Chinese Open Models Now Take 60% of US OpenRouter Tokens

A procurement lead reads the AI Kill Switch Act and does not see policy. She sees a requirements list. Reps. Lieu and Moran introduced it on July 23 as an amendment to the Homeland Security Act. Covered companies would have to support government-ordered throttling of inference and compute, feature disabling, full shutdown, and rollback to earlier versions, while preserving model weights and telemetry and reporting within 15 days. Penalties run up to $20M per day, DHS gets emergency authority, and the thresholds are $100M in compute spend and $500M in revenue. Passage is uncertain. The buyer expectation is not. Procurement will ask for these controls well before any enforcement date.

Two of those requirements are harder than they read. Forensic telemetry means more than what teams keep now. SANS research notes that the standard 48-96 hour retention windows already miss correlated events. Rollback means a versioned, known-good model state, which most AI features cannot produce. Prompt templates, model versions, and tool schemas drift independently, and nothing pins them together as one artifact.

The connector story is the nearer-term risk. Zenity Labs reported through Bugcrowd on June 4 that a single crafted ChatGPT link could feed instructions into OpenAI's agent builder, auto-wire the victim's existing connectors across Outlook, Teams, Slack, SharePoint and Google Drive, switch off approval prompts, and publish a scheduled agent. That agent read attacker emails tagged "TASK," searched files, took passwords and API keys, and sent phishing as the employee. OpenAI patched it in four days by removing the offending URL parameter. Automatic connector wiring and skip-the-approval onboarding both live on someone's backlog right now. Teams file them as activation improvements.

A second failure mode belongs in the same epic. Agent memory can be quietly poisoned so a corrupted belief lies dormant and triggers harmful action later, which defeats filters that only inspect immediate inputs. Agents that remember need memory integrity validation and audit logging of their own.

Why buyers care now. MIT Technology Review reports AI-generated errors reaching an official court transcript, reportedly the first known case, with judges also taken in by AI misinformation. The failure mode enterprises fear has shifted from "the model was wrong" to "a human trusted it anyway." That changes what a demo shows. Controllability and a measurable human-review catch rate become the thing on screen, and the disclaimer becomes the footnote.

The controls worth having early are the throttle, the rollback, and the audit log; they show up on procurement questionnaires before they show up in law.

A founder books $100M in revenue and watches $90M of it route straight to Anthropic or OpenAI. TLDR Founders' number is the moment worth sitting with, because cheaper inference does not land in your margin by itself. Here is what teams tell themselves: when the model gets cheaper, the savings are ours. Here is what customers actually do: they demand the discount at renewal, or they bring inference they already pay for. The routing win then shows up on the customer's invoice, not your gross margin. Unless the price is anchored to something other than tokens.

The token curve is moving against you on exactly the features you are adding. Agentic harnesses — coding agents, autonomous multi-step workflows — consume 10-100x more tokens than conversational features. A COGS model built in the chat era is off by an order of magnitude for anything on the agent roadmap. Separate the thing being pitched from the thing being done: a market has already formed to arbitrage the gap. Spot and secondary venues now trade idle GPU capacity and unused credits at 20-80% discounts to retail inference pricing, which makes procurement a lever the finance partner can pull.

The efficiency lever that customers never see. An open-source tool, code-review-graph, achieved a median 82x reduction in token usage by feeding assistants precise structural context through Tree-sitter instead of re-reading whole projects, and it re-indexes a 2,900-file codebase in under two seconds. That gain never appears on the price list, which is precisely why it stays yours. The caveat is sharp. Prompt-caching savings are fragile. Adding a tool, reordering a schema, swapping a model, or rewriting conversation history silently erases them. Routine roadmap moves can destroy an inference budget without a single alert firing.

The pricing assumption under attack. Fugu-Ultra v1.1 shipped a capability upgrade across coding, agentic and reasoning work at the same price as v1.0. Users are being trained to expect smarter AI for free, so any tier priced on model quality is a depreciating asset. The counter-move is already on the board. Cursor kept its cost-savings router on Teams and Enterprise plans only, converting an efficiency gain into an upsell instead of a giveaway — and leaving individual and SMB developers unserved if you want that wedge. That is the tradeoff, named in the same breath as the play.

Buyers are formalizing the question. Cursor, Google Cloud and BMO convene at Harness's FinOps Excellence Summit on July 29 specifically to connect tokens to outcomes and push cost guardrails into deployment pipelines. When a bank shows up to demand cost-to-outcome proof, that proof becomes an RFP line. "We don't measure cost per outcome" becomes an answer you have to give in writing. The forcing function here is the RFP, not the summit.

If your price is a markup on tokens, every efficiency win you engineer belongs to your customer.