China's Mythos Moment
Will Xi license, lock down, or let it rip?
Irene Zhang is in Jakarta this week (irene@chinatalk.media). Reach out to hang!
You can read this article in microsite form thanks to Kimi K3 here.
Soon, a Chinese lab will develop an AI model with capabilities on par with Anthropic’s Claude Mythos. Mythos’ potential to wreak cyber havoc drove the White House to create what is a “de facto involuntary licensing/preapproval regime for frontier models.” Will the CCP similarly panic when the day comes in China?
In June, Z.ai cofounder Jie Tang told Elon on X that China will have a model on par with Mythos before the end of the year. Even if he’s off by a few months (Kimi K3’s release shows we’re certainly getting close) the clock is ticking for regulators in Beijing to respond.
Reuters, on July 7, reported that Chinese regulators were considering “potentially restricting overseas access to China’s most advanced AI models.” And Xi himself has raised technical AI safety to the highest policy agenda. In his speech at WAIC yesterday, while touting the benefits of openness he also said:
We must attach great importance to the various endogenous and derivative risks brought about by AI, and work to build systems of laws and regulations, technical monitoring, risk early warning, and emergency response. We must reinforce the safety baseline, prevent misuse and abuse, and ensure that artificial intelligence always remains under human control.
We wanted to share our team’s own theories about what may come next. In our eyes, the story of Chinese Mythos may pan out in three main ways:
a continuation of laissez faire “let it rip”: the model releases with minimal intervention;
‘Glasswing with Chinese Characteristics’: access is limited first to ministries, then key trusted companies, and only later in a limited fashion to consumers
The black-box, where we will only ever hear rumors of the power of China’s Mythos, contained solely within labs and government ministries
We tell the story of these paths as hypothetical scenarios because all of these outcomes seem plausible. We hope that a creative approach inspires flexible thinking on preparedness: USG, AI policy people, safety advocates, and researchers should be prepared for whatever may come. We create the fictional Z.ai GLM 6 to be the hypothetical Mythos-level model that will rock the world. For all we know, the real Chinese Mythos may come from Kimi, DeepSeek, Qwen, or from any other lab.
Scenario 1: GLM 6 Drops Into the Wild
One day, GLM 6 dropped just as all other models, Chinese or American, had dropped before Mythos: a hype tweet. Only a few hours later, just like how its other models have been released, Zhipu makes GLM 6 open-sourced, with its weights available freely online.
Fictitious graph showing GLM 6’s capabilities. GPT 5.6 performs worse than Mythos on exploiting cyber vulnerabilities. In the pre-Mythos era, OpenAI would have never released this model and waited for the line to beat Mythos. Now, sandbagging is the meta!
After a few days, two phenomena occur simultaneously. First, cyber professionals tinker around and discover GLM 6 can find zero-day vulnerabilities the same way Mythos could. They scramble to inform labs and policymakers, both in the US and in China. Second, enterprises that just want to use good, cheap models are realizing GLM 6 is a saving grace. Before, some companies like Uber Eats, Siemens, and Shopify had already begun to integrate Chinese models in their workflow. But now, with GLM 6, there is no trade-off between cheaper tokens and amazing performance. On the graph of enterprise usage of Chinese models, the slope has a dramatic uptick.
The two phenomena pose real questions to Beijing. A model that is democratizing cyber offense (something the Chinese government believed it had an edge with on everyone sans the NSA) is proliferating worldwide. Cyberattacks seem like they’re on the verge of inflicting disproportionate financial damage on China’s leading companies (since America and friends have already been hardened by Mythos access). But Beijing also sees the economic upside. Zhipu’s market cap approaches $500bn, instantly becoming one of China’s largest companies. GLM 6 is China’s chance to beat America in leading model adoption, crater the western labs’ businesses, and lead global enterprises and government systems to turn to China as the go-to technology provider. Plus, Xi just gave a big speech about how important openness is!
