On August 14 the Chinese lab Z.ai announced GLM-5.3, and alongside the model it announced something worth more attention than the model. In its release notes the company reports a jump in offensive security capability it had not planned for: more post-training compute aimed at code and agentic work produced, as a side effect, a marked improvement in vulnerability discovery and exploit reasoning. The claimed numbers are 84.5% on CyberGym, where the model receives source code and has to find and validate a vulnerability by triggering it, and an ExploitBench score that went from 24.4% to 54.4%. Working with Chinese security teams, the company says, its models identified 2,436 vulnerabilities across 269 open source projects, 1,097 of them critical or high severity, the oldest introduced in 1981. One was found in Cursor, and disclosed privately.
These are vendor claims, and should be read as such: nobody has reproduced them independently yet. But next to the numbers sits a fact that does not depend on benchmarks, and that is the shape of the release. The most sensitive offensive functions stay behind a verified-access program. The weights do not ship with the announcement: they ship, the company says, about two weeks later, once a safety evaluation is complete. The vulnerabilities found go into a public ledger where, at announcement time, 53 were disclosed and 2,383 still under embargo, with the option of publishing the cryptographic hash of a finding still in coordinated disclosure, so it can be verified later without revealing operational detail now.
Whatever you think of Z.ai, and whatever the benchmarks turn out to be worth once someone reproduces them, this is the first significant open-weight release in which openness is not a switch but a calendar. It is a good moment to admit that the word we use to argue about all of this has stopped working.
The Intuition That Held for Thirty Years
The case for openness deserves to be stated at full strength rather than in caricature, because it is the one you have to work against.
For thirty years we have attached open source to an intuition that is moral before it is technical. If code can be inspected, modified, copied and redistributed, power moves from the producer to the community. The user can verify what they are running, the company can escape lock-in, the state can reduce strategic dependencies, the researcher can check the vendor’s claims instead of believing them. In Europe the idea has entered the official vocabulary of digital sovereignty: on June 3, 2026, inside the technological sovereignty package, the Commission presented a standalone open source strategy for the first time, treating open software not as a procurement option or a savings line but as European digital infrastructure, with procurement guidance for open standards, support for public administrations’ open source programme offices, and priority on semiconductors, operating systems, cloud, artificial intelligence and cybersecurity.
Out of this comes the objection to any restriction on open-weight models, and it is a serious objection. If we accept that the most capable models stay closed because they are potentially dangerous, we hand an enormous amount of cognitive power to a handful of American and perhaps Chinese companies. Those companies will decide who gets access to which capabilities, through which filters, at which price, from which countries, for which purposes. They can unilaterally change terms of service, withdraw a model somebody built a product on, restrict permitted applications, watch what their customers do. For a European company that means economic dependency. For a public administration it can mean strategic dependency. For research it means being unable to fully verify the system under study, which amounts to asking the scientific community to work on objects it is not allowed to open.
In cybersecurity the objection gets stronger still. The same capabilities that let an attacker find a vulnerability let a defender find it first, generate tests, analyse legacy code nobody has maintained in a decade, hunt for exploit chains in their own infrastructure, read logs and automate remediation. Restricting offensive tools inevitably restricts some part of defensive capability, and the defender is almost always the one with the smaller budget. It is no accident that NIST, in its AI 800-1 guidance on managing misuse risk for dual-use foundation models, treats these technologies as exactly what they are, dual-use, and not as weapons by definition: the task is managing risk across the whole lifecycle, from pre-development assessment to post-deployment monitoring, not presuming that the capability itself is illegitimate.
Then comes the argument that is hardest to dismiss, and it is geopolitical. A heavily restrictive Western policy on open weights might not reduce global proliferation at all. It might simply guarantee that the most capable open models get built somewhere else, under other rules, with other release criteria. GLM-5.3 makes that hypothesis less theoretical than it was six months ago.
