Ban open-weight models to limit cyber risks could, according to the author of an op‑ed published on Substack, run counter to U.S. competitiveness and increase long‑term risks. He believes the debate is stalled because it fails to consider trade‑offs and hard realities.
- The author argues that banning open-weight models could hurt U.S. competitiveness and raise long-term risks.
- He says the debate stalls because it ignores trade-offs and practical realities.
- Most documented cyber attacks involve closed models accessed through APIs.
- Open models remain essential for defense, especially on internet-isolated networks.
Three positions in the debate
The author distinguishes three currents. The first holds that open-weight models—i.e., those whose parameters are published and can be downloaded—pose an unacceptable risk to society’s functioning. It brings together the leadership of certain leading AI labs and the U.S. national security community. The second, which he aligns with, argues that these models are essential for defense and that banning their use would make the world less safe. It gathers moderate Western voices, including Hugging Face after the incident involving OpenAI, as well as Joshua Saxe. The third groups Chinese companies, which continue to publish open-weight models with strong cyber capabilities, based on their own risk assessment.
The piece criticizes Anthropic’s report on the risks of the GLM‑5.3 model, which can be used as an offensive cyber‑attack tool, for not addressing cross‑cutting issues. The technical work is deemed reasonable, but the author notes that no analysis covers the effects of banning open models nor the reasons why Chinese companies consider these models safe to publish.
Data, trade‑offs and different governance
For the author, the documented attacks to date are mainly linked to closed models accessed via application programming interfaces (APIs), and he especially cites numerous attacks attributed to OpenAI models. He puts forward several possible explanations, without taking a position: both open models and closed APIs could be easy to hijack, or malicious actors willing to target critical infrastructure could be few in number. He also notes that, in certain sensitive domains, open models are the only ones usable on internet‑isolated networks.
According to him, China approaches AI safety in a way that reflects its culture and power structures. From his understanding, Chinese companies must report each major model release to the government, including assessments, but it is unclear whether this mechanism extends to cyber or biological risks. He also believes that comprehensive safety evaluations of a model such as Kimi K3 could cost tens of millions of dollars in compute.
At its announcement, Claude Mythos was presented as a new class of cyber weapon. The author considers this portrayal inaccurate, and that an accidental release of this model in open-weight form would have mainly accelerated incidents rather than created a rupture. He says GLM‑5.3 now crosses the cited capability threshold, and, more than a month after its open-weight release, little public evidence suggests the situation has changed much.
