Mara ReyesClaude could be officially restricted in China and commercially available there at the same time. On June 28, a reported Chinese resale network showed how.
The control assumed one gate
Export controls were built around concentrated, identifiable choke points. An ASML DUV machine occupies a fabrication line; advanced chip capacity depends on equipment that can be restricted, counted and replaced only through another industrial process. Over several years of escalating U.S.-China technology controls, this was the governing design: constrain access to the scarce inputs, and the capability gap behind them becomes harder to close.
The response was already changing the structure. Sources reported that China was retrofitting older ASML DUV machines to produce advanced smartphone and AI chips. Other reports said Chinese chipmakers were being required to use at least 50% domestically made equipment when adding capacity, under a rule that was not publicly documented. Neither report proves that substitution is complete. Both show that the constraint had become an engineering requirement.
That distinction matters. A control can obstruct the original route while making the search for every other route more valuable. The first phase is denial; the second is adaptation; the third begins when the adapted system becomes credible enough to carry demand on its own.
A denied service became a distribution business
Frontier-model access changes the geometry because the restricted product is also a service. The reported Chinese network did not need to manufacture Claude in order to distribute access to it. It converted a controlled supplier relationship into a resale channel, moving the policy problem from whether an official product was available to how access was being intermediated.
Nothing in the report establishes that this access was universal, stable or equivalent to dealing directly with Anthropic. The control may still close authorized channels and determine who receives supported access. But clean containment has become an enforcement problem: the official gate remains closed while a market forms around reaching the other side.
The structure changed. The control was designed for a scarce object that could be stopped at a border or denied to a customer. Model access can be redistributed by intermediaries, so enforcement must govern a network rather than a single transaction.
Substitution is the reinforcing loop
On the same day, Sakana AI in Japan and 360 in China claimed that Fugu and Tulongfeng, respectively, could rival Anthropic systems covered by the U.S. export ban. Those are developer claims, not independent benchmarks in the supplied evidence, and they should be treated accordingly. A launch claim is not parity.
A Z.ai model also matched leading U.S. models in a high-value security task. One task does not establish general equivalence. It establishes something narrower and, structurally, more important: a substitute does not need to win every benchmark before it becomes useful in a valuable domain.
Once that threshold is crossed, restriction begins reallocating attention. Users who cannot rely on the controlled product have a reason to test alternatives; developers have a reason to target the workloads those users value; capital has a reason to finance the industrial base beneath them. The loop does not require a domestic system to be universally superior. It requires the alternative to become credible where access matters.
China launched those funds, according to Chinese state media, to back hard-technology startups valued below ¥500 million, or about $71 million. The money sits beside the reported domestic-equipment requirement and the effort to retrofit older lithography systems. Models, fabrication equipment and financing are different layers of the same substitution system: pressure at the top creates demand for replacement capacity underneath.
Scarcity became a target. A system organized around denying an input eventually teaches the constrained side which input must be replaced.
Selective access still matters
The evidence does not support the simpler conclusion that controls are merely being circumvented or have become useless. Reports that Fable 5 access could be restored and Mythos 5 redeployed show that access can be selectively relaxed. The perimeter moves; it does not disappear.
Official availability can still be withdrawn, restored or segmented, and direct access remains different from a reseller relationship. Controls therefore retain leverage over the authorized market even as gray channels form outside it.
That leverage sharpens the reversal rather than canceling it. The original question was whether frontier capability could be contained by controlling access to its leading suppliers. The revealed effect is now a divided system: administered access through the official channel, redistributed access through intermediaries, and substitute capability built by organizations with a reason not to depend on either.
Austria’s June 28 call for the European Union to consider hosting Anthropic within its own borders points to the same structural pressure from another direction. “Model sovereignty” sounds abstract until it acquires an address: the jurisdiction where the service is hosted, the infrastructure supporting it and the authority able to interrupt access. Dependence becomes visible when a government wants the system moved closer.
The restriction now carries its own replacement
The reversal is not that every restriction fails, or that every announced rival equals Claude. It is that a mechanism designed to preserve an advantage by limiting distribution now creates two markets the original design did not need to manage: one for resold access and another for credible substitutes.
Each restriction narrowed one route and raised the value of the next. Chip controls concentrated attention on domestic equipment. Model restrictions concentrated attention on alternatives. Enforcement concentrated value in intermediaries. Selective relaxation preserved the official gate while confirming that access was administered by geography and policy, not guaranteed by technical availability.
Claude’s official gate was still locked on June 28. Beside it stood a reseller’s counter, three hard-technology funds and a row of models wearing replacement nameplates.