Anthropic's 2028 AI Leadership Paper: Two US-China Scenarios and Three Policy Demands

Anthropic released a paper titled "2028: Two Scenarios for Global AI Leadership" laying out its position on US-China competition in artificial intelligence. The core claim: democracies currently hold a substantial lead in compute, the most important input for frontier AI, and could convert that into a durable 12–24 month lead in model intelligence by 2028 — but only if policymakers close export-control loopholes, disrupt distillation attacks on US models, and accelerate global adoption of American AI.

Anthropic frames the stakes in stark terms. It says the political systems in which the most capable AI systems are built first will shape the rules and norms for how the technology is developed and deployed, and that those rules will determine whether AI is safe, whose security it protects, and whose interests it serves. The paper's stated objective is that responsibility for frontier AI should rest with democratically elected governments rather than authoritarian regimes.

The two 2028 scenarios, in brief

Anthropic presents two hypothetical futures for 2028, the year by which it expects transformative AI systems to have arrived.

Scenario one — democracies hold a commanding and expanding lead. The US and its allies defend their compute advantage. Policymakers tighten controls on advanced compute reaching PRC labs, close loopholes around smuggled chips and foreign data center access, curb semiconductor manufacturing equipment (SME) gaps, and disrupt distillation attacks. US frontier models end up 12–24 months ahead on intelligence, with the lead growing. Anthropic states that when US labs release models in 2028 achieving step-function capability advances — comparable in relative impact to Mythos Preview in April 2026 — China would not have access to similar capabilities until 2029 or 2030. In this scenario, democracies set the rules and norms around frontier AI, and Anthropic says this is also the world in which successful safety engagement with China is most likely.

Scenario two — the CCP-controlled AI ecosystem is neck-and-neck. Policymakers do not act. Loopholes on CCP compute access remain open, distillation attacks continue, and PRC labs catch up to the frontier or overtake it. In this scenario, AI norms and rules are shaped by authoritarian regimes, and Anthropic warns that the best models enable automated repression at scale. The paper states that in this world, Beijing's "AI+" adoption policies let China deploy near-frontier capabilities advantageously across economic, military, and technological domains, and that Huawei and Alibaba data centers — running older chips and hosting cheaper, second-tier models — extend CCP influence in lower-cost markets, especially in the Global South.

Anthropic's summary of the choice is blunt: "Our past success means that our present task is largely to avoid squandering our advantage: to decide not to make it easier for the CCP to catch up."

Compute is the decisive input in the competition

Anthropic argues that compute — the advanced semiconductors used to train and deploy frontier AI — is the essential input on every front of the competition. The paper states that for more than a decade, model capability has scaled with compute, and that the majority of historical performance gains in AI capabilities have come from simply using more of it. Compute is required both for training the most intelligent models and for inference, meaning the capacity to serve customers' use of AI.

Anthropic's position is that access to top talent, large data sets, and algorithmic advances all matter, but each is irrelevant if compute is insufficient. It further argues that algorithmic improvements are "both a function and a multiplier of compute, not a substitute for it," because discovering those advances is itself a compute-intensive process — more compute enables more experiments, which enables more algorithmic discoveries. As frontier models increasingly conduct AI R&D themselves, Anthropic says that loop tightens and compute advantage compounds into algorithmic advantage.

The current compute gap

Anthropic claims the compute gap between the US and China is widening, not narrowing. Key figures cited in the paper:

• An analysis of Huawei and NVIDIA roadmaps found Huawei will produce just 4% of NVIDIA's aggregate compute in 2026 in total processing performance, and 2% in 2027.
• NVIDIA represents only part of the US and allied compute ecosystem; Google and Amazon are ramping up production of their own chips (TPUs and Trainium, respectively).
• China has made little progress in many of the most technologically complex segments of the semiconductor supply chain. Without access to extreme ultraviolet (EUV) technology — and even more so if policymakers close loopholes on deep ultraviolet (DUV) technology and its servicing and maintenance — Anthropic says China's chipmakers cannot manufacture chips in sufficient quantity or quality to challenge US compute leadership.
• China's inability to manufacture high-bandwidth memory at scale further widens the gap.
• One study estimates that if the US strengthens restrictions on CCP compute access, America would have access to roughly 11 times more compute than China's AI sector.

