Chinese AI models are handling nearly half of U.S. router traffic, Layer3Labs says

Layer3Labs says Chinese-developed models now process as much as 46% of token traffic on a major U.S.-based AI router, upending how American companies think about where customer data is going. The firm says most businesses do not know which model is behind the AI features they buy, creating new data-sovereignty and compliance risks.

Why it matters: - Chinese AI models are now deeply embedded in U.S. business workflows, often without the buyer’s knowledge. - Layer3Labs says that creates data-sovereignty, security and compliance exposure for companies that assume their prompts stay on U.S. systems. - The risk is especially acute for healthcare, legal and finance firms that handle sensitive customer data.

What happened: - Layer3Labs says as much as 46% of token traffic on the largest U.S.-based AI model router is now sent to Chinese-developed models. - The firm says U.S. models have fallen from about 70% of that traffic a year ago to about 30% today. - The company released the findings on July 22, 2026, from Miami.

The details: - Business owners often buy an AI feature rather than a specific model, and the underlying model can be routed, resold or white-labeled without notice. - Cost-optimizing routers can send prompts to the cheapest available provider, and Layer3Labs says Chinese inference endpoints can run 60% to 90% cheaper. - Andreessen Horowitz estimates 80% of U.S. startups build on Chinese base models, with named adopters including Airbnb, Uber and Cursor. - Research cited by Layer3Labs puts 70% of enterprise AI activity outside IT oversight. - Layer3Labs says many of those tools are small enough to run on a laptop and can bypass security review. - Layer3Labs says any prompt processed by a Chinese-provider endpoint falls under China’s National Intelligence Law, which can compel data disclosure. - The House Select Committee on the CCP opened a probe in July 2026 into U.S. firms’ use of these models. - The NDAA already bars DeepSeek from Defense Department systems. - Firms with high shadow AI exposure face an estimated $670,000 breach premium per incident. - In its review of dozens of small- and mid-sized business AI stacks, Layer3Labs found 70% contained at least one Chinese model the company had not knowingly approved.

Between the lines: - The shift is hard to see because AI procurement has moved away from direct model selection and toward bundled products. - That makes vendor risk and model provenance a bigger issue than many business leaders realize. - The core concern is not just cost or performance. It is where customer data is processed and which jurisdiction can reach it. - The findings also suggest many companies may already be out of compliance with their own security expectations even if they never intended to use Chinese models.

What’s next: - Layer3Labs is urging companies to run a provenance check on every AI tool that touches customer data. - The firm is offering a free AI Stack Sovereignty Check to identify which models are actually processing a company’s data and to flag data-sovereignty and compliance risks. - Layer3Labs says the first step is simply mapping what is already in the stack.

The bottom line: - Layer3Labs says the biggest AI risk for many U.S. businesses is not using AI. It is not knowing which model is using their data.