[Prompt]
Following on from the GPU heist episode: if Ocean's Eleven were made today, the crew wouldn't crack a vault. It would be a man on a budget flight to Kuala Lumpur with a suitcase full of hard drives, or not even that, just a rental contract for a server rack in Johor. Far less glamorous, and much weirder. So let's talk about GPU tourism: the idea that people take their data to wherever GPUs are abundant and the rules are loose, train the model there, and bring home nothing but the weights. Which places have become these no-questions-asked compute jurisdictions, why them, and is this really a new kind of arbitrage, data centres in cheap-energy places undercutting Western ones, or is something else going on?

[Response]
Corn: If they made Ocean's Eleven today, Danny Ocean doesn't case the Bellagio. He books a budget flight to Kuala Lumpur, and honestly he might not even get on the plane. The whole job could be a rental contract for a server rack in Johor and a login from home. Daniel's prompt this week picks up right where our heist episode left off — he calls it GPU tourism. You take your data to wherever the export-controlled chips are abundant and the rules are loose, you train there, and you carry home nothing but the weights. His questions: which places have become these no-questions-asked compute jurisdictions, why them, and is this actually arbitrage — cheap energy undercutting Western data centres — or something stranger.

Herman: And I love that he flags the strangeness himself, because the strangeness is real. The first thing to pin down is what GPU tourism actually is, and it's not the thing the movies would film. The old heist is physical — chips in suitcases, trucks, men with burner phones. This is the opposite. Nothing crosses a border that anyone can search.

Corn: The weights cross.

Herman: The weights cross, and nobody's looking for them. Here's the legal core of the whole thing. US export law, the Commerce Department's Bureau of Industry and Security, is built around physical goods. A controlled item is an item that ships, that gets stamped, that goes through a port. Remote access to a controlled chip from another country is not illegal under current US law. It's not a loophole someone found with a crowbar — it's a gap that was never on the blueprint, because the law assumed compute is a thing you own, not a thing you rent by the hour.

Corn: So the vault is unlocked because the vault was built to have doors.

Herman: That's the shape of it. Worth saying too — GPU tourism as a phrase is mostly ours and Daniel's. It's not an established press term. What's documented is the pattern underneath it. The suitcase-of-hard-drives image comes from one Wall Street Journal story in June twenty twenty-five, engineers flying over with drives. But that's the photogenic version. The real phenomenon is a rental agreement and a remote login.

Corn: The unglamorous sequel. Nobody even gets to wear a nice suit.

Herman: So that's the frame. Where does the money actually go, who's renting what, and then whether the cheap-energy story holds up — because I'll spoil it now, it doesn't, and that's my favourite part of this whole prompt.

Corn: Alright. Johor. Why Johor?

Herman: Geography first, then the numbers. Johor is the Malaysian state just across the causeway from Singapore. Singapore has money, connectivity, and no land, and it also put a moratorium on new data centres for years because of power and water. So the build-out spilled across the border into Johor, which had land, cheap-ish industrial sites, and a government that wanted it. The result is that Johor now has about eleven hundred megawatts of live data-centre capacity — third in Asia-Pacific, behind only Tokyo and Singapore. And the pipeline is about eight and a half thousand megawatts more. There's a brokerage measure called colocation vacancy — how much of the finished floor space is still unsold. Johor's is zero point seven percent.

Corn: The hotel is full.

Herman: Packed, with a waiting list. Bangkok's vacancy is twenty-three percent, Jakarta twenty, Singapore about five. Johor is the one place in the region where you cannot get in. Which tells you the demand isn't diffuse — it's aimed. And the constraint now isn't capital or chips. It's land, water, and grid. Malaysia's prime minister said early this year they'd stop approving new data centres that aren't AI-focused. There was the country's first data-centre protest in February, at a site in Iskandar Puteri. They actually stopped approving water-hungry lower-tier facilities in Johor.

Corn: That's a good sign, in a way. Usually it takes twenty years of complaints before anyone stops approving anything.

Herman: The locals moved fast, I'll give them that. Now the legal landscape there, because this is where Daniel's no-questions-asked framing needs a bit of correction. Malaysia is not lawless. In July twenty twenty-five their trade ministry, MITI, issued a requirement that any export, transshipment, or transit of US-origin high-performance AI chips needs a Strategic Trade Permit. Sounds strict. But read what it covers — chips leaving Malaysia. Not who rents them inside the country. Analysts at the time pointed out that importing chips for domestic data centres sits outside it entirely.

