Why Harvey's Legal AI Chose a Chinese Model

Harvey’s Legal AI: Why Pick a Chinese Model?

There was a small but telling event in the US legal AI industry last week. On August 18, Harvey released its first in-house model, Tenet. Harvey is the company that OpenAI’s Startup Fund backed early on, and that was valued at $11 billion this past March. But the foundation of this new model wasn’t OpenAI — it was Kimi K3, built by Beijing-based Moonshot AI.

What’s more interesting is what happened three days later. In the very same Washington where, just a month earlier, the Treasury Secretary had floated the idea of sanctioning Chinese models, White House AI czar David Sacks cited this very model as proof that “American companies are building world-class specialized models.”

So why did America’s biggest legal AI company choose a Chinese model? The part of this story worth paying attention to isn’t the model’s nationality — it’s the timeline. Harvey took an open-weight release and trained its own model on top of it in just two months. Once you can swap out the base model on a timeline that short, what becomes the real asset is the work environment used to train the model. Backdoor concerns aren’t groundless, either — but that’s a problem to be addressed through isolation and verification, not through the model’s country of origin.

---

Harvey’s Model, Post-Trained in Two Months

Harvey was founded in 2022. It sells AI that helps law firms and corporate legal teams with research, contract review, and document drafting. By Harvey’s own count, it has more than 1,500 customers across over 60 countries, half of the top 100 US law firms by revenue use it, and as of July its annualized revenue stood at $350 million. Until now, the arrangement was to pick and choose among models from OpenAI, Anthropic, and Google depending on the task — borrowing models built by other companies rather than having its own.

Tenet is the first model Harvey has trained itself. It’s built on Kimi K3, a 2.8-trillion-parameter open-weight¹ model whose weights were released on July 27. Harvey ran post-training² for two months on roughly 150 Nvidia B300 GPUs, working with inference-infrastructure company Fireworks. The method was reinforcement learning. They built about 1,750 work environments modeled on the kinds of tasks real lawyers receive, and whenever the model read documents, used tools, and produced output inside them, it was scored against grading criteria. They ran more than 10,000 trials³ per epoch. The grading criteria were built the same way as LAB, the legal-agent benchmark Harvey released in May — and LAB alone contains more than 75,000 grading items written by practicing lawyers.

Here’s what came out of it. On LAB holdout problems that weren’t used in training, the number of tasks completed end-to-end nearly doubled compared with the base K3, and in the contracts category (LAB Contracts) it improved by 20% to take first place. Across LAB overall it ranks second. It also beat the base model on external benchmarks that had nothing to do with the training — APEX Agents and Redline Bench. According to Harvey, the cost comes in at less than a quarter of leading frontier models: open-weight models already carry cheaper per-token pricing, and on top of that, the model was trained to be rewarded for finishing the same task in fewer steps, so it was pushed to use fewer tokens outright. Harvey states explicitly that not a single line of customer data went into the training.

What held my attention longer were the three specialized models unveiled alongside Tenet. The lineup mirrors the structure of a law firm itself. There’s an M&A due-diligence model that reads data rooms of up to 80 million tokens — about 60,000 pages of A4 paper; a review model that organizes 10,000 documents into tables; and a “firm knowledge” model that bakes a firm’s institutional knowledge directly into its weights rather than retrieving it on the fly, cutting the cost per query by 90%. It’s essentially as if the partner, the associate, and the knowledge-management team had each been turned into a separate model.

And the foundations underneath all three are, once again, Chinese open-weight models. The due-diligence and review models run on Zhipu’s GLM-5.2, and the firm-knowledge model on Alibaba’s Qwen3.8-27B. GSPO, the reinforcement-learning algorithm used to train them, comes from a paper Alibaba’s Qwen team published last July, and the model used to grade the answers is Moonshot’s Kimi 2.6. Running on American capital and Nvidia GPUs, Harvey went out and adopted whichever models and training algorithms Chinese labs had made public, matching each one to its purpose.

Why a Chinese Model, of All Things?

The answer is simpler than you’d think: there’s no American open-weight model in that weight class.

It’s not that America has no open-weight models at all — there’s OpenAI’s gpt-oss, Google’s Gemma, Meta’s Llama. But they’re in a different weight class. VentureBeat’s rundown from last March laid it out: Llama 4, released in April of last year, got poor reviews, and the larger Behemoth version has been shelved indefinitely. Gemma 3’s biggest version tops out at 27 billion parameters, and gpt-oss-120b only activates 5.1 billion parameters per token in practice. That’s too small to run an agent that reads documents hundreds of thousands of tokens long and works through hundreds of steps. Right now, China is the only place you can download an open-weight model with 2.8 trillion parameters.