Besides, struggle is part of the process. The Party has been willing to accept sacrifices during COVID opening up, some bank failures, and tech crackdowns; this round of cyberattacks could just be the culling before China emerges stronger than ever. On the verge of securing a new commanding height, bureaucrats are torn over how to achieve AI ambitions and security at home.
The Trump administration is also torn. Perhaps the uptick is an anomaly, and no policy action is required. USG rails against China for distilling and then releasing such a model, declares that government contractors can’t build with Chinese open models, but doesn’t outlaw models as it would be too silly to try to ban a file that can just be torrented. When Beijing doesn’t send any signals on cracking down on GLM 6, Washington decides to let it rip as well, screaming at its leading labs to drop something open. If there’s going to be a powerful open source model out making waves, it should probably be American.
Z.ai workers, already in a sleepless daze from the eighteen-hour days up to launch, don’t know what to do. The celebrations from the launch party have subsided into stress. They are already talking with the relevant authorities, but what to do? Because they open sourced the model, like they did with 5.2, there is no putting the genie back in the bottle. The model, with well over a trillion parameters, can’t just be weaponized by anyone with too much free time and a Mac Mini. But there are plenty of actors out there — terrorists, companies with the wrong interests, criminal syndicates — who could get their hands on a good number of racks to turn the model against China. All Z.ai can do is hold their breath and wait for the fallout.
The Party decided that GLM 6 wasn’t dangerous enough to strangle, but the model did serve as a wake-up call. GLM 6 is now the ceiling for unsupervised drops, and every model after gets scrutinized closely before release. Without much fuss, China implements a stricter licensing regime that doesn’t just check for politically unacceptable output, but also cyber capabilities.
Scenario 2: Glasswing with Chinese Characteristics
After seeing Mythos, Beijing realized that emergent capabilities could inflict real damage in the wrong hands. The best means of mitigating the negative effects of future models seemed to be a Project Glasswing-type undertaking. In August 2026, Ding Xuexiang gives a speech implying that breakout domestic AI models should be shared with important government ministries and corporate giants like Baidu, Alibaba, and Tencent before deployment.
Tang Jie and team had already deeply internalized the risks of misuse for Mythos-level models. After Ding’s speech, Z.ai postpones the launch party for GLM 6 to further evaluate the model’s capabilities internally, at which point their researchers realize what their creation is capable of. Determined to not be disappeared, company leadership pitches Project IceFeather (冰羽项目) to the Cyberspace Administration of China. The CAC, of course, takes the lead on announcing the initiative in October, but Z.ai is credited as the “core private sector partner” of the project.
Government ministries and key SOEs like State Grid get access first. They use their exclusive access window to check for vulnerabilities in their own systems while the MSS trawls for exploits that can be used offensively overseas.
The Party’s involvement in Project IceFeather means the state is also a co-owner of the model’s risks. The dominant strategy for bureaucrats instructed to “Evaluate first, deploy later” turns out to be endless evaluation. The downside risk of letting anyone with enough compute get to punch a hole in China’s critical cyber architecture seems much scarier to the system than marginally more productivity growth and global discourse power as the open standard for AI. At first, nobody quite decides that the model should be released, as nobody wants to be responsible for what would happen post-release. But after seeing American models continue to advance and the gap between U.S. and China widen, the trigger gets pulled. Strong safeguards are put on the model, perhaps to the point of excess, and the regulators hope that domestic infrastructure has been sufficiently strengthened by Project IceFeather. Hesitant to hand over their golden goose, Z.ai leadership offers API access instead of the full model weights. A lobotomized GLM 6-Open gets released, while the real breakthroughs Z.ai plans to monetize by selling tokens.
Visualization of the fictitious GLM 6’s public safeguards. Adapted from Anthropic.
Despite having the best Chinese model, Z.ai stock price doesn’t moonshot as feet-dragging over Project IceFeather spooks investors who worry that the government won’t allow them to monetize the model beyond state customers, much less into key markets overseas. While the MSS has the time of its life hacking away at everyone who didn’t get access to Mythos, domestic coders still mostly use transfer stations to access frontier capabilities.
