I’m very pleased to have had my first policy memo @iapsAI published! Shortly after the memo was finalised, MiniMax announced it was too offering an ‘always on’ AI agent service, similar to Moonshot. There are serious security risks associated with these offerings. Depending on how our policymakers respond, they could make the TikTok case in the US look trivial with the benefit of hindsight. Right now, there is an opportunity to act proactively to manage the security risks associated with these tools and ensure the public is properly informed about the potential implications for their data security and privacy. As we learnt from the TikTok case, the room for political manoeuvre can be much smaller when the target of government action is something that has become deeply embedded in our lives. I’m all for having agents in my life but they must be reliable, robust and secure. KimiClaw and MaxClaw are far from that! Thanks to my wonderful IAPS colleagues for all of their support and feedback on this first piece. Here’s to many more!

New analysis from my colleague Erich Grunewald in The Substrate: Where will China get its compute in 2026? Four pathways: (1) ~60% legal NVIDIA H200 imports (~230K B300-eq) - the US could cut this off entirely if it wanted (2) ~25% domestic Huawei Ascend 910Cs via SMIC (~40K B300-eq) bottlenecked by CXMT's HBM production, not chip fabrication (3) ~10% smuggled Blackwells (~20K B300-eq) - DeepSeek reportedly already using "several thousand" for next-gen models, according to @theinformation (4) <5% proxy fabrication via front companies (~2K B300-eq) - the old TSMC stockpile is likely exhausted Total: ~320K B300-equivalents. Enough for ~6 Grok 4-scale training runs simultaneously and ~600x what DeepSeek reported it used for V3. However, this is far less than what US companies will acquire. The Stargate campus alone will house ~300K B300-eq. Export controls are the main reason Chinese models lag behind the frontier. To maintain and widen this gap, the US could tighten HBM and semiconductor equipment controls and/or reverse the H200 decision, lower the volume cap, or, at minimum, avoid raising any of the volume cap or performance thresholds. Outside of this, preparing cloud access restrictions via the Remote Access Security Act, creating a whistleblower incentive program and improving BIS capacity can also be considered to bear down on remote access. Read the full post here: the-substrate.net/p/where-wi… CC @ohlennart