Open vs. Closed Models

Geopolitically speaking, there is growing consternation around open-weight versus closed-weight AI models. While American frontier labs today are winning the global AI race based on the latest benchmarks, the race is tightening with a business model that is wildly different between the American and Chinese behemoths.

According to EpochAI’s Capability Index, Chinese AI models have historically lagged the US frontier capabilities by 7 months, on average, over the past 3 years.

With the recent release of Moonshot AI’s Kimi K3, that gap is now estimated to be closer to three months.

On July 16, 2026, Moonshot AI, a leading Chinese AI lab, launched Kimi K3, a 2.8T parameter mixture-of-experts (MoE) model awarding a #3 spot on the Artificial Analysis’s Intelligence Index, behind only Claude Fable 5 and GPT-5.6 Sol.

While the American frontier models are still setting the pace, they are doing so with closed-weight, proprietary models - even though American technology companies compete in both categories. The Chinese labs have distributed their models almost entirely as open-weight.

According to Stanford’s HAI 2026 Index, “the performance gap between leading closed-weight and open-weight models have fluctuated over the past three years, with open-weight systems closing in and then falling behind as new proprietary models are released. While closed-weight models still lead, open-weight models are far more competitive than they were a few years ago.

The United States’ substantial lead in 2023 shrank considerably by early 2025, and the performance gap has remained narrow since then. Over the past year, the gap has fluctuated between near parity and low single digits. This convergence is particularly notable because it has emerged from two distinct development environments and institutional contexts.”

What happens if the world builds on Chinese open models? That is what podcast pontificators, national security experts, and technologists are asking.

My read is that China is striving for geopolitical dominance. If developers around the world standardize on Chinese open-weight models, the Chinese could gain influence over the foundational layer of the AI ecosystem much like Android became a default foundation that millions of other products were built on.

Build on the Chinese models, they are free!

Free, sorta. The biggest strategic issue isn’t whether the weights are open or closed - it’s who owns the surrounding ecosystem (OS, cloud platform, databases, networking, APIs, applications, models, etc.). Anthropic, OpenAI, Google, and others are increasingly selling an entire platform, not just a model.

If developers around the world build around a Chinese model family, they may adopt its surrounding tooling, integrations, fine-tuning methods, benchmarks, and workflows. Those switching costs can become significant over time. Technical debt is real.

That said, many enterprises deploy Chinese open-weight models on American cloud infrastructure or their own hardware - rather than paying API or cloud fees to the Chinese.

It’s important to note, though, that using open-weight models doesn’t necessarily mean inference runs on Chinese infrastructure. Inference is running a trained AI model to generate an output for a live query. It's the "using" side of AI, distinct from training, which is the "building" side.

For example, you could download K3 or GLM-5.2’s weights and run it on your own servers/GPUs specifically (on-prem or cloud) so the code and prompts never transit to China during inference.

Unfortunately, there are significant risks here too.

In May 2026, my former employer Booz Allen, ran 2,800 trials against one American and four Chinese coding models commonly used by US developers.

Their testing resulted in two core findings:

1. “Chinese LLMs produce more vulnerable code when prompted with a U.S. government persona than without - and the vulnerabilities are highly obfuscated.”

2. “Chinese LLMs inject PRC-aligned political bias into both the answers and the code they generate.”

“The threat is not an obvious backdoor in the code. In fact, we do not have proof at this point that code flaws are intentionally introduced. Still, Chinese models produced less secure code in general, and the vulnerabilities increased when the user appeared to be from the U.S. government. Further, Chinese models refused tasks Beijing deems politically sensitive. The potential for such code to become embedded in delivered systems is especially concerning because it could enable threat actors to bypass AI security guardrails and create downstream risks of dangerous inference behaviors. Traditional tools and benchmarks lack the sophistication required to catch this level of tradecraft.”

If the Chinese can distribute open models that slow the market penetration of the leading global frontier labs (e.g., OpenAI and Anthropic), and therefore slow the broader American economy lifted by AI, they probably will try. US export controls have limited the number of NVIDIA chips sent to China even though the Chinese are actively training and distributing Chinese models on their own chips (e.g., Huawei) anyway.