After two months, regulators expand the circle of trusted users for GLM 6, to include provincial governments as well as trusted local tech leaders like Alibaba, Xiaomi and Huawei. It takes another few months for Chinese firms broadly to get access, by which point other domestic labs have developed roughly similar models. Thanks to pressure from the Trump administration, OpenAI releases a cyber-lobotomized open model on par with GLM 6, which finally convinces CAC that Zhipu should be able to allow the world to access its model.
Scenario 3: Zhipu Emerges as the Certified National Champion as a Covetous Beijing Keeps Frontier AI In-House
Li Qiang, China’s Number Two, wasn’t kidding. What Beijing really cares about is really “upholding the bottom line of AI security,” not the platitudes in Xi’s speech at WAIC about “openness, win-win” and “mutual learning between civilizations” that the credulous foreigners ate up. Behind the scenes, Beijing has maintained deep insights into exactly how capable China’s top AI models were, and was preparing for the moment when it knew it would have to step in.
In September 2026, the Cybersecurity Administration of China publicly updates its AI model registry regulations. Whereas previously, the rules only governed new models and algorithms with the ability to “shape public opinion,” it now requires companies to report any major update, self-assess for potentially catastrophic cyber risks, and give the government exclusive access indefinitely. Remembering the fates of DiDi and Ant Group, companies all know better than to not comply.
Now the state now gets first dibs on every new model release and update. An internally assembled testing capacity through the MSS and PLA Cyberspace Force meant that when GLM 6 proved to be genuinely exceptional, Zhongnanhai was the first to know. Having recognized that this model was a potential ‘assassin’s mace’ Xi had directed the state to forge a decade ago, there was no way the security state would allow its capability to be open sourced. Despite Foreign Ministry protestations that releasing this model globally would improve China’s standing in the world, and MIIT officials salivating at the domestic productivity boost the model could provide, the security state was not having it. Open soucing this model would forfeit a cyber window of opportunity and allow Xinjiang separatists and Falun Gong activists with some Azure credits the same hacking capabilities as the domestic security apparatus.
Two days after GLM 6 was sent over to the state, Tang Jie and co. were summoned to CAC. Over long hours and litres of tea, a deal was struck. The “real” GLM 6 would become available to government entities: specifically, it would be deployed on-premise into core governmental functions that benefit from such capabilities — including defense. Z.ai would release to the public a lobotomized version of the model, thoroughly tested by both the company and the government to ensure its cyber capabilities are satisfactorily weakened. The lab gets a contract with lucrative term and the state agrees to help ‘persuade’ other chinese model makers to sign away their compute both in the mainland and at southeast asian neoclouds. Instead of cyber capabilities getting democratized with the likes of Xinjiang separatists and the Falun Gong
In a world where cyber capabilities have the potential to become democratized, Beijing has made sure that the tools in its arsenal are of a different tier.
Parts of the meeting leak to Reuters, but no matter. At first, no one was surprised that the Chinese government was getting better AI than the masses. Z.ai was now the proper national champion, but there was no actual proof that they made something transformative.
Then the attacks started. Beijing knew that Americans, armed with Mythos-level defensive capabilities for months already, were on the lookout for any sign of trouble, and did not want to re-inflame the bilateral relationship at a time when it could not expect to extract meaningful concessions. Instead, it focuses its new cyber bazooka on less-prepared countries: wavering capitals in the Global South, less developed neighbors, and eventually Europe. It was easy enough to hack into Paraguay’s citizen records; by early 2027, Asunción was frightened into dropping recognition of Taiwan. European technology companies in the semiconductor supply chain, began reporting cyber attacks at a much-increased scale. Brussels bureaucrats began fretting about blackmail of uncertain origin.
Other Chinese labs, having signed over a good amount of their compute to Zhipu, slowly progress on their own capabilities but still get prevented from releasing their weights by the CAC. By this point, collaboration between the government and Z.ai has reached new heights. Building on GLM 6, the lab is now developing proprietary models tailored to government wants and new-generation cyber weapons. On the outside, Z.ai still looks like a normal lab, continuing to release consumer-grade models, open-source research, and AI products. The to-G side is heavily insulated; researchers must be thoroughly vetted before being deployed to serve the government, and are required to surrender their passports. The CAC occasionally poaches star researchers from other labs under the guise of “national development consultation.”
