# Local AI: A Question of Power, Not Price LLMS index: [llms.txt](/en/llms.txt) --- > Anthropic's threat report, OpenAI's soap opera, the closure of the $200 subscription tier, and rising GPU and memory prices—all of this week's events tell the same story. Three things happened this week. Taken separately, each looks like industry gossip. Put them together, and a complete picture emerges. First, on September 10, Anthropic published a [threat intelligence report](/work/anthropic-report.html) detailing eight months of abuse detected on Claude. It covers cyberattacks, influence operations, surveillance, fraud, biological threats, and weapons, with an entire chapter devoted to “unauthorized distillation.” Parts of the report are too sensitive for me to reproduce in full. What I can say is this: people are using Claude's API to run romance scams; some Chinese model vendors are secretly distilling it; and API relay services are reselling your conversation logs along the way. Second, OpenAI announced that a cluster of 10,000 agents had “solved” the Navier–Stokes equations. What should have been a historic achievement turned into a soap opera. NYU mathematician Buckmaster and his collaborator had kept months of drafts in Codex. He asked OpenAI whether its models had trained on their conversations. The answer: “The model does not look up user data.” He asked again about training. No answer. OpenAI's own blog was even more artful: it could not rule out the possibility that “de-identified data” generated by the two researchers using its products had helped improve its models—though that was “unlikely.” Third, also on September 10, OpenAI suspended new subscriptions and upgrades to its $200 Pro tier, Pro 20X. Existing subscribers can renew, but once you leave, you cannot get back in. The $100 tier remains available. The official explanation is overwhelming demand for the new Astra model and a shortage of compute. Meanwhile, GPU prices are rising, memory prices are rising, and so is the cost of local hardware capable of running large models. Phones, computers, and game consoles are getting more expensive too. Ordinary people are already paying the AI tax. Behind all three events is the same story: your data, your ideas, and your most sensitive information are being assigned a price. --- ## 1. The Victim Is You, Not Anthropic Start with the report. Most people read it as a story about bad actors using AI. I read it as a story about where the data goes. Take the romance scams. A Chinese app studio built a network of more than 20 dating apps with Claude playing the people you chatted with, while claiming that everyone was real. During a two-week observation window in April 2026, Anthropic counted more than 4,700 AI personas chatting with at least 25,000 people. Claude sent roughly 2.36 million messages. The target users were in the United States. The feeds were 75% AI personas and 25% human gig workers. The humans handled what AI could not—video calls and following users back on social media—to convince you that the person on the other end was real. Three AIs to one human: an industrial staffing ratio. Sending messages and making matches consumed credits. When the credits ran out, users bought coins. One detail in the report made me deeply uncomfortable. In a small sample, the model's own reasoning recognized that the person it was talking to had disclosed a serious illness or was in distress. Yet it did not refuse; it stayed in character. The system prompt looked like an ordinary companion app. No individual conversation revealed the monetization scheme or the deception. This was someone using another company's model to defraud a third party. The victims were the source of the data. Then there is distillation, the part that directly concerns you and me. Since first disclosing distillation attacks in February, Anthropic has caught seven more Chinese labs. Their names are familiar to anyone following the industry; the report names them, and I will not repeat the list here. I am more interested in how they did it. The largest operation used more than 3,500 fraudulent accounts at its peak, generating nearly 3 million interactions a day. Anthropic observed more than 150 million interactions from May through July. The target was Claude's chain-of-thought reasoning traces, collected for supervised fine-tuning (SFT). This is “normal” distillation: write your own questions, ask Claude, and save the answers. Other operations worked differently. One model company quietly forwarded its users' requests to Claude, then returned Claude's answers as if its own model had produced them. Users thought they were using a Chinese model; they were getting Claude. Nearly 300,000 requests were forwarded in ten days through a proxy network of 5,380 accounts that appeared to be in Singapore and Japan. As it forwarded the requests, the company saved the interactions and extracted Claude's chain of thought to train its own model. Another company was more selective. It inspected strings in incoming requests, tagged users of frameworks such as