Congress is investigating Cursor and Airbnb for using Chinese AI models. Here's what happened:

The House Homeland Security Committee (where I used to be a staffer) and House Select Committee on China sent letters to Airbnb and Anysphere on April 29.

The subject:

Decisions to build products on AI models developed by Chinese companies.

The likely trigger:

Cursor released the Composer 2 model last month.

An independent developer discovered the model was built on systems from Moonshot AI, a Beijing-based firm backed by Alibaba Group.

Moonshot AI, according to the lawmakers, was one of three China-based firms involved in "coordinated campaigns to extract advanced capabilities" from American AI systems.

Airbnb used Alibaba's Qwen to build a customer service agent it launched last year.

CEO Brian Chesky's stated reason: "fast and cheap."

What the letters demand:

-> Details on Chinese AI models each company uses

-> The decision-making process for model selection

-> In-person staff briefings with employees involved

The investigation follows the White House OSTP memo issued April 23 characterizing Chinese AI IP theft as "deliberate, industrial-scale campaigns."

And this is the first time Congress has targeted specific U.S. companies for their AI model sourcing decisions.

Now I'll admit the messaging from Congress is a little confused on the technical details:

Rep. John Moolenaar wrote "Chinese AI companies are beholden to Chinese law and could turn over data they collect from Airbnb and Anysphere to the Chinese government if they are asked to do so."

True, but barring a hidden backdoor in an open-source AI model or direct API access to a hosted one, no Airbnb or Cursor data is going to China.

But the signal is clear: AI vendor selection can be a political question, not just a procurement one.

3 things to do now:

1. Inventory every AI model in your stack

Whether or not you think it's worth the risk to use DeepSeek, Alibaba, Moonshot AI, MiniMax, or other Chinese-developed models, you must KNOW if you are.

2. Compare model selection process to external issues.

ISO 42001 is the perfect framework here.

It demands incorporating contextual issues (e.g. national security concerns) into risk assessment.

3. Document decisions, rationales, and controls

Congress is asking Cursor and AirBnB for receipts.

If they had a documented decision-making process they followed consistently (especially if audited externally), they'll be able to avoid a lot of pain.

If they didn't...expect follow-up questions.

Bottom line: AI model selection is NOT just a technical decision. Treat it that way.