Open and Closed Models

On July 24, 2026, an open letter titled Open Weights and American AI Leadership was published — Nvidia CEO Jensen Huang’s first post on X. It launched with 25 signatories and grew past 270 within weeks, among them Nvidia, Microsoft, Meta, IBM, Dell, Hugging Face, Mistral, Cohere, the Linux Foundation, and later OpenAI and Google. It asks Washington to avoid “premature restrictions” on downloadable models, frames open weights as strategic infrastructure rather than a liability, and makes a safety argument that would have been unusual a year earlier: that closed models are single points of failure and that broad security can depend on many people being able to test and harden the models society relies on. A fair caveat, which critics note: none of the signatories sells access to a closed frontier model, so openness is being urged at the layer where these firms do not compete.

Lambert, in an expanded version of testimony he prepared for Congress, argues open models are becoming the substrate for everyone outside the few frontier labs, that owning open models lets a country coordinate on risk and diffuse AI through its economy, and that restricting access to strong open models — including Chinese ones — would mostly set back the American businesses already relying on them. He also estimates that distillation, training on a stronger model’s outputs, explains only a month or two of China’s progress, not the whole story.

Anthropic is a notable non-signatory. In its position paper, CEO Dario Amodei writes that “we have not and are not advocating for a ban on open-weights models as a category,” and grants that open weights expand access, competition, and customer control. But he disputes the letter’s claim that openness necessarily favors defenders over attackers — pointing to biology, where an attacker can move faster than a defender — and argues instead for three narrower measures: chip-export controls, a crackdown on industrial-scale distillation, and mandatory safety testing of all sufficiently capable models, open or closed. The distillation concern is concrete for Anthropic: it has alleged that operators tied to Alibaba’s Qwen ran a large-scale campaign to extract training signal from Claude — a claim Alibaba’s side contests, and one the pro-open camp argues is a separate problem from openness itself.

The most institution-neutral anchors sit outside the industry entirely. In 2024 the US Commerce Department’s NTIA studied exactly this question and applied a “marginal risk” analysis — weighing the specific added risk of open weights rather than the general risks of AI. It concluded that current evidence did not warrant restricting open model weights at that time, recommended active monitoring for emerging risks, and explicitly preserved the option to restrict certain classes of weights later: monitor now, decide later, on evidence. That marginal-risk lens comes from independent scholarship — a widely cited 2024 paper led by researchers at Princeton and Stanford, which surveyed the main misuse vectors (cyber, bio, disinformation) and found that existing research was, in most cases, insufficient to establish how much additional risk open models create beyond tools already available. Its lasting contribution was diagnosing why the fight is so heated: the two sides are often analyzing different pieces of the same problem.

Some of the sharpest disagreement is empirical. When a major platform investigated an AI-driven intrusion in 2026, it reported running its forensic response on an open Chinese model because closed models refused the defensive work — a case the pro-open side cites as open weights aiding defenders. The cautious side reads the same terrain differently, emphasizing domains where the attacker’s advantage is structural. Both are looking at real events and drawing opposite lessons.