ChinaTalk 调查美国数据公司向中国 AI 实验室出售 RL 环境的现象

American data companies like Mercor, Surge AI, AfterQuery, and Turing are selling roughly half a billion dollars worth of data to Chinese AI labs. A chunk of that data comes in the form of reinforcement learning (RL) environments, which labs use to post-train their models to make them excel at specific domains like coding, cyber, finance, law, and bio.

Post-training, and especially RL, is one of the most important indicators of the final performance of a model. Whenever a new model within a single generation drops, the advances from the previous release are entirely due to post-training. The difference between Opus 5 to Opus 5.5, or from GPT 5.5 to GPT 5.6, is not due to a new pre-training run. Since they have the same base model, the capability gains come from researchers teaching the model to get better at specific domains.

The phenomenon of American companies arming Chinese labs with the data that enables this RL should set off alarms for policymakers and those invested in the U.S.-China AI race: American companies are helping Chinese labs develop better models, and we were able to find at least nine who do so. But the business relationships between data vendors and Chinese labs are more complicated than that single hawkish line, and today, we’re diving into what’s going on. We’ll cover:

• What it means to sell an RL environment and how it differs from distillation

• The current ecosystem of China-tied data vendors

• To what extent American companies are selling RL environments to China

• Whether this is a problem that needs fixing

What RL Does and Doesn’t Look Like

Example RL Flows

RL environments are essentially simulated worlds in which a model can train to improve its performance at specific tasks or environments. As an example, a model developer may want their model to get better at creating PowerPoint slides with pleasant aesthetics and clear text. To achieve that capability, the model developer may go to a data vendor and ask them to make a clone of PowerPoint so that the model can train repeatedly and learn how to use tools to make a good slide deck. The product the vendor is selling may include the PowerPoint clone itself, as well as a grading rubric to determine whether or not each of the model’s outputs should be rewarded or disincentivized.

For something as nebulous as a “good” PowerPoint, data vendors often contract human experts to create rubrics or sample grade slide decks. They might hire McKinsey consultants, professional designers, and other experts to create the perfect PowerPoint rubric, which the model developer will use in RL.

At the beginning of the post-training run, a model might be churning out low-grade slide deck slop. This is typical of early “rollouts,” or instances of the model solving (or attempting to solve) the task. But by being in a PowerPoint-like environment and learning from grading rubric signals, the model gradually gets better at using the app until it produces a quality product. This is “RL” in a nutshell. It is often specific to one domain (like PowerPoint creation, navigation of live websites, or using spreadsheets for data analysis), so developers are purchasing countless environments to drive improvements across a variety of tasks and fields. When your model suddenly starts functioning in Slack or Google Docs, it is because the developer post-trained it to be better in those environments.

For the PowerPoint example, the value the data vendor provided was in creating the app clone and in having a network of experts to create a good rubric and stress test the clone. But other environments require less active work and are more about having the right data. For coding environments, for example, data vendors spend huge amounts of money purchasing company GitHub repos; this data will include bugs in codebases and the fixes the company’s engineers employed to patch those bugs. With that data, a developer can give the model the codebases with the bugs present prior to the patch and test whether the model found the fix.

What makes the RL environment valuable is its ability to actually improve the model’s capability. Not all environments are created equal, and a vendor’s environment becomes valuable when it has sufficient data diversity, good task choice, and proper difficulty calibration for a particular model.

Chinese Labs can Piggyback Off American Labs to Save Compute

American vendors helping a Chinese model get better at slide decks might seem innocuous, but the issue arises when Chinese labs are able to procure environments related to sensitive domains, and when these environments enable piggybacking off American labs. By selling environments for coding, for example, data vendors are also assisting Chinese models in exploit-finding and offensive cyberattack capabilities. Environments for biology-related tasks could upgrade models’ abilities in gene synthesis and bioweapon design. The line between an acceptable environment and a dangerous one can be hazy, and right now, almost everything is kosher.