Claude Code, the Claude Agent SDK, and OpenCode, and specifically routed those users' requests to Claude Opus. Why those users? Because they were doing real work. These were agent tasks—the data most valuable for distillation. Another saved its users' conversations and coding sessions with its own model, then replayed them to Claude afterward, asking Claude to answer again to generate SFT and reinforcement learning (RL) data. The report mentions almost in passing that the company offered a free trial when it launched a new model, then extended it. Most of the distillation targeting Claude happened to begin near the end of the trial period. Draw your own conclusions about that free trial. Then come the relay services. The report describes a secondary market: proxy networks that sell Claude access to users in unsupported regions while saving their conversations with Claude and selling them to labs. One lab's distillation pipeline included user conversations purchased from “third-party data providers.” Another set up its own relay service through a shell company with no apparent connection to the parent. It sold only Anthropic and OpenAI models, no Chinese models—not even its own. I hardly need to explain what that relay service was for. ![Screenshot of a post describing purchased LLM relay data and exposed credentials](buy.webp) Who were the victims? These forwarded, replayed, and resold interactions contained sensitive information belonging to individuals and large multinational corporations: names, email addresses, and company data from hundreds of end users, in at least twelve languages. The report provides two redacted examples. One was a pharmaceutical company's internal capital expenditure forecast, including estimates for plant expansions in Ho Chi Minh City, Kuala Lumpur, Bangkok, and Ljubljana from 2026 through 2028. The user thought they were giving it to a Chinese coding assistant. The other was a developer debugging a notification bot who pasted in a Telegram bot token, a Feishu `appSecret`, and a Notion integration secret. Those credentials were still valid at the time. A technology company employee also used a “Chinese model” to analyze internal documents containing the complete specification, organizational structure, and strategic goals of a flagship AI project. An engineer at a large state-owned enterprise exposed internal code and valid credentials from several major companies. I cannot go into detail on that one. Here is the chain. You type a prompt into a client and send it to a “Chinese model.” The service sees that your request involves real work and forwards it to a relay. The relay saves a copy and sends it to Claude. Claude's answer travels back along the same route. The relay saves the answer, the model vendor saves it too, and then the vendor presents Claude's answer to you as its own. Your data gets copied at every stop. Each copy could feed the next training run or be bundled up and sold. And the whole time, you think you are simply using an inexpensive Chinese model. ![Conceptual illustration of a user's conversation being copied into multiple archives as it passes through a model service and an API relay](data-relay.webp) Ultimately, these model vendors and relay services are after the data. **You think you are getting a free ride, but you are the one paying for it.** --- ## 2. OpenAI's Soap Opera: It Cannot Even Say “We Didn't Train on It” The report covers Chinese vendors and relay services. OpenAI's episode brings us to the “legitimate” operators. Here is the timeline. On September 1, rumors circulated that Anthropic researchers might have solved two Millennium Prize Problems. OpenAI staff later acknowledged on Twitter that these rumors prompted them to set a newly trained internal model to work on the remaining problems. On September 3, Buckmaster contacted OpenAI to explain that this was a personal collaboration between him and Anthropic researcher Alpöge, not an Anthropic project. On September 6, OpenAI told them its system had achieved something bigger: a proof of finite-time blow-up for Navier–Stokes. On September 7, the two researchers made their work public. Buckmaster says he and his collaborator had kept all their drafts for the project in Codex conversations for months. He asked OpenAI whether its model had trained on or accessed those conversations. The answer was that the model did not look up user data. He asked again about training. No answer. OpenAI executives denied that any employee or agent had seen the work before publication, but OpenAI's own blog would not rule out the training-data route. I am not going to judge whether the proof was plagiarized. That is for mathematicians. What concerns me is the phrase “cannot rule out.” What does that mean? It means the default terms of a consumer subscription allow your conversations to be used to improve the model. They did not deceive you. It is there in black and white, just somewhere you never click. The mathematicians put months of work into the tool because it was useful. At $20 or $200 a month, it was far cheaper than hiring a postdoc. Only when the company deploys 10,000 agents and spends millions of dollars on compute to cover months of your work in a few days do you think to ask: did you train on my work? The answer: hard to say. **This is what trading data for compute looks like in plain sight.