The Dangerous Path: Open Weights, Unreadable Models, and the Regulation That Came Home

Releasing model weights is a one-way door, and the model behind it is a room no one can read. Those two facts — irreversibility and inscrutability — sit underneath the most-quoted thing Dario Amodei has ever said about open models, that they are heading down a "dangerous path." A 2023 clip of Anthropic's CEO warning the U.S. Senate resurfaced on Hacker News this month, and the top comment wrote the dunk for everyone: these tools will become dangerously powerful, which is why nobody should be allowed to have them except by buying them from me. It is an easy laugh. The actual argument is more careful than the clip, the evidence behind it is thinner than Anthropic implies, and the way 2026 has judged it is sharper than either side expected — because the regulatory lever Amodei spent years asking for came home in June 2026 as an export-control order that switched off Anthropic's own flagship models.

This is the long version. It runs through what "open" earned the right to mean across forty years of software; what Amodei actually argues, in his own essays rather than the meme; what the biosecurity studies actually found; and why the closed, "safe" path turned out to be the one with a government-sized switch on it.

Loading diagram…

What "open" earned the right to mean

To understand why open weights make people so angry in both directions, you have to remember what the word "open" spent four decades earning.

The lineage starts with a moral claim. In 1985 Richard Stallman founded the Free Software Foundation and wrote the GNU General Public License around four freedoms: the freedom to run, study, modify, and share software. "Free as in freedom, not as in beer." The decisive freedom was the second — the freedom to study — because it presupposed that you could read the source and see exactly what a program did to you and your machine. The GPL then used copyright against itself to make that right non-revocable: a copyleft license guarantees that derivatives stay readable too. In 1991 a Finnish student named Linus Torvalds released the Linux kernel under that license, and the movement finally had an operating system at its heart.

The pragmatic rebrand came in 1998. Netscape, losing the browser war, released the Mozilla source, and a group including Eric Raymond and Bruce Perens coined "open source" to sell the same practice to corporations without Stallman's moral edge. They founded the Open Source Initiative and wrote the Open Source Definition — not merely visible code, but the rights to redistribute, fork, and use for any purpose — with the term itself coined by Christine Peterson at a February 1998 strategy session. Raymond's The Cathedral and the Bazaar gave the movement its theory: "given enough eyeballs, all bugs are shallow." Auditability was the entire promise. Many eyes on readable code is what made open source safer than the proprietary alternative, not more dangerous.

That promise is precisely what does not survive the jump to AI — and that is the hinge of the whole debate.

The relevant AI lineage is short and recent. In February 2023 Meta released LLaMA to researchers under a gated, research-only license; within about a week the weights leaked onto a 4chan torrent and were, irrevocably, everywhere. In July 2023 — the same month as the Senate hearing at the center of this piece — Meta released Llama 2 with downloadable weights, free for research and most commercial use. Mistral, Falcon, and a wave of others followed. By 2024 the Open Source Initiative had concluded the existing definition no longer fit and published a separate Open Source AI Definition — an admission, in effect, that "open source" and "open weights" had come apart.

The category error: open weights are not open source

The single most useful idea in this debate is the one most often elided: open source and open weights are not the same thing, and the gap is not pedantic.

Open-source software is human-readable instruction. You can read a function and know what it does. You can find the backdoor, patch the vulnerability, rebuild the binary from source and verify the two match. The four freedoms assume readability, because the freedom to "study" is meaningless without it.

An open-weight model ships none of that. What you download is a few hundred gigabytes of floating-point numbers — the learned parameters of a network. You can run them and fine-tune them, but you cannot read them. The training data is almost never included; the training code usually isn't either. So an open-weight release grants the freedom to use and modify without the freedom to understand. The eyeballs that made open source safe have nothing to look at. This is why most of what gets called "open source AI" is, strictly, a category error: the LLaMA- and DeepSeek-class releases are open weights — free to run, opaque inside — while genuinely open projects that ship data and training code as well (OLMo, the EleutherAI lineage) remain rare.

