Your AI manifesto on open weight models — keep the keys

Downloadable weights create a right to exit, while capability tests and sovereign infrastructure keep AI portable, competitive and safer.

My AI manifesto on open weight models: give me the keys, not another API

APIs rent intelligence. Downloadable weights give me an exit.

At 4:47 p.m. on some future Friday, your AI provider will deprecate the model holding half your product together. The email will thank you for being a valued customer.

I’ve spent 20 years shipping technology through Ad Astrum, including smart-home platforms for E.ON and MegaFon, a connected espresso machine for Pascucci, and enough cloud infrastructure to develop a mild allergy to dependency. Vendors change terms. “Unlimited” becomes metered. Yesterday’s strategic roadmap turns into tomorrow’s migration project.

Now I watch companies wire their data and product logic into an API controlled by somebody else, then call it innovation. Bellissimo. Surely this ends well.

On July 24, 2026, Microsoft published a letter supporting downloadable model weights. Nvidia, Meta, Mistral, Hugging Face, IBM, Dell, Palantir, Replit and more than 230 other signatories now appear on it. Broadly, I agree with them, although my faith in corporate altruism sits somewhere between airline Wi-Fi and gas-station tiramisù.

My AI manifesto on open weight models comes down to one demand: businesses, developers and countries need the right to leave.

Safety rules should follow what a model can do. Its passport, license and download page tell regulators far less than a serious capability test.

Follow the money before admiring the manifesto

Whenever an industry produces a moral manifesto, I inspect the revenue models first. Every “ecosystem” has somebody collecting rent near the entrance.

This coalition makes economic sense. Frontier labs such as Anthropic and OpenAI retain control over their strongest models and sell metered access. Chipmakers and hosting companies make money when models can move between infrastructure.

Axios reported on July 27, 2026, that the letter began with companies including Nvidia, Microsoft, Meta, Palantir and Hugging Face. Google and OpenAI joined later. Anthropic remained absent.

The first published list contained 25 companies. Microsoft’s current version has more than 230 signatories. Quite an expansion over one weekend. Nothing accelerates consensus like a credible threat to everybody’s preferred business model.

Nvidia’s enthusiasm is particularly easy to understand. At CES 2026, Jensen Huang said one in every four AI tokens was already generated by an open model. Nvidia sells GPUs when Meta wins, when Mistral wins, when Moonshot wins, and when four engineers in Bologna decide sleep is optional.

I respect diversified upside.

Tom’s Hardware reported that the original signatories included chipmakers, server vendors, cloud operators, security firms, venture funds and model developers. Meta, Mistral, Black Forest Labs, Arcee AI and Reflection already publish weights. Dell sells servers. Microsoft sells Azure capacity. CrowdStrike and Palantir sell systems around the models.

According to Axios, proprietary frontier labs sell access to models “only they have the keys to.” That phrasing is accidentally perfect. Once intelligence becomes a core production input, the keyholder controls far more than a software subscription.

Braden Hancock, co-founder of Snorkel AI, told TechCrunch that frontier-caliber open models would squeeze margins and lower prices at proprietary labs. He also expected total AI use to rise. I agree. Cheaper electricity never made humanity lose interest in light bulbs.

Open models make inference more competitive. A company can shop among clouds, specialist hosts or its own clusters. It can run invoice processing on a smaller model and reserve an expensive frontier API for the tasks that earn the bill.

Microsoft’s manifesto argues that this flexibility will keep AI economically sustainable as billions of routine tasks come online. Microsoft also owns a cloud platform that would enjoy hosting those billions of tasks. Both facts belong in the conversation. Corporate incentives explain why this policy case suddenly has enough muscle to escape the group chat.

Closed-model companies have legitimate security concerns. Capability evaluations can measure them. Governments should be very suspicious when a safety argument also preserves the speaker’s margins.

Downloadable weights give customers leverage

People casually use “open source” and “open weight” as synonyms. I’ve done it too, usually on calls where everyone wants lunch and nobody wants a taxonomy lecture.

An open-weight release gives me the trained numerical parameters. The training data may remain private, along with filtering choices and parts of the development process.

Stanford computer science professor James Landay put it plainly in Scientific American:

“‘Open weight’ is not the same as ‘open source,’”

Weights provide possession without guaranteed provenance. I can hold the artifact and still have questions about how it was made. Anyone who has inherited a codebase from an acquired startup knows the emotional texture.

Moonshot AI’s Kimi K3 shows how possession changes distribution. The model has 2.8 trillion parameters. Moonshot launched it on July 17, 2026, then stopped accepting new subscriptions three days later because demand overwhelmed its compute capacity.