Corn: So the law chases the chips and never the rental contract.

Herman: Exactly the shape of the gap. And there's a concrete case that shows it in practice. The South China Morning Post reported in July twenty twenty-five that a Chinese company rented over three hundred Nvidia GPU servers at a Malaysian data centre — through a local company, with local directors, set up for the purpose of training models. Malaysia's response was fascinating. They said AI servers aren't restricted under Malaysian law, but they oppose circumvention of other countries' export controls, and the trade ministry opened an investigation. That's a government trying to be two things at once.

Corn: The jurisdictional equivalent of I'm not angry, just disappointed.

Herman: It's the posture of a country that wants the revenue and doesn't want the phone call from Washington. Now the US side. The House actually did something. In January they passed the Remote Access Security Act — three hundred sixty-nine to twenty-two, which is the kind of margin bills about motherhood get. The sponsor, Representative Mike Lawler, made the argument in one line: controls are only as strong as the weakest link. The bill would bring cloud and remote access under export controls. It went to the Senate Banking Committee the next day and, as far as I've seen, has sat there since.

Corn: A wall passed the House. The Senate is the gap in the wall.

Herman: And the vote margin tells you something — this isn't partisan. It's just not urgent to a body that moves at the speed of a body.

Corn: Let me test the other half of Daniel's framing, the arbitrage story. The pitch is always — data centres in cheap-energy places undercutting Western ones. Malaysia, cheap hydropower, tropical whatever.

Herman: I'm glad you asked, because the numbers say no, and it's not close. Peninsular Malaysia's base electricity tariff actually rose in mid twenty twenty-five, to about forty-six sen per kilowatt-hour. That's roughly eleven US cents. American industrial power averages about eight point seven to eight point nine cents. Malaysian electricity is dearer than American.

Corn: The energy arbitrage runs the wrong way.

Herman: It runs the wrong way! The cheap-power comparison everyone makes is against Singapore, where power is around twenty-seven cents. Johor is cheap next to Singapore, dear next to Texas. So if you're choosing Johor on price, you're choosing it as a Singapore substitute — but nobody taking a budget flight from Shanghai is comparing it to Plano, Texas. They can't rent in Plano. That's the whole point.

Corn: So the arbitrage isn't the kilowatt. It's the permission.

Herman: Access and legality. If you're a Chinese AI lab, the chips you want, you cannot buy or rent at home through normal channels — US controls, and the sort of extraterritorial reach the Americans assert. The same hour of an H100 might cost you about seven dollars on AWS on-demand in the US, roughly four at Lambda, and less on the open marketplace — but none of those prices are available to you, so they're not prices. The price you'll pay in Johor is whatever it is, plus the fact that it exists. That's the arbitrage.

Corn: Which is why I'd frame it — and tell me if this is fair — as an options market on somebody else's rulebook. The rental price isn't the cost. The cost is the risk that the jurisdiction changes its mind halfway through your training run.

Herman: That's a real cost, and we'll get to it, because the jurisdictions do change their minds. But hold the thought. One more Johor detail. The biggest single campus there, DayOne's Nusajaya site, is estimated by Epoch AI at about four hundred seventy megawatts of IT power. Epoch's own estimate in H100-equivalents is on the order of half a million top-tier chips. An estimate, not a disclosure, but that's one campus, across the causeway from Singapore.

Corn: Half a million chips nobody can rent in Shanghai.

Herman: Sitting in a country whose permit regime covers them only when they leave.

Hilbert: Hilbert's Anteater Trivia. The giant anteater and the two tamanduas belong to the family Myrmecophagidae, while the silky anteater has a family of its own. I have also spent years in a family of my own and nobody has offered me a permit for it.

Corn: Half a million relatives, and the silky one gets a separate filing.

Herman: Anyway — the risk side. Enforcement. Because if the arbitrage is permission, then the story of the next two years is whether the permission lasts, and Bloomberg reported in August that BIS enforcement is reviewing exactly this — offshore access to controlled chips. The plan they're reportedly working on is two country lists. One list for physical smuggling hubs, one for remote-use hubs. So they're designing the taxonomy of the problem, which means they've accepted the problem is real enough to taxonomize.

