Contents of China's AI export control list reportedly revealed: weights restricted for models meeting any of 10^26 FLOP, 2 trillion parameters or a global top-10 rank, with AI vulnerability discovery also covered

Details have been reported about the contents of the list attached to Announcement No. 48, published by China. Taken together, reports from Xinhua (October 16), The Beijing News and an English-language explainer from CellCog indicate that the list places the weights and training methods of large models under export restrictions. Covered models are reportedly those that meet any one of three criteria: 10^26 FLOP of training compute, 2 trillion parameters, or a place in the global top 10. If the reports are accurate, China has brought frontier models themselves under export controls.

This article, however, is based on media reports. We have not obtained the original text of the attached list, and the definitions of the figures, the scope of application and any exemptions have not been verified. All figures below should be treated as reported.

The list's three criteria: compute, scale and rank

According to reports, the list captures models using three criteria.

10^26 FLOP of training compute

The first draws the line at the total amount of compute used in training. The US AI diffusion rule, issued in January 2025 and rescinded in May, used the same 10^26 threshold for controlling model weights. That is an order of magnitude higher than the 10^25 benchmark the EU AI Act uses as an indicator of systemic risk. Drawing the line by compute is a familiar approach across countries, and the list appears to have aligned with it.

2 trillion parameters

Separately from compute, the list reportedly also draws a line by model size. Today's large frontier MoE models range from around 1 trillion to several trillion total parameters. Among Chinese models, for example, Kimi K3 has 2.8 trillion total parameters and Xiaomi's MiMo-V2.6-Pro has 1.02 trillion. On the US side, Microsoft's MAI-Base-2 was announced at 2.8 trillion total parameters, while Meta's Muse Spark Open has 816B. A 2 trillion threshold sits right at the level that catches some of the top Chinese open-weight models. Alibaba has said it is aiming for 5 trillion to 10 trillion parameters with Qwen4.5 and Qwen5, and DeepSeek is reportedly training a 2 trillion-parameter model. If released, these would far exceed the line. The 2 trillion benchmark has not yet been confirmed in the attachment's original text (an unresolved question from earlier reporting).

Global top 10

The third criterion is not an absolute figure but a global ranking. According to reports, models in the top 10 are covered regardless of compute or size. The reports do not make clear which metric or point in time the ranking is based on, or who makes the determination. The criterion can be read as a safeguard so that, if compute efficiency suddenly improves and small models that reach neither 10^26 FLOP nor 2 trillion parameters line up at the top, they are not missed. StepFun's Step 5 Preview, with 600B total parameters, scores at the same level as the 2.8 trillion-parameter Kimi K3, suggesting that a size threshold alone cannot keep up.

The key point is the structure: a model is covered if it meets any one of the three. If it hits on compute, size or rank, virtually every frontier model is caught in the net.

AI vulnerability discovery also covered

According to reports, the list also includes technology that uses AI to find vulnerabilities. Separately from model weights, this explicitly brings frontier cyber capabilities under export controls.

Over the past month, this area had become a front line of national security. On September 29, Anthropic reported that Z.ai's GLM-5.3 succeeded 12% of the time in building attack code end to end on ExploitBench, close to the 14% scored by Claude Mythos Preview. On October 16, Epoch AI estimated that the cyber capabilities of open-weight models lag closed models by six to seven months. There have also been cases in which flaws found by Mythos and Project Glasswing were exploited the day after disclosure. AI vulnerability discovery has come to be treated as a technology usable for both defense and attack. China's inclusion of it in the export control list can be read as stemming from the same concerns that led US labs to set up application-based, tiered access through the Cyber Verification Program and Daybreak.

What controlling weights and training methods means

What the list reportedly covers is not products or services but weights and training methods. A model's capabilities reside in its weights, and the ability to build it lies in training methods. Bringing both under control means that both the capacity to build frontier models and the finished models themselves now require state permission to leave the country.

In the US, chip export controls remain in place, but rules governing model weights themselves disappeared with the rescission of the diffusion rule. If the reports are accurate, China is now the major country that has explicitly placed frontier model weights on an export control list.

What remains unverified

Because the attachment's original text has not been read, the biggest question remains unanswered: whether releasing open weights is treated as an "export." DeepSeek, Qwen, Kimi, Z.ai, MiniMax and StepFun have pursued a strategy of publishing weights on Hugging Face. As recently as October 17, DeepSeek released the weights of V4.1-Flash-1017 under the MIT license. If publishing weights counts as an export requiring a license, it would become difficult for Chinese labs to freely release the weights of next-generation models exceeding 2 trillion parameters. Conversely, if publication is excluded, the controls would have limited practical effect. The reports do not allow either conclusion.

The following points are also unknown:

• How 10^26 FLOP is counted: pre-training only, or whether post-training and distillation are added.

• How the top 10 is determined: which evaluations serve as the benchmark, and when the rankings are reviewed.

• The scope of training methods: whether publishing papers or training code is also covered.

• The treatment of already-released weights: what happens to weights released before the list, such as Kimi K3.

According to earlier reporting, the deadline for public comments is November 15, preceded by the Fifth Plenary Session (October 26–29), while the US-China dialogue on superintelligence continues through November. There has been no US response yet. If the attachment's original text confirms the three criteria and the vulnerability discovery item, the reading that China has placed frontier models under state control will be firm. Until then, this should be treated as an outline glimpsed through media reports.