ANALYSIS: The Asian Cloud Is Pushing the Boundaries of AI Chips

The chip didn’t cross the border

The Invisible Journey

U.S. customs officials have learned to monitor a crate, a manifest, a recipient, a chip. The cloud changes the nature of the shipment. The hardware can remain in Thailand or Malaysia while its processing power traverses the network. Nothing travels in a truck to China. The computing power, however, becomes available remotely.

CNBC reports that several Chinese companies have accessed advanced Nvidia computing power provided by Asian data centers. The most explosive case involves Moonshot AI: Michael Kratsios, a White House official, accused the company of using GB300s hosted in Thailand to train Kimi K3. This is an official accusation, not published technical evidence.

Control Still Lies with the Hardware

According to researcher Cassia King, cited by CNBC, the current regulations target the physical ownership and transfer of chips, not remote access to their computing power. Aolani, a Singapore-based cloud provider, specifically states that its customers do not own its chips, have no future rights to them, and do not have physical access to them.

America has built a customs barrier for silicon; its potential adversaries are discovering that a connection can bypass the checkpoint. That is the strategic vulnerability. Not a proven contraband shipment, but a regulatory border drawn around the object just as value is shifting to a service.

The chip remains stationary. Its processing power, however, no longer has a passport.

Reported does not mean proven

Moonshot Under Accusation

Moonshot’s access to the GB300 chips stems from an accusation made by Michael Kratsios following the launch of Kimi K3. The public record reviewed provides no contract, usage log, machine inventory, or confirmation from Moonshot. To state that the company certainly used these chips would therefore go beyond the available evidence.

Caution must remain paramount: the allegation is serious enough to highlight a regulatory loophole, but too incomplete to serve as a verdict against the company. The distinction matters, especially in a field where a single sentence can transform an industrial policy dispute into an accusation of illegal circumvention.

ByteDance and Aolani

CNBC also reports that ByteDance was working with Aolani to access computing power in Malaysia, according to an anonymous source familiar with the matter. The Wall Street Journal had previously reported on this arrangement. Aolani asserts that its services comply with applicable regulations. ByteDance did not respond to CNBC.

The mechanism is credible, and the reports are consistent, but the volume, the specific machines, and the end use remain largely shrouded in mystery. This limitation does not make the problem imaginary. It merely prevents us from filling in the gaps with fabricated certainties.

Uncertainty does not erase the flaw. It merely determines what we can honestly attribute to it.

From Product to Use

Selling a Chip, Renting a Function

Traditional oversight tracks a physical asset. Who exports it? Who buys it? Where will it be installed? The cloud sells something else: a function measured in time, capacity, and access. The customer can use an accelerator without knowing its exact location, without touching it, and without appearing as its owner.

This dissociation is at the heart of the problem. The United States may ban the direct sale of a GB300 to a Chinese company, only to discover that a supplier located in a third country is leasing computing power generated by the same architecture to that company. The strategic goal of the control is thus circumvented without a chip necessarily having been exported to China.

Sovereignty is shifting

The point of control shifts from the port to the customer account. It is necessary to know the user’s true identity, their affiliated companies, the destination of the workload, and sometimes the trained model. This oversight is more complex than a serial number, because services can be resold and corporate identities can multiply.

Controlling AI no longer means simply knowing where the machine is located; one must know who is activating its power, for what purpose, and through which intermediary. This transformation requires a framework, legal authorities, and compliance systems that substantive rules have never had to bear alone.

The export of the future may be an open session, then closed, without a customs office or a customs officer.

Asia is becoming the interface

Thailand, Malaysia, Japan

Reports cite Thailand in connection with Moonshot, Malaysia with ByteDance, and Japan as among the locations through which Chinese companies allegedly accessed Nvidia computing power. Singapore appears to be the headquarters of Aolani. The region is not described as a complicit bloc, but as an expanding infrastructure linking American suppliers and Asian demand.

It would be unfair to brand these countries as guilty by association. Hosting a data center does not constitute a violation or an intent to circumvent Washington. Each jurisdiction has its own laws, operators, and interests. The challenge for the U.S. is precisely to act without treating its partners as mere administrative extensions of the BIS.

Thirty-one Mega Projects

CNBC, citing DC Byte, reports that 31 data centers of at least 100 megawatts are planned in Malaysia, Indonesia, and Thailand, compared with just two facilities of that size currently in operation. JLL estimates that global capacity could nearly double to reach approximately 200 gigawatts by 2030.

The gap isn’t emerging in a stagnant market; it’s opening up just as Southeast Asia is building the global computing highway. The more capacity increases, the more a system focused on a few physical shipments risks missing the bigger picture.