The basis for the choice was benchmark scores. On the leaderboard where the independent outfit Artificial Analysis separately ran Harvey’s LAB benchmark, the base Kimi K3 sits at the very top by the rate of scoring criteria satisfied. From Harvey’s perspective, they didn’t pick a “Chinese model” — they picked the open model that scored best on the test they themselves designed.

Harvey isn’t the first, either. Last March, it came out that Composer 2, the coding tool Cursor’s in-house model, was built on top of Kimi K2.5. A developer poking through the API traffic found “kimi-k2p5” baked into the model name. Cursor admitted it within hours, and a co-founder said, “Not disclosing it from the start was a mistake.” Cognition’s SWE-1.6 is presumed to be built on top of GLM from Zhipu, a Chinese AI company, and Airbnb CEO Brian Chesky said publicly, “We lean heavily on Qwen.” The list product leader Peter Yang compiled also includes Shopify, which switched to Qwen and saved $5 million a year.

What catches my attention here is the shift over five months. In March, Cursor got caught and apologized. In August, Harvey wrote it up on their blog and bragged about it, and the White House praised them for it. What was once hidden became something to boast about. Recall that just a month earlier, Treasury Secretary Bessent had warned that Chinese models could face sanctions — the “crack inside America” I covered in July had, within a month, taken the concrete shape of a single product.

There’s also an interesting clause worth adding. Article 3 of the Kimi K3 license requires that any product with over $20 million in monthly revenue using the model must prominently display “Kimi K3” on screen. Harvey’s monthly revenue, annualized, comes to roughly $29 million. Article 4 carves out an exception if you go through a certified inference partner, so in practice this gets resolved through contracts — but by the letter of the license, an American law firm’s screen would have to display the name of a Chinese model. This is my own reading of the clause, not legal advice, so I’d encourage you to check the original text yourself on this point.

Backdoor worries are a deployment-design problem, not a matter of the model’s nationality

“But it’s still a Chinese model — is that really okay?” is a fair question. Still, the worry needs to be split into two.

The first worry is whether data ends up going to China. The nature of open weights answers this. Open weights are a file, not a service. Harvey’s model runs on Fireworks, US infrastructure, and doesn’t exchange a single byte with Moonshot’s servers. That’s a completely different problem from the DeepSeek app, where you install an app and send your queries straight to Chinese servers. On top of that, Harvey has stated flatly that it did not use customer data for training.

The second worry is whether something is embedded inside the weights themselves. This one has real grounding. Anthropic’s 2024 “Sleeper Agents” study found that behaviors planted to trigger only under specific conditions can survive subsequent safety training. And Harvey’s use of LoRA⁴ — a method that leaves the original weights largely untouched and adds only a thin extra layer — means two months of post-training doesn’t “launder” whatever properties the base model started with.

But looking closely at the nature of this risk also points to the response. A legal agent is something that reads documents and writes memos inside an isolated sandbox. Block outbound communication, restrict tool permissions, and verify that citations actually match the source documents, and it doesn’t much matter what’s sitting inside the weights — there’s simply less it can do. In other words, this is a risk managed by deployment design, not by the model’s nationality. It’s the same logic Jensen Huang invoked in July when he said, “you can control it within a sandbox” — though I’d add one line to that. Saying you can control it also means you should control it. Resolving the concern means actually building outbound-communication blocks, tool-permission limits, and citation verification into the real operating structure.

For a company with the capability to manage this risk, Chinese open weights have already moved from “a candidate worth reviewing once” to the default option.

The ‘Wrapper Strikes Back’ Story Is Only Half Right

One reading of this announcement has been making the rounds: “the companies once dismissed as wrappers are now building their own models. The frontier labs’ customers are turning into competitors, one by one.” I think that reading is only half right.

Let’s start with the half that’s correct. Cursor and Harvey were both among the heaviest API customers the frontier labs had. When companies like these move their core, most-repeated workloads onto their own models, that carves out a meaningful chunk of frontier-lab API revenue. That’s a real threat, no question.

