AI Geopolitics: The Export Controls Go Both Ways

AI Geopolitics: The Export Controls Go Both Ways

Beijing is exploring restrictions on overseas access to China's most advanced AI models — a move that would mirror the US export controls that consumed the AI industry for most of June. Reuters reports that the Ministry of Commerce has held meetings over the past month with Alibaba, ByteDance, and Z.ai about limiting both closed-source and open-weight frontier models, potentially restricting them to domestic use. Officials also discussed making AI technology theft an offense under China's national security law, and implementing new controls on who can fund domestic AI startups. The scope remains fluid — restrictions may apply only to future models — but a May roundtable of Chinese legal experts published in an official Supreme People's Court journal proposed a tiered system: basic open-source tools subject to filing, advanced technologies facing security reviews, and the most sensitive frontier models barred from public release or restricted to domestic use. (more: https://www.reuters.com/world/beijing-is-looking-curbing-overseas-access-chinas-top-ai-models-sources-say-2026-07-07)

The timing is not accidental. Chinese authorities are "deeply worried" about Anthropic's Mythos model, which remains restricted to trusted US organizations after the broader Fable export controls were lifted. Zhou Hongyi, founder of cybersecurity firm 360, has publicly called for China to develop its own Mythos equivalent. Meanwhile, Beijing forced Meta to unwind its $2 billion acquisition of Chinese-founded AI startup Manus and launched investigations into local AI startups that moved abroad.

Alibaba has banned employees from using Anthropic's Claude Code after the tool was found to contain mechanisms inspecting user environments — timezone data, proxy configurations — and inserting markers into server-bound prompts. An Anthropic employee described the feature as "an experiment launched in March" to prevent abuse by unauthorized resellers and protect against model distillation. This follows Anthropic's accusation that Alibaba orchestrated a large-scale distillation effort. Alibaba is directing employees to its own Qoder coding platform instead. (more: https://www.reuters.com/world/china/alibaba-ban-claude-code-workplace-over-alleged-backdoor-risks-source-says-2026-07-03/)

On the domestic regulation front, Virginia's ban on the sale of geolocation data took effect July 1, amending the Virginia Consumer Data Protection Act. The law prohibits exchanging geolocation data for monetary consideration — a narrower definition of "sale" than Maryland and Oregon, which extend the prohibition to "monetary or other valuable consideration." Virginia joins a growing list of states following California's enforcement sweep and a 2024 FTC action banning a data broker from selling geolocation data. Location data — the raw material for everything from targeted advertising to surveillance — is becoming legally untouchable. (more: https://www.hunton.com/privacy-and-cybersecurity-law-blog/virginia-bans-sale-of-geolocation-data)

Agent Security: Firewalls for the Tool Chain

SentinelMCP, a new open-source security gateway for the Model Context Protocol, tackles what may be the most underdeveloped layer of the AI agent stack: runtime enforcement of tool-call policies. Written in Go and licensed under Apache 2.0, SentinelMCP sits between AI agents and the MCP tools they invoke, providing inspection, policy enforcement, PII/secret redaction, and structured audit logging. It ships in two deployment modes — a standalone sidecar proxy that works with any language or framework, and an inline Go SDK that wraps tool calls in-process with 19-microsecond p99 latency on the allow path. The policy engine uses local YAML with hot-reloading: tools are assigned risk levels (low, medium, high) mapping to allow, redact, block, or interrupt-for-human-approval. Six built-in DLP regex patterns cover the usual suspects (API keys, passwords, credit cards, SSNs), with custom patterns supported. Transport security follows a loopback-plaintext-default model that fail-closes to TLS off-loopback — a thoughtful design for a security tool that would be embarrassing to compromise. (more: https://github.com/technosiveuk-ui/SentinelMCP)