You do not have to take a critic's word for the opacity. Take Amodei's.

Amodei's real argument, in his own words

The strongest case for treating model weights as different from source code is not in the resurfaced clip. It is in Amodei's April 2025 essay The Urgency of Interpretability, which is worth reading precisely because it undercuts the lazy reading of his open-weights position while making the serious one unavoidable.

His thesis there is that modern AI is grown, not built. "When a generative AI system does something, like summarize a financial document," he writes, we "have no idea, at a specific or precise level, why it makes the choices it does." Look inside, and you find "vast matrices of billions of numbers" that somehow perform cognition, while "exactly how they do so isn't obvious." Anthropic's own mechanistic-interpretability work has identified more than 30 million interpretable features inside a single medium-sized model — a genuine advance, and also a measure of how far there is to go. Amodei calls it "basically unacceptable for humanity to be totally ignorant of how they work" when the systems in question are approaching what he elsewhere calls a country of geniuses in a datacenter.

Put that next to the open-weights question and the argument writes itself. Releasing source code publishes something humans can audit; releasing weights publishes an artifact that even its creators cannot yet read. The 30-million-feature result is the strongest evidence for the open-weights worry and, simultaneously, the strongest evidence that the worry cannot be fully resolved by inspection — because nobody can yet inspect a frontier model well enough to certify it safe. The irreversibility of a weight release (you can patch a vulnerable library; you cannot un-publish a parameter file) compounds with the inscrutability of the artifact. That is the real shape of the claim, and on the technical merits it is correct.

Where it stops being obviously correct is the leap from "this artifact is irreversible and unreadable" to "therefore only a few licensed incumbents should be allowed to ship it." That leap is a policy choice, not a technical fact, and it happens to coincide exactly with the business model of the firm whose CEO is making it. Both things are true at once, and the rest of this piece is about holding both.

What he actually told the Senate in 2023

On July 25, 2023, Amodei testified before the Senate Judiciary Subcommittee on Privacy, Technology, and the Law at a hearing titled "Oversight of A.I.: Principles for Regulation," alongside Yoshua Bengio and Stuart Russell. His written testimony is worth reading in full, because the clip flattens it — and because the record is more nuanced than the meme on both sides.

Two honest caveats. First, the headline framing — "open source is on a dangerous path" — comes most cleanly from the hearing's exchanges and the contemporaneous reporting that resurfaced; in the written testimony the most pointed warning about publicly released pre-trained models being cheaply fine-tuned for misuse was actually pressed hardest by Bengio, not Amodei. Amodei's written remarks lean on supply-chain security, third-party testing, and the biosecurity timeline. So the fair statement is not "Amodei delivered a crisp anti-open-source manifesto in 2023"; it is that he warned, then and since, that the trajectory of uncontrolled frontier-weight release is dangerous, while supporting small and medium open models. His more developed open-weights-and-export stance lives in his later essays, not that single hearing.

Second, the part everyone does remember is the biosecurity clock. His testimony warned that "a straightforward extrapolation of today's systems to those we expect to see in two to three years suggests a substantial risk that AI systems will be able to fill in all the missing pieces" an attacker needs in biology — that within roughly two to three years, models could meaningfully "widen the range of actors" able to attempt a large-scale biological attack. That claim is the engine of the open-weights worry: if the model is the dangerous artifact, publishing it with no recall mechanism is the alarming act. The claim is also testable. So what happened when people tested it?

The biosecurity clock — and what the studies actually found

This is where the careful version of the debate departs from the apocalyptic one, because the empirical record from 2024 onward is markedly more sober than a 2023 extrapolation implied.

