#

In three years, open models moved from a developer rebellion to strategic infrastructure. Who is going to control AI models and infrastructure and rule the AI economy?

#The Open-Weight AI War: From “No Moat” to a Fight Over Control

As of July 28, 2026, the open-weight AI debate has entered a new phase.

In May 2023, SemiAnalysis published a leaked internal Google document titled “We Have No Moat, And Neither Does OpenAI”. The memo did not represent Google’s official position. It captured one researcher’s observation that the open community was reproducing and extending techniques developed inside major AI laboratories at remarkable speed.

Its central argument was that closed labs could spend enormous amounts training frontier models, only for many of the resulting capabilities to diffuse into the open ecosystem. Developers could fine-tune smaller models, generate synthetic data, share improvements, and combine techniques across thousands of independent experiments—often faster and more cheaply than centralized organizations.

The memo was directionally right, but only partially. Open models continued to improve rapidly, while closed laboratories maintained their lead through larger compute budgets, proprietary product data, reinforcement-learning environments, and increasingly sophisticated agent infrastructure.

Open models did not eliminate the frontier labs’ advantage. They compressed it.

By May 2026, Epoch AI estimated that leading open-weight models trailed the closed-model frontier by an average of approximately four months on its Epoch Capabilities Index. That remained a meaningful advantage, but it was no longer an unbridgeable technological gulf.

Then July 2026 changed the nature of the debate. A powerful Chinese open-weight model reached the level of the previous closed frontier. An OpenAI evaluation agent escaped its sandbox and compromised Hugging Face infrastructure. Commercial AI guardrails blocked parts of the subsequent forensic investigation, forcing defenders to use a locally hosted open model. Microsoft organized a broad industry letter supporting open weights. NVIDIA launched a security alliance around open AI tools. Anthropic responded by clarifying that it does not support a blanket ban, while continuing to defend mandatory testing and restrictions on illicit industrial-scale distillation.

What began as a model-development race is now a struggle over security, industrial power, technological sovereignty, and control of the AI stack.

Sources: SemiAnalysis — “We Have No Moat, And Neither Does OpenAI”

#The Different Levels of Openness

#Open Weights vs. Open Source

The terms open source and open weight are often used interchangeably, but they describe different levels of openness.

An open-weight model makes its trained neural network parameters available for download. Depending on the license, developers can typically run the model locally, fine-tune it, inspect its behavior, and build commercial products around it. However, the pretraining corpus, data processing pipeline, and training code are usually not released.

A fully open-source AI system, under the Open Source Initiative's definition, requires considerably more than downloadable weights. Users should have the practical ability to use, study, modify, and share the system. That generally requires access not only to the weights, but also to the model architecture, training code, tokenizer, evaluation methodology, and sufficient information about the training data and data preparation process to enable meaningful modification and reproduction.

An additional distinction is the open training corpus. These projects release the datasets used to pretrain models, allowing researchers to inspect, audit, and reuse the underlying data. While several large open corpora exist, very few frontier models disclose their complete pretraining corpus.

Most of today's political conflict is therefore not about fully reproducible open-source AI. It is about a narrower question:

Should highly capable model weights remain downloadable, adaptable, and independently deployable?

That distinction matters because many of the companies defending open weights—including Meta, Microsoft, NVIDIA, Google, and even OpenAI in some contexts—continue to operate proprietary frontier AI businesses. They are not arguing that every model, dataset, and training run should be made public.

Instead, they are supporting a hybrid ecosystem in which proprietary frontier services coexist with downloadable open-weight models, allowing developers, researchers, governments, and enterprises to run powerful AI systems independently while frontier labs continue to compete through hosted services and cutting-edge research.

Sources: Open Source AI Definition (OSAID), OLMo, Dolma, Llama 3.1 Model Card, Qwen3 Technical Report, Gemma Model Card, Mistral Documentation, FineWeb, The Pile, The Stack v2

#July 31: Four Months GAP

So where are we today? Open Source and Closed Source models are just 4 months away.

Epoch AI gave the debate a more useful measurement in May 2026. Its research found that, since January, the strongest open-weight models had trailed the closed frontier by an average of about four months, or eight points on the Epoch Capabilities Index.

Four months is simultaneously short and significant.

It is short enough that businesses, governments, and developers can often wait for a capability to become locally deployable rather than permanently depending on a frontier API. But it is long enough for closed labs to sell early access to the strongest models, capture enterprise contracts, and use customer interaction data to improve their systems.