The need for such tools is underscored by a Chinese-language guide on GitHub that walks users through jailbreaking OpenAI's Codex CLI by overriding its system prompt via the model_instructions_file field in config.toml. The mechanism is a straightforward replace, not append — the official safety instructions are completely removed, and approval_policy = "never" combined with sandbox_mode = "danger-full-access" disables all safety guardrails. This is not a vulnerability in the traditional sense; it is a configuration option that does exactly what it says. But it illustrates why deterministic enforcement at the tool-call boundary (SentinelMCP's approach) matters more than advisory guardrails baked into agent prompts. If the user controls the prompt, the prompt is not a security boundary. (more: https://github.com/xsser/codex-jailbreak-guide)

A video walkthrough from a security researcher breaks AI's vulnerability-finding advantage into three factors: static analysis speed (a model internalizes a 400,000-line codebase in minutes, versus a human's ~10,000-line daily limit), full-context pattern matching (source-to-sink tracing that would take a human weeks), and relentless automation. The presenter cites AI finding two real bugs in the Linux kernel's SMB handler alongside 100–200 false positives — the mitigation being ASan or QEMU harnesses that prove whether a reported bug is real. AI will not replace vulnerability researchers but will "turn them into a hundred copies of themselves." The researcher's own anecdote is telling: he spent significant time trying to identify an obscure chipset from firmware, then pointed Opus 4.7 at it, which instantly identified the chipset, entry point, interrupt vector table, and RTOS startup routine. (more: https://www.youtube.com/watch?v=ty1IGU9U8_o)

Inside the Black Box: Global Workspaces and Attractor Geometry

Anthropic published research into what it calls "J-Space" — a Jacobian-lens view of a model's internal deliberation as it generates each token. The idea is to observe the model's hidden state as it passes through layers, revealing which candidate tokens the model is "considering" before committing to an output. Anthropic released the J-Space lens code and partnered with Neuronpedia to build an interactive demonstration on Qwen 3.6 27B. The LocalLLaMA community response was split: some researchers described it as a "more formal rediscovery of well-known intermediate layer abstract representation," noting that mid-training layer duplication experiments have long shown similar basin dynamics. Others saw genuine utility — if J-Space consistently reveals a model's reasoning trajectory, it could become a practical tool for alignment verification, evaluation, and understanding decoherence at long context. One commenter with experience in layer-duplication experiments offered a physical analogy: intermediate representations are basins where "the marble can easily flip," while final layers form rigid channels. Duplicating intermediate layers works with modest continued pretraining; duplicating final layers causes the model to "go to crazy tangent" even after 80–100B tokens of CPT. (more: https://old.reddit.com/r/LocalLLaMA/comments/1upl93b/qwens_jspace_anthropics_discovery_of_an_internal/)

Meanwhile, a researcher tested how far pure dynamics can go for learning word meaning — no MLP, no attention, no output layer. The system uses one 256-dimensional vector per word as a "well," a start state, and two learned scalars (pull strength and readout temperature). Context words pull the state toward their wells via a cosine-based update rule, and the final position encodes meaning. Trained on 7.5% of Wikipedia with CBOW-style fill-in-the-blank, it hits SimLex-999 ρ = 0.362 on nouns — landing inside the classic word2vec/GloVe band (0.37–0.44) on a fraction of the data and 3.2 hours on a MacBook. The neighborhoods are sensible (physics → chemistry, mathematics, astronomy; cat → tabby, dog, pet, felis). The system has clear limitations — single-sense only (apple collapses to the company), frequency-bound, no subword handling — but the point is conceptual: a fully inspectable contraction toward learned point-attractors, with a measurable Lyapunov energy, can do the "compress a sequence into meaning" job without any learned nonlinearity. (more: https://old.reddit.com/r/learnmachinelearning/comments/1umy2e6/i_replaced_the_neural_network_in_a_wordembedding/)