The most rigorous test was a RAND red-team study that ran realistic bioweapon attack-planning scenarios with and without LLM assistance. Its finding: no statistically significant difference in the viability of the plans produced with an LLM versus those produced with the open internet alone — the model outputs mostly mirrored information already online. OpenAI's own early-warning biothreat study, run with 100 participants, found GPT-4 conferred at most a mild uplift in accuracy and completeness that did not reach statistical significance. Anthropic's Frontier Red Team reports "early warning" signs of rising dual-use bio capability while assessing present models as still short of the thresholds that would substantially elevate national-security risk. A 2024 survey, The Reality of AI and Biorisk, reviewed the literature and concluded that existing studies are nascent and often speculative, and that current AI and bio-design tools do not pose an immediate marginal risk over already-available resources.

None of this proves the danger is fake; capability is rising and "not yet" is not "never." But it reframes the policy question from "ban the dangerous artifact now" to "measure the marginal risk and gate on evidence" — which is exactly what the U.S. government's own review concluded. The 2024 NTIA report on dual-use foundation models with widely available weights, commissioned by Executive Order 14110, found that "the government should not restrict the wide availability of model weights for dual-use foundation models at this time," recommending active monitoring instead of preemptive restriction. The agency tasked with deciding whether open weights were too dangerous looked, and said: not yet, keep watching.

The marginal-risk framework

The intellectual core of the "not yet" position is a single idea: marginal risk. The question is never "could a capable model help a bad actor?" — of course it could, and so could a library, a search engine, and a graduate textbook. The question is whether an openly released model adds risk beyond what those existing tools already provide.

That framing is the contribution of On the Societal Impact of Open Foundation Models, a 2024 paper by Kapoor, Bommasani, Narayanan and a large coalition of researchers, which argues that the evidence for elevated marginal risk across misuse vectors — bio, cyber, disinformation, non-consensual imagery — was, at the time, insufficient to justify treating open release as categorically more dangerous. The same authors carried the argument into a Science policy piece, Considerations for governing open foundation models, urging that governance weigh marginal risk and the distinctive benefits of open release — competition, reproducible research, transparency, customization — rather than regulating openness as such. Stanford HAI's issue brief on governing open foundation models makes the same demand: establish marginal risk over existing tooling before imposing restrictions. And CSET's study of open models in research catalogs the other side of the ledger — hundreds of publications and seven distinct research use cases that simply require weight access, which structured API access cannot replace.

The strongest pro-restriction academic case is the honest counterweight here: Open-Sourcing Highly Capable Foundation Models, a 2023 GovAI paper by Seger and colleagues, argues that for some highly capable near-future models the extreme-misuse risks may eventually outweigh the benefits, and proposes structured-access alternatives to full weight release. That is the serious version of Amodei's worry, made by people without his balance sheet. The debate between these two camps — measured marginal risk versus precautionary structured access — is the real debate, and it is a world away from the clip.

DeepSeek, chips, and the China reality

Here is the fact that quietly dissolves a lot of the 2023 framing: by 2026 the open frontier was not American to restrict. It was largely Chinese.

DeepSeek-V3 shipped as a frontier-grade mixture-of-experts model under a permissive MIT code license; Qwen2.5 released most of its sizes under Apache-2.0 (with a couple of larger checkpoints on a bespoke license); Kimi and others followed. Stanford's 2025 AI Index documents the convergence: the gap between the best closed and best open models on the Chatbot Arena leaderboard narrowed from roughly 8% in early 2024 to under 2% by early 2025, and Epoch AI finds that about half of notable large-scale models now have downloadable weights, with the best open model trailing the frontier by only months. The weights Amodei warned about did not stay hypothetical, and they did not stay subject to U.S. policy.

Amodei's own response to this is instructive, because it is not "ban the weights." In On DeepSeek and Export Controls he argues that DeepSeek's efficiency is real but unremarkable — "an expected point on an ongoing cost reduction curve," a model "close to the performance of US models 7-10 months older, for a good deal less cost (but not anywhere near the ratios people have suggested)." His conclusion is that the binding constraint on Chinese frontier AI is not knowledge or even open weights but chips: "well-enforced export controls are the only thing that can prevent China from getting millions of chips, and are therefore the most important determinant of whether we end up in a unipolar or bipolar world." That is the tell. The policy energy goes to compute, where the United States holds a chokepoint, not to weights, where it does not. The open frontier had already escaped, so the lever moved to the one input that hadn't.

