US banned its best chips from China. Renting them is still legal

American export controls were written to stop Nvidia's most advanced chips reaching Chinese companies. They were written around the idea of a shipment.

Buying a GB300 is prohibited. Renting time on one sitting in a data centre in a third country is a different transaction, and the rules do not clearly reach it.

That gap is now the central problem in US technology policy, and Washington is moving to close it.

The Accusation That Made It Concrete

On July 22, Michael Kratsios, the White House director of science and technology policy, publicly accused Moonshot AI of obtaining servers fitted with Nvidia GB300 chips and routing training workloads through GB300-enabled infrastructure in Thailand.

Kratsios said the arrangement violated ‘both US export regulations and the terms of service set by American AI developers’.

The GB300 belongs to Nvidia's Blackwell generation and is explicitly barred from export to Chinese firms. Lower-tier parts such as the H200 have received exemptions. Nvidia did not comment on the White House statement.

The timing was what gave the accusation its force. Days earlier, on July 27, Moonshot had released Kimi K3.

The Model At The Centre Of It

Kimi K3 is a 2.8-trillion-parameter open-weight model, the largest ever released with open weights. It activates 16 of 896 experts at inference, handles a context window of one million tokens, and is built on a hybrid linear attention mechanism the company calls Kimi Delta Attention.

Its benchmark position is the part Washington noticed. On LMArena's Frontend Code evaluation, conducted through blind developer testing, K3 placed first at 1,679 points — ahead of Anthropic's Claude Fable 5. On the Artificial Analysis Intelligence Index it scored 57.11, fourth overall behind Claude Fable 5 at 59.86 and two configurations of OpenAI's GPT-5.6 Sol.

Moonshot's own assessment was more modest, placing K3 behind Fable 5 and GPT-5.6 Sol on overall performance while ahead of every other system it tested, including Claude Opus 4.8 and GPT-5.5.

A Chinese laboratory, operating under a chip embargo, released open weights that beat the best American model on a blind coding evaluation and sit within three points of it overall. That is the outcome the export controls were designed to prevent.

Why Renting Is Not Buying

The controls regulate the movement of goods. A chip that never leaves a data centre in Thailand or Malaysia has not been exported to China in any sense the regulation recognises, even if every workload it runs originates in Beijing.

Several Chinese firms have reportedly reached restricted compute this way, through facilities across Southeast Asia. Reports indicate Kimi K3's training drew on roughly 20,000 Nvidia chips accessed through Alibaba's infrastructure.

The Bureau of Industry and Security is now examining whether Chinese entities bypassed restrictions using overseas subsidiaries or third-party cloud providers. That inquiry is about structure rather than smuggling: not who moved a chip, but who controlled the workload running on it.

The Bill That Would Close It

The legislative answer is the Remote Access Security Act, which would extend export controls to cover cloud-based access to restricted hardware — treating remote access as an export event in itself.

It passed the House in January. It has not moved in the Senate since.

The delay is not simple obstruction. Redefining remote access as export has consequences well beyond China. Cloud computing is sold on the premise that the physical location of the machine is irrelevant to the customer. A rule that makes location determinative would require American cloud providers to identify the ultimate controller of every workload on restricted hardware, worldwide, and to refuse service on that basis.

That is an enforcement burden of a different order from checking a shipping manifest, and it lands on companies that are themselves among the largest buyers of the chips in question.

What It Means Beyond Washington

For the rest of the world, the significant detail is that the fix under discussion does not stop at China.

Any framework that treats compute access as a controlled export gives the United States a licensing decision over who may use American chips anywhere on earth, regardless of where those chips physically sit. Countries building sovereign AI capability on Nvidia hardware — which is very nearly all of them — would be operating inside that framework.

India's own AI compute programme runs on Nvidia silicon, under the same statutory authority Washington used against China in 2022. So does most of Europe's, and the Gulf's.

The Remote Access Security Act is aimed at one country. The instrument it creates would not be.

The Underlying Problem

Export controls assume a chokepoint. They work when the restricted thing is physical, traceable and has to cross a border.

Compute has stopped behaving that way. It is rented by the hour, brokered through intermediaries, and consumed thousands of miles from where it is installed. A control regime built for cargo is being asked to police a utility.

Kimi K3 is the evidence that the mismatch is not theoretical. Whatever hardware trained it, the weights are now published, downloadable, and running on machines their authors will never see.