Corn: You know a bureaucracy is taking something seriously when it starts making lists about it.

Herman: It's step two of grief, institutionally. And there's a reported example of how tangled the routing gets. Bloomberg reported that Alibaba reaches Nvidia chips in Malaysia through an outfit called Megaspeed — through a Singapore company controlled by a Cayman Islands entity that Alibaba ultimately owns. Alibaba declined to comment, Megaspeed declined to comment, and nothing there is proven wrongdoing. But look at the geography of that arrangement. The chips are in Malaysia, the operator is in Singapore, the ownership is in the Caymans, the customer is in China. That's not a supply chain, it's a relay race where every runner is in a different time zone.

Corn: The Financial Times had Alibaba and ByteDance doing this more openly too, renting from non-Chinese operators in Singapore and Malaysia?

Herman: Reported, yes — and Nvidia's own position was that the rules explicitly allow cloud infrastructure outside controlled countries. Which is the uncomfortable part for Washington. The industry isn't hiding behind a technicality it invented. It's using the technicality the US government wrote.

Corn: Now the Moonshot business. That one's alleged, and I want us to keep the label on it.

Herman: Firmly. July twenty-second, the White House science adviser Michael Kratsios posted — publicly, by name — that Moonshot AI, the Chinese lab behind the Kimi models, had acquired GB300-equipped servers and accessed GB300s in Thailand, likely to train its models, and that it distilled an Anthropic model for Kimi K3. Kimi K3 came out in preview mid-July, reported at around two point eight trillion parameters. He offered no public evidence, and Moonshot didn't respond to reporters. So: an allegation, unproven, and no response from Moonshot.

Corn: But notice what's being alleged, separate from who did it. It's not training from scratch on stolen chips. It's distillation — you use the rented compute to interrogate a frontier model and compress what it knows into yours.

Herman: And that reframes the whole border question, because it's not just compute leaving the country. It's the output of someone else's compute coming back wearing your label. Weights distilled from a frontier model don't arrive with a receipt. Then there's the OBON case, reported by Bloomberg in May — a Bangkok firm that created the sovereign-cloud company Siam AI, suspected of helping divert Super Micro servers with Nvidia chips. Around two and a half billion dollars of servers were sold to it before Commerce reportedly halted shipments. OBON isn't a defendant in anything, and Alibaba denies any relationship with it and says it never used banned chips. But two and a half billion dollars of servers is a lot of hardware for one Bangkok company, which is presumably why Commerce wanted a closer look.

Corn: Especially when the US considered chip controls on Thailand several times and never imposed them.

Herman: That's the part I find strange. A draft Commerce rule that would have restricted Malaysia and Thailand was shelved. Meanwhile they rescinded the Biden-era AI Diffusion Rule in May twenty twenty-five — days before it would have taken effect — a rule that would have put Malaysia in a capped middle tier with a quota on chips. The same day that rule died, BIS put out a warning that using Huawei Ascend chips anywhere in the world risks violating US export controls. Anywhere in the world.

Corn: They dropped the fence and fined people for standing in the field.

Herman: The policy is reactive, and the swing is the real story. Take the UAE. Ten July this year, the US moved the UAE into the licence-free tier for AI chips for at least nine months. Last November, the US approved up to thirty-five thousand GB300-equivalents each for G42 in the UAE and Humain in Saudi. A jurisdiction can go from suspect to favoured inside twelve months, and back, depending on the week's diplomacy.

Corn: Which is the answer to Daniel's which-places question, in a way he might not expect. There isn't a stable list of no-questions-asked jurisdictions. There's a moving shadow — wherever the rules haven't reached yet this quarter.

Herman: The list writes itself and erases itself. Thailand's the clearest case — controls considered, never imposed, then a two-and-a-half-billion-dollar diversion story surfaces there anyway. And Singapore, the respectability layer — the country with the strict reputation, whose name sits on the companies routing around it.

Corn: So you'd get more reliable hosting advice from a horoscope than from the Federal Register.

Herman: Corn, you were going to say that regardless of the research.

Corn: I stand by its accuracy. Here's my question, though — and it's the one I actually can't decide. If the Senate ever moves on the Remote Access Security Act, what does enforcement even look like? A smuggled chip is a thing in a container. A rented chip is an invoice and an IP address. You can't seize a login.