In a WSJ opinion last week, Holman Jenkins Jr wrote “the big concern should be open-weight AI models from China, distributed free or cheaply, which can be modified by the user beyond the purview or control of the creator. These Chinese models are catching up quick. They’ll soon be creating such incidents if they aren’t already, and will be harder to catch or stop.”

“U.S. national-security concerns aren’t going to be a big factor for private users deciding whether to use Chinese AI models. Fears of data piracy and legal liability are rational dissuaders.”

In a blog post from Anthropic CEO Dario Amodei last week (July 27, 2026), he wrote “reports suggest that some US officials are considering banning the use of Chinese open-weights models by US companies. In response, many tech companies have signed a letter supporting open-weights models, and some people have even accused Anthropic of wanting to ban open-weights models as a means of protecting our business…Anthropic has never advocated for a ban on open-weights models. Open-weights models that don’t have dangerous capabilities are a public good: they don’t cost anything besides the compute needed to run them, and they provide value to businesses, developers, and researchers.”

What This Means for Your Organization

Business leaders are asking themselves these same questions, though for perhaps a more complex set of business reasons.

What is your tolerance for building dependency on infrastructure whose long-term governance sits outside the US jurisdiction? That applies to capability you build - as well as tools you license, buy, or invest in.

While some may opt for a hybrid approach using both American and Chinese models, others choose to build exclusively on American models. When the latter is in play, the choice becomes American closed (frontier) versus American open-weight currently trailing the leading Chinese open-weight models. What happens if you build or buy on an American closed model and the US government issues a directive to suspend access, such as what happened with Anthropic’s Mythos model last month?

Note - On June 12, 2026, the US Dept of Commerce issued an export control directive to restrict access for foreign nationals to the Anthropic Mythos 5 and Fable 5 models (including Anthropic employees) due to jailbreak and bypass concerns. Because there was not an immediate way for Anthropic to verify user nationality in real time, they disabled the models for all users globally to ensure compliance. This directive has since been lifted after the government’s concerns were assuaged.

Time will tell if the American open-weight models leapfrog the Chinese, even at the risk of cannibalizing the current financial incentives in the market (looking at you Mira Murati and the Thinking Machines Lab).

To make better sense of the above, I thought it would be helpful to define open and closed models and talk through some of the business constraints for each.

At the most basic level, open models are a publicly downloadable package of software. When you download an open model (in the same way you would think about downloading a book, movie, or song), you get the trained model file and can run it on your own hardware.

While many refer to open models as open-source models, it is more technically accurate to call them open-weight models.

Open-weight models are algorithms, trained on data, using compute power. After that training process, the model develops a set of weights, otherwise known as parameters.

Open-weight means you can access and modify those weights. They are fully accessible to locally deploy, customize, fine-tune, run independently, and even redistribute under a stated license. They come with lower inference costs and infrastructure flexibility, at least above a threshold. They are ideal for organizations wanting control and cost efficiency provided there is existing infrastructure and engineering talent. Unfortunately, like their closed siblings, the training data and methodology are usually undisclosed, and many licenses carry commercial use restrictions or require attribution.

Meta’s Llama class of models, Google’s Gemma models, NVIDIA’s Nemotron models, Alibaba’s Qwen models, Moonshot AI’s Kimi models, and DeepSeek’s models are open-weight.

There are very few truly open-source models where the parameters (weights), code, and data are open, and they are accompanied by an unrestricted license.

In contrast, closed models are proprietary and highly optimized. The weights are not released. There is limited customization due to lack of code access. The models inside products like ChatGPT, Claude, and Gemini are closed.

You can access closed models inside a hosted product license (free, pro, enterprise, etc.) or you can access the models with an API call in your own dev environment. The vendor controls inference, RAG, fine-tuning, rate limits, and pricing.

For example, OpenAI lets you fine-tune the models through the public API, but you cannot deploy these models locally or look at the weights.