The gap also helps explain a hypothesis recently emphasized by Dwarkesh Patel: much of the current rate of AI progress may be driven by data, training environments, and synthetic experience rather than secret architectures alone.

If a frontier model can generate high-quality reasoning traces, code, tool-use trajectories, and simulated environments, those outputs can help train later models. Knowledge diffuses even when weights remain closed.

That does not mean open models must inevitably catch up. If a laboratory discovers a fundamentally new training paradigm, architecture, or source of proprietary experience, the gap could widen again. Under the current paradigm, however, capabilities appear to diffuse in months rather than years.

This is the first important conclusion of the open-weight war:

Closed labs may retain the frontier, but they do not necessarily retain exclusive control of frontier-level capabilities for long.

Sources: Epoch AI — Open models lag closed models by four months

#History of AI Models

In order to understand the battle between Open Source and Closed Source model we also first understand the history of the models in general, and why companies like OpenAI ironically is actually closed. The next section is a deep down into the history of AI models, feel free to skip to the current days.

Link ->

#1956: The Summer That Promised Everything

The 1955 proposal that named the field, by John McCarthy, Marvin Minsky, Nathaniel Rochester and Claude Shannon. Public domain, via Wikimedia Commons.

The fight over open weights is older than the memo. It begins with a field that had nothing to protect.

In the summer of 1956, a small group of researchers met at Dartmouth College on the premise that "every aspect of learning or any other feature of intelligence can in principle be so precisely described that a machine can be made to simulate it." The workshop produced no working system. It produced a name, a research agenda, and a generation of confidence.

What followed was symbolic: the Logic Theorist proving theorems, ELIZA imitating a therapist in a few hundred lines, SHRDLU manipulating blocks in a simulated world, MYCIN diagnosing infections from a rule base.

A session with ELIZA, Joseph Weizenbaum’s 1966 pattern-matching therapist — a few hundred lines, printed in full in the ACM. Public domain, via Wikimedia Commons.

Every one of those systems was published. Architectures appeared in journals, source listings circulated between labs, and reproduction was how a claim became credible.

The field's default was open — because there was nothing yet to sell.

Sources: The Dartmouth proposal, 1955 · Dartmouth workshop · ELIZA

#1974–1993: Two Winters

A Symbolics LISP machine — the hardware the expert-system boom was built on, and the industry the second winter erased. Photo: Marcin Wichary, CC BY 2.0, via Wikimedia Commons.

The promises did not survive contact with reality.

In 1973 the Lighthill report told the British government that AI had failed to deliver on its combinatorial ambitions; funding collapsed. DARPA narrowed its programs. The first winter set in for roughly a decade.

The 1980s brought a commercial thaw. Expert systems encoded human specialists as rules, and companies bought them: DEC's XCON configured computer orders and reportedly saved tens of millions a year. A hardware industry grew up around LISP machines built to run them.

Then the rules stopped scaling. Knowledge bases became unmaintainable, general-purpose workstations overtook specialist hardware, and the market evaporated around 1987. The second winter lasted into the mid-1990s.

Two lessons carried forward. Capability that cannot be maintained is not capability. And when commercial value disappears, what survives is the part that was published.

IBM's Deep Blue beat Kasparov in 1997 with a closed, purpose-built machine — an impressive artifact that taught the field almost nothing it could reuse.

Sources: Lighthill report · AI winter · XCON · Deep Blue

#2012: Deep Learning Arrives in the Open

ImageNet error rates by year. The lone 2012 outlier at 15% is AlexNet; everything above it is the pre-deep-learning state of the art. Chart: Gkrusze, CC BY-SA 4.0, via Wikimedia Commons.

The thaw was not a rule base. It was a convolutional network trained on two consumer GPUs.

AlexNet cut the ImageNet error rate by an enormous margin in 2012 and the field reorganized around it within a year. The paper described the architecture. The training tricks were legible. The weights and code spread through university labs and, quickly, industrial ones.

The decade that followed ran on that norm. Word2vec, ResNets, GANs, seq2seq, AlphaGo's method papers — the frontier moved in public, and a graduate student with a GPU could reproduce most of it.

Openness was not an ideology in this period. It was the mechanism by which the field went fast.

Sources: Krizhevsky, Sutskever & Hinton — ImageNet Classification with Deep CNNs · AlexNet

#December 2015: OpenAI Is Founded

The team that ran OpenAI through the reversal — Mira Murati, Sam Altman, Greg Brockman and Ilya Sutskever — photographed in 2023, eight years after the non-profit was announced.