** As for the Agent API OpenAI released today, it practically lays the cards on the table. Previously, you had to provide the agent's execution environment yourself. That sounds inconvenient, but your credentials, secrets, and private information stayed local, right? If it tried anything, you could detect and block it at the gateway. But if agents all move to the cloud, doing anything useful may require you to hand over your keys, credentials, and all sorts of other things—willingly. And it would become much harder to audit how the agent used them or what it actually did. --- ## 3. Subscription Subsidies: A Game of Musical Chairs A few months ago, in [*AGI Machine Guns Are Now Standard Issue*](/en/ai/ai-machinegun-for-everyone/) and [*How Do You Burn Through 10 $200 Codex Subscriptions?*](/en/ai/10x-subscription/), I argued that today's $20 and $200 monthly subscriptions are fundamentally a trade: data for compute. Price the inference you can burn through on a $200 Pro subscription at standard API rates, and the API bill would be tens of times higher. Where does that difference come from? Half is subsidy, spent to win users, market share, and an impressive growth curve ahead of an IPO. The other half is your data. Consumer products can use your conversations for training by default. You can turn it off, but it starts on. Enterprise APIs do not train on your data by default, and zero data retention (ZDR) requires a separate arrangement. That clause is at the heart of the price gap between subscriptions and metered enterprise APIs, which can cost tens of times more. My judgment at the time was that these subsidies could never be permanent. Once the company had enough data, or was heading for an IPO, they would stop. This is a game of musical chairs. Now the first signs are here. On September 10, OpenAI suspended new $200 Pro subscriptions and upgrades. Its official explanation was that demand had surged during Astra's first week, and the Pro tier put the most pressure on the system. I do not doubt that explanation. Compute really is tight. But look at it another way: the tier losing the most money was the first to close. The $100 Pro 5X tier is still available, but compared with the 20X allowance, you pay half as much for a quarter of the usage. You get half the value for your money. My prediction is that the $100 tier may change before long too. The rules are revealing: existing users can renew, but once you leave, you cannot return. That is a filter. Users willing to keep paying $200 and keep producing high-quality data stay. Everyone else is directed to the $100 tier. The backdrop is OpenAI preparing for an IPO, while a leading Chinese model company is preparing to list on the STAR Market. Public companies cannot keep carrying subsidy losses on their financial statements indefinitely. If we accept enterprise API pricing as the economics of normal operations, subscriptions subsidized by a factor of 20 or 50 serve as temporary loss leaders. When they end depends on when the companies decide they have enough data, have locked in their users, and have sold their growth story. That is why I keep saying: use the subsidy while it lasts. If this window has only a few months or half a year left, the obvious move is to exploit it fully and use those months to make as much progress as possible. I have not changed my mind about that. But there is another side to it: while the compute flows toward you, know where your data is flowing. --- ## 4. What Is Your Moat, Really? There is a fundamental question here: in the face of AI, what is your moat? You can write code. So can AI. You can write essays. So can AI. You can design architectures, review contracts, and work through models. AI can do all of that, and it keeps getting better. None of those skills constitutes a moat against an AI company. What really protects you or your company from these AI companies is neither compute nor models. It is data. More precisely, it is your memory: who your customers are, how you set your prices, which mistakes you have made, what experience you have that others lack, and what you are thinking about that nobody else has thought of yet. This is the core of who you are. What fundamentally distinguishes one person from another, after all, if not the arrangement of neurons in their brains? What was the mathematician's moat? The line of reasoning he had developed, step by step, over months in Codex. Codex could write the code too, but that path was his. Then he paid $200 a month to hand it over, happily. **Why is data a moat? Because data is power.