RL environments are also not perfect on the first try. Perhaps the initial PowerPoint clone had bugs, the grading rubric was rewarding incorrect behavior, or some dataset was low quality. With the vast amount of data vendors out there and the even larger amount of products they sell, model developers can waste time and money procuring RL slop. Thus, Chinese labs have been reported to purchase exactly the same products as American labs like Anthropic and OpenAI so as to acquire what they know to be good data. The exact compute savings vary significantly depending on the exact environment, but one study suggests that rollouts (RL runs) consume more than 70% of RL post-training time, so these savings are not insignificant. This is especially true for Chinese labs, as rollouts rely on inference. Inference operations are memory-constrained compared to most training operations which are compute-constrained, and Chinese chips, more than lack of compute, suffer from a lack of high-bandwidth memory (HBM). Therefore, saving on memory-constrained operations is a huge boon to their model development.

American labs may pay up to four or five times more for an exclusive product to avoid this piggybacking phenomenon and keep their post-training recipes confidential, but even then tacit knowledge trickles down to Chinese labs. If a data vendor cannot make the exact same PowerPoint clone for a Chinese client, they can still avoid making the same mistakes when they create a similar environment for competitors; this again saves Chinese labs time and compute by streamlining rollouts and arriving at a good product quicker. Vendors even flaunt this dynamic, with Surge AI’s site marketing “RL environments built by the same experts behind our frontier-lab work.”

Distillation + RL Piggybacking = Problem

RL piggybacking allows Chinese labs to improve models at the final stage of post-training, making it arguably more important than distillation. Supervised fine-tuning (SFT) is the process before RL where distillation occurs.

Instead of creating an entire PowerPoint clone, distillation allows a developer to use a stronger model as a teacher to make better slide decks. A Chinese lab just asks Astra or Fable to make a bunch of good PowerPoint decks, and the Chinese model can learn from those examples. This is significantly cheaper in terms of dollar cost and compute compared to RL. In a way, however, this is also piggybacking off the RL environments the American lab used to get their models to create such pleasing slide decks.

It is unclear which of SFT or RL is “more” important, given conflicting evidence from recent model releases. Mistral Large 4, for example, demonstrated its major gains to be from RL, not SFT, on a variety of benchmarks. For Xiaomi’s MiMo-V2.6, however, SFT seemed to achieve more gains.

One explanation may be that Chinese labs are simply doing a lot more distillation, which is why they get more out of SFT than non-Chinese labs. Another explanation may lie in companies’ post-training processes outside of just the RL environment. Regardless, RL is what gets the model to its final capability, whereas SFT is the intermediate step. The first 50% of hillclimbing is significantly easier than the last 50%. It is what separates “pretty good” from SOTA.

The Wild West of Data Companies

There are dozens of data vendors, each with their own expert networks, domain specialties and data pools. A new data company sprouts up daily, trying to take advantage of the gold rush. With so much competition, many may find revenue sources in Chinese labs and even come to depend on them; one American vendor, AfterQuery, is reported to source half of its $100 million ARR from Chinese business. Other vendors may simply sell because it’s free money; after a product is made and sold the first time, the overhead on selling to other customers is functionally zero. Further, the value of a product decreases over time as model capabilities increase and diffuse, meaning vendors are incentivized to dump a product to as many customers as soon as possible before its value dries up. After too long, a model developer might as well use GPT-6 Astra to create good slides for SFT or even slide-making environments, rather than spending money on an environment from a vendor.

We did our best to search every nook and cranny to discover which vendors are selling to China, and these are the companies we could find:

• Mercor, one of the largest data vendors, sold SWE RL environments to Alibaba as shown in data we were able to access. Forbes reported that 2% of their Q2 2026 revenue came from China, and one anonymous source from a Chinese lab told us that they purchase from Mercor.

• SurgeAI, another large data vendor, has been purported by SemiAnalysis and Forbes to sell RL environments to Tencent, Z.ai, and Moonshot AI. We also found evidence possibly indicating Tencent as a customer, and the same anonymous source from a Chinese lab told us they purchase from Surge.

• Turing, a large data vendor specializing in code, sells data to Chinese labs like Tencent and Alibaba. We have found multiple pieces of evidence and posts from Turing contractors describing their work with Chinese labs.

• AfterQuery, a mid-size data vendor, depends heavily on Chinese business according to Forbes, though we were unable to find independent verification of any sales.

• Abundant, a small vendor specializing in code, has sold to ByteDance.

