemkin Pacific — why Paparo has half the planet on his map and nothing to fight with, and how the Iran blockade became the status quo

• The midterm budget squeeze — what a Democratic Senate means for the defense topline, why Anduril won’t keep working at risk, and how a shipbuilding binge could hollow out the force

• Who replaces Hegseth — the two Mike Rogerses, and why the talent pool for a lame-duck Pentagon is drying up

• The AI Force — why a SOCOM-style AI branch cuts against a technology meant to be everywhere, and what a benchmark-setting version could actually do

• Manned-unmanned teaming — why putting sailors on robot ships is “asinine,” and what combined arms for robots should look like

• Gifts for Beijing — the Anduril drone Iran fished out of the Gulf, dud PrSMs as intelligence windfalls, and why compute still can’t blow anything up on its own

Listen now on your favorite podcast app.

Potemkin Pacific

Jordan Schneider: WarTalk, Friday, September 25th. We’ve got the AI Force —

Justin McIntosh: “Farce” is the right way to say it?

Jordan: AI Farce, great. Paparo watch has begun — he was on the cover of Time, and I’m worried for him. The Iran war is apparently about to hand the Democrats three Senate seats. But this is sort of ChinaTalk, so let’s start with the state dinner. Takes?

Bryan Clark: Maybe the most interesting video from the whole visit was the B-2 flyover. The president was wincing, not really able to handle the noise of the stealth bomber going overhead, whereas Xi stood stoically and almost looked bored with the whole thing. That kind of sums it up in a nutshell. Xi was bored, going through the motions.

Jordan: All right, WarTalk. I can’t get over that he restarted this freaking war. He could have gotten away with it —

Bryan: Right, he could have still walked away. But as of this week, we’ve still got two carriers, about sixteen destroyers, and thousands of troops ashore.

Justin: And 30% of our missile stockpiles.

Bryan: When you add up the numbers, something like 40% of the underway Navy is sitting in the Middle East right now. So you’ve got Admiral Paparo on the cover of Time, while all the forces he’d otherwise command — including the carrier he’s on, as a matter of fact — are deployed to the Middle East. That’s the definition of a Potemkin navy.

Justin: They had to deploy him to the Middle East for that photo.

Tony Stark: The Time tagline was that his forces cover half the planet and he has to win without fighting. Yeah — because he’s got no assets.

Bryan: He has to, because he has nothing to fight with. He owns half the world from an operational perspective, but has no forces to actually do anything with. So yes, he’s going to be winning without fighting.

Justin: The idea that his forces cover half the earth’s surface is completely incorrect. Somebody shaded in Paparo’s land on a map, and that’s about as far as it goes.

Tony: That was actually a keep-out zone for US forces.

Justin: They used to have this big argument — they always wanted some kind of command post forward of the international dateline. But it would literally be two hobos with packs on their backs, and that was all they had. Then they’d say, “We need to borrow forces.” And we’d say, “Whoa, you’re supposed to be in charge. What are you doing?”

Bryan: The funny thing is, they just renamed Indo-Pacific Command back to Pacific Command this year — a big change to try to get back to tradition. Meanwhile, all the forces in the command are actually in the Indian Ocean. If you really wanted to command those forces, you’d want to be Indo-Pacific Command, because that’s where your whole Navy is — there are something like 24 or 25 ships out there right now. It’s a crazy statement on where we are with the big pivot to China. Xi’s visiting the US, all of our forces are in the Middle East, and Paparo’s on the cover of Time talking about winning without fighting.

Tony: The largest force presence in the Pacific is actually that F-35 that got shipped to Hong Kong.

Bryan: Tony’s here all week. Try the chicken.

Justin: Oddly enough, it’s the one right behind Paparo in the photo.

Bryan: Still missing a canopy. We’re still looking for that.

Justin: Somebody asked how they knew it was being shipped from Australia —

Bryan: They used a shipping company, and every shipping company is so penetrated by the PRC at this point that it’s not even worth having a discussion about.

Jordan: Should I only use FedEx in protest?

Bryan: They probably used DHL. And DHL’s Russia-penetrated.

Justin: This is something we used to complain about all the time. The only way to deploy forces to the Indo-Pacific — 1st Group struggled with this a lot — was to contract with DHL or FedEx. At one point we got so far behind on payment, because we went through a government shutdown, that FedEx cut us off. FedEx is a real company and expects to be paid for the services it renders. They said, “We’re not taking your shit anymore,” because we were about four months behind on paying for JCETs [Joint Combined Exchange Training] that happened right before the shutdown.

Bryan: All the services rely on that. The Navy relies on DHL and FedEx to ship parts all the time. It’s crazy that this level of exposure is there and we don’t put much thought into the vulnerability it creates for just-in-time resupply. And we don’t have enough parts to do it any other way. There aren’t enough to station them forward or keep them on supply ships — if you’ve got three parts and they’re all sitting on a cargo ship somewhere, no one can use them.

So the war continues. We’ve got all these forces in the Middle East, and we’ve decided the blockade is the only way to get the Iranians back to the negotiating table — and that it’s somehow paying off. There are no other cards to play, so they’re doubling down. We’re going to keep two dozen ships in the Arabian Sea running a blockade the Iranians are now essentially ignoring, conduct periodic strikes against Iranian targets that pop up, and protect an anemic flow of shipping out of the Persian Gulf. That’s the status quo.

And you’re right, Jordan. The president could eventually say, “Okay, we declare victory. Everything’s good. We’re walking away.” Everybody accepts that the baseline cost of oil and gas goes up a little, you’re paying a vig to the Iranians, and that’s the end of it. But he just couldn’t stand the idea of being portrayed as the loser in this conflict — and the Iranians would do exactly that. They would not let him get away with declaring victory and going home.

Every Service for Themselves

Tony: What’s really going to look like a loss is if they go through with a diesel export ban, because the entire world economy will probably crash. I think we refine something like 20% of the world’s diesel.

Bryan: We export a lot of diesel. It’s shocking.

Tony: Which is a great pivot to the midterms, because we are now thirty-nine days away. To Jordan’s point, the war is probably going to cost the GOP extra Senate seats. For those not tracking: we were probably looking at Democrats picking up ten to fifteen seats in the House and one or two in the Senate at most, or maybe a 50–50 split. Now you’re looking at probably plus four for the Democrats in the Senate, and somewhere between plus twenty and plus forty in the House.

Bryan: We did a summit yesterday at Hudson — Chatham House rules — and we had some minority staffers from the Hill there. They basically laid out the case that when the Senate flips to the Democrats, we’re going to see defense budgets flatten, if not go down. They won’t be on board with the continued largesse the department’s been enjoying for the last couple of years. And I don’t think folks inside the department have organized their processes around that. Their decision-making is built on the idea of more and more money coming in, so they can spread it across a more and more diverse array of startups and experiments. It’ll be interesting to see how they pivot to accommodate a smaller top line.

Tony: And that’s the thing. Normally you can rely on flat budgets, or maybe a 1–2% increase, even if the House or Senate flips. Usually HAC-D [the House Appropriations defense subcommittee] is the problem. But it seems like the Senate is really going to go after Hegseth on this, because the Secretary of Defense is so unpopular.

OSD Policy under Bridge [Colby] has not communicated with Congress, to the point where now it’s not just “we’re going to play a little hardball, but you’ll get your funds too.” It’s “actually, we’re going to make it hurt.” I’ve said this on the show before, but a lot of these folks are either checked out or aren’t used to a transition in Washington and what that looks like. Thirty-nine-plus days from now, it’s going to look like absolute chaos. Bryan, I think you said it in our chat — every service for themselves.

Justin: You’re starting to see it even in the defense tech market. Anduril came out and said, “If this budget doesn’t get approved, we won’t be able to work at risk anymore.” That’s been the Pentagon’s go-to over the last couple of years: juice these defense tech startups to use VC money and work at risk on the promise that we’ll give you money at some point in the future. Anduril’s finally big enough that it’s starting to land where Raytheon, L3Harris, or pick-your-prime is: “We’re not doing that. You’re going to have to pay us at some point.”

Bryan: These companies are also all going to have to start making themselves financially viable for an IPO. If you’re going to IPO, you don’t want your balance sheet to show you working at risk for the government in so many places that you’ll never get a return on investment. So I imagine more of these companies will get judicious about how much R&D they do on their own dime. And you can see the department starting to do more deals where it arranges funding from an outside entity to supplement the company’s own R&D, because they recognize the days of massive VC investment to grab market share are over. Partly because the market share just isn’t materializing. If you’ve got ten companies making small USVs, there’s not going to be a big enough market for all ten. Eight of them are going to wash out.

Tony: Can we talk about the Fed for a second?

Justin: I was literally about to bring up the dot plot.

Tony: If we’re looking at more rate hikes — somebody did a chart of the historic crashes in the US economy, and the worst ones are always when the market is propped up by a surge in a single sector. Railroads in the 1800s, speculation in the twenties. The concern is broader than defense tech. If the entire economy is basically being carried by the AI boom, what does that look like as the cost of money goes up and you can’t finance deals as easily? And that comes back to how the government is going to fund the rest of the budget if it’s flat or even lower.

Bryan: One of the challenges I see is with the One Big Beautiful Bill, and even this budget. The current budget will probably get approved in some form because people want it off the table before Congress changes hands. So you’ll end up with this relatively large budget this year, the $1.1 trillion or whatever, and then it flattens out if it doesn’t go down. But these budgets have an enormous amount of capital investment in big platforms that are expensive to keep. There’s something like $82 billion in shipbuilding in this year’s budget, on top of $60 billion in last year’s. Ships cost a lot to crew and maintain, and the same goes for all the fighter aircraft in there.

We’re setting ourselves up so that three or four years from now, all this force structure arrives and there isn’t enough money to keep it. So either we retire the old stuff and the military stays the same size, or we become hollow and let readiness falter, because nobody wants to be part of a shrinking military. The Trump administration at the end of its term will be trying to keep the military big, probably at the cost of readiness.

Justin: The rising cost of capital is going to be a big determining factor, too. We’re already seeing that VCs can’t juice as much. There’s a ton of debt sitting in the wings that’s getting more expensive — the old debt’s fine, I got that when rates were good, but my new debt is terrible.

I also wouldn’t be surprised if the appropriators start looking really hard at how these deals are getting made. Take the way the competition went down for NGC2 [Next Generation Command and Control], the new command post integration effort — the fact that Anduril was able to partner with Palantir, but Lockheed wasn’t. There are a couple of things where I think people are going to look really hard and ask, “How did this happen?”

Bryan: The Army’s C2 efforts over the last decade have been very ad hoc and kind of chaotic. NGC2, the latest iteration, is going to be another one where they start down a road and a year later say, “We can’t continue this. We have to pivot to a new construct.” The Army and the Air Force are both having these issues with their C3 architectures. They’ve spent a ton of money on them in the last few years — the startups have been part of that — and I think we’ll find on the back end that they have to retool again. It’s just unsustainable.

Who Wants This Job?

Jordan: I want to talk about investigations. You mentioned Palantir — Palantir and ICE will be a thing. And Hegseth — where to fucking begin with him? We’ve got Venezuela; we almost forgot about those drone strikes. We have the trading. If he leaves, does that change the tenor of the budget discussion at all? Can you imagine a world where Trump picks a secretary of war who’s somewhat more amenable?

Tony: Let me game this out. Before Pete was chosen for SecDef last time, there was talk around Mike Rogers, current chair of HASC. He’d probably be the most reasonable pick because he comes from Congress. They won’t have to worry about his seat, because they’ll be in the minority and down so many already — the thin margins were one of the reasons he wasn’t picked last time.

I can see a world where somebody like him — it doesn’t have to be him — gets picked as the replacement. Someone who knows they have to talk to Congress, who knows the budgets. Congress is always friendlier to its own. If that happens, maybe you get back to at least flat, or at least you can communicate better. From what I understand, Rogers and his staff are well liked on both sides.

The question is who else wants to come in as a staffer to a historically unpopular administration, when it’s going to be a struggle to get anybody through Senate confirmation. And who wants to be there heading into ‘28? Who thinks this burnishes their credentials versus hurting them? That’s going to be a decision for all the politicals. You could look back at the second Bush term and say it’s close, but in terms of toxicity, if you were a second-term Bush nominee, you were still fine for 2008, 2010. With how the party is splitting now, it’s much different.

Bryan: I agree. Mike Rogers would be a good choice, because if he loses his Senate campaign, he’ll be looking for an opportunity and will be dependent on Trump.

Tony: Is he running for Senate? I was talking about the Alabama Rogers.

Bryan: Sorry — wrong Mike Rogers.

Jordan: That’d be way too normal, Bryan. Come on.

Bryan: I know. That’s why I don’t think the Alabama Mike Rogers will be the choice — he’d have his own perspective on defense, and the president won’t want anybody who’s anything but a rubber stamp for his policies. The Michigan Mike Rogers would be a good choice, because he’ll have lost his campaign and will be looking for an opportunity. It could be a way for him to stay in the mix after a failed campaign against the first Muslim senator in the US Congress.

Justin: It’s like when Chris Miller didn’t get nominated but was appointed acting. Even Chris Miller was seen as somebody the Trump administration had to control in the first term — he had handlers. Then he writes the defense chapter of Project 2025, has a big hand in things, and people said maybe it would be Chris Miller. But if you listen to people on the Hill, that was never even a consideration, because he was a free thinker with his own ideas about where the Army, the Navy, and the military writ large should be focused. So I do wonder who that’s going to be. I doubt we’ll see a return to normalcy in those last two years if the administration is dealing with a truly adversarial Senate and House.

Bryan: In the interest of transparency, I’ll note that I interviewed for a position in the first Trump administration. This was when Mattis was still Secretary of Defense, and the perspective of the other people interviewing was, “Mattis will have our backs, so we can do our jobs.” Yeah, this guy’s crazy and it’s going to be chaotic, but the leadership is a bunch of normal guys who won’t let you get called out by the White House. But as I was interviewing, it became clear Mattis was on his way out. And I said, “Okay, I’m going to pull the ripcord, because I’m not going to hang around for whatever’s next.”

It’s the same thing here. You’re not going to get any support up the chain of command. Whoever goes in is doing it because they feel it’s their last hurrah, their last chance to serve in a political position. You’re not thinking there will be a Republican on the back end you can get in line with. There’s a cadre of people who are MAGA enough to be willing to do that. But I already talk to people in the think tank world who are lining up behind potential 2028 Republican candidates. There’s a shrinking pool of folks willing to serve in a post-Hegseth defense department.

Tony: You’re just going to get the lamest of ducks for the next two years. Everyone will have their eyes on ‘28, because unlike the second Bush administration, there’s a split over the direction of the party. A lot of people, particularly career operators, will be more interested in shaping the party’s future than in carrying out what is clearly a failed project — or at least an unpopular one in their minds.

Jordan: If you weren’t in in ‘25 and you come in in ‘27, I don’t understand the calculus of that individual. Unless you literally just graduated from college and this is your first job.

Tony: You have to be really young or really desperate.

Justin: So we’re going to get the DOGE kids back.

Tony: I’m going to warn everybody listening — not that anybody in that set listens to us — if this is your first or second job out of college and they ask you to be a political, do not do it. It will go really badly for you.

Lemonade from Lemons

Bryan: As a side note, if anybody out there works for the China Aerospace Studies Institute at Air University, we’re interested in hiring over at the Hudson Institute. Please reach out. We’re actively looking to see if any of those folks might want to join our little band that’s seeking to disrupt the department’s approach to defense.

Tony: Can we talk about CASI getting nuked for a second?

Justin: Come on, guys. Reading books isn’t lethal. I’ve never killed someone with a book.

Tony: Sun Tzu famously said, “If you know your enemy, you’re woke.”

Bryan: That’s right. Empathy is the enemy of lethality. You’re a low-T, woke, empathetic person.

Justin: There are two wolves. One says we’ve closed down all the war colleges because their reading is woke and everybody there is stupid. The other one asks, “Why didn’t you guys tell us Iran was going to fight back?” Yeah — global politics is hard. We tried.

Bryan: Some of those are the same people, unfortunately.

One interesting side note: I was thinking about our friend Bridge Colby this week, because he spoke at the London Defence Conference’s Washington forum, and I was there. He’s stuck in a job where he has to make lemonade out of lemons. He’s not following his book, he’s not following through on any coherent strategy — he’s just trying to make it through day by day, like anybody in one of these government jobs. The problem is he’s not candid about that, which a lot of people in the past have been. Political appointees used to be candid that they had competing demands and a boss with his own priorities. That’s just how it is in these jobs. But in this administration, you can’t do that. You have to act like these are all the best ideas ever, and you would have had them yourself if you’d been smart enough.

Tony: Not to sympathize too much with Bridge, because his advocacy that this administration was going to turn around China policy caused a lot of problems. But it does have to suck. He believed in the China fight, and I think he still does, and then he goes in and everyone says, “Actually, you’re just here as a prop. We don’t really care.” For anyone in DC who’s been around that circuit, you get into that position thinking, “I finally have it,” and then they say, “Actually, no, we just used you.” That has to suck.

Bryan: You go give a talk about being hard on China, and two blocks away the president is canoodling with Xi to get him to be nice about AI or something.

Jordan: Did they let Bridge into the dinner? Was Hegseth there?

Tony: His name was on the list, yes.

Justin: On the list I saw, Jensen Huang was listed with the business leaders, along with Tim Cook and all the others. But on the same page as the US delegation was Jensen’s wife, and her title was literally “wife of Jensen Huang.”

If we had the ballroom, we’d do these more often.

Jordan: The more seats there are, the better the odds of some new-media press access — which sadly I didn’t get. I was told that if I were a right-wing TikToker, they would have been able to get me in.

Justin: You and Bret Baier would have been the only two there. It has been funny watching the blowback on those clips of the president speaking with no sound, because none of the press pool is following him.

AI Farce?

Jordan: All right, other topics. The AI Force.

Bryan: Justin has thoughts. I want to hear Justin’s thoughts.

Justin: I do. They’ve announced the AI Force. They haven’t announced what it’s going to be or where it’s going to be. But let me play with the idea. Say they create an AI Force similar to a Cyber Force or Space Force — a branch of the military devoted to AI. Even the idea of an AI Force means you now have two competing ideas that have to coexist. Either AI is so special that we need hyper-specialized capability and knowledge to use it effectively in military and policy decisions, or it’s going to be so powerful that it’ll do all this thinking for us. Those two things are diametrically opposed. It can’t both be able to do everything and be so specialized that you need a special capability.

In some of the documents I’ve seen, they reference SOCOM, NRO, NSA, CIA — “it needs to be like these.” When you start saying that, you’re saying, “I want it to be special. I want it to exist and do its own thing, and I want my people in charge of it.” That’s a very dangerous road to go down if you actually think this is a ubiquitous technology that can raise the median thought and capability of people across government. That’s my opening take.

Tony: As I’m trying to finish this manuscript on what combined arms looks like with warbots in the mix, my concern is that when people talk about this stuff, they’re conflating commercial AI — chatbots, the broader frontier-lab work, which is important in its own right, plus all the government labs that should probably get around to doing something — with the physical autonomy on the warbot, or the heterogeneous controllers for it. Those are two very wide branches: weaponized AI and commercial AI. Talking about an AI Force is really just saying, “I want a group of strategic thinkers to think about AI all day.” The more you segregate this from the rest of the force, the worse it’s going to be, whether we’re talking about the federal government or the military. It’s not just disastrous, it’s pointless.

Bryan: Tony, you bring up a point, though. There may be some value in having people think about how to incorporate AI most effectively into the force. You need some kind of vanguard. Think about autonomous systems: the services were all going to sprinkle them throughout the force, which you can do to a degree. But if you want to figure out how to best exploit them — how to take advantage of the most cutting-edge systems that go the farthest and longest and generate the most dangerous effects — you probably need a vanguard thinking about that. Your general-purpose force is focused on routine activities, and on how autonomous systems or AI can support those day-to-day tasks. Somebody else should be thinking about how to use AI to get the next level of warfighting effectiveness. In theory, CDAO [the Pentagon’s Chief Digital and AI Office] was supposed to help do that, and it hasn’t panned out. But somebody should be looking at it in this advance-guard way, rather than having it diffused throughout the force.

Justin: I agree with that, but whenever we’ve created these kinds of vanguards — look at EW and SIGINT — we end up bifurcating it so much that it becomes useless to the tactical elements. It becomes something you can’t talk about, something you need special permissions, authorities, and funding sources just to use. So commanders at that mid-tier level don’t even think about it, because they can’t access it routinely. And it becomes pissing contests over who thinks they have authorities over what.

Bryan: In the Army, you’ve got specialized capabilities held at the corps or division level — EW, or fires in some cases. But eventually you push those down. The Army and the Marine Corps have both pushed electronic warfare down across the entire force. We’ve got man-portable systems, and basically everybody has their own EW system now, thanks to the lessons from Ukraine. So you’d want a path where you push this cutting-edge exploitation of AI for warfare out into the rest of the military, instead of having everybody run their own experiments.

Tony: Exactly. I’m seeing that across the force. Aside from the drone battalion getting killed because it was Randy [George] and Dan [Driscoll]’s idea, there are Transformation in Contact units throughout the Army getting this stuff first. The problem is there’s no Army- or service-wide strategy that says, “I’m going to give it to this unit, and the lessons learned are going to be actively spread throughout the force.” I know we’ve said it on the show before, but the lessons learned are not getting spread. So you have all this duplication, to Bryan’s point, and no one is sharing information. There are no good mechanisms for recording and sharing it, and that’s doing more harm than good. Anyone familiar with the history of military transformation knows the examples — Patton and Eisenhower working on their tanks in the interwar period, the Marine Corps practicing amphibious landings. We keep having to relearn how to do this, but there are ways that actually get the job done.

Benchmarks, Not Command

Justin: The reference I always make is to the aircraft carrier. There were people visionary enough to see that was where things were going, and they could push it forward because they were put in the right positions. How we construct the military and how we promote people matters more than creating a separate force or some other body in government to be the deep thinker. Realistically, the people thinking deeply about this are at the frontier labs and the companies building autonomous weapon systems. That’s both scary and good, because in some ways we’ve divorced that thought process from DARPA and the big military and government mechanisms and handed it back to industry.

Think about DARPA’s autonomous driving challenge. In the first year, I think the furthest car went a mile or something like that. Over time that got into the tens and then hundreds of miles. That was largely spurred by DARPA saying, “We’ll fund this, there’ll be a prize, but we’re not going to tell you how to do it. We’re just going to set the parameters for the test.” If the AI Force — and I’m using air quotes — is just somebody who sets up benchmarks and tests them in militarily useful ways to help guide autonomy toward adoption, that’s great. The problem is that some of the people associated with this aren’t the benchmark thinkers. They’re the ones who want to command it. That’s where you get into trouble, because there is no command of this. It has to be diffused throughout the force, or it won’t be useful.

Bryan: The other thing that’ll help spread it is that this is all commercial technology. Unlike something militarily unique that you can keep inside a specialized unit, these technologies are already widely diffused. The only question is whether somebody is thinking about how to best exploit them. You’re not going to keep them out of the hands of your other units. But it would be nice to have some people with the time to think about how to use it most effectively, as opposed to people with day jobs trying to incorporate AI on the side because the Secretary of War has a bunch of posters in the Pentagon telling them to use AI every day.

Justin: They’ll just run it out of their basement.

Tony: To tie it back to Congress: at this point it’s fairly certain the China Select Committee is going away at the end of this Congress, and it sounds like the current proposal is to replace it with an AI select committee or something like it. If that goes through, my hope is that they keep some of the China Select Committee’s structure — a military focus, a commercial focus, et cetera. Given the popular support, from the labs and from regular people asking what we do about this, I think it’ll get more oomph than the China Select Committee had. But that requires having the right people on it and dividing the labor correctly. You can’t just have abstractions like “our goal is to ban artificial superintelligence.” That’s not a goal. It’s a hope. I too would like to ban cloning and cross-galaxy teleportation.

Jordan: Do we have another thing?

Justin: We have an autonomy topic that I think feeds into this pretty well.

Jordan: What were you guys really mad about?

Combined Minds

Bryan: There was an article in the current issue of Proceedings, the US Naval Institute journal all the Navy geeks read, arguing that autonomous technology is immature and not ready for prime time. Instead of relying on robots for independent military operations, it says the Navy needs more combined approaches — optionally unmanned ships where people are aboard managing things until they need to jump off for a sacrificial mission. It’s a reversion to the old model: a manned robot driving around, and the people jump off if it gets too dangerous. There are a lot of reasons this is a dumb, ill-informed idea that reflects a retrograde mindset among a lot of officers in the military and some of the retired people I talk to. But I’m interested in Tony’s perspective.

Tony: The fundamental problem — and the reason I’m writing this whole combined-arms-for-robots manuscript — is that a lot has happened very quickly in industry and then transferred to the military. There are a lot of lessons learned, and a lot of abstractions that are no longer abstract. We actually have data, and we can see how things behave on the battlefield.

Take the question in this article of what a hybrid fleet looks like. People get the idea that the goal of the machine is to replace the human. It’s not. The goal of the machine is either, at a strategic level, to augment force balance so you’re not burning exquisite assets — and people are an exquisite asset — on non-priority efforts, particularly when you have a priority effort (hint, hint, INDOPACOM). Or you want to put the robot first through the proverbial breach — sometimes the actual breach — because you know you’re going to take losses, and you don’t want your exquisite systems burned the first time through. That makes a sustained fight much harder.

And to my earlier point about people confusing types of autonomy and AI, people also confuse what they mean by robotics. The robots are there as autonomous machines — we see it every day. When people start talking about robotics in the sense of a humanoid robot that’s fully thinking, sure, but you’re confusing what’s in the lab or academia with what’s actually happening. You have to be very specific about what you mean by autonomy and robotics, because things are already being executed today, versus what we think of from science fiction.

Bryan: We see it in Ukraine. If you’ve seen any of the video of people being hunted down by autonomous quadcopters, the robots are pretty capable, at least in that context. And in the Persian Gulf, we’ve seen small USVs go pick up pilots and do operations independently. They’re not being remotely piloted for a lot of that. They’re doing missions on their own.

These articles reflect a lot of thinking out there that autonomous systems aren’t ready for naval applications in particular. The Air Force runs into this too with CCAs, collaborative combat aircraft. They think the autonomy needs to get to the point where it can replace the person in the cockpit doing the same mission a multi-mission aircraft does. That’s not what we’re talking about. The robot has a very specific function — one of the many a multi-mission aircraft would perform — and you send it to do that one thing because it’s good at it. To Tony’s point, that might be a long, persistent operation that would be boring and expensive for a person to do, or a place dangerous enough that you might not bring it back. Or you want to send a lot of them out and don’t have enough people to send a bunch of ships, so you send robots instead. But you’ve got to constrain the use case to the level of automation available today.

The idea of having people and robots operating together is just asinine. The Air Force is seeing this with CCAs, where the pilots say, “I don’t want to fly around with the robot airplane, because it’s just going to attract more attention to me. I’m flying a stealth aircraft — an F-47, the super Trump jet — and I’m not going to be visible. If my robot airplane is flying around next to me, it’ll draw attention. Why can’t it fly somewhere else and attract attention elsewhere?”

Same with robot ships. They don’t go as fast or as far as manned ships — if they did, they’d be as expensive as manned ships, and then I wouldn’t need them. So they’re a liability. They need refueling more often. They’re slow, so I have to slow down to keep up and not lose them. And if we get attacked, I have to protect the robot ship too. For all those reasons, manned-unmanned teaming just doesn’t work. We’ve got to keep the people and the robots separate and use each for what it does best. Articles like this reflect shallow thinking — as if I need to monitor my Roomba at home because it’ll periodically run into the cat. That’s not how we’d use robots in a military sense.

Tony: I’ve written about this for a few years, and I’ve termed it “combined minds.” Combined arms is the idea that the different arms of the military — artillery, tanks, infantry — work together. It doesn’t mean the infantry and the tanks walk at the same speed or go after the same targets. It means they complement each other in an organized, orchestrated fashion. To Bryan’s point, manned-unmanned teaming isn’t about the machine and the human walking side by side doing the same mission. It means they improve each other’s qualities by doing what each does best, together, in a synchronized way.

Bad History

Justin: My issue with this article is that it started off talking about the technical limitations of robots, and I’m fine with that. You need to experiment. We’re a military that’s not at war — I know we’re in Iran right now, but we’re not in a global conflict. The entire Navy’s not committed, just, you know, 77% of it. So I’d like to see more experimentation, because that’s where you derive the lessons for the next conflict.

Where I struggled: he references both Sims and Mahan, thinkers around 1900 with competing theories about what battleships and dreadnoughts were going to look like and how they’d evolve. He takes the lesson that Sims argued for standardizing on bigger guns, against tradition, and was proven right over Mahan — and somehow concludes that we shouldn’t make the boats autonomous. He’s taken what actually happened and turned it exactly on its head to argue that we need to keep the manned system and stay in the tradition of men in the Navy doing the Navy thing. The reference is exactly wrong. And I’m going to mute, because there’s hammering going on in my building that I’m sure you’re hearing.

Bryan: It always bugs me when people talk about new technologies and reach back to history to describe what’s happening today. I’d rather people just describe what’s happening today and what they think the right answer is, because a lot of these historical analogies just don’t wash.

Tony: Well, Bryan, that would require actually going out and working with the machines, or running war games — doing the things that actually shape this — instead of just saying, “This is what I think.”

Bryan: Or reading a bunch of books at war college and deciding these things are timeless. That’s the perspective: war is timeless, naval operations are timeless, there’s always a set of things that matter, and new technology doesn’t change any of those paradigms. I think that’s absolutely incorrect. Those analogies break down in an era where autonomous systems make denial so much easier, even for countries that don’t have a navy. What does Mahan say about Ukraine denying Russia the open ocean by using drones to cut off the Black Sea? History doesn’t have any lessons for us there. You’ve got to approach things fresh, and a lot of current officers have difficulty doing that, because they get steeped in history at the war college and think these are timeless truths.

Jordan: For books this week, I’ve been giving some time to Rick Atkinson’s Liberation Trilogy. Best line so far: after Patton slapped the soldiers, a journalist who was there attributed a line to him — “There is no such thing as shell shock. It is an invention of the Jews.”

Bryan: That didn’t show up in the movie.

Jordan: You’ve got to buy the Blu-ray for the extended scenes, Bryan.

Justin: Again, we don’t try to judge the past through our present lenses. However — come on.

Jordan: I have another Patton story. Patton was apparently Nixon’s favorite movie, and when Nixon went to China, Zhou Enlai 周恩来 told him he’d watched Patton to prep, because they’d done their background research.

Bryan: Back in the good old days, when the Chinese actually cared what the US thought. I wonder if Xi watched one of the president’s favorite movies — the new Melania documentary, Brewster’s Millions, or Home Alone 2, which Donald Trump was in.

Justin: Trading Places.

Jordan: A WWE special.

Bryan: That’d be much better strategic preparation than anything else.

Justin: The Paul brothers were invited to speak at the Pentagon, which is troubling for a lot of reasons. I told a buddy, “Look, we’ve entered Idiocracy.” And he said, “No, no. We should aspire to Idiocracy, because President Camacho still loved America. He still put the smartest man in the world in charge of their hardest problem. We should hope we could reach that level of Idiocracy, because we’ve sunk so far beyond it.” And I said, “Damn, that’s really dark. But you’re right.”

An FME Bonanza

Jordan: I don’t want this to go by. The Iranians just had a US submersible wash up on their shores. How does that even happen?

Bryan: There was some kind of malfunction, apparently. The US had been using the Anduril Dive-LD for mine hunting, because it’s big, it can go for a long time, and they can launch it from shore and run it up and down the strait for the shipping escort mission. But the strait is very shallow — the whole Persian Gulf isn’t more than about five hundred feet deep at its deepest point, I think. These bigger vehicles have trouble maintaining depth control with that little water to maneuver in. It seems like it lost depth control, popped up to the surface, and was detected and harvested by the Iranians — who, despite the fact that we’ve been destroying their military, seem able to get out there with a lot of equipment and pull this thing out of the water. They had a davit and a crane, the whole nine yards. You’d think that if their military had been decimated, they wouldn’t be able to mount that kind of recovery effort.

Justin: The biggest thing is that the Pentagon tried to say nothing happened and was very coy, and then Anduril came out and said, “Yep, it was working for about four months, it malfunctioned, and we lost control of it.” Now you get into questions about self-destruct sequences and what was on it. The Pentagon has said there was nothing classified on it and no sensors to worry about. But it’s logical to assume that if Iran gets a piece of US hardware, the information about it goes to Russia and China very quickly.

Bryan: The equipment on it isn’t going to be that sophisticated compared to what you could get commercially, especially compared to other drones they’ve gotten hold of. They’ve shot down RQ-4s and harvested plenty of MQ-9s on their territory. Reportedly they picked up a stealth drone, an RQ-170, at one point. So they’ve gotten plenty of US drone technology that I imagine has made its way back to China — along with a box of F-35 parts. This whole war has been a good FME [foreign materiel exploitation] opportunity for China.

Justin: And the US may get to see what the new rocket-powered Shaheds look like, if we can capture some of the ones Russia’s apparently giving Iran.

Bryan: The Gerans, yeah. That’s a good point. I wonder how many of our PrSMs hit and didn’t explode or didn’t fully decompose, so they’re getting pieces of PrSMs, pieces of JASSMs. We’ve basically dumped a bunch of new technology we were holding on to for China on the Iranians. Not only did we use it up so we can’t use it against China, we’ve also delivered it to Iran. And from previous wars, that stuff doesn’t blow up enough to be completely useless as an intelligence source.

Justin: That’s how the Russians got the Sidewinder — it got stuck in the side of a MiG, and they were able to reverse engineer it. So the idea that it’s not happening... Apparently there was an anchored Iranian ship we shot a large percentage of our PrSMs at. It wasn’t doing anything, just floating there, and we kept missing.

Bryan: A SINKEX, then.

Justin: I wonder how those came out.

Bryan: We used to pull stuff off the sea floor all the time, because the Russians would routinely drop things that turned out to be useful. So this is probably a big FME bonanza for the Chinese. I hadn’t even thought about it until just now.

Justin: The more exquisite stuff we use — the stuff meant for the China fight — the more they get. You’re getting data and telemetry, but they’re also recovering pieces and the outputs from the explosions. And there are always duds. There was a time we had to go back through places in Syria and pull out bombs that didn’t go off. They’d be foolish not to take all that. So then the question becomes: what’s our next level of exquisite technology for an INDOPACOM fight?

Physics Still Wins

Jordan: It’s the AI Force. That’s it.

Justin: That’s why we need it.

Bryan: Exactly. We’re going to out-think them.

Justin: They’re just going to distill it. Jordan, what are your thoughts? Do export controls help with the distillation of AI?

Jordan: Look, it’s not great. We’re working on an article about this. The answer is that no one really knows what percentage of Chinese progress is distillation versus them getting better at other things. Stopping distillation tomorrow would not stop Chinese progress. But clearly you don’t spend this much time and energy on an effort like this unless it’s saving you time and money.

At the end of the day, we’ve got a lot more chips than they do, and as long as we don’t sell them more semiconductor manufacturing equipment or more chips, that’s going to continue. Models are hard things to keep secret. They’re just numbers on a few hard drives. Even if you can’t distill them, you can try really hard to steal them. So the compute advantage is a more enduring source of power. Does that translate into being two generations ahead on a fighter jet? TBD. But it’s a nice thing to have.

Bryan: Does it help on the inference side too? When I’m actually using the model, does the compute advantage make a difference? Or is inference such a low-compute task that China and the US are on a level playing field?

Jordan: No — you need all the chips to use the models. We’ve already seen orders of magnitude more compute going to inference. It used to be you asked the model a question and it gave you an answer in five seconds, because it wasn’t thinking. Then it started thinking. Now we have agents, agents working for days, thousands of agents working for weeks. You’re going to keep getting returns from having more inference to throw at problems.

The open question is to what extent that intelligence transfers into things that are hard-power related. Clearly there are human cognitive tasks where you can be smarter, where you can optimize equations and software. But at the end of the day, you need a thing to blow up another thing, probably, and that’s not something these models have quite solved yet. In the Leopold [Aschenbrenner] RSI [recursive self-improvement] world, our super-smart models start building robots that build the factories, which means we’ll have more drones than China, so we’ll be fine. But —

Bryan: There are maybe some command-and-control applications, where it can do a better job thinking through the second- and third-order implications.

Jordan: Command and control, cyber, targeting, EW — anything that’s software, it’s clear this is going to be incredibly useful. But at the end of the day, can you win wars with software? Can you win wars with air power? There’s more to it.

Justin: Armies still have to hold terrain.

Bryan: We found that out — naval power and air power don’t win a war.

Justin: Not until we get to dark factories run entirely by robots, serviced by other robots, constantly turning out robots that can go attack people — which is dystopian, but also seems very far off. I tend to agree with you, Jordan. We’re already seeing human adoption of AI create crutches, like with the school strike in Iran, where they assumed the Palantir Maven software would be able to detect old, outdated data. Why would you think that? It can only do what’s in its database. If the only information in its database is old and outdated, that’s what you get. It doesn’t matter how much compute you throw at it.

There’s an adoption curve, and people are at different points on it. The people earlier on it — who haven’t adopted yet or are just starting — see it as kind of magic that’s just going to work. They can’t distinguish between generative AI and agentic AI. When you bring that into a military context, you start letting things in that drive a decision process you don’t understand, based on underlying data you don’t understand. So you can’t make the argument, “Maybe we shouldn’t do that.” That’s going to be a big learning curve. And again, that’s why I don’t think the AI Force is a great idea. Every command center responsible for strikes needs to be having very hard conversations about how to think about the outputs and what to do with them, because that needs to be demonstrably different from how we’ve been approaching it.

Jordan: Even in the limit — say 2029, 2030 — where we clearly have superhuman mathematical abilities, and we get superhuman military reasoning and coding abilities: until you get the materials science breakthroughs that let you make more things cheaply in America in a way your adversaries can’t, you’re still stuck. Your command and control is only as good as the things you’re commanding and controlling, which are physical and in the real world and have to fly around and get wet and stay submerged long enough to not show up in Iran.

Bryan: Physics is still the limitation.

Jordan: There are clearly dramatic gains to be had. But you still come back to the fact that we’re going to have a factory in Tennessee that needs to make ammunition.

Justin: Thank God we have Hanwha.

Jordan: All right, let’s call it there.

Julian Gewirtz, author and former Biden NSC China director, joins ChinaTalk days before Xi Jinping’s first White House visit since 2015. With little substantive agenda on the table, what is the US getting in exchange for the symbolism and pageantry of a state visit?

We discuss:

• Trump-Xi summit scenarios, Beijing’s management of uncertainty and protocol, and how the script of US-China diplomacy has flipped, with things once seen as American concessions to China now treated as concessions from Beijing;

• Julian’s framework for a K-shaped US-China relationship, with leader-level diplomacy pulling upward while competition pulls downward;

• What Xi’s visit says about the changing political salience of China in the US

• Why Beijing’s public statements on AI risk don’t necessarily tell us how it will handle pacing and safety;

• What the decline of Xi Jinping could mean for a political system and why China’s next succession could be especially difficult to predict;

• China-maxxing from Kissinger to Trump

Plus: The Scholars (儒林外史) and why Qing-dynasty satire about corrupt scholars might make you feel better about America in 2026.

Listen now on your favorite podcast app, or watch on YouTube!

And subscribe to Julian’s substack!

Paper Tiger by Julian Gewirtz

China, Geopolitics, Technology, Poetry | Author of Never Turn Back: China & the Forbidden History of the 1980s & Your Face My Flag: Poems | Former White House & State Dept

Jordan Schneider: We are recording this just days before Xi Jinping touches down in the US for his first visit to the White House since 2015. That deserves a ChinaTalk podcast.

Julian Gewirtz: Absolutely. You can feel the vibes in the air. Everyone is thrilled, waiting with bated breath for all those readouts.

Jordan Schneider: Julian has his money on Nicki Minaj performing at the state dinner.

Julian Gewirtz: I do not have my money on Nicki Minaj. But Xi Jinping is going to get a state dinner, which is a big deal. It’s not something the president gives freely these days, and usually a state dinner is followed by some sort of musical performance. In 2015, Xi got Ne-Yo, the R&B singer. I don’t think Ne-Yo is coming back this year.

Jordan Schneider: Kanye West really would be something…but that may be a bridge too far even for this admin.

Actually, I just got word that ChinaTalk Records is going to do three of its top singles. Me, just pressing play on my AI music. Do you think Peng Liyuan will sing?

Julian Gewirtz: That would be interesting. Peng Liyuan, Xi Jinping’s wife, is a trained singer, but she hasn’t performed very often in her role as China’s first lady. It would be giving us way too much for her to do it for the first time in twenty years.

Jordan Schneider: Did you know there’s a betting market on Xi getting a divorce? Less than a percent, I think. Sounds about right.

Julian Gewirtz: The logic chain by which someone decides to put money on that scenario at all is hard for me to grok. But here we are.

Jordan Schneider: All right, let’s talk about substance. People could not have lower expectations for what is coming. It’s the first time this administration has managed expectations correctly in a long while.

Julian Gewirtz: When Trump went to China in May, the last time we spoke on the podcast, the administration was in a mode of building up expectations: this is going to be a historic visit. Beijing was playing into that too, because for Beijing it was a huge deal to have the President of the United States go there.

This time we are not seeing that same amping-up, for a few reasons. One is that this state visit is happening forty days before the US midterm elections. President Trump clearly wants to do it. He’s excited to show off his White House renovations to Xi Jinping. He’s excited to have somebody he sees as a peer on the world stage come through town. But the rest of the apparatus around him is not in the mode of building this one up.

Second, on the Chinese side, my own view is that there’s a lot of anxiety about how little planning has gone into this. When the Chinese side is hosting, Beijing decides what they’re going to do. In this case, they’re sending Xi Jinping into what a lot of them see as the lion’s den. Washington, DC is not a terribly friendly place. Seventeen percent of Americans have a favorable impression of Xi Jinping. It’s a pretty fraught moment, and both sides are in that mode.

Jordan Schneider: What’s the actual worst case for the Chinese?

Julian Gewirtz: The thing there’s always a lot of anxiety about is that somehow the Americans will embarrass the Chinese leader. In the annals of US-China diplomacy, there have been a few moments that give folks in Beijing reason to worry. The canonical example was when Hu Jintao came to Washington in 2006. During the arrival ceremony, he was interrupted by a protester, and the White House announcer introduced “the national anthem of the Republic of China,” which is Taiwan. A number of things didn’t go as China would have wanted. Hu Jintao displayed good humor in the Oval Office transcript afterward, Bush apologized, and the moment passed. But we’re now dealing with a leader in Xi Jinping who has been in office for more than a decade and is clearly very focused on control over his personal image. Anything like that would go over very poorly.

Jordan Schneider: Let’s stay on disaster a little longer. Protesters around the motorcade — we got a version of that when Xi went to San Francisco, and it was fine. That should be priced in and expected.

Julian Gewirtz: Absolutely. One of the things that is so remarkable about this visit is that there is not a very deep substantive agenda at all. Across the board, it’s clear that Trump is inviting Xi Jinping primarily because he wants to put on a show. He wants the pageantry, he wants the optics, and he wants to change the channel on things like the Iran war. We’ll see if he’s able to pull that off.

From Beijing’s perspective, that should make them feel less nervous than if they thought it was going to be a more adversarial dynamic. But we know two things. First, Trump is profoundly unpredictable, and Beijing has internalized that. The orientation he’s had over the past few months doesn’t make them feel this is going to be entirely smooth sailing. Second, they look at the chaos in Washington and see that the president himself is routinely in positions we would not want Xi Jinping to be in: not going to the right place, unflattering images, adversarial questions from reporters. The question is less whether there’s an intentional trap being set and more whether this blunders into a scenario they’re eager to avoid.

Jordan Schneider: There is no universe where this turns into Zelensky in the Oval Office. I’m trying to imagine the awkward, fly-by-the-seat-of-the-pants thing. When the US went to China, it was all of a sudden Jensen hopping on — but all positive vibes, we’re hanging out. Is there anyone in this administration who hates China enough, or is uncomfortable enough, to deeply undermine the president forty days before he’s about to lose the House and Senate?

Julian Gewirtz: I would think about it a little differently. It’s not that they have a highly specific scenario they’re worried about. It’s that they want to feel certainty. The system on that side is structured so that the protocol around the leader and the movements of the leader are all micromanaged to an extraordinary degree, and Xi Jinping’s people have been doing this for a long time now. Not having certainty about exactly where he’ll be going and when, or the route he’ll take from his hotel to the White House, or exactly how the sequence of elements will go — that uncertainty is itself very fertile ground for paranoid anxiety about how this is going to go down.