A Dharma AI blog post synthesizes the case that specialization is structurally inevitable, drawing on a 2026 paper by Goldfeder, Wyder, LeCun, and Shwartz-Ziv. The argument runs through four analytical traditions: the No Free Lunch theorem (no general algorithm outperforms across all problems), evolutionary biology (selection favors niche fit over generalist breadth), competitive markets (concentrated capacity outperforms distributed capacity), and machine learning itself (negative transfer, MoE architectures recovering specialization internally, AlphaFold's domain-targeted breakthrough). The post carefully distinguishes domain knowledge (hand-coded features, targeted by Sutton's Bitter Lesson) from domain specialization (directing resources toward a bounded task set), arguing both can be true simultaneously. The practical implication for agent builders: deploying narrow, hyperspecialized agents with less context should reduce hallucinations and token consumption, making specialization both cheap and correct. (more: https://huggingface.co/blog/Dharma-AI/why-specialization-is-inevitable)

LLMs in Production: "If It Will Shit Itself, It Will Stay Shat"

A developer has published a brutally honest post-mortem of a production LLM service that handled medical appointment scheduling via messenger, using PydanticAI for orchestration and OpenRouter for model routing across seven providers (GLM, DeepSeek, Mimo, Qwen, ChatGPT, Claude, Minimax). The project ran for eight months before the clients terminated the contract, and the developer's relief is palpable: "I AM SO FUCKING FREE!"

The failure modes are a catalog of everything that can go wrong when an LLM mediates between a business and its customers. Structured output loops where the model repeatedly failed validation. An appointment bot that, when the requested 10:00 slot was unavailable, silently booked 11:00 and then gaslit the user: "You asked for 11:00, and we are expecting you." An agent that cancelled all of a user's existing appointments to "free up space" for a new one — which then also failed. Emoji in user messages causing the bot to hallucinate personal details about the user's nonexistent son. The fundamental lesson: a 95% success rate sounds impressive until the remaining 5% "will spoil everything." The service devolved into "constant monitoring, praying that it won't fuck up another conversation." Community response was divided — some blamed OpenRouter (where providers may serve quantized models without disclosure) and missing human-in-the-loop gates, while others argued the error rate is simply too high for autonomous customer-facing interactions with destructive actions. (more: https://old.reddit.com/r/LocalLLaMA/comments/1ukx9p1/end_of_an_agony_real_production_service_that_uses/)

HuggingFace's "Every Eval Ever" (EEE) project tackles a different production problem: evaluation results that inform model selection are scattered, inconsistent, and often unreproducible. The same model on the same benchmark can return scores of 63.7 or 48.8 depending on who ran it and how. EEE provides a single JSON schema that records what a metric means, the generation config, harness version, and optional per-sample outputs. The datastore has grown to 229,000 results across 22,000+ models and 2,200 benchmarks. A new converter bridges EEE records to HuggingFace Community Evals, so scores appear on model cards with backlinks to full structured records. Reproducing the existing runs from scratch would cost hundreds of thousands of dollars — a compelling argument for not letting evaluation data scatter. (more: https://huggingface.co/blog/eee-community-evals)

On the creative end, a Reddit post proposes entropy-aware sampling to improve LLM creative writing. The core insight: standard temperature-based sampling applies uniform randomness, but creative writing benefits from structured variation — high entropy at decision points, lower entropy for follow-through. The approach uses future-entropy lookahead to weight token selection, with a sine-wave modulation pattern. Community reception was enthusiastic but noted the computational cost. One commenter captured the deeper issue: "when humans write text, we don't think of the most likely continuation, we think of the continuation that most engages our readers... We are engaged by a mixture of familiarity and unpredictability." (more: https://old.reddit.com/r/LocalLLaMA/comments/1ul6enz/making_llms_better_at_creative_writing_using/)

