Harvey's Legal AI Runs on a Chinese Model · Issue #208

Opening

Reader, a small thing happened in the US legal AI industry last week. On August 18, Harvey released its first in-house model, “Tenet.” Harvey is a company backed early by the OpenAI Startup Fund and valued at $11 billion as of this past March. But the foundation of this model wasn’t OpenAI — it was Kimi K3, built by Beijing-based Moonshot AI.

Here’s what makes it more interesting: three days later, in the very same Washington where the Treasury Secretary had raised the idea of sanctioning Chinese models just a month earlier, White House AI czar David Sacks held this model up as proof that “American companies are building world-class specialized models.”

That raises a question. Why would America’s biggest legal AI company choose a Chinese model of all things? The short answer: the word to focus on here isn’t “China” — it’s “two months.” The model has become disposable, something you can rebuild from scratch in two months, and the real asset is the work environment used to train it. The backdoor worry isn’t wrong — it’s just aimed at the wrong target.

The Model Harvey Built in Two Months

Harvey was founded in 2022. It sells AI that helps law firms and corporate legal teams with research, contract review, and document drafting. By Harvey’s own count, it has more than 1,500 customers across 60-odd countries, half of the top 100 US law firms by revenue use it, and as of July its annualized revenue was $350 million. Until now, the company simply picked among OpenAI, Anthropic, and Google models depending on the task—it was a company running on borrowed intelligence.

Tenet is the first intelligence the company has built for itself. Its foundation is Kimi K3, an open-weight¹ model with 2.8 trillion parameters whose weights were released on July 27. Working with the inference infrastructure company Fireworks, Harvey ran post-training² for two months on roughly 150 Nvidia B300 GPUs. The method was reinforcement learning: Harvey built about 1,750 task environments modeled on the actual work lawyers receive, and whenever the model read documents, used tools, and produced output inside them, it was scored against a rubric. A single epoch involved more than 10,000 rollouts³. The rubrics were built the same way as LAB, the legal-agent benchmark Harvey released in May—and LAB alone contains more than 75,000 grading criteria written by practicing lawyers.

Here are the results. On LAB holdout problems that were excluded from training, the number of tasks completed to the end nearly doubled compared to the base K3, and in the contracts category (LAB Contracts) it rose 20% to take first place. Across all of LAB, it ranks second. It also outperformed the base model on APEX Agents and Redline Bench, external benchmarks unrelated to the training data. According to Harvey, the cost comes in at less than a quarter of the leading frontier models—open weights make the per-token price cheap to begin with, and the training rewarded shorter completions for equivalent results, so the model learned to use fewer tokens overall. Harvey states explicitly that not a single line of customer data was used.

What held my attention longer, though, were the three specialized models released alongside Tenet. Their lineup mirrors a law firm’s org chart: one is an M&A due-diligence model that can read a data room of up to 80 million tokens—about 60,000 pages of A4 paper; another is a review model that organizes 10,000 documents into tables; and the third is a “firm knowledge” model that embeds a firm’s institutional knowledge directly into its weights rather than retrieving it, cutting the cost per query by 90%. In effect, they’ve turned the partner, the associate, and the knowledge-management team each into a model.

And all three of these are built on Chinese open-weight models too. The due-diligence and review models run on Zhipu’s GLM-5.2, and the firm knowledge model runs on Alibaba’s Qwen3.8-27B. GSPO, the reinforcement learning algorithm used in training, comes from a paper Alibaba’s Qwen team published last July, and the model used to grade the answers was Moonshot’s Kimi 2.6. On top of American capital and Nvidia GPUs, they assembled the output of three Chinese labs.

Why a Chinese Model, of All Things

The answer turns out to be simpler than you’d think: there’s no American open-weight model in that weight class.

That’s not to say the US has no open-weight models at all — there’s OpenAI’s gpt-oss, Google’s Gemma, and Meta’s Llama. But they’re not playing in the same league. Looking at the weight-class chart VentureBeat put together back in March, Llama 4, released last April, got lukewarm reviews, and its heavyweight version, Behemoth, has been shelved indefinitely. Gemma 3’s biggest version tops out at 27 billion parameters, and gpt-oss-120b only activates 5.1 billion parameters per token. That’s too thin to run an agent reading hundred-thousand-token documents and working through hundreds of steps. Right now, China is the only place you can download an open-weight model with 2.8 trillion parameters.

harvey And the benchmarks made the call. On a leaderboard that independent outfit Artificial Analysis ran separately using Harvey’s own LAB, the base Kimi K3 lands near the top by share of scoring criteria satisfied. From Harvey’s perspective, they didn’t pick “a Chinese model” — they picked the open model that scored best on the exam they themselves designed.