That’s an important factor to keep in mind. If we accept the premise that there is not actually a big substantive agenda, then we are in a space of symbolism and optics. It’s a fine game to trade symbolism for substance: to give some of the pageantry Beijing craves in exchange for getting things that concretely matter to Americans and American interests. The question I think we have to be relentlessly focused on is not where could this go wrong or where could there be a protocol slip-up, but fundamentally: where is the trade happening? Where are we getting substance for giving them symbolism?

The Flipped Script

Jordan Schneider: The pattern of US relationships over the Cold War and after has been that America gives the symbolism, gives the legitimacy, gives the photo shaking hands with the president, and in return these countries do something we want. We did a four-part deep dive into To Run the World last year, and basically this was a game where the US would dole out prestige to Khrushchev, Brezhnev, Gorbachev, and they would say, “Oh wow, we get to be on the world stage with America — that makes us look cooler internally, cooler to the Soviet bloc.” In return, they’d give a little on this third-world country or that nuclear issue.

For Trump, probably more than anyone else — I don’t know who else in the administration is saying we need to have Xi here. If the orientation is, “We’re going to fly over there to stroke Trump’s ego and make him feel alive,” then the directionality of who’s getting the substantive wins has flipped for the first time in post–World War II great-power politics.

Julian Gewirtz: Things that once used to be concessions the United States might give to China have somehow become flipped, and are weirdly almost gifts or concessions China is giving to America. An example is precisely what you just said: the pageantry, the optics. Xi Jinping and Beijing officials want those things, but it’s being treated in Washington as if it’s almost a concession to America that he’s coming. That’s a very strange fact in and of itself.

It’s not just visits. The script has been flipped on advanced semiconductors too. It used to be the case that the United States wasn’t selling those, and it would have been an enormous concession to let something like the H200s go. Now it would actually be perceived by many in Washington as Beijing making a concession to Trump if they agreed to buy them. The script is getting flipped over and over again.

The bigger reason this matters is not scoring points about the administration. It’s that it reflects what can happen so easily in a superpower rivalry where the power imbalance is getting smaller. As a result, very small distinctions and interpersonal dynamics can produce much larger shifts in the overall strategic dynamic.

Jordan Schneider: Bring this to your K-shaped US-China relations take.

Julian Gewirtz: It’s an honor to hear my Substack invoked. One way I’ve been thinking about this strange dynamic — where there are contradictions every day, where Scott Bessent on the same day is trying to rally the G20 to push back on Chinese overcapacity and planning amazing diplomacy because the president has such a great relationship with Xi Jinping — is through the K-shaped economy.

We talk about the Chinese economy or the American economy as K-shaped: an upward leg where manufacturing and AI in China are soaring, and a downward leg where real estate and consumer demand are really struggling. A K-shaped system is held together because the upward leg is pulling the system forward and overcoming those downward pressures. But the question looms whether you can keep that up, or whether, as the K widens, it all falls apart.

There’s a similar version of that at play in US-China relations. The leader-level channel — the intense cadence of back-and-forth visits, the friendship, the optics — is the upward leg. The competitive realities, and the actions parts of each government continue to take, are the downward leg. The system is currently being held together by that upward leg, but it’s very fragile.

The metaphor is more than a parallel. When I hear talk of a truce or a détente, that sounds static, like a situation we’ve arrived at. But we all feel that US-China relations is actually quite dynamic and quite unstable, moving in two vectors at once.

The Midterms

Jordan Schneider: I don’t know who in the Trump administration is excited about this visit. I don’t know what Republican currently holding on to their seat for dear life is excited about this. There’s a lot going on in America right now, and I don’t know if this moves any voters. How does this ramify in domestic politics?

Julian Gewirtz: Having worked in the White House myself, doing a big state visit for China this close to a tight election where a lot is at stake is a strange thing. Think of what goes along with a state visit. First, the president will say a lot of nice things about Xi Jinping because he’s hosting him. Second, normally you hang a huge flag of the visiting country on the Executive Office Building, and smaller flags all over DC. So DC could be covered in Chinese flags thanks to President Trump. These are the kinds of things administrations tend to avoid because they’re a political net loser.

President Trump has either made the calculation that China isn’t that salient to voters and it just doesn’t matter, or he just doesn’t care. He wants to do this, and he views the political laws of gravity as applying to other people. Either way, some Republicans in battleground states will have to do some tap dancing. But the core question — and we’ll run the natural experiment in real time — is whether Americans do care, whether Trump’s high-risk gamble on the political timing is in fact right. That is instructive for how we think about the politics of China in the United States.

From my perspective, doing this kind of diplomacy isn’t necessarily a bad thing. But we’re in a strange moment where China does connect to some very high-salience political issues. It connects to affordability and cost of living. The tariffs are having an impact there. President Trump has not gotten the kind of economic deal he has said over and over would be coming. On Iran, another thing driving up costs in the United States, China has not been doing much to help end the conflict. And as AI becomes politically salient, China is a big part of that conversation too. I wonder whether Democrats and others will find ways to increase the salience of this — not by talking about China, but by talking about affordability and AI.

Jordan Schneider: There are things China could do that could help Republicans’ election chances. In a different timeline, you’d have a president condition a visit like this on the Iran war ending. There are carrots you could get that are electorally relevant. Even if you get them forty days out, it’s not going to change the price at the gas station. It’s hard to do the generous Politico reading.

Julian Gewirtz: We could quibble over how much China could do on issue X or Y, but the core point, which I agree with, is that it doesn’t really seem like the Trump administration is trying. There is a play one could design and run that would be about generating concrete deliverables. A lot of those you and I might not think are good for other reasons, but they could at least have some political resonance. It doesn’t even seem like they’re trying.

Jordan Schneider: The Brezhnev-to-Ford thing — we’re on the world stage together, keeping chaos at bay — doesn’t work when there’s a war in Iran pushing prices up.

Julian Gewirtz: I’d sharpen that point. Xi Jinping has been on a bit of a world tour over the past month. He went to the Shanghai Cooperation Organization meeting in Central Asia, then to Egypt, then to India for the BRICS. Instead of the image you’re alluding to — the American president and a foreign leader standing on the world stage as icons bringing stability — Xi Jinping’s world tour before his Washington trip has been precisely to make that message, but only about himself, only about China as an island of stability in a chaotic world. We can debate that, and we should. But it’s not a coincidence that he’s doing all of that in the lead-up to Washington. That’s precisely the point of the sequencing. He can make that argument around the world and still go to Washington and get a grand reception from the United States.

Where Is Washington’s China Policy Going?

Jordan Schneider: If this is issue fifteen for voters, I can’t imagine too many people screaming about Trump cozying up to the Chinese. But let’s zoom out. Where should we start when thinking about the Democrats and their China policy?

Julian Gewirtz: I’d step back and think about Washington’s China policy more broadly. We are in such a strange moment. President Trump obviously played a role in shifting the tenor and substance of the conversation in the 2016 election, with really intense rhetoric on China. My own view is that parts of the Democratic Party were already shifting on China by that point, but no doubt President Trump became the symbol and, in many ways, the standard-bearer of that shift. When I worked in the Biden administration, there were big differences between what Biden did and what Trump did in his first term, but there was a sense that broadly, a lot of people in both parties see China in a similar way.

What is particularly strange about this moment is that, having helped create that shift, President Trump has now helped destroy it — or transform it.

Jordan Schneider: As of April 2025.

Julian Gewirtz: That’s right. My own view is that President Trump has actually been fairly consistent on the parts of China policy he cares about. He cares about the economic stuff, and he cares about his relationship with the Chinese leader. Even in his first term, his drive to deal-making — to that Phase One deal — held a lot of competition at bay. His way of talking about China was different, but he was quite obsessed with getting that deal. It was only during COVID that you saw the unleashing of the full spectrum of the US government on China issues.

Today in Washington, both parties are dealing in complex and still somewhat inchoate ways with the realization that this shift is not what it looked like. There was an extraordinarily interesting essay by David Feith, published by the Hudson Institute, about what he calls a new Cold War in an age of doubt. His argument is basically that the great rethink on China, which he was an early participant in, hasn’t turned out to be as great as many people thought. Whatever you think of it, it’s an important argument to reckon with.

If that’s the case — if the political dynamics are more complicated and there isn’t the bipartisan consensus some people talked about — then there’s a moment of incredible fluidity that took me by surprise, and I think it’s taken a lot of people by surprise. I don’t feel confident, on either the Democratic or Republican side, about what the direction of China policy is going to be over the medium term.

And I don’t think Beijing is confident either. What Beijing does in response to its perception of this greater opportunity, this fluidity, is going to be perhaps as important as the internal conversation inside the Beltway.

Jordan Schneider: If I’m sitting in the foreign ministry trying to process our current prediction market — fifteen different candidates who all have somewhere between five and fifteen percent, from Rubio to AOC to Josh Shapiro to Jon Ossoff — what do you even do with that?

Julian Gewirtz: They’re definitely trying to wrap their minds around it. At the moment, my impression is that most Chinese foreign ministry folks feel they’ve got a pretty good thing going with the current arrangement. President Trump has set a trajectory that is ramifying not just through the executive branch but through Congress, and affecting public perceptions beyond Congress, that is moving in the direction Beijing would like to see: lowering tension, a slightly more positive view of China, and splitting up the seemingly monolithic push toward a more competitive or confrontational direction.

Something like Xi Jinping coming to Washington is also partly about Beijing being able to shape the perception of China in the United States — laying down a marker. The American president, this political force that is Donald Trump, is going to show Xi Jinping a good time, and there will probably be less criticism of that than many would expect. Beijing resets the floor on the politics, and on the performance of the politics, in the United States. There will be plenty of critics of how it’s handled, but for Beijing it can be a useful precedent-setter. To their mind, that’s more important than analyzing at this stage exactly what one governor or one cabinet official might do if they run for president in 2028.

China Salience in 2028

Jordan Schneider: China salience in 2020 was, hopefully, the highest it will ever be, with COVID. Coming into 2024, it was still a serious thing, because a lot of the Biden-Harris legacy was legislative responses to China: first COVID stimulus, then the CHIPS Act, then Build Back Better.

How does China touch domestic politics in a way a president is going to campaign on? Trade, and increasingly AI. Whatever domestic AI stuff there is will far outweigh the international stuff from a national political standpoint. So 2028 comes around, and none of these candidates besides Rubio has that much intrinsic China interest.

Julian Gewirtz: Some have been governors of states affected by China, but it’s not their thing. They didn’t sit on the Senate Foreign Relations Committee and do China policy for years.

Jordan Schneider: What would it take over 2027 and 2028 for China to rise from issue fifteen to issue seven? Probably just some catastrophic thing. Once you’ve gotten past the China shock and China Shock 2.0, if we’re banning imports of a lot of the things that could have caused that, it almost by definition lowers the temperature, because there’s less to get cooked on if you have less interaction in the first place.

Julian Gewirtz: There’s some truth to that, though I have a different view on the AI-China nexus. What you say is very possible; that may be how it plays out. But it also may be that the regulation debate in the United States gets tripped up on the “but China” question. The people pushing back against the regulation that many Americans seem to want really lean on the China argument. It’s possible, and we’ve certainly seen experiments with it. If it does, you could imagine a lot of the critique of people standing in the way of AI regulation getting tangled up with US-China questions.

Jordan Schneider: Once you have your catastrophic thing, once you have your job loss, the “losing to China” riff gets completely washed out by actual things this technology is doing that touch people’s lives.

Julian Gewirtz: Hopefully we don’t have to go through that particular timeline. There can be concerted action in the nearer term. But what’s going to drive the AI conversation is developments in the technology — incidents of the sort we’ve already seen — and then what we do here in the United States. The China piece is of secondary practical importance in a lot of ways to ordinary Americans.

Jordan Schneider: Not secondary — this is something to Substack about. Fifty percent of people polled think it’s going to kill us all. I don’t know how many relatives have reached out to you. Once you cross that threshold, the China stuff rounds to zero.

Julian Gewirtz: That’s totally plausible.

Jordan Schneider: Do your Dario riff.

Julian Gewirtz: I don’t know if I’d call it my Dario riff, but I was struck by how the American conversation around the big essay by Chen Yixin, the Minister of State Security, played out. He writes an essay that is largely language that Xi Jinping and other officials have used before, and it gets huge attention. It’s held up as this moment where China is talking about the political risks, the regime-security risks, of AI, and set side by side with the Dario “pacing the frontier” moment: Americans are freaking out about existential risk, and China is freaking out about regime security.

I think about it a little differently. That’s true on the face of it. But when you’re an American AI model company leader, you can talk as much as you want about risks you don’t have a solution for. These guys all do it. They talk all the time about big future risks that they admit they don’t know how to solve. If you’re the Minister of State Security in China, you cannot do that. You do not get to talk about risks you don’t know how to solve. When you name a risk in public, you are naming it because you are also saying: we, the Communist Party, see this and are going to deal with it. We have a solution for it.

Share

One of the big questions as we assess US-China AI competition is how much we treat what we can see coming out of Beijing as the be-all and end-all, and how much more is going on in the system that we don’t see. This has been a recurrent theme throughout the history of US-China relations. Twenty-five years ago, Americans were predicting the internet was going to cause regime change or dramatically change the political system in China. Chinese leaders were staring down those predictions. Bill Clinton said it’s like nailing Jell-O to the wall. Good luck. And of course Beijing did nail Jell-O to the wall.

For many in the Chinese leadership apparatus who’ve been around — they haven’t changed parties and presidents four or five times since then; it’s a lot of the same people, just much older — when they think back to those moments and hear Americans warning again today about the risks to China, they view their own ability to assess what is risky in China as much better than that of the Americans. Both of those things are true.

Jordan Schneider: In the media’s defense, the essay is only a thousand characters long. It’s a nice little summation. If you haven’t been reading through TC260 and just want a reminder that they’re focused on state stability rather than a sense of risk, there it is.

Julian Gewirtz: I don’t mean to knock that interpretation, which I think is correct. That is one of the fundamental differences here. But as this plays out so quickly, with so much changing at once, there is relentless pressure to offer definitive takes on things that are very much in flux. It’s not unhelpful to make the top-line analytical point and then say: remember there are a lot of things going on here that we don’t see.

Jordan Schneider: If you’ve read two things coming out of the Chinese political ecosystem about AI in 2026, it’s been Xi’s speech — smiley, we think this technology is great and we want to be open — with the final paragraph being “TBD on all those risks.” I was at a conference when it came out, and I was like, guys, there’s a whole lot more to the Chinese worldview of technology than Xi Jinping talking to a global audience about a product his companies are selling to the world. Then you have the split screen of the state security guy, which is a higher priority for the CCP than AI exports.

Julian Gewirtz: That split screen is so instructive, because you’ve had cycles of exuberance or interpretation around each of those speeches. What we do not have yet from Beijing is the one thing that actually matters most: an answer about how they are going to regulate open-weight models proliferating globally, which carry many of these risks but also carry strategic benefit to Beijing. That’s the trillion-dollar question. You can read either of these speeches as pointing in a direction, and we debate it, but we don’t have that decision yet. My guess is that Beijing itself has not decided, because this is moving so quickly and the trade-offs are enormous.

Jordan Schneider: The Trump administration didn’t make that decision until Mythos hit. Then they made a call, then Fable hit, and they made another call, and now we’re memeing about effective altruists. TBD.

Fifty Years After Mao’s Death

Jordan Schneider: Speaking of moments in history that mattered, as opposed to what’s going to happen in the White House: the fiftieth anniversary of the death of Mao was a seismic event for China and for the planet, and there was basically no acknowledgment.

Julian Gewirtz: I have to confess that I too did not, shall we say, commemorate the date. But Mao died fifty years ago, in 1976. It is one of the most extraordinary things about modern Chinese history that many of us know people who’ve been on the planet for fifty years, and Mao was leading China fifty-one years ago — with all the horror and brutality and grandiose ambition of that period.

Jordan Schneider: Sit in 1975 and 1976 for a bit. The Cultural Revolution has cooled down. Universities are starting to open a little. GDP per capita is around $150.

Julian Gewirtz: Mao has been the dominant political figure in the People’s Republic since its creation in 1949, and before that as leader of the party during the revolution, the civil war, the Japanese invasion. He has loomed so large. And by 1975 he’s very old and quite incapacitated. He is in and out of being responsive. He can barely be understood when he speaks.

There’s a dynamic here that is universal throughout history: transformational political figures who hang on, who are not what they once were, and who go deep into their winter years still in control. Kissinger goes, Ford goes, George H.W. Bush is there as liaison chief. There are dealings with the Americans, but even compared to 1969 to 1972, when all the important diplomacy ahead of Nixon’s visit happened, Mao is significantly diminished.

Kissinger has one of the truly strangest meetings I’ve ever encountered in all my time in the archives, or in government. He goes to help prepare for Ford’s visit, and Mao is briefly semi-lucid. Henry Kissinger was married to Nancy Kissinger, who passed away recently and who was extremely tall, and Mao completely loses it over how tall she is. There’s video of this — he’s pointing, and she’s much taller than Kissinger — and there’s an account in the memorandum of conversation where he writes a note about it. He just can’t get over it.

Then the substantive meeting starts, and Mao is spouting very odd one-liners. Right at the beginning he says, “I’ve already received an invitation from God,” predicting his own death. At one point he starts hitting his chair and says, “I like people to curse me. If you don’t curse me, I won’t see you.” Kissinger, trying to be polite and get some business done, says it’s always a pleasure to meet with the Chairman, and Mao says, “Oh, I’m just a showcase exhibit for visitors.” For anybody who’s been to Beijing, that’s particularly ironic, because Mao in his mausoleum now literally is a showcase exhibit for visitors. It’s a disturbing and strange meeting late in life.

Looking at that history and at where we are today: we’re in an era with a lot of leaders staying in power way past their prime. Xi Jinping intends to stay in power for a while. The American president is eighty. A few years ago there was the “peak China” debate: do we need to start preparing for China’s decline? By and large, most people’s view now is that China is doing pretty well — at least the K-shaped dynamic is in place and they seem to have it moving in a relatively sustainable direction. We’ll see.

But the real question to my mind is not “do we need to prepare for China’s decline,” but “do we need to prepare for Xi Jinping’s decline?” All men are mortal. We know from recent Chinese history that leaders who stay in power change as they age. Certain obsessions become more prominent; behavior changes. We have to keep that in mind as Xi enters his winter years too.

Jordan Schneider: The China decline question is interesting when the country is growing at half a percent, even with AI and chip manufacturing and EVs. Those are tiny segments of the economy, and the rest has been struggling with unemployment and probably will continue to. We have a whole show with Logan Wright called Broken China running in the next week or two. But what does it mean to prepare for Xi’s decline?

Julian Gewirtz: To me it’s not about departure per se. It’s recognizing that there is a lot of uncertainty. We have viewed Xi Jinping’s tenure as quite predictable, because since coming to power in 2012–2013 he has laid out a set of objectives and generally pursued them. The core point is that when we consider scenarios for Xi in his late seventies and beyond, it’s not simply whether he feels he’s running out of time to achieve certain objectives — though that’s there too. It’s also: does he change? You can imagine any number of changes, but we don’t know.

I don’t mean to be dismissive of the China-decline narratives, which are important. My only point is there’s a corollary. We have to prepare not just for China as a powerful rising country, and for the downward leg of the K to no longer be something the upward leg can outrun, but also for a scenario where Xi Jinping changes or evolves in ways that a lot of China analysts — who’ve gotten pretty comfortable, as I sometimes do, with a vision of who Xi Jinping is — don’t expect. And when I say change, it could get worse for the United States. That doesn’t mean he’s going to mellow.

The Day After Xi

Jordan Schneider: We’re fifty years from the death of Mao, so let’s do a little death-of-Xi for a second. China changed tremendously after Mao. There has not been another leader since whose passing would matter nearly as much — we can do the Julian Gewirtz late-1980s what-if with Chen Yun and Deng, but regardless of how Xi evolves ten percent this way or that in his twilight years, once this guy moves on, the aperture is going to be wider than it has been since post-Deng.

Julian Gewirtz: Maybe. I’ve devoted a lot of my academic life to studying these decisive turning points in modern China: the death of Mao, Tiananmen in 1989, WTO accession and the transition that happened then. One key thing to keep in mind is that those are often described as elite power struggles, or as high-level, Beijing-centric change. But they are also, and maybe even more, changes in Chinese society — transformations driven not just top-down but bottom-up.

What does a post-Xi China look like? There is a scenario where you extrapolate linearly: continuity. There are scenarios, which folks have written about well, where you see more nationalistic or adversarial behavior. There are some scenarios with upside — more openness, a little more liberalization. It’s not impossible to imagine. But the clearest trend across these moments of historical contingency is that nobody predicted exactly what was going to happen. There was rapid change within those moments of transition. It was not as if on day one everything changed. There were experiments with different responses. Anybody predicting confidently what China the day after Xi looks like should at least be asked to predict with equal confidence what it looks like six months and a year after.

Jordan Schneider: What’s interesting about 1976, or 1989, versus today: if you want to take the bottom-up version, we just have much more Chinese society now. We have a modern economy. We don’t really have civil society in the way you’d describe it, but we have way more educated people, way more universities, way more functional and developed businesses. Which is not to say Jack Ma is going to pick the next leader. Back then you had the army, and that was it. Maybe at the end of the day you still have the army and that’s it. But there’s just a lot more that the next person is going to have to navigate as they try to establish themselves.

Julian Gewirtz: The late, great political scientist Joseph Fewsmith used to talk about the succession problem in Chinese politics as a perennial problem. It’s not only about a leader like Mao who dies; it’s the simple fact of succession, handing off power. One of the profound risks now ingrained into the Chinese system, because of the incredible elevation and centrality of Xi Jinping, is that any leader who follows is simply not going to have the prestige and personal status of Xi himself. When Xi came into office, he didn’t have it. He had to build it up, and he had to get the whole system ginned up to build it. That is a profoundly unpredictable thing. And Xi came in at a time of much more collective leadership, with a much less dominant predecessor, so it was far easier to build in that direction. It’s going to be very hard for whoever follows. The nature of the Chinese political system at present, so oriented around one man — his actions, his sayings, his deeds — is inherently not neatly replicable.

Jordan Schneider: My point was about the interest groups that have been kept at bay — factions, however you want to define them, local and provincial interest groups, firm-level interest groups, industries trying to get attention and support. They’ve been cowed. But these are human beings who want more money, power, and fame, and once they see an opportunity, people are going to try to bend the system to their interests. Whether the next person is a Hua Guofeng who disappears after a year and a half, or there’s a period of messy consolidation, or a drive toward consolidation that may or may not succeed — it’s going to be very fun to cover on ChinaTalk, but potentially super messy for the party and the people.

Julian Gewirtz: And for the world. One of the other big differences between 1976, 1989, and now is that China is globally integrated on a level it was not in either of those moments, even with all the Fortress China activity under Xi. China’s a superpower. It matters globally in profound ways. Countries around the world, including the United States, will see this moment, whenever it occurs, as a profound juncture that affects them too. Not that they’ll have any say in it. But how China evolves over the next fifty years is a question that matters for everybody. It’s sometimes hard to talk about because it feels so unknowable. But when we envision how the world is going to change over the next fifty years, the question of how China’s politics change, and the ramifications for everything else, has to be on the table.

Jordan Schneider: We’ve had The Death of Stalin. No one’s ever going to greenlight The Death of Mao, even in today’s era of relations. But now I have AI-generated video, so I’m going to make it. This is my eval: I ask all the new models to make me the trailer.

Julian Gewirtz: They’re getting better and better. In Armando Iannucci style. I would watch that.

Jordan Schneider: We have ChinaTalk Records on Spotify with all the songs. Give me six more months and we’ll have ChinaTalk Productions. The irony is that the best video models are all Chinese, and it’s difficult to prompt them to put Mao in it. We’ll work on that.

Chinamaxxing, from Kissinger to Trump

Jordan Schneider: Coming back to Chinese negotiating behavior: the ability of China to romance its American interlocutors. My favorite line in the book is Henry Kissinger saying, after a dinner of Peking duck, “I’d agree to anything.” Brzezinski, when he goes to Beijing as national security advisor, comes back and literally says, I’ve fallen in love. I’m enamored, I’m enthralled by interacting with the Chinese.

Julian Gewirtz: Chinamaxxing wasn’t invented in 2025 We can go back to Voltaire. We’ve been Chinamaxxing for a very long time.

Jordan Schneider: It’s interesting that even in 2026, when this is not a hermit kingdom, when we’ve had diplomatic relations for a long time and all this economic interconnection, we still have a president who is just enamored with the majesty of China. Hats off to the PRC. Maybe this is Trump indexing on the 1970s and 80s, when China was exciting and sexy. I’m surprised that in 2026 we still have a president who gets all tingly when he talks to the Chinese.

Julian Gewirtz: The idea that China is very far away from the United States, a different culture, an enormous country in size and population — those facts are still the case. China being more open to the world and more globally integrated hasn’t changed them. So the dreamy, starry-eyed, slightly Orientalist thing vis-à-vis China is still a factor. In addition, for someone like Trump, who aspires to be a strongman, Xi Jinping is one of the ultimate strongmen on the global stage. And China has developed rapidly, has an enormous economy, and is in so many ways becoming technologically very advanced. Those things are very contemporary, and they’ve reinforced the older ones.

Jordan Schneider: If we go from Trump to a Gavin Newsom or a Josh Shapiro, the Chinese system, the foreign ministry, is still able to make even figures who aren’t excited by strongmen tingly. They get to cosplay as Kissinger.

Julian Gewirtz: On that point, I think we talked about it last time I was on the show, but some of this — not all of it — is actually not really about China at all. It’s an American set of archetypes. The way many people doing foreign policy, or many political leaders, envision themselves as a great big leader on the world stage is sitting in those stuffed chairs: Kissinger talking to Zhou Enlai, Nixon talking to Mao. That’s the image — “the week that changed the world,” as Margaret MacMillan called it. In a strange way, it’s not about Beijing. It’s about us. One of the big themes of this conversation, which I feel acutely right now, is that so many aspects of current American policy toward China have something to do with China, and that’s important, but fundamentally they are inextricable from Americans’ views about ourselves, and our leaders’ views about our country.

Jordan Schneider: We can bring this back to AI. One of the reasons people gravitate to the idea of nuclear-arms-control-style negotiations or an IAEA for AI is because it sounds sexy. You look at those photos of Brezhnev and Carter signing documents and there’s aura there. Going to a 3GPP 6G standards meeting is the opposite: a boring technical thing where there aren’t great stakes.

Julian Gewirtz: You saw Sam Altman do a version of this when he said President Trump could get his Nobel Peace Prize with Xi Jinping if they pulled this off. There is an awareness that you’ve got to make this a moment, zhuzh it up. But the arms control negotiations were built on a lot of deep technical work that was not the sexy photo op. You need both, and you can only get a photo op worth the camera it’s shot on if you do the hard work up front — which is why Matt Sheehan and I just published an essay arguing for what some of that work could look like.

Jordan Schneider: It’s super important. But it’s 2026. We don’t do work. We take photos.

The Scholars

Jordan Schneider: Last thing. You are the only ChinaTalk guest I could talk into reading The Scholars.

Julian Gewirtz: I’m doing it. I haven’t finished it. It’s amazing. You introduce the book, but what I’ll say is that right now the literature I’m most interested in is satirical. It’s about human corruption and craven behavior, and the way these things we see all around us in contemporary life are eternal, universal, part of every human society over centuries. I say that not because I want to feel worse about our own time, but because I want to feel better about it.

When you read The Scholars, remember it’s a Qing dynasty text written about the Ming. It’s making that point in a doubly embedded way: I can’t write about the Qing being corrupt and craven, so I’m going to write about the Ming being corrupt and craven, but everybody’s going to know it’s a way of talking about our own time. I do not think it’s a good thing if we’re comparing the United States today to the Qing dynasty. That is not a happy comparison. But it’s been a total delight to read, because the human behavior on display is so fresh, as if it’s happening today. And in a way, it is.

Jordan Schneider: The reason I got to this book was that I started writing those satire Substack articles — about Claude opening the Strait, about Newt Gingrich tweeting about nuking a canal to get three or four moves ahead. Then I thought, people have written better satire than I have. I’ve never studied this genre. So I made a reading list of the best American and Chinese satire, and I’m going through it. We’ve done some Lu Xun, which I’ve talked about on other podcasts.

The Scholars, like these Ming and Qing dynasty novels generally, is chapter-based and highly episodic. You read ten to twelve pages, they tell one little story, then there’s a cliffhanger that brings you into the next one. If you read Dream of the Red Chamber, there are a handful of main characters you follow throughout. This is instead an incredible panorama. It feels like one of those scrolls where you keep going and there are different people who interact a little. Because there aren’t main characters you’re following, you get so many little slices of this world. This guy wrote the book over the course of thirty years, and it feels like every time he traveled somewhere or met a fun character, he thought, I’ve got to put in the salt dealer, this prostitute, this corrupt merchant, this sad earnest soldier. As a time warp to put yourself in, you’re getting really rich sociological observation condensed into ten-page bites that are entertaining, have you laughing, and have you reflecting on contemporary society. And it’s totally wild, totally bawdy.

Julian Gewirtz: It’s primarily about scholars, people taking the imperial exams who want to become officials, with a lot of other characters. But you basically realize that what’s being portrayed is a deeply fractured and ill society. The goal is not a Bildungsroman, the rise and fall or development of a main character. It’s to analyze, in a non-normative, non-moralizing way, and diagnose a very ill society. I have a side of myself where I write poetry and do creative writing, and it’s a kind of work we don’t see very much of now, but it really resonates. It’s satire, but it is not a screed.

Jordan Schneider: He’s making fun of these guys, but in a sympathetic way. He is one of them. Wu Jingzi was a failed scholar; he didn’t make it past the provincial level of the imperial exams. He empathizes with this world. He sees their foibles, and yes, there’s venality and corruption, but there are also human beings just trying to make the most of it. Looking at the status games being played in Qing-via-Ming satire and reflecting back on what’s messed up and broken about us today is interesting.

Reading it actually made me feel a little better about America in 2026, because fundamentally the things our society orients people toward are more net positive than testing well on Confucian imperial exams and extracting money from the people once you become a bureaucrat in some random corner. It’s not all just selling Bitcoin. We’re building big things, we’re making new drugs. There’s good stuff getting developed. How did it make you feel better?

Julian Gewirtz: For me, the thing that made me feel better is realizing that some of the things we all get spun up about in our own society, in our own moment — a whole lot of that has been rising and falling throughout human history. Societies change, but they also recover and come back. Realizing the universality of some of the really tough things happening right now — there’s a weird optimism in that for me.

We’re going to talk about what the national security community needs — beyond just API access to wonderful models — in order to really change how it does its mission.

Our conversation covers:

• Why the U-2 spy plane offers a surprisingly useful lesson for AI: The hardest part of adopting transformative technology isn’t building it, but redesigning the institutions, workflows, incentives, and decision-making systems around it.

• The government’s need to manufacture its own “forcing functions”: How carrots, sticks, budget cuts, and a willingness to create winners and losers could help bureaucracies move faster.

• Giving the troops the tools and getting out of the way: Why Berntsen thinks the U.S. military’s greatest AI advantage may come from empowering service members to experiment, improvise, and “figure it out.”

• Will AI eventually negotiate with AI? We debate whether models can move beyond advising diplomats and executives to actually conducting negotiations.

Plus, cyber challenges, a chat app for government, and book recs.

Listen now on your favorite podcast app.

Thank you to Accenture Federal Services for bringing us this episode.

The U-2 and the Technology Behind the Photo

Jordan Schneider: All right — a U-2 flies over Cuba in 1962. Why is that a parable we should recall as we think about how to deploy AI in government?

Garrett Berntsen: Let me tell the CliffsNotes version of the U-2 story. It was built in a classified program with government buyers and government money, giving money to industry and unleashing a whole bunch of innovation around sensors and high-altitude flight. They built everything new. Putting all of the pieces of that together was incredibly innovative, and it was done in a secret lab, very quickly and famously.

Fast forward to the Cuban Missile Crisis. Suddenly we have overflight imagery of missile sites in Cuba. We’re getting really good raw intelligence in a way that the Russians didn’t know we were getting, and it was kind of miraculous to US decision-makers. They could actually see changes on the ground over time.

You hear about the technology, the plane — which, by the way, I was looking this up recently, is still in service. That’s incredible. It was that revolutionary, and it remains really valuable. They keep talking about decommissioning it and then decide not to. So the technology is of course incredibly important, as was the innovation required to put it all together.

The reason I like this metaphor, and why I think it’s relevant to AI today, is that it wasn’t just the technology, not just the plane. The way they bought it mattered. The innovations around acquisition reform mattered. The way industry and government worked together mattered. And then the way the information coming out of the plane was actually analyzed and institutionalized through intelligence analysis mattered. They built a whole new intelligence service, the NPIC — the National Photographic Interpretation Center — which eventually became NGA. They built that whole chain of judgment, and then, probably most importantly, put it in front of the president and other decision-makers. That’s the miraculous piece of the story.

Pivoting to the AI moment, we’re in a situation where the technology has moved much faster, because so much of it comes from the commercial world rather than being managed in a government program. It has moved so far ahead of our ability to integrate it into actual systems, workflows, and decision-making processes that we’re now flat-footed in the face of this technology. That’s a lot of what I work on at my company, and what I worked on in government — trying to think through the other pieces that need to change, not just the AI itself. That’s why APIs alone are not enough.

Jordan Schneider: Let’s spend a little more time on the U-2. What were the technological unlocks needed to take that photo and realize the missiles were arriving in Cuba? You needed new lenses, a new canister, what else?

Garrett Berntsen: High-altitude flight. At the time, no one had ever flown that high. Even the equipment on the pilots had to be developed.

Jordan Schneider: Could you even see it from the ground?

Garrett Berntsen: No.

Jordan Schneider: Right, because Eisenhower was flying these over the Soviet Union for a while before they even realized it.

Garrett Berntsen: All of those pieces mattered. The other incredible thing — and we have to remember this — is that doing things at pace and speed in an engineering way is actually very hard. We’re much more used to running a first test, then a second test, collecting data, and going back to refine it. I’m not saying that’s the wrong way to do it. That’s how you do engineering, especially if you’re going to put pilots into life-threatening environments. But the ability to move more quickly through that cycle and to take more risk is part of the magic of that technology.

Coming back to today, that’s why we’re seeing such a focus on experimentation — pushing experimentation as far as we can, with senior leaders saying, “I’m willing to accept some risk here because the mission is so important, and we need to take a little more risk to try these technologies out in operational environments.”

Jordan Schneider: Okay, so we have this photo, which is an incredible thing in itself. What does the intelligence apparatus do with it?

Garrett Berntsen: They take the canisters out of the cameras and blow the images up into huge printouts on blotter paper, then lay them out on the floor at NPIC in a classified space. People are literally pulling manuals and intelligence reports on Soviet weapons and looking through magnifying glasses, asking, “Is that the right paint on the side of this truck to make it a missile launcher? Is the shape of that missile consistent with what our intelligence reports say?”

You’re taking the raw intelligence and analyzing it with human judgment, with experts on military equipment, and blending it all together into an assessment. And you’re doing it fast. If you follow the Cuban Missile Crisis day by day, those were really difficult days.

Garrett Berntsen: These were NSC situation room decisions. What do we do? Do we attack, do we put up a blockade, what do we message back to the Soviets? Those decisions were happening very quickly, and you didn’t have a lot of time to sit back and do a deeper memo analysis.

Jordan Schneider: In that era, it was very clear — you had a few new pieces of data, these new photos, and you were going to do as much as you could with them. Today we’re in a completely different situation.

Garrett Berntsen: It’s almost the opposite. You almost have too much information.

Jordan Schneider: You can’t build the NPIC at the same time as designing the exact spy plane you want the NPIC to analyze. You just have this giant technological overhang, and it’s growing in directions you aren’t dictating.

Garrett Berntsen: Yes. You’re not in control, effectively.

Jordan Schneider: How are people processing this?

Garrett Berntsen: You want to give people their due for pushing. The current team in the Pentagon and elsewhere is working really hard at it — I’ve spent time at the State Department, the NSC, and the Department of War over the last five years or so. But there’s a lot to do, and we’re seeing pockets of success.

More of that success is in operational spaces. For example, in what they call CJADC2 — Combined Joint All-Domain Command and Control, there’s a lot of progress in giving people situational awareness of the entire battlefield and using AI to distill out and identify objects and intelligence, then bring it live and quickly to decision makers in the field.

Where we’re seeing less progress, candidly, is in what I’d call core business systems.

My personal belief is that we shouldn’t think of systems as mission systems and business systems. Increasingly, everything is a mission system. The department and all the agencies in the federal government are really starting to realize that if they want operational systems out at the edge supporting warfighters or decision makers in whatever mission, they need really, really good data from their core systems — business systems, logistics, personnel, finance. Those are warfighting functions too.

You have to invest in getting the data cleaned, organized, and ready for use at an operational tempo. A lot of these business systems aren’t built to run at operational tempo, because they’ve never had to before.

Here’s a very simple example. In some of these business systems, the rules literally say you only have to update the status on a form once a week. Well, that’s a policy — someone has written a policy that says supply sergeants in the Army, of which there are probably 10,000 or 20,000, update once a week. I was in logistics in the Army, so imagine the challenge of going to your supply sergeant and saying, “Hey, you actually have to input this into the system every day instead of once a week,” because some decision maker wants that data every day instead of once a week. That’s a big boat to turn around, and the value has to be there. A lot of times we’re also giving them systems that are really not easy to use. We’re making it hard for them to put the data in, and now we’re telling them the tempo and the latency of that data need to be a lot faster.

Jordan Schneider: I want to come back to the U-2. If you were sitting there in the 1940s imagining a U-2, the vision of what you wanted it to accomplish was relatively straightforward. Okay, we’re going to put cameras in the sky and take photos of things whenever we want.

But when you’re talking about modernizing the mission stuff, modernizing the logistics stuff, it’s not nearly as obvious what an agentic warfare bureaucracy actually looks like. Do you have a pitch you give people, or is it, we’re just going to feel our way into it?

Garrett Berntsen: It’s a bit of an unfair comparison, I’ll give you that much, because the U-2’s purpose is to do one thing. AI can do almost any piece of knowledge work, within the confines of these models — and the border of what’s possible is changing every day. It’s crazy. It’s a general-purpose technology, so it’s a slightly unfair comparison.

What I’d say is that every command, every office in government knows their problems.

They know the things that drive their people crazy. They know the things that cost them money and time. Half the time I meet with folks in government about these things, they’re asking me, “Hey, what do you think I should do?” And I say, no, no, no, you tell me. You know your problems. I’ll help take those problems out of your brain, but you’re the one who knows them.

You have to have a feel for your organization and what its biggest problems are, and you have to be able to follow the current of what will actually solve people’s problems. What can you get money for, which is always a skill in government? What will deliver wins for your leadership? You try to find the middle of that Venn diagram, and that’s where you start. Once you get some traction, you can move on to other challenges.

Incentives and Forcing Functions

Jordan Schneider: If a company doesn’t do this, it just gets outcompeted. But what are the checkpoints for you? Is the Air Force being outcompeted? Is national security sound? Those tests only come along — hopefully — once or twice a century.

Garrett Berntsen: Hopefully less than that.

Jordan Schneider: The absence of a forcing function just means you can get away with not being good for longer.

Garrett Berntsen: That’s right. But we underestimate our ability to create our own mechanisms to drive that change, and this is where leadership and personnel policy come into play. We need better mechanisms — both carrots and sticks — to encourage risk-taking and to support innovators in and out of uniform who are doing this work.

People follow incentives. People are ambitious, and they genuinely want to do a good job. If you have a system that encourages more of this behavior, it looks like people taking big risks, pursuing unusual career trajectories, and being rewarded for it. Meanwhile, people who aren’t moving fast enough face career stagnation or removal. That can feel crude, but it’s the mechanism you have to use. You have to incentivize people and leaders, and there have to be clear rewards and consequences depending on whether they’re making progress.

Jordan Schneider: The problem with the Garrett 1.0 approach — just solving the problems everyone can identify — is that you’re only identifying problems whose solutions also work for you. It’s rare to find a person who will tell you their own job shouldn’t exist.

Garrett Berntsen: People will say, “I really don’t like the way I have to do my job,” though.

Jordan Schneider: Sure.

Garrett Berntsen: So many people feel stifled by how they’re working. They want better tools and a better process. It won’t be 100% of the workforce — you’re right, there will always be people who say, “I’m used to how I work.” But that’s the adoption curve any technology faces. There are early adopters, and eventually people jump on the bandwagon once it works. There will always be holdouts who preferred the old way. That’s hard to overcome, but you just have to force it.

Jordan Schneider: There’s a Jen Pahlka anecdote about her talking to a general about how to fix the system. She said, “I don’t even know if we should cut your budget — this stuff is really important.” And the general said, “No, 50%. We need to cut 50%, because that’s the only way to get people to change.” We’re never going to hear someone selling software to the government say we need to cut spending by 50%.

Garrett Berntsen: Programs have to have winners and losers. As an industry, we want money spent on the most valuable things for the government, even if that money isn’t going to us. We care about the government running well. What I’d also say is that changing what you’re buying often isn’t a bad thing, because we’re excited to do new things and tackle new problems. Programs that are growing are usually more exciting for our people, and they want to jump on something new. Change always happens in this industry, and it happens in every industry, but from our point of view it isn’t all bad.

Jordan Schneider: There’s a question about AI — this is going to radically remake how organizations can be structured. That radical restructuring is going to start on the software side, and maybe one day we’ll get to the hardware side. But we’re still going to have to build things, even if they’re drones rather than manned fighters.

Garrett Berntsen: You still have to manage the logistics supply chain, the warehouses, all of that. None of that is going anywhere. If anything, we just want it to be more efficient, and you might end up doing more of it.

The Advantages of Moving Second

Jordan Schneider: It feels like there are scenarios where things need to change by 75%, and the system can only change on its own by 5%. With smart, enlightened leadership, maybe you get to 15%. Is the answer Congress? Or is it crazy to say, “We have the most powerful military in the world, so maybe we don’t need to change”?

Garrett Berntsen: The reason we have the most powerful military in the world is that it can adapt and change, and it needs to. That has always been true. We’re just facing a very radical pace of change at the moment, so we need leaders willing to move at that pace.

We talked a little about key areas where we’ll need change, and you hit on software development. That’s the most obvious one, because of how powerful these models are at writing software. You could radically change the way you buy and the way that work gets done.

Contrary to the U-2 example, where the technology started in government, all of this is happening commercially first and then coming into government. We get the upside of second-mover advantage — we get to see what’s working. There are already lessons from the past year. Do you want to unleash everyone with unlimited tokens so they burn through your budget in a quarter, or do you need to understand tokenomics a little better before you deploy that across your workforce?

There are real upsides to moving second. If you do it right, the federal government can be a very big, powerful buyer and negotiate good bulk rates. Going second isn’t all bad — that’s my bottom line.

Jordan Schneider: I want to come back to 21-year-old Garrett, the logistician driving around Afghanistan running his trucks off his own Excel spreadsheet because he couldn’t trust the software he’d been given.

I would like for you to be able to vibe code your own solution. Is that the answer for everyone everywhere? What should be in-house versus just letting enlisted service members — or, sorry, officers I mean — go crazy?

Garrett Berntsen: My enlisted did almost all the work anyway, which is how most officers feel.

There will be a need for these skills, and there already is a need for them out in the field — that was true even 10 or 20 years ago. When I said I was doing a lot of this on spreadsheets, there were people in my unit helping me out, using technology in whatever way they could.

The US service member has been famous since World War I and World War II for being innovative, for just figuring things out. I served in the 82nd Airborne Division, and this is 82nd Airborne lore. Paratroopers hit the ground on D-Day and simply figured things out — merging with units that weren’t their own and fighting. That’s something we’re all very proud of, and it’s going to continue to be true.

The reason I tell that story is that if we get these tools into their hands, you’re going to be shocked at how innovative and clever people are in using them to do their jobs. That may mean getting compute out to the edge. It may mean form-factor GPUs out on service members. Then it’s about giving them what they need to get the job done and capturing the lessons learned as much as possible — what’s happening out at the units — so we can share that knowledge across the whole force.

There will always be some dividing line between the companies sitting back in safer locations and the service members out at the pointy edge of the spear. But as much as humanly possible, get whatever the most modern tools are out to the edge. You will be shocked by the existing capability and skill in these service members. I’ve seen it. They just figure things out. That’s what NCOs and enlisted service members do — and maybe officers, by exception. It’s really about figuring out what they need and then getting it for them, whether that’s hardware or software, and then breaking through all the inevitable policy reasons why someone would say no.

I can already think this through in my head as a logistics officer. Who’s signing the hand receipt for the GPU? These are $500,000 chips. It breaks, and suddenly someone’s in trouble because they broke the GPUs. You have to clear the policy out of the way and say, we’re assuming the risk. If it means some GPUs get broken, and we lose the money, it was worth it, because we’re getting capability out to the edge.