The capture critique, restated

The Hacker News thread did not engage any of this. It went straight for motive, and the motive critique deserves to be stated at its strongest because it has two distinct parts.

The first is plain regulatory capture. A frontier lab arguing that powerful models are too dangerous for anyone else to release freely — while selling metered access to its own equally powerful models — is, whatever its sincerity, describing a market in which the safe and legal way to obtain frontier AI is to buy it from a small club of incumbents. When the safety argument and the commercial interest point in exactly the same direction, skepticism is the correct prior. You do not need to assume bad faith; you need only notice the alignment of incentives and refuse to grant deference on the strength of the speaker's mission statement.

The second is sharper and, in hindsight, more important: the argument that concentration is itself the more dangerous configuration. If the entire frontier lives behind a handful of corporate APIs, that is not safety — it is a single point of failure and, worse, a single point of control. Centralize the most powerful general-purpose technology of the era into three or four firms and one government's export regime, and you have built a chokepoint. The only open question is who gets to stand on it. In 2023 that was an abstract objection. In 2026 it stopped being abstract.

2026: the boomerang

Here is the part the resurfaced clip could not have anticipated. (Caveat up front: the 2026 events below postdate my own training and are reconstructed from contemporaneous reporting; I attribute each to its outlet and flag the contested points rather than asserting them.)

Through 2025 and into 2026 Anthropic kept asking for the thing Amodei testified for: serious, binding regulation of frontier AI. His June 2026 essay Policy on the AI Exponential is the fullest statement of it — an explicit shift from his earlier transparency-first stance to an FAA model in which "frontier AI models, like airplanes, should be required to go through technical testing and auditing, and their release should be blocked or reversed as a threat to public safety if they do not meet high standards of safety," with mandatory third-party testing "in four specific areas: cybersecurity, biological weapons, loss of control of AI systems, and automated R&D." The same essay is unusually strong on civil liberties, warning that "a surveillance-focused AI could analyze widely available information at massive scale and use it to infer the innermost details of every citizen's life," and calling for bans on fully autonomous weapons in domestic law enforcement. Hold that thought.

Then the machinery arrived — pointed the other way. The dispute began over use. According to a Congressional Research Service summary and contemporaneous reporting, the Pentagon wanted Anthropic to waive the contractual red lines in Claude's terms that forbid mass domestic surveillance of Americans and fully autonomous weapons that fire without a human in the loop — the very lines Amodei's essay had just defended in public. Anthropic refused. CNN reported that the administration then moved to a supply-chain-risk posture against the company in early 2026 — a designation historically reserved for foreign adversaries like Huawei and ZTE, not an American firm — and that Anthropic's attempts to block it failed in court.

Then it escalated from procurement to the kill switch. On June 12, 2026, Axios reported that the Commerce Department issued an export-control directive subjecting Anthropic's two most powerful models — reported as Mythos 5 and Fable 5 — to controls covering any foreign national, including foreign nationals inside the United States and Anthropic's own non-citizen employees. Compliance at that granularity was effectively impossible, so Anthropic disabled both models for every customer worldwide, a step covered by PBS NewsHour and, on the scope point, Al Jazeera. The stated trigger, per CNN, was a claim by another company that it had jailbroken Mythos — which Anthropic characterized as merely "verbal evidence of a potential narrow, non-universal jailbreak." Two weeks later the standoff partially de-escalated: CNBC and NPR reported that Commerce granted permission to release Mythos 5 to roughly a hundred approved "trusted partner" companies and agencies, with The Hill noting the Secretary reserved the right to amend the access list "at any time." Government-gated AI, made literal — and, as another CNBC analysis put it, the binding regulation Anthropic got was not the kind it had asked for.

