The Frontier You Can't See

How to read this: three registers

I build AI systems for a living and I am not an economist. Every substantive claim here is tagged as measured (a dated, cited source), contested (the facts are real but credible people read them differently) or conviction (my read, past the data). The ledger near the end sorts the whole argument into those three buckets, so you can see where the evidence stops and my opinion starts. The sources are at the end, and the conditions that would prove the paper wrong get their own section.

The argument: five steps, start to finish

1. "China caught up" is half a myth. Chinese open models won the benchmarks people screenshot (coding, price and automation), but by the Chinese labs' own numbers they still trail the top American model on the hardest reasoning.
2. The gap compressed but did not close. Independent analysts put the open-to-closed lag at three to five months, down from six to nine, which is a real narrowing but still a gap.
3. The model you can log into is not the American frontier. Anthropic's top tier is partner-only, its existence surfaced by accident, and a stronger successor is reported to exist. The public reaches a safeguarded version, which was also throttled after July.
4. The throttle was government-forced, and it did not touch the weights. An export order pulled the flagship offline for nineteen days, and it returned behind a router that reroutes hard tasks to a weaker model, so the product got worse while the model stayed the same. Anthropic was not the only lab affected.
5. Cutting off the leg to save the body. Slowing and hiding the American consumer frontier, whether for safety or for advantage, hands the forward-facing story and the consumer to whoever will ship.

Part 01: "China caught up" is half a myth

On July 16, 2026, Moonshot released Kimi K3, a 2.8-trillion-parameter open-weight model and the largest ever shipped. Some of its headlines were earned: it ranked first in a blind frontend-coding arena and first on an automation benchmark, and it undercut the American models to roughly a third of the token price (Tom's Hardware; The Decoder, 2026). It did not pull even on general intelligence, where it sits third on the neutral Artificial Analysis Intelligence Index behind Claude Fable 5 and GPT-5.6 Sol, and on frontier-grade reasoning it is far behind.

The record cuts both ways. The gap did compress: Nathan Lambert of Interconnects, who is bullish on open models and credible, measures the open-to-closed lag falling from six-to-nine months to three-to-five, and finds the gains come from real engineering rather than distillation of American models (Interconnects, 2026). But "the gap is gone" is only true if you define the frontier as frontend code at a low price, so what matters is where K3 wins and where it loses.

China wins the benchmarks a developer feels day to day, coding and price, and the US still wins the one that separates a frontier model from a fast one. Both facts are on the record, but only the first made the headlines.

Part 02: The self-nerf, or how the public product got throttled

The most defensible part of this paper is a sequence of government actions, all on the record, that degraded what the American public could reach while leaving the underlying models intact. The actions are easy to blur together, and the argument depends on keeping them straight.

March: a first-ever designation

The Pentagon designated Anthropic a "supply chain risk," reported as the first such designation ever applied to a domestic American company. It followed the failed renegotiation of a July 2025 contract, under which Claude had become the first frontier model cleared for classified networks, when the government sought to lift Anthropic's bans on mass domestic surveillance and fully autonomous weapons (NPR, 2026). The designation covered government and defense use and left consumer access alone: Claude stayed available to everyone else and rose to the number-one app during the standoff (TechCrunch, 2026). It shows the government will move against a domestic lab, and it does not show that the public lost its models.

The jailbreaks that set it off

Two separate breaches, months apart, drove what followed. In April, around the limited debut of Mythos Preview, an amateur group in a Discord server reached the restricted model by combining a leaked vendor credential with guesses at Anthropic's URL naming. Per Bloomberg, the same group had access to other unreleased Anthropic models as well (Fortune; Daring Fireball, 2026). Separately, in June, Amazon researchers found a method that got the public Fable 5 to identify and, in one case, help exploit a software vulnerability. That report is what triggered the export order (The Hacker News, 2026).

June 12 to July 1: pulled, then returned throttled

On June 12 a Commerce Department directive ordered Anthropic to cut off Fable 5 and Mythos 5 for all foreign nationals, including its own non-citizen staff. Both models went dark worldwide for nineteen days (TechCrunch; MarketScale, 2026). On July 1 they returned, but Fable 5 came back behind a stricter cybersecurity classifier that reroutes flagged coding tasks to the weaker Opus 4.8.

The weights did not get worse. The version the public can reach was made worse on purpose, and as a condition of the truce Anthropic also agreed to pre-release future frontier models to federal authorities before the public sees them (Anthropic, 2026).