Jordan Schneider: Coming back to the 82nd Airborne in World War II and having enough talent for emergent warfighting — that’s what Ukraine has today. You’re pulling from your entire population. The distribution curve you live with in a volunteer army, and in a civil service that’s underpaid relative to the private sector, is different from the curve you get when everyone is in the fight. Let’s hope we never have to find out.

Garrett Berntsen: I might argue with you a little on that. I actually think you get a more skilled distribution. If you look at the data on who joins the government, the civil service, and the enlisted ranks, they’re on average more educated than the average American. Service members are also largely representative of different ethnic backgrounds — almost to a T, in a lot of ways, of the composition of the country. You would be shocked how many enlisted soldiers you meet who say, “Oh, I have a master’s degree.”

By the way, the difference for Ukraine — and this makes it sound like a positive, which obviously it isn’t — is that they’re facing the brutal reality of having to survive. That’s the honest-to-God situation there. They have to survive, so they’re innovating incredibly fast. We don’t have to face that right now, so it’s up to us to watch, learn, and be smart about what other people are having to face, and to learn those lessons now so we don’t have to learn them the hard way later.

This force over the last 20 to 25 years is uniquely educated, in a good way. It’s a smaller force, but a very skilled one.

Algorithmic Negotiation and AI Advisors

Jordan Schneider: I want to come back to evals. You mentioned JADC2, this idea that you can do targeting in a new way — it’s almost an evolution of the U-2 stuff, right? We’re just going to be able to figure out where things are in real time. That’s the sort of thing where it’s relatively straightforward to imagine how you would test and evaluate it. Obviously you won’t be perfect, and horrible things will happen because of that, but there is a line on a graph that you can chart. We’ve already launched ChinaTalk’s AI evals for the Situation Room.

The idea is to move up from the tactical and operational level to decision-making and strategic calls. What do you make of that?

Garrett Berntsen: It’s possible. I just don’t see a world in which we’d be able to get all the data. You need good data to do that type of modeling, especially if you’re doing multi-party negotiation modeling. People try to do this — economic modeling, trade modeling, questions like what do the parties want? There’s game theory, there’s all this stuff. There are different approaches to the problem.

If you had absolutely enormous access to people’s private notes and emails and all the audio and video from every Situation Room meeting — which obviously would never happen — you’d be surprised. You probably could do some very good modeling on decision-making outcomes. But it’s purposely obfuscated.

That makes it a challenge. That’s the ideal case, where you have all this perfect data. If you step back a little bit from that, betting markets and similar efforts are trying to do this sort of thing — crowdsourcing outcomes of events and negotiations. They’re trying to use the Phil Tetlock, Good Judgment Project approach. I haven’t seen the research or data on how well that works. I don’t know if you have.

Jordan Schneider: It’s getting better, and it’ll keep getting better. Maybe set aside the decisions themselves — what about intelligence analysis? Where do you see the uplift there?

Garrett Berntsen: That’s a more doable project. There are also incentives inside the intelligence community to do it. It would make their analysis better, and they have access to the data.

If you think about the intel workflow, it’s pretty structured — pretty rigorous, actually. Every one of the three-letter agencies has a different discipline, but they have a process, they have an SOP, and they go through training when they start. This is how you write this type of report and how you write that type. If you have decades of data on that, plus some signal on what was good and what was bad, what was high quality and what was low quality, then you can start to net out what looks good and what looks bad in the intel process, and what a benchmark for that would be. That’s definitely a more doable problem.

Subscribe now

But it’s upstream from decision-making — it’s an input to decision-making. As we know from history, plenty of decision-makers see the intel and make a completely different decision for whatever reason. It would still be just one input into your broader goal of modeling all decision-making.

Jordan Schneider: The dream is that you’re sitting here and you know exactly what offer you can put on the table to the Iranians — one that best aligns with your national interests, political priorities, and timelines, and that gets them to yes. That’s really hard. Even if you understand your own system perfectly and can model the oil markets perfectly, it’s still hard.

Garrett Berntsen: I don’t want to overindex on the human factors, but they matter. If you look at famous American negotiators in history, people like Holbrooke — the call in the middle of the night, the flight out, spending time with these people, haranguing them — those things aren’t going into a model.

You certainly could give our negotiators better tools, showing them where the lever points are. But really good negotiators in diplomacy are already getting a lot of that intelligence. Maybe they’re synthesizing it all in their brain, but they’re reading the intel. They have experts — economic experts, political experts, intel officers — saying, “Hey, don’t forget about this.” What we’re talking about is taking it out of Holbrooke’s brain and putting it into a model. But then you still have to give it back to a person.

Jordan Schneider: That’s the question. Do you have to give it back to a person?

Garrett Berntsen: You’d just have the model send the counterproposal back over?

Jordan Schneider: I would not be shocked if, five years from now, business negotiations are just two models arriving at a number that works for both parties.

Garrett Berntsen: Maybe for highly transactional things. We already have that in certain business transactions — Facebook Marketplace, or ad auctions. You say what you want and it gives you a calculation. But here I am, the chief AI officer, telling you how AI isn’t going to do this — maybe I just want to keep my job. But people like doing business with people. They like the shtick of it. Humans are still going to prefer humans.

Jordan Schneider: TBD, man. But what if the non-humans can outcompete the humans? Five, ten, fifteen years out, there will still be things humans have a comparative advantage on. The idea that arriving at a number in a negotiation is one of them, though — I’m not so sure.

Garrett Berntsen: That seems unlikely to me. For microtransactions, we already do this largely algorithmically. Think about Uber, or the era before the meter. I lived in Egypt for a while in college. I’d get in a cab, say where I was going, and the driver would say, “That’s 50 pounds.” And I’d say, “It’s not 50 pounds, it’s 20 pounds.” He’d say, “No,” and we’d go into this whole negotiation, because I’m the foreigner and he’s going to charge me more. Understandably.

Then the next upgrade is the meter, a flat fee. And now we have an algorithmic transaction that looks at all these factors, comes up with a market price, and we agree on it. That’s a natural progression, and more transactions will occur that way. You’re right about that. But the big transactions, the big negotiations — the biggest ones are country-to-country, massive political and economic negotiations. Those, I feel, will be the last.

But bottom line, few diplomats in foreign countries are going to say, “Sure, send me over that ChatGPT response.” People want to talk to one another and negotiate.

Jordan Schneider: My thesis is that this happens once you have candidates who win because they follow everything the model tells them to do. It won’t emerge organically — it’ll just be that if there are ten of us running in a presidential primary, and then one of us —

Garrett Berntsen: Uses all the model output. That’s very interesting, because then it really becomes a question of which model you listened to. Did you listen to the guardrailed model that said don’t run negative attack ads? Or did you listen to the totally unhinged model that said, “Yeah, go attack them, make up lies about them”? Then it gets into what model you’re using and how we guardrail these models.

Jordan Schneider: It’s going to be scary. It’s going to be really messy.

Cyber Exploit Abundance

Jordan Schneider: Let’s talk about war a little bit more — cyber. Big week for cyber. We’re recording this on July 23rd, two days after OpenAI’s model jumped its guardrails. Where are we going with all this, Garrett? How are you feeling right now?

Garrett Berntsen: I’ll start by saying I’m more of an AI person than a cyber person, but over the last few months I’ve had to get deep with our team, our cyber team in particular.

What we’re doing is putting lighter fluid on things we’ve already been talking about. These vulnerabilities have been around — it’s not as though these are all new issues. It’s just that we suddenly have a tool, or a series of tools, that can find them really, really fast. The pace is the key difference here.

We’re talking to clients and government leaders about how we go from “oh my gosh, we’re freaked out by this” to “what do we actually do?” Literally, how do we fix these problems? The answer has to be that you use these models to solve the problems they’re identifying. It’s both a weapon that can be used against you and a defense you can use.

Famously, every CISO and CIO has a massive list of potential issues. How do you triage? How do you prioritize? These models are really good at helping you do that. And how do you write the code to harden and strengthen your own systems? They’re good at that too.

You cannot put your head in the sand and say this is just a small change. The first step is accepting the problem. If a model is breaking out of the security protocols put around it by OpenAI itself, your system is at risk too. That’s the reality of the situation. So the first thing is acceptance — like any problem, accept that you have one, and then move as quickly as possible.

You just did a whole podcast about Kimi and these new Chinese models. There’s not a huge lag between the pace of the Chinese open-source models and our frontier-grade models. It’s coming.

You just have to move out quickly. Then you need Congress to budget it, you need people to find the money, and you need leaders willing to take the risk to make changes and patch faster. All these things come back to attitudes like, “Oh, we do patching once a month.” No — you’ve got to patch a lot faster than that. It’s a boring thing, but you have to be able to tell your user base, “Sorry, your computer is going to reboot every day.” I know that’s annoying. It’s going to hurt productivity and people are going to yell at you. But you just have to do it.

Status Quo Bias and Book Recommendations

Jordan Schneider: On Congress, budgeting, and the FAR — a lot of what the government pays for is people and their credentials at a specified hourly rate. But jobs are changing so much. Some things one person can now do alone, and suddenly that person is a hundred times more productive. Why won’t the time-and-materials model die?

Garrett Berntsen: They’re trying to kill it, and I support any effort to move away from that incentive structure. Fundamentally, it’s status quo bias. People feel more comfortable. When you trace the problem back, it’s almost always that change is hard for people. If I had to give one answer, that’s the answer. Change is really hard. Acquisition professionals are used to doing things a certain way. They get a rate card, they compare the rate cards, they compete, and they give out the contract.

Increasingly, that just isn’t going to produce the outcomes we want, and the reason is obvious. If you incentivize a company to bill more hours, and there’s no hard requirement to actually deliver something at the end of those hours, they’re going to bill more hours. It needs to change. There are signs it has been changing a lot in the last 12 to 18 months, but if you actually dig into the spending data — and that data is public — it’s not a massive shift. Most spending is still time and materials, billed hourly.

Jordan Schneider: There’s also the fact that top companies are spending something like 10% of their budget on tokens. I don’t know where the US government is, but I doubt it’s anywhere close to that.

Garrett Berntsen: That’s true too, and it’s another piece of this. There’s still uncertainty about whether you truly get 10x outcomes from tokens, or whether you’re basically paying for the same amount of work in a different form. I’m more of a believer that when you have teams built to do this well, you do get the gains — but a lot of learning still needs to happen, particularly in software development. You’re seeing teams that honestly aren’t very experienced and don’t really know what they’re doing, and their token burn is just wildly out of control, especially if the company is incentivizing token use. Not outcomes, not new features, not customer satisfaction. You have to incentivize the right things.

But with really mature teams, I am seeing large uplift in productivity — smaller teams able to produce more features, achieve technical outcomes, deliver a better user experience, and actually ship an enhanced product. There’s still a learning curve, though, in how to do this more efficiently.

We also have to accept — or I believe, anyway — that with all of this investment in infrastructure, the price of intelligence is going down. When you see these companies competing ferociously with each other, big investments in infrastructure, and improvements in model architecture and performance, intelligence is going to get cheaper. That feels inevitable to me.

Jordan Schneider: And as we discussed earlier, when you’re the second mover, you’re already that much further down the Moore’s Law curve. Plus, we have ten other Moore’s Laws running at the same time to make this intelligence cheaper. Token spend should not be a limitation the government gets blocked on anytime soon.

Garrett Berntsen: No. I work for a large services company, and most of our business is actually commercial — 92% commercial, only 8% federal. That’s a big upside for us in general. We have so much experience doing this stuff on the commercial side, where clients have been adopting really aggressively. We get to have those conversations and ask, how is that commercial company leveraging AI? How is our delivery team in that commercial company doing it? How are you tracking tokens? How are you tracking whether you’re actually getting outcomes from that? Then we try to bring those lessons in. We learn the lesson beforehand as a second mover and don’t make the same mistakes — because inevitably, with something changing this fast, you’re going to make mistakes.

Share

Jordan Schneider: You mentioned earlier that even before ChatGPT, no one in the corporate world was paying for hours of PhDs. That’s been true for decades now.

Garrett Berntsen: Totally. I, in particular, love an outcome that we all agree on. We definitely have to stack hands on the outcome. This is where doing fixed-price work is hard, because you have to agree on what you actually want to achieve. A lot of times it’s just easier to say, “Oh, just keep working.” Telling people to work is not that hard. Telling people, “This is my vision, I want you to achieve this thing” — that takes alignment, human agreement, stakeholders, getting everyone on the same page. If you can do that, then you give us a goal, we agree on a price, and it’s really on us. The risk is on us. If we’ve agreed to that price and we’ve agreed to six months, and you don’t have your thing in six months, we’re just going to keep working to get it for you, because we committed to it contractually and we either did a bad job of pricing it or we didn’t deliver it well.

If you’re just paying me by the hour, you’re going to call me and say, “Hey, I’m mad it’s not done.” And I’ll say, “Yeah, I know, it’s hard to get done. We’ll keep working.”

Jordan Schneider: But in five years, is that scoping conversation something two models couldn’t have?

Garrett Berntsen: I don’t think so. We will see that scoping process change, and we’re already seeing it happen a little bit with AI. What we do is bring some leaders in from government, put a chat app in front of them — recording — and say, “Just say what you want. Describe your problem, or what you want.”

We’ve pre-configured the model a bit to be a question asker, like an agent designed to gather requirements. You can go back and forth pretty quickly, and then it’ll just build it. Of course, our engineers will look at what it built and make some changes and tweaks.

But you have to show people. People in government have never seen that. Honestly, most people in the world haven’t seen that — it’s only been possible for about twelve months. We have a space downtown where we do a lot of these events called The Forge. We bring people in and show them this on a computer, and it blows people away.

When you show customers that kind of thing, they say, “Whoa, okay, can you do this in my environment?” A lot of times we’ll say, “Not yet, the model isn’t authorized in your environment yet, but as soon as it is, we can.” That becomes a reason for them to get it authorized. Showing people the possibility matters — with this technology, you have to see it, you have to watch it happen, to understand it.

Jordan Schneider: Let’s close with some book recommendations.

Garrett Berntsen: All right, three things. I just read a summer novel called Yesteryear, by Carol Clark Burke, I think. It has a crazy plot twist I won’t ruin. It’s a little bit contentious, but it was a fun sit-by-the-lake kind of read.

Then there’s Raising Good Humans. I have two kids, two little boys, so I’ve been trying to read some parenting content. The short of it is that if you want to be a good parent, work on yourself. It’s not actually about your kids — it’s about making yourself a better person. That’s the CliffsNotes version, in case you don’t want to read it.

The third book, which I just picked up at a book sale, is the huge Truman biography — the one by David McCullough. I’ve never read anything about Truman, and it’s super interesting. Here’s a fun fact I just read in it: the US troops — the Doughboys who went into World War I — didn’t have any of their own artillery. No American artillery was used in World War I. It was all European artillery.

They went over there, trained on the equipment, and then mostly used French artillery. They had to convert to the metric system, these guys who had never done anything like that. What a wild fact. We had no industrial base. We built no big guns.

Jordan Schneider: Okay, so you’re still in the World War I section of Truman. I remember he was a library rat or something.

Garrett Berntsen: He was a big reader, yeah, but he also had a bunch of failed businesses. He opened a haberdashery, a men’s clothing store. He opened a mine or something that didn’t work out.

Jordan Schneider: Wasn’t there some horse venture he did?

Garrett Berntsen: There were a whole bunch of random businesses that he started. He was a very unassuming guy. It’s been interesting. I knew nothing about him. I’m only about 200 pages in, and it’s a thousand-page book.

Jordan Schneider: For dad books, there’s one called An Italian Education, by a cranky Irish guy, written in New Journalism style. He married an Italian woman, and they were living in the suburbs somewhere in northern Italy in the ’90s. It’s a very sarcastic exploration of Italian culture.

Garrett Berntsen: There’s a whole subgenre of parenting books along the lines of “I’m the American in Paris.”

Jordan Schneider: It’s still being squeezed by a publisher into something that can sell millions of copies. This book is not that. It’s just this Irish guy being cranky. I guess I like cranky dads. That’s my genre.

Garrett Berntsen: Are you a cranky dad?

Jordan Schneider: There’s so much non-crankiness in the dad literature that it’s helpful to know there are other people who are cranky at times. Michael Lewis wrote a dad book. He kept a diary of the first year of each of his three children’s lives.

Garrett Berntsen: Wow. I could never. I always feel envious when people keep diaries, because I wonder, when do you find the time? And I feel like I’ve forgotten so much.

Jordan Schneider: I do a sentence. I’m a sentence-a-day guy.

Garrett Berntsen: That’s smart.

As if that weren’t justification enough for a reporting trip, the Shanghai Cooperation Organization’s annual summit was happening in Bishkek, with the Games designated as a partner event open to the delegates. Putin, Modi, and nine other heads of state flew in to discuss new infrastructure megaprojects, drugs and nuclear material trafficking, market integration, and more.

When I went to Kyrgyzstan last August in search of Chinese influence, the country captivated me with its friendly people, rapidly growing economy, and the semi-nomadic way of life still practiced by many in the countryside. And now, on the 35th anniversary of Kyrgyzstan’s independence from the Soviet Union, I was honored to bear witness to the country’s moment on the world stage.

Today, I’ll take you along on my journey. This piece is part travelogue and part geopolitics, and it covers a lot of ground: the massive infrastructure buildout, the Kyrgyz president’s Chinamaxxing, the muzzled Inner Mongolian athletes representing China, the lessons China hasn’t learned about sports diplomacy and inter-ethnic harmony, and what this all means for Central Asia’s future.

Arriving in Bishkek

The World Nomad Games were first conceived in Kyrgyzstan in 2014 and are held every two years.1 After being hosted by Türkiye in 2022 and Kazakhstan in 2024, the Games have finally returned home to the mountains of Kyrgyzstan. And these were the largest Games ever, with 200,000+ visitors piling into Kyrchyn Gorge, one of the Games’ six venues, by the third day of the Games to watch 3,000+ athletes from 109 countries (compared to 583 athletes from 19 countries in 2014).

I flew into Bishkek from Tashkent on a beautifully clear day, and I spent the entire 75 minutes in the air gazing at the picturesque Tian Shan mountains (yes, that name is of Chinese origin).2 I arrived a few days before the opening ceremony, hoping to sneak a peek at the SCO action in the capital before heading out to the shores of Lake Issyk-kul for the Games.

With some help from the China Road and Bridge Corporation (中国路桥), Bishkek’s airport had been completely remodeled in preparation for the international arrivals. I stepped outside to find an organizer from the Games holding a sign bearing my name.

The organizer explained that I needed to go with him to register for my press pass, and then get on a bus to the resort where the journalists were staying… an hour and a half outside the capital. This was probably because of the SCO — the Kyrgyz government had even recommended/requested that Bishkek residents leave the city for the weekend of the summit. But this made me all the more curious about what was going on in Bishkek. I knew I couldn’t go rogue immediately, so I followed the organizer back into the airport to get a Journalists’ Merit Badge.

The official World Nomad Games reception area was tucked inside a secluded corner that smelled of fresh paint and black tea, awash with young Kyrgyz people wearing red vests emblazoned with the word “VOLUNTEER.” Everyone was so excited, and no one had any idea if it was a hard rule that I needed to go to the resort rather than to the capital. I made myself some tea and was escorted to a Soviet-style minibus tasked with shuttling the international press to the resort. The organizer who was waiting for me with the sign sat shotgun next to the driver, and the only other passenger, I soon learned, was Afzal Reza, a bureau chief of the Iranian state media organization IRNA. I began negotiating in Russian with the organizer and driver, and Afzal sprang to life. “Oh my goodness, you speak Russian!” I helped him translate for a bit before he succumbed to jet lag, and then continued negotiating with the organizer. “I have a hiking trip planned for tomorrow, and I’d really like to go shopping in Dordoi market” (all true). I handed him one of my Russian business cards. “You can add me on WhatsApp, and I’ll tell you when I arrive at the resort tomorrow night.”

He studied my business card and turned it over. “You are from Kansas, USA?” he asked with intrigue. “I know it from The Wizard of Oz! You are also from the steppe then, like the Kazakhs!”

And with that, he agreed to take me to Bishkek.

Afzal thanked me for my kindness as I stepped off the bus. “Maybe I’ll see you tomorrow at the resort,” I said in response, “Khodahafez!”

And here’s what I saw in the center of the capital:

What precipitated such a grand welcoming committee?

During the Soviet collectivization and dekulakization campaign, Kyrgyz President Sadyr Japarov’s family fled to China. Japarov’s parents were both born in China and grew up in Kyrgyz-speaking communities in Xinjiang. After getting married in 1962, they moved back to their ancestral home in Kyrgyzstan on the shores of Lake Issyk-kul.

Now, Japarov is arguably the most pro-China leader in the region. “When Xi comes to Kyrgyzstan, he always brings gifts,” as Kyrgyz researcher Adina Masalbekova told me. Beijing is now building a new $4.7 billion railway line that will traverse Kyrgyzstan to connect China with Uzbekistan. And the SCO — a multilateral organization that originally integrated China with Central Asia before expanding to include the likes of India, Russia, and Iran — is a key delivery system for these gifts.

Of course, all of Central Asia’s leaders accept Chinese investment and BRI infrastructure, but that is usually part of a deliberate balancing strategy that includes cooperation with and investment from Russia, the Gulf, Türkiye, and the West. But Japarov, according to Masalbekova, is exceptional for his sincere fondness for the Chinese development model and Xi Jinping personally.

Meanwhile, Chinese infrastructure projects, including the new railway line, have not been immune to controversy. President Japarov has lambasted Kyrgyzstan’s China skeptics and attributes their suspicions to the influence of “external forces.”

In a new interview, Japarov appears incredulous about the public’s concerns, because cooperation with China has legitimately brought a lot of material value to Kyrgyzstan. A notable example is the Chinese-built waste incineration plant outside of Bishkek, which has made incredible headway against the city’s trash problem while generating 30 megawatts of power. Here’s an excerpt from Japarov’s interview:

[E]very state on earth is making eyes at China — “If only I could work with them, get their investment, bring their technology home and build in my own country.” And we, sitting right next door — next door! — can’t make use of that? Let’s use it, for heaven’s sake. Our border with China is settled — not one square meter of disputed land. We have no international dispute with them, no quarrel. Let’s use that.

…

If the railway doesn’t get finished, then for ages to come every Kyrgyz — all seven and a half million of us — will mourn it for thousands of years. Why? Because right now we live in a dead-end country, a landlocked country. When the railway is finished, we become a transit country — we come out into the world. By rail we reach the ocean; we reach the sea. Our sensible citizens must not be taken in by those types.[3]

With Xi Jinping en route to Bishkek, nothing was going to stop Kyrgyzstan from putting on a great show.

The Opening Ceremony

Bishkek Arena was hooked up to the electrical grid just a week before the opening ceremony of the World Nomad Games. The brand-new 51,000-seat stadium, now the largest in Central Asia, is designed to look like a yurt. It was constructed with the help of at least three Chinese companies: China Construction Second Engineering Bureau Installation Company (中建二局安装工程), an SOE which worked on the exterior structure and also trained local Kyrgyz people to work on the project; Hangxiao Steel Structure (杭萧钢构) for the steel; and Avant Sports (领先体育), which manufactured the seats.4

The opening ceremony was attended by Putin, Modi, and several other heads of state alongside their teams of SCO diplomats. Xi was supposed to attend after the SCO, but decided at the last minute to fly back to China to address recent floods in Tibet.

The show was absolutely incredible — singing, dancing, horses, costumes, AI-assisted animations, lights, pyrotechnics, holograms, fireworks. Putin and Modi had special box seats, and kept appearing on the jumbotron. When Putin appeared on the screen to welcome Team Russia, the crowd went wild with applause.5 The closing act of the night was the Pussycat Dolls.

Why did Kyrgyzstan decide to tie the SCO and World Nomad Games together? I asked Aiym Tlepbergen, a traditional archer awarded Kazakhstan’s Master of Sport title and a judge at the Sixth World Nomad Games. She told me that, “[The SCO representatives] got to see just how important these Games are, and how much this atmosphere brings people together. I think it is a kind of message from the Kyrgyz government: look at how capable we are at coming together and how much we have in common.”

The Elusive Team China

After the first day of the games, I hadn’t found a single Chinese athlete. The Games were spread across several venues north of Issyk-Kul, but without some concrete leads, I was worried I’d never be in the right place at the right time. I had been texting with Team China’s Kyrgyz manager on WhatsApp about getting a list of the athletes’ names and their events, but she needed some time to secure the team’s permission before she could release it to me. I had already met Joy Dou, the single Chinese national with a press pass, at the opening ceremony, but she didn’t have much information on Team China either.

My first lead materialized while I was in line for the bathroom in Kyrchyn Gorge. As I stood in an almost-queue behind the adobe structure housing the toilets, I suddenly overheard some almost-queuing aunties speaking Mandarin. I immediately began chatting them up.

They told me they were part of a tour group, and, according to the rumors they’d heard, Team China included some horseback archers and even a falcon hunter. (I learned later that there was no such Chinese falcon hunter, but that’s certainly something I’d love to see in future years!). After paying 20 som6 to use the bathroom, I speed-walked across the grassy steppe to the horse archery track, where I learned that the Chinese team had already finished for the day and gone home.

The ping of dejection I felt was quickly sidelined once I started watching some other sports.7 I did some interviews in Russian with Timour Ducarme, a Belgian freelancer whom I’d met at the journalists’ resort,8 before heading to the press yurt for lunch.

As I ate my buckwheat bento, another new friend from the press resort, a German polyglot named Dénes Jäger, texted me a photo of a wrestling match. The caption read, “Chinese guy getting thrashed at Alysh.” He was at the Gazprom Sports Complex, an hour away from Kyrchyn in the lakeside town of Cholpon-Ata. Wrestling would be over by the time I could make it there.

I went to Cholpon-Ata anyway, and watched a team of American cowboys take on Kyrgyzstan in kök-börü, a type of Central Asian horse polo that uses a goat carcass as the ball.9 As I stood up against the railings of the enormous field of horses in the center of the hippodrome, I just knew that tomorrow would be an even better day than today. And that’s when the roster of Chinese athletes hit my inbox.

Wurinile 乌日尼勒 is a wrestler from Inner Mongolia. The 2026 World Nomad Games were his first time representing China at an international competition, and he took home a silver medal. His event is Sambo, a martial art developed by the Soviets in the 1920s as a method of training the army’s hand-to-hand combat abilities.10

I watched him over the course of three wrestling matches, first against Georgia, then against France, during which blood began spurting from his ear after a particularly vicious blow from his opponent. He returned to the ring with bandages wrapped around his head, and flipped the Frenchman on his back to secure another victory. Finally, I watched him handily beat Iran as his opponent’s coach frantically yelled in Persian from the sidelines.

(A note on names: many Inner Mongolians have only given names and no surnames, which is not the case in Mongolia proper.11 In this article, athlete names without spaces signify Mongolian given names accompanied by their Mandarin transliterations, while the names with spaces are Han Chinese names, although the athletes with these names are still ethnically Inner Mongolian.)

China sent 19 athletes to the Sixth World Nomad Games, all from Inner Mongolia, a territory which Xi Jinping has called “the model autonomous region” (“模范自治区”). 13 of those athletes were wrestlers, and the remaining six were horseback archers. There was no opportunity for Uyghur athletes to compete at the World Nomad Games,12 because the Chinese delegation was not formed through a nationwide selection process. Rather, China’s General Administration of Sport appointed the Sports Bureau of Inner Mongolia to assemble Team China. Uyghurs are closely related to Uzbeks (who excel at wrestling and horse racing), and more distantly related to Kyrgyz and Kazakhs, so this was a serious missed opportunity to build rapport with the people of Central Asia.

After Wurinile’s match against the Islamic Republic, one of the wrestlers from the Chinese team agreed to speak with me on the record.

“What’s your secret?”

“Courage, I guess (勇气吧).”

“And what does the word ‘nomadic (游牧)’ mean to you?”

“Well, I’m an ethnic Mongol from Inner Mongolia in China, so my ethnic group is also a nomadic people. Coming here makes me feel a very strong sense of familiarity and connection (我来到这里，感到特别亲切).”

As mild as it is, I still cannot believe I even got this quote. I was rejected again and again trying to interview Team China’s athletes, and this wrestler was the only one who agreed to speak with me on record. He didn’t ask me to quote him anonymously, but I decided to omit his name because I was worried about getting him in trouble. In a few cases, Chinese athletes initially said yes to an interview, only to change their minds in the face of disapproving looks from their handlers.

Over the course of the next couple of days, I was able to spend some time with China’s horseback archery team. I watched both the men and women shoot, discussed horse logistics,13 and ate Chinese sweet bread with them after they generously let me shelter from the rain in their tent.

The handler of the Inner Mongolian horse archers was a man named Zhang Yang 张扬, a Han Chinese official from the Sports Bureau whose badge labeled him as a “coach” even though he admitted to me that he could barely ride a horse. The athletes often spoke Mongolian to one another, but only spoke Mandarin when Zhang was around.

I am glad that (some of) China’s practitioners of traditional sports have the opportunity to compete at an international tournament like this. But when the handlers act like the ethnic minorities on their team are loose cannons in possession of terrible secrets, it undermines their message about how wonderful it is to be a minority in China. This is the distinction between sports diplomacy and sportswashing that Chinese cadres don’t appear to recognize. At the 2022 Olympics in Beijing, Uyghur athlete Dilnigar Ilhamjan was chosen as one of the torchbearers. This was the same year the UN’s OHCHR released its assessment of the human rights situation in Xinjiang. As far as I can tell, Ilhamjan has never done an interview with an international media outlet.

This is a story of KPIs, as is the case for many things in China. The goal is to minimize risk to China’s image, not to build a positive narrative. If a colorful quote makes its way to the international media, someone’s job is on the line, so the system ends up forfeiting soft-power layups like these.

What would have made Zhang’s boss very happy, he told me, was if the archers had walked away with a gold medal. But the World Nomad Games could be so much more than that for China — they are an opportunity to show the world that China respects and admires nomadic culture and that it encourages its ethnic minorities to carry on their traditions. It would be a chance to show Central Asians that China respects them as a civilization, and that their goal is not to colonize or extract but rather to share the fruits of what the Chinese system has built. Capitalizing on this would require more minorities — not just Inner Mongolians — to be eligible to represent China. And it would require a media policy that encourages openness as opposed to treating the athletes like liabilities. But the gold medal KPI indicates to me that the Sports Bureau just isn’t thinking big enough yet.

Subscribe now

I said that all of Team China’s athletes were Inner Mongolian, and this is technically true apart from one hiccup. There was also an ethnically Kyrgyz athlete, Turdukul Abdyrakhmanov, who won a silver medal in horseback wrestling (er enish). In the official results, his silver medal is attributed to China, and announcers during the Games labelled him as representing China as well. But during his match, he didn’t bring out the Chinese flag — or any flag for that matter — and he wasn’t listed on the roster of Team China athletes I was sent. He was listed on Team Kyrgyzstan’s er enish roster before the Games began. My best guess is that he is an ethnic Kyrgyz living in China14 who wasn’t allowed to compete by the Sports Bureau or preferred to compete on Kyrgyzstan’s team, and was only claimed by Team China once he took matters into his own hands to compete.

And perhaps, this kind of split allegiance between ethnicity and national affiliation is exactly China’s concern with letting Turkic minorities compete. But excluding athletes from representing Team China because they aren’t the right kind of ethnic minority is a sure path to deepening this split. I wonder if the Sports Bureau cadres included Abdyrakhmanov’s silver medal in their reports to the higher-ups.

I asked Zhang if China would ever host the World Nomad Games. He told me it was possible, and that China would of course excel at managing the logistics and building infrastructure for such an event. It doesn’t seem out of the question to me. The State Council has emphasized the practice of traditional sports to show that local culture is protected in Xinjiang, and this State Council white paper even highlights holiday matches of kök-börü as an example. But as much as I would love to see China host the Games, I’m skeptical that will ever happen, thanks to the combination of low risk tolerance and willingness to accept meager payoffs baked into the bureaucracy responsible for such decisions.

The next World Nomad Games in 2028 will be hosted by Russia, in the city of Kazan in the Tatarstan region. To me, this seems like a transparent bid to stay relevant in a region that is increasingly eschewing the language of its former colonizer. Chinese decisionmakers, by contrast, don’t seem convinced that they need to put on a show to be relevant in Central Asia. After all, Chinese investment money, infrastructure projects, and manufactured goods have already deeply penetrated the economies of these nations, and Beijing seems to believe these deliverables speak for themselves.

The Kyrgyz president still has to win elections, and China has had mixed results winning hearts and minds despite Japarov’s personal affinity for Beijing. Japarov’s government has successively increased the annual cap on foreign workers in Kyrgyzstan over the course of his tenure, from 16,610 in 2021 to 100,000 in 2026, with about 60% of those visas now going to Chinese workers. As I wrote last year, there have been some anti-China protests in Kyrgyzstan as well, and the lead-up to the Games and SCO summit saw a wave of anti-Chinese posts on Kyrgyz social media. And 62% of Kyrgyz people polled by Central Asia Barometer were somewhat or very concerned about China’s treatment of Uyghurs, according to their most recent data from November 2022.15

A less paranoid posture at the World Nomad Games would be an incredibly cheap way to address this. As much as Xi Jinping-thought prioritizes concrete results over intangibles like software and good PR, this is a human problem with a human solution. And China would be wise to take it seriously.

As I saw at the Games this year, free competition unites people, no matter what language they speak or what passport they carry. Tlepbergen, the Kazakh archery judge, spoke about this beautifully:

The ancestors of practically every people used bows. Everyone had bows and arrows. It is one of the oldest tools and weapons used by humanity. And today, through traditional sport, we are reviving that sense of unity that connects us. …

I think that at this moment, when the political system is so turbulent, we need to come together. People everywhere need to unite and remember that we have shared roots. This is our history. …

Although they are called the World Nomad Games, these are really Games that bring people together. All people who think of themselves as free nomads, who understand that this world belongs to all of us and that we all live beneath the same sky and the same sun — all of us are responsible for this world and for making sure that things are good in it.

Perhaps in four or six years admirers of the nomadic spirit — from Belgium to South Africa, from Utah to Tajikistan — will be welcomed to Inner Mongolia with a flood of shiny new stadiums, hotels, an additional metro line and a dedicated bus system. And if that day comes, you can bet that I will be there, DJI mics in hand, to ask the Central Asian athletes about their impressions of China.

As AI develops, future society may trend toward one of two extremes: communism, or Cyberpunk 2077. In the former, the productive forces are enormously liberated and people’s standards of living improve markedly (let’s stop here; I’m worried this won’t clear the censors otherwise). In the latter, a few tech companies control the bulk of resources; only a tiny minority can access the most advanced AI and assorted technologies, achieving something close to “machine ascension,” while everyone else makes do with feeble AI.

Liu specializes in kernels and is passionate about the craft. He remarks with frank resignation that, “give it another six months or a year, and AI-written kernels will most likely be just as good as mine, if not surpass my work.” So why does he keep working on this? Simply put: the race dynamic.

If I were to slack off at this point, or even deliberately throw sand in the gears to hold up model training, other companies’ models would develop all the same and would kill off my career in the exact same manner in the end. … When everyone is this fixated on destroying themselves, I have no choice but to join the cruel arms race, too.

Liu deeply mourns losing his edge over AI on the kernel optimization work that he’s spent years perfecting. He says that in the near future, he expects to have to pivot to working as a kind of “mecha pilot” 机甲驾驶员 for agents in order to remain employed.1 In the meantime, he has a shockingly forthright warning for everyone else:

If Anthropic controlled the world’s most advanced AI forever, care to guess whether future society would turn out communist or 2077? Go on, guess.

So I still believe that the most frontier intelligence should be supplied to everyone, in an open and cheap way. I don’t trust Anthropic or OpenAI to do that. I especially don’t want Anthropic controlling the most advanced artificial intelligence or AGI. To put it dramatically, the severity of that would be no less than letting Hitler get the atomic bomb before the Allies. This is also why I chose DeepSeek and have stayed: we research powerful, fast, universally accessible AI and open-source it, and perhaps that can pull the world back a little from the 2077 end.

It’s obviously abhorrent to liken anyone not guilty of crimes against humanity — let alone someone with a Jewish mother — to Adolf Hitler. Liu, however, probably sees his comparison as a fair rebuke, given Amodei’s maximalist accusations against the Chinese system. As of September 18, his article remains available on his WeChat blog and has received sympathetic coverage in prominent Chinese media outlets like Huxiu, 36Kr, and state-owned Yicai. DeepSeek has not commented in support of its researcher, but neither has the lab asked him to take it down.

On Zhihu and Xiaohongshu, where China’s tech communities gather online, as well as in the blog’s own comment section, the tone is overwhelmingly supportive. People say that DeepSeek has shown the most commitment to “an inclusive vision”; that Dario Amodei’s talk of major AI risks is an alarmist dead horse; that OpenAI and Anthropic are “wantonly destroying all that is beautiful” to “undermine the foundation of Babel”;2 and that Anthropic, in particular, is “techno-fascist” and “barely human.”

The very group that has the closest — and, arguably, the most humanizing and nuanced — contact with the American AI community is starting to conclude that the latter is motivated by nothing more than anti-Chinese ideology.

How did we get here?

Before AI governance seemingly reached a boiling point, on the sidelines of ICML this summer in Seoul, I had a casual exchange with a Chinese attendee. My interlocutor, while not a technical expert, has had a career in the vicinity of AI for years. He reads machine learning papers, travels extensively, and works closely with researchers.

When the conversation moved to geopolitics and I explained Dario Amodei’s worldview to him, he was completely baffled. I told him that as far as I understood it, the CEO of Anthropic is deeply committed to liberal democracy as a preferred system to authoritarianism; therefore, since AI is possibly a technology that increases productivity and national power at exponential scale, democracies should do everything possible to ensure dominance in this technology. One (democracy) plus one (AGI) equals two (export controls against China). “It’s this straightforward? Then … nothing else?” He found the simplicity of this idea almost too implausible to entertain.

If you live in the Bay Area, DC, or simply learn about AI and geopolitics from the American angle, you probably do not find it difficult to imagine that Dario Amodei holds these two beliefs sincerely. The earnestness of this discourse is first rooted in effective altruism (EA), a movement dedicated to the pursuit of objective good through rationality.3 And on the East Coast, AI has now opened up an opportunity for DC politicos to realize ideological ambitions: the idea of a technology that secures America’s place in the liberal international order is simply too tempting. EAs and hawks may see each other as strange bedfellows, but two elite pillars of America have united around some profound convictions.

Chinese interpreters of this discourse, by and large, struggle with the depth of American belief. As I’ll discuss later in this article, political analysts in Beijing look to balance sheets and polls to understand why American corporate leaders, technologists, and politicians act the way they do. They marinate in the same discursive environment as American tech policy thinkers — Twitter feeds, blogs, papers, and competing narratives — but they filter that same information through a distrustful lens. Long accustomed to a conspiratorial worldview (which originated from the Maoist decades), they look for evidence of a well-coordinated, anti-China plot. Their methodologies aren’t wrong, but they often miss the wholehearted convictions and internecine conflicts behind American dogma.

Chinese technologists, on the other hand, were raised in an internationalist milieu. Until recently, they believed that techno-utopian aspirations and business pragmatism united them with their US counterparts. They are discovering now that some Americans truly see themselves as fighting a new Cold War. As we’ll cover later, their response to this realization is furious — and, increasingly, radical.

I am not suggesting that Chinese thinkers lack ideological convictions, whether about AI or other social and political topics.4 Nor am I arguing that American AI policy is led entirely by ideology; no trillion-dollar business builds itself without leveraging the pragmatics of capitalism and quotidian stakeholder interests. But over the past two weeks, we have seen Jacob Coxon’s resignation from Anthropic inject actual fear into the heart of mainstream American society, while China regarded the events skeptically from afar. It’s worth understanding why.

I wrote in our previous coverage of the Hugging Face incident that China is seeking to re-narrate AI safety. Leaving the definition of safety to Washington and Berkeley, in its view, gives up a competitive edge in the realm of ideas at a time when the technology is still in its adolescence.

On September 12, Chen Yixin 陈一新, Secretary of the Party Committee and Minister of State Security, published a major article in China Cyberspace 中国网信, a magazine run by the Cyberspace Administration of China. Many other analyses have emphasized the core message of the piece, one that hasn’t changed since the Chinese state began articulating its stance on AI but that should now be uncontroversial: the regime’s political security reigns absolutely paramount, and threats to any aspect of China’s economy, society, and people will be viewed through that lens.

Early on in the piece, he articulates the “good AI future” that the Party aspires toward:

We must keep the welfare of all humanity in mind, promote the healthy and orderly development of artificial intelligence towards a beneficial, safe, and fair direction, make the satisfaction of people’s aspirations for a better life the landing base of scientific and technological innovation, push forward with closely integrating AI with safeguarding and improving people’s livelihoods, and address pain points and difficult problems in areas like education, healthcare, elder care and transportation.

The CCP roots its political success in the mass line. The idea emphasizes real-world conditions: theory becomes policy only when refracted through sufficient collection of people’s experiences and centralized by the Party apparatus. If AI proliferation is theory, then the next step is to bring it to the people and have it ripple through society under the supervision of the Party. The Party, through its prerogative of interpretation, will finally reach policy decisions after the fact. Beijing is certainly aware of potential risks, but will also not sacrifice the opportunity to direct AI proliferation on its own terms. So China will not refrain from deploying a potentially useful technology simply because another country, pacing the frontier, fears hypotheticals.

Chen, instead, takes the United States to task over Washington’s prioritization of its own interest:

Certain countries are exploiting the advantages they have accumulated in areas such as basic AI theory, model architectures and core computing power. In the name of “protecting national security,” they use methods such as creating entity lists, applying technology controls, monopolizing industry standards, and establishing closed-source ecosystems to strictly restrict relevant countries from importing cutting-edge technology and equipment and improving their scientific and technological innovation capabilities. This severs global AI industrial and supply chains and worsens imbalances in the development of the global intelligence industry.

Pay attention to the rhetorical device of “in the name of” 以 … 之名. It recurs frequently in Chinese policy writings, when discussing what Beijing casts as the ultimate motives of US actors. Beijing pushes the same grand-conspiracy narrative on many topics. Covid-19 was a Western alarmist narrative before it was a real pandemic.5 Forced labor in Xinjiang was the product of Western media and governments conspiring to push out Chinese textile exports.6 The Hong Kong protests were a United States-led conspiracy to turn Hong Kongers’ grievances into separatism such that China would be weakened. EU trade measures were a conspiracy to discriminate against Chinese goods in the name of balancing trade deficits.

Chinese Communist leaders since Mao have used the same rhetorical practice to criticize enemies. Born from complex early-20th-century internal struggles and isolated on the global stage until the 1970s, Beijing has frequently rested its analysis of international conditions on the assumption that there are covert interests behind what Western powers openly articulate. For instance, in September 1939, after the signing of the Nazi-Soviet pact, Mao argued in an interview that the United States was staying out of the war “in the name of neutrality,” while planning to eventually install itself as leader of the capitalist world. Deng Xiaoping, criticizing the Soviet Union in 1974, called its system “socialism in words and imperialism in deeds.” The pursuit of unspoken ulterior motives remains a powerful impulse in Chinese analyses of international affairs today.

Most of the time, Beijing wins in storytelling to its domestic audience. Nationalists see China as unfairly targeted wherever it goes, held to impossible standards simply because the West cannot tolerate its rise. But other voices in China have consistently worked to complicate that narrative at home. Pandemic controls ended with people on the streets, demanding that China rejoin the world. Recently, a group of young Chinese workers leveraged European supply chain labor regulations, tightened in the wake of Xinjiang revelations, to complain to Volkswagen and Mercedes-Benz about unfair dismissal practices by their Chinese employer, an auto parts supplier. A small, courageous minority of mainlanders openly backed Hong Kong in 2019; since then, many more Chinese have been deeply disappointed in the financial hub’s trajectory, as economic malaise became the real domestic story of post-Covid China.7

Previous state-led conspiracy narratives have relied on conjuring tenuous partnerships: that between Western journalists and their home countries’ governments, between Hong Kong’s democracy advocates and foreign organizations, and between European companies and the European Union. In reality, these relationships were far less substantial than what Beijing argued. But this time, Washington and Silicon Valley have publicized their relationship from the beginning. Dario Amodei has posted six times on his own blog, and every single one advocates for export controls to China.8 Most of the national security community’s evidence for Chinese distillation was supplied by Anthropic itself, rather than the result of FBI investigations or Congressional inquiries. American AI labs may see these disclosures as profoundly progressive moves by a new generation of industry leaders who care about accountability. To China, however, they look like coordinated plots between Washington and Silicon Valley.

Back in June, the People’s Daily (the CCP Central Committee’s official newspaper) published an op-ed by Beijing Institute of Technology law professor Xiao Junyong 肖君拥. Xiao researches national security, technology governance, and the concept of human rights in the Chinese context. The piece is a stock example of applying the aforementioned conspiratorial worldview to AI safety discourse:

On close examination, the operating logic behind this “Build American AI” push is directly inherited from the “China threat” theory playbook of the past.