Read the diagram again. Anthropic chose the closed, API-gated path — the safe one, by its own argument — and that path led to a single point of control. The lab assumed it would be the one standing on the lever. It turned out the lever belongs to whoever holds the state.

The one-way door meets the unreadable model

Now layer the two threads together, because the synthesis is the part neither side argued in 2023.

The open-weights worriers and the regulatory-capture critics were both fixated on the open/closed axis. The variable that actually determined the 2026 outcome was control. A closed, centralized frontier is not intrinsically safer; it is intrinsically more seizable. The same property that lets Anthropic revoke a key — central control of the weights — is the property that let Commerce revoke them for the entire planet on ninety minutes' notice. Meanwhile the open Chinese weights that Amodei called dangerous were the one part of the entire system that no government could switch off: already downloaded, already mirrored, already beyond recall. A 2026 RAND analysis had by then argued that oversight of open-weight models should be proportional to demonstrated marginal risk rather than blanket restriction — the same evidence-gated logic NTIA reached — precisely because the weights are global and unrevokable, so a U.S.-only restriction mostly relocates capability rather than containing it.

And here is the deepest irony, the one that ties the interpretability thread to the policy thread. The closed path concentrates control over an artifact that nobody can read. We accept a single point of control over frontier AI — corporate or governmental — on the implicit promise that the controller understands what it is gating. Amodei's own interpretability essay says plainly that no one does yet. So the 2026 settlement is the worst of both worlds described in miniature: maximal centralization of control over maximally opaque systems. The open frontier is unrevokable and unreadable. The closed frontier is seizable and unreadable. Inscrutability is the constant; the only thing the open/closed choice changes is who holds the off switch — and whether anyone can take it from them.

What both sides get wrong

1. "It's pure regulatory capture" undersells a real asymmetry. Open weights genuinely are irreversible in a way open-source code is not — you can patch a library, you cannot un-publish a parameter file — and the artifact is genuinely unauditable, by Amodei's own account. Dismissing the argument because the messenger profits from it is lazy; the irreversibility and the opacity are real engineering facts, not talking points.
2. "It's pure safety" ignores the evidence and the incentives. A safety case that maps perfectly onto a revenue model deserves adversarial scrutiny, and when scrutinized the marginal-risk evidence is thin: the RAND and OpenAI bio studies found no significant uplift, and NTIA declined to restrict.
3. The open/closed axis hid the real variable: control. The 2026 boomerang shows the safety-relevant question was never only "open or closed." It was "who can pull the lever, and what stops them pulling it for reasons that have nothing to do with safety." Closed did not mean safe; it meant someone else decides.
4. "Open weights protect us from government overreach" is also too neat. The same irreversibility that shields a Chinese open model from a U.S. export order shields a genuinely dangerous capability from any recall. Distributed-and-unrevokable cuts both ways; there is no configuration of this technology that is simply safe.
5. Everyone underrated the China factor. Both the capture critique and the safety case were argued as if U.S. policy set the global default. With the open frontier shipping from Chinese labs, a U.S.-only restriction relocates capability rather than containing it — which is why even Amodei's own essay routes the real lever through chips, not weights.
6. Interpretability is the unpriced risk under both regimes. Open or closed, we are deploying systems that, in Amodei's words, are "grown" and not understood. The governance debate spends its energy on who may ship the artifact and almost none on the fact that no one can read it — which is the failure mode that should scare everyone regardless of license.

Decision table: which "open" are we even arguing about?

Artifact	What you can do	What you can audit	Reversible?	Who can switch it off	In the 2023→2026 debate
Open-source software (Linux, GNU)	run, read, modify, redistribute	everything — readable code	patchable; forks persist	no one	the trust the word open earned
Fully open model (OLMo, Pythia)	run, fine-tune, retrain	weights + data + training code	no — weights are out forever	no one	the only true "open source AI"
Open-weight model (LLaMA, DeepSeek, Qwen)	run, fine-tune	weights only — opaque inside	no — the one-way door	no one	what Amodei actually warned about
Closed / API-gated model (Claude, GPT)	call the API under terms	nothing	yes	provider — or the state	the "safe" path that boomeranged

Most "open source AI" fights are really open-weight fights, and most safety-versus-freedom fights are really control fights wearing an openness costume. The table's last two columns are the ones that decided 2026.

