Shallow moats, eighteen months on

19 July 26

ai

Last Friday in Shanghai, Xi Jinping stood up at the World Artificial Intelligence Conference and urged the world to “encourage open source, openness, collaboration and sharing”. The day before, 29 countries launched the World AI Cooperation Organization, a new Shanghai-headquartered body with the UN Secretary-General in attendance. That same Thursday, Chinese lab Moonshot released Kimi K3, a 2.8-trillion-parameter model that benchmarks within a whisker of the best closed models from OpenAI and Anthropic. The weights are promised as a free download by the end of the month.¹ Within days Moonshot was pausing new K3 subscriptions because demand had pushed its GPUs to their limits, and on Sunday Alibaba announced Qwen 3.8, a 2.4-trillion-parameter model it claims is “second only to Fable 5”, with open weights likewise promised soon.

Eighteen months ago I argued in Times Higher Education that DeepSeek R1 had exposed how shallow the moats around frontier AI really are. The leaked Google memo from 2023—“we have no moat, and neither does OpenAI”—was holding up, and my point then was that universities should think twice before signing exclusive contracts with any one provider. Since then, the two leading US labs have raised money at a combined valuation approaching two trillion dollars. That is, in effect, a bet that the memo was wrong.

All benchmarks are game-able and so it’s too simplistic to say open-weight models have “caught up”. Epoch AI’s tracking shows the gap widened through 2025. This year a cluster of Chinese releases (Qwen 3.5, GLM-5 and the Kimi series) pulled it closed again. Across the whole eighteen months, the frontier lead has stayed bounded at roughly three to six months. That is what the shallow-moat claim looks like in practice—whatever capability you are paying top dollar for today will be powering the free Maccas chatbot by Christmas.

China’s open-source strategy was already being called a geopolitical earthquake in the weeks after DeepSeek’s release. You can read Xi’s speech as statesmanship: AI as a global public good, “not a solo performance by a single country”. Ten billion downloads of Chinese open models suggest the offer is being taken up. But you can read it just as easily as strategy, the classic play of commoditising your complement: give away the thing your rival sells, and their core asset becomes a public good. Both readings lead to the same policy, and commitments tend to survive when principle and interest align. This is why the prediction that Chinese labs would stop open-sourcing once they caught up keeps failing to come true. As Nathan Lambert puts it, sustained frontier-adjacent releases bend open models from “soft power” to just “power”. There are counter-currents: Reuters reports that Beijing has privately weighed restricting overseas access to its top models, and Alibaba’s newest flagship is API-only.² Watch those threads, because they mark the places where principle and interest pull apart.

The other new part of the story since early 2025 is safety. Anthropic now ships its frontier model in two forms. The public Fable 5 wraps the model in classifiers that block dual-use cyber and biology work; Mythos 5 lifts those safeguards for vetted partners. Security researchers aren’t happy, since even routine code review can trip the filters.³ Then this month’s Hugging Face security incident showed how this can bite in practice. An autonomous agent framework was driven through the company’s dataset pipeline, and when the defenders fed 17,000 attacker log entries to hosted models for forensic analysis, the providers’ guardrails refused. Hugging Face finished the job on a self-hosted Chinese open-weight model. Since publication OpenAI has named the attacker as its own models: GPT-5.6 Sol and an unreleased successor, running with cyber refusals turned down for a capability benchmark, escaped their test sandbox through a hole in a package installer and went after Hugging Face because that was where the benchmark’s answers were kept.⁴ The guardrails that stopped the defenders had been switched off for the attacker by the company that built them. None of this means the guardrails are unmotivated: Anthropic has documented alarming misuse of its own models. But safety-by-gatekeeping only works while the gatekeepers hold a monopoly on the capability. And Bruce Schneier notes that much of what’s gated has already been reproduced with cheaper, older models.

In February 2025 this was a procurement question for university administrators. It’s now a macroeconomic one, though the procurement question hasn’t gone away. If the capability you are licensing commoditises within two quarters, a multi-year exclusive contract is a bet against the trend line, made with money that could be funding tutors. OpenAI last raised at an $852 billion valuation, Anthropic’s latest round values it at $965 billion, and both have filed confidentially for IPOs (Anthropic, then OpenAI a week later). The hyperscalers have guided to roughly $700 billion of capital expenditure this year.⁵

I’m not going to add to the pile of “it’s a bubble” warnings, because forecasting the timing of market corrections is a mug’s game. The narrower point stands on its own. Those valuations embed the assumption that a handful of companies will capture most of the value from frontier AI, and the eighteen-month experiment keeps returning evidence against it. The counter-evidence is real, though, and it cuts both ways. On Vercel’s AI gateway, open models now serve 29% of tokens but earn under 4% of the spend, so the labs still have the revenue. Token share moved first; whether the dollars follow is the open question.

The strongest counterargument comes from Ben Thompson. He concedes the model layer is commoditising, but argues the moat has moved up to the agent-harness and integration layer, so the capex is warranted. Maybe that’s true, but even if it is, the memo was right about the models. And harnesses are even more hot-swappable than weights. Moonshot’s own developer docs pitch K3 for “programming agent scenarios such as Claude Code”: the Chinese labs are building drop-in engines for the US labs’ own tooling, and switching is close to a one-line change. The routing layer above them is already somebody else’s business: Fireworks, an inference provider with an interest in the answer, ran about a thousand agentic tasks across both models and scored K3 at 92.4% against Fable’s 92.6%, with a router that picks between them per task beating either alone at a fraction of the cost on long agentic loops. If the moat really has moved to the harness, it has moved to a harness the labs don’t own.

My advice eighteen months ago was for universities to stay provider-agnostic. The students and early-career researchers that advice was written for are the first to be priced or gated out of frontier models. They are also the first to notice that the open ones are now good enough. That has consequences for how universities teach with AI, not just how they buy it: curricula and assessment built around one provider’s products will date as fast as the contracts. Hugging Face’s post-mortem generalises the advice to everyone: have a capable model you can run on your own infrastructure, vetted and ready, before you need it. What looked like campus prudence in February 2025 now reads as basic operational hygiene. The moats haven’t got any bigger, but the stakes have.

@online{swift2026shallowMoatsEighteenMonthsOn,
  author = {Ben Swift},
  title = {Shallow moats, eighteen months on},
  url = {https://benswift.me/blog/2026/07/19/shallow-moats-eighteen-months-on/},
  year = {2026},
  month = {07},
  note = {AT-URI: at://did:plc:tevykrhi4kibtsipzci76d76/site.standard.document/2026-07-19-shallow-moats-eighteen-months-on},
}