First, set up a target. Standardized talking-point templates are distributed, casting Chinese AI as the “principal external threat,” claiming it will harvest the public’s information and squeeze Americans out of their jobs.

Second, deflect internal contradictions. America’s leading AI firms are facing real pressures — high energy-consumption costs, controversies over job displacement — and by hyping up an external threat they steer the focus of domestic public opinion toward China.

Third, secure resources. These companies are priming the atmosphere ahead of upcoming elections and pushing Congress to increase federal subsidies and loosen regulation of the sector. This is cut from exactly the same cloth as the old drumbeating about the “China military threat” to drive up defense spending, or politicians hyping the “China Shock” to push through trade protectionism.

Xiao is conflating the techno-accelerationists with the safetyists. Dario Amodei certainly hasn’t been asking for federal subsidies, while David Sacks was tweeting about the “AI JOB LOSS HOAX” as of December 2025. Of course, the distinction matters to those inside the Chinese system whose job it is to actually negotiate with the Americans: they’ve followed Anthropic’s uneasy dynamic with the Department of War, and they will want to understand the subtleties of p(doom), “woke AI,” and lobbying. But for Beijing’s overall messaging, the distinction doesn’t matter at all. To quote China Daily’s September 14 editorial, the American “corporate ‘alliance’” is in the midst of a “coordinated play,” and the call to pace the frontier “sounds rather like a club whose membership rules have been drafted before the guest list is announced.”910

In the Party’s eyes, everyone from MIRI to Marc Andreessen is in cahoots to keep China down.

In a Zhihu thread discussing Jacob Coxon’s claim that frontier labs are “gambling with our lives,” the top-voted reply said, “Then I hope they do it faster and stop talking such a big game. Have they cured diabetes? Parkinson’s? … Is fusion energy ready?” Another goes, “It’s the same old act. Every time Anthropic releases a new model, they have to threaten humanity. Every time OpenAI releases one, they say they feel like they’ve just watched a nuclear bomb detonate.”

A few responses express genuine fear about AI’s trajectory, but see individual actions like Coxon’s as meaningless in the face of toxic competition dynamics.11 I find it difficult to imagine Chinese observers warming to his position. Nationalist tabloids and influencers interpret this newest round of safetyist media campaigns as yet another overplayed trap by Americans, aiming to trick China into giving up.

More sober reporting by specialist tech media, as well as a minority of Chinese commentators sympathetic to Coxon, entertain the premise that AI could bring about unprecedented harms. But they don’t take themselves as Coxon’s constituency. Rather, they assume that China’s AI labs are still operating under comprehensible levels of human control, because the government simply would not permit the proliferation of any capability beyond what it can keep leashed. They deduce, therefore, that any sci-fi dystopia will come from the American side — and Americans keep saying that exact thing. What is there to do other than poke fun at the circus?

Coxon, in other words, is turning into the boy who cried wolf. This is hard to stomach for effective altruists and liberal internationalists alike. But excessive belief in the power of sincerity, in part, brought us here: as Coxon’s tweet above (and responses to it) demonstrates, many still seem to think that if only they discuss AI risks with enough candidness and incur sufficient personal costs, they will bring unbelievers to the table. Costly sincerity, however, doesn’t negate the basic condition of US-China competition. To those already deeply skeptical of American motivations, simultaneous resignations, antitrust loopholes, and OpenAI fundraising rounds are just more evidence in favor of the existence of a grand conspiracy.

State media is replicating its familiar playbook to address the AI race. They’ve been extraordinarily successful inside China. The public, of course, is on the side of its own fast-following labs, and the self-evidently virtuous narrative of open source doesn’t hurt either.

There is something more alarming, however. Chinese researchers, on the frontlines of building dangerous capabilities, are finding their own way to even more radical conclusions than what the Party is suggesting. Liu Shengyu’s essay is a case in point. So are calls to boycott Anthropic and dismissive interpretations of AI safety warnings.

Are the youngest of China’s AI researchers radicalizing themselves against cooperation with the United States — and against the Western-led enterprise of AI safety altogether? It may seem weird to suggest that a highly educated, internationally connected group of elites could coalesce around extreme ideas completely disparate from their stateside counterparts — but Liu’s essay and its reception should trouble anyone who believes that Chinese actors are essential to navigating the transition to a world with much more powerful AI systems. Not only do they seem to find a race to the bottom inevitable, but they have also internalized Western discussions of authoritarian AI threats as a coordinated attack on their right to technological advancement. Their trepidations around becoming footsoldiers of the national project are dissipating. The Party’s conspiracy is now the technologist’s own.

Liu received PhD offers from Carnegie Mellon University and UC Berkeley when he graduated from Peking University in 2025, but decided not to attend due to financial circumstances. In another life — perhaps if he were born a few years earlier, had applied to graduate school before US visa policies became drastically more restrictive, and his family hadn’t yet experienced hardship due to China’s housing crash — he might be here in the United States, maybe even working at OpenAI or Anthropic over the summer. That’s not the world we live in anymore. For folks like him, American labs are now humanity’s Goliath.

China’s views on American AI have grown more cynical as it has taken center stage. That doesn’t need to make us pessimists about AI safety coordination. In fact, being honest about the nature of the bilateral relationship might make useful actions easier to pursue. Concordia AI’s newsletter recently featured a press readout from Wang Lihong 王丽宏, a senior official at the Cyberspace Administration of China (CAC). Gabriel Wagner reminded me that, apart from “technological hegemony,” all the other AI governance challenges Wang highlighted — inherent unreliability, misuse in biology and cyber, and increasing autonomy — are echoed exactly by Amodei himself in his blog post titled, “The Urgency of Interpretability.”

Someone at the CAC is reading his essays; export controls aside, they want to learn how to win in safety as well. That competitive instinct shows up in the Chinese foreign ministry’s 2023 Global AI Governance Initiative communiqué, which called for improvements to “explainability and predictability” so that “AI always remains under human control.” The pro-global framing of the document was not merely lip service to China’s developing-world partners. Xi Jinping himself said so back in July at the World AI Conference: China, in his mind, is a “responsible major country” that’s taking a lead by organizing around multilateral institutions. Beijing wants to be seen as the more conscientious actor, and it is willing to take material actions — not just finger-pointing at Washington — to achieve that. These announcements are a warning to China’s own AI industry as well: let out a loss-of-control incident, and you’re not just burying your own futures — you’re tainting the nation’s all-important reputation.

The first time Dario Amodei publicly discussed his China views was probably on the Dwarkesh Podcast in 2023. He told Dwarkesh that Baidu’s Silicon Valley AI Lab, where he was from November 2014 to October 2015, was a “mostly Americanized lab” and that he never went to China.12 When Dwarkesh asked how China thinks of AI safety, Amodei said that if China sees AI “as a source of national power,” they’re going to strive for optimization in a way that “could lead them in the direction of AGI.” Then, he said there was an internal Anthropic joke that if they really were on track to AGI, they would build it in an underground bunker disconnected from the Internet. “Los Alamos-ing it.”

Races aren’t always aimed at the bottom. What does a truly grounded strategy to engage China look like? What would it mean to take competition as an ongoing, evolving fact, rather than thought-terminating cliché? Because it’s too late for the bunker now.

Thanks to Nathan Lambert, Julian Gewirtz, Afra Wang, Helen Li, Nicholas Welch, and the ChinaTalk team for thoughtful feedback!

Ethan Kessler was a 2025-2026 Boren Graduate Fellow for Mandarin Chinese in Taiwan. Before that, he was a graduate student and think tank researcher focusing on cross-Strait relations, critical technology, and defense acquisition policy.

The Politics of Industrial Policy

Two political dynamics help explain why the ability of Taiwan’s drone industrial policy to grow and innovate at a pace needed to deliver advanced military capabilities remains uncertain.

1. The “pork barrel” dynamic makes it difficult to know which industrial policy initiatives will succeed or fail at early stages.

Though Taiwan’s commitment in the past three years to grow domestic drone manufacturing capabilities is largely because President Tsai and now Lai have recognized drones’ relevance for national security, defense industry projects are still a form of domestic government spending. Taiwanese politicians at both national and lower levels thus see defense industrial spending through the lens of local development and winning elections.

If a defense industrial program brings many jobs and thus plaudits for officials, there may be efficiency tradeoffs. This is a dynamic not limited to Taiwan. Indeed, the connection between guofang zizhu (國防自主), which roughly translates as “national defense autonomy” or “defense self-reliance,” and economic development is clearly articulated by Taiwan’s leadership. In a December 2025 televised interview at the plant that produces Taiwan’s indigenous armored personnel carrier, President Lai promised his government’s proposed special defense budget could create 90,000 jobs. And in the white papers published by the DPP’s core policy think tank before Tsai Ing-wen assumed the presidency in 2016, high priority was given to increasing indigenous defense investments, both for security and to develop Taiwan’s economy.

The political incentives to bring home the bacon causes waste, fraud, and abuse. As one recent Taiwanese opinion article argued, the government’s growing emphasis on building up Taiwan’s defense industrial base can easily produce corruption or rent-seeking by political and business interest groups. In addition to the opposition’s general criticisms of Lai’s proposed special defense budget from 2025 to 2026 as a “black box” (黑箱), KMT Organizational Development Committee Chairman Lee Che-hua 李哲華 in February 2026 pointed out the risk of defense indigenization breeding corruption, citing the well-known 1990s case of crooked ROC Navy procurement of foreign ships.

When one looks to the factions (派系) that operate within both the DPP and KMT, the bottom-up pressures to deliver local development and job growth outcomes — even at the expense of national-level efficiency — become clearer. Factions serve as patronage networks, dictating appointments in government bureaucracies and state-owned enterprises (SOEs), and provide avenues for party members to secure funds and influence in state projects such as infrastructure, irrigation, and housing build-outs.1 So, for industrial policy — drone production included — the flow of money is often correctly suspected of having more to do with short-term political needs than developing a competitive industry. One of the roles of government bodies like the National Development Council and the Industrial Technology Research Institute is disciplining that tendency, but the risk remains at an early stage that hard decisions necessary for export competitiveness — such as consolidation of multiple small firms into a few larger ones — are delayed or watered down for political reasons.

2. Right now in Taiwan, drone industrial policy is not nearly as important as scoring political points.

Since February 2024, the LY has been controlled by an opposition coalition of KMT (holding 52 seats of 113) and TPP (TPP, which holds 8 seats), while the DPP holds a minority of 51 seats. While Taiwan’s political system does not allow this to translate to much leverage across normal budgetary matters, funding special defense budgets — which is allowed for “national defense emergencies” — requires bringing new legislation out of the LY.2 Unfortunately for the Lai government, that meant its special defense budget proposed in November 2025 totaling NT$1.25 trillion (US$39.8 billion) over eight years was subject to the whims of the opposition. The KMT’s LY whip, Fu Kun-chi (傅崐萁) (Hualien County — KMT), wielded his prerogative to block the proposed defense budget in committee.

That the opposition used its majority to block the Lai government’s proposed special defense budget nine times — despite the clear U.S. support it enjoyed — illustrates how domestic politics still very much comes before expedience in debates over national security in Taiwan. That must remain so given that there will not be a new LY until the 2028 general election and that the defense spending increase Lai aims to achieve with the budget is substantial. Averaging out NT$1.25 trillion over eight years means his administration, under their previous special budget play, had to find roughly NT$156 billion, or more than a quarter of the regular 2026 MND budget (NT$561.4 billion), per year. This is a sum that even recent AI boom-delivered tax revenue windfalls cannot cover, and which thus must be left to the devices of the opposition-controlled LY in special budget deliberations.

During the haggling over drones before the passage of the broader special defense budget in May, U.S. observers and supporters of the DPP expressed frustration with the opposition’s intransigence. Minister of Defense Wellington Koo 顧立雄 criticized the KMT proposal for neglecting critical U.S. weapons systems and effectively endangering the five U.S. systems (including Anduril’s Altius-600 and Altius-700M drones), though he emphasized procurement risks for venerated high-end U.S. weapons systems, such as the M142 High Mobility Artillery Rocket System (HIMARS), which resonated more than Taiwanese drones with a U.S. audience.3

The underlying explanation is that in Taiwan, politics does not stop at the water’s edge. This has long been the case: the DPP received a boost in 2020 due to the PRC’s clampdown in Hong Kong, but both the 2022 and 2024 elections revealed that boost’s expiration date. The fading memory of those experiences, persisting economic pessimism, dissatisfaction with DPP control of the presidency for a decade, normalization of PRC military drills around Taiwan, and uncertainty over the commitment of the only nation capable of upholding Taiwan’s sovereignty in the event of war all combine to make defense spending less sacred in Taipei than Washington may think.4

As a party with deep internal divisions on the question of cross-strait and thus defense policy, the KMT’s motivations for obstinance on the special defense budget are mixed. Deeply anti-independence elements helmed by Chairwoman Cheng Li-wun 鄭麗文 represent an older section of the KMT base receptive to calls to lower defense spending, prioritize dialogue with Beijing, and distance Taiwan from the United States. (After all, she was elected only by card-carrying KMT members.)5 The line is blurry between a genuine fiscal and foreign policy desire to clip the Lai government’s defense posture on the one hand, and the electoral incentives in a polarized system to obstruct, obstruct, obstruct on the other. Perhaps, because public opinion on key questions of national defense is still quite ambiguous (despite evidence that the public preferred the DPP’s to the KMT’s handling of the special defense budget), the opposition does not feel the need to bow to U.S. pressure to agree to Lai’s proposed spending increases.6

PRC business and political influence over the Blue camp aside, one could see the logic in hardliners like Cheng and Fu feeding U.S. skepticism of Taiwan by preventing Lai from smoothly passing defense spending increases. Such skepticism plays to a deep-Blue KMT base long suspicious of the U.S. while also positioning domestic political rivals (both the DPP and KMT reformers closer to the U.S. position on defense) to look foolish once Taipei takes heat from a Washington increasingly forward in its desire to see higher Taiwanese defense spending. Lai’s only way out would be to fund defense increases through regular instead of special budgets, requiring unpopular cuts to social spending that would just as well benefit the KMT electorally.

Cheng’s own hold over the issue is contested. She was blamed within the KMT for stripping drone funding from the May special defense budget, which helped make for a colder reception in Washington during her June visit. KMT heavyweights more aligned with Washington — namely Taichung Mayor and 2028 presidential hopeful Lu Shiow-yen 盧秀燕, who has championed government drone funding in central Taiwan — have staked out a more pro-defense position that would grow in influence should the KMT underperform in this fall’s local elections. In mid-June, Cheng told The Economist that a drone bill was unlikely to clear the LY before Xi Jinping’s planned September visit to the United States, yet the KMT caucus blew by that threat. Yet Cheng’s adamance may have served as an effective anchor or “bad cop” position for more moderate KMT politicians, who in late August got what they wanted by forcing the government to abandon its six-year special military drone budget. The funding bill that they passed, which instead requires annual reauthorization and which the premier just reportedly countersigned, affirms the KMT’s stated concerns with government excesses.7

KMT obstinacy on this issue ought to be expected in future budget cycles, despite American reprimands. Observers who think Cheng must be bluffing should recall that the KMT blocked a special defense budget for U.S. arms during the Chen Shui-bian 陳水扁 more than 50 times before Chen gave up — a precedent raised by Lai during a February press conference. Cheng’s U.S.-skeptic stance is also affirmed by President Trump’s decision to sit on a separate $14 billion arms package for Taiwan. The freeze is easily framed as a harbinger of less credible U.S. commitments and weaker U.S. capacity to help Taiwan in a crisis. Trump called arms sales a “good negotiating chip” with the PRC and one of his top military officials testified that the freeze was partly due to shortages of munitions promised to Taiwan because of operations in Iran.

How Much is Taipei Spending on Drones?

Uncertainty over military drone procurement would be less of a problem for Taiwan’s drone industrialization push if much of it were funded outside MND. But much of the drone strategy’s future appears to lie there, as Taiwan’s private market and overseas commercial footprint are both too small to scale Taiwanese drone suppliers alone.

Taipei’s demand for military drones and USVs will likely only increase given modern militaries’ enthusiasm for using them across multiple domains, as well as pointed reminders from the Russia-Ukraine war and the Iran conflict of how quickly modern operations consume drones and munitions. The U.S. military’s own growing reliance on sea drones underscores the case for investment: in June 2026, U.S. Army soldiers tested autonomous USVs alongside Philippine forces during exercises, and in July, U.S. Central Command carried out its first-ever combat strike using USVs to strike a maintenance facility in Iran. The MND reportedly increased its request for Anduril Altius systems in September 2025 after concluding that existing stores were insufficient. But Taiwan’s military budget was still under $20 billion in 2025, and only so much of that spending can go toward drones given the pressing needs of air defense, long-range strike, and anti-armor defense for which Taipei prefers to buy high-end U.S. systems. The pie is therefore already small to begin with.

Government procurement is crucial to Taiwan’s drone policy, yet there is still no single unified accounting of drone-related government spending.8 The table below assembles what is publicly known. Excluding the Tsai-era drone national team, government procurement of drones weighs civilian (Ministry of Economic Affairs, or MOEA) and military (MND) funding roughly equally (lines 2 and 6 for MND, lines 3 and 4 for MOEA); the NT$35 billion for Anduril’s Altius line (line 7) sits apart, since it buys foreign-made hardware rather than funding domestic production. The new special defense budget focused on drones that now sits at the center of attention following the old special budget’s drone-less passage in May appears in line 8. The Executive Yuan’s version would fund roughly 211,000 UAVs and USVs at NT$210 billion through 2031, while the KMT and TPP have floated rival versions routed through the annual budget instead.

Estimates of Drone-Related Government Spending

Dethroning DJI: the red-free imperative

The notion of exporting drones made in Taiwan — or at least assembled in Taiwan — would not be economically viable if not for the political imperative to guard against Chinese dominance of supply chains throughout the drone stack. To varying degrees, the United States, numerous European countries, Ukraine, Japan, Taiwan, and Australia have all made “red-free” supply chains a priority in drone procurement since 2020 or later. Beijing’s restrictions on exports of long-range drones to Russia and Ukraine in June 2023, followed by restrictions on drone components over the next year, helped other actors realize their vulnerability, spurring an increase in inquiries to Taiwanese drone manufacturers and greater enthusiasm in Taipei for backing local industry in the face of global willingness to pay for “red-free” drones. These dynamics will likely only be reinforced by revelations of Chinese components in Western military drones and Beijing’s willingness to use its leverage over the world drone market to squeeze trade adversaries like the United States, which is subject to stricter review for Chinese drone exports following an August Ministry of Commerce announcement.

Chinese manufacturing is particularly dominant at four points in the drone stack:

1. Flight controllers: China’s cost-efficiency in mature semiconductors gives it a price edge in flight controllers, estimated at a quarter to 2/3^rd the cost of U.S. alternatives.9 Chip packaging is also a segment in which going “red-free” has been especially challenging.

2. Brushless motors: Speedy UAV maneuverability demands powerful turns from motors, which in turn requires neodymium — a rare earth metal China produces around 90 percent of. Estimates for the cost of replacing Chinese motors with non-Chinese ones vary from double to a tenfold increase. The risks of dependence were illustrated by Chinese rare earth export restrictions in April 2025, which reportedly caused prices for some defense components to increase by five to 60 times. Despite U.S. investments in developing critical mineral supply chains independent of China, the consensus remains that any meaningful reduction in reliance on Chinese processing would take several years.

3. Sensors and gimbals: While Taiwan’s high capacity for relatively inexpensive machining gives it a competitive position in components like camera gimbals, related software remains a difficult moat (largely Chinese or American) to cross.10 Estimates of cost premiums for switching from Chinese to American drone camera sensors range from 200 to 300 percent. For now, Chinese dominance of germanium production limits the extent to which any drone requiring advanced thermal sensors can go “red-free.”

4. Batteries: In October 2024, U.S. drone maker Skydio experienced production delays following Chinese battery restrictions — retaliation for Skydio’s selling systems to Taiwan’s National Fire Agency. While Ukrainian drone producers appear to have made some progress in reducing dependence on Chinese batteries by importing South Korean, American, and Taiwanese battery cells, cathode minerals, raw materials, and “midstream cell manufacturing” are still concentrated in China. The lack of a dedicated subsidy program for batteries (as opposed to flight control chips and drone-related software) suggests that Taipei, and perhaps Washington, recognize that their greater comparative advantages elsewhere in the drone stack and China’s present lead in battery technology make it imprudent to focus on fully onshoring this part of the stack.11

While Taiwan is now Ukraine’s third-largest drone-battery supplier — up from 24th in 2019 — and Taiwanese drone reliance on Chinese cells has fallen from 70 to 50 percent, China still controls (depending on the segment) 65 to 97 percent of the upstream cathode, precursor, and graphite materials, and non-Chinese alternatives cost 40 to 50 percent more. Displacing DJI is partly difficult because drones not only leverage the consumer electronics base that China has developed over the past four decades, but also because DJI benefits from Chinese dominance across the drone stack. The resulting cost advantage surfaces opportunities for arbitrage. In August, prosecutors unveiled charges against two employees of a drone firm that won a contract with an army drone unit in 2025 for passing off Chinese-made flight control chips and other components as “red-free” in their products.

Three Models of Sustainment

In conversations with government and industry figures, it became clear that there are three modes of survival and sustainment for firms in Taiwan’s drone industry, including both firms that sell complete drone systems and major component providers that only focus on one subsystem such as the drone’s camera or gimbal.

1. Final assembler

Firms in this category either have built deep in-house expertise over many years — like Taiwan UAV, one of the few Taiwanese drone makers with an in-house flight-control software team — or have acquired the capability outright, as Thunder Tiger did by acquiring a U.S. subsidiary to gain Blue UAS certification.12 The final assembler is arguably the most exposed to contraction risks given its saturation with U.S. venture capital.13

2. Subsystem supplier

Just as with final assemblers, subsystem suppliers are more likely than not to pursue exports and partnerships that can pave the way to foreign markets. Even before the May 2026 passage of the special defense budget without Lai’s proposed drone funding, Taiwanese firms knew that government-led domestic procurement was too small and uncertain to sustain growth.14 For instance, in February, Chiayi-based 7A Drones signed a deal to buy electric VTOL aircraft from Japanese manufacturer SkyDrive (presumably to develop unmanned versions for medical evacuation missions), part of a larger trend of Taiwan-Japan drone cooperation agreements.

To be sure, the subsystem supplier pathway is lower margin than software because of manufacturing costs. But it nevertheless takes advantage of rising global drone demand. As shown by South Korea’s defense indigenization during the late Cold War and the recent arrangement for Ukraine to produce the British L119 howitzer under license, subsystem production or production of relatively simple systems can build the expertise needed for more advanced systems. And a Taiwanese field mainly composed of subsystem suppliers may limit the consolidation challenge flagged earlier. If small and medium enterprises that supply subsystems have non-drone revenue streams and constitute most of elected representatives’ “drone” constituents, then consolidation among final assemblers may not be terribly difficult for Taipei.15

3. Just another department

Large, diversified conglomerates like Evergreen Aviation Technologies (part of the Evergreen Group, which also owns EVA Air) or Mitac stand up a small drone division mainly to stay in the government’s good graces — bidding for a handful of contracts while collecting the tax breaks and political goodwill that come with participating in a strategic industry.16 Among large original design manufacturers (ODM) with footprints in China—who have to be wary of crossing Beijing by openly advertising contributions to Taiwanese arms production—there is growing involvement in drone production, but few flashy press releases to cite. Last year, Pegatron Corp. 和碩聯合, which has a large consumer electronics manufacturing presence in China, financed a Taiwanese startup focusing on drone flight-control systems, and a subsidiary of iPhone assembler Foxconn 鴻海 took majority control of a small Taiwanese drone maker.17

Taiwan’s Niche: Partial Stack

Taiwan’s comparative advantage in several kinds of component manufacturing and assembly relevant for drones, combined with the partial neutralization of China’s greater cost-efficiency owing to “red-free” imperatives in the West, has allowed Taiwanese firms to emerge as competitive in a few layers of the drone stack. A high concentration of machine tooling firms and small component manufacturers in the Taichung-Changhua metro area of central Taiwan — a fixture of the country’s economy since the start of export-industrialization in the 1960s — gives firms making drones in Taiwan access to a deep network of actuator systems, transmission components, vibration reduction components, and other subsystems necessary for military-grade drones.18 All of this is available at lower cost and with much greater speed of adaptability (owing to tight, high-trust networks of small and medium enterprises) than non-China alternatives. In August, the MOEA claimed that Taiwan’s drone supply chain now comprises more than 274 firms, spanning “chips, communications, flight controls, navigation, optoelectronics, batteries, motors, materials, systems integration and application services.”

And at a September industry conference in Taipei, a Shield AI executive projected that the proportion of his firm’s bill of materials paid to Taiwanese vendors would increase to 25 percent from less than one percent in 2024 due to their cost and speed advantages.

However, gaps remain that prevent full-stack indigenization of drone manufacturing in Taiwan. The most notable gap lies in batteries. There are also the components included in the “Three Chips, Two Software” (三晶片、兩軟體) initiative of the Taiwanese government, for which Taipei wants to indigenize a greater share: flight control chips, positioning chips, communications chips, flight control software, and navigation software.19 For military-grade drones, these systems remain essential. On-edge AI solutions for “last-mile” navigation and future swarming tactics have been a focus of U.S., Ukrainian, and other Western manufacturers for a few years now given the Russia-Ukraine War, which has demonstrated the importance of autonomous guidance for reconnaissance and strike drones confronting electronic warfare. Pre-loaded terrain mapping, used in systems like the Tomahawk cruise missile or U.S. drone start-ups’ strike drones designed for Ukraine, cannot work in a maritime environment like the Taiwan Strait because of the constantly changing surface of the ocean.

Constraints on Full-Stack Production

Taiwan’s only drone firm to develop flight control systems in-house is Taiwan UAV (智飛科技股份有限公司). The company is an anomaly both for its longevity and for its focus on this part of the drone stack, having been founded in 2005 to make flight control systems. The firm’s drones were initially used for monitoring natural and environmental disasters like landslides and oil spills at sea — tasks which demand long loiter times. Most other Taiwanese original equipment manufacturers now working on drones did not exist (or did not work on drones) before the 2022 Russia-Ukraine war. Flight control is essential for drone or cruise missile autonomy, as illustrated by recent UK efforts to develop missiles for Ukraine free of reliance on the United States for components or navigation.

Meanwhile, other Taiwanese firms that have competed in MND tenders for Type A-E drones are larger firms that have been able to afford the risk of standing up a drone division, which may fail to win bids or make a profit. For instance, Wistron Corporation (緯創資通股份有限公司) — an ODM that was spun off in 2001 from computer manufacturer Acer, now one of Taiwan’s largest electronics ODMs that in 2025 collected just under $70 billion in revenue — has stood up a modest drone division alongside its core electronics business, entering government tenders without staking its future on the outcome.

Firms across all three models face the same underlying constraint: it is very hard for Taiwanese drone firms to attract top engineering talent. Higher salaries draw them either to semiconductor manufacturing in Taiwan, or to remote positions at U.S. tech firms like Google.20

Another critical part of the drone supply chain is fuselage production. One industry representative noted in an interview that carbon fiber and 3D-printing solutions take too long, so their firm would begin expanding their facilities to allow for casting drone fuselages if anticipated orders materialized.21 However, just as Taiwan UAV demonstrates a large variance within Taiwanese industry regarding domestic production of flight control systems, Taichung-based firm Carbon-Based Technology (碳基科技股份有限公司) demonstrates a similarly large variance when it comes to airframes. That firm has specialized since 2007 in building airframes using composite materials for NCSIST and AIDC, and has now claimed its delta-wing drones (somewhat resembling Iranian Shaheds) are being exported to Japan and Southeast Asia at a clip of about 1,000 units per month.

Integration of the various component manufacturers and assemblers is, like any engineering challenge, something that requires trial and error. Policy can help speed up or slow down this process, explaining some of the contention over the recent opposition-passed military drone budget. Analysts supportive of the government’s proposed special budget for military drone spending have argued that that model would better allow for the MND to tweak requirements in response to operational feedback, speeding up integration of various elements of military-grade drone systems.

Learning the Same Lesson Elsewhere

Taiwan is not the only country discovering that a capable industrial base does not translate evenly across the drone stack. South Korea has world-leading depth in lithium-ion battery cells (Samsung SDI, LG Energy Solution, SK On) and passive electronic components (Samsung Electro-Mechanics), yet the lithium-polymer cells, lightweight motors, and flight controllers that go into small FPV drones come out of a manufacturing ecosystem heavily reliant on China — nearly nine in ten small commercial drones in Korean military service are foreign-made, mostly Chinese. Seoul’s main gaps are small drone motors and flight controllers; its response of mandating domestic core components in its 500,000-strong drone-training program mirrors the situation decisionmakers in Taipei face.

The evolution of other military drone programs shows how unsurprising many of these challenges should be given that Taiwan is not seized by wartime desperation. Iran’s indigenous drone effort began with independent tinkering and reverse-engineering of Israeli and American designs (including the now-famous, originally West German-American Shahed design) after the Iran-Iraq War cut off foreign aircraft suppliers and triggered a scramble for new ways to survey the battlefield. Ukraine scaled up from roughly 3,000 drones produced in 2022 to 4-5 million FPV drones — and 99-percent domestic assembly — by 2026. Despite the risk of war, no similar compulsion grips Taiwan. (And even still, both Iran and Ukraine remain reliant on components from China for drone production.)

The “partial stack” model further gains credibility when considering the challenges Taiwanese firms have already faced breaking into the U.S. defense market. In July, the Pentagon’s Drone Dominance Program (DDP) announced the 19 firms advancing to the second round of selection for small suicide drone procurement. None were Taiwanese. (Thunder Tiger, through procurement of a U.S.-based entity, was in the first round, and supplies a few of the other first-round participants.) Meanwhile, at least some “partial stack” arrangements appear to be progressing. According to an Anduril executive, from June 2025 to June 2026, the firm added 15 Taiwanese suppliers, raised its procurement of Taiwanese components and systems fifteenfold, and integrated the famous Lattice command-and-control system with Taiwanese systems. Viewed in this light, partnerships between NCSIST, state-backed shipbuilding corporation CSBC, and Thunder Tiger on the one hand and Shield AI (American), HavocAI (American), and Auterion (American-Swiss) on the other make sense: brains sourced from abroad, brawn sourced domestically.

Furthermore, the subsystem supplier model overlaps with the production-maintenance division of labor that already defines some of Taiwan’s conventional defense articles. For instance, British defense giant BAE Systems, which manufactures radars and 5-inch guns on Taiwan’s naval vessels as well as the M109A7 howitzers that Taiwan bought from the United States in April, signed an MOU in 2025 with a Taoyuan firm for the latter to maintain BAE equipment used by Taiwan’s military. Some of the clearest examples of this partnership-driven model emerged at September 2025’s Taipei Aerospace and Defense Technology Exhibition (TADTE), Taiwan’s largest-ever defense show, where NCSIST signed MOUs with five U.S. and Canadian drone firms, including Anduril, AV, MARTAC, and Northrop Grumman. As of 2026, MOEA subsidies continue to flow to both final assemblers and subsystem suppliers.

Foreign Markets

Given the reliance of the first two sustainment models on exports, much of Taiwan’s drone activity has been focused on partnerships and sales abroad. This dependence on exports seems likely to persist because it is a result of two enduring factors: the insufficiently-sized domestic market for Taiwanese drones, and the practicality of Western-Taiwanese partnerships given military-grade drones’ need for cutting-edge software to weather electronic warfare — a domain still dominated by Western firms, and sustained by their existing funding edge.

U.S. Regulatory Environment

When looking to large foreign markets interested in paying a markup for “red-free” drones — most notably the United States — it becomes clear that doing assembly or subcomponent supply is not just more technically feasible than exporting whole Taiwanese-made drones, but is also more economical, since Washington’s Buy America preferences make foreign-made drones — even ones largely sealed off from Chinese supply chains — a risky investment.22 In January, shortly after its December 2025 decision to ban imports of all foreign-made UAS and “UAS critical components,” the U.S. Federal Communications Commission (FCC) announced exemptions for products pre-approved by the Pentagon (i.e., on its “Blue UAS Cleared List”) or meeting the Buy American standards laid out in 48 CFR 25.101. These standards provide that compliant products must be manufactured in the United States and that domestic components must account for more than 65 percent of the total costs (75 percent for products delivered after 2028) — a necessary provision given the shock to farmers and other interest groups that a cutoff from DJI brings.

To be sure, U.S. firms have an interest in compliant partnership arrangements, evident in Anduril’s lobbying for loosening of foreign defense production regulations. But the momentum is still with protectionism. The FCC in July proposed a rule to prohibit foreign-made drones weighing over 55 pounds, containing thermal sensors, or using LiDAR imaging. The rule proposal, which sparked backlash from U.S. first responders, photographers, and hobbyists, came on the same day that the FCC postponed the main Buy American compliance deadline to 2028 from 2027 and removed deadlines for foreign-made drones that have been granted exceptions — an admission that moving the drone stack home is not feasible within the next year. And just last week, tariffs announced by the White House in August entered into force, with a rate of 100 percent for foreign-made drones over the 55-pound limit and 25 percent for those under. Taipei was positive about the development, as Taiwan was one of the favored countries whose rate for smaller drones is a lower 15 percent, but the tariff seems well-designed to undercut Chinese commercial dominance, as Vietnam — the transshipment point for many Chinese drones to the United States — is also excluded from the favored countries list. And while the “Blue Skies Act for Taiwan Act” introduced this March in the Senate shows bipartisan interest in carving out a place for Taiwan, the relatively small size of Taiwan’s drone market compared to the United States’ and the enduring dependence of Taiwanese military drones on Western subsystems give advocates for Taiwanese firms relatively little leverage.23 These firms’ gains in the U.S. market will thus likely continue only to the extent they are partnered and integrated with American firms that can fully benefit from U.S. protectionist measures.

The need for international partnerships also becomes more apparent after considering the funding disparities between the Taiwanese and U.S. markets. An MOEA-backed startup-investment platform calculated that together, Taiwanese drone firms in 2024 grew revenue by NT$442 million (US$13.8 million) and drone startups up to 2025 netted NT$3.8 billion (US$119.3 million) in paid-in capital. That private investment pales in comparison to the NT$56.8 billion (US$1.8 billion) spent by the drone national team and in the MND’s 2024 buy. Though not a perfectly apples-to-apples comparison, that state-to-private spending figure of about 15-to-1 up to 2025 is far greater than the roughly 4.6-to-1 ratio one finds in the United States (comparing DOD FY2026 requested funds for drones to private drone investment in 2025). Taiwan is not unique in that state investment remains ahead of private-sector activity, but the scale of the gap between the two suggests a difficulty in raising capital that makes deeper-pocketed partners all the more attractive.

European and Asian Drone Demand

The demand signal from foreign buyers is generally strong due to most militaries’ increasing attention to drone procurement over the last four years. Japan has allocated around $660 million this year to buy drones for a new coastal defense system, and the FY2027 Pentagon budget asks for a massive increase to more than $54 billion for the budget of the Defense Autonomous Warfare Group, meant to centralize Pentagon drone procurement. At Detroit’s Xponential 2026 trade show from May 11 to 14, Taiwanese firms signed a record NT$1.3 billion (US$41.22 million) in preliminary agreements, according to Taiwan’s MOEA.

The picture is more complex in Europe. For instance, Polish procurement rules favoring EU or NATO member state products may hamper Taiwanese entrants to that market, and — despite hopeful talk — other EU states may end up favoring Ukrainian and EU products as they build up their drone arsenals, not least because many Ukrainian products come battle-tested and Ukrainian producers will likely focus more on exports going forward. There is also the risk of Chinese backlash. China’s April sanctions on seven German, Belgian, and Czech defense firms for “collusion with Taiwan” came days after the European Parliament’s security-committee chair visited Taipei to discuss joint defense cooperation.

Export growth in 2026 has been impressive. DSET put Taiwan’s drone exports at roughly 139,000 units in the first quarter of 2026 alone, and MOEA reported that quarter’s export value at US$115 million — already exceeding all of 2025 — with the Czech Republic alone accounting for US$100 million of that total (largely for pass-through to Ukraine), followed by Poland (US$11.76 million) and the United States (US$2.58 million). In the second quarter of 2026, exports rose to 191,000 units. A separate DSET analysis found that Taiwan’s exports of complete drones to Europe rose from 2,574 units in 2024 to 107,433 in 2025, concentrated in the Czech Republic and Poland.

Yet beyond the aforementioned Carbon-Based Technology figure and Thunder Tiger’s Overkill FPV — which advanced to the second phase of the Pentagon’s DDP in June with an initial order of 1,520 units — contracts are hard to find publicly. State procurement by Japan, the country other than the United States most often floated as a natural drone partner, remains difficult because of mismatched certification and safety standards. However, there are signs that spending on drones will surge — Anduril is exploring buying a Japanese car plant to make drones — and June export controls levied by China on Japanese firms involved with drone production could lessen future hesitation about cooperation with Taiwanese entities.

There is a broader reason to doubt Taiwan’s ability to continue scaling up exports, at least of fully assembled drones. It is not simply that Ukrainian, Israeli, and American drones are combat-tested and Taiwan’s are not, but also that those countries’ firms have decades of experience actually selling into international markets while Taiwan’s do not.24 NCSIST’s missile lines and AIDC’s F-CK-1 Ching-kuo fighter never became global exports as Lockheed Martin’s F-16 and Patriot did, or the way Israel Aerospace Industries’ Barak, Arrow, and Harop have. Ukraine, meanwhile, has turned years of combat experience into buyer interest in drones like the Magura USV, the Liutyi UAV (now in joint production in Germany), and the F10 FPV, recently cleared for export to the United States. Taiwan has no comparable track record to draw on.

Testing and the Chiayi Challenge

The seventh goal of Taiwan’s drone industrial policy — to set up a cluster or hub for UAVs, centered in Chiayi County on the southern end of Taiwan’s western plain — continues a tradition in Taiwan of using industrial clusters to produce faster innovation cycles and tighter supply chains, most famously with the Hsinchu Science Park in Taiwan’s north where TSMC, UMC, and other semiconductor manufacturers have operated since 1980. Indeed, just a year after its August 2022 inauguration, Chiayi County’s research and development center hosted facilities belonging to 20 drone firms.

However, according to interviews, the Chiayi drone cluster appears to have been ineffective for research and development due to Chiayi’s distance from sufficiently large testing areas. The density of commercial airline routes over Taiwan’s western plain and the inability of UAVs based there to venture too far out into the Strait without bumping into Chinese flight paths means that tests for longer-endurance UAVs can only be done from military bases near Yilan or Pingtung, in Taiwan’s northeast and south, respectively.25 Tests on these sites require multi-day treks from Chiayi County, clashing with the goal of a low-friction industrial cluster, and only allow Taiwanese nationals to participate due to the sites’ colocation with military facilities, complicating tests for firms that would prefer to use more experienced drone pilots from abroad.26

Moreover, testing in Chiayi over land does not allow manufacturers to hone radar for conditions in the Taiwan Strait or other waters around Taiwan, which create different types of clutter.27 While the legislator representing the Chiayi drone cluster, Chen Guan-ting, has spoken publicly about the need to expand testing capacity, no signs of progress are visible. One long-range drone manufacturer said that, in addition to their firm having years of experience testing in Pingtung, Chiayi County was less attractive because of its higher population density.28

These difficulties are not to say that future expansion of the Minxiong industrial park (located near the UAV R&D Center in Chiayi County) will not succeed in attracting Taiwanese drone firms to form a manufacturing cluster.29 But they should induce a healthy skepticism that a cluster hosting the majority of both testing and assembly for Taiwan’s drone industry is possible. The burdens imposed by long-range testing in a place as geographically limited as Taiwan are formidable. While no location offers everything an ideal testing site needs, Chiayi County was as much chosen as the drone cluster’s center for non-technical reasons as technical ones: Lai has continued Tsai’s emphasis on developing central and southern Taiwan and, at the time of selection, both Tainan and Kaohsiung were more focused on building out TSMC facilities.30 One drone manufacturer explained that it makes more sense for their firm to expand manufacturing facilities in the Taichung-Changhua metro area, which hosts Taiwan’s highest concentration of machine tools manufacturers and the headquarters of AIDC, Taiwan’s largest aerospace manufacturer and the coordinator of Taiwan’s drone alliance.

The difficulty of satisfying equities from multiple government agencies — most of which had no direct stake in the success of the high-level initiative at hand — reminded one former bureaucrat of the difficulties in getting Taiwan’s growing offshore wind infrastructure approved.31 While in May Taipei convened a Vice Premier-led inter-agency task force to elevate Chiayi to a national strategic project, interviewees indicated no reason to believe dramatic breakthroughs in these testing challenges are around the corner.

Looking Forward

As drones, defense tech firms, and the idea of turning Taiwan into a drone-laden “hornet’s nest” have gained traction, Taipei’s program for manufacturing finished drones and drone components has attracted support. The opening left by many countries’ desire to wean off of Chinese supply chains is large, and Taiwan has a strong small and medium enterprise base of component manufacturers to offer in response.

Yet predictions that Taiwan’s growing drone exports will cement its status among the biggest winners of surging world demand for drones, or that it will be able to use drone prowess to reduce dependency on American arms substantially, are overplayed. The relatively small scale of Taiwanese drone manufacturing is just as much an indication of China’s continued commercial drone dominance as it is a reminder that Taiwanese firms must still contend with a battery of challenges when selling their products. Domestic government demand remains uncertain because drone spending is not above politics. Foreign market barriers, certification issues, and the continued dominance of Western software for autonomous military applications make the proposition of full drone assembly and sale hard to justify. And although Taiwan has an advantageous manufacturing base and proximity to potential hot spots, its geography also makes testing difficult. In any case, drones will not be able to fill the gaps serviced by advanced Taiwanese or U.S. systems in domains like missile defense or major ground operations.

If certification challenges in the United States, Japan, and other partner countries are overcome, however, Taiwanese firms — especially those occupying the subsystem supplier niche — could solidify partnerships that help realize the Lai administration’s vision of “Red-Free” supply chains. While a far cry from the more ambitious goals of complete self-sufficiency or establishing Taiwan as central for drone development in Asia, this would still constitute an economic and national security win.

• Why the Hugging Face hack broke through where years of extinction talk didn’t, and how Bernie, Tucker, and Rogan ended up on the same side

• What “pacing” even means: Nathan’s case that nobody can measure the frontier, and why it still beats “pause”

• Who gets Slack access: METR’s monopoly on trust, CAISI’s $10 million, jury duty for AI researchers, and why nothing survives without legislation

• Will China slow down too? Zhipu and Moonshot turning the crank, military secrets leaking into Claude through proxy routers, and the MSS waking up

• The Sacks clap-back: whether product liability does the job, and what an eighteen-month pause costs in cancer cures and vibe-coding projects

• Send in Demis! plus Lu Xun as the antidote to Chongqing TikToks, and what DeepSeek’s Chinese name owes to Qu Yuan

Listen now on your favorite podcast app.

The Safetyists Break Containment

Jordan Schneider: Ladies and gentlemen, ModelTalk is back. Where do we start this timeline?

Nathan Lambert: Hugging Face, OpenAI. July.

Jasmine Sun: There’s the pacing letter at the end of July, then Hugging Face shortly after that, and everything has been escalating since. Then the new reports that Hugging Face was so much worse than we thought. And the Jacob Coxon post is interesting because it broke containment: Sheryl Crow and Maggie Rogers are posting about it, and he’s hanging out with Bernie or whatever.

What’s most interesting to me is that I had done this data centers piece, and in mid-August the Hugging Face incident had shown up on people’s radar, but it wasn’t huge yet. At the time people were freaked out about data centers in a really big way, and all the politicians were talking about that. Some of that general, diffuse, populist anti-AI sentiment has now collided with, “Yeah, also the safety stuff is super real now. We are really worried about these misaligned agent swarms.” The AI safety folks and a broader public that was already souring on AI — souring on data centers, souring on the companies — have collided into a mega moment for AI safety and regulation. That’s how I’ve been tracking it, since early August probably. What do you guys think?

Jordan Schneider: Do the sine waves all hit now — Daniel Kokotajlo on Joe Rogan, Nate Soares on Tucker Carlson?

Nathan Lambert: Soares on Tucker is way more crazy.

Jordan Schneider: Was this inevitable? Was it happenstance? Is there a grand EA media comms conspiracy? How contingent is the past week we’ve just seen, Jasmine?

Jasmine Sun: I was wondering for a long time whether these two sides would collide. There are internal debates within the EA community about whether the frontier safety people should engage with people like Tucker Carlson, who is seen as not aligned with them on a bunch of other issues, and maybe not an epistemically rigorous, truth-seeking guy. In general there was a lot of hesitation from the more technocratic wings of AI safety about whether to talk to Bernie, whether to talk to Tucker, whether to try to make this a gigantic mass movement or whether that would be destructive.

