Chinese AI models now power nearly half of U.S. traffic, Layer3Labs says

Layer3Labs says Chinese-developed models now handle as much as 46% of token traffic on U.S.-based OpenRouter, up from about 30% a year ago. The firm says the shift is often hidden inside vendor tools and shadow AI, creating data-sovereignty and compliance risks for U.S. businesses.

Why it matters: - Layer3Labs says a growing share of American business AI traffic is now processed by Chinese-developed models, raising questions about where customer data is going and which laws apply. - The exposure is especially sensitive for healthcare, legal and finance teams, where model provenance and data handling can affect compliance and breach risk. - Layer3Labs says firms with high shadow AI exposure face an estimated $670,000 breach premium per incident.

What happened: - Layer3Labs says as much as 46% of token traffic on U.S.-based OpenRouter, which it describes as the largest AI model router, is now routed to Chinese models. - A year ago, U.S. models handled roughly 70% of that traffic; now they are closer to 30%. - Layer3Labs says most business owners do not choose the underlying model directly and instead buy an AI feature that may be routed, resold or white-labeled without notice.

The details: - Cost-optimizing routers often send prompts to the cheapest available provider, and Layer3Labs says that is increasingly a Chinese endpoint where inference costs 60% to 90% less. - Andreessen Horowitz estimates 80% of U.S. startups build on Chinese base models, with named adopters including Airbnb, Uber and Cursor. - Research puts 70% of enterprise AI activity outside IT oversight, and Layer3Labs says much of that activity uses Chinese models small enough to run on a laptop. - Any prompt processed by a Chinese-provider endpoint falls under China's National Intelligence Law, which can compel data disclosure to the state. - In July 2026, the House Select Committee on the CCP opened a probe into U.S. firms' use of these models. - The NDAA already bars DeepSeek from Defense Department systems. - Layer3Labs says its review of dozens of small and mid-sized business AI stacks found 70% contained at least one Chinese model the company had not knowingly approved.

Between the lines: - The biggest risk is not just direct adoption of a Chinese model. It is the hidden path data can take through vendors, routers and unsanctioned employee tools. - That makes AI governance a visibility problem as much as a technology problem. - Jonathan Teplitsky, CEO of Layer3Labs, said business owners often believe their data stays on U.S.-based servers, but hundreds of gigabytes of sensitive data are being run through Chinese-provided endpoints without their knowledge.

What's next: - Layer3Labs is urging businesses to run a provenance check on every AI tool touching customer data. - The firm is offering a free AI Stack Sovereignty Check to identify which models are actually processing company data and flag sovereignty and compliance risk. - Layer3Labs says regulated industries should treat the review as an immediate priority.

The bottom line: - The core issue is not whether businesses use AI. It is whether they know which model is handling their data, and under whose jurisdiction that data may fall.