The Dangers of Free China-Based AI: Why Kimi Should Give American Users Pause

Kimi K3, the newest flagship model from Beijing-based Moonshot AI, topped a major frontend-coding leaderboard this month, and nearly every review ends the same way: it’s free, go try it. Millions of Americans and thousands of companies are doing exactly that. Before joining them, it is worth asking a question that rarely appears in the benchmarks: where does everything you type actually go?

What the fine print says

Moonshot’s own privacy policy states that user prompts and uploaded content may be used to train and improve its models. Unlike ChatGPT, Claude, and even DeepSeek, Kimi’s consumer product documents no in-product opt-out for model training as of mid-2026. The policy also never names the jurisdiction where user data is stored, saying only that data may be transferred to and held on servers outside your country of residence. The consumer service’s controller of record is a Singapore entity, Moonshot AI PTE, but the company, its engineering, and its infrastructure are Chinese.

That last point matters because of a law most users have never heard of. Article 7 of China’s National Intelligence Law requires all organizations and citizens to “support, assist, and cooperate” with state intelligence work. China’s Cybersecurity Law and Data Security Law layer on additional obligations for data access and localization. Whatever assurances a Chinese AI company offers its foreign users, it cannot contract its way out of its own government’s legal authority. When an American startup uploads its codebase, or a paralegal pastes a draft brief, or a job seeker uploads a resume, that content enters a legal environment in which the Chinese state has a standing right of access.

This is not a hypothetical concern about competence, either. In April 2026, Kimi disclosed one user’s private resume, including name, phone number, and work history, to a different user during a routine session, a data-isolation failure that was verified as authentic and prompted legal action in China. Independent safety testing has been similarly unflattering: red-team evaluations of Kimi K2 found raw safety-benchmark performance among the lowest of any frontier model tested.

Key points:

• Moonshot’s privacy policy allows user prompts and uploads to be used for model training, with no documented in-product opt-out for consumers.
• The policy never names where your data is stored; it only says data may leave your country of residence.
• Article 7 of China’s National Intelligence Law compels Chinese organizations to cooperate with state intelligence work — no user agreement can override it.
• Kimi has already suffered a verified privacy failure: one user’s full resume was leaked to another user in April 2026.
• Independent red-team testing found Kimi K2’s raw safety-benchmark performance among the lowest of any frontier model.

The scale of the exposure

The exposure is not marginal. Security researchers at Harmonic tracked roughly 700,000 Kimi interactions inside UK and US enterprises, making it the most-used China-based AI tool in Western workplaces, ahead of DeepSeek. Employees are pasting in exactly the material you would expect: source code, contracts, financial models, customer data. Every one of those interactions leaves institutional boundaries and crosses into a foreign jurisdiction. For regulated industries the problem is acute: a hospital or pharmaceutical company that passes protected health information through Kimi’s hosted API has no Business Associate Agreement, no HIPAA assurances, and no meaningful recourse.

American governments have already reacted to the previous iteration of this problem. After DeepSeek’s breakout in early 2025, at least 21 state attorneys general, along with individual states including Texas, Alabama, and Oklahoma, banned Chinese-origin AI applications from government devices over data-storage and national-security concerns. Kimi presents the same structural issue with a larger user base.

Key points:

• Roughly 700,000 Kimi interactions have been tracked inside UK and US enterprises — the highest of any China-based AI tool, ahead of DeepSeek.
• Employees are pasting in source code, contracts, financial models, and customer data, usually without IT’s knowledge.
• Regulated data (health records, clinical data) sent to Kimi’s hosted API travels with no BAA, no HIPAA assurances, and no recourse.
• At least 21 state attorneys general plus states like Texas, Alabama, and Oklahoma already banned Chinese AI apps from government devices after DeepSeek.

A pattern with a long history

Skeptics will say this is paranoia about a company that has simply built a good product. But the concern does not exist in a vacuum. It sits atop three decades of documented, systematic intellectual-property extraction from American firms.

The US Trade Representative’s Section 301 investigation in 2018 concluded that China engaged in forced technology transfer, cyber-enabled theft of trade secrets, and discriminatory licensing practices as a matter of industrial policy. The FBI and the Commission on the Theft of American Intellectual Property have estimated the annual cost to the US economy at between $225 billion and $600 billion. The case files are concrete: Sinovel stole wind-turbine control software from Massachusetts-based AMSC and nearly destroyed the company; Fujian Jinhua was indicted for stealing Micron’s DRAM designs; Huawei employees were found by a jury to have stolen T-Mobile’s phone-testing robot technology, with internal bonus programs rewarding employees who obtained confidential information from competitors. Talent-recruitment programs, joint-venture requirements, and state-sponsored hacking campaigns such as the OPM breach round out the picture. The FBI has said it opens a new China-related counterintelligence case roughly every ten hours.