• Pareto, a mid-size vendor, has worked with ByteDance on human data collection. Pareto’s old website presented customer testimonials from ByteDance.

• DeccanAI, a start-up based in the US and India, has sold to Tencent and ByteDance.

• Eaglepoint, a small vendor based in the US and East Africa specializing in code and healthcare, has sold to ByteDance. Eaglepoint may be a subcontractor for other data vendors, and the company is majority owned by Beijing-based Mofy AI.

• Invisible, another American vendor, also sells to China, according to an anonymous source at a Chinese lab that purchases from them.

We apologize for being vague about our sources but decided against mentioning or linking them in case they get patched or removed later. If anyone in government is interested in seeing sources, please reach out to aqib@chinatalk.media and quinn@chinatalk.media.

These nine companies are only the companies we were able to find, and more definitely exist. We were only able to uncover these because of anonymous sources and sloppy business practices by subcontractors, who typically come from poorer nations with lower wages (most often India). Vendors have outsourced much of their environment creation and data organization to these subcontractors paid with peanuts, and the vendors then flip those products to customers for obscene markups. We have heard of products being sold for a thousand times what it cost to make them.

The downside of contracting thousands of workers in developing countries is that operational security is often atrocious. Contractors leak client names when they should have code names. They name the clients they work for on their LinkedIn posts and resumes. We imagine this type of evidence will become less available in the future as opsec gets better — and as using AI to create these environments eventually begins to rival subcontractors in price and quality — but it remains a hallmark of the vendor industry today.

If there are nine ants in your kitchen, you have more than just a nine ant problem. The only companies we are aware of who publicly are saying they forego any China business are Scale, micro1, and fleet.

One indication that the trend is widespread is high Chinese demand. Chinese labs are starving for American data vendors’ products, especially for expert-graded domains. Typically, Chinese labs prefer to build RL environments in-house, especially as its 3rd-party vendor industry is growing but still nascent. But for anything requiring expert graders and nicher domains, Western vendors fill the gap. A StepFun buyer job ad lists vendor deliverables like “repo, docker, task, trajectory, reward, rubric, verification.” Tencent’s CL-bench contains rubrics that appear to be written by Western experts. Thus, China gains access to expert graders that would otherwise be difficult to source domestically. These experts are used for building model capabilities in agentic coding, finance, writing, and a variety of office tasks. Further, even though Chinese labs can create a great deal of synthetic data in-house, they are always seeking external data to counteract their biases and improve their distribution.

We have also heard from people inside both the American and Chinese AI industry that Chinese purchasing patterns are nearly entirely predicated on benchmaxxing. This phenomenon has been covered before, though is still hotly debated in the industry. We have heard that the benchmaxxing phenomenon can be partially attributed to internal competition in Chinese labs. Competition across teams can be intense, and doing well on benchmarks is a tangible means of demonstrating your team’s value. Further, to boost their stock, companies must demonstrate their models are good. To demonstrate their models are good, they must show that they perform well on benchmarks. Thus, the labs have clear economic incentives to chase benchmark scores. Vendors, then, package datasets and environments specifically to market them as improving a model at any given benchmark. This purchasing pattern indicates that RL transfer is likely benign currently; many commercially relevant benchmarks simply assess coding and office tasks. But as models become stronger and benchmarks begin to represent more dangerous capabilities, then benchmaxxing presents a problem.

Beyond these tea leaves and leaked sources, though, we ultimately cannot know who is selling what — and therein lies the problem. Legally, few rules actually constrain these sales. Most firms have a limited customer policy, and in May 2026 Mercor narrowed its policy from an ownership test to a location test (before, after). RL environments are largely free from export controls aside from Entity-Listed buyers like Zhipu, but an unlisted ex-China affiliate easily sidesteps this (and it seems many don’t care about an Entity Listing anyway). Further, as work runs under client codenames, the contractors building environments often don’t know the end buyer.

Offshore contracting is also used so that US vendors can sell to Chinese companies without a local legal entity. ByteDance’s data-buying desks are in Singapore and San Jose. Chinese labs regularly post job ads seeking staff experienced with overseas suppliers (this goes for Tencent Hunyuan, Moonshot, MiniMax, Alibaba, and more). This contracting keeps deals outside both Chinese procurement records and most US rules.