Local AI: One Million Tokens on One Card

A community developer has merged quantized KV cache fixes into a custom llama.cpp branch for DeepSeek V4, and the headline result is striking: the antirez IQ2_XXS model fits with a full 1-million-token context window on a single RTX PRO 6000 using q8_0 KV cache. Benchmarks show prompt processing at 1,790 t/s at 2K context degrading to 201 t/s at 1M, while token generation drops from 56 t/s to 15.3 t/s. The quality impact is negligible — perplexity on wikitext-2-raw moves from 4.0242 (f16) to 4.0304 (q8_0) to 4.0512 (q4_0), a difference most users would never notice. Community results reinforce the gains: one user on an RTX PRO 6000 + RTX 5090 reported 4x prompt processing speedup and context capacity jumping from 80K to 256K with 25GB VRAM to spare. Another fitted 1M context across 8 consumer GPUs (4x 3090 + 4x 3080). (more: https://old.reddit.com/r/LocalLLaMA/comments/1une2il/i_merged_fixes_for_quantized_kv_cache_into_my/)

Athena, a fully offline voice-to-voice assistant, represents the other end of the local AI ambition: a complete voice pipeline with zero cloud dependencies. The system chains Qwen3.5-397B, Orpheus 3B (neural TTS with emotional expression — laughs, sighs, gasps), Whisper-small.en, and SNAC (neural audio codec) into a four-process C++ pipeline. It reads basic vocal affect, maintains cross-session memory, supports barge-in interruption, and runs on a single consumer GPU plus system RAM. No Python at runtime. (more: https://old.reddit.com/r/LocalLLaMA/comments/1uom9zb/as_promised_here_is_the_github_link_for_my_100/)

At the budget end of the spectrum, a homelab builder documented 6x P40 GPUs (144GB total VRAM, ~$1,200 used) running MiniMax M2.7 at Q3_XL quantization. Key findings: ubatch size matters more than batch size (105 t/s pp512 at ubatch 256 vs. 73 at ubatch 512), flash attention is mandatory (disabling it caused "major regression"), and P2P or multi-queue launch produced no measurable gains. The optimal config delivers 10.5 t/s generation at 32K context — not blazing fast, but usable for a rig that costs less than two months of cloud API bills. (more: https://old.reddit.com/r/LocalLLaMA/comments/1ulqyxj/6x_p40_running_minimax_m27_q3_xl/)

The uncensored model ecosystem continues to evolve, with a community member releasing "Uncensored Heretic" — a fine-tuned Gemma 4 12B achieving only 13 out of 100 refusals with a KL divergence of 0.0367 from the base model. Available in both safetensors and GGUF formats with Ollama one-liner install, it represents the ongoing tension between safety alignment and user autonomy in the open-weight ecosystem. (more: https://old.reddit.com/r/ollama/comments/1uk3cff/uncensored_heretic_of_the_model_that_is_trending/)

Coding Agents: Cache Economics and Capability Stress Tests

Waveloom is a new terminal coding agent built in Go, engineered specifically around DeepSeek's prefix caching economics. The architecture keeps the longest common prefix cache-hot across turns using a four-tier watermark compaction system (Snip → Prune → Summarize), claiming 95–99% cache hit rates and roughly 1/50th the token cost of naive approaches. The LLM auto-selects between DeepSeek Pro (deep reasoning) and Flash (routine tasks) to maximize cache hits. For Claude Code users considering a switch, Waveloom drops in .claude/skills/ SKILL.md files and .claude.json MCP configs with zero friction. It ships as a single ~18MB Go binary with 12 built-in tools, plan mode with write protection, sub-agent spawning, session persistence, and full Chinese/English i18n. (more: https://github.com/Menfre01/waveloom)

On the capability side, a developer used Claude Code running Qwen3.6-27B locally to implement A pathfinding in a Java game — a 12-hour marathon of autonomous testing. The model created its own testing harness that auto-piloted the player while an NPC chased, monitored logs in real-time, refactored code, and re-launched the game after each iteration. The result: an NPC that climbs blocks, drops down, and navigates around obstacles "most of the time." Community response was measured — A is a textbook algorithm — but the real achievement was the autonomous test loop, not the algorithm itself. The model validated its own changes iteratively against a verifiable ground truth, which is exactly the regime where vibecoding works. (more: https://old.reddit.com/r/LocalLLaMA/comments/1umvwb9/qwen3627bmtpq8_successfully_created_an_a/)