Conclusion

Amodei's 2023 testimony was neither the cartoon villainy the Hacker News thread made of it nor the disinterested public service Anthropic's framing implied. Stripped to its strongest form — and his own interpretability essay supplies that form — it is a technically sound observation: releasing frontier weights is irreversible, and the artifact is unreadable even to the people who trained it. Wrapped around that observation is a policy ask that fortifies his own moat, resting on a biosecurity extrapolation that the subsequent evidence has so far not borne out. The correct response was always to take the technical claim seriously and distrust the policy conclusion, holding both.

What 2026 added is the lesson neither camp was arguing about. The open-weights worriers and the capture critics fought over open versus closed, when the variable that actually decided the outcome was control — and a closed, centralized frontier turned out to be the configuration most exposed to a single actor's veto. Anthropic walked through the door it called safe and found a government on the other side of it. The open weights it called dangerous were the one thing in the story no one could turn off. And underneath both, the constant that should worry us most: whichever door we pick, we still cannot read what is on the other side. That is the dangerous path — and it is the one nobody volunteered to walk.

Frequently Asked Questions

What did Dario Amodei actually argue about open-source AI? His position is tiered: small and medium open models help research, but the uncontrolled public release of the largest frontier weights is dangerous because it is irreversible and the artifact is unauditable. The strongest form of the argument is in his own The Urgency of Interpretability, where he describes models as "vast matrices of billions of numbers" that are grown, not built, and whose decisions we cannot precisely explain.

What is the difference between open source and open weights? Open-source software ships readable code you can audit and rebuild; an open-weight model ships only the trained parameters — runnable and fine-tunable, but opaque inside and usually without training data or code. The Open Source Initiative needed a separate Open Source AI Definition in 2024 precisely because the two had come apart.

Is there evidence open models add real danger? So far the marginal-risk evidence is thin: a 2024 RAND red-team study found no statistically significant uplift to bioattack planning from current LLMs, OpenAI's biothreat study found at most a mild non-significant uplift, and the 2024 NTIA report concluded the government should not restrict open weights at this time.

How did AI regulation boomerang on Anthropic in 2026? After Anthropic refused to waive contractual limits on surveillance and autonomous weapons, the administration designated it a supply-chain risk and, per June 2026 reporting, Commerce issued an export-control order that forced Anthropic to disable its two most powerful models for every customer worldwide — the binding regulation it had asked for, pointed at itself.

Is open-weight AI winning? By 2026 the most capable open-weight models were largely Chinese — DeepSeek, Qwen, Kimi — under permissive licenses, and about half of notable large-scale models had downloadable weights. Amodei's own DeepSeek essay argues the binding constraint is chip access, not knowledge, which is why his policy energy goes to export controls rather than banning weights.