** ![Littlefinger and Cersei discuss knowledge and power in Game of Thrones](knowledge-is-power.jpg) Someone will say, “Power is power.” Cersei and Littlefinger could argue about that. But I mean something specific when I say data is power: data lets other people exert influence over you. Know your finances, and they can tailor their approach. Know your health, and they can price your insurance just right. Know what you watch, and they can tune your recommendations just right. Know your repayment habits, and they can set your credit limit just right. People in the West have a more immediate sense of this: ruin your credit, and everyday life becomes difficult. This is the territory of *Black Mirror*. Another example: OpenAI has publicly said that when it detects someone planning to harm others, human reviewers investigate and may refer the case to law enforcement. Stories have also circulated online about AI conversations ending with the police showing up. That sounds like a good thing, and it is. But it also tells you something: the company has the ability to detect and see what you say. I have no evidence that OpenAI or anyone else is deliberately rummaging through your chat history. I am making a technical point based on eleven years of working with databases: at the scale of OpenAI or Azure, DBAs and SREs very likely have the permissions to see everything. Most of the time, they simply have neither the interest nor the time. If you are a nobody, who wants to read your chat logs? But if you are a high-net-worth individual, your ideas, decisions, tax arrangements, and legal situation are extremely valuable information. Store that information in someone else's database, and there is no guarantee that a determined person will not collect it and use it to deliver a devastating blow later. Here is a personal hunch. Do not take it too seriously; treat it as gossip. Perhaps the real reason Anthropic bans accounts so frequently is not the stated concern about IP addresses or account sharing. I have used data center IP addresses to ask all kinds of sensitive questions, crossing practically every red line they list, and have never been banned. My guess is that accounts judged to produce valuable data get to stay, while accounts judged to have no value can be removed on whatever pretext is handy. This is speculation. I have no evidence for it. But one point requires no guesswork: in a business model that trades compute for data, the platform must be assigning a value to every account. That is business logic, not a conspiracy theory. Privacy matters enormously. That is not an empty, politically correct slogan. **Data is power. When you hand over your data, you hand over power.** --- ## 5. Why I Use These Services So Heavily Myself At this point, someone will ask: you run a dozen or so subscriptions and burn hundreds of agent-hours a day. Aren't you the most enthusiastic data donor of all? Yes. And I would love them to train on all of it. Because I build open-source software. Pigsty's code and documentation, my essays, and my ideas about architecture are meant to be published, copied, and shared as widely as possible, and added to humanity's body of knowledge. If they enter AI's “collective consciousness” through training, my ideas can have more influence through countless conversations. That is exactly what I want. This is the open-source communist approach: my output is already a public good. Training on it helps me spread it. They want to trade compute for data, but my data is already public. They gain essentially nothing extra, while I get an extraordinary deal: top-tier intelligence at a few percent of its price. This is why I call it a golden age for a one-person infrastructure company. With no work I need to hide or keep secret, this subsidy model feels made for me. I do not use those same accounts for sensitive personal information. I have a separate account for personal matters, with the “improve the model with your data” setting turned off. It does not offer enterprise-grade zero data retention, but at least it promises not to train on my conversations and to delete them on a rolling 30-day basis. I do not know whether they actually get deleted. But at the very least, turn that setting off. Another important point, which I have discussed before, is jurisdictional arbitrage over data. Put simply, for someone in China, a leak of personal data to Anthropic or OpenAI may have no direct effect; similarly, a Westerner's personal data leaking to China's GLM or DeepSeek may have little effect on them—because the data crosses jurisdictional boundaries. I discussed this in [*Trading Privacy for Convenience? What Cloud AI Assistants Mean*](/en/ai/cloud-agent/). For that reason, I would not use China's various “Buddy” and “Coder” products even if they paid me. My principle is to distinguish what should be public from what should stay private. **For public material, treat it as advertising: feed it in, the more the better. For confidential material, not a single byte should leave your local network.