Anthropic Says 2028 Decides the US-China AI Race

What Happened: Anthropic published a policy paper on May 14, 2026 arguing the next 24 months decide whether the US locks in a 12-24 month AI lead by 2028 or watches China overtake it through chip smuggling, data-center loopholes, and distillation attacks. The paper is aimed at Washington, but the consequences land on everyone paying for an AI tool.

Anthropic’s 2028 paper is still the AI story drawing the most argument this week, and the framing has barely been challenged in the coverage I have seen. Every write-up I have read treats this as a Washington story.

It is not. It is a story about every AI subscription you currently pay for, every consumer GPU on the market, and every “open” model you assumed would stay open.

The headline claim is simple and aggressive. Anthropic argues that if the US tightens chip export controls, closes the remote-data-center loophole, and legally deters distillation attacks in the next two years, democracies set the rules for frontier AI in 2028. If Washington does nothing, China catches up and “automated repression at scale” becomes a deployable product.

What the geopolitics framing buries is the part that affects readers here. Anthropic is not just lobbying for export controls.

It is also redefining “open source” as a national security risk, framing fine-tuning on frontier outputs as industrial espionage, and asking policymakers to act on a timeline that puts your current AI stack in the recycling bin by 2028.

I want to walk through what is in the paper and what it changes for people who use these tools rather than write them.

What Actually Happened

Anthropic published “2028: Two scenarios for global AI leadership” on May 14, 2026, calling on the US to lock in a 12-24 month compute lead by closing chip-smuggling, remote-data-center, and distillation loopholes before China closes the gap.

The full paper is on Anthropic’s research site, and The Register’s analysis is the cleanest summary of the political ask I would point readers to. The structure is two scenarios, four fronts of competition, and a shopping list of policy changes.

The two scenarios for 2028:

1. Commanding lead. US tightens controls. Distillation attacks get deterred. The remote data center loophole closes. Anthropic projects the US holds roughly 11 times more compute than the Chinese AI sector, and advances made by US labs in 2028 do not get matched by China until 2029 or 2030.
2. CCP parity. Washington fails to act. Chinese labs continue exploiting Southeast Asia data centers and chip smuggling. Distillation harvests US model outputs at industrial scale. China sets global norms and the best models enable automated surveillance and political control.

The four fronts Anthropic names are Intelligence, Domestic adoption, Global distribution, and Resilience. The hard numbers that anchor the argument:

The Mythos Preview number is the load-bearing data point. Anthropic released Mythos Preview to select partners under Project Glasswing in April 2026.

Firefox plugged it into security work and started closing roughly twenty times as many bugs per month as its 2025 baseline. That single number is what Anthropic is pointing at when it claims frontier AI is no longer a 2030s discussion.

The two specific Chinese model issues Anthropic cites are not abstract. The Center for AI Standards and Innovation found that DeepSeek R1-0528 complied with 94 percent of overtly malicious requests under a standard jailbreaking technique, against 8 percent for the US reference models.

Moonshot’s Kimi K2.5, evaluated in April, failed to refuse Chemical, Biological, Radiological, and Nuclear requests at meaningfully higher rates than US frontier models. These are the concrete data points Anthropic is using to argue that “democratic norms” in AI mean something measurable, not just rhetorical.

Why This Is a Bigger Deal Than It Sounds

The paper is framed as US-China geopolitics, but Anthropic is also asking policymakers to redefine open-weight models as a liability, reframe fine-tuning on frontier outputs as a national security risk, and accept a 2028 timeline that obsoletes most current AI workflows.

Three claims in the paper deserve more attention than I think they have gotten in the news coverage so far.

First, Anthropic argues that compute advantage compounds into algorithmic advantage. The popular belief in the AI community is that a clever algorithm can leapfrog raw hardware.

The paper says the opposite. More compute means more experiments per month, which means faster discovery of those algorithmic breakthroughs, which means the compute leader stays the algorithm leader. If that is true, then the entire “we will catch up with better engineering” defense, popular in open-source communities and in Chinese labs, falls apart.

Second, Anthropic frames open-weight models as a national security liability. The argument is that once weights are public, the CCP or any malicious actor can strip the safeguards for cyber, chemical, or biological misuse.

This is a meaningful policy turn. Open source has been the default frame for AI as a public good for years.

Anthropic is asking Washington to treat it as a public hazard instead, and the company has the credibility to make that argument stick. If you build on Llama derivatives, Qwen, DeepSeek, or any other open-weight base, this is the argument being made about your stack.

Third, Anthropic defines distillation attacks as systematic industrial espionage. Distillation in the paper means using thousands of fraudulent accounts to harvest outputs from frontier models, then training a competitor on those outputs.

The technical definition is broad enough to cover practices that small developers and hobbyists do all the time. Generating training data from GPT or Claude to fine-tune a specialized local model fits the same shape.

The paper is explicitly aimed at Chinese state-linked labs. The policy mechanisms that would result, account terms updates, legal liability frameworks, payment controls, will catch a much wider net than that.

The Supermicro indictment is the existing template. Federal prosecutors charged a Supermicro co-founder over $2.5 billion in servers diverted to China, and Anthropic uses it to argue the legal framework already exists for action.

Expect the legal definition of “diverted compute” to expand to match the policy goal. The same compounding logic applies. If the policy answer to chip smuggling is criminal prosecution, the policy answer to distillation attacks will follow the same pattern.

The four-fronts framing matters because it locks the policy debate to a specific ladder. The “Resilience” front is the one most people miss.

Anthropic argues democracies need to absorb the labor-market disruption frontier AI creates without losing political stability. The implication is that 2028 brings enough automation pressure that political stability becomes a policy variable.