The next bottleneck may not be a port. It will be access permission.

A bill is pending in the Senate

What H.R. 2683 Would Do

The Remote Access Security Act, H.R. 2683, would extend the Export Control Reform Act to cover remote access. The bill defines such access as a foreign person’s access to an item under U.S. jurisdiction via a network connection, the Internet, or a cloud service from a location other than where the item is physically located.

This amendment would give the Bureau of Industry and Security a clearer basis for issuing licenses and imposing sanctions related to remote access. It does not automatically label every Chinese customer as a violator. It expands the authority under which a more targeted rule could then be drafted and enforced.

Passed Here, Blocked There

The House of Representatives passed the bill. The Senate received it on January 13, 2026, read it twice, and referred it to the Committee on Banking, Housing, and Urban Affairs. The Congressional Record does not indicate that it passed the Senate, reached the president, or was enacted.

The most frequently cited solution therefore exists as a proposed measure, not as a completed law or an enforceable ban. This legal distinction is crucial. A loophole can be politically acknowledged while the instrument intended to close it remains stalled.

The cloud runs in milliseconds. The law, meanwhile, is still awaiting its next hearing.

Even if passed, the law would not be enough

Authority Is Not the Rule

Michelle Nie and Cassia King, quoted by CNBC, point out that the passage of RASA would not automatically close the loophole. The BIS would still have to decide which capabilities are targeted, which entities are restricted, which licenses are permissible, and what obligations must be imposed on providers.

A rule that is too narrow would leave loopholes for resale. A rule that is too broad could ensnare legitimate customers, impose disproportionate oversight, or shift demand to operators outside U.S. jurisdiction. The legislative text provides a key. It does not build the lock.

The Threshold Problem

Should the regulation target a specific type of chip, a certain amount of computing power, a lease duration, an AI model, or the customer’s identity? Each answer creates its own loophole. A hardware threshold can be circumvented through aggregation. A usage threshold requires an understanding of a workload that the provider does not always clearly see.

The challenge isn’t to write the word “cloud” into the law; it’s to transform a strategic intention into a measurable, enforceable, and challengeable obligation. Without this precision, the new frontier would become an administrative slogan rather than an actual control.

Authority without rules is a door drawn on a wall.

The Rule That Existed and Then Disappeared

The January 2025 Framework

The AI Diffusion Rule, published on January 15, 2025, was specifically intended to limit China’s access to advanced chips and computing power via third countries. It divided the world into categories, established a framework for validated data centers, and proposed restrictions on the cloud and the sizes of highly advanced models.

The Congressional Research Service report describes the intent: to build a secure global ecosystem, control the accumulation of power, and prevent third parties from becoming an indirect gateway for China. The plan thus recognized that the physical distribution of chips was no longer sufficient.

The May Revocation

On May 13, 2025, the Department of Commerce announced the revocation of this rule and ordered the BIS not to enforce it. The administration deemed the framework too burdensome and promised a replacement rule. At the same time, it issued warnings about Huawei Ascend chips, Chinese models, and diversion tactics.

Washington had identified the third-country bridge, then removed its own checkpoint before installing the next one. One can argue in favor of repealing an excessive rule. But one cannot claim that the vacuum left behind comes at no cost.

A bad rule can be harmful. The prolonged absence of a rule also takes sides.

The Withdrawn Replacement

March 2026, yet another draft

In late February 2026, the Department of Commerce had sent a draft titled “AI Action Plan Implementation” to other agencies. Reuters reports that it envisaged conditions related to large volumes of chips, including security guarantees or investments in U.S. data centers for certain exports.

On March 13, the draft was withdrawn before it could be adopted. An official emphasized its preliminary nature. The government has not released a detailed, definitive reason or a timeline for a new version. The withdrawal does not reinstate the previous Biden rule. It prolongs the uncertainty.

A Policy of Stop-and-Go

Chip companies, cloud providers, and partner governments must make investments spanning years. Yet a policy that alternates between announcements, revocations, drafts, and withdrawals forces them to guess at U.S. policy based on incomplete signals. This instability can undermine compliance just as much as a weak standard.

Credible regulation depends not only on its strictness but also on the continuity that allows allies to enforce it and companies to anticipate it. Regulatory power loses its edge when it resembles a series of drafts.

The legal vacuum is not neutral. It becomes a window of opportunity for trade.

The Trump Paradox

Exporting the Tech Stack, Protecting the Lead

The second Trump administration is pursuing two conflicting objectives: spreading the American technology stack to partners and preventing that spread from fueling China’s most advanced capabilities. One requires speed, market access, and trust. The other requires control, verification, and sometimes denial.

