Two dozen technology companies and organisations have asked US policymakers to protect open-weight AI. The signatories include Meta, Microsoft, Nvidia, IBM, Dell, CrowdStrike, Palantir, ServiceNow, Hugging Face, Mistral, Mozilla and the Linux Foundation.
Their open letter compares today’s model debate with the open-source software movement. It is a broad coalition, but also one whose members benefit commercially when more models can run across chips, clouds and enterprise systems.
Open weights distribute capability and control
An open-weight model publishes its trained parameters for others to download, modify and operate. A closed frontier model remains on the provider’s infrastructure and is accessed through an interface.
The letter argues that released weights let startups, universities and public bodies use advanced systems without training from scratch or paying frontier prices for every token. Organisations can retain data within their environment, tailor behaviour and reduce dependence on one vendor’s roadmap.
A wider model ecosystem also creates competition across hardware, hosting and applications. Chip and infrastructure companies have an obvious interest in that expansion because every deployable model generates demand for compute regardless of which laboratory created it.
Control is not the same as simplicity. Self-hosting requires security, monitoring, skilled operators and enough infrastructure to serve the model economically. Licensing may allow access without providing the transparency or community governance associated with conventional open-source software.
Procurement teams should therefore examine the actual licence, training disclosures, supported tools and cost of operation rather than treating “open” as a complete category. Portability is real only if another team can deploy and maintain the system.
The security argument works in both directions
The signatories concede that released weights cannot be recalled. Modified copies may circulate with safeguards removed, and tracing who fine-tuned a system can be difficult. That is a materially different risk from a hosted service that can patch or withdraw access centrally.
Their answer is that defenders need comparable capabilities to simulate AI-assisted attacks and find weaknesses. External researchers can inspect and red-team open systems across many institutions instead of relying on a vendor’s private evaluation. Closed models can still be breached or misused and may concentrate failure in a small number of providers.
This resembles the long-standing security argument for open software, though the letter provides no model-specific incident data proving that openness produces better outcomes. Model weights are also harder to interpret than source code; inspection alone may not reveal harmful learned behaviour.
A sensible policy should distinguish capability, release conditions and use case. Evaluations, staged access, documentation and secure distribution can reduce risk without assuming every open model is harmless or every closed system safe. Restrictions need evidence about the threat they address.
The letter also defends distillation, in which outputs from one model help train or evaluate another. It separates legitimate research and capability transfer from unauthorised extraction of value from closed services. Misappropriation, it argues, should be handled through targeted legal and contractual tools rather than banning a widely used technique.
The letter sets a position, not a policy outcome
No specific bill accompanies the statement. The coalition asks government to expand compute access for researchers and startups, support shared datasets and evaluations, and avoid premature limits on open releases.
That agenda enters an unresolved Washington debate sharpened by Chinese models such as DeepSeek and Kimi. Concerns about security, export controls and distillation can alter the economics of self-hosted AI within one legislative cycle.
Enterprises should not wait for policy certainty. They can document model provenance, preserve copies permitted by licence, isolate deployments, maintain alternative providers and evaluate migration effort. Contracts with cloud hosts should address what happens if a model is removed from a catalogue.
The diversity of signatories makes the letter politically notable, but it does not eliminate their different incentives. Infrastructure vendors want more workloads; model developers want distribution; enterprises want leverage and governments want controllable risk.
Open weights can broaden access and reduce lock-in while creating irreversible distribution challenges. Good policy must hold both truths at once. The important question is not whether openness is universally safe, but which safeguards preserve useful competition without pretending that a released frontier capability can later be called back.