So the thesis cannot be “offensive models must be closed.” That would be too easy, probably ineffective, and above all it would betray some of the best reasons open source matters.
What We Distribute When We Distribute Weights
The trouble starts when you notice that we are transferring the political vocabulary of open source software, uncorrected, to a technological object of a different nature.
An open source web server and an open-weight model share one property, the one that persuaded us to use the same word: I can obtain a copy and use it independently of the producer. But what gets distributed is not the same thing.
Traditional software distributes, primarily, a set of instructions. To obtain a significant new capability I have to understand them, change them, or add to them. The nginx source does not implicitly contain thousands of offensive programs that surface when I ask for them. Its openness makes available what is written in the repository and nothing else: not a latent space of behaviours that the producer itself can only learn about empirically, by measuring.
A foundation model is another object. Weights are learned capability in compressed form. I am not only opening the mechanism by which the system works: I am distributing something that can generate procedures never written explicitly in any source file, and that can be combined with external tools, agent loops, shells, browsers, compilers, scanners. The unplanned jump Z.ai reports is the cheapest possible demonstration of this asymmetry: nobody wrote the ability to chain exploits, it showed up while something else was being optimised, and the company says it discovered it by evaluating its own model. When the producer learns what its object can do by experiment, the word “transparency” means something very different from what it meant for a tarball.
The difference looks technical. What it changes is the entire philosophy of openness.
Three Rights We Treated as One
In classic software the right to inspect and the right to copy are nearly inseparable, not by ideological choice but by material necessity. If I want to let you genuinely verify the program, I have to let you obtain it. And once you have it, stopping you from copying it is both technically hard and politically incoherent. Stallman’s four freedoms hold together partly because in their world there was no way to pull them apart.
With models we can distinguish at least three different rights: the right to know how the model was built, the right to independently evaluate what it can do, the right to own an endlessly modifiable copy of the weights. We have treated them so far as if they were one form of freedom. They are not necessarily, and the first lab to ship the three at three different moments did so on August 14.
Here is the conceptual fracture: the right to inspect does not automatically imply the right to proliferate every capability without limit.
It is a dangerous sentence, because anyone selling opaque proprietary systems can use it tomorrow morning to justify them. Which is why it needs precise borders. It does not mean “security comes before freedom,” a formula that has historically licensed every abuse and that has no place here. It means that we may need to invent, for AI, a grammar of openness more articulated than the one built for the software of the 1980s, and that compressing eight distinct decisions into a single word is not loyalty to an idea. It is laziness.
Knowledge and Capability Are Not the Same Thing
The criterion for drawing lines cannot be “this model is powerful.” That is arbitrary, and in practice it collapses into “this model is recent.” It should be something else: does this capability substantially change the marginal cost of producing a given harm?
Cyber offers an almost ideal case, because it lets us reason in concrete terms rather than in imagined catastrophes.
A model that explains how SQL injection works does not shift the offensive balance by a millimetre: the internet already holds millions of explanations, many of them better. A model that produces a known exploit does not change much either: Metasploit has existed for decades and sits one apt install away. The interesting threshold arrives when a system can take an unfamiliar codebase, autonomously find an undocumented vulnerability, develop a reliable exploit, chain it with privilege escalation, bypass mitigations, and do it again against different targets at near-zero cost. At that point we have not democratised knowledge. We have industrialised a capability.
This distinction is the heart of the matter, and it is older than computing. A recipe for producing a dangerous substance is information. An automatic machine that produces it at industrial scale is capability. The right to access the first, which I defend, does not automatically settle the political question of the second. LLMs blur exactly this boundary, because they turn information into executive capability: once they are wired to tools, the distance between knowing how something is done and doing it shrinks nearly to nothing, and the unit that measures harm stops being the attacker’s skill and becomes the number of machine-hours they can afford.