Harvey isn’t even the first. Back in March, it came out that coding tool Cursor’s own model, Composer 2, was built on top of Kimi K2.5. A developer poking through API traffic spotted “kimi-k2p5” baked right into the model name. Cursor admitted it within hours, and a co-founder said, “not disclosing it from the start was a mistake.” Cognition’s SWE-1.6 is believed to be built on Zhipu’s GLM, and Airbnb CEO Brian Chesky said publicly, “We lean heavily on Qwen.” Product leader Peter Yang’s roundup also lists Shopify, which saved $5 million a year by switching to Qwen.

What catches my attention here is the shift over five months. In March, Cursor got caught and apologized. In August, Harvey wrote it up on their blog and bragged about it, and the White House praised them for it. What used to be something to hide became something to flaunt. Recall that Treasury Secretary Bessent warned just a month earlier that the US might sanction Chinese models — the “crack inside America” I covered back in July has, within a single month, taken concrete shape in one product.

There’s also one amusing clause worth noting. Section 3 of the Kimi K3 license requires that any product with monthly revenue over $20 million must prominently display “Kimi K3” on screen when using this model. Harvey’s monthly revenue, on an annualized basis, runs about $29 million. There’s a Section 4 exemption for products routed through a certified inference partner, so in practice this will likely get resolved by contract — but taken literally, the clause would mean an American law firm’s screen carrying a Chinese model’s name. This isn’t legal advice, just my own reading of the clause, so I’d recommend checking the original text yourself on this one.

Backdoor Worries Are Aimed at the Wrong Target

The question “but it’s a Chinese model, is that okay?” is a fair one. Still, the worry needs to be split into two.

The first worry is whether data flows back to China. The nature of open weights answers this. An open-weight model is a file, not a service. Harvey’s model runs on Fireworks, US infrastructure, and doesn’t exchange a single byte with Moonshot’s servers. This is an entirely different problem from an app like DeepSeek, where you install something and your queries go straight to Chinese servers. On top of that, Harvey has explicitly stated it doesn’t use customer data for training.

The second worry is whether something is planted inside the weights themselves. This one has real grounding. Anthropic’s 2024 “Sleeper Agents” study found that behaviors planted to trigger only under specific conditions can survive subsequent safety training. What’s more, the LoRA⁴ method Harvey used leaves the original weights nearly untouched, just bolting on a thin additional layer — so two months of post-training doesn’t “launder” whatever properties the base model has.

But if you look at the nature of this risk, the response becomes clear too. A legal agent is an entity that reads documents and writes memos inside an isolated sandbox. Block outbound communication, restrict tool permissions, and verify that citations actually match the source documents, and whatever’s sitting in the weights has less room to do damage. In other words, this is a risk managed by deployment design, not by the model’s nationality. It’s the same logic Jensen Huang voiced in July when he said “you can control it inside a sandbox,” though I’d add one line to that. Saying you can control it also means you should control it. That doesn’t mean the worry disappears — it means the department responsible for handling it shifts from the security team to the architecture team.

So here’s the real signal. For companies with the capability to manage this risk, Chinese open weights have already stopped being an “option worth considering” and become the default.

The ‘Revenge of the Wrapper’ Take Is Only Half Right

One reading of this announcement has been making the rounds: “Companies once dismissed as wrappers are starting to build their own models. One by one, the frontier labs’ own customers are turning into competitors.” I think this take is half right and half aimed at the wrong target.

Let’s start with the half that’s right. Cursor and Harvey were both among the frontier labs’ thickest-paying customers. When companies like these move their most frequently run core tasks onto their own models, the thickest layer of the frontier labs’ API revenue gets thinner. That’s a real threat, no question.

The half that misses is the word “competitor.” Harvey still picks among OpenAI, Anthropic, and Google models depending on the task, and Tenet isn’t ranked first overall on LAB. Rather than becoming a competitor, Harvey has pulled one line out of the table that allocates tasks to models. What’s starting is a division of labor: the hardest work still gets rented out, while the most repetitive work gets built in-house.