Anthropic attributes the lead to two causes: commercial innovation by companies including NVIDIA, AMD, Micron, TSMC, Samsung, and ASML across democracies such as Japan, South Korea, Taiwan, the Netherlands, and the US; and bipartisan US policy action across the last three presidential administrations that restricted PRC firms' access to the US AI stack.

The four fronts of AI competition

Anthropic says the US-China contest is not a "race" with a finish line but an ongoing contest for advantage, fought on four fronts:

1. Intelligence — which countries develop the most capable AI models.
2. Domestic adoption — which countries integrate AI most effectively across commercial and public sectors.
3. Global distribution — which countries deploy the global AI stack on which the world economy runs.
4. Resilience — which countries sustain political stability through the economic transition.

Anthropic identifies intelligence as the most important of the four, calling frontier model capabilities the primary driver of geopolitical competition as well as of market adoption and global distribution. But it argues intelligence alone is not sufficient: if the CCP integrates near-frontier AI faster into its economy and security apparatus, and drives global adoption of subsidized low-cost AI, it could secure advantages that overcome an intelligence deficit. The paper cites Beijing's "AI+" Initiative and its focus on "embodied intelligence," alongside the Trump administration's AI Action Plan and its emphasis on promoting export of the American AI technology stack, as evidence both governments see adoption as strategic.

How PRC labs stay close: two workarounds

Anthropic says export controls have been effective but have not gone far enough. It identifies two channels through which AI labs in China remain close to the frontier despite compute constraints.

1. Illicit and evasive compute access

Anthropic describes China's evasion of US export controls as "an open secret" and cites several reported examples:

• Federal prosecutors charged a Supermicro co-founder and two others with diverting $2.5 billion worth of servers containing advanced US chips to China.
• According to US government and media reports, DeepSeek trained its latest model on advanced US chips banned from sale to China.
• The Financial Times reported that Alibaba and ByteDance now train their flagship models on export-controlled US chips in data centers located in Southeast Asia — a route Anthropic says current controls do not reach because US export law covers the sale of chips, not remote access to them.

2. Illicit model access via distillation attacks

Anthropic describes distillation attacks as operations in which China-based labs create thousands of fraudulent accounts to circumvent access controls on US AI models and systematically harvest their outputs to replicate frontier capabilities. The paper calls the practice "systematic industrial espionage of a technology critical to long-term US national security interests" and says it lets labs in China achieve near-frontier capability at a fraction of the cost, subsidized by the United States.

Anthropic notes that OpenAI, Google, Anthropic itself, and the Frontier Model Forum have all publicly condemned distillation attacks. It also cites acknowledgments from within China: a recent article in a state-owned media outlet described distillation attacks on US models as the "back door" China's AI labs depend on as a core part of their business model, and an ex-ByteDance researcher said PRC AI labs use distillation as a shortcut to train models, avoiding investment in their own data pipelines.

On the policy response, Anthropic points to a White House Office of Science and Technology Policy memo on distillation attacks, attention from senior officials in the White House and Department of War, and legislation from the House Foreign Affairs Committee that passed out of committee unanimously.

Safety risks in a neck-and-neck race

Anthropic argues that a close US-China race would make industry and government-led safety and governance efforts harder and less likely. If PRC labs are close behind or at parity, Anthropic says private AI firms in both countries would feel more pressure to release models faster without prudent pre-deployment safety measures, and governments would become reluctant to enact responsible-AI policies for fear of falling behind.

The paper cites several data points on Chinese lab safety practices:

• As of the prior year, only 3 out of 13 top Chinese AI labs published any safety evaluation results, and none disclosed evaluations for Chemical, Biological, Radiological, and Nuclear (CBRN) risks.
• The Center for AI Standards and Innovation (CAISI) found that DeepSeek's R1-0528 model complied with 94% of overtly malicious requests under a common jailbreaking technique, compared with 8% for US reference models.
• An independent assessment of Moonshot's Kimi K2.5 published in April found the model failed to refuse CBRN-related requests at a far higher rate than US frontier models.

