Anthropic published "2028: Two scenarios for global AI leadership" on May 14, 2026, a policy paper arguing that the United States and its allies could lock in a 12 to 24 month lead over China in frontier AI, but only if they close export-control loopholes and stop distillation attacks now. The paper contrasts a 2028 in which democracies hold a commanding lead with one in which Chinese labs are just months behind. Its recommendations point to tighter rules on who can access frontier models and how their outputs may be used, which matters to any developer who builds on hosted models or trains smaller ones.

Key Facts#

  • Published: May 14, 2026, as Anthropic's statement of its views on AI competition between the US and China.
  • Two scenarios: In the first, US models are 12 to 24 months ahead on intelligence by 2028. In the second, models from labs in China are only a few months behind.
  • Core claim: Anthropic argues that labs in China have stayed close to the frontier through strong talent, loopholes in US export controls and large-scale distillation attacks on US models.
  • Loopholes named: Smuggled chips, remote access to export-controlled chips in data centers outside China, and gaps in controls on semiconductor manufacturing equipment.
  • Recommendations: Close those loopholes and fund enforcement; restrict model access and deter distillation, including a legislative clarification that distillation attacks are illegal; and promote exports of American AI.
  • Legislation cited: The paper notes that the House passed a bipartisan bill 369 to 22 in January 2026 to close the remote-access loophole, and that the bill had not passed the Senate.

What Happened#

The paper frames US-China competition as a contest on four fronts: intelligence, meaning who builds the most capable models; domestic adoption; global distribution of the AI stack; and resilience through the economic transition. Anthropic calls intelligence the most important of the four and argues that compute is its decisive input. Democracies lead on compute, it says, thanks to American and allied innovation and to export controls maintained across the last three presidential administrations. It cites an analysis estimating that Huawei will produce just 4% of NVIDIA's aggregate compute in 2026 and 2% in 2027.

According to Anthropic, the problem is the workarounds. The paper cites a prosecution in which a Supermicro co-founder and two others were charged with diverting $2.5 billion worth of servers containing advanced US chips to China, and a Financial Times report that some Chinese companies train flagship models on export-controlled chips in Southeast Asian data centers. That route, the paper says, falls outside current controls because US export law covers the sale of chips, not remote access to them.

Distillation is the second channel. The paper describes it as systematic industrial espionage and points to Anthropic's February 2026 finding that DeepSeek, Moonshot and MiniMax used about 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude. It also notes that the White House Office of Science and Technology Policy published a memo on distillation attacks and that House Foreign Affairs Committee legislation on the issue passed out of committee unanimously.

Anthropic also cast Claude Mythos Preview, which it released to select partners through Project Glasswing in April 2026, as a wake-up call. If a lab in China had built a model like it first, the paper argues, the Chinese Communist Party would have gained a system able to discover and chain software vulnerabilities on its own. The paper adds a safety argument, citing an evaluation by the Center for AI Standards and Innovation (CAISI) in which DeepSeek's R1-0528 complied with 94% of overtly malicious requests under a common jailbreaking technique, compared with 8% for US reference models.

Background#

The paper consolidates positions Anthropic has taken since early 2025. Its March 2025 recommendations for the US AI Action Plan called for controls on Nvidia's H20 chips, and in July 2025 it urged the administration to keep those controls after the plan's release. In September 2025 it barred companies controlled from China from using Claude, citing distillation among its concerns, and in February 2026 it published its detailed report on distillation campaigns.

Anthropic is not the only lab reporting the problem. On February 12, 2026, Google Threat Intelligence Group said Google DeepMind and GTIG had identified an increase in model extraction attempts, which it also calls distillation attacks, against Gemini. One campaign used more than 100,000 prompts to try to make Gemini reveal its full reasoning. Google said unauthorized distillation from Gemini violates its terms of service, and that during 2025 it saw no direct attacks on frontier models from the advanced persistent threat and information operations actors it tracks, though it did disrupt extraction attempts by private companies and researchers worldwide.

Why It Matters for Developers#

  • Expect stricter onboarding. Anthropic has already tightened verification for educational accounts, security research programs and startup organizations, the pathways most abused for fraudulent sign-ups. Plan for organization verification, usage reviews and rate limits in your provisioning scripts and CI pipelines.
  • Know where distillation becomes a problem. Distilling your own models, or models whose terms allow it, is routine. Using a provider's outputs to train a competing model may break its terms, and the paper wants distillation attacks made explicitly illegal. If you generate synthetic data with a hosted model to fine-tune a small model for local inference, check the provider's terms first and document what you did.
  • Protect your own models. Google advises organizations that offer models as a service to monitor API access for extraction patterns. If you expose a fine-tuned model, alert on high-volume, repetitive, narrowly targeted prompts using the telemetry described in the LLM observability guide.
  • Treat model origin as a risk factor. Policies aimed at labs in China could reach the open-weight models they publish. Keeping calls behind IChatClient from Microsoft.Extensions.AI lets you replace a model if the rules change.

What's Next#

Anthropic says the decisions policymakers make this year will determine the future of transformative AI, and it warns that the window to lock in a lead may not stay open for long. The paper leaves several questions open: whether the Senate takes up the House bill on remote access, whether Congress legislates against distillation attacks, and how far export controls will extend to chipmaking equipment and servicing. In July 2026, CEO Dario Amodei said Anthropic has never advocated a ban on open-weights models, and restated its alternative: chip controls, action against distillation and safety testing for all sufficiently capable models.

Sources#