References

1. Dario Amodei. Policy on the AI Exponential. 2026.
2. Dario Amodei. The Adolescence of Technology. January 2026.
3. Dario Amodei. The Urgency of Interpretability. April 2025.
4. Dario Amodei. On DeepSeek and Export Controls. January 2025.
5. Dario Amodei. Machines of Loving Grace. October 2024.
6. Dario Amodei. Written Testimony, Senate Judiciary Subcommittee on Privacy, Technology, and the Law. July 2023.
7. Tech Policy Press. Transcript: Senate Hearing on Principles for AI Regulation. 2023.
8. Anthropic. Anthropic's Responsible Scaling Policy. 2023.
9. Anthropic. Core Views on AI Safety. 2023.
10. NTIA. Dual-Use Foundation Models with Widely Available Model Weights. July 2024.
11. The White House. Executive Order 14110: Safe, Secure, and Trustworthy Development and Use of AI. October 2023.
12. The White House. Executive Order 14179: Removing Barriers to American Leadership in AI. January 2025.
13. Bureau of Industry and Security. Framework for Artificial Intelligence Diffusion (interim final rule). January 2025.
14. Bureau of Industry and Security. Department of Commerce Rescinds the AI Diffusion Rule. May 2025.
15. Anthropic. Securing America's Compute Advantage: Anthropic's Position on the Diffusion Rule. 2025.
16. Congressional Research Service. Anthropic, the Department of Defense, and Supply Chain Risk. 2026.
17. Axios. Trump admin blocks foreign access to Anthropic's most powerful AI. June 12, 2026.
18. CNBC. Anthropic asked for regulation. Washington went much further. June 17, 2026.
19. CNBC. Trump admin allows Anthropic to release Mythos AI model to some companies, agencies. June 26, 2026.
20. NPR. Trump administration partially lifts export ban on Anthropic's most advanced AI model. June 27, 2026.
21. Al Jazeera. US orders Anthropic to disable AI models for all foreign nationals. June 13, 2026.
22. PBS NewsHour. Anthropic disables new AI model after White House security directive. June 2026.
23. Nextgov/FCW. Anthropic suspends top AI models after U.S. export control order. June 2026.
24. The Hill. Federal government permits release of Anthropic's Mythos model to select companies. June 2026.
25. CNN Business. Anthropic export ban shows need for AI regulation, experts say. June 21, 2026.
26. CNN Business. Pentagon's supply chain risk label for Anthropic, explained. March 5, 2026.
27. RAND Corporation. Open-Weight AI Models Require Proportional Evaluation Approaches. 2026.
28. Christopher A. Mouton, Caleb Lucas, Ella Guest. The Operational Risks of AI in Large-Scale Biological Attacks: Results of a Red-Team Study. RAND, 2024.
29. OpenAI. Building an Early Warning System for LLM-Aided Biological Threat Creation. 2024.
30. Anthropic. Strategic Warning for AI Risk: Progress and Insights from Our Frontier Red Team. 2024.
31. Aidan Peppin, et al. The Reality of AI and Biorisk. 2024.
32. Sayash Kapoor, Rishi Bommasani, Arvind Narayanan, et al. On the Societal Impact of Open Foundation Models. 2024.
33. Rishi Bommasani, Sayash Kapoor, Kevin Klyman, et al. Considerations for Governing Open Foundation Models. Science, 2024.
34. Center for Security and Emerging Technology. The Use of Open Models in Research. Georgetown, 2024.
35. Elizabeth Seger, et al. Open-Sourcing Highly Capable Foundation Models. GovAI, 2023.
36. Stanford HAI. Considerations for Governing Open Foundation Models (issue brief). 2023.
37. Mozilla. Joint Statement on AI Safety and Openness. 2023.
38. Electronic Frontier Foundation. Generative AI Policy Must Be Precise, Careful, and Practical. 2023.
39. Alex Engler. The EU's Attempt to Regulate Open-Source AI Is Counterproductive. Brookings, 2023.
40. DeepSeek-AI. DeepSeek-V3 Technical Report. 2024.
41. Qwen Team. Qwen2.5 Technical Report. 2024.
42. Stanford HAI. 2025 AI Index Report. 2025.
43. Epoch AI. Open Models: Data and Analysis. 2025.
44. Free Software Foundation. The Free Software Definition. GNU Project.
45. Free Software Foundation. GNU General Public License, version 3. 2007.
46. Open Source Initiative. The Open Source Definition.
47. Open Source Initiative. History of the Open Source Initiative.
48. Open Source Initiative. The Open Source AI Definition v1.0. 2024.
49. Eric S. Raymond. The Cathedral and the Bazaar. 1997.
50. Meta AI. Introducing LLaMA. February 2023, and Meta and Microsoft Introduce Llama 2. July 2023.