Here's the truth about US chip export controls: They were built to police the physical movement of hardware across borders, and Chinese firms have simply stopped moving the hardware.
By renting Blackwell-class capacity from cloud providers in south-east Asia, the PRC consumes the compute without ever taking delivery of a chip, which leaves the entire apparatus of licences and end-user checks pointing at the wrong thing.
That Moonshot AI could train a frontier model this way is the tell, because it shows the workaround is not a fringe tactic but a viable substitute for ownership.
A gap of the administration's own making
The sharper irony is that the current enforcement hole was widened, not inherited.
Washington announced in May 2025 that it would scrap the diffusion rule, the bureau stopped enforcing it almost immediately, and no replacement arrived until May 2026.
That interval let Chinese subsidiaries buy advanced chips more or less openly, and the estimate of hundreds of thousands acquired is the cost of rescinding a rule before having anything to put in its place.
Criticising the previous framework while recreating its weakness on a larger scale is not a strong position from which to write the next one.
The authority problem nobody wants to own
Even a perfectly drafted rule runs into a more basic question, which is whether Commerce can regulate cloud access at all.
The bureau has already said, in its own advisory opinions, that it does not read its remit as reaching the cloud, and an agency reluctant to claim a power is unlikely to wield it convincingly.
This is why the Remote Access Security Act matters more than the rule-writing, because legislation would settle the authority question that regulation alone cannot.
Yet the bill sits in the Senate, and even passage would only start the drafting, so the practical timeline stretches well past the point where the compute has already been consumed.
Commerce versus security, again
Underneath all of it is the same tension that has shaped every version of these controls.
Chipmakers resisted the original rule because it threatened their competitiveness, allies bridled at a tier system that ranked them, and any successor will draw the same commercial fire.
The move towards a more inclusive framework is a concession to that reality, an attempt to buy international buy-in by widening the circle of trusted partners.
But inclusivity does nothing about the harder vectors, the data centres in Malaysia and the shell companies, which are precisely the routes that do not announce themselves.
The lesson of this cycle is that controls anchored to hardware will keep arriving after the compute has already changed hands.