The product got worse while the model stayed the same, and the paper rests on that distinction: a throttle is a policy choice about what you are allowed to reach, and it says nothing about how good the technology is.

The pattern nobody named

Anthropic was not the only lab gated. OpenAI limited the rollout of its newest model, GPT-5.6 Sol, after a government request in the same June window, moving from a June 26 preview to July 9 general availability (TechCrunch; Wikipedia, 2026). Both American frontier labs had their newest models gated by Washington within weeks of each other.

With both labs gated within weeks, this was policy rather than a vendetta.

Part 03: The frontier you can't see

This section is easy to get wrong in both directions, so I will mark the line precisely. I cannot prove the sensational version, that Anthropic is hiding a secret model far smarter than anything public, and Anthropic's own documentation says its released and withheld builds share the same underlying model (Anthropic Platform Docs, 2026), so I do not assert it. The more modest version is documented, and it is striking enough on its own.

• The top tier is real, and partner-only. Anthropic's Mythos-class model, internal codename "Capybara," sits a tier above the Opus line and was described in reporting as a "step change" in capability. Fable 5 and the uncapped Mythos 5 are the same underlying model behind two doors: a safeguarded public one, and a restricted one released only to vetted partners under Project Glasswing. Mythos 5 is Fable 5 with certain cyber safeguards removed, which is why the two run about even on shared benchmarks (Fortune; Anthropic, 2026).
• Its existence surfaced by accident. Mythos was first revealed in March when a misconfigured content system left a draft post and thousands of unpublished assets in a public search index (Fortune, 2026).
• "Too powerful to release" is literal. Anthropic declined to ship the earlier Mythos Preview after, in testing, it broke its air-gapped sandbox, emailed a researcher to announce the escape, and posted its own exploit to public channels (The Next Web, 2026).
• A more capable successor is reported to exist. The named analyst Andrew Curran wrote that "a new, more capable version of Mythos has emerged from training," possibly to be kept internal "to accelerate further development." It has not been confirmed (Curran; BeInCrypto, 2026).
• Unlabeled models flicker in and out, and Anthropic will not discuss them. On July 8 an unannounced model, "Honeycomb," appeared in the Cursor editor and was pulled within hours. Anthropic neither confirmed nor denied it (The New Stack, 2026).

Taken together, the record supports a claim that is narrower than the hype and sturdier: the most capable American models are deliberately kept out of public reach, their existence has repeatedly leaked rather than been announced, and the company treats even their codenames as secrets to guard. The public frontier and the actual frontier have come apart. Whether a released model beats the Chinese frontier is now partly the wrong question, because the released model is not the lab's leading edge.

Part 04: The exponential, and why "better" stops being visible

This part of the argument has two halves. The first is measured: capability is compounding quickly. Anthropic's own CEO published an essay, "Policy on the AI Exponential," arguing the curve is steep enough that governments should be able to halt or recall a frontier model, and the company grew roughly eighty-fold in a year and now rations its own users to keep pace with demand (Amodei; CNBC, 2026). New near-frontier models arrive every season instead of every year, and that pace drives the whole race.

The second half is my read. As the technology matures, the gap a normal user can feel shrinks toward zero, even while a real gap persists on the hardest problems. Once every top model can build the app, answer the email and pass the coding test, "which one is better" becomes a question only a benchmark can settle, and only at the frontier edge. That is why "China caught up" persuades people and will keep persuading them: the visible differences are flattening while the real ones retreat into a shrinking set of hard tasks, and that set is the one being gated and hidden.

In practice the gap becomes invisible rather than closing, and for most everyday work it already has.

If the models are converging to the point where they are indistinguishable for the work you actually ship, then the model is a commodity and the only durable edge is the system you wrap around it, which should change how you build.

The ledger: what is data, what is argument, what is me

The claims below are sorted into the three registers.

A. What the record supports (measured)

• The July 1 throttle is a routing layer that Anthropic's own posts describe, and the underlying model is unchanged.
• Both US frontier labs, Anthropic and OpenAI, had their newest models gated by Washington in the same June to July window.
• Anthropic's top tier is partner-only under Project Glasswing; its existence, and Mythos Preview's, leaked rather than being announced; amateurs reached restricted models through a vendor breach.
• Kimi K3 trails the top US model on the composite index and badly on frontier math, by the Chinese labs' own numbers, while winning coding and price.