Artificial intelligence is the explicit centerpiece of Beijing’s industrial strategy, named in “Made in China 2025” and successor plans as a sector where China intends global leadership. And it is a race China entered without contributing a single foundational breakthrough. The transformer architecture that every modern LLM is built on was invented at Google. The scaling laws, the pretraining paradigm, the alignment techniques, the very idea of the chat assistant — all of it came out of American labs, American universities, and American-funded research. Kimi, DeepSeek, and their peers exist because that research was published openly and because American GPUs, obtained legitimately and otherwise, made it runnable. Chinese labs have proven to be fast, talented followers and capable engineers, but the technological foundation they stand on was built entirely elsewhere. In some cases US companies allege the following went further than reading papers: OpenAI stated in 2025 that it had evidence Chinese developers used “distillation” of its models’ outputs to train competitors, in violation of its terms of service, and Chinese firms have worked persistently to acquire export-controlled American chips through intermediaries. The pattern — absorb the underlying technology by every available means, then compete against its inventors with state backing — is the same one American industry has watched play out in telecommunications, solar, rail, and semiconductors.

Free frontier-quality AI is, in this light, not just a product. It is an intelligence and industrial-policy asset. Every prompt is training data. Every uploaded document is a window into how American businesses, law firms, and laboratories actually work. A model given away below cost recoups its price in something other than dollars.

Key points:

• USTR’s 2018 Section 301 investigation found forced technology transfer and cyber-enabled trade-secret theft were Chinese industrial policy, not isolated crimes.
• Estimated cost to the US economy: $225–600 billion per year (FBI / IP Commission).
• Documented cases include Sinovel/AMSC (wind software), Fujian Jinhua/Micron (DRAM), and Huawei/T-Mobile (robot technology, with employee bonuses for stolen information).
• Every foundational LLM breakthrough — the transformer (Google), scaling laws, the chat paradigm — is American; Chinese labs built on openly published US research and US chips.
• OpenAI has alleged Chinese developers distilled its models’ outputs to train competitors, and Chinese firms have evaded US chip export controls through intermediaries.
• The playbook mirrors telecom, solar, rail, and semiconductors: absorb the technology, then out-compete its inventors with state backing.

What users and companies should do

None of this requires believing that Moonshot’s engineers are anything but sincere technologists. The risk is structural, not personal. The prudent responses follow directly from the structure.

Individuals should treat anything typed into Kimi’s hosted apps as potentially permanent, potentially training data, and potentially accessible to a foreign government. Nothing sensitive, no client material, no health information, no credentials, no unreleased work, should go in.

Companies should decide the question deliberately rather than letting employees decide it by default. Hundreds of thousands of enterprise interactions are already happening in the shadows. An acceptable-use policy that names Chinese hosted AI services explicitly, paired with sanctioned alternatives employees actually like, closes most of the gap.

Organizations that genuinely want Kimi’s capabilities have a cleaner path: Moonshot releases open-weight versions of its models, and weights running on your own infrastructure send nothing to Beijing. Self-hosting requires real technical investment, but it separates the legitimate question “is this model good?” from the dangerous one “who else is reading?”

And policymakers should extend the logic already applied to DeepSeek: government devices and contractors handling sensitive data have no business routing it through infrastructure legally answerable to a strategic adversary.

Key points:

• Individuals: assume everything typed into Kimi’s hosted apps is permanent, trainable, and accessible to a foreign government — keep out credentials, client material, health data, and unreleased work.
• Companies: set an explicit acceptable-use policy naming Chinese hosted AI services, and offer sanctioned alternatives employees will actually use.
• Organizations that want the model: self-host the open-weight releases on your own infrastructure so nothing is sent to Beijing.
• Policymakers: extend the DeepSeek-era bans — no government devices or sensitive contractors on Chinese-jurisdiction AI services.

The AI race will be won partly on capability and partly on trust. American users handing their data, their documents, and their working lives to a service under Chinese jurisdiction are giving away the second while subsidizing the first. The model may be free. The data you feed it is the payment.

Brian James Curry is a Kansas City–based data scientist and applied Machine Learning and AI researcher working at the intersection of economic modeling, causal inference, and machine learning — with a standing preference for models where the economics is load-bearing. He is the founder of Vector1 Research, an independent lab exploring marketing economics, cognitive AI architecture, and AI-driven enterprise transformation, with research contributions including Papilon, PyCausalSim, and Memory-Node Encapsulation. His twenty-plus years of enterprise work span Koch Industries, Tractor Supply, Vail Resorts, Hallmark, Garmin, and AT&T.