This is where the traditional open source argument meets a historical limit, not a moral one. The movement was born in a culture where the dominant cost was access to knowledge and tools, and where lowering that cost was almost always emancipatory: whoever could not read the code was simply shut out. With frontier AI we lower the cost of knowledge and the cost of action at the same time. That is not the same operation. Open source exists to distribute the power to understand and modify machines; open-weight AI can end up distributing the power to act through them as well. When the two coincide, the politics of openness faces responsibilities that free software could afford to treat as peripheral.
Irreversibility, and Who Benefits From Reminding Us
On July 27, 2026, Anthropic published a position under Dario Amodei’s byline that opens with a denial: the company has never called for a ban on open-weight models. It landed three days after a letter titled Open Weights and American AI Leadership, signed by 77 companies, foundations, funds and research groups, which defended open weights and gestured clearly at who was supposedly threatening them. Anthropic’s proposal is to keep lower-risk open models accessible and concentrate the constraints elsewhere: chip controls toward authoritarian regimes, a brake on industrial-scale distillation, mandatory safety testing for all sufficiently capable models, open and closed alike.
The central argument is irreversibility. Once weights are published, safeguards can be removed, copies can be redistributed or run privately outside any monitoring, and no subsequent intervention on the model is possible. It is a self-interested claim, coming from a company that sells proprietary access to its own models, and it needs to be steelmanned and suspected in the same breath.
Steelman it with the numbers, which exist. Removing safety fine-tuning from Llama 3 8B takes about five minutes on a single A100, for under half a dollar at most cloud providers, and about 45 minutes on the 70-billion-parameter model, for under $2.50; the same procedure runs on a free Colab in half an hour at no cost. With LoRA and under $200, the refusal rate of Llama 2-Chat 70B went from 78.9% to 0.4%, that is from 618 refusals out of 783 questions to 3. And the curve matters more than any single value: the GPU hours needed to dismantle safety training went from hundreds in 2022 to tens in 2023 to minutes in 2024. Publishing weights does not publish the model with its controls. It publishes the model, and the controls stay behind as an intention.
Now suspect it. That the risk is real does not make the economic incentive to present it as an argument for the centralised API any less real, and the same company asking for mandatory testing for everyone is the one that would sell more inference if its open competitors disappeared. Both things are true at once. Which is exactly why “Meta is right, Anthropic is wrong,” or the reverse, is a sterile debate: these are two market positions dressed as philosophies, and arguing them as philosophies costs us the only question that matters.
The Question That Matters
Which properties of open source do we want to preserve?
If the answer is “the ability to run anything at all with no external interference,” then fully open weights are irreplaceable and there is nothing more to say.
If the answer is sovereignty, it gets subtler, because sovereignty does not mean owning everything without restriction. It means not depending on another party’s arbitrary will, which is a different thing. A model reachable only through a single American API is an obvious dependency. But a European ecosystem that downloads a foreign model’s weights and stops there is not sovereign either: without compute, skills, datasets, fine-tuning, evaluation and maintenance capacity, it has only changed which party it depends on, and picked one that owes it nothing. Open weights are a component of sovereignty, not sovereignty. It is the same thing I wrote in June about cloud: sovereignty doesn’t live in the data center, and it does not live in a folder of parameters on a disk either.
Europe Has Already Written This Twice
There is a detail the European debate tends to skip, and it is that Europe has already put this distinction in writing, in two different laws, almost without noticing.
The first time is the AI Act. Article 53 frees providers of GPAI models released under a free and open licence from part of their obligations: the technical documentation, the documentation owed to downstream providers, the appointment of an authorised representative for providers established outside the Union. It does not free them from the copyright compliance policy or from the sufficiently detailed summary of training data. And above all the exemption does not apply to models classified as GPAI with systemic risk, which remain subject to the evaluation and mitigation duties of Article 55, with the presumption attached to the 10^25 FLOP threshold and notification to the AI Office within two weeks. The Commission’s guidelines of July 18, 2025 added the missing piece: the open source exception only holds if the licence genuinely allows access, use, modification and redistribution of the model, weights included, and if the model is publicly available. Calling yourself open is not enough.
