Chinese AI models now power nearly half of U.S. router traffic

Layer3Labs says Chinese-developed models now process up to 46% of token traffic on a major U.S.-based AI router, up from about 30% for U.S. models a year ago. The shift matters because much of that usage reaches businesses through vendors and shadow AI, raising data-sovereignty and compliance risks.

Why it matters: - Layer3Labs says a growing share of U.S. business AI traffic is being processed by Chinese-developed models, not U.S. models. - The firm says that creates exposure for customer data, especially in regulated industries like healthcare, legal and finance. - Layer3Labs says businesses may not know which model is handling their data because AI is often sold as a feature, not as a named model choice.

What happened: - Layer3Labs said up to 46% of token traffic on the largest U.S.-based AI model router is now routed to Chinese models. - The company said U.S. models handled roughly 70% of that traffic a year ago, and are now closer to 30%. - The press release was issued July 22, 2026, from Miami.

The details: - Layer3Labs said cost-optimizing routers often send prompts to the cheapest available provider, with Chinese inference running 60% to 90% cheaper. - The company said Andreessen Horowitz estimates 80% of U.S. startups build on Chinese base models, with Airbnb, Uber and Cursor named as adopters in cited coverage. - Layer3Labs said research indicates 70% of enterprise AI activity sits outside IT oversight, much of it through small Chinese models that can run on a laptop. - The firm said any prompt processed by a Chinese-provider endpoint may fall under China’s National Intelligence Law, which can compel data disclosure to the state. - Layer3Labs said the House Select Committee on the CCP opened a probe in July 2026 into U.S. firms’ use of these models. - Layer3Labs said the NDAA already bars DeepSeek from Defense Department systems. - The company said firms with high shadow AI exposure face an estimated $670,000 breach premium per incident. - In its review of dozens of small- and mid-sized business AI stacks, Layer3Labs said 70% contained at least one Chinese model the company had not knowingly approved. - Layer3Labs is offering a free AI Stack Sovereignty Check that identifies which models are processing a company’s data and flags data-sovereignty and compliance risk. - The company said the review is meant to help businesses run a provenance check on every AI tool touching customer data.

Between the lines: - The core risk is not only where a company buys AI, but where the underlying model routes data after purchase. - Vendor bundling and white-label AI features can hide foreign model use from buyers until a security or compliance review surfaces it. - The growth of shadow AI makes oversight harder because employees may use tools that never pass through central procurement or IT review.

What’s next: - Layer3Labs is urging businesses to map every AI tool that touches customer data and identify the model behind it. - The warning is likely to intensify scrutiny from regulated sectors and from companies trying to control data residency and vendor risk. - Layer3Labs says the first step is simply finding out what is in the AI stack.

The bottom line: - The biggest AI security issue for many U.S. businesses may be invisible model routing, not the AI product name on the invoice.