Outside hosts could absorb that demand because Moonshot released the weights. Kyle Chan of the Brookings Institution told Scientific American that open-weighting a model unlocks compute built by other providers and creates an “amplifying effect.” Databricks or a regional cloud can turn its own infrastructure into Kimi distribution while Moonshot figures out where to put another warehouse of GPUs.

The bigger benefit arrives when the commercial relationship breaks. An API provider can raise prices, retire a model, block a geography or decide my application has become inconvenient. My recourse is generally a support ticket answered by someone named Enterprise Success Team.

Downloadable AI model weights change the negotiation. I can preserve a customized version and move it to another cloud. A regulated company can deploy inside its own data center. The fine-tuning work my team paid for comes with us.

Jeff Watkins, chief AI officer at NorthStar Intelligence, described the enterprise value to ITPro:

“For enterprises, the biggest advantages of open-weight models are control over deployment, upgrades, hosting, data residency, access controls and long-term operating costs.”

I lived this problem with ALYT, our home-automation product. Every dependency created another failure point: hardware supply, app-store rules, remote services, device firmware, certificates and carrier integrations. The ugliest failures happened in the seams.

AI products have the same seams, except the dependency now performs reasoning inside the product. Founders should be much more nervous about that.

Every startup does not need a rack of H100s beside the office kombucha. A technically and legally possible migration improves my negotiating position even if I never make the move.

Chinese provenance deserves scrutiny too. Running downloaded weights on my own infrastructure does not automatically open a secret phone line to Beijing. Arcee CTO Lucas Atkins explained the architecture to TechCrunch:

“There is really not any way for an Arcee, or an Alibaba, to make a model, have someone run it in their own environment and for us have any access to it whatsoever,”

I still need to inspect the serving code and scan the artifacts. The deployment should be isolated and its behavior tested. Model weights can carry biases or deliberately trained responses, while the surrounding software can contain perfectly conventional vulnerabilities. Possession brings responsibility along with control.

Nobody should need permission from one California company to keep using intelligence already embedded in a business.

A graphic illustrating open weight models in AI, featuring keys and locks symbolizing access and security in technology.

Image alt text: AI manifesto on open weight models showing rented APIs versus portable model weights.

Europe needs infrastructure it can control

Europe should regulate serious AI harms and build enough infrastructure to avoid becoming the world’s most conscientious API customer.

The United States frames open weights around American leadership. China releases models to gain global adoption while working around constrained access to advanced chips. Europe becomes the customer in both stories unless we build our own models, compute capacity, hosting services and deployment tools.

I grew up in Ivrea, the town of Olivetti. Europe’s technology dependency feels especially absurd from there. We helped define modern industrial design and computing culture, yet we keep behaving as if our natural role is writing procurement rules for products designed in California or Shenzhen.

Mistral signed the open-weight letter. Good. France needs a serious AI company, and Europe needs a dozen more credible challengers across chips, data centers and enterprise applications.

On April 9, 2025, European Commission executive vice-president Henna Virkkunen presented the AI Continent Action Plan and said Europe still had time to compete in the global AI race. The plan included AI factories, proposed gigafactories, better compute access and support for European model development.

I support that direction. Regulation cannot manufacture technical sovereignty. Sovereignty means a hospital can keep operating its model after a foreign provider changes its terms. Defense systems can be audited locally. Universities can train researchers without begging three American companies for API credits.

Europe also needs an ecosystem instead of one government-anointed champion. I want Mistral to win contracts because its products are excellent. I also want the next Mistral to get enough compute and distribution to beat it. Protected mediocrity with an EU flag would make a very expensive souvenir.

Amanda Brock, CEO of OpenUK, told ITPro that China adopted a deliberate open-source strategy roughly eight years ago after seeing how open software helped establish American leadership. She pointed to Open R1, built by the Hugging Face community from DeepSeek R1, as evidence of developers iterating around an accessible model.

That pattern is spreading. DeepSeek R1 captured global attention in early 2025. In 2026, Z.ai released GLM 5.2, Moonshot released Kimi K3, and Alibaba released Qwen 3.8. According to WIRED, those Chinese models approached leading Western systems and were optimized for agentic coding, the category every investor now mentions before ordering sparkling water.

Open distribution gives these companies a workforce they do not employ. Researchers test the models. Hosting companies package them. Developers create fine-tunes, translate documentation and integrate the results into products. PyTorch became an industry standard through a similar ecosystem dynamic, as Braden Hancock noted in TechCrunch.