The second time is the Cyber Resilience Act, and it passes even more quietly. Article 24 creates the figure of the open-source software steward and gives it a lighter regime: no CE marking, no formal conformity assessment, no mandatory retention of technical documentation. But it does not give it an exemption. The steward must put in place a cybersecurity policy documented in a verifiable manner, cooperate with market surveillance authorities, report actively exploited vulnerabilities and severe incidents. Article 64(10) spares it administrative fines, and that is the point where the legislator explicitly acknowledges that a volunteer maintainer cannot be treated as a manufacturer. It is a gradation, not an amnesty.
Two laws, the same implicit sentence: openness modulates the regime, it does not cancel the risk. It is a philosophically better distinction than the AI Act usually gets credit for, because the regime does not look only at the licence. It looks at capability and effects.
A Ladder, Not a Switch
From here you arrive at the part nobody has written in full: a taxonomy of openness that stops being binary.
Picture a ladder. On the first rung, full scientific transparency, meaning a paper that actually describes how the model was built. On the second, access to the dataset and the methodology, which is not the same as describing them. On the third, access for independent audit, meaning the ability of a qualified third party to measure the model without asking permission each time. On the fourth, access to the weights under an identity-verification regime, which is precisely what Z.ai applied to its offensive functions. On the fifth, redistributable weights. On the sixth, the right to fine-tune. On the seventh, the right to remove safeguards. On the eighth, fully irreversible release, which is the sum of all the others plus the impossibility of going back.
These are different decisions, with different beneficiaries and different risks. A researcher who wants to check a vendor’s claims needs the second and third rungs, and almost never the seventh. A public administration reducing strategic dependency needs the fifth and sixth, and not necessarily the eighth. A startup building a product needs to know the model will not be pulled out from under it, which is a question of licence and duration more than of capability. The current cultural error is compressing all eight rungs into the word “open,” and then arguing as if there were a single lever to raise or lower.
A Freely Redistributable Opacity
Out of that compression comes a second confusion, almost linguistic, which by now forces even the general press to run corrections. A great many models described as open source are in fact open-weight: you can download the parameters, but you do not know the dataset, the full training pipeline, the filtering, the annotation procedures, the conditions of production. The Open Source Initiative tried to impose order with the Open Source AI Definition 1.0, which asks together for the weights, the complete code to train and run the system, and information about the data detailed enough that a skilled person could build a substantially equivalent one. It is a compromise, because it does not demand the dataset itself, and the Free Software Foundation and the Software Freedom Conservancy objected on exactly that ground: without the exact data, the freedom to modify is nominal.
The paradoxical result is that we can have models that are very open in their ability to proliferate and much less open in their ability to be understood. It is almost the inverse of free software’s founding ideal. You can copy the object perfectly, and never reconstruct how it came to be. A freely redistributable opacity.
And it is worth remembering that openness, even in classic software, never coincided with verification. Heartbleed showed in 2014 that a library half the internet rested on was maintained by two people on roughly $2,000 a year in donations. XZ Utils showed in 2024 that a patient campaign of nearly three years, with eight malicious commits inside a long list of legitimate contributions and coordinated pressure from sockpuppet accounts on an exhausted maintainer, could come within a step of compromising every SSH server in the world. “Many eyes” was always a claim about possibility, never about practice. I already wrote this looking at June’s ten thousand cloned repositories: open means inspectable, not inspected. It holds identically for weights, with one aggravating factor: inspecting a model is vastly more expensive than reading a diff, and the people in the world capable of doing it seriously number in the hundreds.
The Precedent We Already Invented
There is already an institution in our culture that solves a problem of exactly this shape, and we in security built it.
