Europe’s AI Spare Tyre Is Made in China

When Hugging Face’s engineers set out to reconstruct how an autonomous agent system had broken into their servers in July, they first reached for the best American models money could rent. The models refused. Their guardrails, the company wrote, “cannot distinguish an incident responder from an attacker.” So the French-founded platform ran GLM 5.2, an open-weight model from Beijing’s Z.ai, on its own hardware and worked through more than 17,000 logged attacker actions. The intruder turned out to be a swarm of roughly 700 agents driven by an internal OpenAI model. American agents broke in. A Chinese model helped clean up.

Europe’s official story about AI rests on a tidy division: American technology is a dependency to be managed, Chinese technology a risk to be contained. This year has been far less tidy. Both of Europe’s AI shocks came from the American side of the ledger.

The first landed in June, when Commerce Secretary Howard Lutnick placed Anthropic’s Fable 5 and Mythos 5 under export controls and barred every foreign national from using them. European users waited almost three weeks for access to return. The Commission’s July action plan now promises “contingency measures” for the day a provider or a third-country government withdraws access again. Brussels did not name the third country. It did not have to.

That imbroglio is the backdrop to last week’s World Internet Conference summit in Wuzhen, which drew guests from 138 countries. Yolanda Díaz, Spain’s second deputy prime minister, told the opening ceremony that “what we want is open-source and inclusive AI.” Arnaud Taddei, who chairs the International Telecommunication Union’s security standards group, said China’s long-term planning had made it the group’s largest partner, while Europeans were still working to deepen their engagement. Dame Wendy Hall, the British computer scientist who co-chairs the WIC’s AI committee, warned that the UK and much of Europe “remain heavily reliant on US technologies,” and that Chinese open-weight models offer some insulation from Washington’s political restrictions. Before June, that sounded like a talking point. After June, it reads like a risk assessment.

Three areas of cooperation surfaced in Wuzhen that cost Europe nothing it values.

First, standards. Taddei’s group set up a new focus group in June on trust and identity for AI agents, with Alibaba among the firms at the table, and it meets in Paris within weeks. Standards drafted with Chinese engineers in the room are standards Chinese-built agents will actually follow.

Second, incident reporting. The Simon Institute for Longterm Governance, a Swiss think tank, urged China and Europe to share data on AI-enabled attacks. The Hugging Face breach is the template case. A swarm of agents does not check passports. Neither should the early-warning system.

Third, sector pilots. The International AI Governance Association suggests starting in cars and telecommunications, where European and Chinese industry already overlap and where the question of who is liable when an autonomous agent errs is most pressing.

The sceptics have real material. America’s NSA, CISA and FBI have accused six Chinese labs, Z.ai and Alibaba among them, of industrial-scale distillation of American models, a charge Beijing rejects. Washington’s own evaluators found that GLM 5.2’s safeguards allow assistance with agentic exploit development, the same permissiveness that helped Hugging Face’s defenders. MERICS warns that Chinese models woven into European software could become a new dependency. And WAICO, the Shanghai-based body China launched in July, counts Russia, Belarus and Serbia among its 29 founding members. When Beijing reportedly offered the Commission a seat last month, spokesperson Thomas Regnier said no formal invitation had arrived.

Yet each objection concerns how a model is run, not where it was trained. Weights downloaded to a server in Frankfurt send nothing back to Hangzhou. A hosted service in any foreign jurisdiction, American included, can be switched off by a single letter from a cabinet secretary, as Europe learned in June. Testing and audit can manage the first risk. A ban by country of origin merely chooses which dependency Europe keeps.

The remedy is already on the Commission’s calendar. ENISA is drafting a European Blueprint for access to advanced AI in cyber defence, with contingency measures due before the year is out. It should list open-weight models, Chinese ones included, vetted by the EU AI Office and hosted on European hardware, ready before the next incident rather than improvised during it. That is what Hugging Face told other defenders to do.

Washington will object, for obvious reasons. But if the blueprint’s contingency list names only American labs, Europe will have bought its spare tyre from the same garage that slashed the last one.