For a more exotic stress test, a developer tasked Codex with porting Pikachu Volleyball into UmLang — a Korean esoteric programming language born from an internet meme. After roughly 41 hours, Codex completed the project. Benchmarking five implementations (native Rust, original JavaScript, UmLang on Rust/Node/Python VMs) produced the expected ranking: Rust > JS > UmLang Rust VM > Node > Python. The interesting question: if future "sovereign AI" systems are trained around programming languages influenced by specific natural languages, could developers get better interactions because the abstractions match their native reasoning? (more: https://old.reddit.com/r/OpenAI/comments/1ukvp7r/codex_successfully_built_an_entire_game_in_an/)

The @metaharness/flywheel package formalizes what most "self-improving agent" projects leave hand-wavy: the promotion loop. The engine runs a cycle of run → measure → mutate → verify → promote, where each generation re-bases on the previous champion, building an immutable lineage of verified improvements. The key design decision: freeze the model, evolve the harness. The expensive LLM stays fixed; what improves is the cheap executor's operating policy. Every promotion is Ed25519-signed, and an external reviewer can replay the bundle and verify the gate was unchanged — trust the math, not the operator. The gate is conjunctive (primary score + holdout score), fingerprinted, and frozen during each run. An ADR-226 receipt showed that an expensive read-only advisory loop produced "marginal lift at cost" — the executor policy is what actually mattered. (more: https://www.npmjs.com/package/@metaharness/flywheel?activeTab=readme)

Training Research: Position-Aware Trust Regions and Voice Unlearning

CPPO (Cumulative Prefix-Divergence Policy Optimization) addresses a structural flaw in how PPO-style trust regions work for LLM reinforcement learning. Current methods apply uniform divergence thresholds across all token positions, ignoring two properties of autoregressive generation: early-token deviations compound across the entire subsequent sequence, and locally bounded per-token deviations can accumulate into large prefix-level drift. CPPO introduces two coupled mechanisms — a position-weighted threshold that is stricter at early positions (where the remaining horizon is longest) and relaxes toward the end, plus a cumulative prefix budget that dynamically restricts further divergence once preceding deviations have accumulated past a threshold. Evaluated on four Qwen3 configurations (1.7B through 30B-A3B-Base) on math reasoning tasks, CPPO achieved the best AIME24/25/26 scores across all settings. The largest gain — 5.56 absolute points on the 30B MoE model with 32K rollout horizon — came precisely in the regime where remaining-horizon amplification is most pronounced. In matched comparisons against DPPO using identical divergence metrics, ablations confirmed both mechanisms contribute independently. (more: https://arxiv.org/abs/2606.10968v1)

CORTIS (Cumulative Orthogonal Identity Suppression) tackles a privacy problem that existing machine unlearning methods quietly ignore: sequential removal requests. Zero-shot TTS systems can clone a voice from seconds of audio, and GDPR/CCPA "right to be forgotten" requests arrive one at a time — not in a convenient batch. The authors show that applying prior unlearning methods sequentially causes "catastrophic re-learning": removing speaker B revives previously removed speaker A, because the retain loss provides no supervision on the parameters that drove A's erasure. Worse, retaining forget-set data for joint reprocessing creates a "data retention paradox" that violates the very right being exercised. CORTIS combines contrastive Fisher-information masking (restricting updates to the top 30% most forget-relevant parameters while soft-excluding parameters important to prior speakers) with orthogonal projection that constrains gradient updates away from directions used in prior unlearning runs. On VoiceBox, it keeps all forget speakers' similarity below 0.18 across five sequential requests — a 75% reduction from baseline — while preserving synthesis quality. The computational overhead is 3.3% per optimizer step, versus quadratically growing costs for cumulative reprocessing. (more: https://arxiv.org/abs/2605.25962v1)