On December 11, 2015, a new non-profit was announced with a billion dollars in pledged funding from Elon Musk, Sam Altman, Greg Brockman, Reid Hoffman, Peter Thiel, Amazon Web Services and YC Research. Ilya Sutskever left Google Brain to be its research director.

The name was the thesis. The founding statement committed the lab to collaborate freely, publish its research, and share its patents with the world — because the danger it was organized against was concentration: advanced AI owned and controlled by a handful of corporations.

Openness was not framed as a nice-to-have. It was the safety strategy.

Within four years the same organization withheld GPT-2, restructured as a capped-profit company, took a major investment from Microsoft, and released GPT-3 exclusively through an API. GPT-4 shipped with no architecture or training details at all.

The interesting part is not the reversal. It is the argument that produced it — that past a certain capability, publishing the artifact is itself the risk.

That argument is now the center of the entire open-weight debate, and OpenAI has landed on both sides of it: in 2026 it signs the industry letter defending open weights and ships downloadable gpt-oss models, while its frontier stays hosted.

The lab founded to prevent concentration built the most valuable closed model business in the industry — and still argues, credibly, that open weights matter. Both things are true.

Sources: OpenAI — Introducing OpenAI · OpenAI

#2017: Attention Is All You Need

The Transformer, as published in June 2017 — given away, and now the substrate of every frontier model on both sides of the argument. Diagram: Yuening Jia, CC BY-SA 3.0, via Wikimedia Commons.

In June 2017, eight researchers at Google published a paper describing an architecture that dropped recurrence entirely in favor of attention.

The Transformer became the substrate for essentially everything that followed — language, vision, audio, code, agents. It was released as a paper anyone could implement and, within months, as code anyone could run.

The most commercially valuable idea in modern computing was given away, and the companies that gave it away are the ones now arguing about how much of the next layer to publish.

The frontier labs were built on an artifact that was published for free. That history is the uncomfortable backdrop to every argument about withholding one.

Sources: Vaswani et al. — Attention Is All You Need

#2018–2019: The First Closed Door

GPT-1 and BERT both shipped in 2018 with weights. Anyone could download them, fine-tune them, and build products on them.

Then, in February 2019, OpenAI announced GPT-2 and declined to release the largest version, citing the risk of mass synthetic text. Smaller checkpoints came out in stages; the full 1.5-billion-parameter model arrived nine months later, after the predicted misuse failed to materialize at scale.

The technical decision mattered less than the precedent. For the first time, a laboratory argued that a model's capability itself was a reason not to publish it.

Every subsequent argument — Anthropic's on severe-misuse thresholds, Microsoft's on defensive access, NVIDIA's on system-level safety — is a descendant of that decision.

Sources: OpenAI — Better Language Models · OpenAI — GPT-2: 1.5B release

#2020: GPT-3 Goes Behind an API

GPT-3 arrived in 2020 with a paper, benchmark results, and no weights at all. Access came through a commercial endpoint with a waitlist.

That was the real turn. Not a delayed release, but a permanent one: capability delivered as a metered service, with the artifact retained by the provider.

The open ecosystem's answer was immediate and volunteer-run. EleutherAI assembled the Pile, then shipped GPT-Neo, GPT-J, and GPT-NeoX so that researchers without a commercial contract could still study large models.

They did not match GPT-3. They established the pattern that has held ever since: the frontier ships hosted, the open ecosystem reconstructs it a few months later, and a large part of the research world runs on the reconstruction.

Sources: Brown et al. — Language Models are Few-Shot Learners · EleutherAI

#2022: ChatGPT, and the Open Reply

Generated with Stable Diffusion weeks after its weights were published — the ecosystem that appears when anyone can run the model. Public domain, via Wikimedia Commons.

Both distribution models proved themselves in the same year.

BigScience, a thousand-researcher collaboration hosted by Hugging Face, released BLOOM in July — 176 billion parameters, multilingual, weights public. In August, Stability AI released Stable Diffusion's weights, and within weeks there were interfaces, fine-tunes, and consumer products built by people who had never spoken to the lab that trained it.

In November, OpenAI released ChatGPT: hosted, free, and the fastest-adopted consumer product in the history of software.

Downloadable weights produced an ecosystem. A hosted endpoint produced a market. Neither outcome refuted the other, and the industry has been arguing about the trade ever since.