Which Scenario is Most Likely?
How likely are each of these scenarios? Here at ChinaTalk, we’ve been having lively internal debates over what might come next. Here are our thoughts (as well as Kimi v3’s!):
Jordan: Chinese glasswing (Scenario 2) most likely (65%) then ‘let it rip’ (scenario 1) (20%) then nationalization (scenario 3) (15%). On 3, despite Xi’s desire for SOEs to perform, I think he has learned his lesson through the tech crackdown that the state can’t really be relied on to produce the sort of technological breakthroughs required to keep pace with the AI frontier (he learned why the unicorns went away). Some muddle through of tighter regulation, golden shares and minority state investment, and a Glasswing-style release as opposed to an indefinite lockdown on access and total nationalization seems like the more likely equilibrium over the next two years.
I also don’t see the labs keeping their best capabilities open forever. Chinese model makers have already begun to go closed source to make money and as Reuters reported there are influential strains within the system skeptical of allowing foreigners’ access to China’s best models. The benefits to the Chinese government of open sourcing powerful AI are diffuse (global PR, undermining the western AI ecosystem), while the harms are concentrated in a paranoid security state that is not interested in democratizing access to hacking. Plus, Xi really likes assassins maces, and a world-conquering cyberweapon is not the sort of thing that you give up for good global PR. Xi’s WAIC speech to me felt like it could just be a barbarian handling exercise akin to his 2017 World Economic Forum speech. In that address, he promised to serve as a counterweight to Trump tariffs but immediately started on a global campaign of economic coercion once security issues towards Korea, Japan, and Australia cropped up. When things get serious once China has an AI model that can truly compete with or even exceed the cyber capabilities the US has access to, it’s unlikely he will really want to hand over that capability to Huggingface.
Lastly, Zhipu, Deepseek, and Moonshot, the leading Chinese labs now that everyone good at Qwen quit, do not own complements like Nvidia which give them economic incentives to commoditize themselves. Their CEOs are genuinely ideologically committed to open source, but they do need to keep money coming in to do novel research and train models. Today I don’t see a coordinated national strategy to pop the west’s AI bubble by driving down the global cost of intelligence. But that may be emerging, evidenced by Xi’s speech and the Deepseek investment.
I do not believe that today there is a national strategy to pop the west’s AI bubble, but it is possible that the government decides it’s strategically important enough to foot the bill for its top firms to drive down the global cost of intelligence. It would not take nearly as much money as Xi has already spent in more hardware-oriented industrial policy efforts around cars, solar, and semiconductors.
Aqib: I see Scenario 1 and 2 equally likely (45%), Scenario 3 least likely (10%). My stock in Scenario 1 went up after seeing Kimi K3 deployed without any fuss, coupled with the recent statements from WAIC.
Scenario 1, where a frontier lab “lets it rip” and deals with consequences later, cannot be counted out. In a vacuum, Z.ai released GLM 5.2 after Mythos seemingly without any fanfare or close scrutiny; the Chinese government also does not seem to monitor model releases for cyber or bio capabilities. Z.ai’s founder recently wrote a memo reiterating support for open source, and Xi prefers to have a “water-flow” mindset toward AI. Most recently, Kimi K3, a powerful open-source model, was released seemingly without close scrutiny as well. This language and action suggests a willingness to keep the models open and public.
However, recently government interest in monitoring models more closely has risen. Reuters reported that Beijing is mulling future powerful models being “barred from public release or restricted to domestic use.” Model developers, who keep regular informal communication with regulators, would likely communicate such capabilities to the regulator to receive informal approval before release, lest the developer receive a crackdown for releasing the model too hastily.
