In late July 2026, a joint letter from two US House committee chairs put food-delivery platform DoorDash in the hot seat. The two representatives co-signed a letter to DoorDash co-founder and CEO Tony Xu, investigating one question: why is the company using a Chinese-developed AI model, Kimi K2.6. A delivery company hauled before Congress for using a Chinese AI model — that's worth unpacking.
1. What Happened: Why Congress Is Eyeing a Delivery Company
Per public reporting, the letter was co-signed by Rep. John Moolenaar, Chair of the House Select Committee on the CCP, and Rep. Andrew Garbarino, Chair of the Homeland Security Committee. It was addressed to DoorDash co-founder and CEO Tony Xu, and it named Kimi K2.6 directly, demanding DoorDash explain its use of Chinese AI models.
The trigger is straightforward. Reportedly, DoorDash's internal AI research lab found through testing that Chinese-developed models (such as Kimi K2.6) outperformed US counterparts on certain tasks, and chose to adopt them. This "performance-first" engineering decision ran straight into a wall marked "national security." The lawmakers' core concern is data security: a platform handling massive amounts of American user data built its AI capabilities on a Chinese model — could data flow to China? Could the model itself constitute a supply-chain risk? These questions don't have answers yet, but the letter alone has already put DoorDash under the spotlight.
2. What Is Kimi K2.6: A Trillion-Parameter Open-Source Agentic Model
Kimi K2.6 comes from Moonshot AI, released on April 20, 2026, under a Modified MIT license. Key specs:
| Attribute | Spec |
|---|---|
| Developer | Moonshot AI |
| Release date | 2026-04-20 |
| License | Modified MIT |
| Architecture | 1T parameter MoE, 32B active |
| Features | Native multimodal, agentic, self-correction |
One important distinction: Kimi K2.6 and Kimi K3 are different models. K2.6 was released in April and is the protagonist of this story; K3 was released on July 17, and The New York Times called it "the world's largest open-source system." Don't conflate the two.
The fact that DoorDash's internal lab selected Kimi K2.6 means it was genuinely competitive in real-world tasks. Open-source models outperforming closed-source flagships on specific benchmarks is no longer an isolated case in 2026. But between "works well" and "can be used" stands a wall of compliance.
3. The Core Tension: Performance vs. Compliance Risk
DoorDash's selection logic is simple: use whichever model performs best on the tasks you need. This is the most natural engineering decision. Based on public information, DoorDash's internal AI lab concluded that Chinese-developed models outperformed on certain tasks. If this conclusion came from real benchmark testing, it reflects a 2026 reality — Chinese open-source models have caught up with or surpassed US counterparts in some capabilities.
But lawmakers see the other side. DoorDash holds data on hundreds of millions of American users — addresses, spending habits, location traces. A company like that building AI capabilities on a Chinese model, even if the model is open-source and can be deployed locally — is the data processing chain truly secure? Could the model weights contain backdoors? For engineering teams, these are verifiable technical questions. In Congress, they become geopolitical issues.
The core contradiction: engineers select by performance, regulators set walls by risk. When "the best model" comes from a country labeled a strategic competitor, these two logics cannot auto-align.
4. The Broader Context: Not Just DoorDash
DoorDash isn't the only company targeted. Per public reporting, Moolenaar and Garbarino also sent similar investigative letters to Airbnb and Anysphere (the parent company of Cursor), likewise targeting their use of Chinese AI models. The two representatives also wrote to the Pentagon, requesting that DeepSeek and other Chinese AI models be added to the 1260H list (the US Department of Defense's list of entities with ties to the Chinese military).
| Target | Investigation |
|---|---|
| DoorDash | Use of Kimi K2.6 and other Chinese models |
| Airbnb | Use of Chinese AI models |
| Anysphere (Cursor's parent) | Use of Chinese AI models |
| Pentagon (letter recipient) | Asked to add DeepSeek to 1260H list |
Zoom out further. On August 1, 2026, the Taipei Times reported that China was using US AI models to train defense systems. That's a reverse angle: the US is also worried about its own AI models being used by China for military purposes. The two directions combined show that cross-border AI model usage has become a two-way security issue — regardless of which country's model flows where, as long as it touches military or critical infrastructure, it triggers a regulatory red line.
5. Takeaways for Enterprises: Three Compliance Baselines for Model Selection
First, performance is not the only selection criterion. A model that tops your benchmarks may not pass compliance review. For consumer-facing apps handling user data, the country of origin of the model is becoming a hard constraint. Add "model country of origin" to your evaluation table, right alongside benchmarks and pricing.
Second, open-source does not mean secure and controllable. Kimi K2.6 is open-source under Modified MIT — you get the weights, you can deploy locally — but that doesn't automatically mean "data stays in-house." Source verification of model weights, data flow auditing of the inference chain, and third-party security assessments are all indispensable. Open source gives you the ability to audit, not a security guarantee.
Third, geopolitical risk is becoming technical debt. Today's compliant choice could become tomorrow's policy risk. If a company's core AI capability is locked to a model from a specific country, a policy shift could make migration extremely costly. Maintaining model replaceability — at least keeping a Plan B — is becoming part of engineering architecture.
A delivery company used a Chinese model and got investigated by Congress. The real signal here isn't whether DoorDash did something wrong — it's that the national origin of AI models has escalated from a "technology selection" issue to a "strategic compliance" issue. For every enterprise using large language models, model selection now has one more dimension that cannot be bypassed.
References
- Moonshot AI official: Kimi K2.6 release information (2026-04-20, specs and license, per official sources)
- US House Select Committee on the CCP: Moolenaar and Garbarino joint letter to DoorDash CEO Tony Xu (per public reporting)
- Public reporting: DoorDash internal AI lab's use of Chinese models and Congressional investigation
- Related reporting: Moolenaar/Garbarino investigations of Airbnb, Anysphere (Cursor's parent) for Chinese AI use, and letter to Pentagon requesting DeepSeek be added to 1260H list
- Taipei Times (2026-08-01): Report on China using US AI models to train defense systems
- The New York Times: Kimi K3 coverage (2026-07-17, distinguishing K2.6 from K3)