The half that’s wrong is the word “competitor.” Harvey still picks and chooses among OpenAI, Anthropic, and Google models depending on the task, and Tenet isn’t the overall leader across LAB. Rather than becoming a competitor, Harvey pulled one line out of the table that allocates tasks to models. What’s actually started is a division of labor: the hardest work is still rented, while the most-repeated work gets built in-house.

And there’s a bigger misunderstanding at play. Harvey’s core asset was never the model itself. A model can be retrained in two months with 150 GPUs. Using the Blackwell rental rate we saw earlier this month in “Intelligence Gets Cheap” (around $5 an hour), the GPU cost alone comes to roughly ₩1.5–2 billion (~$1.1M–$1.4M). The cost of building out the legal data and the environment would be far larger — but for an $11 billion company, neither figure is a big deal. Harvey’s real assets are its 1,750 task environments, its 75,000 grading criteria, and the lawyers hired through Mercor and Snorkel to build and use them. When the next open-weight model comes out, you swap the base model and keep the environments. The model is close to a consumable you swap out; the environment is the asset that endures.

Which is why “wrapper” was the wrong frame from the start. Harvey didn’t bolt a workflow on top of a model — that workflow itself became the environment that trains the model. So the real competitive line isn’t frontier labs versus application companies; it’s companies that own a training environment versus companies that don’t.

Oswarld’s Lens

There’s something I learned when I was running AI products at Kakao Brain: the pace at which a model improves and the pace at which a product improves are not the same thing. What bridges that gap isn’t a bigger model — it’s an evaluation standard that spells out “what counts as a good result.” So the number I spent the most time studying in this presentation wasn’t the 2.8 trillion parameters or the 150 GPUs. It was the 75,000 grading criteria written by lawyers.

From a GTM perspective, what stands out even more is the second research goal Harvey laid out. In this presentation, Harvey explicitly named its research goal as “letting law firms build their own model and own their own intelligence,” adding that “two firms using the same Harvey will end up with different models and different outputs.” The Firm Knowledge Model is the prototype of that idea. Once a firm’s knowledge is trained into model weights rather than stored as a search index, that accumulated knowledge becomes very hard to carry over cleanly to a different product. I’ve seen a lot of lock-in designs while building GTM strategy, but I’ve never seen one with switching costs as high as training a customer’s own knowledge directly into model weights. What Harvey is selling isn’t a single finished model — it’s a structure that lets each law firm train its own.

Bringing this back to Korea, there are two implications. The first concerns the sovereign AI debate. In a world where two months and 150 GPUs are enough to produce a specialized model, what’s scarce isn’t the foundation model — it’s industry-specific environments and grading criteria. The more urgent question isn’t whether Korea has its own foundation model, but whether anyone has mapped Korea’s legal, financial, and manufacturing work into 1,750 environments. The second is a practical constraint. In Korea’s public sector and financial industry, the political cost of choosing a Chinese model is higher than it is in the U.S. So the organizations that move first won’t be the ones asking “which country’s model is this,” but the ones that can explain “how do we isolate and verify it.”

Closing

Let me sum up in three points. First, Harvey — a company OpenAI itself invested in — built its own model in two months using three Chinese open-weight models, and the White House’s AI czar held this up as a model for American companies to follow. Second, the reason was that there was no American open-weight model in that weight class. Backdoor concerns turned out to be a matter of deployment design, not a model’s nationality. Third, this isn’t a story about a wrapper company suddenly “owning” a model — it’s that a company with the right training environment and grading criteria can now swap out the underlying model whenever it wants.

Here’s something to try this week: write down your organization’s ten most frequently repeated tasks, and for each one, note “what result counts as a pass.” That list is a miniature version of Harvey’s 75,000 grading criteria. Models change; that list stays.

Reader, has your organization ever evaluated a Chinese open-weight model? If so, tell me in the comments where it stalled — security, legal, or leadership. I’ll gather the sticking points and turn them into next issue’s piece on “designs that pass review.”

---

💬 Tell me in the comments where your review of Chinese open-weight models got stuck — I’ll factor it into the next issue. 📨 If you have a colleague wrestling with model selection, share this piece with them.

