China champions open AI to the world. In private, it’s afraid of one closed American model.

China has spent the past year telling the world that AI should be open, cheap and shared. In private, its officials are unnerved by one American model that is none of those things.

Beijing is growing anxious that Anthropic’s Mythos could be turned against it, Bloomberg reported. Officials see the frontier model as a potential offensive cyber weapon, people familiar with the matter said, and they resent that Anthropic denies China access even for ordinary use.

The fear is not abstract. Mythos has proved unusually good at breaking software, finding and exploiting flaws at a scale humans cannot match. One GovTech assessment found it chained hundreds of vulnerabilities together and wrote working exploit code on its first attempt. That worked more than 83% of the time. In June, Washington judged the risk severe enough to cut off foreign access entirely.

The irony is hard to miss. China is the loudest champion of open AI, flooding the world with downloadable models and casting itself as the technology’s democratiser. Yet the system it fears most is a closed American one it cannot legally touch.

A grievance with a summit attached

The timing sharpens everything. Xi Jinping is due in the US on 24 September, and Beijing wants a warm mood beforehand. Officials are seeking a “win-win” tone at AI talks expected ahead of the meeting. Suspicion, though, runs both ways. Washington worries that Chinese firms are quietly training their own models on American ones.

That worry has teeth. Treasury Secretary Scott Bessent floated sanctions last month against developers found to have stolen intellectual property, after Beijing’s Moonshot AI released a system said to rival the best US labs. China’s Commerce Ministry warned it would take “all necessary measures” in reply.

Anthropic sits at the centre of the distrust, by choice. It has become the most China-hawkish of the US labs. Chief executive Dario Amodei wants high-end chips kept out of the country, has accused Alibaba’s Qwen team of training on Claude’s outputs, and has called China’s ruling party “the most capable threat” among authoritarian governments. Beijing’s suspicion, in other words, is not imagined.

The response Beijing is drawing up

China is not acting yet, but it is preparing. Officials are drafting options should Washington move first, the people said, including sanctions or adding US AI firms to a restricted-entity list. Because Anthropic does not operate in China, any such penalty would carry little commercial sting. It would be a signal, not a blow.

Beijing has shown it will send those signals. In June it placed export controls on two American rare-earth firms after the Pentagon added Alibaba and BYD to a military-linked blacklist, part of a pattern of hitting back where it hurts. AI is simply the newest front in a rivalry that already spans chips, robots and rare earths.

Washington is caught in its own contradiction. Trump says he is weighing tighter AI controls while fearing they could hobble American firms. “We have to be careful in both ways,” he said last week. “We don’t want to restrict them where all of a sudden, we come in second to China.”

His own government has meanwhile banned federal agencies from using Anthropic’s tools, a fight the company is contesting in court.

So the two superpowers now treat frontier models the way they once treated missiles. The model China fears most is one it cannot download, built by the company most determined to keep it that way. That standoff is the new front, and it opens just as the two leaders sit down to talk.