The Model That Could Not Leave

The order was short enough to fit on a phone screen.

On April 27, the Office of the Working Mechanism for Security Review of Foreign Investment, housed under China’s National Development and Reform Commission, published a brief notice on the Manus deal. The office said it had issued a security-review decision on the foreign acquisition of the Manus project and, according to the official NDRC notice , prohibited the investment and required the parties to cancel the transaction.

There was no long explanation. No public theory of harm. No technical appendix about model weights, training data, agent architecture, or national-security thresholds. The state planner’s message arrived as a clean administrative fact: this AI company could not be sold that way.

The notice carries that force.

Meta had announced in December that it was acquiring Manus, an AI startup with Chinese roots and a Singapore base. Manus had drawn attention for building a general-purpose AI agent that can carry out complex computer tasks. The Associated Press reported that Manus can autonomously handle work such as coding an app, doing market research, or preparing quarterly budgets. For Meta, that made Manus a useful piece of a larger race to make AI agents part of daily software, advertising, commerce, and personal computing.

For Beijing, the same facts pointed in a different direction. Manus was legally and operationally more international than a simple domestic firm, yet it traced back to Chinese founders and earlier Beijing-registered entities. AP reported that Meta had said there would be no continuing Chinese ownership interests in Manus and that Manus would discontinue services and operations in China. China began reviewing the deal in January.

The result was a small notice with a large consequence. A company can move its headquarters. Employees can sit in Singapore. A buyer can insist that the transaction follows the law. The state can say that the capability remains within its security perimeter.

What Meta Was Buying

Manus is useful as a news story because it is easy to misunderstand what an AI acquisition buys.

The visible company is a familiar object. It has founders, employees, investors, servers, offices, contracts, a website, and a price. TechCrunch reported that the deal was worth about $2 billion . Investor’s Business Daily put the figure at roughly $2 billion , while Axios reported $2.5 billion . The exact number matters less than the category. This was a major platform company buying a young AI firm for agent capability.

The less visible company is the harder one to define.

An AI agent sprawls past the old idea of a single software tool. It is a product, a model, a workflow, a set of training choices, an interface, a team habit, and a bet about how people will let machines act on their behalf. It can draft, search, code, schedule, summarize, compare, prepare, and operate across other software. The valuable part sits partly in code and partly in the people who know what the code is trying to become.

That makes acquisition law feel out of date. A regulator can see shares changing hands. It can see a transfer agreement. It can see a headquarters address. It has a harder time seeing the movement of judgment, habits, shortcuts, evaluation methods, model behavior, tacit engineering knowledge, and user data. AI companies are full of assets that behave like property and labor at the same time.

Meta was buying a company. China treated the deal as a transfer of capacity.

That gap is the heart of the story. In ordinary merger language, Manus is an acquisition target. In the national-security language now forming around AI, Manus is also a bundle of human and technical capability that might strengthen a foreign platform, weaken a domestic technology base, or move strategic know-how outside the reach of Chinese policy.

The Offshore Fiction

The Manus structure also shows why headquarters no longer settles the argument.

AP reported that Manus’ parent before the deal was Singapore-based Butterfly Effect Pte, while the startup traced its roots to Beijing-registered entities established several years earlier. TechCrunch wrote that Manus relocated its headquarters into Singapore around mid-2025, after being founded by Chinese engineers.

That kind of move once carried a clean story. A company left one jurisdiction, entered another, and became governed mainly by the new address. Capital could follow. Buyers could transact. Founders could reach global markets. Investors could describe the company by where the holding company sat.

AI makes the fiction harder to sustain.

The company’s formal address may change faster than its talent base, technical lineage, research network, data relationships, and political meaning. Beijing’s action tells founders that an offshore company can remain legible to Chinese regulators as a Chinese-linked strategic asset. Washington has been making the opposite point in its own way. The U.S. Treasury’s Outbound Investment Security Program identifies semiconductors, quantum information technologies, and artificial intelligence as sensitive categories for investment controls involving China, Hong Kong, and Macau. The American concern is that capital, management help, and technical expertise can aid a rival’s military, intelligence, surveillance, or cyber capacity.

China’s Manus decision answers with its own version of the same logic. If the United States can treat investment as a path for strategic technology to strengthen China, China can treat acquisition as a path for strategic technology to leave.

Neither side needs to use the same legal tool. The underlying belief is shared. Advanced AI firms now sit inside a security frame larger than corporate law.

Talent As Territory

The most important asset in the Manus deal may have been neither the corporate shell nor the product name.

It was the team.

AI talent is portable in one sense. Engineers can fly, sign contracts, join a platform, and bring their knowledge with them. It is deeply rooted in another sense. The value of a team comes through education systems, local research circles, startup networks, early investors, government priorities, data access, and competitive pressure. Talent can cross borders. The system that produced it often refuses to disappear.

That is why AI talent now looks less like ordinary labor and more like territory.

Governments have always cared about scientists and engineers in sensitive fields. Nuclear physicists, cryptographers, aerospace engineers, chip designers, and cyber specialists have lived under special scrutiny for decades. AI pushes that scrutiny into a broader commercial class. A small startup team can now carry a product that feels useful to consumer apps, enterprise workflows, intelligence analysis, military planning, software development, propaganda, research automation, fraud detection, and surveillance. The same general-purpose nature that makes an AI agent valuable to Meta makes it politically uncomfortable to Beijing.