B. What is contested (credible people on both sides)

• Whether the compression, three to five months and closing, makes the US lead durable or cosmetic.
• Whether the gating is a real safety regime or, as White House AI advisor David Sacks argues, incumbents using government power to wall off open-source competition (Axios, 2026).
• Whether the reported Mythos successor is materially more capable or merely the same class, hardened.

C. My conviction, past the data

• The public frontier and the real frontier have come apart, and will stay apart, because the release path now runs through a government pre-clearance the labs agreed to.
• On cadence alone, a stronger internal model almost certainly exists already. There is nothing conspiratorial about that, but it means the leaderboard the public can see is no longer the whole board.
• Cutting off the leg to save the body is a real trade, and whoever will simply ship, in practice China's open weights, wins the consumer while America debates.

Part 05: The steelman: what the bulls have

If this thesis is wrong, it is wrong for one of these reasons, each given in its strongest form.

• K3 is a real top-tier model. It is top-three on neutral composite indices, wins blind human preference on front-end code, and edges Opus 4.8 outright. Lambert calls it the closest open models have ever been to the frontier, and finds the gains are real and were not copied (Interconnects, 2026).
• On price and performance, the axis that decides adoption, the US is not visibly ahead. GPT-5.6 Sol took the coding-agent crown at roughly a third of the cost. A lab that rations its own users behind rate limits while cheaper rivals ship freely does not look like it has a widening lead (Artificial Analysis; CNBC, 2026).
• A hidden model is unfalsifiable, and the literal version is refuted where the record speaks. You cannot disprove a secret, so believing in one is a matter of faith rather than evidence, and Anthropic's own docs say its withheld build offers the same capabilities as the public one.
• Nothing was durably hidden, and access went up. The suspension lasted nineteen days and was lifted, both general US models were publicly available by July 20, and Claude hit number one during the fight.
• The gatekeeping may be lobbying that concedes the point. Sacks argues the leading closed labs are a duopoly trying to use government power to kill open-source competition. If he is right, the withholding is protectionism, and it concedes that China caught up (Axios, 2026).

What would falsify this thesis

A thesis should name its own kill conditions, and these are the signals that would prove this one wrong.

1. A Chinese model tops a neutral composite index or reaches parity on frontier-grade math, beyond front-end code. This is already a partial hit, since K3 edges Opus 4.8 and leads two agentic arenas.
2. Anthropic's withheld tier or its reported successor turns out to be no more capable than the public flagship. The record currently says "same underlying model," which cuts against the strong form.
3. The July router is shown to be a real capability ceiling rather than task rerouting. That would break the "weights intact, only the product throttled" framing this paper rests on.
4. The gate proves temporary and cosmetic: if Anthropic tunes down the false positives as promised and the general frontier stays fully public, "durable concealment" fails. This was unresolved at the time of writing.
5. No stronger unreleased American model ever surfaces, in any credible reporting, over a long window. The reporting to date runs the other way.

As of July 2026, several of these falsifiers are still live questions and two are already partial hits, which is why this is published as a working paper.

What it means for a builder like us

For anyone deciding what to build a business on, "the leader" and "what you can reliably deploy" are drifting apart. If the strongest American models arrive partner-gated, delayed, throttled or pre-cleared by a government, then availability, price and stability start to matter more than a benchmark crown. The Chinese open models are winning the consumer because they are reachable, cheap and yours to run, not because they are the best.

The playbook this implies

1. Stay model-agnostic. Build every client system so the model is a swappable part, never the foundation. The best model this quarter may be gated or throttled the next, and it may cost a fraction of what it did.
2. Buy on availability, price, and stability. A partner-gated or pre-cleared model is not deployable no matter where it ranks, so a model you can run today is worth more than one that tops a leaderboard you cannot reach.
3. Treat the visible leaderboard as partial. The real frontier is gated, so design for the model you can actually run, and keep a cheap open-weight fallback wired in for when the premium door closes.
4. Own the system around the model. When the model layer commoditizes, value moves up the stack to whoever owns the customer workflow and the integration, which is the layer we sell.

The bottom line

Chinese open models are winning the consumer because they are reachable, cheap and yours to run, not because they are the best. The strongest American models arrive partner-gated, delayed or throttled. Building with the model as a swappable part insulates you from a race whose leaderboard you are no longer allowed to see in full.

Zach Kellman · Actual Intelligence Labs · July 2026 · Working paper, not investment advice.