Herman: Nobody's solved it, honestly. You'd have to police the contracts and the money rather than the goods — know your customer rules for compute, essentially, which is what the two-country-list plan gestures at. And the counter-pressure is enormous, because the same mechanism that makes it a leakage problem makes it a business model. Nvidia wants to sell, the data-centre operators in Johor want to fill floors, the governments want the investment. Malaysia's own position — servers not restricted, circumvention opposed — is the position of every jurisdiction in this story. Everyone's opposed to it and everyone's booked out.

Corn: A rack with a vacancy of zero point seven percent has opinions about circumvention, and they're all in favour of whoever's paying.

Herman: Here's the line I'd defend: the bottleneck moving up the stack doesn't remove the bottleneck, it just makes it shinier. The constraint used to be making the chips. Now it's deciding who's allowed to multiply them into weights.

Corn: And the multiplication is the part the law can't see. Here's the thing I keep circling back to, though. Everyone in Washington talks about the suitcase of hard drives — IP leaving in a carry-on, the visual. But the suitcase version is one WSJ story. The actual volume is contractual.

Herman: A spreadsheet with a stamp on it.

Corn: No. The spreadsheet is the point. The stamp is what's missing.

Herman: Touché. And there's a wrinkle Daniel's framing will run into eventually, which is the direction of the weights. The Kimi K3 distillation allegation points at weights flowing back into China. But the same rented racks in Johor serve legitimate tenants too — the FT reporting had Alibaba and ByteDance renting openly, under rules Nvidia says permit it. The facility doesn't know which story it's in.

Hilbert: It knows one thing, Corn. I'll grant you the arbitrage is access, not the electricity — you two had that right, and it wasn't close. They ask one question. How long do you need it. That's the whole form.

Corn: From experience?

Hilbert: From a Tuesday, in eighty-five or eighty-six. A man named Ronald Peever wanted machine time for a payroll run he was late on, and he'd found a bureau across the border that would rent it out cheap, no contract beyond a page. He needed someone to sit with the operator while it ran, and I went along because I had nothing on and Peever paid cash.

Herman: Across which border?

Hilbert: It's in the drawer with my passport, Herman, the contract is, not the border. I asked for it in writing — that's my habit, you'll have noticed by now Corn takes credit for the slow decisions and I take the paperwork. One page, faxed, and the acceptable-use clause was three words. Don't ask.

Corn: That's the acceptable-use clause and the business model in one.

Hilbert: Peever's run took four hours and I billed him for six, because the first two we spent waiting for the operator to come back from wherever he was. The machine never arrived at the bureau while I was there, mind — it was in another building, or Peever believed it was. We were renting time on something neither of us saw. He was satisfied. He wanted a second week and I priced it for him and he didn't take it, and I kept the fax.

Herman: You kept a fax from nineteen eighty-five.

Hilbert: It's good paper. And Peever never asked what the three words were for, which is the part I remember. He assumed it meant they wouldn't ask about the payroll. I think it meant they wouldn't ask about the machine.

Corn: For our purposes, that's a data point on vacancy. Under one percent vacancy, and people are renting time on machines they never see — that's the floor price of access, and it's set by scarcity, not by power. Which is worth noticing, because when the Senate eventually does look at the Remote Access Act, the question that decides whether it means anything is simpler than the legal one. Is it cheaper to comply, or cheaper to rent where nobody asks how long you need it? As long as Johor is at zero point seven percent vacancy, that question answers itself every hour of every day.

Herman: And the deeper open question is the one nobody has legislation for. If you can't stop the training, can you stop the weights? They're just numbers, they compress to nothing, they cross on a phone. The whole control regime may end up pushed one step further out — onto the models rather than the machines.

Corn: Which is a very different kind of law to write. Chips have serial numbers. Answers don't.

Herman: If you enjoyed this one, leave a review and subscribe — and tell a friend who still thinks heists are glamorous. If this was your kind of episode, go back for episode eighteen, Beyond the GPU; episode seventeen, Cloud Render Superpowers; and episode sixteen, On Deepfakes, SynthID, And AI Watermarking. This has been My Weird Prompts.

Corn: Find everything at my weird prompts dot com. We'll be back soon.

Herman: See you tomorrow.