Everyone Loves Open Source Now

On Friday, July 24, Jensen Huang made the first post of his life on X. Huang has had an account for years and never used it, which is its own kind of statement, and when he finally broke the seal he did it to share a three-page letter called Open Weights and American AI Leadership. The letter was hosted on Nvidia’s servers, mirrored on Microsoft’s corporate responsibility page, and signed by 25 companies. It asks Washington not to impose “premature restrictions” on downloadable AI models. It draws an analogy to the open-source software movement of the 1980s. It is, as these things go, a perfectly reasonable document.

The signatories were Nvidia, Microsoft, Meta, IBM, Dell, Palantir, Mistral, Hugging Face, Mozilla, the Linux Foundation, Andreessen Horowitz, Y Combinator, CrowdStrike, Replit, and assorted others. Notably absent were OpenAI, Google and Anthropic, which is to say the three companies on earth that sell access to a frontier model you cannot download.

Now, one reading of this is that a broad coalition of American technology firms has arrived independently at a shared principled conviction about the epistemics of AI safety. Another reading is that every company that makes money when weights are free signed a letter saying weights should be free, and every company that makes money when weights are not free did not sign it. I want to be fair to everyone here so I will note that these readings are not mutually exclusive, and also that the second one is correct.

Nvidia sells the chips you run open models on, and a world in which every mid-sized enterprise fine-tunes its own checkpoint is a world that buys an enormous number of GPUs. Meta and Mistral publish open weights because that is their competitive strategy against labs whose frontier models they cannot beat. Hugging Face distributes them. Dell and IBM sell you the racks. The venture firms fund the startups that cannot afford anyone’s API bill. This does not make the letter wrong! Open-source history is genuinely on its side. It just means the letter is an industry position paper written by an industry, which is the only kind of industry position paper there is.

Anyway, by Monday the letter had 50 signatures. OpenAI signed. Google signed. SpaceX signed. AMD, Cisco, Cloudflare, GitHub, Block and Ollama signed. Amazon did not sign, but nobody wrote about Amazon, because the story had found its main character. Anthropic did not sign, and Anthropic said nothing at all, for four days, while the internet decided what its silence meant.

The silence

David Sacks, venture capitalist and until March the Trump administration’s AI and crypto czar, decided what it meant fairly quickly. “The entire tech industry (save for Anthropic) has come out in favor of open source AI,” he posted. “They won’t stop until they kneecap open source. The rest of the industry needs to watch these guys like a hawk.”

Bill Gurley of Benchmark made the same point with less percussion, saying that open weights compete with Anthropic’s corporate economic strategy, which they do. Peter Steinberger, the OpenClaw founder who now works at OpenAI, noted that OpenAI had signed and Anthropic had not, which is the sort of thing you post when your employer has just won a news cycle for free.

The accusation crystallizing here is specific and worth stating plainly, because it is the whole story: that Anthropic wants the US government to ban Chinese open-weights models, and is dressing up a competitive moat as a national security concern. It is a good accusation. It is legible, it is cynical in a way that feels sophisticated, and the timing is genuinely terrible for Anthropic, for reasons I will get to.

On Monday afternoon, Dario Amodei published a post responding to it. The load-bearing sentence, bolded in the original: Anthropic has never advocated for a ban on open-weights models.

Anthropic has never advocated for a ban on open-weights models, source: Anthropic

What he actually said

The structure of Amodei’s argument is unusual, in that he spends a good deal of it explaining why the policy he is accused of wanting would not work.

He names two worries. Worry one, his stated primary: authoritarian governments, most capably China, build models more powerful than America’s and use them for permanent military advantage or extremely thorough domestic repression. Worry two: powerful models get used for cyberattacks or biological attacks, or turn out to be misaligned.

Then he asks what a ban on US companies using Chinese open models would do about either. Against worry one: nothing, because the model you should actually be frightened of is the one trained in secret and handed to the People’s Liberation Army, which was never going to be downloadable in the first place. Against worry two: nothing, because, and this is the line that does the most work in the entire post, “bad actors are unlikely to be legitimate US businesses.” A ban restricts the people who obey bans.

He then writes the sentence you do not usually get: it would protect US AI companies from competition, but that has never been my goal.