And there’s a more important mismatch here. Harvey’s real asset isn’t the model. A model can be rebuilt from scratch in two months with 150 GPUs. If you plug in the Blackwell rental rate we saw earlier this month in the “Intelligence Has Gone Cheap” issue (in the $5-per-hour range), the GPU cost alone comes out to roughly ₩1.5–2 billion. The cost of building out the legal data and environments would be far larger, but for an $11 billion company, neither figure is a big deal. Harvey’s actual asset is its 1,750 task environments, its 75,000 grading criteria, and the lawyers it hired through Mercor and Snorkel to build all of that. When the next open-weight model comes out, they swap out the base model and keep using the same environments. The model is the consumable; the environment is the capital asset.

Which is why the word “wrapper” was the wrong frame from the start. They didn’t drape a workflow over a model — the workflow itself was the training ground. The real front line isn’t frontier labs versus application companies; it’s companies that own environments versus companies that don’t.

Oswald’s Lens

When I was running AI product at Kakao Brain, South Korea’s Kakao-affiliated AI research lab, I learned something. The pace at which a model improves and the pace at which a product improves are not the same thing. What closed that gap wasn’t a bigger model — it was a written-down rubric for “what counts as a good result.” So the number I lingered on longest in this presentation wasn’t ₩2.8 trillion (~$2.0 billion) or 150 GPUs. It was 75,000.

From a GTM standpoint, Harvey’s second goal is the bigger story. In this presentation, Harvey nailed down its research objective as letting “law firms build their own model and own their own intelligence,” stating that “two firms using the same Harvey will end up with different models and different outputs.” The Firm Knowledge Model is the prototype of that. Once a firm’s knowledge is etched into weights rather than a search index, that firm can’t take its intelligence with it when it switches to a different product. I’ve seen countless lock-in designs while building GTM strategy, but I’ve never seen switching costs thicker than hardening a customer’s knowledge into weights. What Harvey is selling isn’t a model — it’s a model factory.

Bringing this back to Korea, two things stand out. One is a question for the sovereign AI debate. In a world where two months and 150 GPUs can produce a specialized model, what’s scarce isn’t the foundation model — it’s the industry-specific environments and grading rubrics. The more urgent question isn’t whether Korea has its own foundation model, but whether anyone has written down Korea’s legal, financial, and manufacturing work as 1,750 environments. The other is a practical constraint. In Korea’s public sector and finance industry, the political cost of choosing a Chinese model is higher than it is in the U.S. So the organizations that move first won’t be the ones that can answer “which country’s model” — they’ll be the ones that can explain “how we isolate and verify it.”

Closing

To sum up, three things. First, Harvey, an OpenAI portfolio company, built its own model from three Chinese open-weight models in two months, and the White House’s AI czar held it up as a model for American companies. Second, the reason is that there’s no American-made open-weight model in that weight class. The backdoor worry has become a matter of deployment design, not the model’s nationality. Third, this isn’t a wrapper company acquiring a model — it’s a company with an environment that turned models into a commodity.

Here’s one thing to try this week. Write down the ten most repeated tasks in your organization, and for each one, write out what result counts as a pass. That list is a miniature version of Harvey’s 75,000 grading criteria. Models change; that list stays.

Reader, has your organization ever evaluated a Chinese open-weight model? If so, tell me in the comments where it stalled — was it security, legal, or leadership? I’ll gather the sticking points and follow up next issue with a piece on “designs that pass review.”

💬 Tell me in the comments where your review of Chinese open-weight models got stuck. I’ll factor it into the next issue. 📨 If you know a colleague wrestling with model selection, share this piece with them.