The scenario has some uncertainty, and reality could branch out at different points. GLM 6 could be released as a closed-weight model, just like Qwen; that would mean the model could be put back in the bottle if the capabilities were too dangerous. The Party may also decide that, after release, it is worth rescinding the model because the risks are just too large. Chinese SOEs have notoriously poor cybersecurity, so they may be the first ones hit. We don’t know what happens afterwards in this world; the hammer could come down hard on the entire AI industry, or it could just be the beginning of a stricter licensing regime.
Lily thinks China’s Mythos won’t be locked behind closed doors indefinitely, but a Project Glasswing-style rollout with Chinese bureaucratic characteristics is possible. The Party’s concerns about AI security go hand in hand with support for AI-enabled One Person Companies and the belief that AI will unlock new productivity increases. Certainly, there are forces in Zhongnanhai that want China’s developers to be working with the best possible tools. But the fact that everyone with the technical expertise necessary to brief the government also has a horse in the AI race could be a powerfully perverse incentive.
Overall, Scenario 2 most likely (45%), then Scenario 1 (35%), then Scenario 3 (20%). I think Scenario 3 is the least likely because the private sector has already produced such high quality models on their own, so perhaps the party would be skeptical that state involvement would produce something more capable.
Irene is uncertain about exactly how CAC regulators will patch holes in the existing registry system, but thinks a secret model is more likely that people assume.
There are recent signals in favor of the theory that CCP leadership is genuinely concerned about AI safety. Xi Jinping will make his WAIC debut in Shanghai this month, where, according to state media, he will “systemically elaborate on China’s policies, position, visions and propositions on AI development and governance.” AI guardrails came up during the Xi-Trump summit in May. And here’s how Zhou Haibing, vice minister of the National Development and Reform Commission, paraphrased Xi Jinping’s message on AI safety during a press conference in June 2026, just a week after Fable’s first release (emphases are Irene’s):
[China will] enact the responsibilities of a major country, manage and control risks, strengthen prevention efforts, explore cooperative opportunities in AI oversight, and jointly defend against AI safety risks. [中国将... 履行大国责任，管控风险、强化预防，探索开展人工智能监管合作，共同防范人工智能安全风险。]
The emergence of keen prevention rhetoric means Beijing expects regulatory agencies to stamp down on risks before they proliferate. Barring truly necessary structural changes, a “let it rip” approach is just not in the PRC’s deeply conservative policy psyche. Publicized regulations will change with the times, but Irene expects much of the negotiations on frontier capabilities inside China to be kept under the hood going forward, no matter how leaky the system can be at times.
The PRC has an extensive history of secret strategic projects. If Beijing truly believes that AI will shape national power — much like weapons of mass destruction did during the Cold War — then it probably is already tempted by its old playbook. “Two Bombs, One Satellite” was highly classified in its initial years, and some of the researchers involved were not permitted to publicize their experiences until decades later. Mao’s “Third Front” (which Irene has written about before) involved building entire secret cities in remote western regions to hide defense-industrial capabilities from prying American and Soviet eyes.
In many senses, hiding a frontier model is easier than hiding literal mines and factories. Despite significant research efforts (including by our own Aqib and Nick), no one has high-confidence estimates on how much AI compute China has. Satellite data on data centers do not correspond neatly onto actual compute amounts, because no one knows what chips are inside or what utilization rates look like. Amid an entire gold rush of companies training and using AI systems, it’d be quite easy to hide a proprietary system in plain sight.
But one challenge might be personnel. There are only so many star AI researchers in China. It’s a tightly-knit circle, and many have overseas experience. Beijing is probably wary of bringing some of these folks onto the high side to build black-box systems, but arguably has no alternative. This is why Irene imagined a scenario where the CAC tries to semi-absorb part of Z.ai rather than build a whole secret lab from scratch.
Overall, I see Scenario 3 most likely (45%, even though we won’t find out), then Scenario 1 (30%), with Scenario 2 least likely (25%).
Below the paywall, results from when Jordan burned $500 in tokens over the weekend to ask the leading Chinese and American models how they think Beijing will react to China’s Mythos moment. He got some pretty surprising results!