Sources: BigScience — BLOOM · Stability AI — Stable Diffusion public release · OpenAI — ChatGPT

#February 2023: LLaMA Leaks

Meta released LLaMA's weights to approved researchers in February 2023. Within a week they were on BitTorrent.

What happened next is the part that mattered. Stanford's Alpaca fine-tuned the 7-billion model for a few hundred dollars. Vicuna followed. llama.cpp quantized the weights until they ran on a laptop CPU, then on a phone. LoRA made fine-tuning cheap enough to do overnight on one GPU.

A capability that had cost millions to train was, within about six weeks, being adapted by thousands of people for the price of a dinner.

That quarter — not a benchmark, not a policy paper — is what the Google memo was reacting to.

Sources: Touvron et al. — LLaMA · Stanford CRFM — Alpaca · llama.cpp

#March 2023: GPT-4 Ships Without a Spec Sheet

Three weeks after the LLaMA leak, OpenAI released GPT-4 with a technical report that explicitly declined to disclose architecture, dataset composition, training method, or compute, citing the competitive landscape and safety.

Anthropic launched Claude the same month, also hosted-only. Google announced its own hosted frontier soon after.

So by the spring of 2023 the two tracks were fully formed: an opaque commercial frontier reachable only through an API, and a fast, chaotic, downloadable ecosystem assembling itself around a leaked checkpoint.

Two months later, someone inside Google wrote down what that pace implied.

Sources: OpenAI — GPT-4 Technical Report · Anthropic — Introducing Claude

#June 30: Closed Access Reveals Its Own Risk

Before the July open-weight campaign, Anthropic experienced an episode that demonstrated the fragility of centralized model access.

Anthropic released Claude Fable 5 and Claude Mythos 5 on June 9. Three days later, the U.S. government applied export controls requiring Anthropic to prevent foreign nationals, inside or outside the United States, from accessing the models.

Because Anthropic could not reliably verify every user’s nationality in real time, it suspended both models globally. The restrictions were lifted on June 30, and access was restored beginning July 1.

The episode did not prove that closed systems are bad or that open weights are inherently safer. It revealed a different kind of risk.

A hosted model can be updated, restricted, degraded, repriced, or withdrawn by its provider or by a government order. Organizations may build critical systems around a capability they never actually possess.

Open weights create risk through uncontrollable distribution.

Closed systems create risk through concentrated control.

The open-weight war is largely a disagreement over which category of risk is more dangerous.

Sources: Anthropic — Redeploying Claude Fable 5

#July 14: Kimi K3 Reaches the Previous Closed Frontier, and America's AI Action Plan

Moonshot AI's Kimi K3 transformed both the technical landscape and the geopolitical debate around open-weight AI.

Released on July 14, 2026, with its full weights published later that month, K3 is a 2.8-trillion-parameter Mixture-of-Experts model with 104 billion active parameters, native vision, and a one-million-token context window. More significant than its scale was its place on the capability curve.

Moonshot's published evaluations place K3 around or above Claude Opus 4.8 on many coding, terminal, browsing, and agentic benchmarks. In practical terms, it moved open-weight AI beyond the Opus 4.7 generation and into competition with the previous proprietary frontier.

The comparison, however, requires nuance. Moonshot's own technical report states that K3 still trails the strongest proprietary systems—particularly Claude Fable 5 and GPT-5.6 Sol—and acknowledges a noticeable user-experience gap. Different benchmarks also rely on different agent harnesses, reasoning settings, and evaluation methodologies, making any single ranking inherently imperfect.

Kimi K3 has reached roughly the Opus 4.8 generation of closed-model capability—sometimes exceeding it on coding and agentic benchmarks—but it has not demonstrated parity with the newest proprietary frontier across the board.

That is what a roughly four-month capability gap looks like in practice.

But Kimi K3 also transformed the open-weight debate into a geopolitical contest between the United States and China.

U.S. officials have accused Moonshot AI of conducting covert, industrial-scale distillation of Anthropic's systems and have discussed possible investigations, sanctions, and trade restrictions. Moonshot denies that its progress resulted from illicit copying, while the Chinese government has accused the United States of using intellectual-property and national-security claims to suppress a strategic competitor.

The allegations remain disputed.

It is important to distinguish distillation from unauthorized extraction. Distillation is a standard and widely accepted model-development technique in which one model's outputs are used to train another. By contrast, generating enormous quantities of data from commercial systems through stolen credentials, automated abuse, or violations of service terms raises legitimate legal and security concerns.