Anthropic adds that labs in China often release dual-use capable models as open-weight, and that once a model is open-weight, whatever safeguards exist can be removed, making it available to any state or non-state actor for malicious purposes.

Mythos Preview and the acceleration period

Anthropic describes Mythos Preview — a model released to select partners as part of Project Glasswing in April — as a wake-up call signaling the arrival of an acceleration period. The paper reports that with access to the model, Firefox was able to fix more security bugs in a single month than it had in all of 2025, and almost 20 times more than its monthly average security bug fixes in 2025. (The Register reported the figure as 423 Firefox security bugs.)

Anthropic quotes a PRC cybersecurity analyst's response to the model:

China is "still sharpening our swords while the other side has suddenly mounted a fully automatic Gatling gun."

The paper also warns about military diffusion speed. It states that the PLA is already procuring commercially developed Chinese AI systems for military use, including DeepSeek models deployed to coordinate swarms of unmanned vehicles and enable cyber offense capabilities. Anthropic argues that when a new model reaches a new capability in autonomous targeting, vulnerability discovery, or swarm coordination, the regime that controls it can put it onto the field in weeks, not years. It adds that if a PRC lab had developed a model at the level of Claude Mythos Preview before an American one, the CCP would have had first access to a system that can autonomously discover and chain software vulnerabilities.

Anthropic attributes the coming acceleration to the logic of scaling laws and to AI increasingly being used to accelerate the development of new models. It states: "There is a high likelihood that we will look back on 2026 as the breakaway opportunity for American AI."

Anthropic's three policy recommendations

To land in scenario one, Anthropic supports three areas of policy action.

1. Close the loopholes: smuggled chips, foreign data center access, and SME

Anthropic says PRC labs currently benefit from access to export-controlled American chips via smuggling and foreign data centers, and that gaps in SME controls accelerate China's self-sufficiency efforts. It recommends tightening controls and ramping up enforcement budgets. The paper notes that a lower compute ceiling could also materially impair distillation attacks, because AI labs in China still require a minimum threshold of compute to distill effectively.

2. Defend innovations: restrict model access and deter distillation attacks

Anthropic recommends that Congress and the executive branch continue supporting policy actions to punish and disincentivize distillation attacks, while facilitating US labs' ability to detect and prevent them. Specific measures it suggests include a legislative clarification that distillation attacks are illegal and efforts to facilitate threat intelligence and technical sharing between peer American labs and with the US government.

3. Champion the export of American AI

Anthropic urges the Trump administration to continue promoting global adoption of trusted AI hardware and models developed and shaped by democratic principles. It argues that locking in trusted American infrastructure now denies the CCP's AI ecosystem the global footholds it needs to compete on cost and adoption later.

Where Anthropic leaves room for engagement

Anthropic states that it supports international AI safety dialogue with AI experts in China when possible, on the grounds that the world has a vested interest in safe AI regardless of where it is developed. The paper argues that prospects for productive engagement are best when the US maintains a large capabilities advantage, and that responsibly building a lead augments American influence over AI safety in China and elsewhere.

Anthropic also states that it "deeply respects the Chinese people and the accomplishments of the Chinese AI community" and hopes for peaceful relations between China and the world, framing its concerns specifically around the risks posed by powerful authoritarian political systems with access to frontier AI. It notes that increasing numbers of researchers in China's AI labs and policy community are concerned with AI safety risks, even though that trend has not translated into safety practices on par with US labs.

The paper's conclusion restates the central argument: America and its allies have developed both the world's most capable frontier AI models and the world's most advanced inputs to AI, and that advantage can be extended if superior access to the technology is defended — but it will be lost if given directly to competitors. Anthropic states that decisions made by policymakers this year will determine the future of transformative AI.