For organizations considering their options, it’s important to consider business and technical considerations across capability, governance, cost, and convenience.

From a capability perspective, while American open-weight models trail in capability on coding and reasoning to their closed-weight American cousins, Meta, NVIDIA, Google, and other labs are continuing to make fast progress.

Secondly, governance comes down to the risk you manage yourself (open) versus risk you outsource to a vendor (closed). Do you want to bet on your own team’s ability to host, secure, patch, and keep pace with model capabilities? According to the leading nonprofit research institution METR, frontier models have been doubling in capability every 7 months for the last 6 years.

With a closed model, your vendor carries responsibility for model behavior, safety testing, red-teaming, incident response, SOC 2 compliance, HIPAA or PII configs, data retention agreements, and safety evaluations - the latter being especially relevant for regulated industries. If the model produces harmful, biased, or non-compliant output, you have a vendor agreement with contractual obligations, SLAs, and indemnification clauses. With the premium you pay, closed models push updates regularly for jailbreak patches, guardrail improvements, etc.

If you are regulated, it can often be simpler to say we use vendor X, who maintains Y certification, with Z safety practices - than to say - we self-host a modified version of an open-weight model with our own internal safety layer. When the model is open and in production, you assume substantially more operational responsibility for security, compliance, and model behavior.

Thirdly, on cost, closed models are an OpEx decision with pay-per-token on inference. They have a low upfront cost, can scale with usage, but can be unpredictable at scale with potential for very high costs at volume. Alternatively, open-weight models are a CapEx decision. While the marginal cost per query can drop at high volume, are you planning to pay for infrastructure, hosting, and AI engineering talent? Self-hosting moves the cost from tokens → GPUs and engineering.

There is, of course, nuance here. There are serverless open-weight inference options that can be OpEx. For example, Microsoft Azure AI Foundry provides access to DeepSeek, Moonshot AI Kimi and Qwen for the model catalog that Microsoft maintains.

Another vendor, fireworks.ai, lets you run open-weight models with token pricing (and without all the infrastructure setup) in much as the same way as a closed model, and of course for considerably less.

For more on tokens, you can see my token posts here and here.

And then finally speed & convenience. For closed models, you rent the capability and the vendor controls the model behavior and pricing. With open-weight models, your business holds a persistent local copy though your usage still operates within a release license (not outright ownership). Many teams build a multi-model environment with a blend of closed and open to mitigate risk and control costs.

To wrap, here are some key business and technical questions you can ask your organization as you think through the open vs closed debate.

Key Business Questions for Open vs Closed Models:

• What’s the available budget (e.g., labor, maintenance, operations)?

• What licensing models are available? What are their terms?

• What is your existing tech stack (e.g., AWS, Azure, on-prem)?

• Are there data sensitivity concerns (e.g., PII, PHI, public data)?

• What’s the IT cost breakdown (e.g., hardware, software, labor, licenses)?

• What's your exposure to vendor-country regulatory action (e.g., export controls, data sovereignty rules)?

A Guide to Closed Models:

• If your task benefits from absolute frontier on reasoning and can absorb premium pricing for it.

• You lack in-house ML/infra talent and need to deploy without building hosting infrastructure.

• You need vendor accountability, SLAs, and built-in compliance infrastructure (SOC 2, HIPAA-eligible configs).

• You rely on mature agentic tooling and enterprise-grade integrations.

• You need to operate within a single, well-understood domestic regulatory framework.

A Guide to Open Models:

• You require on-premise or self-hosted deployment for data sensitivity or sovereignty.

• You need deep fine-tuning or architectural control that some closed vendors don’t offer.

• You’re running high-volume, sustained workloads where self-hosting economics beat per-token API pricing.

• You want to avoid vendor lock-in, long-term agreements, or a single vendor’s regulatory exposure.

• You want control over model behavior and safety tuning rather than a vendor’s default alignment.

• You’re building on the fastest-growing part of the open ecosystem where tooling and community support are concentrating.

A big thank you to Mark Collier, CEO of Neural Energy, for his expertise and contributions to the piece.