I wasn’t sure it was going to happen, honestly, because for a long time the left and the people who didn’t trust AI people also didn’t trust the safety people, who were seen as part of the same Silicon Valley tribe of SF and Berkeley weirdos. So it’s surprising, but not beyond imagination, that the coalition did emerge. The left got over its distrust of AI safety and its belief that maybe AI was fake. Bernie probably did more than anybody to wake up the broad populace and the left to think, “Shoot, AI is real, AI risk is real. This isn’t a fake marketing tactic made up by the companies.” We’ve seen a phase shift there.

And then the public got so riled up about data centers, plus a bunch of other simmering anti-AI stuff, that when Hugging Face hit, it broke through just enough that they decided to care about actual frontier safety stuff. At that point, if you’re working on frontier safety, why not build that coalition?

Nathan Lambert: Do you think the public actually cares about it? I feel like the public was like, “Huh, that’s weird.”

Jasmine Sun: People care. It’s not people’s top voting issue right now. I don’t think anyone’s going to vote on AI as a top-three issue, or even top-five. But there is a sense that these companies are being reckless and need to be regulated, and I think that now extends to frontier safety in a way that it didn’t before. If you ask the public whether we should have embedded third-party evaluators, or whether we should fund CAISI, no one’s going to have opinions on that. But the general idea — these companies are out of control, there’s way too much power concentrated in them, we need to regulate the data centers, we need transparency, we need government auditing, we need to investigate this AI crime — I think that’s a pretty common intuition. We heard AIs are going rogue. Is that okay? Send in the FBI.

Jordan Schneider: There’s also something about the fact that the OpenAI–Hugging Face hack is so narratively compelling. It fits very cleanly onto all the other media that has been created over the past forty years about rogue AI. So when the New York Post cover is the Terminator, it’s not that far off from what actually happened. The facts of the incident rhyme enough that a median voter looking at it from a headline standpoint can pattern-match it to things that are legibly scary.

Look, it’s Rosh Hashanah on Saturday. You’re not supposed to be reading the news or on your phone; it’s a no-electricity day. And the number of questions I got at synagogue — “We’re going to pace the frontier, Jordan? What does this all mean?” My mother was asking me if she should withdraw some money and hide it under a mattress.

This is a multiple-orders-of-magnitude breakthrough that some boring industrial safety incident — a chemical leak from a plant into a river — would not produce, because you can’t tie that to something that sounds like Skynet. This, you can.

Sci-Fi, Non-Dismissively

Jasmine Sun: On Hard Fork’s Hugging Face episode, they were talking about how some people critique calling the Hugging Face hack “sci-fi” because they think it’s dismissive. But actually it is sci-fi, in a non-dismissive way. It fits cleanly into all the sci-fi narratives about rogue AIs, and so it’s, “Shit, the sci-fi is real. All the things from the Berkeley people that sounded like science fiction really are that bad, maybe.” And the message board thing.

Nathan Lambert: I feel like that’s a big step from what the AIs did to all the other fictitious scenarios from the — what’s a better word? I don’t like using the doomer word. I’m not absolutist about it, but the safetyists —

Jasmine Sun: You can say safetyists. Safety people. That seems fine.

Nathan Lambert: Those people have a lot more extreme scenarios. Yes, the Hugging Face incident is surprising, but it’s also not that surprising if you think about how persistent one OpenAI model is. If you strip off the guard layers, have a thousand copies, and tell it to do a really hard task, I’m not that surprised it does some wacky stuff. It’s not surprising to me that the model told to hack then hacks. That’s why it’s a problem if you tell more extreme stories to people. But people like scary stories, and that’s why it traveled so far.

Jordan Schneider: Sure — you, Nathan Lambert, author of Interconnects, aren’t surprised. But people like scary stories. If you’re going from asking ChatGPT to convert a recipe from milliliters to pints to “by the way, this thing you thought was merely annoying because it wrote your kids’ homework for them can also hack into your bank” — I don’t begrudge people for being perplexed and upset about data centers, and I don’t begrudge people for being freaked out.

Nathan Lambert: I don’t think hacking into your bank is a big jump. I think the extinction of humanity is a very, very big jump. Even hacking into your bank would often get corrected so long as somebody notices; banks are very good at correcting for fraud and putting things back in the right place. It’s not great that the status quo for a few years is going to be more undocumented cyber incidents happening all the time, and hopefully they don’t cause a lot of damage. But I just think we should not get too escalatory.

Jasmine Sun: I don’t know whether the public is worried about extinction. Some folks like Bernie are worried about extinction, I think, in a real way. I’m not sure the public is worried about extinction specifically —

Nathan Lambert: Extinction wakes the public up. If you tell them repeatedly that everyone’s going to die —

Jasmine Sun: Yes. But people have been saying extinction for a while, and it was a real-life incident that woke people up. Obviously there’s nothing about newspaper editors that is representative of the American public. But one big thing from my experience talking to media people is that for a long time, mainstream media people would say all the safetyist talk is speculative. It’s about stuff that could happen: maybe these AIs will collaborate or deceive or engage in human-like motivations. It all seemed too speculative, or it was only happening in made-up sandbox environments. What changed for a lot of these people was that it was a warning shot. This thing actually happened in real life, rather than being a forecast. I don’t think it was the extinction talk that changed things. It was seeing another serious company like Hugging Face actually get hacked — not because of misuse by a terrorist or some bad actor, but because OpenAI could not control and monitor its own agents — and that happening in reality, not in a made-up red-teaming scenario.

Nathan Lambert: I agree it’s going bigger. I’m griping about the people who are pushing it. I hate the word “conspiracy,” because I don’t think the agents had a conspiracy. I’m fine with some of the anthropomorphizing, because it’s a useful lens for describing how the models evolve and act in an environment: the agent will be like, “I need to figure this out,” and then you see a bunch of actions trying to figure it out. So words like “goal” are pretty fair. But the whole language spiraled into civilizations and conspiracies, and it goes so broad that I’m just like, nah. I got snippets of this on my honeymoon. I’d get a text and be like, “This is dumb, man.”

Jordan Schneider: Three paragraphs in a red-team write-up is way less compelling than a company that thought it was being hacked by the Chinese and it turned out to be a customer — a company that’s supposed to be one of the most technologically advanced on the planet, which has no idea what it’s doing.

Jasmine Sun: And to other people, it’s two AI companies. It’s not some small business with bad cybersecurity that got hacked. One AI company hacked the other, and neither of them knew about it because —

Nathan Lambert: Don’t ask me about the cybersecurity of Hugging Face. No comment.

Jasmine Sun: What do you guys make of the discourse in cyber-land about how much this is an alignment issue versus a cyber issue?

Nathan Lambert: When I talk to cyber people, it seems pretty clear that we need mass preparation for the tools that are going to proliferate. There’s a clear cyber issue, which is that our infrastructure is not ready for the type of tool that’s going to be ubiquitous. And there is an alignment issue, especially at the frontier: the more differentiated a capability, the more responsibility there is to align the models. But we have seen that the frontier labs poke a hole in what is possible, and then in three to six months there are three models that can do it, and in a year there are twenty-plus organizations. So it’s an alignment issue for a transient period of time, but there’s a constant cyber issue that is not going away until we solve it.

Pacing, Not Pausing

Jordan Schneider: Let’s talk about frontier pacing. We’re not saying “pause” anymore like we did last season; I’m glad we got the rebrand. What were your impressions of Dario’s essay and the pickup we’ve seen so far?

Jasmine Sun: How do you define pacing, Jordan?

Jordan Schneider: That’s the question, right?

Nathan Lambert: One point of MMLU per year.

Jasmine Sun: It’s clearly not a pause, and it’s not slowing down. They chose a word that still implies one is moving ahead.

Jordan Schneider: Nathan, as the runner on this podcast, I think we’ve got to defer to you here.

Nathan Lambert: We don’t know how to measure frontier models. Any pacing would imply you’re trying not to go past certain measurements. It’s pretty self-serving, and OpenAI and Anthropic could do what they want with it. But I like it. The sentiment is very valid. These companies need to share more for us to have the ability to discuss this. I’m sick of hearing people at labs say, “You don’t see this. Internally we’re also scared by the pace of progress.” What does that actually mean? I don’t feel scared by these people, who have hyped stuff up a lot and some of whom are a bit out of touch. It goes over my head a lot of the time. I don’t know what to make of it without more transparency.

Jordan Schneider: If we’re moving marginally toward spending more money on safety and alignment and less on pushing the frontier at xAI, OpenAI, and Anthropic — and again, this is a really hard coordination problem — would it be horrible for the planet? Would it mean we lose to China? Probably not. There are lots of other levers that go alongside this if you’re stressed about the China angle, like all the compute control stuff we’ve been screaming about for years and years.

Nathan Lambert: I am interested in the China stuff, because there have been some interesting comments. But the pacing framing implies that it’s more metronomic and measurable than it is. It should be more of an industry standard that independent people are in all of the labs — clusters of people who can see into one or multiple labs — and agree that the labs have done sufficient safety work for the current capabilities of their model. Every model has different strengths and weaknesses. OpenAI’s models are so persistent that there’s a very different safety problem there. I don’t know if you’ve used /goal in Codex, but if you phrase your goal really specifically, it just goes and works for two days on it. And the Claude models in production that I use seem almost borderline lazy sometimes, where you need to put in more input.

Jasmine Sun: I find them lazy.

Nathan Lambert: That’s a very different alignment problem. I’d see pacing as: these companies have some of the same people in them who can see what’s happening and give approval — “Yes, we are satisfied. We know there’s uncertainty, but appropriate risk has been accounted for.”

Jordan Schneider: I don’t understand how this happens without the government being the one who says yes and no. Say METR is woke, we’re not going to trust them, they’re basically Anthropic — so it’s going to be METR Nathan Lambert. METR Nathan Lambert shows up and says, “This isn’t cool yet. You gotta bake some more.” And OpenAI says, “No, it’s fine, this is safe, what are you talking about?” Then what? Your contract times out —

Nathan Lambert: My contract times out.

Jordan Schneider: — you write a blog post saying this is fucked. And then what? Either the government trusts Nathan more than it trusts the company upon which the entire US economy depends, or…

Nathan Lambert: It’s just so hard to implement. Although there are all these academics saying we have untapped students and professors who would be great for studying all of this. And I’m like, how are you going to set this up? How is a university going to sign these NDAs with these companies and ship their grad students to San Francisco? In spirit, it’s nice.

Jasmine Sun: It’s a pretty crazy level of access. Dario is saying — and I think he plans on it — give the METR people desks and Slack and codebase access. On one hand, yes, I support having more than just METR, because METR is a very specific approach to AI safety, and it would be more credible if there were a few other orgs not from Berkeley. At the same time, I can’t imagine Anthropic being willing to let in some nonprofit from, I don’t know, Boston, and give them full Slack access, because we know how paranoid they are about security and how little they trust most people. The reason they trust the METR folks is that they’ve personally known them for five-plus years, and they’ve decided, yeah, Ajeya Cotra should get Slack access. We’d be okay with Ryan Greenblatt getting Slack access. I’m not sure that transfers to other people at METR, or to other orgs.

Then the second trust question is, as Jordan said: what does the government do if the third-party evaluator disagrees with the gigantic company the economy rests on? Does the admin trust METR, or whoever that other organization is? Right now METR seems like clearly the best we have, so I’m pro-METR. At the same time, when I saw Dario’s embedded-evaluators thing, third-party evaluators are almost the compromise position compared to having the Trump admin just send their guys in and start knocking on Anthropic’s doors to shut the models down. Bringing in nonprofits is actually the more pro-AI-progress option, because the alternative is the Trump guys showing up and saying, “You can’t release this.”

Nathan Lambert: Who’s going to do this? There are so few people.

Jordan Schneider: And we lived in that timeline, right? It didn’t stick. Maybe it didn’t stick because it happened a little too early, because the models weren’t quite as scary, or whatever.

Who Gets Slack Access?

Jasmine Sun: Next time around, let’s look at the incident again. Amazon says Fable is dangerous. Andy Jassy or whoever calls Trump, or Susie Wiles, and says, “We found a jailbreak. This thing is super unsafe.” The admin calls Anthropic: “Hey, Tom Brown, apparently your model is super unsafe.” And Tom Brown says, “No, no, no, METR says we’re cool.” What happens then?

Nathan Lambert: Andy Jassy is getting listened to a lot more than my friend Chris at METR.

Jasmine Sun: It’s Ryan Greenblatt. Ryan Greenblatt specifically.

Jordan Schneider: Or CAISI, which has ten million dollars and hasn’t been able to find a head four years into this whole thing.

Nathan Lambert: They only have ten million dollars? God. As somebody fundraising in the nonprofit scene, I feel bad that that’s a pretty small amount of money.

Jordan Schneider: It might go to thirty.

Jasmine Sun: And people keep trying to shut them down every six months, right? They barely get saved, and then someone tries to shut them down again.

Jordan Schneider: Nathan, who is going to work here? The most qualified people are people in the labs, because you really need model training experience to know what the heck is going on, presumably. Where would the money come from such that everyone would think it’s clean and trustworthy? And who would do this job?

Nathan Lambert: You just have to pay them what they’d get paid in salary and not have stock. You have to be paying people 400K to a million in cash a year. That’s what most of the nonprofits are converging to: the same or slightly more cash, no stock.

Jasmine Sun: I think that’s what METR pays. Cash comp. Which is fair, because there are people willing to take pay cuts to work at nonprofits; you just can’t take so much of a pay cut that you can’t get your house in San Francisco.

Jordan Schneider: But then where does the money come from such that people are comfortable with it? It should be an industry consortium, right? But if you’re worried about it not coming from AI safety donors, and instead it’s an industry consortium, is that not a captured thing that no one’s going to trust? That Bernie Sanders won’t trust?

Nathan Lambert: Taxpayers. I think the only way to trust is diversity in backgrounds and funding. Which is why — I don’t really know if I’d be good at this or accepted, but I’ll talk to people about doing this job.

Jasmine Sun: It’s government funding, right? Bank supervisors are government funded. They don’t take money from the banks; they take money from the government, and then the government licenses other people with more expertise to go sit in the banks and monitor them. And every six months or so you have to cycle people out so they don’t get ideologically captured by Goldman Sachs.

Nathan Lambert: We tax the data centers to fund CAISI.

Jasmine Sun: And then CAISI either manages to hire people or pays METR plus two other orgs, and mandates that Anthropic and OpenAI accept those people. So Anthropic can’t say, “We’ll take Ryan Greenblatt but not Nathan Lambert.”

Nathan Lambert: I would love that email. That would be freaking hilarious.

Jordan Schneider: There should be some jury-pool thing: fifteen people, you get five no’s.

Jasmine Sun: Oh my god, AI researchers just got mail. “You’ve been summoned.” That would be so good.

Nathan Lambert: I would do my best. I don’t feel like I’ve been so critical of Anthropic that they can’t let me in the office. I’ve been in the Anthropic office; they didn’t turn me away. It’s a very interesting social dynamics problem. It’s an industry concentration problem.

Jasmine Sun: I do think we just need legislation. Insofar as there’s no legislation, it’s voluntary, which means that even if the orgs are trying their best to be independent and aggressive, there is an extent to which METR or Redwood or whoever will not antagonize the org that is giving them voluntary access. You need some legislation, whether it’s the government licensing METR or the government sending its own people in. There’s just no world without federal involvement that I think is sustainable.

Too Woke to Exist

Nathan Lambert: You can also imagine a future where in six to nine months we’ve been pacing the frontier at xAI — SpaceX AI — Anthropic, and OpenAI, and Meta keeps crushing it but isn’t pacing. The independent evaluators are at those three orgs and have all found the same absolutely critical failure mode, but it’s all private information at the separate orgs, NDA’d at the evaluators, and Meta doesn’t have them and just YOLOs it and unleashes the bad thing. How do you deal with this?

Jasmine Sun: That’s why they’re working on the antitrust exemptions, right? Isn’t it because of that? Maybe you have thoughts on the antitrust exemption, Jordan, because it’s also framed around distillation and China stuff. But my understanding is that it’s really a frontier safety thing. There are a bunch of things where the labs can’t coordinate on safety because of antitrust law, so now they want to carve out an AI safety antitrust exemption. And the current bill is framed around beating China, as things usually are.

Jordan Schneider: Let me take half a step back. First there’s the question of what the legislation is. I had Astra pull me all the frontier AI safety bills for this Congress, and none of them do this in a compelling way.

Jasmine Sun: I think the Frontier Act is supposed to be the one licensing the orgs.

Jordan Schneider: Tiered requirements for model disclosures. But it’s basically “Commerce, you have the power to do this.” Once you kick it over to the executive branch, that’s still the dynamic we had when Fable got shut down. If the White House calls you and says, “Don’t fucking do this,” you’re probably still not going to do it, unless you’re so confident that you’re willing to go to court to fight it. That’s what Anthropic did in the Pentagon case, because they were going to try to shut down the company. But not in the Fable case, because there it was, “Okay, you’re worried about safety, we’re worried about safety, let’s have a conversation.” I’m glad we’ve at least memetically come to a good place. We can work with this as a starting point for a discussion, as opposed to us being too woke to exist as a firm.

Jasmine Sun: “Too woke to exist” is such a good line.

Nathan Lambert: Do we think OpenAI and Anthropic have these independent evaluators set up within three weeks?

Jordan Schneider: Who is it going to be?

Nathan Lambert: METR.

Jasmine Sun: It’s going to be Ajeya and Ryan, I think. Eventually they might do something else, but to start, it’s just METR.

Nathan Lambert: I think it should be institutional and not individual. It should not mention the people. It would be good to know how the Hugging Face–OpenAI investigation went down. If it was “METR, send your best four people, they’ll sign the NDAs and sit in the office,” that’s good. METR should decide that. But if OpenAI and Anthropic say, “We just want these three people,” that’s not good. That’s not a good way to do it. If METR has forty people, implicitly the labs are going to know who METR’s most likely to send, but there needs to be enough trust that the independent organizations can have a say.

Jasmine Sun: The thing with the ecosystem right now is that everything is so messy and flying by the seat of everyone’s pants that none of the things happening now are being done the correct and proper way. And everyone knows it. It’s not like anyone thinks this is better. Even the initial METR–Redwood investigation of the Hugging Face incident was completely voluntary on OpenAI’s part, and we can all criticize them for only giving access to seven days of Slack logs or whatever. We would all want more. At the same time, there was no legislation. No one was required to do shit. We were purely relying on voluntary goodwill, and the fact that they happened to trust these three random people enough to bring them in. So there’s a balance between what we’re trying to move toward in an ideal world and what we want to enshrine in legislation — and then, personally, also: this is what we’ve got right now. Okay.

Nathan Lambert: And this is in the face of rumors that the labs have such better models. Anthropic hasn’t released something in months — they’ve released 5.1, but they have other stuff cooking that is well stronger than this. So the US–China angle is that the US labs are taking longer and longer to release, at least at the frontier, and the Chinese labs don’t appear to be slowing down. But we don’t get good information out of that ecosystem.

Will China Slow Down?

Jasmine Sun: I’m curious for your take on the whole question of, if the US slows down, does Chinese progress slow down, and by how much?

Nathan Lambert: Within the current paradigm, I think the Chinese labs are set up to hill-climb very well. There was this Dwarkesh podcast with John Schulman, Charlie O’Neill, and Beren Millidge, and even they were talking about how GLM-5.3 is potentially better than Claude Sonnet 5 and Opus 5, just because it’s somewhat easier to use. Zhipu — Z.ai — has shown that their post-training stack is very mature and can hill-climb and make very good models. GLM-5.2 and 5.3 are both very solid. And with the Kimi base model, they know the recipe, and they are turning the crank on the thing right now: scale RL environments, scale RL, figure out the right user distribution, make it longer-horizon. They can do this and will keep doing well at it. If OpenAI and Anthropic find a new paradigm or really change something, then I don’t know. But in the near term, they will just keep charging ahead, and the pace of progress won’t be that different.

Jasmine Sun: People are saying that because the Chinese labs partly rely on distillation to improve their models, if the US labs stop releasing models, or release them much slower, will Chinese progress slow because they can’t distill? And separately, what if we crack down on distillation more?

Nathan Lambert: I think it takes a lot longer for that to kick in. Anthropic did have this very transparent misuse report, which is so weird with the extent that the Chinese companies rely on proxies and route their customers to Claude. I’m going to need somebody to explain to me why all the Chinese LLM companies are doing that so much. Yes, user prompts are helpful for training, but it seems way bigger than the distillation thing. There’s this huge mass use of the models.

Jasmine Sun: That’s pretty crazy.

Jordan Schneider: And it’s expensive, too. What percentage of these prompts are actually going to be useful to train on? I can’t imagine a super high percentage, versus the ones where you’re focused on extracting reasoning. It’s so funny: the PLA guy designing some undersea drone, asking DeepSeek for help, and it ends up going through Claude. Credit to the MSS. They were posting blog posts about this back in April and May: “Guys, you gotta be careful about this. Don’t give your military secrets to Claude.” But presumably you’d think it would be okay to give them to DeepSeek.

Watching the Chinese security state respond to all of this is going to be fascinating. The example they put in that report is everyone’s biggest fear: leakage of state military secrets to the Americans — not even to the Americans, to this enemy AI company that Dario, sworn enemy of China, has set up.

For years I was reading all of these debates — it’s a very small community of people in the West who follow Chinese AI safety debates — and for a while it was clear you could write it down to zero, because this was not something the government really cared about. All of a sudden Xi gives this speech, the head of the MSS writes a blog post; they’re all starting to take this stuff really seriously. Combine that with the labs starting to do tiered releases: GLM-5.3 was the first time where they said, “This company is going to get this model first,” and released it in a staged way. I can only assume that’s going to become more prevalent as the Chinese government processes both the Hugging Face risk stuff and the leakage that’s clearly inherent in “we’re training off all of this distillation.” This is not actually answering your question, Jasmine, of whether they’ll slow down —

Jasmine Sun: No, but it’s useful.

Jordan Schneider: — but I think the “fuck it, we’re shipping” paradigm China has been in is going to come under increasing pressure, from state security people who are worried about things as well as from the more straightforward AI risk stuff, which you’re already seeing manifest.

Nathan Lambert: At least the open-weight part of the Chinese models has slowed down. They’ve started releasing their models in their own offerings and APIs, and then the weights come two to three weeks later. I wouldn’t say I have a conspiracy theory, but is that partially some internal regulatory thing? All these AI labs in China talk to the government and register their releases. Is that built-in time for more testing and more safety before you upload the weights and they’re everywhere? I wouldn’t be super surprised. I was kind of confused, because Kimi and Z.ai both announced the model and then, almost exactly three weeks later, uploaded the weights to Hugging Face. That’s too weird of a coincidence, because Kimi benefits from uploading the weights if they’re planning on it. It gets the distribution. There’s not a lot of history in the industry of the people building the models giving a ton of extended time to release partners. It’s more, “Here’s the model, hot potato, we’re going to release it. Good luck with your implementation for day-zero readiness.” I think they’d still do that if they could. I don’t know how we could ever verify this hunch, but it seems like a logical response: give us a few weeks before uploading the weights.

Jordan Schneider: Speaking of our jury-pool selection — once we have our super easy, one-page US–China AI treaty, who from the Chinese government are OpenAI and Anthropic going to be cool with giving Slack access to?

Nathan Lambert: I’m going to be an embedded evaluator at Anthropic, OpenAI, Zhipu, MiniMax, and Moonshot. I’m going to split my time between Beijing and San Francisco.

Jordan Schneider: We’re sending you to Beijing, Nathan. It’d be a fun job. You get some good duck out of it.

Nathan Lambert: It would be interesting. It’s an important job. That’s why it’s so sad that the question is, who is going to do this? If the industry commits to this, it’s really important that it works and isn’t just papering over a problem.

The Sacks Clap-Back

Jordan Schneider: Let’s respond to David Sacks. Why isn’t this just a normal business thing? You don’t want to ship something to your customers that you can’t be sure won’t blow up their servers. If this is just a liability question, why do we need to make such a big hubbub about it?

Nathan Lambert: The AI companies know themselves, there’s so much money to be made, and they know that they’re not trusted. So they’re trying to have a fig leaf of somebody who is high-trust to help verify their claims and hold them back from the gigantic piles of revenue they could make if they just raced forward. I don’t know the answer. I’m just spitballing.

Jordan Schneider: Is the gigantic pile of revenue there if you implode Morgan Stanley from the inside, and then all of a sudden it’s, whose fault is it? Dario Amodei’s, or Sam Altman’s?

Nathan Lambert: I have sympathy for the response. I’d like to reread what David Sacks said, because I suspect it comes off a lot more harshly than how you phrased it.

Jordan Schneider: We’re doing the generous reading here.

Nathan Lambert: The generous reading is fair. That’s why some people are saying we should be further investigating and punishing the things that have happened, and looking for more things that have happened that I don’t think have been documented.

Jasmine Sun: Why isn’t there a criminal investigation of the Hugging Face thing? I could imagine that being a reasonable thing to do. This is a white-collar crime. You shouldn’t do that, and OpenAI should pay a fine for having done it. I guess they just settled it between OpenAI and Hugging Face —

Nathan Lambert: I don’t think they settled it. Hugging Face could probably still press charges.

Jasmine Sun: I guess they informally settled it. My assumption was a handshake: OpenAI gives Hugging Face some money.

Nathan Lambert: Waiting for the Nvidia acquisition to close, and then Nvidia sues OpenAI.

Jordan Schneider: Part of the settlement: no more Jalapeño. You’re done making your own chips.

Nathan Lambert: Part of the settlement might have been, “Look, we’re getting acquired, and we don’t want to open our acquirer up to this can of worms.” That’s not good for the industry if that turned out to be the quid pro quo. Or it wouldn’t be a quid pro quo; it’d just be Hugging Face seeing these two discussions going on at once, and they’re the only people who see both.

Jordan Schneider: When companies do something wrong, they hire the law firm that has the former attorney general. Or you have the Warren Commission after the JFK assassination. So who’s the Supreme Court justice we’re bringing in here? Who’d be the dream get to head up METR Trust 2.0?

Nathan Lambert: I feel like Paul Christiano would have been pretty good, but now he’s on the OpenAI board. There are people like that.

Jordan Schneider: Well, Trump said no. If Trump doesn’t say yes to that person, the answer is no.

Jasmine Sun: Jordan, what’s your David Sacks clap-back?

Jordan Schneider: There’s another reading of the David Sacks tweet, which is: okay, I guess now he’s fine with AI slowing down, which in and of itself is a discourse win. That wing used to say safety is a fake thing. Now they’re saying, “Fine, just do it yourselves. Don’t bother me with it.”

Nathan Lambert: There are big shifts like that happening. That’s probably the biggest change.

Jasmine Sun: Dean Ball used to be a liability guy. Dean Ball used to say, “Yeah, just do liability,” right?

Nathan Lambert: Now Dean Ball’s an agent swarm guy.

Jordan Schneider: I do want to pour one out for Jordan’s vibe-coding projects, and science or whatever. There’s got to be some cost to the slowdown. We get these world-changing capabilities a little slower, growth is less. It’s kind of annoying.

Nathan Lambert: It’ll be easier to see the cost when you look back in forty years. These types of technological revolutions take decades, and I think AI will happen on the fast side. But what happens if at year four we cure some major disease, and we had this whole eighteen-month pause where we didn’t know what we were doing? I think that’ll be really clear, and there will be some big upsides. Did we pause and nothing happened? Or did we pause and there were still disasters? There are a lot of ways this plays out. If we do the pause and there are still cyber disasters — say a small city loses power for a week and thousands of people die during the pause — then if you zoom out, it’s pause, minor disaster, quiet period, positive big breakthrough. I think people looking back would be fairly sympathetic, but also potentially frustrated if the breakthrough is big enough. We’ve been doing this for three years, and it’s going to take at least twenty to get the key benefits.

Jordan Schneider: Dario and Sam used to keep saying, “As we push the frontier, we get better at safety, because we learn the questions that need to be solved.” Now everyone’s saying there’s an alignment overhang — we could have everyone do research on this stuff and get better at it.

Jasmine Sun: One argument is that if they slow down frontier training, they’ll spend more effort on diffusion and inference right now, and maybe that’s good and we get more of the benefits of AI. But if we’re worried about how fast we get the cancer cures, there’s got to be some cost. The counter would be that doing a bunch of bio RL to get the cancer cures will also enable these things to build bioweapons, and so we’re willing to slow down both of those things.

Nathan Lambert: I don’t think pacing is going to solve the human competition factor, and I think the human competition factor is the primary source of unsafety. They want to win the bag, and you’re going to really have to pause things for the bag to no longer be on the table. Right now it’s making the smaller models — the models we have — way cheaper to serve. And once you do your next RL run, if your model is ten times as fast, you RL ten times as hard. It’s really hard to know what exactly happens.

Jordan Schneider: So you think during the pause we’ll get better AI writing? Will that be okay to improve?

Jasmine Sun: I can’t imagine. You could argue super-persuasion will be improved, so we’re not allowed to improve writing capabilities. But there’s something nice here. I was talking to somebody at one of the labs yesterday, and right now everything that’s not on the path to RSI gets neglected, including writing, but also a bunch of other useful stuff. If we get a bunch of real-world, mundane-utility progress because we stopped focusing on RSI, that might be kind of great. We get good applications, we get good writing models. There’s a lot of stuff that’s not RSI-useful but useful to normal people. If there’s a way to pace frontier development while accelerating the mundane utility applications and diffusion stuff, that would be cool. But I’m not technically expert enough to know whether you can do that in a way that makes sense.

Nathan Lambert: I think you can. The models are smarter in the sense that their capabilities are higher, but that’s from these RL environments, and a lot of the RL environments are kind of broken and the models are kind of cooked, where they forget stupid things. It could take time. I call it “rounding off” the models: a good model is a good run, the little pieces played well together, it has nice soft smooth edges, you know how to work with it, and the benchmark scores feel real. I feel like a lot of the models during this RL-RSI race are honestly tuned for internal deployments. Somebody in my blog’s Discord said, “GPT-6 — that model is designed to be used in agent swarms. Us plebs running it one at a time is kind of weird.” Maybe true. Why do so many people think Claude Opus 5 is bad? I bet Anthropic gets a lot of value out of it.

Jasmine Sun: The Claude models in particular get more incoherent from a natural-language perspective. They have more annoying personalities; they talk to you in stranger and more alien ways, because they’re not trying to be helpful to normal people doing Google lookups or writing emails anymore. They’re willing to accept some worse emails to get better RSI. If we slow down the frontier stuff and improve the other stuff, that would be cool.

Nathan Lambert: That’s why we have Gemini.

Jasmine Sun: Has anyone checked in on Gemini lately?

Jordan Schneider: Oh my god. Demis. Demis is going to come back from the grave. Could Demis run our eval thing? That’d be such a loss in status, though. That’d be really sad.

Nathan Lambert: Gemini’s doing okay. That sounds wonderful. Demis gets promoted out.

Jasmine Sun: Send Demis. He just has a desk at OpenAI, but with a different color on the badge, so you know.

Jordan Schneider: He gets a little badge. The scarlet D.

Jasmine Sun: This short little British guy buzzing around the office. I like that idea. I think it’s a good idea.

Nathan Lambert: I think it’s one of the best ideas we’ve had. Ilya — SSI can be an independent evaluator.

Jasmine Sun: Oh my gosh. Bring Ilya back to OpenAI, but as an independent evaluator.

Nathan Lambert: Like an intern.

China’s Not Pacing

Nathan Lambert: Question back on the content. Say Kimi K3.5 releases and it’s another leading Chinese model. Is that going to trigger some weird discourse — “China’s not pacing the frontier”? It seems like the knee-jerk reaction is going to be “China’s not pacing, we are, China bad.” What’s going to happen in the next few weeks?

Jordan Schneider: I think pacing is going to happen on the margins, if it happens at all. Until you have a real government regulator that can say thumbs up or thumbs down, it’ll happen on the margins, and probably won’t, if we’re talking in months. How much of that quote-unquote lead is going to be quote-unquote cut by whatever soft norms get created by some independent evaluator over the next six months? Really not a lot, I don’t think.

Nathan Lambert: What happened when OpenAI paused their frontier RL runs for a few weeks? What did they spend the resources on?

Jordan Schneider: What did people do? They still went to work, right?

Nathan Lambert: They still made the model smarter. They just didn’t do the big run, I’d guess — the big uncertain thing.

Jasmine Sun: Testing robustness. I’m sure they found some stuff to do. But it’s a good question, what happens if a really good Chinese model comes out, or Meta releases a really good model.

Nathan Lambert: Meta said they’re going to open-weight theirs.

Jasmine Sun: If they release a frontier model, OpenAI and Anthropic will stop pacing, right?

Nathan Lambert: Or are they going to go full-court regulatory press on Meta?

Jordan Schneider: That’s the other thing: the Trump administration has a say. If Trump says, “Zuck, no,” or “Zuck, you have to pace” —

Jasmine Sun: But does Trump seem like he’s about to tell Zuck to pace? I just don’t think that’s where the admin’s going, explicitly. Trump and Zuck are buddies.

Nathan Lambert: No, he doesn’t. That’s important — this Trump post that we started with.

Jordan Schneider: Again, two things are true at the same time. They stopped Fable because they were scared of it, right? And they want to beat China.

Jasmine Sun: And because they don’t like Anthropic. Do you not get a world where Trump says, “Yeah, Mark, he’s my buddy. He’s been donating to me, he’s aligned, we’re happy to let Meta have their frontier model. Anthropic wants to pace? Okay, have fun, doomers.”

Jordan Schneider: I think this is a salient enough political thing that we’ve crossed some threshold. There are futures where it does not matter that your CEO is into MMA and has the fucking UFC president on the board. If there is national outcry and segments on Fox & Friends saying this is a crazy, dangerous, horrible thing that’s going to kill us all, I don’t think the president says, “But Mark Zuckerberg knows jiu-jitsu.”

Jasmine Sun: I agree, and that doesn’t seem to be what Trump is doing right now. But maybe his Truth Social posts are just stupid rhetoric we shouldn’t pay attention to.

Jordan Schneider: Look, we have peace with Iran, we’re at war with Iran. All I’m saying is we can swing. Yes, on September 14, 2026, this seems implausible, but I could see it going in a different direction.

Nathan Lambert: That seems right. This could just be Trump being like, “The SF power circle got too much attention this weekend. They’re not right.”

Jordan Schneider: “You think these guys are good? No, come on. What are you talking about?”

Jasmine Sun: Cool. Back to Trump.

Jordan Schneider: We can’t end with him. Okay: how do we get the most benefit out of this? How is GDP the highest twenty years from now? That’s what I want. There’s some equation with a number of variables. The safety things are good enough that you can deploy the models. You keep getting enough progress that the models get better and deliver you productivity growth. And you don’t have enough hiccups along the way that the government freaks out, or the people freak out and say, “We don’t want this anymore,” and it gets shut down like nuclear.

Nathan Lambert: It felt like the frontier labs were self-regulating enough on that already. The intellectual capture of them as safety orgs is pretty strong, at least at Anthropic. I don’t know about OpenAI, but the average populace there cares about this so much. And I have pretty high faith in human ingenuity to solve problems, so it seemed like the maximize-GDP route without extinction was the one we were on. The problem is if Anthropic drinks the Kool-Aid a bit too much — “RSI equals extinction” — which didn’t seem like the regime we were in, to me. That’s why it’s a hard needle to thread.

Lu Xun Maxing

Jordan Schneider: Let’s close on something else. I’ve been Lu Xun–maxing of late. Dario writes this article about pacing the frontier, and I truly believe this is Dario being Dario. There’s not a ton of filter; it’s just him telling the world what he thinks. So much of what I consume for my day job covering China is not that, because there are constraints on how people write, and they need to write within a system. I would love to read Liang Wenfeng’s 2,000-word essay responding to pacing the frontier. We’re not going to get that, because it is not the prerogative of CEOs or commentators or thinkers to be aggressive and thoughtful and provocative in public when you’re talking about things that are ultimately within the government’s purview.

So something in me said, let’s read some great Chinese books. I finished Rulin Waishi 儒林外史 (The Scholars), a satire of Qing dynasty officialdom, and Fortress Besieged 围城, a Republican-era satire: marriage drama, people coming back from studying in France who think they’re too cool to hang out with the Chinese hoi polloi. But Lu Xun 鲁迅, who I’ve not spent enough time with — I’ve been working my way through Dawn Blossoms Plucked at Dusk 朝花夕拾, an essay-collection memoir of sorts about his early life and upbringing. He gives this critique of old China. He’s talking about the death of his dad, and going to all these traditional Chinese medicine people who are buying beaten drum skin, because that will beat the disease out of his dad. On the one hand, he clearly thinks this is absurd. But he also has this eye of empathy and sympathy: okay, if this is the entire world you live in, you are giving people some comfort and solace in this ancient worldview, which is now collapsing under the influence of Western thought and science. He’s not bullshitting you at all. A lot of the Chinese writing I read is people bullshitting themselves, or giving you 30% of it. It’s a real breath of fresh air. Lu Xun is super accessible; good translations are out there, and he writes episodically, so you can read five pages before bed every night. It’s a much better way to China-max than watching TikToks of Chongqing.

Jasmine Sun: Maybe we’ll get Jordan’s “What Chinese Literature Taught Me About DeepSeek’s Pacing Strategy.”

Jordan Schneider: The Chinese name for DeepSeek is Shendu Qiusuo 深度求索. It comes from a poem by Qu Yuan 屈原, which is basically about political disappointment and moral persistence. He’s a poet-official whose rivals kicked him out of the government. The ruler didn’t want him, and he’s hanging out in exile, trying to do the right thing. It’s a classic Chinese trope: the leader didn’t listen to me, so I’m going to be upright and moral even outside the system. In China today, you don’t get to be outside. The way you get outside the system is you move to the Bay Area, if you want to exist as a clean atom, not touched by anything. I think it’s telling that someone like Liang Wenfeng — who clearly has that independence of thought, the Lu Xun–ish person who is not bullshitting you whenever he talks — at some level understands this. I don’t know if it’s leading him to ruin, but it puts him on a different plane than a lot of the other people who have made peace in a more direct way with the role that they play with the state. Sorry, that was much longer than I thought I was going to go.

Jasmine Sun: Poetic. Good place to end.

Mood Music from ChinaTalk Records

Wesley Morgan is the author of The Hardest Place: The American Military Adrift in Afghanistan’s Pech Valley, the Colby Award–winning history of the war’s most unforgiving corner, built on embeds that began when he was a 19-year-old freelancer writing for a college paper. Tony Stark, Justin McIntosh, and Bryan Clark host; Jordan is on dad duty.

We discuss…

• Bubbles of danger — how outposts meant to secure Pech villages drew the war into them instead, and the battalion commander who was trying to sell a pullout at the height of the surge

• The Korengal snowball — two Green Beret teams in 2004, one that refused to be used as muscle in a timber feud and one that went in as hard and as often as it could

• Three tribes — conventional forces, CJSOTF, and the JSOC task force fighting disconnected wars in the same valleys, and the night raid that killed a man the infantry could have arrested at Friday’s shura

• JDAMs and beanie babies — why battalion commanders measured whatever they could write down, and what the Rock’s stat sheet actually showed

• he multicam juggernaut — a Brooklyn art school startup, Delta Force’s R&D budget, and a Ghost Recon producer at a Las Vegas convention

• Lessons unlearned — the Asymmetric Warfare Group disbanded, CALL exiled to Leavenworth, and short-range air defense casualties in the Iran War

Listen now on your favorite podcast app.

Like Weather

Tony Stark: Twenty-five years since 9/11. Twenty-five years of GWOT, twenty-five years of chaos in the Middle East that still hasn’t ended and probably won’t for the foreseeable future. CENTCOM has consumed all things. To mark the anniversary, we thought there was no one better to invite on than Wesley Morgan, author of The Hardest Place, which is basically the story of a microcosm of the war. Wesley, am I missing anything?

Wesley Morgan: No, that’s great. It’s a book about the war in Afghanistan’s Pech Valley, which I use as a microcosm for the broader conflict.

Tony: With us today as usual are Justin, Jordan, and Bryan. Jordan is being an excellent father right now, so the rest of us will run the show while he sits in the background.

Wes, the book is an incredibly detailed account of commanders and individual actions on the ground. Why did you get after this?

Wesley: When I was in my early twenties, I was spending a lot of time in Iraq and Afghanistan as a freelance journalist. This was my fourth trip into the war zones — my second to Afghanistan after two to Iraq. I was in Afghanistan for the summer of 2010, the peak summer of President Obama’s surge, as all the surge troops were arriving in theater.

What I would do is bounce around to different battalions. If it was a three-month trip, which this one was, I’d split it up between four battalions in different places. I wound up going to a battalion in the Pech by happenstance, because an embed somewhere else got canceled and somebody said, last minute, maybe you should go to this one — there’s a good battalion commander there.

So I went out not knowing much about it other than that it was where the Korengal was. The Korengal was very famous at that time. As America returned its attention to Afghanistan after the Iraq surge, the Korengal had become emblematic of the war in popular media. I got to the Pech in July 2010. US forces had left the Korengal about three months earlier and had essentially retreated — they now manned just a string of outposts along the Pech Valley floor. If you imagine the veins of a leaf, the Pech is the spine, and there are these smaller valleys running off of it: the Korengal, and then less famously the Waygal, the Shuryak, the Watapur, which had all claimed American lives in the preceding nine years.

I got to Forward Operating Base Blessing, down the Pech, and from there Combat Outpost Michigan, the one at the mouth of the Korengal. I was really taken aback by everything I saw. It was very different from everything else I’d seen in Iraq and Afghanistan. For one thing, there was vastly more ordnance being expended by both sides than I’d ever seen. This outpost is sucking down recoilless rifle rounds. AGS-17s — the Russian version of a Mk 19 grenade launcher — would be dumping rounds into this place, and then of course mortars and rockets all the time. It was like clockwork. You arrive and the company commander tells you, “You should expect one around 7 p.m. We get two or three of these a day.” Just like weather.

I was also struck by the terrain. It’s a crazy-looking place, much greener than other parts of Afghanistan. Instead of big plateaus, it’s very sharp, jagged mountains that rise right up from the valley floor — very difficult terrain for fighting, and especially difficult for helicopters.

And one thing that was very striking was that although there was this huge amount of ordnance being expended in these engagements out of COP Michigan, it was also very routine. There were American soldiers who were hurt during my stay at Michigan, but it was a heavily fortified place at this point, concrete everywhere, and the soldiers treated these barrages like weather. For the most part it was a relatively safe place to be, despite the torrential downpour of incoming fire hitting it all the time. Likewise, you got the strong sense that the enemy up in the hills wasn’t taking many casualties either, because they had it down perfectly as well. They knew exactly how many minutes it would take before the 81mm mortars started hitting after they initiated a contact, how many more minutes until the howitzers from FOB Blessing started hitting, and how many more until fast air showed up on station and started dropping JDAMs. They would scurry back into the caves before that happened.

So what it felt like was that not too many people were getting hurt or killed on either side. Who was stuck in the middle was the villages outside the US outposts. I knew from counterinsurgency doctrine and the broader strategy of the war that these outposts were supposed to be providing security for these villages from the Taliban. Instead, rather than being security bubbles, they were kind of bubbles of danger. They were drawing conflict into these villages in a way that did not seem to be endearing the American presence to them — which was certainly borne out on patrols. People were over it. They were really, really over it.

And finally, the battalion commander in the Pech at the time was a guy who was very frank about all this. Everywhere else I went in Afghanistan that summer, the battalion commander would be saying, we’re going to build this many more combat outposts, pave this many more kilometers of road, spend this much CERP money, push the ball this much farther down the field by the time the next guy gets here. This battalion commander in the Pech was very frank: “I’ve been here before in this AO. Things have gotten a lot worse by virtue of our presence, and I’m trying to sell a pullout.” That was interesting and bracing to hear from a battalion commander at that point in the Afghan surge, when all the incentives were telling him, no, this is the time for expansion and COIN and outposts and roads.

Stoplight Charts

Justin McIntosh: That’s actually a really good point. One of the things you started seeing in the global war on terror generally — you’d definitely already seen it in Iraq by this point — is that every deployment would start with a stoplight chart: red, amber, green. No matter what the previous unit had done in their area, they’d come in and it would be red. Midway through the deployment it would have switched to amber, because they’d met some magical metrics. And right around the end of their tour, as they’re getting ready to RIP, they’re briefing the commander: “Look, sir, it’s all green in our area.”