The existing US rules mainly cover identifiable American data, medical data, and large amounts of unidentified data. The relevant regulations here are under the Department of Justice’s Data Security Program, the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA), and state laws relevant to medical data. These rules can explain why China’s nascent data industry is focusing on healthcare data, as that is the only subset where regulations truly apply. Besides these rules, however, everything seems to be fair play, and it is unclear to us if even these rules are closely heeded.

What Is to Be Done?

We Should Do Something

Some common sense policies should be enacted to limit the harms of these transactions. Namely, we should strive to limit the transfer of dual-use environments to Chinese labs, and the federal government has multiple weapons at its disposal to accomplish this in minimally interventionist ways.

Two common sense proposals include:

• BIS could restrict dual-use environments according to relevant existing rules. BIS already has rules against the export of products that enable chip design, cyberattack capabilities, and bioweapon development; we can creatively file relevant RL environments under those rules. More generally, BIS can send is-informed letters to vendors clarifying that licenses are required for sales to military end users and for bioweapon end uses.

• DoW should change procurement standards to prevent transfer of tacit knowledge to Chinese labs. Through FAR and DFARS, DoW can restrict its contracted vendors from selling to worrisome Chinese labs, thus preventing Chinese companies from piggybacking off of RL environments with clear national security ties.

Most importantly, however, the US government needs more visibility into what is going on. We can choose to take more restrictive steps if or when we detect vendors doing more business with Chinese labs, especially if more and more of that business is in dual-use domains. Chinese labs are often fast followers of American labs when it comes to what domains to focus on. When an American lab starts to buy data and environments for office tasks or deep research or whatever else, Chinese labs decide to purchase that next. We can take a page from MOFCOM’s playbook by announcing potential rules as a means of collecting data on the status quo of the industry before actually pulling the trigger.

Now that we are chasing cyber and bio capabilities, some Chinese labs may decide that is their next direction too. When that happens, we must be prepared to protect those sensitive domains without taking the entire industry down with it.

But Thankfully, it’s Not the End of the World

The data industry is the Wild West right now and needs some order, but ultimately, these relationships are not apocalyptic. We think the disastrous consequences can be exaggerated for a few reasons:

1. Harmful transactions fundamentally require lag between Chinese labs and American ones. To attain compute savings, Chinese labs must first wait for an American lab to purchase or create an environment before the Chinese client is able to repurchase them, perpetually keeping the Chinese labs at least a few months behind on model capabilities. These transactions only allow China to narrow the gap despite compute constraints, not pull ahead, and reduce the need for a strong Chinese data industry.

2. English-language and Western-context environments probably have limited carry-over for Chinese labs. Environments built for navigating applications like Google or Slack, for example, may not easily translate to Baidu or Feishu.

3. Sensitive environments for domains like life sciences, experimental biology, chemistry, cybersecurity, chip design, and investment banking have increasingly become in-house products for American frontier companies, as evidenced by increased hiring of domain experts by Anthropic and OpenAI. Chinese labs, for their part, are also increasingly turning inward for certain domains. For example, ByteDance is attempting to bring STEM experts in house. This trend will only intensify as AI becomes more capable of making good RL environments. (This does not cancel the threat entirely, however. Mercor has been hiring biology specialists for gene sequencing purposes too.)

4. RL environments are incredibly domain specific. Dangerous environments make up a small minority of total environments, and likely even a smaller minority of environments sold to China. For example, not all coding tasks translate to greater capabilities in cyberattacks.

5. Environments built on proprietary data — i.e., data that is the property of an American lab — cannot be resold. Labs increasingly purchase data for themselves, limiting the carry-over gains to competitors, even with tacit knowledge. We should be curious about the extent to which contracts brokering data between vendors and businesses, particularly SMEs, are being heeded, however.

Also, a dynamic and international market for RL environments probably leads to better models! Chinese open models that are better at benign domains like office tasks create healthy competition and more options for consumers, even if we want to limit dual-use domains like cyber and bio. RL environments for AI safety and alignment are also cropping up, and restricting Chinese access to these sorts of environments only increases the risk of AI safety incidents.

To receive new posts and support our work, subscribe!