Six of the Ten Most-Used AI Models Are Chinese. Risky.

What live usage data — trillions of tokens a week — reveals about the AI your company is actually running, and the questions a regulated business should be asking.

Ask an executive which AI their company uses and you’ll hear the same three names: ChatGPT, Copilot, maybe Gemini.

Ask the usage data and you get a very different answer.

OpenRouter is an aggregator that routes AI requests to hundreds of models through one API. Because developers and apps use it to reach whichever model is best for the job, its public rankings page is one of the few places you can see revealed preference in AI: not benchmarks, not vendor press releases — actual tokens, paid for and processed.

This is what it showed the week I wrote this.

The most popular AI models right now

The OpenRouter LLM Leaderboard, first week of June 2026 — origin column added for analysis.

Three things in this table deserve a place in your next risk meeting:

Six of the ten most-used models are Chinese. DeepSeek holds three of the top ten spots, Xiaomi two, Tencent one. Together, Chinese models account for roughly two-thirds of the tokens flowing through the top ten — about 11.5 trillion of 17.7 trillion tokens in a single week. The names your board would recognize — Anthropic, Google — hold three spots between them.

The #4 model is anonymous. “Owl Alpha” is a cloaked preview — a model published deliberately without attribution so the community can test it blind. It processed 1.93 trillion tokens last week. That is a meaningful slice of the world’s AI workload running on a model whose maker, training data, and jurisdiction are undisclosed by design.

The churn is violent. Xiaomi’s MiMo-V2.5 grew over 999% week-over-week. Claude Opus 4.7 dropped 44% in the same window, largely as usage migrates to its newer release. The “most-used model” answer changes monthly. Any governance process that approves a model once a year is governing a snapshot that no longer exists.

AI usage grew roughly 10× in a year

Weekly tokens routed through OpenRouter, June 2025 → May 2026. Screenshot from openrouter.ai/rankings, captured June 4, 2026.

A year ago this chart sat around 3 trillion tokens a week. It now runs at roughly 30 trillion — about a 10× increase in twelve months, through one aggregator alone.

Adoption at this slope is bottom-up. It is developers picking the cheapest capable model, teams wiring AI into internal tools, and SaaS vendors swapping models behind the scenes. None of it waits for a steering committee.

Why the cheap models are winning

The #1 model isn’t winning on quality benchmarks. DeepSeek V4 Flash is winning on price-performance: it is good enough for the bulk of real workloads — extraction, summarization, classification, routine coding — at around $0.20 per million input tokens, a fraction of frontier pricing.

This matters to you for one specific reason: your software vendors feel that price gap too. Every SaaS product that added an “AI feature” has a margin incentive to route your data to the cheapest capable model — and to switch silently when a cheaper one appears. The model named in last year’s vendor review may not be the model processing your documents today.

Are Chinese AI models a compliance problem?

Here’s the nuance that separates a useful policy from security theater. I read the terms, privacy policies, and provider data-handling disclosures behind this leaderboard so you don’t have to, and what they actually say is more interesting than the headline.

The model is not the provider. The #1 model, DeepSeek V4 Flash, is currently served through OpenRouter by six different providers: two US hosts (DeepInfra, GMICloud), two routing through Singapore (Alibaba Cloud International, SiliconFlow), and two mainland-China providers (Baidu Qianfan, StreamLake). Same weights, six jurisdictions. Which one touches your data is a routing decision — driven by price and uptime unless you constrain it. An open-weight “Chinese” model running on US infrastructure under a zero-retention policy is a different risk object than the same model behind a mainland endpoint. The nationality of the weights is the wrong question; where your tokens land is the right one.

The provider policies are public — and uneven. OpenRouter publishes every provider’s retention and training policy. Amazon Bedrock, Azure, Fireworks, Together, DeepInfra: zero retention, no training. Xiaomi, sole host of the #3 model: 30-day retention, no training. DeepSeek’s own endpoint: retention period unknown, and it may train on your prompts. And if your team uses DeepSeek’s first-party app or API directly, its privacy policy says it plainly: “we directly collect, process and store your Personal Data in People’s Republic of China.” The model and the company are two different risk decisions — most policies I’ve seen conflate them in both directions.

The anonymous model logs. Owl Alpha — #4, almost 2 trillion tokens a week — is served by a provider listed simply as “Stealth,” and OpenRouter’s own model page notes that prompts and completions may be logged and used to improve the model. That is a meaningful slice of the world’s AI workload, handed voluntarily to an unnamed party with training rights.

Controls exist — shadow usage just doesn’t use them. OpenRouter itself doesn’t store prompt content by default, and offers exactly the levers a regulated buyer needs: exclude providers that train, restrict routing to zero-retention providers, pin an explicit provider allowlist, and — for enterprises — EU in-region routing that keeps traffic inside the EU. The provenance tooling is better than most procurement teams realize. The catch: it only governs traffic on accounts you control. Your employee’s personal API key carries none of your settings.

Your contract is thinner than you think. OpenRouter’s terms make you responsible for each model’s terms — which may be modified by the model provider at any time, with continued use counting as acceptance. Meanwhile, most vendor DPAs pin a provider, not a model + host + jurisdiction. If your vendor routes freely to whatever is cheapest, your sub-processor list is fiction. Add the regulatory layer — the EU AI Act’s transparency obligations for general-purpose models are in force, and DORA holds EU financial entities accountable for ICT third parties — and “whatever was cheapest that week” becomes an answer you really don’t want to give an auditor.

Popular is not the same as permissible. But you can’t even ask the question until you know what’s actually running — and where.

(There’s a second story hiding in this same data — the biggest consumers of AI tokens are no longer chatbots but autonomous agents, including one with standing access to users’ inboxes. That one deserves its own piece; it’s next. Follow along if you’d rather not find out from an incident report.)

What to do about it: a five-step provenance check

If you run technology, risk, or compliance in a regulated business, this is the short version of what I’d put in motion this quarter:

1. Inventory reality, not policy. OAuth grants, expense lines, browser extensions, and network egress will tell you which AI tools and agents are actually in use. Expect surprises.
2. Put the model question to your vendors. Which models, which hosting providers, which jurisdictions — and what is their routing/substitution policy? Get the answer into the DPA and the sub-processor list, pinned as model + host + jurisdiction, not just a vendor name.
3. Stand up an approved-model registry behind a gateway. One logged, controlled route to a defined set of models — so “which model touched this data” becomes a query, not an investigation. Enforce the policies your gateway already offers: zero-retention-only routing, no-train filters, provider allowlists, in-region routing.
4. Tier by provider and jurisdiction, not by model nationality. The same open weights behind a US zero-retention host, a Singapore reseller, and a mainland-China endpoint are three different risk tiers — and an anonymous cloaked preview is a fourth.
5. Re-check monthly. The leaderboard above will look different in four weeks. A model that grew 999% in a week deserves a faster review cycle than your annual vendor assessment.

One caveat about the data: OpenRouter’s traffic skews toward developers, startups, and indie apps. A roleplay chatbot platform sits in its top-10 apps!

Treat it as a leading indicator of what reaches your enterprise next, not a census of what’s inside it today. That’s exactly what makes it worth watching: you’re seeing the supply chain form before it shows up in your stack. (And to its credit, the rankings are built from request metadata and anonymously sampled topic categorization — not stored prompt content.)

I work as a fractional CTO for companies in regulated industries, where “which model is allowed to touch this data” is a weekly conversation. If it’s on your desk right now, the fastest route is a conversation: book 30 minutes with me, and bring your vendor list.