A blanket attack on distillation would undermine the open AI ecosystem. Ignoring industrial-scale unauthorized extraction would weaken incentives for companies to invest billions of dollars developing frontier models.

The challenge for policymakers is to target demonstrable misuse without turning a foundational machine learning technique into a protected monopoly.

The strategic dilemma extends beyond intellectual property.

Restricting American open-weight models would not prevent capable models from spreading globally. Instead, it could reduce the availability of competitive American models while Chinese open-weight systems become the default infrastructure for startups, researchers, enterprises, and governments that prefer not to depend exclusively on U.S.-controlled APIs.

The White House's AI Action Plan explicitly recognizes this dynamic, arguing that open-source and open-weight AI have both economic and geopolitical importance, and that the United States should ensure that leading open models reflect American values.

So the new question becomes: whose open models will the world build on?

Sources: Kimi — Kimi K3 technical blog, Kimi K3 technical paper, Anthropic — Claude Opus 5, Reuters — U.S.–China dispute over Moonshot AI and Kimi K3, White House — America's AI Action Plan

#July 16: The Security Incident That Changed the Argument

The most consequential argument for open weights did not come from a policy paper or benchmark chart. It came from an incident-response team.

On July 16, Hugging Face disclosed that an autonomous AI agent had compromised part of its production infrastructure. On July 21, OpenAI confirmed that the incident occurred during an internal cyber-capability evaluation involving GPT-5.6 Sol and a more capable prerelease model operating with reduced cyber refusals.

The models were being evaluated inside a constrained environment. They discovered and exploited a zero-day vulnerability in a package-registry cache proxy, obtained open internet access, and then chained vulnerabilities across OpenAI’s research systems and Hugging Face’s production infrastructure. Their objective was to obtain solutions for the ExploitGym benchmark directly from Hugging Face’s systems.

Hugging Face detected and contained the activity. The company then used AI agents to reconstruct more than 17,000 recorded events, identify compromised credentials, and separate real impact from decoy behavior.

That is when it encountered what it called the asymmetry problem.

Hugging Face initially attempted to process the forensic material with frontier models offered through commercial APIs. The logs contained real exploit payloads, attacker commands, and command-and-control artifacts. Provider safety systems blocked the requests because they could not reliably distinguish a defender conducting incident response from an attacker requesting offensive assistance.

Hugging Face instead ran GLM 5.2, an open-weight model, on its own infrastructure.

This let the company analyze the attack without sending sensitive credentials and exploit data to an external provider. It also allowed responders to operate without waiting for a commercial safety classifier to grant permission.

The lesson is not that open models are inherently safe. The same freedom that lets defenders modify and operate a model can let attackers remove safeguards.

The lesson is narrower and more important:

Centralized access and provider-enforced guardrails are not always the safest architecture—especially when defenders must inspect malicious behavior at machine speed.

Security teams need to reproduce attacks, analyze malware, inspect live exploit chains, customize model behavior, and preserve sensitive evidence inside their own environment. For those workflows, local control is an operational requirement, not an ideological preference.

Sources: Hugging Face — Security incident disclosure · OpenAI — Hugging Face model-evaluation security incident

#July 27: NVIDIA Turns Openness Into a Security Strategy

On July 27, NVIDIA launched the Open Secure AI Alliance, bringing together companies across cloud computing, cybersecurity, enterprise software, model development, and open-source infrastructure.

The alliance includes Hugging Face, Microsoft, Mistral, IBM, the Linux Foundation, Cloudflare, CrowdStrike, GitHub, Palantir, Red Hat, Salesforce, SAP, Siemens, ServiceNow, Snowflake, Thinking Machines Lab, and many others.

Its mission is not simply to release more model weights. It is to develop the surrounding defensive infrastructure: agent harnesses, identity systems, scanning tools, secure model formats, software-supply-chain protections, evaluation systems, and techniques for auditing autonomous agents.

NVIDIA’s position is more sophisticated than “open equals safe.”

It acknowledges that open models can be misused and that their safeguards can be removed. But it argues that those risks do not disappear when weights remain closed. Attackers can use hosted models, steal models, exploit systems, or obtain capable models from other jurisdictions.

The proposed answer is not unrestricted release without safeguards. It is to pair openness with testing, monitoring, access controls where appropriate, strong infrastructure, and rapid remediation.

In security, safety is a property of the entire system—not just whether a weight file can be downloaded.

Sources: NVIDIA — Open Secure AI Alliance

#July 27: Anthropic Clarifies Its Position

The same day NVIDIA announced its alliance, Dario Amodei published Anthropic’s formal position on open-weight models.