This paradox is not a flaw in itself. Every technological power wants to sell widely without arming its rivals. The problem arises when policy refuses to acknowledge the conflict between these two ambitions, then leaves it to companies and allies to absorb the resulting contradictions.

Credit and Responsibility

The administration deserves credit for keeping chip security at the center of the debate and supporting a system of controls that the White House presents as rigorous. It also bears responsibility for the withdrawal of the Diffusion rule and the proposed replacement, even as remote uses become more visible.

Trump can be credited with putting technological competition front and center, and criticized for leaving the cloud caught between two doctrines. Critical support begins precisely there: acknowledging the direction, then refusing to applaud the delay.

A strategy isn’t strong simply because it makes loud claims. It is strong when its various parts stop contradicting one another.

Know the customer—truly

KYC for computing

Closing the gap requires a form of “Know Your Customer” tailored to the cloud. The provider should identify the actual entity, its owners, its affiliated companies, and perhaps certain sensitive uses. The “Diffusion” rule’s validated data center programs were already moving in this direction.

But a form isn’t enough. Corporate structures can hide a beneficiary, resellers can split access, and a legitimate customer can rent on behalf of a third party. Verification must therefore combine identity, behavior, traceability, and the right of recourse—without assuming that every anomaly proves hostile intent.

Compliance Comes at a Cost

Cloud providers may have to turn away customers, monitor accounts more closely, and maintain more detailed records. The Diplomat warns that a regime that is too broad would drive legitimate users and friendly nations toward Chinese providers. This risk is an analysis, not a result that has already been measured.

There is no such thing as free security: the honest question is who pays, who is being monitored, and what threat justifies each restriction. A good regulation does not deny these costs. It weighs them against the strategic cost of uncontrolled access.

“Know your customer” must not become “suspect the whole world.”

Allies are not subsidiaries

The sovereignty of host countries

Malaysia, Thailand, Singapore, Indonesia, and Japan are not mere dots on an American map. They welcome investment, seek digital growth, and set their own rules. Any sustainable strategy must therefore be negotiated with them, not simply imposed on American suppliers.

An overly harsh extraterritorial restriction could be perceived as a seizure of their industrial policy. An overly lenient approach could turn their infrastructure into an unwitting gateway to capabilities that Washington deems sensitive. Between the two lies the difficult work of the alliance: common standards, verification, and shared responsibility.

Don’t Hand the Market Over to Beijing

The Diplomat argues that overly burdensome controls could accelerate the adoption of Huawei Cloud, AliCloud, or other Chinese offerings. This is a plausible strategic risk, not an inevitability. It points out that technological dominance is also determined by the attractiveness, reliability, and openness of ecosystems.

If protecting American technology means making America an unattractive choice, Beijing will claim a victory that its chips have not yet secured. Regulation must slow down the adversary without driving away allies.

A coalition cannot be engineered from Washington. It must be earned, data center by data center.

National security is not just for show

Why Chips Matter

Advanced accelerators enable the training and operation of powerful AI systems. U.S. officials fear that these capabilities could support military, intelligence, or surveillance applications. The Congressional Research Service places these controls within a broader policy framework aimed at addressing China’s military-civil fusion and U.S. technological leadership.

The effectiveness of each threshold is open to debate. But this issue cannot be reduced to a routine trade dispute. Concentrated computing power has both economic and strategic value. Leasing it remotely can produce the same functional effect as owning it, even if the law does not yet treat the two the same.

Precision vs. Panic

This seriousness does not justify labeling every Chinese customer a spy or every cloud session a violation. A serious policy identifies the risks, the end users of concern, and the sensitive capabilities. It also maintains licenses, exemptions, and appeal mechanisms when the evidence does not support an outright denial.

National security gains strength when it distinguishes a documented threat from nationality, and a sensitive use from a mere commercial presence. Otherwise, it becomes unfounded fear—easy to circumvent and impossible to defend to partners.

Control that targets everything eventually fails to see what it was meant to stop.

What the Report Does Not Prove

No public inventory

The file reviewed does not specify the number of GB300 chips involved, the duration of access, the amount of computing power consumed, or the full contracts. It does not publicly demonstrate the effect of this access on the performance of Kimi K3 or other models. It cites reports, an official accusation, and statements from suppliers.

This omission must remain evident. Data center capacity projections describe a regional infrastructure, not the specific Chinese usage of each facility. Advances in Chinese models do not, by themselves, prove the use of a specific chip. Narrative correlation cannot replace technical evidence.