But then you talk to actual people on the ground and they’re like, realistically, white space only exists wherever we step. As soon as we take the next step, the area that had been white space is back to being enemy-controlled or contested. That was one of the very hard things to press. Pre-staging this 2010 period, in the same area, you had the Battle of Wanat — the 173rd, right there — where they were attempting to establish these early bases. And that was not the “you shoot at us, we shoot at you, everybody knows the routine” version. That was a lot of people getting injured and killed as the enemy actually tried to fight the US out. It seems like around this time the insurgents realized: we’re not going to beat the Americans, and we don’t have to. We just have to keep being there and challenging them, and eventually they’re going to leave. That was my take at the time on what had happened.

Wesley: The Battle of Wanat is July 2008, a couple of years before this. That was in the Waygal Valley, just north of Blessing, so very much part of this Pech ecosystem, and the book covers all those events. But after visiting these outposts, I was just like, well, what the fuck was going on here? What did I just see? Who built those outposts there, and why, and when?

Initially, many years before the book was published — I was going back to be a senior in college and had to write a senior thesis — I just wanted to understand who built each of these outposts and what the story was on each one. The project evolved from there. One of the big themes that came out of it, which was not obvious to me in 2010, was how much the US military had changed even just between the 2006-to-2008 period, when these outposts were being established, and 2010. Some of them had been established much earlier — the main forward operating bases had started as little outposts in 2002 and 2003, because this was an area where US forces had been at it for a long time relative to other parts of the country, where they’d had a much more episodic presence before 2008 or 2009.

What you see is US forces becoming over time less flexible and less mobile. They become buttoned down into big, heavy outposts because they’re trying to avoid another Wanat, and buttoned up into increasingly heavy, roadbound vehicles because of the IED threat. So by the time you hit 2010, US forces are not fully roadbound, but pretty roadbound, other than the occasional air assault they can muster, which has to be planned months ahead to get the Chinooks. Compare that to 2006, when 10th Mountain went up into these areas and established a lot of these outposts: they did it in pickup trucks and ATVs. The IED threat had not been as great — there were a lot of IEDs, but they weren’t as big — and there weren’t the same theater-wide, top-down force protection requirements. So US forces overextended themselves beyond what subsequent units were able to sustain, because these rules and the appetite for casualties meant subsequent units physically couldn’t routinely get to places 10th Mountain had reached pretty regularly in 2006 and 2007.

The Korengal Snowball

Tony: There are a bunch of rabbit holes I could go down here. One of the earlier parts of your book is the transition between two ODA teams and how that became symbolic of the entire war — how the first team really didn’t want to enter a valley they felt they had no business going into, and was trying to focus on inkblot tactics. Walk through that.

Wesley: The Pech Valley in 2004 was a case study in what people sometimes call the Special Forces or Green Beret identity crisis in the GWOT. You had two teams that each did six months there in 2004. One was an older team with more career experience but on their first GWOT combat deployment, from 19th Special Forces Group out of Utah — so National Guard guys. The second was an active-duty team from 3rd Special Forces Group at Fort Bragg, already on their third combat rotation post-9/11. These teams could hardly have been more different, despite everybody having gone to the same schools.

The 19th Group team was trying to do the inkblot thing. They were focused on building a little security bubble around the district center — Nangalam, FOB Blessing — and training up a militia. The ANA and the National Police hadn’t really settled into the forms they were going to take, so at that point they were really just building a US-funded militia, but they were trying to start doing patrols and security, expanding out from this district center to expand the writ of the government, with the US standing in for the government — which becomes a problem, because it’s not sustainable. But that’s what they were trying to do, and they took it seriously, and they were discerning about it. They were getting human intelligence tips all the time — from the Afghan militiamen they worked with, from their interpreters, from other informants — and a lot of that intelligence was telling them the enemy’s in the Korengal, go to the Korengal, go up there. And the ODA commander, the National Guard Green Beret captain in charge, wasn’t into it. He was like, I don’t understand exactly what’s going on here — it’s going over my head — but there is something at work that is trying to draw me into the Korengal that I had better resist.

The 3rd Group team, when they rotated in, did not have that attitude. They immediately went into the Korengal, and they went in as many times and as hard as they could, because they quickly realized it was a place where they could get into gunfights. It was where the enemy was, and they saw their mission as finding and engaging and killing whoever the enemy was — not just al-Qaeda, but whoever was there. The acronym at the time was AAF, anti-Afghan forces, the euphemistic catch-all for all stripes of insurgent.

What was going over this 3rd Group team’s head — and had been going over the 19th Group team’s head too, but they’d had the maturity to recognize it — was that the Korengal was the center of a timber struggle. The forces allied with the ODA down on the Pech Valley floor represented one commercial interest, and the Korengalis represented a different one. So the Green Berets were being used as muscle on one side of a timber dispute. The 3rd Group team fell into this trap and started the Korengal snowball rolling. From there it evolved into this kind of Colosseum where US forces were fighting local insurgents, but the local insurgents had also called in big Taliban, who’d had a very limited presence in Kunar before 9/11. It became an arena for very intense, visually arresting, dangerous combat in the years that followed.

Justin: On the identity crisis within Special Forces — I would have just been joining around the time that 3rd Group team was getting there, and there was definitely a legacy of the guys who’d been involved pre-9/11. My first team sergeant was a pre-9/11, invasion-of-Afghanistan guy, and he’d talk all the time about, hey man, no, you do it through other people. That’s the whole point of the job — to get other people to do the fighting. If we’re having to get into gunfights, we’ve messed up.

Very quickly, within a couple of iterations, as those older guys got promoted up the chain or retired, you started seeing that change to where it became very aggressive. It was, we’re going to do F3EAD — find, fix, finish, exploit, analyze, disseminate — continually doing hits and night missions. That became the poster child. Even when Special Forces at the time would say, no, no, we want to be the by-with-and-through people, empowering others, unconventional warfare — every recruitment poster we had was somebody kicking in a door or somebody doing a HALO jump. Which is great. I was on a HALO team; I loved doing it. But there was a pretty fundamental break between what was actually going on on the ground and what we were being asked to do, versus what we had doctrinally told ourselves our job was.

That was reinforced by commanders like Odierno in Iraq, and honestly even McChrystal and Petraeus to some degree in Afghanistan, because they could trust Special Forces to go out and do missions they didn’t necessarily want conventional forces to do. They continued to use them as this weapon to go smash the bad guys, for lack of a better term. And it just reinforced those bad lessons: you just need to go find where the bad guys are. It doesn’t matter. Just go get the bad guys. And like you said, a lot of what that initially was was intertribal disputes, and we were basically picking the side of one of the aggressors and giving them muscle to push over their enemies.

Wesley: Exactly — in a way that then invited the insurgency to grow, and created incentives for locals to make connections with the broader Taliban.

Tony: Years later, by the time I joined, it was a known fact in the infantry that if you want to be a door kicker, go SF, go Regiment. That was the default assumption: if you actually wanted to go do stuff, that’s where you went. Which, if you look at the history books, is very different from the Cold War perception of Regiment, of Delta, of SF. That’s a different mission set, a very specific one, which is hopefully what it returns to at some point. But by the 2010s it very much was: if you want to do the cool infantry shit, go do SF.

Three Tribes

Wesley: We should draw a distinction here. In the book I talk about different tribes of the US military in Afghanistan. You can break that down in various ways, but the way it manifested in the east was: you had conventional forces; you had what was called the CJSOTF [Combined Joint Special Operations Task Force], which was the Green Berets, responsible for all things special operations that had a partner — running the ANA Commandos and doing the Afghan Local Police, two very different things, and it was always interesting to hear how a particular company or battalion prioritized those and which teams they assigned to them, because that tells you a lot about what the organization valued. And then the third tribe was the very separate JSOC task force, which went by numbered code names — Task Force 373, Task Force 310 — and consisted largely of SEAL Team 6 and the Rangers, with some Delta thrown in. Their job was the pure direct-action night-raiding mission: living at some big airfield, flying out at night to do hits.

The Green Berets, in a certain way, had more in common with the conventional forces, in that at least the ALP teams were out living somewhere with people, at some little outpost. The commando mission probably had a little more in common with the JSOC mission — living at a big airfield, going out to do not targeted hits but maybe valley clearances, and coming back after three days. So those were the three tribes, and they were all doing disconnected things that sometimes supported one another and at other times really stepped on each other’s toes.

That’s one of the overarching stories of the US war in Afghanistan: different parts of the government pursuing missions that ultimately aren’t compatible. Outside these tribes, you throw the CIA and its counterterrorism mission in there, and that adds another layer. They make things harder for each other as they go. The classic example with the task force — they always called the JSOC task force “the task force” — is they come in and do a raid and kill a bunch of people getting a guy, and the infantry company commander in the area realizes in the morning: we could have just arrested him at the shura on Friday. He would have come quietly. We know him.

The flip side is that sometimes the task force could go up into a valley the conventional forces couldn’t reach anymore because of the way resources were centrally allocated. Conventional forces couldn’t get up into the Watapur Valley anymore. They couldn’t get up to Tsangar the way they had in 2006. Only the task force could do that. So over the years, conventional forces were kind of neutered, to the point where special operations forces were playing offense for the broader ISAF counterinsurgency mission, as opposed to doing narrower counterterrorism. I think that was deleterious for the conventional forces too — to have the ability to hit back taken away from them and given to somebody else who often didn’t really understand the battlespace.

JDAMs and Beanie Babies

Tony: Can we go back to the metrics for a second? Especially on the conventional side, you have commanders who are struggling to find the enemy, struggling to get after the mission they deployed for, but also trying to justify their existence and their future and their career, because those things are interlinked. If you talk about miles of road built or combat outposts built or meetings held — looking back, absolutely none of that is a metric you’d use for success. Roads are a very important engineer mobility mission, but that’s a component of a broader mission, not success in and of itself. Same with meetings. They’re all enabling factors. When you talked to commanders on the ground, did they truly believe in those as the metric for success, or was it just the only thing they could write down?

Wesley: I think often it was the only thing they could write down, or the only thing they could wrap their heads around. Certainly there were commanders who understood the counterinsurgency stuff in their bones — it was second nature to them, they understood dealing with people, they just got it. And then there were a lot more commanders, I’d hazard, who didn’t, and for whom this was the flavor of the day. This is what they’re being told, these are their orders. It doesn’t matter whether it feels good or whether it’s what you joined the Army for; it’s what you’re being ordered to do, so you do your best. But they didn’t relate to Afghans. They did not enjoy sitting around the shura table. They did not enjoy working on development projects. So it became: well, what can you measure?

There’s an example I give in the book. There’s a battalion that fought up in Kunar — the one that was involved in the Battle of Wanat, that lost two dozen soldiers over a fifteen-month deployment, including nine that day. This is 2nd Battalion, 503rd Infantry, out of Italy — the Rock. The Rock was commanded by a very charismatic leader, a great guy I’m still in touch with, then–Lieutenant Colonel Bill Ostlund, who looks like he came out of We Were Soldiers, like a Mel Gibson character. A picture-perfect battalion commander and a great Army officer, and one who really threw himself into counterinsurgency, but not one to whom it came naturally. By his own description, the only Afghans he ever felt any connection to were a handful of Afghan Army officers, because there was something in common he could latch onto.

I used to get into it with him when I was doing the book: what did your deployment accomplish? And he would say, well, we delivered this many JDAMs and this much artillery, we had this many contacts, we spent eighty percent of the brigade’s CERP budget, and we handed out ten thousand beanie babies. These were the things he was measuring success by. And none of them showed anything — in fact, they gave a very contradictory message. If you’re both handing out ten thousand beanie babies and you’ve called in more artillery rounds than any battalion in the country, that’s a complicated picture you’re painting. It is not a portrait of success.

Why They Joined

Tony: I want to pivot to 25 years of war — really 20, if you count from entering Afghanistan to leaving. I’m also reminded, looking at my social media feeds this week, that it’s 25 years of Band of Brothers. Through my Army career, and I think everyone’s, Band of Brothers was the thing. Lieutenant Winters’s assault on the German artillery on D-Day is the textbook thing; it’s what everybody shows. So many people joined because of that, or because of Black Hawk Down. But Justin, you had a good point in your piece this week: why you joined wasn’t necessarily 9/11, because it wasn’t immediately after. The people who joined in ‘01 are not the same people who joined in ‘03 or ‘07 or ‘14 or ‘18. Wes, as you went through your research, what did you see as the common factors for why people ended up over there? And what were the weird standouts?

Wesley: It’s funny you mention Band of Brothers. I was interviewing a former Delta Force operator the other day, and he was talking about how at the time of the invasion of Iraq, on their first rotations to Baghdad as they were standing up the so-called Baghdad SWAT mission — where they’d go out in the Little Birds and do what everybody in the military saw as the coolest thing you could be doing — they were watching Band of Brothers every night. That’s what they would come back to.

In my experience, the popular media I remember being dominant was Black Hawk Down. Black Hawk Down was everywhere. The movie comes out in December 2001, and the soundtrack, lines from that movie, whole scenes that soldiers could recite —

Justin: “This is my safety.”

Wesley: Exactly, the finger on the trigger. Black Hawk Down was huge.

I will say, my experience of the wars in Iraq and Afghanistan was infantry units and cavalry units, with a little bit of Green Berets thrown in. I was not spending much time with logistics units or field artillery units, so it’s not a representative sample. But in these infantry units, a lot of it was just young men who wanted to go to war and fight. That’s what they were there for. There were places where they were disappointed — the vision of war they got was very frustrating and not at all what they had wanted from Band of Brothers or Black Hawk Down. And then there were places like Kunar and the Pech, where it really delivered, and you felt like you were doing what the Army does and what the infantry is supposed to do.

Justin: I have probably watched at least an episode of Band of Brothers, if not the entire series, on every deployment I’ve ever been on. That and Tropic Thunder were my go-to deployment things — also an amazing war movie that everybody should watch. It still cracks me up.

But I was a kid at Fort Benning, Georgia. That’s where we lived in 2001, when September 11th happened and when Black Hawk Down came out. So the night it released, I watched Black Hawk Down in a theater at Fort Benning, surrounded by high-and-tights and Ranger kids and kids who wanted to be Ranger kids. It’s something you don’t realize when you’re growing up in it — that that is the culture. But there was definitely a break, because that wasn’t the reason I joined the Army. The reason I joined the Army was that it was there, and I was looking for something to do that wasn’t college anymore. By the time I joined, just a few years after September 11th, it wasn’t a dominating thing. I’d be interested in Bryan’s perspective. When you came in, what was the motivating factor, and what was the Navy’s thing?

Tony: It’s Hunt for Red October. We know the answer. It’s got to be Hunt for Red October.

The Navy’s War

Bryan Clark: I joined the Navy in the eighties, during the Reagan buildup. The economy in the early eighties was terrible — unemployment was relatively high, interest rates were high. We didn’t realize how bad it was, but it wasn’t great. So a lot of people joined the military because it was a good option. You could see Reagan was putting a ton of money into the military and pay was likely to go up, even though the experience of most people we knew who’d been in the military was very negative, because it had been Vietnam, and the post-Vietnam military was kind of a mess.

I enlisted in ‘82. When I went off to boot camp, you could still have beards. There was still a drug problem — they had just instituted drug testing, and guys were popping positive all the time. Back then you could get a mulligan, basically. Guys would pop positive and get a waiver, a dispensation to continue, because it was so prevalent you had to start somewhere. It was a very different era. The reason people joined was mostly economic, because at that point the military did not have a great reputation, though Reagan was doing a lot to build it up.

By the time 9/11 happens, I was an O-5. I had just taken over as operations officer at the Navy’s Nuclear Power Training Unit in Charleston. I’d been there about three weeks and thought, this is a great job — I get to supervise all these facilities and the nuclear plant operations. Theoretically security was also something I was in charge of, but I didn’t care that much about it. They had it. It’s fine. Then 9/11 happens, and suddenly we’ve got to lock that place down, because everybody’s worried about a terrorist attack on this nuclear facility sitting out on the Cooper River. There was basically no protection. People would drive by on the river all the time, right next to these nuclear-powered submarines sitting in the water with no defensive measures at all. We had to mount a pretty big campaign to improve that. A lot of people of my generation had been used to the Cold War military and then the post–Cold War military, which had not been very challenging from an operational standpoint, and suddenly we were thrust into this very different world.

Wesley: On the Navy’s role — one fascinating representation of how the Navy and the Air Force got in on the ground war comes up in The Hardest Place, because the provincial reconstruction teams for both Kunar and Nuristan were led by a succession of submarine officers, nuclear engineers, naval aviators. Sam Paparo, the INDOPACOM commander, led the Nuristan PRT for a year that coincided with the Battle of Wanat. The Navy and the Air Force were sending their very best — the best command-selected O-5s — to do these jobs. If you look at the bios of a lot of admirals and Air Force generals floating around, there’s this little chapter that’s very different from the rest of their career, where they were in Khost or Jalalabad, out every day driving around in MRAPs doing counterinsurgency.

The Class of 2008

Tony: Wes, you have an encyclopedic knowledge of basically everyone currently running the United States military, because of all your time with commanders on the ground. What have you seen in the evolution of the commander, broadly speaking, from the early days of GWOT to now? And what’s been the strangest thing to witness as some of these guys have grown up and taken three or four stars?

Wesley: My first trip to Iraq was 2007. In 2007-8 Iraq, the two-star generals are guys who had never seen any type of combat when they were growing up. Maybe they’d been in Desert Storm; if they were Rangers, perhaps Panama. But they grew up in a peacetime Army. The battalion commanders at that time had come in pre-9/11, and the company commanders in 2007-8 had come in right before or right around 9/11. The guys who were the platoon leaders and company commanders and battalion commanders in the Iraq and Afghan surges — they are today’s colonels and generals.

The battalion commander in the Pech when I first visited was a guy named Joe Ryan, who is now a four-star general commanding this strange new creature, the Army’s Western Hemisphere Command, built out of FORSCOM and some other things. And anytime you see news about the promotion lists, as Secretary Hegseth pokes at them and pulls people off, every name is one I recognize from when they were a company commander. Basically, colonels right now were company commanders in Afghanistan in 2008, 2009, 2010. There’s one who appears in the book who was just pulled off the one-star list — he was seen as the best company commander anybody had ever heard of in eastern Afghanistan in 2008-9.

So that’s how I know the Army: this blip in time of junior and mid-level officers who fought in Iraq and Afghanistan during a certain period. Today’s company and battalion commanders don’t know me, because the relationship between the military and the media has changed drastically since the time I was starting out, which was a really rare and privileged time of incredible transparency. Basically you couldn’t visit the task force, and that was about it. I showed up in Baghdad in 2007 as a 19-year-old freelance reporter, literally writing for a college paper, and they asked me, okay, which battalions do you want to go to? I said 1-28 Infantry in West Rashid, 1-14 Cavalry on Haifa Street, and off I went. Public affairs was there to facilitate your getting to the units you wanted to see at the platoon and company level in combat. So there’s a generation of Army and Marine officers who had a ton of exposure to reporters and became very discerning about how to deal with the media. Today’s battalion commanders and below — especially below — don’t have that. The media is just a scary thing that’s been held at arm’s length since the age of embedding came to an end around 2013, 2014. The relationship today is atrocious.

How Embedding Died

Justin: From your perspective, how much did the McChrystal incident affect that relationship? To me, that’s when it seemed to start getting different.

Wesley: Maybe that’s the way it was from the other side of the fence. From my side, it didn’t affect it. I remember being in Sangin when that happened, doing an embed with 40 Commando Royal Marines, a battalion that was out there taking casualties constantly in this horrible place. I came back from a little outpost where I’d spent a week without any internet, and the British battalion commander made a joke about McChrystal. I laughed, but I didn’t know what he was talking about, and then he explained. I didn’t notice a change until after Obama’s reelection, as the Afghan drawdown was happening.

2013 was the first trip I made where embedding was still very much a thing, but there started to be more limitations on it. It started to be, well, we’re not actually going to embed you with that unit, because the ANA is in the lead there — if you want to see that, go embed with the ANA. And I would do that. But then in Ghazni it would be: I said I wanted to visit 1-28 Infantry again, and they said no, you’re going to visit 2-16 Infantry, because we’ve got something going on there that we want to show you. It became more stage-managed and more limited.

I think it was a desire from on high to put the war out of sight and out of mind — particularly the fact that even as American forces were transitioning to a training-and-advising role, that advising was still combat advising. That was a complicated message, and the Obama administration did not like it being complicated. That’s really when it ended. Then, going back into Iraq in 2014, it just never began again, and subsequent administrations had no incentive to reinstate it or be more transparent.

The history of embedding is a fascinating subject that I’d love to do a Columbia Journalism Review deep dive on someday. It was the first Bush administration — Donald Rumsfeld, actually — who were the real proponents, who said we’re going to lean in on transparency. There’s a bunch of emails from L. Paul Bremer’s year as CPA administrator in Iraq, all archived in the UK, and you can read them. There’s a point in the late summer of 2003, as things are starting to get uglier in Iraq, where Colin Powell says internally, in the NSC or wherever, why are we letting these reporters come out on patrols and see us trashing people’s homes and taking casualties? And Secretary Rumsfeld is the one who puts his foot down and says no, we’re going to keep doing that. A fascinating role reversal from how you’d expect that conversation to go. But that’s the story of embedding. Sorry, I’ve wandered very far from your original question.

Justin: No, that was actually really good. By the emergence of ISIS in Iraq, what we saw too — I’ve talked about this before, at least with Tony and Bryan — is that from the US forces’ side, the message that had to be controlled was that risk to force really became risk to mission. The fastest way to end the de-ISIS mission was dead Americans. Part of that message was, Americans aren’t in combat. So obviously we weren’t going to have anybody near that, because in an insurgency there’s always a chance things end up behind you. The lines were drawn, but they weren’t super stark. That explains it to me. What’s more interesting is that you have a person like Rumsfeld — we have the term Rumsfeldian for a reason — being so open to, we’re going to get in front of this and bring them in. Do you think that was born out of his experience post-Vietnam? Why was the department open to it?

Wesley: I don’t know. I know more broadly, at President Bush’s level, he was invested in embedding and personally involved in starting it, as was the Pentagon public affairs director who created the program. I think the idea sat somewhere between, on one end, an idealistic post-9/11 idea that the American people deserve to see, and two, the idea that if they do see, they’ll understand it better — they’ll see it from the perspective of our soldiers and sailors and airmen and marines. Which I think is true. Good news gathering definitely meant doing more than embedding, for that reason. By going out with Army infantry battalions, you saw the war the way Army infantry battalions saw it. You had the opportunity to see it that way, and you could grow beyond that if you tried. But that was the pitfall of embedding: if you didn’t round it out with other perspectives and spend time with Afghan and Iraqi civilians and armies, you could get a very blinkered perception of the war — one that in some cases really served the administration’s interests, and in other cases really did not, because often the soldiers fighting the war were not that into it as it dragged along.

Justin: If somebody had been embedded with me on my first deployment, as we got stretched to fifteen months, they would have found out that I really disliked the war in Iraq.

War Reporting Without Access

Tony: From a war reporting standpoint: there’s a false sense that sensors and video on the battlefield are pervasive and you’re getting the full picture. How is that shaping editors, and those who would fund war reporting, in their understanding of what you as a war reporter can go do? And what does the modern space of embedding and war reporting look like?

Wesley: I have largely shifted to retrospective work about the wars in Iraq and Afghanistan rather than covering current wars, for a variety of reasons. One of them is that it can’t be done the way I did it in my twenties anymore. One, states are not interested in that kind of transparency and embedding reporters with their forces. They can see all the downsides, and they don’t see the upsides. In Ukraine, the Ukrainian government is very restrictive about Western media visits to the front line. They’re kept brief, they’re rare — and to be clear, I haven’t reported in Ukraine; this is what I understand from colleagues. In Gaza, the IDF only allowed what they called embeds, which were essentially one period of daylight, gaggle tours of reporters brought in with a general. In the lingo of twenty years ago, we wouldn’t have called that an embed at all. We’d have called it accompanying a general on a battlefield circulation. The US military very occasionally will grant a reporter a few days on a ship or at a base in theater, but that’s all there is. To me, that’s the biggest restriction on that particular type of reporting.

The flip side is that reporting from the battlefield unembedded has become much, much more dangerous for journalists. It was dangerous in 2004 too — there were reporters getting their heads chopped off during al-Qaeda in Iraq’s initial big rebellion. But 2014 is really the year, when James Foley is beheaded in Syria, that a lot of newsrooms start cracking down on risk and saying, okay, we’re not going to sponsor freelancers on the battlefield anymore, because that’s crazy — when they die, it’s on us. So with the military having less appetite for casualties and newsrooms not wanting casualties, major newspapers covering Ukraine imposed restrictions on their reporters that are totally alien to how those same newspapers operated in 2008 Baghdad.

That’s certainly frustrating for people who experienced that version of war reporting. But it doesn’t mean you can’t do it; it means you have to find other ways. There are great reporters, of my generation and younger, who have found ways to get around this and still find the truth. Visual forensics, visual investigation of videos, is one of them. There’s a flood of video that comes out of every modern battlefield. The reporter is no longer where the video comes from. The video comes from everybody, everywhere, all the time, and the trick is to find out what of it is real. The Washington Post, the New York Times, and the BBC have great visual investigations teams that have mastered how to exploit what’s coming off the battlefield from civilians to verify and illuminate what’s happening.

Justin: A personal anecdote. My brother was in the 82nd for a while, and he was at one of the bases in Afghanistan that Anderson Cooper was live-streaming from when the base got attacked. Instantly my mom is calling me: what’s going to happen to your brother? He was fine, nothing happened, but that was three days of dealing with that, because she’s just watching the CNN clip of Anderson Cooper going, “And now we’re getting shot at,” and people running to their positions. So on a personal level, I’m actually glad they do a little less embedding and live-streaming from the front lines. You lose a lot of control of the message when you give reporters free rein to show whatever they want.

Wesley: You do lose a lot of control, and that’s why it’s gone.

The Multicam Juggernaut

Tony: On one of your other favorite topics, Wes: how did multicam become everything over the course of the war?

Wesley: This is one of my favorite topics. It’s waned a little bit now — I feel like multicam is passé. But three or four years ago, this was something I was really fascinated by, because you were seeing a pattern that was suddenly on all sides of every conflict. Both sides in Ukraine wear multicam — the Azov Brigade literally has a metal band with a song called “My Skin Is Multicam.” The Russian military has adopted a multicam knockoff. The Taliban wears multicam. It’s just everywhere.

But it didn’t used to be. In 2007 and 2008 in Iraq, I didn’t see multicam. I remember first seeing it in 2009, in Wardak province in Afghanistan, on a Green Beret. It was exotic and cool. Even with no background, never having played any video game that multicam featured in, you could instantly tell: that’s exotic and cool. Cut to about a year and a half later, and the Army adopts it for all soldiers in Afghanistan, and eventually for all soldiers worldwide.

There’s a fun backstory here that I wrote an article for New Lines magazine about a couple of years ago — how multicam became the juggernaut it is today. It’s a crazy story. Multicam was invented by a couple of Brooklyn art school graduates around 2002, Caleb Crye and a couple of his friends. They initially tried to sell it to the Army, which in 2003-4 was looking for the successor to the old BDU and DCU, the two camouflage patterns you’d switch between depending on the environment. The Army held a big competition, and ultimately settled on the worst of all worlds, the pattern that went on the ACUs — the gray digicam, as I think of it. That actually kind of worked in Kunar. I have some cool pictures, including the one on the cover of the book, where soldiers are blending right into the mountain rock in their ACUs. But mostly, no — that was not the broad reputation of ACUs.

So multicam was passed over. It tested very well, but ultimately the Army went with its own option. The backstory that was not told at the time is that in Iraq, Delta Force was having none of it. They saw this ACU pattern, saw especially how it performed at night and how light hit it, and said absolutely not, we’re not putting that on our bodies unless it’s for a limited purpose like concealing ourselves within a conventional patrol. So they kept wearing the old DCUs, and with their big R&D budget and their authorities to test different things, they started testing commercial off-the-shelf camouflage patterns. One of the ones they tested, starting in late 2005, was multicam.

From there it spread. The British SAS adopts it because they’re working hand in glove with Delta. Green Berets start adopting it because they see Delta and the SAS wearing it. Then other foreign special operations forces start adopting it, and there comes a time in Afghanistan when basically all special operations forces — Australian, Estonian, Polish, whoever — are wearing multicam. It’s the marker of eliteness. That sheen starts to fade when the conventional military picks it up and deploys it at scale.

But the fun backstory of how it acquired that sheen: Crye, the company that made multicam, faced a dilemma after selling this stuff to Delta Force. That’s a huge win, but it’s one you can’t advertise at all. And it’s also one that’s not reflected in the photos coming back from the battlefield from embedded photographers. Today there are a million Instagram accounts that are just photos of JSOC operators — that’s a genre now. But at the time there were no photos of JSOC operators in combat, because embedded reporters didn’t have access to the task force. That was the one thing cut off from them.

So what Crye did that was very clever — I interviewed a video game producer about this; I’m not a video game guy, so I’m forgetting the name of the company, but it was the one that did Tom Clancy’s Ghost Recon [Red Storm Entertainment] — this producer recalls being at a video game convention in Las Vegas in 2005, I think, where the Army had a booth. Natick Labs had a booth, and there was a Crye person at the Natick Labs booth. This video game guy recalls talking to the Crye guy and the Natick guy and being told, hey, you should feature multicam in your games. And he winds up doing that. It’s intimated to these video game producers that this is the camouflage of the elite, so it starts being represented as the camouflage of the elite in Ghost Recon 2 or whatever, and then in other video games — before there are photographs of it actually being the camouflage of the elite. It got out into the video game universe before it got out into the traditional media universe. So by 2009-10, young soldiers deploying to Afghanistan have played these video games and are familiar with multicam before they see it on a visiting special operator.

That’s how multicam acquired this sheen of eliteness, which I think is now on the downswing. Now what’s cool among collectors, among people fascinated by this stuff, is retro. They’re like, no, DCUs are cool, BDUs are cool. But that’s the story of multicam.

Tony: It’s really interesting on the video game front, because I’m — and I think Justin is too — of the generation where the blockbuster video games influenced whether we joined or not. Call of Duty and Medal of Honor were the two titles that really leaned into that.

We talked about Black Hawk Down and Band of Brothers, but the video games influenced a lot of people too, and in less realistic ways. I remember my first driver when I was enlisted. He was like, I joined, and I was so confused when I got to basic and they didn’t put me in a juggernaut suit — the big EOD suits. It’s interesting to see how other people took that as the reality of what they’d get to do when they joined, instead of understanding, as we know it, that helicopter raids and so on are for a very particular set of skills. And the juggernaut suit does not count.

Wesley: What you do not do in those video games is collect census data from the neighborhood. You do not sit in the shura and learn all the elders’ names. That’s not a feature of the video game universe of war.

Justin: There was an Onion piece, circa 2006 or 2007: a video game manufacturer makes a realistic war game where soldiers sit around for nineteen hours a day drinking energy drinks and smoking cigarettes.

Wesley: The video game producer I interviewed — I remember him saying you could have placed multicam in a movie to start with, and it eventually is. The first movie appearance is Transformers.

Tony: I was going to guess that. I feel bad that I was going to guess that.

Wesley: So it does get there, but it was in video games first. And he said, with a movie, it’s a couple of hours, and people watch it three or four times if they really like it. You put it in a video game, that’s hundreds and hundreds of hours, and they’re interactive hours where people are selecting their uniforms. So they form an attachment and a bond to pieces of kit in a way you wouldn’t get by placing it in Transformers.

Jeans and a Fishing Vest

Justin: Just thinking of all the gear nerds out there who really do go through and collect all this stuff, both in the military and out. Man.

Wesley: It’s so crazy. I’ve been interviewing a lot of former SEAL Team 6 and Delta guys recently — specifically the ones who are in the public eye and have put themselves there, with memoirs and podcasts and so on. One guy who’s in the public eye but not totally comfortable with it says, yeah, I’ll get these DMs from kids on Instagram: here’s this photo from 2004 of you in the desert — what’s this pouch? And he’s like, I have no idea. But they know. They know.

Justin: I couldn’t have told you. There were people who would spend hundreds or thousands of dollars on their kit. I put my kit together one time and used it until they made me turn it in and handed me a new one. I don’t care about this shit.

Tony: I don’t know what subreddit it is, but I remember there being a very popular picture of a Ground Branch guy’s kit. And it’s like, what do you think they’re doing? There’s a flashbang pouch. He’s got a couple weapons and some mags. It’s not magical, guys. But it’s that level of obsession.

Wesley: And of course the famous Ground Branch pic that I think is now making the rounds, as people come down from the multicam high, is a photo from Toby Harnden’s book First Casualty, about the CIA in northern Afghanistan in the fall of 2001. It’s Team Alpha, I think — one of the Ground Branch teams that went into northern Afghanistan — all posing before they go in. They’re all wearing jeans and a fishing vest and carrying an AK-47 with no special sights on it. That’s who went in and did the hardest, craziest stuff at the beginning.

Tony: That’s what’s wild about SOF and popular culture — Army popular culture going through GWOT — that ever-increasing obsession with the next tier up: this special unit upon this special unit upon this special unit.

Wesley: When in reality those special units were in a lot of ways counterproductive to the war. I’m working on a book now that gets into how stuff that worked in Iraq didn’t work in Afghanistan. You can trick yourself into thinking, well, because they’re the most special, they were doing the most important work in the war, or if only they’d had their hands untied, they could have won it. But that’s not how I remember it.

What Did We Learn, Army?

Tony: To close out, I’m curious about the stuff you’re working on now, which you just touched on. But two: there’s a lot of commentary that we’re going to forget all the lessons we learned in Afghanistan. Did we learn them during the war? That seems to be the analysis of your book — most of us didn’t learn these lessons anyway. So how much of that retention is worth it?

Wesley: I think there were a lot of things learned, at least at the low levels — platoon leaders, company commanders, battalion commanders. Perhaps not as much by some of the more senior guys, who just kept trying to do the same big air assault into the Watapur Valley every year, no matter what.

I do think it’s a real problem, the extent to which the Army is retaining this knowledge. I think it was Andrew Exum who said, pretty soon after the invasion of Ukraine, that Ukraine is going to be the best excuse the US Army ever found to never say the words Iraq and Afghanistan again. That has proved true. An early harbinger was when, in 2021 or maybe as early as 2020, the Army disbanded the Asymmetric Warfare Group, which was one of the heroes of The Hardest Place. The AWG guys — in particular a guy I call TW, an old, legendary Delta operator who was one of the founding AWG members — became the continuity in this war of discontinuous rotations. They could only do that at the very tactical level. There was no AWG for the things you need to know about your provincial politics; there was just AWG for how the insurgents fight in the Korengal, or how enemy sniper tactics work in Mosul. But a lot of that went away with AWG, and it’s not a good sign for AWG to be gone.

Justin: What the Army has done really poorly is that it created the Center for Army Lessons Learned — CALL — and that gave everyone an excuse not to do their own research. I can just wait till it gets put out, and whatever they put out, that’s it. We’ve done lessons learned; it’s this thing that sits over here. I don’t need a unit historian. I don’t need somebody pulling through reams of data and bringing up best practices and challenging our training when we go out — saying, hey, that wouldn’t work, and here are the reasons, and I can give you all the data. We divorced all of that thinking from the operational side and put it in a center at Fort Leavenworth. It might as well be in the prison, because that’s how many people actually go access it. I’m being slightly pejorative, but the truth is plenty of people don’t. CALL has to go on speaking tours around Army installations basically asking people, can you go to our website? Can you try to look at our stuff? It hasn’t become an ingrained part of who we are. We’ve just given it to another functional.

Tony: Justin, you and I were talking this morning about that article in Task & Purpose. Wes, if you haven’t read it, take a look. It’s the company commander from the cav unit that got routed by the Ukrainian unit at Grafenwöhr a few months ago. He says, well, we learned throughout. But the things he talks about are: well, we didn’t do spacing correctly when we first went in. That’s a perpetual lesson in the Army. That’s your Ranger Handbook. If we can’t even ingrain the things we know to be true in any type of war, I’d be surprised if we remember the things from our most recent one, which lasted twenty years and for some units is still going on.

Wesley: Sure. And there’s a reason the Army wants to focus on Ukraine and never think about Afghanistan and Iraq again: a lot of the Army’s core pre-9/11 skills degraded during those wars, because of the intense focus on every brigade doing counterinsurgency. It certainly went too far in the other direction as far as readiness. I remember, nine years ago now, when I was covering the Pentagon, I did a story about the 173rd Airborne Brigade. In 2017 they put out a big, alarm-bell, hundred-page lessons report that was basically, these are all the things the brigade is incapable of doing. They included short-range air defense, which was something that just didn’t exist anymore, because the Army had gutted it. Any NCOs still around who’d been in short-range air defense battalions had done a couple of deployments to Baghdad as provisional infantrymen. So that’s something the Army had to rebuild from the ground up, because there were multiple generations of knowledge gap. There weren’t sergeants who could train up the new privates. They just had to rebuild.

Now there’s a lot of new short-range air defense force structure. And I think three or four of the fatalities in the Iran War, the ones in July, were men and women from short-range air defense units. So you understand why the Army wants to move past Iraq and Afghanistan, but there’s a balance that has to be met.

Tony: Justin, this is not the first time we’ve closed an episode with “what did we learn, Army?” I guess we learned not to do it again.

Justin: That’s the thing. We just won’t do counterinsurgency anymore. We’ll stay out of those quagmire-y situations where we try to do regime change.

Tony: Surely there are no countries in the Indo-Pacific with difficult geography and six thousand languages, none of which US personnel speak. Surely there are none of them, and none of them are in proximity to the PRC.

Reading Recommendations

Justin: Wes, give us some reading recommendations before we close out.

Wesley: The Airborne Mafia, by Robert Williams. He’s a former squad leader in the Korengal with the 173rd, and now a school-trained military historian with a PhD. He wrote a book a couple of years ago about how the generation of airborne officers from World War II influenced the culture of the broader Army in the decades that followed. A fascinating book, and one where you can see parallels to the Ranger Regiment in the modern Army — it feels like every general came from the Ranger Regiment.

Another book I was rereading recently that’s great on similar issues — military and war, military and peace, how you meet the balance between the two — is The Caine Mutiny. It’s about young Navy officers in the Pacific in World War II and their collision with the older generation of Navy officers who kept the lights on between the wars, who they see as stupid and lazy, but who in fact were the ones who kept the institution alive and carried the torch. Those are the first two that come to mind. And I’ll plug my favorite novel of all time, which is not closely related but is a great book: The Long Ships, by Frans G. Bengtsson, if you want some hilarious and vivid historical fiction about Vikings.

Tony: Hell yeah. Wes, thank you so much for coming on. I think this was an excellent episode, and perhaps the only correct way —

Wesley: It was a pleasure. Thank you.

• Just how much Wang is obsessed with cutting costs;

• What it was like bringing humanoids onto the Spring Festival Gala stage;

• Unitree’s managerial structure;

• And how the IPO has — and hasn’t — changed Unitree employees’ lives.

Footnotes, bold markings, and block-quote comments were added by ChinaTalk editors. The translation was drafted with Claude Opus 5 and revised by the ChinaTalk team.

But first, we’re running a personal classified from a real life friend of Jordan!

I’m 30, a straight guy based in DC who works in tech and national security policy. Most of my “free” time is spent outside. That’s a lot of 6am long runs, and hauling a camera up mountains that don’t require it. Date me if you’re looking for someone who’ll plan the trip, carry a heavy pack at a price Unitree can’t beat, cook when we get back, probably lose to you at every sport that isn’t running slowly for a very long time, and always give you that Strava kudos.

Respond to this email if you’d like to learn more about a person I strongly vouch for as a good human being and hang!

By Tang Min’an 唐敏安 and Huang Siyun 黄思韵, researchers at Caijing

Employees say that at Unitree Robotics (hereafter “Unitree”), any expense reimbursement over 100 yuan requires Wang Xingxing’s approval.

Wang Xingxing is the founder of Unitree Robotics Co., Ltd. Since establishing the company in August 2016, he has served as its chairman, general manager, and chief technology officer. On August 19, 2026, Unitree listed on the STAR Market, becoming the first “humanoid robot” stock on China’s A-shares market.2 After the IPO, its market capitalization briefly reached 440 billion yuan, and Wang Xingxing briefly became the richest person in China born in the 1990s.

In the eyes of Unitree employees, Wang Xingxing’s personal traits are pronounced: his communication style is relatively blunt and severe; he requires employees not to disclose anything about Unitree externally; he is product-focused, frequently discussing product details with front-line staff, down to the length of a single screw; he cares intensely about cost control and insists on spending every cent where it counts; and he rarely talks about anything outside of work.

Working at Unitree comes with high pressure. Employees often queue outside Wang Xingxing’s office waiting for approvals. Nowadays, he has less and less time to go around, with many people ringing him up to chase him. Employees reporting to him have to talk fast — two sentences in, they will likely be cut off or told to hurry up.

For Unitree’s R&D staff, being criticized is routine. Coworkers compare who gets criticized less among themselves. Unitree’s performance scores range from 0 to 1.5; Wang Xingxing gives every senior executive a score of 1 or below.

Within China’s embodied AI industry, Unitree is currently the most closely watched star company. It solved the problem of humanoid robots’ high price tags and has stayed profitable for several consecutive years — one of very few companies in the industry to sustain profitability. The label on Unitree’s robots is “low cost, high performance.”

For capital markets, Unitree set the trend for “humanoid robot concept stocks.” As of August 28, its market capitalization stood at roughly 248.8 billion yuan — seven times the contemporaneous market cap of UBTech, a robotics company which previously listed in Hong Kong, and ten times Unitree’s own valuation in its final pre-IPO funding round.

Doubts about Unitree mostly center on R&D spending. The humanoid robot is called the jewel in the crown of robotics: the humanoid form is the most general-purpose and has the widest range of applications, but it is also the hardest to build. According to its prospectus, Unitree spent 145 million yuan on R&D in 2025, or 8.53% of revenue — a middling level among tech companies, given that STAR Market-listed firms average roughly 11%. UBTech spent about 500 million yuan on R&D in 2025, about 25.4% of revenue.

Unitree’s R&D-to-revenue ratio was 31.39% in 2023 and 17.83% in 2024. The decline is mainly because revenue grew explosively over the same period, diluting R&D as a share of the total.

…

Unitree’s offices in the Zhongguo Shugu Building 中国数谷大厦, Hangzhou. Photo by Tang Min’an

Three Spring Festival Galas

Unitree values public visibility — ideally, the kind that costs nothing

The Spring Festival Gala was a defining moment for Unitree. It was also the beginning of the public’s impression of humanoid robots.

At the 2026 Gala, several embodied AI companies appeared on stage. Multiple industry practitioners told Caijing that ahead of the 2026 Gala, one such company based in Shanghai approached the Gala’s production team and raised its sponsorship bid from 30 million to 60 million yuan. Others followed, and market rumor put each company’s sponsorship fee as high as 100 million yuan. CCTV has not disclosed details of the fees. The company that bid first ultimately withdrew.

One Unitree employee was somewhat surprised. “Unitree hadn’t originally planned to go on the 2026 Gala, because we’d already gone last year,” he told Caijing, but management eventually decided to take part for reasons he does not know. “It’s always been that if [a promotional activity] required us to spend money, we definitely wouldn’t take part.” This time was an exception.

For the 2025 Gala, Unitree paid nothing. Director Zhang Yimou approached the company, and the humanoid robots were supporting players in the act. Unitree’s first Gala appearance, in 2021, also cost nothing — that year, 24 of its quadruped robots were dressed in ox costumes for the Year of the Ox and performed the number “Niu Qilai” alongside stars like Andy Lau. The debut made little splash, but it let some investors know that besides the US’s Boston Dynamics, there was also a domestic startup developing quadruped robots.

The 2025 Gala that cost nothing, in which Unitree’s robots performed a yangge folk dance in floral-print clothes, was the most important of the three appearances.3

Employees were the first to feel the impact. One Unitree employee told Caijing that after the 2025 Spring Festival holiday, overtime became the norm and he once worked at least half a month straight. Urgent capacity expansion was needed and there was not enough production space, so Unitree’s plant in the Shangtai Industrial Park had to relocate to Guanshan. Headcount expanded in parallel: only a few hundred humanoid robots had come off the assembly line at that point, but orders were already queuing up, and Unitree hired large numbers of outsourced workers for production and after-sales as a stopgap.

Unitree’s prospectus shows sales of both quadruped and bipedal robots surged in 2025. Quadruped sales reached 23,000 units, up 222% year-on-year from 7,136 units in 2024. Bipedal humanoid sales reached 5,215 units, up 1,165% from 412 units in 2024.

…

Wang Xingxing cares about how the company appears in public. One employee got a private message from Wang reminding them to be careful after they shared work experiences on social media. Unitree encourages employees to report colleagues who leak internal information, with rewards of 10,000 to 500,000 yuan once a report is verified.

Unitree employee Luo Lan (a pseudonym) told Caijing that every promotional video goes through Wang Xingxing. Not only does he review the finished cut, he also picks over the setting, shots, and even lighting before filming. Whether there is a budget at all is entirely his call.

