Chinese AI models now handle nearly half of U.S. traffic, Layer3Labs warns

Layer3Labs says Chinese-developed models are now processing as much as 46% of token traffic on a major U.S.-based AI router, upending who may be handling American business data. The firm says the shift is often hidden inside vendor tools and shadow AI, raising compliance and data-sovereignty concerns for U.S. companies.

Why it matters: - Chinese-developed AI models are now handling a much larger share of U.S. business prompts, which raises questions about where customer data is processed and which laws can reach it. - Layer3Labs says the risk is most urgent for healthcare, legal and finance firms that handle sensitive information. - The firm says companies may be paying more in breach risk when AI activity falls outside IT oversight.

What happened: - Layer3Labs said as much as 46% of token traffic on one of the largest U.S.-based AI model routers is now routed to Chinese models. - A year ago, U.S. models held about 70% of that traffic; now the share is closer to 30%. - The firm said most business owners do not directly choose a model and instead buy an AI feature whose underlying model can be routed, resold or white-labeled without notice.

The details: - Cost-optimizing routers can send prompts to the cheapest available provider, and Layer3Labs said Chinese endpoints can run inference 60% to 90% cheaper. - Andreessen Horowitz estimates 80% of U.S. startups build on Chinese base models, with Airbnb, Uber and Cursor listed among adopters in cited reporting. - Research cited by Layer3Labs puts 70% of enterprise AI activity outside IT oversight, much of it tied to Chinese models small enough to run on a laptop. - Any prompt processed by a Chinese-provider endpoint falls under China's National Intelligence Law, which can compel data disclosure to the state. - In July 2026, the House Select Committee on the CCP opened a probe into U.S. firms' use of these models. - The NDAA already bars DeepSeek from Defense Department systems. - Firms with high shadow AI exposure pay an estimated $670,000 breach premium per incident. - In Layer3Labs' review of dozens of small and mid-sized business AI stacks, 70% contained at least one Chinese model the company had not knowingly approved. - Layer3Labs is offering a free AI Stack Sovereignty Check to identify which models are processing a company's data and flag data-sovereignty and compliance risk.

Between the lines: - The core issue is not only model performance or price. It is visibility, because the model handling a prompt may be buried inside a vendor product or a shadow AI workflow. - The routing trend suggests cost savings are pushing companies toward cheaper infrastructure even when the data-governance tradeoffs are unclear. - The probe by Congress and the Defense Department ban show the issue has moved from security theory into policy action.

What's next: - Layer3Labs is urging companies to run provenance checks on every AI tool that touches customer data. - The firm said the first step is to identify what is actually in the AI stack before trying to govern it. - Businesses in regulated industries are likely to face the most pressure to document where AI prompts are processed and under whose jurisdiction that data falls. - Layer3Labs says its AI implementation and automation work is aimed at helping small and mid-size businesses deploy AI safely in 2 to 4 weeks.

The bottom line: - U.S. companies may be using Chinese AI models far more often than they realize, and the hidden routing of business data is becoming a compliance and sovereignty problem, not just a technical one.