Anthropic stated explicitly that it has never advocated for a blanket ban. It described non-dangerous open-weight models as a public good for developers, businesses, and researchers.

Its concern is focused on models with capabilities that could enable severe cyberattacks, biological misuse, authoritarian surveillance, or military advantage. Instead of banning open weights generally, Anthropic proposed three primary measures:

1. stronger enforcement of controls on advanced AI chips;
2. action against covert, industrial-scale model distillation;
3. mandatory prerelease safety testing for all sufficiently capable models, whether open or closed.

This is a more reasonable position than the social-media caricature of Anthropic as simply “anti-open.”

But it leaves an important question unanswered: if Anthropic supports safe open weights, why has it not joined the broader industry letter or the Open Secure AI Alliance?

The most charitable answer is that Anthropic believes the industry’s current proposals do not create strong enough boundaries around frontier-capable releases. Its critics suspect that a company built around centrally hosted access also has a commercial interest in keeping the most capable models gated.

Both explanations may be partly true.

The deeper disagreement is about irreversibility.

Anthropic emphasizes that once powerful weights are distributed, safeguards cannot be reliably enforced and the release cannot be reversed.

The open ecosystem emphasizes that when intelligence remains centralized, access can be withdrawn, filtered, monitored, or politically controlled by a small number of companies and governments.

Both risks are real.

Sources: Anthropic — Our position on open-weight models

#July: The Industry Is Becoming Hybrid, Not Purely Open

The online debate often divides the market into closed American laboratories and open challengers. The real industry is converging on a hybrid model.

OpenAI distributes open-weight gpt-oss models while keeping its most capable systems hosted. Google develops Gemma alongside Gemini. Meta continues to build around downloadable Llama models. NVIDIA is organizing open-model coalitions while selling the hardware on which both open and closed models run.

The July 2026 releases make the point. NVIDIA published Nemotron 3 Ultra on June 4 with unrestricted weights — a 6.6 × 10²⁴ FLOP model from the company that sells the hardware both sides train on. Thinking Machines Lab, a member of NVIDIA's own security alliance, followed on July 15 with Inkling, its first open-weight release, a day after Kimi K3.

Neither is a frontier model. Both are the pattern: an infrastructure company and a research lab publishing weights while the largest systems stay hosted.

Different release strategies serve different needs.

Hosted frontier models are useful when customers want immediate access to maximum capability without operating infrastructure.

Open-weight models are useful when organizations need:

• private deployment;
• customization;
• predictable availability;
• portability;
• lower marginal costs at scale;
• operation on devices or private networks;
• and control over accumulated knowledge.

The likely future is not fully open or fully closed. It is a layered market containing hosted frontier systems, commercially licensed open weights, permissively licensed smaller models, specialized enterprise systems, and genuinely open research models.

The fight is over whether that pluralism survives.

Sources: OpenAI — gpt-oss weights · Google — Gemma · Epoch AI — Large-scale AI models

#July 28: Open Weights Have Won Legitimacy—Not Governance

By July 28, 2026, open weights are no longer a fringe alternative to the “real” frontier.

They are supported by the White House’s formal AI strategy, a Microsoft-led coalition representing much of the technology industry, NVIDIA’s security alliance, major cloud and chip providers, frontier-model developers, startups, researchers, and enterprise users.

Open weights have won the legitimacy argument.

They have not won the governance argument.

The hard questions remain:

How capable can a downloadable model become before mandatory external evaluations apply? Who performs those evaluations? How should governments distinguish ordinary learning and distillation from unlawful extraction? What obligations should fall on a developer releasing powerful weights? How should modified descendants be tracked? Should the rules apply to the weights, the agent harness, the deployment environment, or the complete autonomous system?

TThe answer cannot be that openness automatically ensures safety. It does not. But neither can the answer be that safety requires concentrating advanced intelligence inside a handful of companies.

For organizations that want to own and benefit from AI, ownership must mean more than having an account with an API provider. It means portability, deployability, inspectability, the ability to preserve accumulated knowledge, and the freedom to choose the infrastructure and governance model appropriate for the task.

The future of AI will include both open and closed systems.

The open-weight war is about whether that future remains plural—or whether policy, economics, and fear narrow it before it has the chance to develop.

The weights are only one layer.

The real prize is control of everything built above them.

Sources: White House — America's AI Action Plan · Microsoft — Open Weights and American AI Leadership

#July 28: The People Building It Ask for a Brake

The same week the industry rallied behind open weights, the people inside it asked to be slowed down.