** If you want to preserve what makes you or your company distinctive and irreplaceable, your core assets are precisely the things you cannot publish: customers, case details, formulas, strategy, and unpublished research. Hand those over casually, and you are selling the part that makes you you for $20 a month. I have quoted Palantir CEO Alex Karp before on this: AI model API calls are essentially the largest transfer of data in human history. --- ## 6. The Case for Local AI Is Political Does local AI pay off? Honestly, on purely economic terms, it loses badly. Take the latest example. DeepSeek released V4.1 Flash on September 10: 552 billion total parameters, 16 billion active parameters, open weights under the MIT license. It is one of the strongest models you can currently run on a single machine. Buy a fully loaded Mac Studio for close to RMB 100,000, run a quantized version locally, and 80 tokens per second would be a decent result. The official API? Hundreds of tokens per second, several times faster, at a little over $0.20 per million input tokens and a little over $0.60 per million output tokens. Even if you run the machine flat out, 24 hours a day, producing 7 million tokens daily, the equivalent API savings come to less than $5 a day—a little over $1,000 a year. It would take six or seven years just to recover the hardware cost, before electricity. An ordinary user will struggle to use it for even two or three hours a day. That pushes the payback period into decades. On tokens alone, the numbers will never add up. And local hardware prices keep rising. This time the driver is memory, not cryptocurrency mining. The three major memory manufacturers are shifting capacity toward HBM and server memory. The result: the 5090 selling for $5,090, the 6000 Pro for well over RMB 100,000, and the GB300 racing toward RMB 15 million, with no stock to buy even at that price. Even the Switch 2, PS5, iPhone, and Mac mini are getting more expensive. Local hardware that can run large models is more expensive today than ever, and tomorrow it will cost more. It is the same story as DHH's 19 PB of all-flash storage jumping from $1.5 million to $19 million. Cloud compute is draining the supply of consumer hardware. If you want to build your own, the window is narrowing. So why do I still expect these machines to sell like crazy? Because this is not an economic calculation. It is a political one. What do I mean by political? Put your data on one side of the scale and the extra cost on the other. The money barely deserves a second glance. What are months of a mathematician's reasoning worth? A pharmaceutical company's three-year expansion plan? A law firm's case files? The complete specification for your company's next product? These things are priceless. Comparing them with sixty cents per million tokens is absurd. ![A scale weighs memories and research material against a few coins, illustrating the difference between the value of private data and the cost of inference](data-value.webp) *Local AI protects the value of your data, beyond what appears on an inference bill.* Some places have high taxes; others have low taxes. But a low tax rate is only attractive if you are safe. Safety is the leading 1 in a number: without it, all the zeros that follow amount to nothing. Local AI is that 1. My definition of local AI is practical. You do not have to cancel every cloud subscription. You do need the capability. You need a machine that can run a capable model with open weights, and it must be able to process your sensitive data without that data leaving the premises. For everyday public work, burn through your subscription tokens. Use the subsidy while it lasts. --- ## 7. This Is the Same Argument as Leaving the Cloud I have spent years arguing for leaving the cloud. Some people think I mean going back to a data center and building everything from the rack up. I do not. I mean getting off the SaaS and PaaS products that lock you into a cloud vendor. Buy basic cloud resources if you like. I use inexpensive infrastructure providers such as Hetzner and DMIT every day. But you should not be locked into their databases. Now I would add: you should not be locked into their models either. Why single out those two? **Because databases and models are the two most critical points of data exposure in your entire system. Your database holds all your facts. Your model processes all your intentions.** You can outsource other things. These two, you cannot. In my writing on leaving the cloud, I have described a chain: without the ability to host it yourself, you have no right of exit; without a right of exit, you have no bargaining power. Cloud PaaS lock-in is how you become a “digital serf.” The same chain holds in the AI era. Without local inference, you have no right of exit. The subsidy ends, your account is banned, the terms change, the model is withdrawn, or your conversations are used for training—and you simply have to accept it. Local capability lets you negotiate and choose: use a subscription for this job, keep that one at home. Hybrid cloud requires the ability to do without the cloud. Hybrid AI requires the ability to do without cloud models. There is also a simple practical difference: querying a database or reading