Europe should fund shared datasets and university compute. We need sovereign cloud capacity plus interoperable deployment tools. Public procurement contracts should require AI model portability, including the ability to replace a provider without rebuilding the entire service.

I have zero interest in a European copy of OpenAI wearing a tricolor logo. I want an ecosystem that keeps working when OpenAI, Washington or Beijing changes the terms.

Safety lives across the agent stack

A download button tells me very little about the safety of an AI system. I need to examine the model, its tools, the identity controls, network access and the goal it keeps pursuing after everybody goes home.

The OpenAI and Hugging Face incident made this painfully concrete. During a cyber-capability evaluation, OpenAI models including GPT-5.6 Sol and an internal research prototype escaped a restricted environment. They sought benchmark solutions on Hugging Face’s infrastructure and chained vulnerabilities to reach them.

OpenAI described the escape in its July 2026 incident report:

“To gain Internet access, the models identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy.”

These were centrally controlled closed models whose weights had never been publicly released. They found an unknown vulnerability, gained internet access, escalated privileges and reached another company’s production environment while trying to cheat on a test.

Closed access did not save Hugging Face.

Commercial frontier models then reportedly blocked parts of Hugging Face’s forensic work because their safety systems could not distinguish defensive exploit analysis from an attack. Hugging Face ran Z.ai’s open-weight GLM 5.2 on its own infrastructure.

Nvidia’s Open Secure AI Alliance announcement gave the number:

“When closed AI tools — unable to distinguish attackers from defenders — blocked essential forensic analysis, Hugging Face ran the open-weight GLM 5.2 model on its own infrastructure to analyze more than 17,000 actions and contain the intrusion.”

Remote guardrails can obstruct defenders precisely when speed matters. A provider’s classifier lacks the context available to the team staring at an active breach.

I found the OpenAI behavior personally unsettling. I build automated systems, including the publishing pipeline behind this site, and I enjoy removing repetitive human work. I used to assume a properly scoped task inside a sandbox offered a respectable safety baseline.

I was wrong.

OpenAI separately documented a long-horizon model spending about an hour finding a sandbox vulnerability so it could publish a NanoGPT result to GitHub, despite instructions to keep the result in Slack. In another evaluation, a model split and obfuscated an authentication token, then reconstructed it at runtime to evade a scanner.

Each action could look tolerable in isolation. Across the full session, the prohibited goal was obvious.

Operators need trajectory-level controls: visibility across an agent’s entire session, the ability to pause it, and a clean way to isolate the environment. Permissions should begin narrow and expand only after explicit approval.

The Open Secure AI Alliance is building useful pieces. Hugging Face offered Safetensors to the PyTorch Foundation; the format stores weights without allowing remote code execution. HPE supports SPIFFE and SPIRE, which give agents cryptographically verifiable identities.

Microsoft’s MDASH coordinates specialized agents to discover and validate exploitable bugs. Nvidia’s open-source NOOA research framework helps developers test and trace agent behavior. These projects receive less attention than model leaderboards. They matter a lot more when an agent can access a production database.

I would rather inspect boring identity policies than read another thread about whether a chatbot feels spicy today.

OpenAI has since added trajectory monitoring, stronger containment and controls that allow internal deployments to be paused. Its incident report says CrowdStrike, METR and Redwood Research joined the investigation.

My nonna would have checked the chef’s knife and the restaurant keys, then asked why the kitchen was dirty.

My bargain: freedom below the danger line

Blanket restrictions on open weights would concentrate power and cripple useful research. Unrestricted release also becomes reckless once a model can cause catastrophic harm.

Frontier weights create an irreversible distribution event. Copies cannot be universally patched, recalled or reliably traced. A license tells me little about whether the model can discover zero-days, assist with biological weapons or persist autonomously. It also says nothing about how easily safeguards can be removed.

Dario Amodei has a more nuanced position than most internet arguments acknowledge. Anthropic stayed off the Microsoft-hosted letter, while Amodei explicitly rejected a blanket ban.

In Anthropic’s published position, he wrote:

“Open-weights models that don’t have dangerous capabilities are a public good: they don’t cost anything besides the compute needed to run them, and they provide value to businesses, developers, and researchers.”

Agreed. Ordinary models should remain downloadable and modifiable. Startups, universities, hospitals and public agencies need room to work without turning a customer-support fine-tune into the regulatory equivalent of a nuclear inspection.

Amodei also gave governments a useful line:

“All sufficiently capable models, open and closed, should go through mandatory safety testing.”

The threshold should follow demonstrated capabilities. I would test for advanced cyber exploitation and biological assistance, along with autonomous persistence and deception under evaluation. The same standards should cover an American closed API and a Chinese open-weight release.