References & Further Reading

Primary sources

• Harvey (Calvin Qi et al.), “Update on Harvey’s Post-Training Effort”, Harvey Blog, 2026.8. ··· This is today’s primary source. The 1,750 environments, 150 B300 chips, two months, three specialized models, and the declaration of no customer data use are all here. I’d recommend starting from the opening paragraph, where the two research goals are laid out.
• Harvey, “Introducing Harvey’s Legal Agent Benchmark”, Harvey Blog, 2026.5.6. ··· This covers the 1,200 tasks, 24 practice areas, 75,000 grading items, and the logic behind all-or-nothing scoring — not “8 out of 10 right earns 80 points,” but “miss even one and score 0.”
• Benzinga, “David Sacks Defends Open-Source AI, Cites Harvey’s Tenet Model”, 2026.8. ··· This lays out Sacks’s original X post from August 21 and Harvey’s claim of running “at less than a quarter of the cost of frontier models.”
• South China Morning Post, “OpenAI-backed legal tech firm pivots to Chinese Kimi K3 open-weight model”, 2026.8.21. ··· This article situates the episode within the broader trend of Western companies shifting toward Chinese open-weight models.
• VentureBeat, “Cursor’s Composer 2 was secretly built on a Chinese AI model”, 2026.3. ··· This covers the full story of the Cursor incident and offers a good weight-class comparison explaining why Llama 4, Gemma 3, and gpt-oss fell short as alternatives.
• Simon Willison, “moonshotai/Kimi-K3”, 2026.7.27. ··· A record from the day K3’s weights were released. It details the license clause requiring attribution to “Kimi K3” above $20 million in monthly revenue, and how that clause evolved.

Background

• Chujie Zheng et al., “Group Sequence Policy Optimization”, arXiv, 2025. ··· This is the original paper on GSPO, the reinforcement learning algorithm Harvey used. It’s authored by Alibaba’s Qwen team.
• Evan Hubinger et al., “Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training”, arXiv, 2024. ··· This research shows that conditional behaviors embedded in model weights can survive safety training. It’s where you can confirm why backdoor concerns are “well-founded worries,” not paranoia.
• Alex L. Zhang, Tim Kraska, Omar Khattab, “Recursive Language Models”, arXiv, 2025. ··· This is the original paper on the “recursive language model” technique Harvey built into its harness to handle 80-million-token data rooms. It’s MIT research.
• Artificial Analysis, “Harvey LAB-AA Leaderboard”. ··· An independent organization ran Harvey’s LAB separately and published this leaderboard. See for yourself where the base Kimi K3 model ranks.
• Axios, “David Sacks says Chinese open-weight AI models push China ahead”, 2026.7.17. ··· Written right after K3’s release, this piece has Sacks calling the model “concerning” while still naming openness, not regulation, as the answer. It’s the prequel to his August remarks.
• Sacra, “Harvey revenue, valuation & funding”. ··· The source for figures like Harvey’s $350 million annualized revenue, $11 billion valuation, and customer count.

Past issues worth reading alongside this one

• When AI Cuts the Time You Sell, What Do You Sell Instead? ··· This issue covers how Harvey’s rise is reshaping the US legal market. It’s about selling value instead of time.
• Why Did Jensen Huang Praise a Chinese Model? ··· This is the prequel to today’s story. Seeing the scene where Bessent’s sanctions warning and Huang’s defense landed on the same day — that “crack within America” — makes today’s story read as the next scene in the same arc.
• Containment Built China Up. Now It’s Locking the Door. ··· This is the same story seen from China’s side. Reading it alongside today’s issue gives a fuller picture: American companies are building on top of open weights from a China that has itself started locking its doors.

---

The author is Oswarld (Kwangseob Ahn). Current roles: Adjunct Professor at Sejong University, Strategy Consultant at INLEVEL9. Career, research, books, and recent work are kept current on the About page. Latest · July 2026: HEMA-2: A Consolidation-Aware Tri-Memory Architecture with Multi-Channel Scheduling for Lifelong Conversational AI.

📝 Glossary

Footnotes

1. Open weights: A distribution method where a model’s trained weight files are made available for anyone to download, run on their own servers, and modify. Because it’s a file, not a service, whoever downloads it decides which country’s servers it runs on. ↩

2. Post-training: The process of further training an already-built model on domain-specific data and reward signals to fine-tune it for a particular use. Think of it as a law firm’s training program for turning a college graduate into a first-year associate. ↩

3. Rollout: In reinforcement learning, one complete attempt by a model to perform a task from start to finish within an environment. Because the model is corrected based on the score of that attempt, the number of rollouts is essentially the amount of practice. ↩

4. LoRA (Low-Rank Adaptation): A method that leaves the original model’s weights untouched and instead attaches a thin auxiliary layer that alone gets trained. It costs less, but most of the base model’s original characteristics remain unchanged. ↩