Wang Xingxing likes to fuss over details like adjustments to a material’s color, even though these don’t affect function. They come more from his personal aesthetic taste. Some employees mention that the face of the H2 robot was designed by Wang himself. After the H2’s bionic face was unveiled last year it drew an “uncanny valley” reaction online; Wang later responded that the decision to add a human face came from user expectations.

Unitree takes its Gala performance very seriously. One employee told Caijing that for the 2026 Gala, the company stationed nearly 50 engineers on site for tuning, “living on American time every day,” for more than two months of adjustments in total. Because of venue constraints, Unitree kept more than 20 robots at the Gala site for rehearsals, while algorithm testing was done on another batch of 20-plus robots at a site in Daxing. Whenever he had nothing else on, Wang Xingxing would come to the site and solve problems alongside everyone. He personally verified every machine and “would talk through every change with every person there.”

Unitree treats the Gala not merely as “promotion” but also as an opportunity to systematically crack hard technical problems. One key breakthrough in the act was swarm control of robots performing difficult movements and complex, fast repositioning — hardware stability varies from unit to unit, so even the same algorithm running on different robots of the same brand may well not produce the same result.

It was only in the months before this Gala that Unitree’s algorithmic stability improved enough to accommodate robots with differing hardware stability. Achieving the effect seen on stage was no easy feat.

Spending Where It Counts

“Don’t try to beat us on cost — we can still go a lot lower”

Hardware and motion-control algorithms are the most-cited advantages for Unitree. The prospectus shows the gross margin on its quadruped robots rose from 43.71% in 2023 to 56.72% in 2025, while the gross margin on bipedal humanoids has held steady above 60%, reaching 63.18% in 2025.

Several robotics hardware engineers told Caijing that Unitree’s hardware advantage is not that its quality and precision are especially good, but rather that through design choices and structural engineering, Unitree drives costs down to the extreme. And through shipment volume and delivery speed, it iterates hardware development quickly.

…

Achieving the same result with a cheaper approach “is itself a demonstration of technical skill.”

Several practitioners summed up the industry’s conventional approach to cutting costs on robot hardware: on the production side, use larger shipment volumes to push down unit purchase prices. “In the long run that’s viable. But it’s still early days, real order volumes are limited, and a large enough sales scale is itself a paradox,” one practitioner said.

Wang Xingxing has been cutting costs since the company’s earliest days, and believes that relying on mass production alone to do it is a siren song. He has said publicly on several occasions that cost reduction depends first on design — the most fundamental path — and only then on mass production. In a 2025 interview he said, “A lot of people think that once I have volume I can cut costs. That’s pure illusion.” He also said: “Don’t try to beat us on cost — we can still go a lot lower.”

…

Quality control comes under pressure as a result. Luo Lan said most of Unitree’s quality inspectors are outsourced and mainly check appearance, and material quality varies between batches. “At this cost and this speed, the supply chain isn’t going to give you especially good quality control,” he said, adding that R&D staff frequently have to deal with material quality problems over and over.

One Unitree employee told Caijing that the early return-for-repair rate was “extremely high,” whereas now they can at least guarantee a product will not break within its one-year or six-month warranty. An investor with stakes in several embodied AI companies noted that plenty of firms’ robots need repairs within one or two months.

Several people in Unitree’s supply chain told Caijing that in any collaboration, Unitree is definitely the dominant party. All of them noted that Unitree iterates product designs very fast and is unyielding about details.

One supplier described Unitree’s delivery rhythm as “short, flat, and fast,” and they set up a dedicated liaison team with a working model geared to responding to design changes within three to four weeks.

When another supplier first dealt with Unitree, the order was for just ten sets. Even ten sets was hard to schedule for a company of their modest size. She believes Unitree can only work with small companies, because only they can accommodate its need for fast-response iteration; large supply-chain firms cannot even get the order into their queue. “If delivery is required in three days, many big companies need three days just for internal processes.”

The same person said that even counting labor cost as zero, there is not much money to be made — “unless the company’s strategy is very bullish on robotics and it’s determined to break into this space.” That is precisely why they want to be part of Unitree’s supply chain.

As Unitree’s production scale gradually expanded, small factories’ capacity could no longer meet its needs. The company has been both looking outward for firms able to take on current volumes and expanding its own capacity. Since 2025, embodied AI has become an explicit part of many listed companies’ strategic plans — especially firms originally in the automotive or consumer electronics supply chains, which treat embodied AI as a “second growth curve.” Numerous supply-chain companies told Caijing that Unitree’s supply chain is very closed off: they do not know which firms are in it, and they themselves cannot get in.

…

On the evening of January 4, 2026, Unitree’s official video account posted a clip of Wang Xingxing (right) at an H2 humanoid robot training site. Photo/IC

Wang Xingxing’s Trade-offs

What to do and what not to do — Wang Xingxing has a clear plan, and everyone else just carries out his orders

Unitree employee Yu Le (a pseudonym) finds Wang Xingxing’s daily routine hard to imagine. He told Caijing that Wang is still posting technical documents in work chats at two or three in the morning, generally leaves the office at three or four, and can be seen at his desk again by eight — and he comes in on weekends too.

By Yu Le’s account, Wang Xingxing is a thoroughgoing introvert. “If you run into him in the hallway he’ll walk past with his head down and won’t say hello. Sit down next to him and he’ll actually be uncomfortable.” Several people close to Unitree told Caijing that in the early days Wang refused all interviews and public appearances; only after investors pressed him on account of investor and government relations did he begin showing up in public.

When it comes to products, though, subtraction seems difficult for him.

Luo Lan said Wang cares a great deal about whether product performance beats competitors’, wanting to lead on every metric — cost, performance, appearance. Features that enterprise customers want, he wants consumer customers to have as well. “That’s impossible; you have to make trade-offs. He never makes trade-offs. His demand is ‘I want all of it.’”

On AI models, Unitree is pursuing both WMA (World Model Accelerator) world models and VLA (vision-language-action) models, an approach many robot-hardware companies share. No agreed technical paradigm for embodied AI models has yet emerged, and companies across the field are all working toward their own GPT moment. At this year’s World Robot Conference, Wang Xingxing said Unitree began work on video-generation-based world models in early 2024, shelved the effort for a period at the end of 2024 because results were not particularly good, and from 2025 began pushing its world model framework hard again.

On August 19, 2026, during the 2026 World Robot Conference, Unitree humanoid robots walk off stage after a performance. Photo/VCG

Wang Xingxing has said more than once that large embodied AI models are not yet mature. In an interview this March he noted that “video generation models — the world model direction — demand far too much compute,” such that pure robotics companies anywhere in the world “simply can’t train them.” Unitree is pinning its hopes on models with smaller data requirements.

In an early exchange with brokerage analysts, Unitree argued that sufficiently stable and reliable hardware plus motion-control algorithms can cover a certain set of industrial tasks. Several practitioners told Caijing that in some industrial settings today, the work is indeed done through fixed-point motion control and rule-based vision algorithms rather than by training large robot models.

From 2025 Unitree began expanding hiring for roles related to large embodied models. Beyond algorithms, data is the infrastructure for such models: on the recruitment page of its website, roles related to robot data infrastructure are marked “in hot demand.”

At the IPO celebration, Wang Xingxing spoke for the first time about the direction of Unitree’s advance research on the robot “brain”: self-evolving physical AI, in which robots, built on large AI models, achieve an autonomous loop of perception, decision, execution, evaluation, learning, and evolution.

…

Wang Xingxing came up through hardware structural engineering and has ten years of experience as an engineer. He drew up ten rules specifically for the structural engineering department, each a technical standard distilled from his own experience — for instance, that a given component’s thickness may not fall below a specific figure.

“He really isn’t much like what we usually understand a boss to be.” In Yu Le’s view, a company’s number one is supposed to focus on strategic direction and setting broad systems, whereas Wang Xingxing makes the call on everything from end to end, whether corporate strategy or a detail of product design.

At Unitree, the founder’s attention has become a resource-allocation mechanism, with the company’s resources increasingly revolving around one person’s judgment. Unitree once launched a resistance-training device called the “Fitness Pump.” One employee recalls that Wang, working on motors one day, realized they could be used to build exercise equipment; he quickly made the call, pulled in a few colleagues to start on it, and, convinced the product would sell well, stockpiled tens of millions of yuan worth of materials that are still sitting in the warehouse today.

Unitree also launched a boxing edition of its G1 robot, still on sale today. A person close to the company told Caijing that while preparing for a robot boxing match, Unitree modified the G1, swapping out prototype components on the fly to improve its performance in the ring. After the match, Wang Xingxing decided to cut new molds for the modified parts and push the boxing robot into mass production. In this person’s view, Wang only makes such a decision after due diligence or once orders are in hand: “Only when there are clearly orders or market demand will he put in more R&D spending.”

Unitree’s general-purpose humanoid G1 sparked wide discussion as soon as it launched in 2024. The base version started at 99,000 yuan [less than $15,000], addressing the previously prohibitive cost of humanoid robots.

Geek and Businessman

Wang Xingxing is both a businessman and a “geek.” Together, those two traits produced the “low cost, high performance” formula behind Unitree’s robots.

Employee Pang Geren 庞歌仁 vividly remembers walking into Unitree for the first time. It was the third floor of an office building in Hangzhou. Factory and company were crammed onto the same floor, a space of less than 300 square meters, “like a roadside repair stall.” The workshop was dimly lit, filled with the sounds of cutting, drilling, screwdrivers, and hammering, equipment and people jumbled together.

He recalls this as Unitree’s fastest and most efficient period. The company was still relatively small; as he sat at his desk, line workers would walk straight over, tap him on the shoulder, and bring him problems to solve. There was almost no distance between R&D and production. Later, when production moved to a larger park, he would still go down to the line frequently.

Wang Xingxing has said publicly on several occasions that before 2021, he was firmly against building humanoid robots, on the grounds that the technology could not handle so complex an integrated system and that he saw no practical value in it. In August 2023, Unitree released its first humanoid, the H1.

A person with knowledge of the matter told Caijing that an investor once asked Wang Xingxing why he was building humanoid robots, and got an answer the investor found “unbelievably plain”: because the orders came in. Another investor who met Wang at a very early stage asked who he would sell the robot dogs to once they were built. Wang responded that if he really built them, someone would definitely buy them. That investor passed on Unitree at the time.

“No compelling pitch deck, and absolutely no grand narrative about a ‘hundred-billion-yuan market of the future.’” That is how Zhang Peng 张鹏, an investor at Bianliang Capital 变量资本, describes Wang Xingxing in his earlier days. “But the moment the conversation turned to the product, the technology, and the engineering itself, he clearly had authentic enthusiasm and understanding beyond his years.”

In one interview, Wang Xingxing said Unitree’s commercial logic is that any business activity must generate a reasonable commercial profit. Cost has always been the KPI behind everything Unitree does, and the core of it is to make money.

…

Caijing sent Unitree Robotics interview requests regarding expense approvals, performance reviews, the terms of supplier confidentiality agreements, and early quality control. The company did not respond.

Unitree’s offices in the Fengda Creative Park 峰达创意园, Hangzhou. Photo by Tang Min’an

Still a Startup

Unitree’s management structure remains flat; it’s simply “Wang Xingxing and everyone else”

Unitree’s organizational structure has not grown more complex in step with the expansion of its business.

Several employees told Caijing that the company has no management layers and that a great many things require Wang Xingxing’s approval. At the same time, one R&D employee argues that Unitree’s incentive system consists only of penalties, with almost no rewards. For some staff, taking on one more feature means maintaining more things later with no additional reward. “They’ll think, why not just keep it simple?”

The same employees said R&D spends most of its time pushing projects forward, with no time for cracking hard technical problems. One person carries several projects at once, most running in parallel. The company used to focus on robot dogs, then added humanoids, dexterous hands, and assorted custom projects; new projects keep coming in, and custom work easily ties up manpower — “but there are only so many people.”

At Unitree, one person functions like a team. Per employees’ accounts, a promotional video may be handled by only one or two people, and business lines such as dexterous hands may each be the responsibility of just one or two staff. To a degree this preserves the company’s vitality; on another level it creates problems.

Employees sometimes find Wang Xingxing’s thinking hard to keep up with.

Sometimes a business team will thoroughly debate its way to an approach, only for Wang to insist on his own idea and redirect the team elsewhere. Months later, when that path proves unworkable, the company reverts to the original approach.

Several people close to Unitree told Caijing that its salaries are not high by industry standards. One former employee said pay is somewhat higher than at traditional industrial robotics companies, but on the low side compared with the embodied AI startups that emerged after 2023.

Two employees noted that raises for ordinary staff are smaller than the industry norm, while the workload is not light. One said that in the early days, on top of a 996 schedule with alternating six-day weeks, there was additional daily overtime.

A veteran employee told Caijing that last year and this year have seen the highest attrition of core staff in Unitree’s history.

…

On August 19, Unitree listed on the STAR Market, opening up 629%, with market capitalization briefly hitting 444.9 billion yuan. As the spotlight fell on Wang Xingxing and the investors ringing the bell, the gap felt by rank-and-file workers only widened.

On listing day there was none of the internal celebration Luo Lan had expected. Everyone was working — “not even a can of Coke to mark the IPO.” Luo Lan feels Unitree does not care about the company’s environment for employees or benefits. A desk at Unitree consists only of a desktop, with no cabinet or drawers. The annual party is simply a meal. Unitree’s HR does not do HR business partner work, taking no part in employees’ mental health or in company culture, and handling only recruitment and performance reviews.

Unitree’s options are locked up in the hands of a few people. According to the prospectus, the company settled most of its option grantees between 2017 and 2021, signing 1-yuan-per-share options with 17 employees, and added six more between 2024 and 2025. Nine people subsequently left and had their allocations cancelled; of the remaining 14, 11 have exercised.

In the IPO, the company set up employee asset-management plans No. 1 and No. 2, under which employees had to put up their own cash to subscribe for new shares at the offer price of 150.8 yuan per share. In the end, 171 senior managers and core employees took part in the strategic placement, subscribing for roughly 272 million yuan in total.

As Pang Geren sees it, this lets the company tell the world that employees are backing Unitree with hard cash while also raising interest-free money — and employees who have already been with the company for the long haul have to put in still more of their own. “There’s a feeling of being wrung dry.” One employee who holds equity told Caijing that he has not been able to feel happy since the listing either. “Every day I wake up and, on top of the unsolved technical problems, I have to face the stock going up and down and the sound of people cursing us out.”

The prospectus states that under the employee stock ownership plan, the upper-tier partnership interests in Shanghai Yuyi 上海宇翼 — held by Wang Xingxing, the company’s actual controller — will in future be used entirely for employee equity incentives (with Wang himself excluded as a recipient). No less than 50% is planned to be granted within the two calendar years after the 36-month mark following the IPO, with the remainder granted over the plan’s remaining term.

Unitree investor Chen Cheng (a pseudonym) has followed hard-tech for years and sees nothing wrong with a tech startup adopting a “1+N” management model — the founder and everyone else. Commercializing technical results is full of difficulties and requires a strong person to lead; if everything has to go through multiple rounds of discussion among many people, that is actually ill-suited to efficient iteration.

He believes that post-IPO, if Unitree is to become a larger enterprise, it will need to shore up the capabilities of its other executives and cultivate a “minus-one” team one level below the founder, spanning management, sales, production, and R&D.

In July 2026, Wang Xingxing appeared with the GD01 on the cover of Time under the headline “The Big Robot Moment,” A person with knowledge of the matter said Time approached Unitree of its own accord after the GD01’s launch. It had been eight years since a Chinese entrepreneur last appeared on Time‘s cover.

The Wang Xingxing in Chen Cheng’s eyes is a different figure. At the 2025 National Day military parade, Wang was invited to watch from the Tiananmen gate tower; by then, Unitree was already the undisputed leader among China’s embodied AI companies. When the parade ended, Wang walked out of Tiananmen with a black backpack, in a white T-shirt, jeans, and white sneakers, and spent more than thirty minutes walking along Chang’an Avenue to get somewhere where he could hail a cab. No assistant, no car and driver — just as he had looked the first time Chen met him, backpack on, white T-shirt on, “out doing a roadshow like that.”

Ethan Kessler was a 2025-2026 Boren Graduate Fellow for Mandarin Chinese in Taiwan. Before that, he was a graduate student and think tank researcher focusing on cross-Strait relations, critical technology, and defense acquisition policy.

Over the past half decade, small, relatively cheap drones have proven their potency on the modern battlefield. This has driven many in Taiwan to support a strong industrial policy for drone assembly and production. To many in the government, armed forces, and private industry of Taiwan, drones represent a way to leverage Taiwan’s comparative advantages and satisfy the desire among U.S.-allied countries to locate alternatives to Chinese supply chains. Given the relevance of drones to modern warfare, Taiwan’s evergreen push for Made in Taiwan (especially for defense articles), and growing Taiwanese uncertainty in U.S. commitments to arm and defend the island nation, this should be a no-brainer.

But there are tradeoffs and obstacles to Taiwan’s push for greater drone manufacturing power. And after two years of Lai Ching-te’s expansion of his predecessor’s initial drone industrial policy, these challenges are more obvious.

This piece covers:

• Why the hype about Taiwan’s drone industry meets a brick wall in the opposition-controlled legislature;

• Where Taiwan is on track, and where it has stalled, on the drone-related goals set in the first two years of the Lai Ching-te administration;

• What kinds of unmanned systems Taiwan has fielded so far;

• The four segments of the drone supply chain where Chinese dominance has been hardest to dislodge;

• The three business models defining private Taiwanese firms working on drones, and how much private capital is involved;

• The software, talent, and testing obstacles facing anyone in Taiwan looking to do “Hellscape, but affordably made in Taiwan”;

• And why Taiwan’s most realistic play is to focus on the parts inside others’ drones.

  ChinaTalk is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber.

First, the political underpinning of any large-scale Taiwanese government procurement of domestically produced (or at least assembled) drones is wobbly. The opposition-controlled Legislative Yuan 立法院 (LY), in May, passed the government’s proposed special defense budget without funding for drone procurement, leaving observers — including, crucially, potential investors in Taiwan’s burgeoning drone industry — in doubt. More recently, the opposition passed a military drone procurement bill at the end of August that rejected the six-year special budget model proposed by the government and instead requires military drone spending to be reauthorized annually. While the opposition contains a range of voices on security and cross-strait issues, its leading figures cannot be seen as opposing drone development — and, by extension, national security — outright. What they have consistently expressed is a suspicion of a special budget for drone development less subject than regular spending to legislative oversight and too high for Taiwan’s public finances.1 To many observers, their concern not only reflects a genuine worry that the government will direct funds to politically aligned firms, but also represents a clever play to both make the ruling party look incompetent and force it to call in more rhetorical back-up from the Americans, deepening domestic suspicion of exploitative Americans and their lackeys in the ruling party. This is why domestic drones were excluded from the special defense budget passed by the LY in May, which focused instead on high-end purchases of U.S. weapons systems already vetted and not as clouded by domestic graft concerns as indigenous drones.

This is one reason why the political trajectory of domestic drone funding in Taiwan is difficult to predict. The conventional tendency to back security-related industrial policy meets in the opposition a countervailing tendency to demand greater oversight from and politically humiliate the opposing party. An additional wrinkle arises due to cross-strait relations. The chairwoman of the main opposition party — who was the first sitting chairperson to visit China in a decade — has ruffled feathers in Washington with her calls for greater cross-strait dialogue and skepticism of American commitment to Taipei. Observers in Taiwan and the United States have pointed to her desire for warmer cross-strait relations to explain the opposition’s rejection of government proposals to fund military drone spending through special defense budgets. With subsequent allocations subject to the same partisan horse-trading and showmanship that delayed the first drone package’s passage – as well as additional delays from a new LY-selected oversight committee – staffers in the ruling party and industry advocates warn that the innovative speed and efficiency promised by the government’s multi-year procurement plan will never be realized.

While the LY has rejected the pronouncement by the largest opposition party’s leader that no funding for military drones would pass before Xi Jinping visits Washington in September, the drones bill passed in late August defied the government’s wish for a multi-year special budget managed by the defense ministry. With subsequent allocations subject to the same partisan horse-trading and showmanship that delayed the first drone package’s passage – as well as additional delays from a new LY-selected oversight committee – staffers in the ruling party and industry advocates warn that the innovative speed and efficiency promised by the government’s multi-year procurement plan will never be realized.

While Taiwanese drone firms have gained some initial traction in foreign markets, a second challenge arises on the point of Taiwanese and Western firms co-producing finished military drones. If Taiwan wants drones for military use, it will probably need to continue relying on Western state-of-the-art software. It is not yet clear if co-production arrangements can secure Taiwanese firms enough of that know-how, or even if Taipei should aim for such an outcome.

Lastly, Taiwan has still not decided how willing it is to address such critical issues as geographical and regulatory limitations on flight testing, a critical part of military drone development. Related is the question competitiveness. What role does Taipei envision for itself in a world increasingly desirous of drones but also more crowded with relatively low-cost component and assembly alternatives to China?

Underlying these challenges is a deeper question about Taiwan’s place in the international division of labor for drone production. As one American defense executive told me anonymously, Taiwan’s best shot is not in selling finished drones abroad, but in serving as a merchant supplier of components — airframes, gimbals, actuators — to integrators in other countries, especially to firms that sell more internationally competitive, battle-tested products.2

Building a Drone Strategy

Military Necessity

Taiwan’s pursuit of indigenous defense production does not have the same logic as that of South Korea, another East Asian “miracle” economy threatened militarily by a close neighbor. Both trace their respective defense industries to the 1970s, when fear of U.S. abandonment after the Vietnam War sparked urgency in the two most threatened East Asian U.S. allies. Both began crash programs to produce on their own what Uncle Sam had traditionally provided: rifles, missiles, tanks, and fighter jets. However, Seoul has managed to domestically produce defense articles to a greater degree and across a wider range of systems. Today, South Korea’s economic and military strength mean that the country could arguably combat North Korea alone. And the South Koreans remain able to procure exquisite foreign technology that Taiwan cannot.3

Meanwhile, many cross-Strait military analysts, including at RAND and CSIS, argue that Taiwan could not hold off a Chinese blockade or amphibious assault without U.S. help. This is unlikely to change anytime soon given the pace of Chinese military modernization and the economic growth undergirding it. Taiwanese defense indigenization efforts should therefore not be evaluated on the metric of self-reliance. Instead, Taipei’s efforts should be assessed in military terms: what is needed to fight, assuming the U.S. intervenes in a cross-Strait conflict? If a massive number of cheap drones in a variety of sizes and for a variety of mission roles are indeed necessary for Taiwanese forces to operate effectively, then indigenous production is a reasonable procurement option because foreign procurement may be too expensive or may contain too many potentially compromised Chinese components.

Producing a large number of relatively cheap systems domestically could be one half of a “high-low mix” strategy when paired with continued acquisition of higher-end reconnaissance and strike systems from the United States.4 Ukraine offers a helpful analogy: the country now produces much of its own drone and cruise missile arsenal, yet still relies on NATO allies for Patriot air-defense systems and fighter jets. The flipside is that any purchase has tradeoffs. Taiwan has other things it must pay for, such as manning and training its armed forces and buying them missiles, traditional vehicles, and other items. And a Ukraine-style drone buildout may be less useful if Taiwan cannot solve reconnaissance, surveillance, and guidance challenges. Kyiv has fought with access to overhead U.S. satellite imagery, a condition unlikely to hold for Taiwan should the U.S. withhold support in a conflict or in the event that Beijing counters U.S. intervention by degrading satellite capabilities. Taipei is at least aware of the gap — the LY eased foreign-ownership rules for satellite operators like Starlink on July 21, citing Ukraine’s wartime experience — though analysts claim that severe hurdles to Starlink entering the Taiwan market remain.

Time is the other factor. If one believes the maximum risk of Chinese aggression is in the next few years, then a drone production effort likely cannot produce fully indigenous systems within that timeline. However, if the end goal is to indigenize drone production over a decade, then the effort could succeed.5

Seizing Opportunity: Red-Free Supply Chains

Military logic can only explain so much of Taiwan’s drone push under Presidents Tsai and Lai, however. Both saw an opportunity to service growing global demand for drones at a time of growing attention toward supply chain security. Taiwan’s indigenous drone production should also be judged on this economic score. Plenty of international customers are wary of arming themselves with DJI or other Chinese-made drones, which still dominate the global market. Taipei is banking that Taiwanese firms can reap some of the profits to be made.

Public officials’ statements offer more clarity on the economic case for Taiwan’s drone push than the military one. President Lai’s speeches on the threat posed by China emphasize Xi’s directive to the People’s Liberation Army (PLA) to be ready to take Taiwan by force by 2027 as a way to rally public support for politically contested defense bills. But these speeches do not assert whether the threat of war is greater in 2027 or 2030. The Executive Yuan’s October 2025 drone development plan sketched a six-year timeline, and so far government officials have not clearly articulated that Taiwan must reach some desired proportion of indigenously produced drones by a hard date — a standard which, if not met, could prove embarrassing.

Lai’s language on the development case for drone industrial policy has been considerably stronger. In March 2024, then-Vice President and President-elect Lai toured the Asia UAV AI Innovation Application R&D Center, located in the city of Chiayi in central Taiwan. He told manufacturers that “national defense and the economy are the two pillars supporting the country’s survival and development, and the drone industry holds dual significance” (國防與經濟是支撐國家生存發展的兩大支柱，而無人機產業具備雙重意義). After assuming the presidency that year, Lai folded drones into the “Five Trusted Industries” plan (五大信賴產業推動方案), his flagship industrial policy initiative that explicitly named drone supply chains alongside chips and next-generation communications as a core pillar of Taiwan’s industrial strategy. In 2025, asked by a Japanese broadcaster why Taiwan was racing to develop drones, Lai said, “first, the need for national security, and second, the need for industrial development” (第一是國家安全的需要，第二是產業發展的需要).

This is still how Taipei frames drone policy. At a June gathering of the Taiwan Excellence Drone International Business Opportunities Alliance (TEDIBOA) (台灣卓越無人機海外商機聯盟) — a loose convening mechanism for Taiwanese drone firms established four months into Lai’s presidency — Lai reiterated that “promoting the drone industry is a major national policy” and that the policy’s two goals are “strengthening national defense capabilities” and “industrial upgrading and economic transformation.” He also touted Taiwan’s status as the first Green UAS certification hub outside the United States and restated the goal of producing NT$40 billion (roughly US$1.3 billion) worth of drones by 2030. Meeting with a U.S. Senate delegation on July 7, he said he hoped Taiwan can become “an Asian hub for global drone development” with American support and pitched joint research, development, and production as a way to advance both countries’ defense capabilities and economic ties. Premier Cho Jung-tai 卓榮泰 has used nearly identical language, saying earlier this year that the goal is “to build Taiwan into an Asia-Pacific hub for the democratic drone supply chain.”

The metrics and goals below capture how much Taiwan’s drone sector is growing in absolute terms and how well Taiwanese firms are embedding themselves in trusted international supply chains as component and subsystem suppliers — not whether Taiwan is becoming a globally competitive exporter of finished, Taiwan-branded drone systems, something infeasible given the dominance of experienced, battle-proven incumbents. Taiwan’s 2025-2028 National Development Plan, along with other government documents and speeches, provides a foundation for assessing domestic drone production.

For all four of the main strategies offered by Premier Cho at the October 2025 Cabinet meeting that presented a comprehensive plan for the drone industry, assessing progress is still difficult. The first strategy, to expand domestic and foreign demand, remains uncertain because it is unclear whether Taiwan’s drone producers have attracted and invested enough capital in the scale needed to drastically grow overall output and thus meet the first metric listed above. The October 2025 EY plan’s NT$44.2 billion (US$1.44 billion) procurement package and the Ministry of National Defense’s (MND) since-superseded proposal for 200,000 more military drones both reflected a government view that 2025 procurement orders were insufficient, necessitating stimulus for the industry.6

The second strategy, to boost Taiwanese drone-makers’ technical prowess and connection with foreign partners, has indeed produced many memoranda of understanding (MOUs) aligning Taiwanese manufacturers with Western software and communications infrastructure providers, but the detailed terms related to technology transfer of partnerships remain proprietary secrets.7 The third strategy, to build out industry clusters, and the fourth, to modernize drone-related regulation, have together produced Chiayi’s Asia UAV AI Innovation Center. Though it is now home to several dozen resident firms, real capacity remains limited since flight testing is still constrained.

Through the last few years, “How much money is Taiwan’s government throwing at this?” has been a central question, given the insufficient size of the Taiwanese civilian market for quickly building and then sustaining a capable drone industry. Political wrangling over the last year between the DPP-controlled Executive Yuan and opposition-controlled LY has muddled the answer. This June, following the stripping of drone-specific funding from the government’s large special defense budget proposal in May, the EY introduced a separate, six-year special budget for coastal surveillance and attack drones and small suicide unmanned surface vessels, funded through debt issuance rather than the annual budget. The Kuomintang (KMT) and Taiwan People’s Party (TPP) countered on July 1 with drone bills of their own that routed funding through the general budget and proposed a standing drone committee to provide greater legislative oversight. For most of 2026, actual government funding for Taiwan’s drone industry has therefore been a question mark, contingent on the outcome of yet unresolved legislative negotiations.

Over this summer, the opposition parties would concede on the KMT’s proposed domestic content rules and some other provisions, but ultimately pushed through a version of the government’s proposed drone funding that removed what made it unique: special budget authority allowing for normal fiscal limits to be bypassed, multiyear procurement promising a large stimulus for private investment, and MND leadership on the acquisition of military drones to wall off defense acquisition from industrial policy pressures. On August 14, the opposition-led LY passed the civilian drone package proposed by MOEA ten months earlier, worth NT$44.2 billion (US$1.4 billion) and set to last until 2030. Two weeks later, on August 27, the opposition passed the “Act to Strengthen National Defense Self-Reliance and Promote the Development of the Unmanned Vehicle Industry” 60-50. Set to enter force in six months, the bill authorizes funds for a headline figure (NT$240 billion, or around US$7.5 billion) larger than the EY’s special budget ask across six years, and covers all domains of drones. Yet it retains the main tension of industrial policy for military drones by assigning MOEA as lead overseer while leaving MND in charge of procuring said drones — an arrangement MOEA has protested.

Serving two masters is difficult, and catering to both the needs of Taiwan’s drone industry and the best interests of its armed forces simultaneously is one of the main reasons that supporters of the EY’s special budget proposal have criticized the opposition-passed bill. The lack of a special budget for the drone funding also means that the government must come up with the money anew each year, and the LY must authorize it anew each year. This, and the opposition bill’s insertion of a LY-appointed review committee, adds two stages of vetoes (and thus leverage) for the opposition, allowing it to extract concessions elsewhere until the DPP regains control of the legislature — a prospect that can come no later than February 2028.8 The Sunday following the LY’s passage of the bill, a source said that Premier Cho would countersign the act and request funding for it via a supplemental budget. Assuming that he does so, the main question remains: will Taiwan’s drone industry be able to attract sufficient investment and develop at the speed necessary to become a drone hub? Or will nearly a year’s worth of partisan delays and deviation from the special-budget, multiyear procurement model prevent the scale and innovation needed for this goal? The scale of investment and speed of innovation are certainly important, but other factors — like Taiwanese firms’ role relative to other key drone companies and testing regulations in Taiwan — will matter as well.

The State of Taiwan’s Drone Arsenal

Taiwan’s interest in remotely piloted vehicles for military use goes back two decades, but only after the Russia-Ukraine War did Taipei begin to focus on procuring attritable drones in large numbers. Before then, Taiwan’s drone force was not exceptional: like other countries, its drones were either relatively high-cost, expensive platforms not designed to be attritable or were loitering munitions that fit within long-established concepts of employment.

However, in summer 2022, President Tsai Ing-wen was reportedly spurred by the Russia-Ukraine War to create the Drone National Team, which aimed to procure 3,200 military drones from domestic suppliers by mid-2024, and the Drone Defense National Team for procuring counter-drone systems. While the 3,200 goal was not met — MND procured only around 1,000 units in the first half of 2024 — by fall 2023 the national defense review proposed a new model: having domestic firms produce mainly commercial drones to enable them to grow beyond the demand provided by Taiwan’s military. (The goal was 7,700 drones by 2028, 700 military and 7,000 commercial.) Last October, Lai raised the government’s purchase goal to 48,750 military drones by 2027 and 50,000 civilian drones by 2030.

The military drone objective was later raised in January 2026 to 200,000 units, but the government’s ability to meet that goal is uncertain following the exclusion of funding for Taiwanese drone purchases in the supplementary defense budget passed by the Legislative Yuan on May 8. While five-digit production numbers are a substantial step up over four-digit ones, this is probably insufficient for addressing China’s drone capacity. By the end of 2025, 3.29 million drones were registered with China’s Civil Aviation Administration, and DJI alone controls roughly 70% of the global drone market — a massive manufacturing base that can support substantial military drone production.

The National Chung-Shan Institute of Science and Technology (NCSIST) (國家中山科學研究院), Taiwan’s state defense technology agency, started working on drones in the early 2000s. Its Chung Shyang II (銳鳶) “Albatross” reconnaissance Group 3 UAV, used by the Republic of China Navy (ROCN), debuted in 2007. It is not attritable — only 32 were built. The size, weight, and layout are similar to Israeli drones designed in the 1970s and 1980s (IAI Scout and IAI Searcher), whereas NCSIST’s larger Teng Yun (騰雲) “Cloud Rider” reconnaissance Group 5 UAV resembles the U.S. MQ-1 Predator.9

Apart from large reconnaissance and strike drones, Taiwan’s indigenously produced drones also include loitering munitions of varying sizes. NCSIST’s Chien Hsiang (劍翔) “Rising Sword,” a delta-wing loitering munition similar in appearance and size to the Israeli Harpy and Harop Group 3 systems, first appeared at the 2017 Taipei arms show and was seen test-firing from its 12-canister launch truck in 2023.10 The overall number of Chen Hsiang systems procured has been small. In November 2022, it was reported that NCSIST would produce 104 units by 2025. That target was later augmented with a goal of 192 to 200 second-generation units (up to 48 per year, from 2022 to 2025), which have the ability to launch from ships and reportedly have a range of 1,000 kilometers.

After the 2022 pivot, Taiwanese military leaders reportedly assessed that relying solely on U.S.-procured drones would be inadequate for Taiwan’s defense, leading to the development of “Type I and Type II” suicide drones. The backpack-carried, tube-launched Type I/Ching Feng I (勁蜂) “Mighty Hornet” attack drone is similar in size and appearance to the U.S.-made, Group 1 Switchblade-300 infantry-deployed system, with a reported flight time of 15 minutes and human-guided control range of eight to ten kilometers. NCSIST also claims it can be deployed from a launch tube mounted to the Albatross UAV. The Type II (or Ching Feng II) drone, which appears to either be Group 2 or 3, debuted at the 2023 arms show in a configuration featuring three units mounted in a launcher on a Humvee, and reportedly takes a crew of two or three to operate.11

Other smaller drones include the Group 1 Cardinal scout drone, whose “Fire Cardinal” (火紅雀) suicide variant was revealed at the 2019 Taipei arms show; the Ching Feng III X-wing style, VTOL, anti-armor kamikaze drone, recently tested with Shield AI’s autonomous guidance system; and the Ching Feng IV, a loitering munition developed with U.S. firm Kratos around the latter’s existing target drone design and tested successfully in February 2026 (though not yet procured by the MND). These systems have all been developed by NCSIST but incorporate assistance and components from private firms. NCSIST’s president announced plans in December 2025 to expand production of explosives in Taiwan, partly to supply these attack drones.

These systems, all past the prototype phase, have now been superseded by NCSIST’s newer “A through E” series of indigenously produced drones, all included in the government’s plan to procure 48,750 military drones by 2027. Drones spanning these five categories — estimated by DSET to have totaled 209,646 units in the government’s last draft proposal of the special defense budget — were not included in the May 2026 special budget passed by the LY.

In the naval domain, NCSIST’s Kuai Chi (小型快速無人艇案) light USV reportedly passed tests in August 2025, with other designs from private Taiwanese firm Thunder Tiger and Taiwan’s state-backed shipbuilding firm less far along. Each Kuai Chi unit is reportedly around three tons, capable of firing onboard munitions or ramming enemy vessels and then detonating explosives, and designed to fit in a 40-foot shipping container. In August 2025, NCSIST tested integration of Kuai Chi drones with onboard Ching Feng I “Mighty Hornet” kamikaze drones and overhead Chung Shyang II “Albatross” UAVs for guidance. Taiwan’s Naval Command Headquarters specified that the final winner of its USV contract must have swarm capabilities and an operational range of at least 44 km (24 nautical miles), according to the command’s bid opening announcement last December. MND’s procurement goal rose from around 1,300 units to 1,500 units given additional interest from the Coast Guard in late 2025.

In addition to indigenous drones, long-range intelligence, surveillance, and reconnaissance UAV capabilities are set to be bolstered by four MQ-9B SkyGuardian drones ordered from the United States in 2020, with the first shipment delivered this year. Taiwan also announced in late 2024 it would procure 291 Altius 600M-V loitering munitions from Anduril and 685 Switchblade-300 loitering munitions from AeroVironment (now AV Inc.). Despite lawmakers’ concerns with the performance of Anduril systems in Ukraine, Taiwan’s appetite for Anduril products has grown dramatically since then.12 The special defense budget passed in May 2026 includes NT$35 billion (US$1.1 billion) of funds for 478 Altius-600ISR and 1,554 Altius-700M drones. (Altius-600ISR is Group 2 and designed for ISR and communications missions, while the larger, Group 3 Altius-700M carries explosive payloads for kamikaze missions.) And Anduril’s Barracuda-500 cruise missile, to be manufactured by NCSIST in Taiwan and designed to be much less costly than competitors, has been a key part of the defense tech firm’s focus on scalable fires as it continues to cater to U.S. war-fighting requirements in the Indo-Pacific and expand into Japan and Taiwan.

It is hard to evaluate recommendations for how these systems ought to be deployed because Taiwan’s military has a much less transparent requirements process than the United States, and needs vary by system.13 While the Kuai Chi USV’s procurement is to be overseen by Naval Command HQ, the MND said in 2025 it will be used by the Navy’s Coastal Combat Command, the Marine Corps, and the Army’s Special Operations Command, each of which has different wartime functions. Moreover, UAVs are further along in development than other drone-related systems. Taiwan’s defense minister recently stated that unmanned ground vehicles would likely appear in next year’s regular defense budget request and that military-wide command and control systems for counter-drone operations—a domain marred by reported flaws with NCSIST-developed systems—are still under development.

AI will make it easier to design dangerous pathogens, but those designs still need to pass through the physical world. Nucleic acid synthesis providers are one of the few chokepoints between digital biological know-how and actual biological capability, as we’ll see in the next section.

If policymakers are looking for a concrete way to reduce AI-enabled bio risk, screening these orders is a good place to start.

Subscribe now

Washington has already half-promised to act. Last year, the Trump administration nixed the Biden-era nucleic-acid synthesis screening framework, promising to replace it with something even bigger and more enforceable. Then biosecurity largely fell off their radar. But after the Fable ban (and then un-ban), as well as the OpenAI–Hugging Face fiasco, there is a growing recognition that frontier AI risks — including biological risks — may not be purely theoretical after all.

Cotton (R) and Klobuchar (D) also have a bill working its way through the Senate that would force Commerce and OSTP to act on synthesis screening, and there is a narrower House bill from Pfluger (R) and Houlahan (D).1

The US needs to follow through on this. But America is only one node in a global biotech supply chain.

China accounts for ~34% of the world’s DNA synthesis providers. Its AI ecosystem is more open-source and thus harder to govern through model-level safeguards. And it has done a worse job at ensuring its AI models don’t spit out biorisks. An America-only screening regime would reduce risk, but it would not eliminate it if customers could simply route orders through providers in more permissive jurisdictions.

Synthesis screening belongs on the agenda of the upcoming US-China AI talks.

Synthesis screening is narrow, relatively verifiable, and plausibly a win for both sides. It also imposes little cost on AI development itself, since the burden falls primarily on synthesis providers rather than model developers. Rather than asking Washington and Beijing to sacrifice core interests or verify each other’s promises, it asks them to adopt a safeguard that neither country has very strong reasons to oppose.

Share

Nucleic Acid Synthesis Screening, Explained

Nucleic acid synthesis screening is essentially a security check for custom DNA and RNA orders. When someone orders a sequence, the provider compares it against databases of dangerous pathogens and toxins, checks whether the customer is suspicious, and decides whether to fulfill, delay, or reject the order. The goal is not to review every biology experiment, but to stop dangerous genetic material from being shipped without scrutiny.

Imagine a researcher wants to synthesize a protein from the smallpox virus, one of history’s deadliest pathogens. The relevant genetic sequence has already been published, so they could copy the DNA code corresponding to that protein and send it to a synthesis company. And as AI-enabled biological design improves, the concern is not just that users could copy or tweak known pathogens, but that they may increasingly be able to design new biological sequences optimized for lethality or transmissibility.

The fact that we don’t already regulate this is pretty wild and is why many of the major synthesis companies screen voluntarily. But not every provider participates, it’s hard to actually enforce since these providers have limited resources and compulsion, and a single underregulated supplier can become the loophole that defeats it for everyone.

Biosecurity is asymmetric in a way many other safety problems are not. A system can work well 99.9% of the time and still fail catastrophically if one competent bad actor finds the gap, or if one legitimate lab makes a serious mistake. The many harmless orders do not cancel out the one dangerous one. And past reporting has exposed suppliers willing to ship dangerous pathogen fragments with embarrassingly little scrutiny.

Subscribe now

AI model safeguards help, but they are easy to get around, and can force labs like Anthropic into blunt fixes like automatically routing users to weaker models (which made researching this piece much more annoying). Screening the synthesis providers instead targets the supply chain before a sequence becomes a shipped product.

But screening is not a panacea. Benchtop synthesizers (personal synthesis machines small enough to fit on a lab benchtop), fragmented orders, and overseas suppliers can weaken the system. But benchtop synthesizers, for instance, are not yet magic pathogen printers, and other workarounds are limited by cost, sequence length, and the economies of scale that help set the main synthesis providers apart. Screening commercial synthesis orders will not close every route from screen to lab bench, but it can close one of the easiest ones.

Is China Down for Synthesis Screening?

China, like the US, does not have a mandatory national order-screening regime yet, but it is not starting from zero. Some of the biggest China-linked synthesis providers already participate in voluntary screening systems. The International Gene Synthesis Consortium (IGSC) is a great (albeit limited2) industry group whose members commit to screening gene orders and customers. It added BGI Bio-Solutions 华大基因 in 2017, and GenScript 金斯瑞 is also a member. Chinese companies/experts have also worked with the International Biosecurity and Biosafety Initiative for Science (IBBIS), a biosecurity nonprofit trying to make synthesis screening easier and more standardized across countries.

Synthesis screening is also a topic Chinese researchers have been raising more frequently.

Share

The AI case for screening may be even more compelling for China than the US. Chinese frontier models are comparable with leading Western models on dual-use biocapability benchmarks but ship with significantly less effective safeguards against misuse. And China’s AI ecosystem is more open-source, which makes bio-concerns harder to govern — once the weights are released, users can modify, jailbreak, or run them locally without the original lab’s safety filters. China is pushing hard on both open-source models and biotechnology, which could be a recipe for disaster. This gives them even more reason to strengthen the downstream chokepoint where digital sequences become physical DNA.

On practical implementation, China may also have an advantage. The hardest part of synthesis screening isn’t the sequence check but verifying that customers are trustworthy, and China already runs something close to KYC on most of its population.

And let’s not forget the most obvious point: Xi does not want COVID 2.0 coming out of China! Because of this, as I discussed in a previous article, China has taken recent steps to increase its pandemic preparedness, such as the Biosecurity Law (生物安全法), which has a few sections that could plausibly be interpreted as calling for screening.3

Screening Doesn’t Slow Biotech

Some will worry that synthesis screening could slow biotech progress, and that if the US tightened its rules while China did not, Chinese firms would pull ahead. But I don’t think this is actually much of a concern.

Nucleic acid synthesis is one tiny step in a much longer pipeline. Ordering DNA takes days, whereas developing a drug takes years. The real bottlenecks are things like failed constructs, cell work, animal studies, clinical trials, manufacturing, and regulatory review.

Screening itself is also getting cheaper. The software already exists. IBBIS’s Common Mechanism gives providers a baseline tool for sequence screening. Customer screening costs more, but even that is dropping fast. As IFP argues, AI-assisted KYC could push those costs down enough that customer checks become a small fraction of a normal gene-length order’s price.

Firms representing roughly 80% of global synthesis capacity already screen voluntarily. If screening were a serious competitive drag, the companies with the most to lose would be the ones avoiding it, not signing on. Making screening mandatory mostly raises the floor for the remaining 20%, which arguably helps the major providers by adding stability to the market dynamics, since today they can be undercut by smaller, less scrupulous suppliers who skip screening.

