The Cloud Loophole: China's AI Firms Skirt Nvidia Export Controls

The United States has spent three years building what its own officials call the most rigorous export-control regime in modern history, all organized around a single assumption: if Washington stops Nvidia's best chips from physically crossing into China, it stops Chinese AI development in its tracks. That assumption is now crumbling. Chinese AI firms have found a loophole that doesn't require moving a single GPU across a border. They are renting the compute remotely, and the export-control machinery has almost nothing to say about it.

What happened

A CNBC investigation published on August 19, 2026 found that Chinese AI companies are accessing Nvidia's most advanced chips, including the GB300, through data centers in Thailand, Malaysia, and Japan. Less than a week after Moonshot AI released its Kimi K3 model in July, White House official Michael Kratsios accused the company of using GB300 chips through a facility in Thailand. ByteDance, Alibaba, and Tencent have reportedly done the same, with ByteDance working through the Singapore-headquartered cloud provider Aolani to reach compute in Malaysia.

The crucial detail is that none of this is illegal under current U.S. rules. Cassia King, a senior researcher on the Compute Policy team at the Institute for AI Policy and Strategy, told CNBC that the export-control regime "controls physical AI chips. It does not cover remote access to those chips." Moonshot's compute access, she said, is legal "so long as Moonshot isn't actually buying and owning the physical hardware directly."

Why it matters

Compute, not code, is the binding constraint on frontier AI. Training a state-of-the-art model takes tens of thousands of accelerators running in concert, which is exactly why Nvidia's effective monopoly over the most powerful chips made export controls Washington's sharpest tool in the AI race. But that tool was built for an era of physical products. A chip has a serial number and a shipping manifest; a rented GPU-hour is borderless, fungible, and infinitely divisible. You cannot put a GPS tracker on a cloud workload.

The consequences are already visible on the leaderboards. Kimi K3, DeepSeek's newest systems, and Alibaba's Qwen have all posted sharp benchmark gains in recent months, and industry watchers directly credit access to overseas compute as a key factor. The cloud loophole is not a theoretical vulnerability waiting to be exploited. It is a live, active contributor to Chinese model capability right now.

The policy gap

Washington is moving to close the gap, but slowly. This is not the first overseas loophole officials have chased: in late May, the Commerce Department moved to require licenses for advanced chips shipped to China-headquartered subsidiaries outside the country, according to The Straits Times. Now the Remote Access Security Act (RASA) would extend export controls to cover the remote cloud-based access of critical hardware and software. It passed the House of Representatives in January but remains stuck in the Senate. And even if it passes, the hard part is not the law, it is enforcement.

Michelle Nie, a visiting fellow in technology and national security at the Center for a New American Security, warned that "cloud providers would bear the compliance burden of any KYC and customer verification requirements mandated by the bill." The Bureau of Industry and Security (BIS) could theoretically push through a rule quickly, possibly in a "matter of days" with White House support, but the real challenge is drafting something that is both effective and enforceable. Policymakers would have to decide what compute is covered, who is prohibited from remotely accessing it, and how to build a know-your-customer scheme robust enough to catch shell companies and intermediaries.

The scale of the problem is enormous. Real estate firm JLL estimates global data center capacity could roughly double to 200 gigawatts by 2030, and there are 31 planned data centers of 100 megawatts or more across Malaysia, Indonesia, and Thailand alone, compared to just two today, according to DC Byte. Southeast Asia is becoming the neutral ground where the world's compute lands, in part precisely because it sits outside the direct reach of U.S. export rules.

Builder impact

For AI builders and technical teams, this story matters in three concrete ways.

First, compute access is becoming a regulated, contested resource. The distinction between owning hardware and renting compute is about to become legally significant. Teams building or deploying agents at scale should watch RASA closely: if it passes, know-your-customer and geographic verification requirements will ripple through every cloud provider and could change how, and from where, you can buy compute.

Second, the geography of AI infrastructure is shifting. The data center buildout in Southeast Asia is not a footnote, it is a structural relocation of a large share of global compute. For anyone planning multi-region deployments or inference capacity, this region is emerging as a first-class home for AI workloads.

Third, open-weight models from China are a permanent fixture, not a temporary workaround. If overseas compute is a key driver of Chinese model capability, then the era of treating Qwen, Kimi, DeepSeek, and GLM as novelty challengers is over. Builders should plan for a genuinely multi-polar model landscape and stop assuming the frontier will remain a two- or three-company story.

What to watch next

Three signals will determine how this plays out. The first is the Senate's handling of RASA, which will decide whether the U.S. government gains authority over remote compute access at all. The second is any BIS rulemaking, which could arrive in days if the White House pushes it. The third is the quiet response of the major hyperscalers and Nvidia itself, who will bear the real cost of whatever compliance regime emerges.

If the bill passes and BIS moves fast, expect cloud providers to tighten onboarding for customers in, or with ties to, restricted jurisdictions. The export-control regime was built for chips. It is now, in real time, being rewritten for compute.