📎 References & Further Reading

Primary sources

Harvey (Calvin Qi et al.), “Update on Harvey’s Post-Training Effort”, Harvey Blog, 2026.8. ··· This is today’s primary source. The 1,750 environments, 150 B300 GPUs, two months, three specialized models, and the declaration of no customer data use are all here. I’d recommend starting from the opening paragraph, where the two research goals are laid out.
Harvey, “Introducing Harvey’s Legal Agent Benchmark”, Harvey Blog, 2026.5.6. ··· This lays out the logic behind 1,200 tasks, 24 practice areas, 75,000 grading criteria, and an all-or-nothing pass system — not “8 out of 10 gets you 80 points,” but “miss even one and you get zero.”
Benzinga, “David Sacks Defends Open-Source AI, Cites Harvey’s Tenet Model”, 2026.8. ··· This has the original text of Sacks’s X post from August 21st, along with Harvey’s own claim of running at under a quarter of the cost of frontier models.
South China Morning Post, “OpenAI-backed legal tech firm pivots to Chinese Kimi K3 open-weight model”, 2026.8.21. ··· This piece situates the episode within the broader trend of Western companies moving to Chinese open-weight models.
VentureBeat, “Cursor’s Composer 2 was secretly built on a Chinese AI model”, 2026.3. ··· This covers the full story behind the Cursor episode, plus a solid weight-class comparison explaining why Llama 4, Gemma 3, and gpt-oss don’t hold up as alternatives.
Simon Willison, “moonshotai/Kimi-K3”, 2026.7.27. ··· A record from the day K3’s weights were released. It lays out the license clause requiring “Kimi K3” attribution above $20 million in monthly revenue, and how that clause evolved.

Background

Chujie Zheng et al., “Group Sequence Policy Optimization”, arXiv, 2025. ··· The original paper on GSPO, the reinforcement learning algorithm Harvey uses. Written by Alibaba’s Qwen team.
Evan Hubinger et al., “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training”, arXiv, 2024. ··· This research shows conditional behaviors embedded in weights can survive safety training. It’s where you can confirm why the backdoor worry is a well-founded one.
Alex L. Zhang, Tim Kraska, Omar Khattab, “Recursive Language Models”, arXiv, 2025. ··· The original paper on the “recursive language model” technique Harvey built into its harness to handle 80-million-token data rooms. This is MIT research.
Artificial Analysis, “Harvey LAB-AA Leaderboard”. ··· An independent organization’s own leaderboard run on Harvey’s LAB. Check for yourself where base Kimi K3 lands.
Axios, “David Sacks says Chinese open-weight AI models push China ahead”, 2026.7.17. ··· Written right after K3’s release, this has Sacks calling it “concerning” while still naming openness, not regulation, as the answer. It’s the prequel to his August remarks.
Sacra, “Harvey revenue, valuation & funding”. ··· The source for figures like $350 million in annualized revenue, an $11 billion valuation, and customer counts.

Past issues worth reading alongside this one

If You Sell Time, and AI Erases It, What Do You Sell Next? ··· An issue about how Harvey’s rise reshaped the U.S. legal market. It’s about selling value, not time.
Why Did Jensen Huang Praise a Chinese Model? ··· This is the prequel to today’s piece. If you first watch the scene where Bessent’s sanctions warning and Huang’s defense landed on the same day — that crack inside America — today’s story reads as the next scene.
Containment Grew China — Now China Locks the Door ··· The same story, seen from China’s side. Reading it alongside today’s piece adds depth: American companies are building on Chinese open-weight models even as China starts locking its own doors.

📝 Glossary

The author, Kwangseob Ahn, is a professor of business administration at Sejong University and lead consultant at INLEVEL9. He teaches statistics and data analysis, including business data management and business analytics, while leading GTM and AI strategy consulting in the field, designing the seam between technology and business. He has published academic research on a memory architecture for AI dialogue systems (HEMA) and runs Daily Arxiv, a daily curation of global AI papers. He holds a master's from Korea University's Graduate School of Technology Management and a KMBA. He is the author of Homo Brainless: The People Who Outsource Their Thinking.

Footnotes

open weights: A release format where anyone can download a model’s trained weight files, run them on their own servers, and modify them. Since it’s a file, not a service, whoever downloads it decides which country’s servers it runs on. ↩
post-training: The process of further training an already-built model on domain-specific data and rewards to refine it for a particular use. It’s closer to a law firm’s associate program that trains a law school graduate into a junior lawyer. ↩
rollout: In reinforcement learning, a single attempt where the model carries out one task from start to finish inside an environment. Because that attempt’s outcome gets scored and used to update the model, the number of rollouts is effectively how much practice it gets. ↩
LoRA (Low-Rank Adaptation): A method that leaves the original model’s weights untouched and instead attaches a thin auxiliary layer, training only that layer. It costs less, but most of the base model’s characteristics remain unchanged. ↩