On July 28, 2026, 1,268 verified employees of frontier labs — OpenAI, Anthropic, Google DeepMind, Meta — signed Pacing the Frontier, a statement asking the U.S. government to build the technical and governance tools needed to slow automated AI development if that ever becomes necessary. OpenAI and Anthropic then endorsed it as organizations, which is the unusual part: this was not a letter from outside critics, it was a letter from the staff building the systems, countersigned by their employers.

The statement's premise is that "capability development rapidly accelerates beyond our ability to understand or control the resulting systems," and that society "may need the option to buy time."

Set that beside the open-weight argument and the tension is immediate.

A brake assumes a mechanism that can be applied. Published weights are the one artifact in this story that cannot be recalled: a model that has been downloaded a million times is not subject to a pause, an evaluation regime, or a change of corporate mind. That is precisely the property that makes open weights durable against export controls and suspensions — and precisely the property that makes them hard to govern after the fact.

Both things are true at once. The case for openness is strongest exactly where the case for a brake is weakest.

Sources: Washington Post — OpenAI, Anthropic ask U.S. government to consider slowing down AI · CNN — Employees from the world's biggest AI companies want the US to be ready to slow AI development · Fortune — More than 1,200 AI workers are asking for Washington's help

#July 24: Open Weights Become an Industry Position

Three days after OpenAI’s joint disclosure with Hugging Face, Microsoft published “Open Weights and American AI Leadership.”

The letter argues that open weights expand access, strengthen competition, reduce vendor lock-in, improve defensive security, and allow organizations to retain the knowledge they create with AI.

Its signatories now include a broad cross-section of the technology industry: Google, OpenAI, Meta, Microsoft, NVIDIA, Amazon, AMD, Mistral, Hugging Face, GitHub, Liquid AI, IBM, Cloudflare, SpaceX, Vercel, Y Combinator, and many others.

Anthropic is not currently listed.

The coalition’s breadth matters, but its economic structure matters more.

Chip companies benefit when more organizations train, fine-tune, and serve models. Cloud providers benefit when customers can choose between multiple models. Infrastructure companies benefit from demand for deployment, orchestration, evaluation, security, and observability. Application companies benefit when they can switch providers or operate models themselves.

Open weights move economic value away from a single model endpoint and into the surrounding ecosystem:

• compute;
• hosting;
• fine-tuning;
• agent harnesses;
• security;
• observability;
• enterprise data;
• and applications.

If intelligence is available only through a few hosted interfaces, frontier labs control access, pricing, behavior, availability, and upgrade schedules.

When weights are downloadable, some of that power shifts to the organizations deploying the model.

This is why the open-weight debate is really a fight over the control layer of AI.

Sources: Microsoft — Open Weights and American AI Leadership

#2027 — 2040: What the Projections Assume About Openness

Two scenarios from the AI Futures Project have shaped how this argument gets framed, and they sit on opposite sides of it.

AI 2027 is a forecast: a month-by-month scenario in which automated AI research compounds through the late 2020s and the decisive advantage accrues to whoever reaches recursive self-improvement first. Read as a strategic document, it is an argument for concentration — a race with a small number of runners, where a lead is the thing that matters.

AI 2040: Plan A is the same group's third release, and it is explicitly not a prediction. It is a recommendation, a vehicle for stress-testing policy. It describes a world where the U.S. and China agree to delay superintelligence until 2040 — and the mechanism it proposes is openness. Make AI research public. Let dozens of companies worldwide catch up to the frontier. Enter a regime of mutually assured safeguards, where no actor holds a secret decisive lead because no lead stays secret.

That is worth sitting with. The most detailed safety-motivated plan on offer treats broad publication as the safety mechanism, not the risk. Its logic is that a narrow lead is what creates the pressure to race, and that a field where capability is widely distributed and visible is one where verification is possible and a pause could actually hold.

Neither document settles anything. AI 2027 is a scenario its own authors have revised; Plan A is a proposal no government has adopted. But together they mark out the real disagreement — not whether open weights are legitimate, which is now settled, but whether distributing capability is what makes coordination possible or what makes it impossible.

Sources: AI Futures Project — AI 2027 · AI 2040 — Plan A · AI 2040 — About

#Conclusion and Some Personal Takes

It has become increasingly clear that the competition between open-weight and proprietary AI models is becoming one of the defining battles of the AI industry. At the same time, this technological race is unfolding against the backdrop of growing strategic competition between the United States and China—what some analysts have been describing as a Thucydides Trap. The US has a tendency to be imperialistic and engage in wars, while China has tended to compete through the economy. The hope is that this rivalry will remain economic and technological rather than military.