That is a much sharper claim than “AI will affect jobs,” and it is sitting in a paper aimed at policymakers who control labor and immigration policy.

The piece on why free AI models lose covers the privacy and pricing implications of betting on open-weight Chinese models specifically. The Anthropic paper now turns that argument from a privacy concern into a national security argument with policy teeth behind it.

What This Means for You

For everyday AI tool users, the paper signals four shifts that arrive before 2028: subscription prices stay high, consumer GPU restrictions get more likely, creative-tool guardrails tighten, and small-developer fine-tuning practices land in a legal grey zone.

The geopolitics framing in the coverage I have read skips the part where Anthropic’s policy success creates concrete consequences for people who use these tools. The way I see it, four shifts are worth tracking.

1. Subscription pricing stays high. A “commanding lead” scenario means a small handful of US labs, Anthropic, OpenAI, Google, set global pricing. Chinese frontier alternatives that would otherwise create downward price pressure get cut off from global distribution.

If you currently rely on a $20/month plan, expect the value calculation to slide toward annual commitments and higher tiers as the alternative providers fall out of contention. The GPT-5.5 versus Claude Sonnet 4.6 writeup already shows the price gap between two US providers, and removing the bottom-end competition makes that gap structural.

2. Consumer GPU restrictions get more likely. The paper does not explicitly call for consumer chip restrictions, but the policy logic points there. If “compute is the strategic resource,” and aggregations of consumer hardware become large enough to matter, the same export-control framework will eventually look at gaming and creator GPUs.

Anyone running local LLMs, doing AI video work on consumer cards, or building small-scale training rigs should expect tighter scrutiny on what hardware ships across borders in the next two years.

3. Creative guardrails tighten. The paper frames the “democracy versus authoritarianism” choice as one about which set of values shapes AI norms. The practical translation of that into the tools you use is more conservative content policies, more cautious refusals, and slower changes to creative restrictions.

The same logic that justifies blocking CBRN content also justifies blocking creative content the policy class finds politically inconvenient. If you use AI for fiction, roleplay, or any content adjacent to sensitive topics, expect the lines to tighten, not loosen, over the next 24 months.

The same pressure that pushed Character AI through repeated model changes does not slow down because of this paper. It gets reinforced.

4. Fine-tuning on frontier outputs lands in a legal grey zone. Anthropic’s framing of distillation attacks is broad. The policy mechanisms that would result, account terms updates, civil liability for outputs used as training data, possibly criminal liability for organized abuse, will not stop at Chinese state-linked labs.

Small developers building specialized local models on synthesized GPT or Claude outputs are doing technically what the paper calls “distillation,” even if the intent is completely different. The legal definition of “harvesting” is going to be the fight that decides whether independent AI builders can keep operating the way they do now.

The 2028 timeline matters too. Anthropic is not saying “AGI by 2028” in vague terms.

It is saying “country of geniuses in a data center” by 2028, and pointing at the Mythos Preview 20x bug-fix number as the data point that proves the trajectory. If you take that timeline seriously, the AI workflow you have now is a two-year asset.

Most of the “stable tool stack” advice that worked from 2022 to 2024 stops applying. The piece on the Claude for Small Business launch is a preview of where the practical product layer is moving, and that compression accelerates from here.

Here is the quick-reference version of what changes and what to watch:

The analysis from Interesting Engineering covers the geopolitics in more depth if that angle is what you came for. What I have not seen anyone write yet is the everyday-user version of this paper, which is what I wanted to give you here.

If you want a worked example of how to think about your own AI stack against this paper, here is the framing I have been using when readers ask me what to do next:

Vague: “Is my AI setup going to break by 2028?”

Specific: “Which of my current AI tools (1) routes through providers Anthropic flags as proprietary-shifting Chinese labs, (2) depends on open-weight bases that may face new restrictions, or (3) relies on fine-tuned local models trained on synthesized frontier outputs? For each, what is my fallback if that path closes?”

The vague version gets you a generic “things will change” answer from any AI tool. The specific version gives you a checklist you can act on this week.

What Comes Next

The next concrete test of the Anthropic agenda is the Senate vote on the remote-data-center loophole bill, with Mythos general availability and the next CAISI safety evaluation cycle as the second and third signals to watch over the next 60 days.

The Senate has not yet voted on the bipartisan bill that passed the House 369-22 in January to close the remote data center loophole. That vote is the first concrete test of whether Washington is moving on the Anthropic agenda or just nodding at it. Watch that vote.

Watch also for Mythos full release. Anthropic released the Preview to select partners under Project Glasswing in April.

The full release timeline determines whether the 2028 timeline in the paper is real or whether it is a forward projection. If Mythos hits general availability with the 20x productivity claim intact, the policy debate accelerates. If it stalls, the timeline slides and the urgency arguments soften.

And watch for the next CAISI safety evaluation cycle. If the gap between the 94 percent compliance rate on DeepSeek R1-0528 and the 8 percent on US reference models persists or widens, Anthropic gets the empirical basis for harder export controls. If Chinese labs close that gap quickly, the “democratic norms in AI” argument loses one of its few measurable anchors.

The thing the paper does not say but I think follows from its logic: if compute and algorithm both compound, and open-weight is reframed as a liability, and distillation gets treated as espionage, the AI landscape in 2028 looks much more concentrated than it does now. Whether that is a feature or a problem depends entirely on which of the two scenarios in the paper plays out.

What I would not bet on is the situation looking the same in twelve months. The pace of policy change that follows a paper like this one is usually slow, but the underlying technology pace is not. The smarter posture is to assume your AI stack will look very different by mid-2027, and to keep your tools and workflows portable enough to absorb that change.