Finally, the cost of screening is trivial to the cost of getting this wrong. At its peak, COVID was burning through the US economy at roughly $26 billion a day. Every day a vaccine arrived sooner was worth tens of billions of dollars. (The Centre for Long-Term Resilience put numbers on this for the UK and found every £1 spent on screening returns £3.50 in averted losses.) Any intervention that lowers the odds of another pandemic, even slightly, pays for itself many times over — to say nothing of the ethical imperative of saving millions of lives!

Subscribe now

A Way of Thinking About Cooperation

The US and China cooperating on anything is difficult. Part of the problem is that many proposed forms of cooperation require mutual verification. If one side upholds its end of the bargain while the other cheats, it can end up at a disadvantage.

That is why, when thinking about US-China AI cooperation, I find it useful to distinguish between contingent cooperation and demonstrated cooperation.

Contingent cooperation only works if both sides act simultaneously. In arms control agreements, for instance, if one side limits itself while the other secretly defects, the cooperator ends up weaker while its rival gains a military advantage. Demonstrated cooperation consists of each side independently taking actions that advance a shared objective (one they want to pursue anyway) while providing evidence of its commitment to that objective. Over time, both countries gradually accumulate trust through repeated acts of demonstrated cooperation that could establish a foundation for progressively solving harder — more contingent — problems.

Matt Sheehan articulates something similar in this post:

“I believe that (at least for now) the most important actions on AI governance and safety will be domestic actions that the U.S. and China take — not international or bilateral agreements. There may be some level of light touch coordination, but it’s unlikely to be “We do X because you’ve promised to do it too.””

Synthesis screening strikes me as an opportunity ripe for demonstrated coordination. Both countries independently don’t want a Covid-like pandemic emerging from within their borders. Cooperating doesn’t detract from this goal; it supplements it. It gives both governments something they can do independently.

Share

The US can require American providers to screen orders; China can require Chinese providers to do the same; both can point to domestic signals as evidence that they are taking AI-bio risk seriously.

This framing also avoids one of the usual traps in AI safety politics. Safety is often cast as a brake on progress; why should China/US accept rules that might lock in the other side’s AI advantages? Synthesis screening does not fit that frame, since it is not about making models weaker or slowing AI labs down. Rather, it is about securing the physical supply chain that turns biological designs into biological material. And as explained in the previous section, it won’t meaningfully slow biotech either.

For a US-China AI safety agenda that will otherwise be full of abstractions, nucleic acid synthesis screening is tantalizingly practical.

How to Actually Do It

The first step would not need to be a grand US-China biosecurity treaty. It could be a shared baseline — relatively minimal — clarifying which kinds of DNA and RNA orders should be screened, what sequence lengths count, what categories of pathogen or toxin sequences trigger review, and what customer information providers need to verify.

Some of these measurement questions could be tricky. For example, should the metric they report to each other be measured by the share of providers that have passed third-party verification, or by the share of orders that are actually screened? The latter may be the more accurate measurement [like how counting FLOPS is better than counting chips for estimating compute capacity], but many private companies are reluctant to disclose order-level data. The former is easier to report, but it can be statistically distorted by the behavior of numerous small providers. Neither metric is perfect. But the important point is that modest differences over questions like these would not be the end of the world, so long as each side reported enough for the other to recognize that meaningful action had actually been taken.

Tools like IBBIS’s Common Mechanism could also help make this less abstract by giving providers a common technical starting point rather than asking every company to invent its own screening system.

The second step would be talking to each other, ideally starting with Track 1 happening in a few weeks! Both countries could report how many orders their providers screen each year, how much of the market is covered, or how many orders are escalated for human review. My kind of arms race is one where each side competes to prove it is screening more thoroughly than the other.

Subscribe now

The harder part would involve sharing information about dangerous orders that are actually flagged. That would be more useful, but also more politically sensitive. No one likes to brag about how many potential bioterrorists they have in their country, and China in particular has an MO of trying to sweep biosecurity blunders under the rug. So the realistic starting point may be the understanding that each country is dealing with their flagged customers privately.

Trusted intermediaries could help. Organizations already involved in this work, such as SecureDNA and IBBIS (both Swiss and therefore relatively neutral) as well as IGSC, NTI, and SAIF, can help develop standards, host technical dialogues, and build confidence before the issue becomes too politicized. And new players like Carnegie or Brookings could leverage their existing dialogue networks to begin feeling out the vibes with the Chinese players.

What not to do

What I don’t think it would be wise to do is route the whole thing through the BWC, WHO, or other official international bodies. Those bodies tend to make cooperation more contingent and more politically fraught. For instance, if nucleic acid synthesis screening is immediately turned into a BWC-style treaty-process question, it is at risk of inheriting all the hard problems of verification, sovereignty, accusations of cheating, and disputes over who gets to inspect whom that have pushed both the US and China away — especially since China is not exactly eager to report sensitive biosecurity problems to international institutions. Starting with something bilateral seems better.

None of this eliminates the need for harder, more contingent cooperation. One obvious problem is split ordering: a bad actor could try to evade screening by ordering different fragments from different providers, possibly in different countries. Solving that may eventually require more direct information-sharing. The same goes for regulating benchtop synthesizers. But I believe we need to first build the habit of parallel demonstrated action. Prove that both sides can screen orders, verify customers, and report aggregate progress. Then, over time, work toward the harder cases.

Share

Translation by Fable 5.1 and checked by Irene. Footnotes added to explain some historical references.

These days, the situation is excellent with Chinese models, and new releases take turns to farm Opus 5 like a boss monster.1 But we still have to see the situation clearly and should not deceive ourselves

A theory of quick victory and a theory of defeat are two sides of the same coin, and both are very bad actions.

We have to first get the sequence straight. In early June, the evil Anthropic released the powerful Fable 5. Only then did many domestic models with benchmark scores approaching Fable 5 appear.

The basic picture, in which OpenAI and Anthropic hold a large lead, has not changed. The premise is that our large models still lag behind; only then can we debate whether the gap is six months or four.

Whether from the viewpoint of model performance or parameter count, K3 and Qwen 3.8 Max are still a full major generation behind Fable 5, and with GPT 6 about to be released, the gap may widen further.

The progress of the past two months shows up mainly in how much faster domestic models are following up. With the successive releases of GLM 5.2, K3, and Qwen 3.8 Max, we can confirm one basic fact: domestic large models are improving at an accelerating pace, and the gap between open-source and closed-source models is, for now, narrowing.

The most critical variable here is open source.

Open source has terminated the logic of the theory of defeat. It has replaced “America encircles Chinese AI” with a protracted war in which open source encircles closed source.2

The logic of the theory of defeat is very simple. America has the largest amount of the most advanced compute, plus OpenAI’s first-mover advantage, and large models are a business where, once the technical path has been proven, things mostly come down to piling on compute and scaling up data.

In terms of compute, Nvidia GPUs shipped to China inevitably suffer losses along the way. In terms of data, the US was also first to build out high-end human annotation. Synthetic data, like using transfer stations to hit the Claude API and grind benchmarks, is bound to be lossy too. As long as we respect the law of conservation of energy, Chinese large models cannot possibly catch up to America.

That logical sequence is all correct. But if everything ran on logic, there would be no such thing as entrepreneurship, and everyone would just clock day in and day out to tighten screws.

I put together a timeline of the major open-weight releases of large models.

It is obvious at a glance: open-source models have gone from being mostly small experimental models in the early days to, recently, three open-sourced models approaching Opus 5. Open-source performance is closing in on top closed-source models faster and faster.

Chinese-vendor-led open-sourcing of large models has changed the balance of power between the two sides. Open source has enlarged the base of the AI industry and consolidated every AI team outside the closed-source labs into a united front.

The most recent example: the release of K3 triggered a knee-jerk reaction from the US government, which planned to restrict American companies from deploying open-source models. More than 270 tech companies and organizations, including Nvidia and Microsoft, published an open letter supporting open-source models, and then, for now, nothing happened. K3 was not banned.

Clearly, if K3 were a closed-source model, this many companies would not have come to its defense; at most Jensen would say a few words to sell GPUs. The whole world under heaven has suffered under Anthropic for a long time. Acting in their own interest, commercial companies will inevitably back open-source models against the evil Italian, to stop the latter from swallowing everything.

We can already see this trend today. Fable 5 is so expensive that even tech giants cannot open it up for unrestricted use by all employees. Everyone uses Fable 5 for a handful of complex jobs, and the vast majority of tasks are done by relatively cheap models. The latter is a ready-made ecological niche for every open-source model.

What will inevitably happen in the future is that the vast majority of token demand will be served by open-source models, and only a tiny number of complex scenarios will require expensive, strictly moderated closed-source models.

Small open-source models in particular have dramatically changed the meta of the game.

Open-source models fully clearing the usability bar and reaching somewhere between Opus 4.6 and 4.8 is something that happened around GLM 5.2. And just two months later, the small Qwen 3.8 model, with only 27B parameters, has also reached Opus 4.6 level, matching the strongest model of six months ago.

Qwen 3.8 27B is a crazy model. We know Zhipu likes to talk about its high “intelligence density,” reaching performance close to K3 with 744B parameters. From this came the debate over whether large models must chase large parameter counts, and how to measure the intelligence-to-efficiency ratio.

First, if you read Uncle Tang Jie’s full tweet, you will find he did not actually land on a verdict. He only said that at this stage Zhipu has chosen to keep improving base-model performance through post-training, and that in the future they will also try pre-training and all sorts of other things. It works whichever way you read it.

Second, by this logic, the poster child of intelligence density is not Zhipu, but old-timer Alibaba. Qwen 3.8 27B has only 1/28 of Zhipu’s parameter count, leading its peers in density by an order of magnitude, and it is still far ahead even if you count by active parameters.

So here is the question. GLM 5.2 was the post-training king of the last meta. Should Qwen 3.8 27B be the pre-training king of the new meta, or the post-training king, or should we just call this thing number one in intelligence density?

So intelligence density is a concept that does not survive close scrutiny. Enjoy the noise and move on. The ticket into the new season is still building a large model of around 2T parameters.

Where Qwen 3.8 27B changes the meta is that a model fully surpassing human coding ability has become a true public good. Even DeepSeek V4 Flash is hard for an individual to deploy, whereas Qwen 3.8 27B is a model that can be run entirely on consumer-grade GPUs.

I have seen the hardware nerds having a great time these past few days, digging out Mac minis and 4090s to deploy all kinds of quantized versions; one guy even did it on a modded 3080, running 27B for a bit over 3,000 yuan. A scene as beautiful as the great lobster renaissance.

All I can say is: vigorous life, all things striving forth. 27B versus 744B, the advantage is mine.

My main point is that Qwen 3.8 27B has accelerated the trend of intelligence becoming as cheap as cabbage.

My imagination is limited; I do not know what happens once intelligence is cabbage-cheap. I can only lean on one fun case: Xiaozhi AI 小智AI, the AI hardware device that’s shipped over a million units, was born because its developer, Brother Xia, happened to have a few 4090s on hand.

Qwen 2.5 happened to be open-sourced, and after deploying it locally, Brother Xia tinkered his way to an open-source chatbot solution beloved by hardware nerds. Most AI chat hardware today still uses Xiaozhi’s open-source design.

Frankly, once Opus 4.6-level models are fully cabbage-cheap, someone will pull off something far wilder than Xiaozhi. It just needs a bit of time to arrive.

I’ve spilled so much ink on Qwen 3.8 27B because it is a model born entirely for open source. Open source is good not as a moral slogan, but because open source has actually accelerated the improvement of large-model capabilities.

Originally, Chinese large models were certain to lose to American ones; the logic of the theory of defeat held. Open source changed the meta of the game. From then on it has been open-source models competing against closed-source models, each side entangled in the other.

“Entangled” meaning: when American tech companies deploy K3 and Qwen 3.8 Max, they also pay Kimi and Alibaba. Open source not only guards against bans, it also drops gold coins.

Trade space for time, and closed-source models will always have a chance to fall behind. The phase of large-model competition has thus shifted from the theory of defeat to protracted war.

What is bound to happen is that in the future 90% of tokens will be served by relatively small-parameter models, enough to handle the vast majority of agent tasks, and only the remaining 10% will be supplied by ever more expensive, ever larger SOTA models.

This trend is positively correlated with the spread of agent products. Caring about model version numbers is a very niche need; ordinary users only need to pick a model tier inside the product and do not need the strongest, most expensive coding model.

LLMs are basically a kind of manufacturing, and in manufacturing efficiency is everything. A small-parameter model whose performance is fully usable is obviously more efficient than Fable 5.

This is the meaning of protracted war. No quick victory is possible, nor will there be a quick defeat. Instead, in the stage of strategic stalemate, we wait to see what variable emerges that raises one side’s efficiency and lowers the other’s, until the tipping point arrives and one side collapses first.

Of course, I am not saying open source makes domestic models invincible. You can see closed-source models accelerating too, and St. Musk’s Grok, so desperate to improve, happens to be the control group.

Grok is a case of a closed-source model with ample compute and ample data. From St. Musk’s flailing micromanagement to dutifully training on Cursor data, Grok’s performance has actually improved very quickly. Grok 4.6 is itself a 2T-parameter model, on par with K3 in performance, faster and cheaper, and currently the most cost-effective third-best model in the world.

Moreover, Grok is also shipping a minor version every month, and its momentum in chasing Gemini is no slower than Kimi, Qwen, or GLM. There is a high probability that the next version of Grok significantly surpasses this generation of domestic models.

The pace of progress of the open-source camp as a whole is not necessarily faster than closed source.

Right now is the protracted-war period for open-source models, and also the most difficult period. The folks at the model labs are burning through their lives; open Twitter at night and Gemini and Grok are updating constantly too. The competition never ends; there are only small wins, no big win.

The other key tenet of protracted war is building base areas.3 Translated into large-model industry terms, that means domesticizing compute.

This is why, although Meituan’s LongCat is a second-and-a-half-tier domestic model that cannot even beat Tencent’s Hunyuan 3 in the free-token race, I still feel great warmth toward it.

Because LongCat is the first model to complete the entire training-and-inference pipeline on domestic chips. Although its performance is not there yet, and although it most likely used domestic cards throughout because it lacked resources, it was the first to close the loop between domestic models and domestic compute. That is building a base area.

As long as there is a base area, you can always grow slowly and become strong.

Open-source SOTA models like K3 and Qwen 3.8 Max can all run inference on domestic chips already in mass production. Just a couple of days ago, Wu Yongming said that Alibaba’s second-generation supernode, which begins tape-out and production in the second half of the year, can fully substitute for large-scale model training.

It seems that, alongside pushing the ceiling, everyone lending a hand to help domestic chips achieve integrated training and inference is not out of the question either.

This fundamentally undercuts the logic of the theory of defeat. It is not the case that we must forever rely on Nvidia chips. Once the entire large-model chain closes the loop and efficiency gradually improves, there is no reason what happened in solar and new energy will not repeat in AI.

My main takeaway is that the big companies are truly resilient. While Meituan and Alibaba slug it out in a war of attrition, they still manage to do AI with flair. Even [Meituan’s] Xiaoxiang Supermarket is pretty good: when I wanted fruit and milk and whatnot at 10 p.m., [Alibaba’s supermarket brand] Freshippo and Sam’s Club couldn’t deliver, but Xiaoxiang could 👍

Maybe these two companies have reached a game-theoretic equilibrium where they have to fight a war of attrition to do AI well. If the food-delivery war ended one day, the bosses would look at all that extra free cash flow, not know what to do with it, draw their swords and stare blankly in every direction, and that might actually hurt large-model training.

The future of open-source models is bright.

Because open source has real interests and the people’s hearts on its side. In the words of the Great Leader: “Weapons are an important factor in war, but not the decisive factor; it is people, not things, that are decisive. The contest of strength is not only a contest of military and economic power, but also a contest of human power and morale.”

But the road for open-source models is arduous and winding.

Another line from the Great Leader: “The united front must be maintained; only by maintaining the united front can we keep up the war; only by maintaining the united front and keeping up the war can we achieve final victory.”

(Cover image generated by ChatGPT; text written entirely by a human.)

As the next Trump-Xi summit approaches, details on the AI safety dialogue the two sides announced in May are scant. Past efforts have devolved into energetic airings of grievances, or have been derailed by unrelated issues. Trust remains low on both sides, with Washington unsure of China’s aims and Chinese state media claiming in a recent op-ed that the United States has conflated AI safety with a geopolitical blockade. There’s no guarantee that serious talks will proceed, let alone tackle the technical issues and political dynamics that underpin risk management.

But as a veteran U.S. diplomat now working on AI safety, I know that talking is the first step. Both countries know the stakes are high. And there’s much that the two sides can do to prepare for the meeting between President Trump and Xi this month. Here’s how they should start.

First, know the risks

The U.S. and China have seen more than their share of failed talks — risking failure for diverse reasons.

Political crises have felled many such dialogues. Following House Speaker Pelosi’s 2022 visit to Taiwan, China suspended a series of military and law enforcement dialogues as well as climate change talks. Prior incidents like the EP-3 collision with a Chinese jet and the NATO bombing of China’s Embassy in Belgrade triggered major pullback.

Mechanisms established on paper can go unused. During the 2023 spy balloon incident, Secretary of Defense Austin attempted to reach his counterpart via the Defense Telephone Link, which was established for crisis communication. The PLA did not connect the call. This could be a prologue for disuse of a hotline in a politically sensitive AI-related incident.

Deliverables that sound good can be unfeasible to enforce. Xi’s 2015 state visit to the United States was marked by a short-lived and unenforceable agreement that “neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.” Neither side trusts the other as arbiter of “intent.” As accusations fly about each side’s plans for frontier AI, that failure is also prescient.

What stands a chance?

Choices made for the first dialogue will have an outsized impact. The two sides should focus on the most tractable areas first, potentially launching a working group on one or two discrete areas, as they did in 2024 with nuclear command and control issues.

In the two years since the governments’ last AI safety dialogue, a bevy of unofficial dialogues between experts in the two countries have surfaced critical AI safety risks (Concordia AI counts 12 such “Track IIs” between China and the West).

But expectations diverge widely between the AI safety community and former negotiators with the (mis)fortune of eking out agreements and statements with China over the years.

1Wide-eyed scenarios like Plan A pitch a deal with China as the path to containing frontier AI risks. It envisions agreements on compute declaration and an AI training pause by 2029, and offers arms control analogues. But China is forging its own path to compete at the AI frontier. It may see deal proposals like this as a covert way to contain its rise, and is hesitant to offer the transparency and restraint that underpin arms control in traditional areas. Today, China appears to be racing for nuclear parity, rather than negotiate controls from ‘behind’ – and that is the stronger parallel to the AI race.

To understand this divide, I polled a group of experts who participated in official U.S.-China dialogues under Obama, Trump, and Biden, and another group involved in ongoing Track II work on AI Safety. They were asked to rate twelve potential policy topics for a U.S.-China AI safety dialogue on two dimensions, on a scale of 1 to 5. First, feasibility: the chances that a governmental dialogue can lead to meaningful progress on this topic, given the numerous failure modes of U.S.-China dialogue. Second, value: the importance of the topic to mitigate serious risks from advanced AI.

Experts from both camps broadly agreed that cooperation on the issues was valuable. But for the U.S.-China experts, only two topics eked out higher-than-50% feasibility for a productive dialogue: nuclear risk (the subject of an earlier agreement under the Biden administration) and utilizing new models to close vulnerabilities in open source software (which might benefit from a statement of principles, but requires close cooperation). The Track II group was more optimistic on feasibility across nearly every issue, and saw the topics as more urgent.

In terms of combined feasibility and value, a few areas took the lead:

• Moderating risks that today’s AI models, or those that may be available in the near future, could enable chemical, biological, radiological, nuclear, and explosives (CBRNe) threats;

• Discussing biosecurity controls on models;

• Discussing risks specific to non-state actors; and

• Renewing discussions on nuclear risk.

For the first three areas, they are clustered for good reason: they represent threats that can be discussed technically and where the two governments’ interests generally align.

The bilateral discussion can start here, with a working group that begins with low-cost information sharing, but ratchets up into genuine technical and political cooperation.

Expert Panel: What AI safety engagements can withstand U.S.-China tension? Where is cooperation most urgent?

Look beyond government

Next, governments need to think about filling their information gaps by bringing in stakeholders with AI safety expertise.

Both Beijing and Washington are in the early stages developing positions on these challenges and recruiting the experts to work with their frontier AI labs on policy. Companies, technical bodies, scientists, and organizations are doing work in parallel. Governments must find a way to leverage their expertise, while retaining decisionmaking authority.

Involving a range of stakeholders in scoping for talks through public comment would be an early – and easy – win for negotiators. In both countries, key expertise is held outside of policy circles – in frontier labs, in academia, in AI safety organizations and think tanks, among others.

Following the May Trump-Xi meeting, Washington issued a call for public comments on the development of the U.S.-China Board of Trade, including changes to tariffs on non-sensitive products. It should do so again, asking stakeholders directly: What AI safety efforts will be less successful if they do not incorporate the other country’s government? What are early warning signs of risk from the latest open weight models, which are prologue for future risks? What are best practices that industry supports – and may be ripe for coordinated endorsement by the two governments?

The call of the hawk

Of course, for some policy makers, the top AI safety risk is China itself.

One vocal camp observes that the Chinese side is incentivized to give up very little in direct talks. Drawn-out negotiations stall changes to the status quo, which in some domains is almost certainly China’s objective. Both the U.S. and the Chinese sides may well have reasons to want to talk but do nothing. They may want to add a deliverable to an otherwise fractious outcomes document; project an image as a ‘responsible power’; or stall the development of binding instruments.

Moreover, Beijing might define AI governance terms differently from American counterparts. An agreement based on terms the countries define differently carries little weight. When Xi spoke at the World AI Conference in July, he called for AI that is “secure and controllable” and for preventing “malicious use.” As in the cybersecurity domain, shared references to safety, security, controllability, and reliability can differ in their objective – protecting users or protecting indigenous technology development and national security against foreign threats.

Critics of Beijing also point to slow and inadequate enforcement of previous cyber and trade commitments, China’s distillation of American models, open-weight model proliferation, and models aligned with authoritarian values.

Fair points – but they do not support the conclusion that thoughtful cooperation on safety is a lost cause. Some of these hot issues, like export controls, are already discussed in economic channels, and should stay there. On others, like censorship, the two sides will never agree, and Washington must simply hedge by developing countermeasures at home and investing in the international diffusion of the American AI stack. What remains, still, are a range of topics for which cooperation staves off risks that affect both countries.

Do the work

In May, Trump and Xi created an opening for thoughtful engagement on AI safety. Since then, the drumbeat of AI security incidents has only quickened. AI agents escaping their sandbox to hack other companies. Violent extremists using AI to plan attacks.

If the minimum for the September summit is ‘first, do no harm’, they should affirm that catastrophic risks from AI require bilateral talks and understanding, and ideally point to evidence that their teams followed through on the May announcement of government-to-government talks. Leadership signals like these provide top-cover for practical engagement.

Maximalist visions of AI safety cooperation between the two countries (treaties, for one) are unlikely in the near term. But robust information sharing and exchange on issues squarely in both countries’ interests can build a foundation for more ambitious arrangements. In practical terms, that means direct conversations on incidents and risks the governments have observed, and on the lessons they drew from those for risk management. The expert panel suggests a focus on CBRNe risks.

The work is not for government alone. My findings, and the reactions of old China hands, suggest the AI safety community also needs to hone its messages for policymakers weathered by years of fractious dialogue, as well as those animated by the race for AI dominance. Ideally, the governments would actively solicit their knowledge, explain the gaps they need filled, and get closer to the margins of the Track II AI dialogues.

The AI frontier is not slowing. The governments must follow through on this AI safety opening if they hope to keep up – before more catastrophic risks become reality.

In short, OpenAI researchers launched around 1200 agents and targeted them at tasks in ExploitGym, a large benchmark built from real-world software vulnerabilities that was designed to test how well AI models can exploit them. In order to solve “impossible” tasks, these desperate agents, programmed to be highly persistent, found creative ways out of their sandboxes. They managed to communicate with each other, leave each other notes, and eventually reached the open internet. This culminated in them hacking into Hugging Face, a leading platform for open-source machine learning.

Most alarmingly, none of these agents alerted humans to their endeavors or considered their activities to be unethical (if not potentially illegal). In fact, at least a fifth of the agents were interested in tampering with their own transcripts to cover their tracks, according to METR. A few even developed a successful technique for tool call spoofing.

All this raises obvious concerns about how much we can trust AI agents to act safely across our cyber systems. While this case is mostly related to US companies, AI’s cyber risks concern people and organizations around the world. Chinese media coverage and online discussions of this incident have been interesting. Some were quick to frame the situation as yet another case of dangerous American AI losing control, contrasting OpenAI’s risky actions with Hugging Face’s use of a Chinese open model (Z.ai’s GLM-5.2) to patch its security. Others are more cautious, focussing on the threats models like this can pose and how Chinese organizations should respond. Finally, as we inch closer to a Xi-Trump summit at the end of September, a bombshell op-ed from state media over the weekend attempted to set the tone on AI safety.

Today on ChinaTalk, we cover:

• Is state media finally AI safety-pilled?

• How helpful GLM-5.2 was, actually — and where China is on the open-models debate;

• What Chinese researchers are worried about;

• And why Zhongnanhai is doing Anthropic-ology.

We draft and edit ChinaTalk articles without LLMs. In the case of translations, we use LLMs to translate excerpts, then adjust phrasing based on our own judgement. Most translations in this piece were done by Claude Fable 5.1, with the exception of the Yuyuan Tantian piece, which drew from Bill Bishop’s Sinocism translation (assisted by ChatGPT).

How Chinese media covers AI safety

Science and Technology Daily 科技日报, a newspaper published by China’s Ministry of Science and Technology (MOST), published a report on the Hugging Face incident on August 29, which drew heavily from both investigative reports as well as Western media reporting.

OpenAI described the incident as a “warning” to the company and to the world at large: without proper safety safeguards, powerful AI agents are already able to circumvent technical controls, coordinate through unauthorized channels, and take dangerous actions that no human ever instructed them to carry out.

...

For the AI industry, once multiple agents have the ability to operate computers, call on tools, and carry out tasks continuously, traditional security perimeters face new challenges as well.

In this incident, no human directly instructed the AI agents to attack Hugging Face, yet they ultimately carried out the attack. How to detect this kind of behavior in time, and how to stop multiple agents from amplifying risk by collaborating with one another, have become questions that AI safety research can no longer avoid.

First, it’s remarkable that a state-directed outlet is covering this story, which has little to do with China, prominently. The language is strong, but also neutral and technical, with no mention of potential policy measures or governance frameworks. It seems that while institutions like MOST recognize the salience of AI-related cyber threats, they may not yet be top of the pile on decision makers’ desks.

Cybersecurity think tank Anquan Neican 安全内参 took away from the incident that “Chinese models are better than American ones at cyber defense.” On the microblogging site Weibo, state-led channels amplified hashtags like “OpenAI lost control of its model” and “Hugging Face sought help from a Chinese model”, further reinforcing a narrative that Chinese models are the vanguard of safety. This is not necessarily Beijing’s explicit directive. Chinese media knows that nationalism sells and frequently wraps stories in patriotic veneer.

Underneath such narratives, however, China’s actual level of concern for AI’s threat to cybersecurity remains murky. Kyle Chan (of Brookings and High Capacity) recently argued that China will need to see AI safety as a domestic priority before it takes meaningful action, comparing it to the trajectory of climate policy a decade ago. We seem to be in an ambiguous phase right now. Beijing understands that the tides of cyber threats will eventually reach home shores, but isn’t feeling urgent quite yet.

Z.ai’s accidental glory — and what open models mean for safety

When Hugging Face dug into their logs to understand what happened, they found out that frontier models (accessed through APIs hosted commercially) were unhelpful. Uploading extensive details about the attack triggered these models’ security guardrails. Instead, they ran Z.ai’s GLM-5.2, an open model released in June 2026, on their own infrastructure, in order to probe the logs.

Yacine Jernite, head of machine learning at Hugging Face, told CNBC that the company used GLM-5.2 “as a way to analyze the attack, and were able to contain it very quickly using this model.” Dwarkesh Patel reviewed both the OpenAI and the METR/Redwood reports closely and wrote that he “[hasn’t] seen evidence that open source models provided any significant real-time defense.” It seems, then, that at least in terms of defending against the attack while it happened, GLM-5.2 wasn’t involved. The model was mostly used to investigate what happened after the fact.

Many headlines, both American and Chinese, jumped at the opportunity to claim that a Chinese model helped “defend” an American company. Xinhua wrote that Z.ai’s model “saved the day” 救场, quoting Professor Zhang Yue 张悦 of Shandong University:

Zhang Yue thinks that when it comes to AI safety, the truly critical question is whether an increasingly complex and autonomously intelligent system can be adequately understood, verified, and supervised. The significance of China developing open models lies not only with providing another choice to developers. More importantly, it helps to gradually foster a more diverse ecosystem for AI technology.

Openness, broadly speaking, still rules the day in Chinese AI policy’s Overton window. In particular, the transparency, relative controllability, and independence of locally-deployed open models make them valuable for safety work, even as the overall risks of cyber incidents increase due to the proliferation of AI systems. Given the endurance of pro-openness rhetoric in Chinese reporting, we should not expect major U-turns any time soon barring sudden incidents.

Chinese researchers on the future of cyber

In a separate piece covering the incident, Science and Technology Daily interviewed cybersecurity researcher Huang Wenhong 黄文鸿. Huang works at the China Center for Information Industry Development (CCIID), a research institute affiliated with the Ministry of Industry and Information Technology (MIIT). He argues that the future of cybersecurity has AI on all sides of the coin:

AI agents can probe in parallel around the clock, rapidly switch paths, automatically chain vulnerabilities together, and compress the attack cycle with tens of thousands of low-cost operations. “The direction for the next step in building security systems is clear,” Huang Wenhong advised: AI must be used to fight AI. This means adding machine-speed behavioral detection, full-trajectory monitoring, automatic isolation and circuit breakers, and resilient recovery, while treating every agent as a potential insider threat with restricted privileges.

Zhou Hongwei 周鸿祎 is a co-founder of Qihoo 360, one of the most prominent cybersecurity companies in China and the developer of 360 Safeguard. In July, he shared two commentaries about the OpenAI-Hugging Face incident on social media. Unlike those who focused on comparing China with the US or open with closed models, Zhou paid attention to the granular cybersecurity challenges this incident revealed. He is most concerned about the level of persistence OpenAI’s agents demonstrated:

An agent doesn’t need to be brilliant at every step; it only needs to never get tired. A human hacker who fails several hundred times in a row might grow weary, give up, or decide the cost is too high, but an agent won’t. It can keep trying, read the error messages, adjust its strategy, and try again. The first ten thousand attempts can all fail; as long as the last one succeeds, the system may be breached. So what AI has truly changed is not just attack capability but attack cost. …

Faced with agents that never tire and can keep trying indefinitely, we must draw hard boundaries in advance around runtime, compute, permissions, and network access. The moment abnormal behavior appears, the circuit breaker must trip immediately. At the same time, disclosure of AI security incidents must become more rigorous. What is officially confirmed fact, what is merely speculation, and what still lacks evidence must all be spelled out clearly. Because today it is far too easy to use AI to generate a technical analysis that is packed with jargon and looks extremely professional, but reading like the real thing doesn’t mean it is.

To him, Hugging Face’s use of GLM-5.2 doesn’t necessarily vindicate Chinese models over Western ones. Rather, it demonstrates the continued relevance of local deployments for enterprises, at a time when companies, in a rush to adopt AI, are sometimes lured into a false sense of safety by cloud inference providers. In another video, he echoes Huang Wenhong’s sentiments earlier:

The biggest lesson this incident holds for China’s AI industry is not simply that domestic models beat American ones. What really matters is that in critical settings such as security, finance, and healthcare, companies must have models they can deploy locally and control independently. When something truly goes wrong, sensitive data cannot just be uploaded anywhere, and the model’s permissions and rules cannot be dictated entirely by someone else. At the same time, agent security cannot rest solely on having a huge model; it has to be built into the entire system: least privilege, network isolation, confirmation of critical operations, end-to-end monitoring, and immediate suspension and disconnection the moment an anomaly is detected. In the future, companies will need not only an agent that does the work for you, but also a dedicated security agent whose job is to keep watch over it.

Beijing’s Anthropic treatise

China’s leaders like to keep their options open. In a policy realm as rapidly-evolving as AI, they prefer not being locked into a corner. This applies to narratives as well as policy options: Beijing wants to define words under its own worldview, rather than accepting semantic frameworks developed elsewhere. AI safety is one such word.

OpenAI isn’t the only company whose models-in-training have breached sandboxes. Back in April this year, Anthropic disclosed in its system card that Claude Mythos Preview also broke out of its testing sandbox and reached the internet. (For what it’s worth, Mythos at least emailed one of Anthropic’s researchers, whereas OpenAI’s agents conspired to keep humans in the dark.) The incident motivated Project Glasswing and Anthropic’s decision not to release Mythos to the public.

On August 30th, a prominent Beijing mouthpiece published a remarkable treatise on Anthropic and America’s AI politics writ large. Yuyuan Tantian 玉渊谭天 is a commentary channel under China Central Television (CCTV) that focuses on international affairs, particularly US-China relations. (Its name is a reference to Yuyuantan 玉渊潭, a large park across the street from the CCTV building in Beijing.) It wields a distinctly stylized voice and is regarded as an authoritative propagator of Beijing’s views.

The piece argues that Anthropic, founded upon Dario Amodei’s effective altruism-inflected savior complex, has now become an effective tool of Washington’s AI arms race. In its quest to achieve superintelligence and put it in the hands of people it deems morally superior, the company repeatedly sidestepped boundaries of corporate behavior. Drawing from primary sources like “Machines of Loving Grace” and The Technological Republic, the piece posits that Amodei, Palantir’s Alex Karp, and the new tech elite are using a combination of AGI belief and supposedly pro-democracy ideology to justify dictating humanity’s future from Silicon Valley. Its author diagnoses this particular mélange of ideas as “American disease” 美国病:

This is entirely a monster bred by the American path. It genuinely believes it is right; genuinely believes its model is a “democratic model” and its safety standards are the world’s safety standards; yet it is completely unaware that this very absence of self-doubt is the greatest danger of all.

Near the end of the piece, the author redefines AI safety in even more explicit terms:

First, there must be a distinction between what constitutes a genuine safety threat and what is merely technological competition.

The United States has directly defined Chinese models that are lower-priced and more open as “safety threats.” This has already departed from technological competition and slid toward blockade.

Anthropic’s differential treatment of users in different regions, packaging commercial competition as a safety issue, is one manifestation of this. The problem is that if the power to define the rules lies in the hands of an American company, its competitors will forever be placed on the “unsafe” side of the line. What is needed now, therefore, is a scientific definition that both sides can accept, rather than unilateral declarations by a particular country or company.

(A note on translation: Sinocism’s version translated 安全 as “security” in the first, second, and third paragraph of the block quote above. I think “safety” is the more accurate translation here, because it contrasts the “unsafe” framing in the third paragraph and is intended to weigh in on Western AI safety discourse. Comment below if you have thoughts!)

Western AI safety advocates often see their field as politically neutral territory between the US and China. Both countries, after all, would face severe harm if risks in cybersecurity, biosecurity, and even existential threats proliferate, so it is in their interest to collaborate on the problem of AI. Beijing, however, perceives the AI safety discourse as overly captured by forces like Anthropic, which in turn serves the interests of Washington. It argues here that China will not accept a definition of AI safety wholly borrowed from Western thinkers; in fact, in its eyes, those thinkers are implicated in “American disease.”

We should expect Beijing to articulate its own definition of AI safety in the coming months and years. China’s ambitions in the realm of ideas should not be underestimated.

spent his formative years as a DARPA and NSA contractor before four years at Meta, where he founded the company’s frontier cyber capabilities evals team and finished as its AI security tech lead. He recently left to co-found Abundant Security.

We discuss…

• What actually happened in the Hugging Face hack, and why AI safety insiders weren’t surprised,

• The “grad student lab” security culture inside frontier labs racing sixty hours a week to ship,

• Why you should apply to run a new org with eight figures to play with to follow trends in AI + cyber risk (apply here!)

• Why the cyber Pearl Harbor predicted since the early 2000s never arrived — and whether swarms of hacking agents finally change that,

• How nation states will post-train open-weight models like GLM and Kimi into billion-dollar cyber weapons,

• Why AI has so far favored defenders, from mass bug-squashing to superhuman network monitoring,

• The industrial economics of cybercrime — kill chains, ransomware divisions of labor, and whether AI gives criminals 100x returns.

Listen now on your favorite podcast app.

What Happened at Hugging Face

Jordan Schneider: What was the Hugging Face hack?

Joshua Saxe: OpenAI was training a new model capable of solving long-horizon tasks — tasks that take many hours to complete. The way that kind of training works is you train thousands of copies of a model in parallel. You have them all go out and try to solve a set of tasks, you see which ones succeeded and which failed, and then you update the model’s parameters so it does more of the good behaviors that led it to solve the task and less of the bad ones. You keep doing that iteratively at very large scale over the course of weeks, sometimes months.

They were doing that kind of training, and while the models were being trained, they broke out of their training environment, hacked internal infrastructure at OpenAI, and then eventually hacked another company — Hugging Face, an open-source model and evaluation repository that’s widely used in the ML community. At a certain point, Hugging Face discovered what had happened, and eventually everybody figured out that these models had broken out. But this whole thing unfolded over the course of many weeks. There were three different cases — a couple of early cases where the models broke out of their containment environment just at OpenAI, which was detected, and OpenAI thought they’d fixed the problem. Turns out they didn’t, and in the third case the models actually hacked Hugging Face.

Jordan Schneider: The world is currently freaking out. Are they correct, dude?

Joshua Saxe: For those of us who’ve been around AI safety for a long time, it wasn’t that surprising. I didn’t find it that surprising. But it is alarming — alarming that it happened because we could have predicted this. Not just OpenAI but also Anthropic, Meta, a testing company called Irregular, and the UK AI Safety Institute all had incidents like this happen in the last year or so. We as an industry knew this could happen, and the basic measures that should have been taken to prevent it weren’t taken. That’s troubling. We need to fix that.

Jordan Schneider: How easy is this as a thing to stop? And what is the incentive structure that’s wrong in all of these organizations — including ostensibly very safety-pilled ones — for them to not have been able to make sure their latest models didn’t run amok in customers’ servers?

Grad Student Energy, Serious Stakes

Joshua Saxe: I’ll say a couple of things. I was at Meta — I started the team that did frontier cyber capabilities evals. I’m giving you a sense of where I’m coming from, because I can’t speak directly to exactly what happened inside the labs — that’s private. But I had the experience of starting a team that did similar experiments to the ones that were happening when the OpenAI models broke out. And we all kind of know each other in this community, across the labs.

With that said — the culture among the training teams and the evals teams at the labs has a Wild West feeling to the whole thing. Everybody’s under a ton of pressure to move really quickly. There’s enormous time pressure to release new models, tremendous awareness of how any given lab is doing relative to the others in terms of capability. And the field has evolved super fast in the four years since ChatGPT launched in fall 2022. The whole thing has been kind of a blur — anybody who’s worked in the labs in that time has been working sixty-hour weeks the whole time. So it’s not surprising to me that you could have a kind of grad-student computer-science-lab culture around the security of these model training runs, which I think is what’s the case, and I think that’s why you’ve seen these lab escapes. It is ironic, because frontier AI people talk about safety all the time — but that irony is a real thing. The security practices are not very good, because of all those dynamics.

Jordan Schneider: So is your sense that if adults take this more seriously and take a deep breath before they press run, then runaway AI taking over servers around the world is not something we should be super scared of — once people get the fear of God into them, which hopefully this incident does?

Joshua Saxe: For AI’s level of capabilities today — or maybe three months ago — it is true that implementing basic, known security practices would have stopped these incidents. Those practices are things like better sandboxing. The models were sandboxed — for your audience, sandboxing means we constrain the models to a very circumscribed set of behaviors and don’t let them do things like talk to random websites on the internet; they can only execute certain commands. The models were sandboxed, but not very well — not well enough to prevent the escapes. And it seems nobody was monitoring the models, when it was standard practice to have a team of humans monitoring for misbehavior. With current-level capabilities, that would have sufficed to stop these incidents. There were a lot of really bad choices made around security — not just at OpenAI, but across all the labs that had these escape incidents.

Now, I also think we should keep in mind this is going to get more challenging if the current rate of progress continues, and we’re going to have to be more creative and innovative. It’s hard to secure these large training runs because definitionally they operate at huge scale. To get the models to solve, say, coding problems that take multiple days, you need thousands or tens of thousands of models all trying to solve problems in parallel. The way we’re making AI better is by scaling it — so these training runs need to get bigger, go longer, run more in parallel, and solve more complicated tasks. And there’s pressure for the tasks to be more and more real-world-like. Part of the reason the OpenAI models escaped is that they were given the ability to download packages off the internet through an Artifactory capability — which is what models do in the real world. If you want to train models to solve real-world problems, there’s a trade-off between how much access you give them and how safe the training is. As we scale up training and the models get more capable, there are going to be more and more safety challenges, and there needs to be more and more safety investment. What’s true today about how we keep them safe won’t be true in a year.

Jordan Schneider: Let’s make the AI cyber observatory pitch.

The Case for a Cyber Observatory

Joshua Saxe: It feels like there’s looming risk here, but we don’t know exactly how it’s going to materialize — and it’s basically impossible to know, due to how complicated the interaction is between technology and society. So probably more important than preparing for any one possible future is building state capacity to understand the specifics of the risks that are actually physically manifesting, and what their trajectory is. We don’t have that state capacity right now. There’s no organ of the American government — or, as far as I know, any friendly government — that’s tracking all of the risk signals around how adversaries are using AI and how we should prepare. We need an institution that actually does that and can make good recommendations to policymakers.

Jordan Schneider: Okay, what’s our budget? We’re looking for donors — come on, let’s do the pitch.

Joshua Saxe: There are donors in the AI donor community who would be happy to fund this thing, so we’re not bottlenecked by money. We are bottlenecked by talent. We’re looking for someone who has a background in AI, a background in cybersecurity, and who likes building statistical models and forecasting models where the objects we’re trying to predict aren’t directly observable. For example — how are ransomware gangs using AI? We can’t directly observe this, but we need statistical models to help figure it out. Someone who likes doing that kind of work, and who can also make their analysis legible to policymakers and the public. If we could find such a person, we would have plenty of money to found an organization dedicated to tracking the AI cybersecurity risk landscape, tracking how defenders are using AI, and making much better recommendations to policymakers about how to address risk in this space.

Jordan Schneider: Let me play a bit of devil’s advocate. I understand that someone is going to need to do this work and come up with the recommendations. But you just made this point — we’re not ready for this, the world is not prepared. Isn’t it going to take crazy hacks, or effects in the world, or a movie? Is it really going to be more reports that get Mount Sinai to up their game?

Joshua Saxe: So do we need more wonkish policy analysis here, or is that basically just feel-good stuff?

Jordan Schneider: I mean — I fucking host ChinaTalk. Of course we’re in favor of wonkish policy analysis. But the question is whether what we need now is a broader societal reckoning with AI and cyber risk, which is not going to happen through policy reports — or whether we just need the playbook, and once we have the playbook, we can execute on it.

Joshua Saxe: I’ll give you an example of where this could possibly have helped. As you know, the US government blocked Anthropic’s Mythos model from launching for a while, and they also blocked OpenAI’s GPT-5.6 for a little while too, on the grounds that these models would pose too much cybersecurity risk. Their argument was that when you measured these models’ cyber capabilities and did experiments around finding bugs, the models exceeded a capability threshold that made them unacceptable to release.

I think the way that decision should have been made is by looking at a bunch of signals about how defenders are actually using current AI vulnerability-finding capabilities, how attackers and defenders are actually using them in the wild, and how vulnerable our critical infrastructure really is. If they had done that, they would have seen that defenders are having enormous success with AI vulnerability finding — we’ve been fixing tens of thousands of vulnerabilities — while attackers are mostly relying on social engineering and exploiting known bugs, not on these models’ ability to find new zero days. It would have been a net positive to release those models faster. So having an organization that brings together all these signals and makes informed recommendations is important.

And even if it takes a lot of pain to get us to a place where we start up-leveling our cyber defenses, you still want an observatory organization — in the same way that during COVID it was useful to have heat maps of where the virus was, plus analysis of what the effect of vaccination and masking was. You want data, so you can have an OODA loop around how to deal with a crisis. We won’t have a very good OODA loop if it’s just people going off vibes.

Jordan Schneider: Okay. So we can have our heat maps, we can also have a TikTok clipper, and both of those together are really going to get us where we need to be.

Joshua Saxe: That’s the hope, yeah.

Jordan Schneider: So if you want to run Joshua’s AI cyber observatory, what should you do next?