The word “agent” intensifies the discomfort. A chatbot answers. An agent acts. It can complete tasks across software, monitor information, prepare documents, code, book, buy, plan, and coordinate. The more capable the agent becomes, the more it begins to look like a layer of delegated labor. Whoever owns that layer may shape how work is routed, measured, accelerated, and surveilled.

That does not make every AI company a weapon. It does make the old consumer-tech frame inadequate. A social platform acquiring a photo app once raised questions about market power, privacy, and advertising. A social platform acquiring an autonomous-agent team raises those questions and adds a state-security question: whose productive capacity just increased?

The Mirror

There is an easy way to describe China’s decision as protectionism. There is a reasonable case for that description.

Beijing wants domestic AI champions. It wants founder talent to remain tied to China’s technology system. It wants strategic firms to avoid being drained by U.S. platforms. It also wants a veto over deals that founders and investors might otherwise choose for themselves.

But the American mirror should stay in view.

The United States already screens inbound deals through CFIUS, limits certain outbound investments into Chinese technology sectors, controls advanced AI chips, and pressures allies around export restrictions. Those policies rest on a premise: some private technology transactions can alter the balance of national power. Once that premise is accepted, other states can adopt their own version of it.

The Manus order is striking because it turns the usual story around. For years, Washington’s fear has been that American capital and technology might help China catch up. This time, Beijing’s fear appears to be that Chinese-origin AI capacity might be absorbed by an American platform.

Both governments are narrowing the space where private companies can say, “This is only business.”

That narrowing carries costs. Founders lose optionality. Investors face political exit risk. Employees can find their careers tied to strategic disputes they did not choose. Platforms may spend heavily on deals that regulators later unwind. Smaller countries that host relocated startups may discover that a headquarters address offers little shield against geopolitical claims on people and technology.

There are public benefits too. Voters may reasonably want governments to notice when sensitive capability moves across borders. A world of autonomous software cannot be governed by pitch decks and acquisition premiums alone. The hard part is building review systems that are clear enough for companies to plan around and narrow enough to avoid turning every promising technical team into a contested national asset.

The Manus notice offered power without much explanation. That may suit the administrator. It is also a warning to the market. The review perimeter can appear after the deal is already celebrated.

An AI company is code, people, data, habits, and product judgment arranged into one difficult object.

The Company After The Company

The strangest detail in the AP account may be the simplest one: Manus’ website said the company “is now part of Meta,” even as China ordered the transaction withdrawn. Meta said the transaction complied fully with applicable law and that it anticipated an appropriate resolution.

That leaves the deal in a modern corporate half-state. Paper says one thing. Regulator says another. Website says a third. Employees, founders, customers, and lawyers have to live in the overlap.

This overlap is where many future AI disputes will land.

Software companies can be separated on paper, but capability is not always easy to unscramble. If employees have already moved, what returns? If code has already been integrated, what counts as withdrawal? If model behavior has been studied by the buyer, what can be unlearned? If the acquiring company has already shaped its product plans around the team, what does compliance look like beyond new paperwork?

The old merger remedy imagines a company as a thing that can be bought, sold, separated, and restored. AI firms may resist that model. Some value sits in repositories and access controls. Some sits in notebooks, prompts, evaluations, internal tools, deployment lessons, and conversations. Some sits in people whose knowledge cannot be reset.

That is why the Manus order may matter long after this particular deal is resolved. It signals that regulators will contest AI transfers after corporate form has already shifted. The legal question may become backward-looking: how much of the company has already moved?

The deal may be corporate. The review treats the model as strategic capacity.

Who Owns The Mind Work

The strongest version of the Manus story is not about Meta losing a deal. Meta is large enough to buy, hire, build, and wait. It will pursue AI agents through other paths.

The deeper story is about ownership of mind work at industrial scale.

AI agents sit at the edge of a broad change in how companies imagine labor. They promise to turn software into a delegated worker: something that can take an instruction and carry out a chain of tasks with limited supervision. That makes them attractive to platforms. It also makes them attractive to governments. A country that lets its best agent teams disappear into foreign platforms may fear losing more than company value. It may fear losing the future habits of work.

That fear can become overbroad. Governments can use national security as a blanket for industrial policy, political control, or simple embarrassment that local founders prefer foreign exits. Companies can use corporate structure to make sensitive transfers look ordinary. Both risks are real.

Manus sits where those risks meet. A startup with Chinese roots and a Singapore home became valuable enough for Meta to buy, sensitive enough for China to block, and visible enough for Washington to comment. Its product category remains young, but the political category has matured quickly.

The acquisition agreement tried to answer a corporate question: who owns the company?

The security review asked a harder question: who owns the capability?

Those questions will keep colliding. The next case may involve a model lab, a robotics team, a chip-design group, a data-labeling network, or a quiet startup whose value sits in evaluation methods no one outside the company can see. The transaction may look international. The state may see a national asset trying to leave.

The Manus order was only one line. It carried the weight of a new rule for the AI age: a company can cross a border on paper before the state agrees that its mind has gone with it.