Take a zero-day. We are normally in favour of disclosure, because public knowledge forces the vendor to fix, lets users defend themselves, and creates collective knowledge. And yet almost no serious security community holds that the moral maximum consists in immediately publishing a working exploit chain against critical infrastructure before a patch exists. Responsible disclosure introduces time, context, coordination and gradation without denying the fundamental value of openness. Nobody ever considered it a betrayal of transparency. The opposite: it is transparency that learned how to handle itself.
Perhaps the future of open AI will look less like the simultaneous publication of a repository and more like coordinated disclosure: maximum openness as the underlying goal, but the option of differentiating timing and modality when specific capabilities cross concretely measurable thresholds. Which is, read back now, exactly the calendar of August 14. Two weeks of delay on the weights, verified access on the most sensitive functions, a ledger holding hashes of findings still under embargo. I am not saying Z.ai found the right formula, nor that its motives are the ones it states, and a verified-access regime administered by a company subject to a non-European legal order raises problems entirely of its own. I am saying the shape has already been invented, and that it is ours.
Who May Do What
At this point the regulatory question can be posed usefully. Not “how do we stop bad people from having powerful models,” which is unrealistic and leads straight to surveillance and centralised control, that is, to losing precisely what we set out to protect. But: which distribution of technological power simultaneously maximises autonomy, verifiability, defensive capability and accountability?
These values do not coincide. Transparency maximises verifiability. Open weights maximise replicability. Local execution maximises autonomy. Gating can increase accountability, because it creates somebody to hold to account. Centralisation permits revocation and monitoring, which is why it is dangerous. Decentralisation reduces lock-in and monopoly abuse, which is why it is precious. There is no point that maximises everything, and claiming otherwise is propaganda no matter which side it comes from. This is exactly the kind of problem where good regulation should not look for a universal truth but build explicit local trade-offs, declared as such.
Which leads to the more radical thesis, stated in full: “open source” should no longer be a binary property attributed to the model, but an architecture of rights around the model. Who may inspect it. Who may evaluate it. Who may run it. Who may modify it. Who may redistribute it. Who may remove its controls. Who may connect it to tools capable of acting in the world. Who carries responsibility when those capabilities are used. These questions are infinitely more useful than “is it open?”, and they have the virtue of all being writable into a contract, a licence or a law, which is the job we actually do.
Cyber forces us to understand this before other domains because it makes visible what stays abstract elsewhere: it can be measured, counted, reproduced. But a biomedical model capable of proposing a dangerous molecule raises the same problem. A system that optimises drone design raises it. An agent operating autonomously in markets raises it. Cyber is simply the laboratory where the tension becomes obvious first, and therefore the place where it is best to make our mistakes now, while they can still be counted in CVEs.
The Battle Ahead
The problem is not that open source stopped being a value. The opposite: it became so important that we can no longer afford to use it as a slogan.
For thirty years we defended openness because it prevented anyone from owning technological power unilaterally, and that intuition holds word for word. But when the open object is no longer just a tool I can study, and becomes a general-purpose machine capable of turning knowledge into action, the freedom to inspect it and the freedom to multiply every one of its capabilities without limit stop being automatically the same right. Recognising this is not surrendering to the proprietary enclosure. It is the only way to defend European open source without turning it into a dogma unable to admit that some technological objects changed nature in our hands while we went on calling them by the same name.
The next battle will not be about whether to open or close artificial intelligence. It will be about which forms of openness genuinely preserve the distribution of power, without turning the distribution of power into the irresponsible distribution of the capacity to harm. And the landing point is political, not technical: sovereignty is not being able to do anything you like with a technology. It is not being forced to ask someone else’s permission to understand, govern and decide what that technology may do in our society.
On August 14 a lab sent this question to everyone, in the form of a calendar. In two weeks the weights will be online, and the part that counts will not be how good the model is. It will be whether we have a vocabulary for saying what we have just received.