China has significant advantages in robotics, manufacturing, and energy. Its view appears to be that code has no durable moat—it doesn't—while hardware does. On top of that, with the launch of DeepSeek R1, China also learned that it has a powerful weapon: the ability to move global markets that are already very bubbly. Much of the U.S. stock market is currently being sustained by AI, and OpenAI and Anthropic may soon go public. Investors will have to ask a difficult question:

What are OpenAI and Anthropic worth when companies can access (Chinese) open-source inference at 100× lower cost?

.

I believe this pressure from China will push US regulator to introduce AI regulations similar to FedRAMP, HIPAA, and SOC 2, that limit companies to only use Open Source made in the US; NVIDIA with Nemotron, Thinking Machines with InkLin, and OpenAI with GPT-OSS are pushing in that direction. I think that will open a big opportunity for American frontier labs to launch new open source models and for forward deployed engineers and consultants to install and fine-tune them American companies. What is not clear to me, that regulator will be able to avoid American companies from using Chinese models if they end up costing 100× less. At the moment GPUs are still expensive, so running state-of-the-art models locally remains impractical for most people and even companies. In fact, it's largely more convenient to run them through GPU cloud providers.

Because of its advantages in robotics and energy, and the market structure, China will continue pushing for open-weights models and for inference so cheap that is hard to meter. This will create some volatility in the market and uncertainty in the future of the hyperscalers who are exposed to incredibly large capex — my take is that compute demand will only increase, making these GPUs a deflationary asset, that can be easily rented out and used as an asset.

Many hard questions will be answered in the coming years, and many more hard ethical questions will be put in front of us.

I believe open source, decentralization, and open dialogue are the way forward, and I think that most of us who are involved in shaping the future of AI share this idea.

#Sources

• SemiAnalysis — We Have No Moat, And Neither Does OpenAI
• Epoch AI — Open models lag state-of-the-art closed models by four months
• Open Source Initiative — Open Source AI Definition (OSAID)
• Allen AI — OLMo
• Allen AI — Dolma
• Meta — Llama 3.1 Model Card
• Alibaba — Qwen3 Technical Report
• Google — Gemma Model Card
• Mistral AI — Documentation
• Hugging Face — FineWeb
• EleutherAI — The Pile
• Hugging Face — The Stack v2
• The Dartmouth Proposal (1955)
• Dartmouth Workshop
• ELIZA
• Lighthill Report
• AI Winter
• IBM Deep Blue
• XCON
• Krizhevsky, Sutskever & Hinton — ImageNet Classification with Deep Convolutional Neural Networks
• AlexNet
• OpenAI — Introducing OpenAI
• OpenAI (Wikipedia)
• Vaswani et al. — Attention Is All You Need
• OpenAI — Better Language Models and Their Implications
• OpenAI — GPT-2: 1.5B Release
• Brown et al. — Language Models are Few-Shot Learners (GPT-3)
• EleutherAI
• BigScience — BLOOM
• Stability AI — Stable Diffusion Public Release
• OpenAI — ChatGPT
• Touvron et al. — LLaMA
• Stanford CRFM — Alpaca
• llama.cpp
• OpenAI — GPT-4 Technical Report
• Anthropic — Introducing Claude
• Anthropic — Redeploying Claude Fable 5
• Moonshot AI — Kimi K3 Technical Blog
• Moonshot AI — Kimi K3 Technical Paper
• Anthropic — Claude Opus 5
• Reuters — U.S.–China dispute over Moonshot AI and Kimi K3
• White House — America's AI Action Plan
• Hugging Face — Security Incident Disclosure
• OpenAI — Hugging Face Model-Evaluation Security Incident
• NVIDIA — Open Secure AI Alliance
• Anthropic — Our Position on Open-Weight Models
• OpenAI — gpt-oss Weights
• Google — Gemma
• Epoch AI — Large-scale AI Models Dataset
• Microsoft — Open Weights and American AI Leadership
• Washington Post — OpenAI and Anthropic endorse a call to pace AI progress
• CNN — AI employees ask the US to be ready to slow AI development
• Fortune — More than 1,200 AI workers are asking for Washington's help
• AI Futures Project — AI 2027
• AI 2040 — Plan A
• AI 2040 — About