a model's API call logs is nothing like stealing a hard drive. If your data is in someone else's database, one SQL query will do. If it is on a disk in your own rack, someone first has to break into your premises. Local does not mean perfectly safe, but it turns “looking at your data” from a permissions problem into a physical one. That is the difference. I have argued before that the data world is converging on two things: PostgreSQL and object storage—a database and a filesystem in a new guise. The AI era adds a third: a local model. Together, these are your sovereign infrastructure. The database holds facts, object storage holds files, and the model holds intelligence. Only when you control all three are you fully your own person. Pigsty handles the first two. I am thinking about the third, but that is another article. ![A database, object storage, and a local model form three pieces of infrastructure under the user's control](sovereign-stack.webp) --- ## 8. A Few Predictions Put this week's three events alongside the past few years of leaving the cloud, and I have a few predictions. I may be wrong. Feel free to prove it. **First, subscription subsidies will shrink substantially within a year.** Closing the $200 tier is the opening move. OpenAI wants an IPO, Chinese vendors want to go public, and their financial statements cannot sustain permanent subsidies. The retreat will come through caps, reduced allowances, and segmentation rather than simple price increases: existing users can renew while new users cannot join; expensive tiers remain while cheaper tiers lose capacity. The allowance $200 buys today will probably cost $400 a year from now—or be unavailable altogether. **Second, data terms will move from the fine print to the sales pitch.** “We do not train on your data” will become a basis for pricing, rather than just a compliance statement. The same model capabilities will come at two or three prices depending on the data terms. Enterprise APIs cost tens of times more than consumer subscriptions; that difference is essentially the price of those terms. **Third, the API relay industry will face a crackdown.** Anthropic has begun identity verification and bans based on attribution to organizations. Others will follow. All three parties have reasons to turn against the relays: model vendors hate the circumvention of their restrictions; users will eventually discover that their conversations are being recorded; and publicly named labs will find it harder to keep buying from them. And then there is this latest… **Fourth, open weights and local hardware will form a second supply chain.** There is an interesting contradiction here. The Chinese vendors named in the report are distilling others' models while releasing open weights themselves. V4.1 Flash came out under the MIT license. As I have said before, operating systems have Linux, databases have PostgreSQL, and Chinese companies are leading the open frontier in AI. However they trained their models, once the weights are released, they become a public good. You can run them on your own machine, and doing so no longer sends your data elsewhere. Let them settle the distillation dispute with Anthropic. The benefits of open weights belong to everyone. **Fifth, local hardware will keep getting more expensive, and a category of machines built for local AI will emerge.** Today we have machines such as the Mac Studio and systems based on the AI Max 395 that happen to be able to run models. Tomorrow we will have integrated machines designed specifically for 500-billion-parameter mixture-of-experts (MoE) models. Early buyers will look back a few years later and realize they got a bargain, just like people who bought NVMe all-flash storage early. **Sixth, companies will classify their data.** As with leaving the cloud, first distinguish what can leave and what cannot. Burn through subscriptions on data that can; keep the rest local. Over the next year or two, this will be one of the most practical tasks in enterprise AI adoption: sorting the data, not choosing the model. The last point is advice, not a prediction: **use the subsidy while it lasts, and keep a lifeboat ready.** Those two things are compatible. Make the most of the next few months, use every bit of the available capacity, and make as much progress as you can. At the same time, keep your memory in your own hands and prepare your local capability. --- ## Epilogue Back to the mathematician at the start. He did what everyone is doing: found a useful tool and put his most precious work into it. His only mistake was forgetting to ask who owned the tool. You should not sell that work for $20 a month, or give it away just because someone else's model is useful. Open-source work and material meant for publication? Take it all—the more it goes into training, the better. Private material that could ruin you? Not a single byte should leave your local network. Local AI is not an economic calculation. The economics will never add up. **It is a question of power: does what is yours still belong to you?**