Key takeaways
On August 14 Z.ai announced GLM-5.3 with a claimed jump in cyber capability, 84.5% on CyberGym and ExploitBench more than doubled, keeping offensive functions behind a verified-access program and holding the weights for about two weeks pending a safety evaluation. The benchmarks are vendor claims, but the shape of the release is a fact: graduated openness, not a switch.
In classic software the right to inspect and the right to copy are inseparable. With models they split into at least three distinct rights: knowing how it was built, independently evaluating what it can do, owning an endlessly modifiable copy of the weights. We have treated them as one freedom. They are not.
The irreversibility argument is more than self-serving rhetoric: stripping safety fine-tuning from Llama 3 8B takes five minutes on a single A100 and under half a dollar, and a model’s refusal rate drops from 78.9% to 0.4% with LoRA for under $200. The safeguard does not travel with the weights. That this suits companies selling API access is equally true, and it does not make the numbers any less exact.
Europe has already written twice that open is not an exemption. Article 53 of the AI Act frees free-licence models from part of the documentation burden but not from Article 55 once systemic risk applies, and Article 24 of the CRA gives open-source stewards a lighter regime, not the absence of obligations. It looks at capability and effects, not only at the licence.
The useful question is not “is it open?” but who may inspect it, evaluate it, run it, modify it, redistribute it, strip its controls, wire it to tools that act, and who answers when they do. Sovereignty is not being able to do anything you like with a technology. It is not having to ask someone else’s permission to understand, govern and decide what that technology may do where you live.
Questions & answers
What separates an open-weight model from open source software?
Open source software distributes instructions: to get a new capability you have to read them, change them or add to them, and the nginx source does not implicitly contain thousands of programs that appear when you ask for them. An open-weight model distributes learned capability in compressed form: the weights can produce procedures nobody ever wrote in any source file, procedures the vendor itself only learns about empirically, by running evaluations. They are two different objects under one word, and the difference matters most once the model is wired to shells, browsers, compilers and scanners.
Would banning the most capable open-weight models reduce proliferation?
Probably not, and that is the most serious reason not to try. A heavily restrictive Western policy risks guaranteeing only that the most capable open models get built elsewhere: GLM-5.3, announced by Z.ai on August 14, 2026 with claimed top-tier vulnerability discovery, makes that less hypothetical. The point is not to prevent the capability from existing, since it is spreading anyway, but to decide which forms of openness actually preserve the distribution of power.
Do safeguards survive in a model whose weights are public?
No, and not because of weak engineering but because of cost. Published research shows that removing safety fine-tuning from Llama 3 8B takes about five minutes on a single A100 for under half a dollar, and about 45 minutes on the 70-billion-parameter model. With LoRA and under $200, the refusal rate of Llama 2-Chat 70B fell from 78.9% to 0.4%. The cost curve went from hundreds of GPU hours in 2022 to minutes in 2024. Whoever publishes weights publishes a model without its controls, whatever they intended.
Does the AI Act exempt open source models from its obligations?
Only partly, and never where systemic risk applies. Article 53 frees providers of GPAI models released under a free and open licence from the technical documentation, from the documentation owed to downstream providers, and from appointing an authorised representative, but not from the copyright policy or the sufficiently detailed summary of training data. And the exemption falls away for models classified as carrying systemic risk, which remain bound by the evaluation and mitigation duties of Article 55. The Commission’s guidelines of July 18, 2025 add that the exception only holds if the licence genuinely allows access, use, modification and redistribution, weights included.
What does digital sovereignty over a model actually mean?
Not owning an unrestricted copy. It means not depending on another party’s arbitrary will, and those are different things. A model reachable only through a single foreign API is an obvious dependency, but a European ecosystem that downloads foreign weights without compute, skills, datasets, fine-tuning and evaluation capacity is not sovereign either: it has merely changed which party it depends on. Open weights are a component of sovereignty, not sovereignty itself.
The author
