Chinese AI models handle nearly half of U.S. traffic, Layer3Labs says

Layer3Labs says Chinese-developed AI models now process as much as 46% of token traffic on a major U.S.-based router, upending who may be reading business data behind the scenes. The firm says the shift is often invisible to companies that buy AI features through vendors or shadow AI tools, raising new privacy and compliance risks.

Why it matters: - Layer3Labs says a growing share of U.S. business AI traffic is now processed by Chinese-developed models, which could expose customer and company data to foreign jurisdictions. - The firm warns that many businesses do not know which model is handling their prompts, making data governance and compliance harder. - The issue is especially sensitive for healthcare, legal, and finance firms that handle regulated data.

What happened: - Layer3Labs said as much as 46% of token traffic on the largest U.S.-based AI model router is now routed to Chinese models. - The firm said U.S. models handled about 70% of that traffic a year ago and now are closer to 30%. - Layer3Labs said the shift often happens without direct customer choice because businesses buy AI features rather than selecting the underlying model.

The details: - Cost-optimizing routers can send prompts to the cheapest available provider, and Chinese endpoints can run inference 60% to 90% cheaper. - Andreessen Horowitz estimates 80% of U.S. startups build on Chinese base models, with named adopters including Airbnb, Uber and Cursor. - Research cited by Layer3Labs puts 70% of enterprise AI activity outside IT oversight, with many of those tools small enough to run on a laptop. - Layer3Labs said its own review of dozens of small- and mid-sized business AI stacks found 70% included at least one Chinese model that the company had not knowingly approved. - The firm is offering a free AI Stack Sovereignty Check to identify which models are processing a company’s data and to flag data-sovereignty and compliance risk. - Layer3Labs said it helps small and mid-size businesses deploy AI safely, with implementations that go live in 2 to 4 weeks. - Layer3Labs was founded in 2019 and is based in Miami. - The company specializes in AI strategy, workflow automation and vendor risk assessment.

Between the lines: - The core risk is not only model origin, but invisibility: Chinese models can enter company workflows through vendors, white-label products and unsanctioned tools. - If prompts go through a Chinese-provider endpoint, Layer3Labs says those data may fall under China’s National Intelligence Law. - The House Select Committee on the CCP opened a probe in July 2026 into U.S. firms’ use of these models. - The NDAA already bars DeepSeek from Defense Department systems. - Layer3Labs says firms with high shadow AI exposure face an estimated $670,000 breach premium per incident. - Jonathan Teplitsky said most business owners assume their data stays on U.S.-based servers, but sensitive data is being routed through Chinese-provided endpoints without their knowledge. - Mark Boyhous said companies cannot govern AI they cannot see.

What's next: - Layer3Labs is urging businesses, especially regulated firms, to run provenance checks on every AI tool that touches customer data. - The company is pushing customers to identify which models are actually processing their data before expanding AI use. - Businesses facing vendor-driven AI adoption may need to revise procurement, security review and data-sovereignty practices.

The bottom line: - Layer3Labs says the fastest-growing AI risk for U.S. businesses may be hidden inside the tools they already use, not the models they knowingly chose. - More information is available at Layer3Labs.