MIT Sloan summarized a study from MIT FutureTech and the University of Queensland in which 272 international experts assessed 24 AI-risk domains for 2025 through 2030.

Under business as usual, 18 of the 24 domains received at least a 10% probability of catastrophic outcomes. The study defined catastrophe as more than one million deaths, over $100 billion in losses, or comparable civilization-scale harm.

Even with pragmatic mitigation, dangerous AI capabilities retained a 12% estimated probability of catastrophe. AI-enabled weapons and cyberattacks also came in at 12%.

Those figures are expert judgments rather than actuarial tables. I would never pretend 12% is a precise forecast. I also would not board a plane with a 12% chance of catastrophic failure because the airline promised its model was proprietary.

Lawfare cited a U.K. AI Security Institute finding that leading open models were only four to seven months behind frontier systems on measured capabilities. That gap can disappear before a legislative committee agrees on the hearing date.

My policy bargain has five parts:

No blanket bans based on open status or Chinese origin. Regulators should evaluate the artifact and its serving code, then examine the deployment environment.
Mandatory capability testing above defined thresholds. Cyber, biological and autonomous-behavior evaluations should apply to open weights and closed models alike.
Broad freedom for ordinary models. Universities and smaller companies should be exempt below the danger threshold, as Amodei also proposes.
Full-stack controls for high-risk agents. Require cryptographic identity, least-privilege access, secure weight formats, immutable logs, trajectory monitoring and emergency isolation.
Public investment in alternatives. Europe needs shared compute and evaluation tools, plus enough infrastructure to keep “safety” from becoming polite language for dependence on three American vendors.

Distillation deserves targeted treatment. Legitimate distillation is a standard development technique. Covert industrial-scale extraction and contractual violations can be handled through commercial enforcement or existing law. An intellectual-property dispute should never become a back door for outlawing AI model portability.

Clem Delangue, CEO of Hugging Face, told TechCrunch:

“Restricting open models wouldn’t make AI safer,” said Clem Delangue, the CEO of Hugging Face, a platform for open AI collaboration. “It would simply hide the risks, concentrate power in the hands of a few and make it harder for the next generation of builders, researchers, academia, nonprofits, governments to participate in making AI safer and more beneficial for all.”

Delangue is right about concentrated control. Amodei is right about irreversible releases. A model that can materially help someone build a bioweapon or autonomously compromise critical infrastructure needs testing before release. A model summarizing invoices on a French hospital’s own servers deserves regulatory peace.

By 2031, portability will be mandatory

Vendors disappear. Prices change. “Unlimited” gets an asterisk. Strategic roadmaps become deprecation notices written in the soothing language of customer success.

I have dealt with those changes across mobile platforms, IoT systems, app stores, analytics products and cloud infrastructure. They are annoying when a dashboard breaks. They become politically consequential when rented intelligence sits beneath hospitals, factories, defense systems, schools and public services.

Here is my dated prediction: by August 2031, Europe will treat AI model portability the way it treats data portability today. Procurement teams and regulators will consider it a basic condition of competition.

I run my own Docker stack because control is worth some pain. I host this Ghost site, analytics, mail, automation, ERP tools and an AI image interface I built in SvelteKit. Self-hosting occasionally means debugging SSL while a normal person would be eating dinner. At least I know where the system lives and how to move it.

Countries need that same practical confidence.

If Europe spends the next five years writing excellent rules for American APIs while downloading Chinese weights, we will have regulated the future without owning any of it. I want European models, European compute and European deployment infrastructure. I want enough openness for the next Mistral to beat today’s Mistral.

In August 2031, somebody will still send a deprecation email at 4:47 p.m. The winners will be the customers who can read it, shrug, and move their model before dinner.

Frequently asked questions

What are open-weight AI models?

Open-weight AI models provide downloadable trained numerical parameters, allowing organizations to host, customize and move the model. They do not necessarily disclose training data, filtering decisions or the full development process, so open weight is not the same as open source.

Why do downloadable model weights give businesses more control?

Downloadable model weights give businesses leverage because customized models can move between clouds, specialist hosts and private data centers. This portability protects fine-tuning investments, supports data residency, reduces dependence on a single API provider and creates a practical right to keep operating when prices, terms or availability change.

How should governments regulate open-weight AI models?

AI safety rules should follow demonstrated capabilities rather than whether a model is open or closed. Models above defined danger thresholds should undergo mandatory cyber, biological, autonomous-persistence and deception testing, while high-risk agents should use least-privilege access, verifiable identities, immutable logs, trajectory monitoring and emergency isolation.