I want to flag what a strange thing that is to publish. The standard move, when accused of protectionism, is to deny that the policy is protectionist. Amodei instead concedes that the policy he is accused of wanting would indeed protect him, and argues that this is why he doesn’t want it, because it would protect him without accomplishing anything else. You can believe him or not. But it is not the sentence a person writes when they are quietly hoping the ban happens.

In place of a ban he wants three things. Keep advanced chips and chipmaking equipment out of China, and prosecute the smuggling that routes around existing controls, on the theory that scaling laws mean China cannot outbuild the US frontier without US silicon. Crack down on industrial-scale distillation, the process by which a competitor pays your API to teach their model to be your model. And mandatory pre-release safety testing on cyber, bio and alignment risk for every sufficiently capable model, open or closed, foreign or domestic, with smaller models from startups and universities exempted.

On the Nvidia letter itself he concedes most of it. Open weights expand access, strengthen competition, give customers control, and models without dangerous capabilities are, in his words, a public good. What he won’t concede is the safety claim, the letter’s assertion that openness makes safeguards easier and helps defenders more than attackers. His counterexample is biology, where he thinks a capable enough model could weaponize a pandemic-class pathogen with widely available materials on a timescale of days, and defending against it is a multi-year operational slog even in the Operation Warp Speed case. He does not claim to have proven this. He claims nobody has tested it, which is true, and that the answer should come from testing rather than from either side asserting it in a letter, which is also true.

The awkward part

So here is why the timing is bad.

On July 16, Moonshot AI released Kimi K3, a 2.8-trillion-parameter mixture-of-experts model that activates 16 of its 896 experts per token, holds a million-token context, costs $3 and $15 per million input and output tokens, and debuted at number one on Arena’s Frontend Code leaderboard, above Claude Fable 5. Weights were dated for July 27. Anthropic is a private company valued at something like $965 billion with reported IPO preparations underway, and a cheap downloadable model trading punches with your flagship is precisely the input that valuation is not built to absorb.

Kimi debuted at #1, Source: Arena

Also, Anthropic has accused Moonshot of getting there by distilling Claude, to the tune of 3.4 million exchanges, a charge White House OSTP director Michael Kratsios repeated on July 22 and that Treasury Secretary Scott Bessent has floated sanctions over. So Anthropic is asking Washington to crack down on the specific mechanism it says its scariest competitor used, eleven days after that competitor shipped. If you are inclined to read this cynically you now have everything you need, and you should probably go ahead and read it cynically for a minute, because it is not a crazy read.

Here is the thing that complicates it. In June, the Commerce Department ordered Anthropic to restrict foreign access to Fable 5 and Mythos 5. Anthropic called the order disproportionate, argued that the underlying capability was already available from other models and specifically named OpenAI’s GPT-5.5, and warned that the precedent could halt new model deployments across every frontier provider. About 100 cybersecurity leaders, including Alex Stamos, Katie Moussouris and Rachel Tobac, signed a letter demanding reversal. Commerce lifted the controls on June 30 and access came back July 1.

The argument Anthropic made in June is that restricting one category of capable model does not remove the capability, it removes it from the people following the rules. That is, word for word in substance, the argument the Nvidia letter made in July, and the argument Amodei made on Monday about Chinese models. A company purely optimizing for regulatory capture does not spend June arguing that its own government shut down the wrong thing for the wrong reasons.

The actual disagreement, which is small

Strip the motive fight out and what is left is a genuinely narrow empirical question: does releasing weights make the world safer or less safe?

The letter says safer. More eyes, more probing, more safeguards, and there is real software-security history behind that. The UK AI Security Institute says the opposite, on the grounds that once weights are out the safeguards can be stripped, the copies redistributed, and the model can never be recalled, ever, by anyone. Both of these are assertions. Neither is a finding.

Amodei’s proposal is to stop asserting and start testing, with the threshold set by capability rather than by license or country of origin. Which is a smaller ask than “ban open source,” is close to what Demis Hassabis has proposed, and has the mildly funny property that the company demanding the testing regime would be the company most frequently subjected to it, since its models sit at the top of exactly the capability distribution it wants tested. Regulatory capture is normally more fun than this.

Anthropic spent four days losing an argument it could have contested on day one, and the position it eventually published is not the position it lost the argument about. In fairness to everyone involved, this happens constantly, and the position that travels is never the one in the document.