No General Illegality Established

Cassia King believes that Moonshot’s access would be legal as long as the company neither purchases nor owns the hardware. Aolani claims compliance. The Department of Commerce and the BIS did not respond to CNBC. Without a clear general rule on remote access and without a published enforcement decision, the term “circumvention” primarily describes the failure of a policy objective, not necessarily an established violation.

The most serious scandal is not that a company has been convicted; it is that Washington still does not clearly know what conduct it intends to prohibit. This weakness is institutional rather than criminal.

When the law is ambiguous about the verb, the prosecution cannot invent the verdict.

What Would Truly Close the Loophole

A Framework Rather Than a Slogan

A credible response would combine the authority of RASA, a precise BIS rule, understandable thresholds, a program for validated clients, proportionate audits, and cooperation with host countries. It would also provide for licenses for legitimate uses and penalties for documented misrepresentations.

Technology could help track location, aggregation, and certain usage patterns, but no mechanism can replace governance. We must define who collects the data, how long it is retained, who can challenge it, and how a provider corrects an error without being condemned to perpetual suspicion.

A Stable Policy Framework

Perhaps most important is continuity. Partners need to know whether the United States intends to export its entire technology stack, restrict advanced capabilities, or combine the two according to sustainable categories. A revoked rule, a promised one, a withdrawn proposal, and a pending bill do not yet constitute this doctrine.

Closing the gap requires less a new declaration of technological war than a continuous chain linking the law, the regulation, the ally, and the supplier. If even a single link remains deliberately vague, the calculus will exploit it.

The power of a policy is measured by where its final link refuses to yield.

The border has become an identifier

The American Choice

The United States can continue to control primarily the physical destination of chips and accept that remote access remains a blind spot. It can abruptly expand its authority and risk alienating partners. Or it can build a targeted, negotiated, and verifiable regime that treats computing as a capability without treating every customer as an enemy.

The third path is the slowest to develop and the hardest to sell politically. It is also the only one that acknowledges the two realities of the issue: advanced chips are strategically important, and the global network that powers them cannot be governed like cargo.

The Verdict After the Evidence

Moonshot remains under indictment. ByteDance and Aolani remain a reported settlement. Aolani claims compliance. RASA remains a bill passed by the House, not a law. The Diffusion rule has been revoked. The March replacement bill has been withdrawn. These developments do not diminish the urgency. They define its exact form.

The Asian cloud does not prove that U.S. controls are dead; it proves that they still guard a border that no longer exists. Silicon remains in a country. Power appears in an account. And Washington is still figuring out which of the two it really wants to control.

The next American frontier may not be on a map. It will be in the “authorized user” box.

Signed, Maxime Marquette, columnist

Columnist’s Transparency Box

Editorial Position

I am not a journalist, but a columnist and analyst. My expertise lies in observing and analyzing the geopolitical, economic, and strategic dynamics that shape our world. My work consists of dissecting political strategies, understanding global economic trends, contextualizing the decisions of international actors, and offering analytical perspectives on the transformations that are redefining our societies.

I do not claim to possess the cold objectivity of traditional journalism, which is limited to factual reporting. I strive for analytical clarity, rigorous interpretation, and a deep understanding of the complex issues that affect us all. My role is to make sense of the facts, place them within their historical and strategic context, and offer a critical analysis of events.

Methodology and Sources

This text respects the fundamental distinction between verified facts and interpretive analysis. The methodological rule is consistent: factual information is published only if it is supported by a verifiable source, and the sources actually used in this article are listed under “Sources,” never here.

Categories of primary sources used by the publication, when applicable: official press releases from governments and international institutions, public statements by political leaders, reports from intergovernmental organizations, and dispatches from recognized international news agencies.

Types of secondary sources: specialized publications, internationally recognized news media, analyses from established research institutions, and reports from sector-specific organizations.

When an article cites statistical, economic, or geopolitical data, it is sourced from data-producing institutions (intergovernmental organizations, central banks, national statistical institutes), and the specific institution is listed under “Sources.”

Nature of the Analysis

The analyses, interpretations, and perspectives presented in the analytical sections of this article constitute a critical and contextual synthesis based on available information, observed trends, and expert commentary cited in the sources consulted.

My role is to interpret these facts, contextualize them within the framework of contemporary geopolitical and economic dynamics, and give them coherent meaning within the broader narrative of the transformations shaping our era. These analyses reflect expertise developed through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a situation documented as of its publication date, not a prediction: subsequent developments may alter these perspectives. No updates are promised in advance; when an article is corrected or supplemented, the change is dated within the text.

ANALYSIS: The Asian Cloud Is Pushing the Boundaries of AI Chips