On 19 August 2026, CNBC reported that Washington is weighing new measures to close what officials and analysts describe as a significant gap in the United States export control regime: the remote use of advanced Nvidia chips located in data centres outside China. Although Nvidia's most advanced semiconductors, including the GB300, are under export restrictions to China, the current rules restrict the physical hardware rather than access to its computing power over the internet.
The loophole in the current rules
Cassia King, a senior researcher on the Compute Policy team at the Institute for AI Policy and Strategy, told CNBC that the US export control regime "controls physical AI chips. It does not cover remote access to those chips." She said that Moonshot AI's reported access to compute through a facility in Thailand was legal "so long as Moonshot isn't actually buying and owning the physical hardware directly." Some less capable Nvidia chips are permitted for shipment to China.
Michelle Nie, a visiting fellow in technology and national security at the Center for a New American Security, described the gap as "threatening U.S. national security," arguing that "the point of chip export controls is to deny China the ability to train frontier AI using advanced U.S. chips." Industry watchers told CNBC that access to advanced compute through overseas cloud providers is a key factor in the recent capability gains of Chinese AI models.
Reported use by Chinese firms
The issue gained prominence in July 2026 when, less than a week after Moonshot released its Kimi K3 model, White House official Michael Kratsios accused the company of using Nvidia GB300 chips through a facility in Thailand. That remains an accusation by a US official rather than an independently verified finding. Kimi K3 is one of several recent Chinese systems, alongside new models from DeepSeek and Alibaba, that have scored well on performance benchmarks.
According to CNBC, Chinese hyperscalers including ByteDance, Alibaba and Tencent have reportedly accessed Nvidia compute remotely through other Asian nations, among them Thailand, Malaysia and Japan. ByteDance and Tencent did not respond to requests for comment, and Alibaba declined to comment. Separately, an anonymous source told CNBC that ByteDance had worked with Singapore-headquartered cloud provider Aolani to access compute in Malaysia, an arrangement the Wall Street Journal first reported in March 2026. Aolani said the companies it services "do not have ownership, potential future claim or physical access to the chips" and that access is "fully compliant with all applicable regulations."
Regional infrastructure is expanding quickly. Real estate firm JLL estimates global data centre capacity could roughly double to 200GW by 2030, and data compiled by DC Byte counts 31 planned data centres of 100MW or more across Malaysia, Indonesia and Thailand, compared with two in operation as of August 2026.
The Remote Access Security Act
The main legislative vehicle for closing the gap is the proposed Remote Access Security Act, or RASA, which would extend US export controls to remote, cloud-based access of critical hardware and software. The bill passed the House of Representatives in January 2026 but has not passed the Senate, and Nie said it faces potential industry pushback because cloud providers would carry the compliance burden of any know-your-customer and customer verification requirements.
Even if enacted, RASA would not by itself change the rules. Nie said it would give the government "the authority to regulate remote access," but officials "would still need to create a rule to export-control remote access to advanced chips." King said the Bureau of Industry and Security could move quickly, possibly in "a matter of days" with White House backing, but added that "the challenge will be in making a rule that's effective and enforceable," citing decisions about which compute is covered, who is barred from accessing it, and how to run a robust verification scheme.
A White House official told CNBC that "the Trump administration has implemented the most rigorous export control regime in modern history, and remains committed to safeguarding America's national and economic security." The Department of Commerce and the Bureau of Industry and Security did not respond to requests for comment.
What is established and what is merely claimed
Established: on the expert accounts quoted by CNBC, current US export controls restrict the export of advanced physical chips to China and do not cover remote access to those chips overseas. RASA passed the House in January 2026 and awaits Senate action, and even its passage would require a subsequent rule before restrictions took effect. Data centre construction in Southeast Asia is growing rapidly.
Merely claimed: the assertion by Michael Kratsios that Moonshot used GB300 chips through a Thai facility is an accusation, not a proven finding. The reported remote use of Nvidia compute by ByteDance, Alibaba and Tencent rests on unnamed sourcing, and the companies either declined or did not respond to comment. The claim that the loophole threatens US national security is the view of the analysts quoted, not an adjudicated conclusion.