An MIT-licensed model out of Beijing took the top of a blind human-preference design benchmark in June, at roughly a sixth of the output price of the flagship it beat, and you can run it on a Mac Studio with the network cable pulled out.
By late July, Washington was reportedly weighing restrictions on Chinese open-weight models (opens in a new tab), fifty companies had signed a letter asking it not to, and the AI safety conversation had gotten very loud in a very specific direction.
I don't think those are unrelated events. So let's start with the money, because the money explains the timing better than the safety argument does.
The open-weight pricing math that stopped working in June
GLM 5.2 (opens in a new tab) shipped from Zhipu on June 13, 2026. 744 billion parameters, mixture of experts with roughly 40 billion active per token, a 1M context window, MIT license. Not a research license, not open weights with an acceptable-use appendix stapled on. MIT, the same license as jQuery.
Here is what it costs to use, next to the models it competes with.
| Model | Input | Output |
|---|---|---|
| GLM 5.2 (Z.ai, MIT) | $1.40 | $4.40 |
| Claude Opus 4.8 | $5.00 | $25.00 |
| GPT-5.5 | $5.00 | $30.00 |
Output tokens are where agentic work actually burns budget, and that column is a 5.7x gap against Opus 4.8 and a 6.8x gap against GPT-5.5.
A gap that size is survivable as long as the cheap thing is meaningfully worse. GLM 5.2 took #1 on Design Arena's website design leaderboard (opens in a new tab) on June 19 at 1360 Elo, a 27-point jump that put it four places above where it started, and it held that slot for about a month. As of July 30 it sits at 1341, three points off GPT-5.6 Sol at 1344 and two off Claude Opus 5 at 1343, with Kimi K3 clear at the top on 1375. An MIT-licensed model at a sixth of the output price, inside the noise of both US flagships. That is blind human preference, people picking between two outputs without knowing which lab produced either one.
Moonshot's Kimi K3 arrived on July 16, with weights following later in the month. Artificial Analysis published a piece the next day titled Kimi K3 achieves #3 in the Artificial Analysis Intelligence Index (opens in a new tab), scoring 57 and landing in the same band as Opus 4.8 and GPT-5.5. It still scores 57. What moved is the field around it, because Claude Opus 5 and GPT-5.6 Sol both shipped in the back half of July and score 59 to 61. It also took #1 on Frontend Code Arena (opens in a new tab) in July at 1,679 Elo against Fable 5's 1,631, on 1,757 blind developer votes, and as of July 29 it runs second there at 1,682, behind Opus 5 at 1,712.
So the pitch that a frontier API subscription buys you capability you cannot get anywhere else is now, for a growing list of specific jobs, false.
When the cheap option is losing, price is a strategy. When the cheap option is winning, price is a countdown.
Where the tokens actually went between June 2025 and June 2026
Benchmarks are arguable. Routed traffic isn't.
US models from Google, OpenAI and Anthropic held around 70% of token share on OpenRouter (opens in a new tab) in June 2025. By June 2026 that was roughly 30% (opens in a new tab). Anthropic's own share of that traffic slid from 29.1% to 13.3% over the same twelve months, and now sits behind six separate Chinese models. DeepSeek alone moves more tokens than any other single provider on the platform.
That is one platform, and it skews toward price-sensitive developers rather than enterprise contracts, so revenue share looks nothing like volume share. It is still the cleanest public view of what people reach for when nobody from procurement is watching.
On the capability side, the picture is messier than the "gap is closing" headline suggests, and the mess is worth sitting with. Epoch AI (opens in a new tab) measures open models trailing state-of-the-art closed models by about four months since January 2026, which is actually wider than the roughly three months it measured from 2023 through late 2025. The UK AI Security Institute went the other way in its first public measurement of the open-weight cyber gap (opens in a new tab), finding open models trailing by four to seven months, down from six to ten.
Two respected groups, two different directions, because they are measuring different things. What both agree on is the order of magnitude: the lead is now measured in months, not years, and a few months of lead time does not support a 6x price premium.
The Open Weights and American AI Leadership letter, and the absence
On July 24 a group of companies published Open Weights and American AI Leadership (opens in a new tab), hosted on Nvidia's servers, asking Washington to resist sweeping restrictions on open-weight models and to use targeted legal frameworks instead of broad bans. Twenty-five signatures on Friday, about fifty within a day: Nvidia, Microsoft, Meta, IBM, Palantir, Hugging Face, Mozilla, the Linux Foundation, a16z, Y Combinator, Mistral, Replit, then OpenAI, Google, AMD, Cisco, Cloudflare, GitHub and Ollama over the weekend.
Anthropic, Amazon and xAI did not sign. Palantir's Alex Karp said so publicly, and pointedly (opens in a new tab), warning that pushing back against competition ends with a tech sector as stagnant as Europe's.
Now the correction, because the version of this story in my feed all week is wrong and I would rather be accurate than fast. Anthropic did not ask for a ban. Amodei published a position post on July 27 (opens in a new tab) stating in bold that Anthropic has never advocated for a ban on open-weights models, and calling open models without dangerous capabilities a public good. He told Axios (opens in a new tab) that a ban would shield US labs from competition and that this "has never been my goal."
What he asked for instead is three things: no frontier chips or chipmaking equipment sold to China, a crackdown on industrial-scale distillation, and mandatory pre-release safety testing for every sufficiently capable model, open or closed, with smaller startup and academic models exempted.
Read those three together and notice what happens. Two of them are China policy. The third is a rule about every model, including the MIT-licensed one your team wants to self-host in Frankfurt. They arrive as one package, in one post, under one national security frame, and the packaging is doing argumentative work that nobody is being asked to defend.
Why mandatory pre-release testing lands harder on open weights
A pre-release testing requirement is a compliance cost. Compliance costs are proportionally brutal to small entrants and a rounding error to incumbents, which is exactly why incumbents so often end up supporting them sincerely.
Anthropic already runs the evaluation function. System cards, red teams, a policy org, classifier tuning. It built all of that because it decided years ago that this was the product. A university lab or a twelve-person startup releasing weights has to build that from zero, or not release.
And for open weights specifically, testing is not a gate you can reopen. A closed lab that finds a problem after launch patches and ships again. Anthropic did precisely that with Claude Fable 5: shipped June 9 with classifiers that reroute cybersecurity work to the weaker Opus 4.8, pulled from non-US access on June 12 when the US government imposed export controls after Amazon researchers reported a classifier bypass, then redeployed globally on July 1 (opens in a new tab) once Commerce lifted those controls the day before, this time behind a new classifier that blocks the reported technique in over 99% of tested cases. Three weeks after that, Claude Opus 5 (opens in a new tab) shipped with classifiers Anthropic expects to intervene about 85% less often than Fable 5's, and its system card (opens in a new tab) permits source-code vulnerability discovery at every access level. A launch, a suspension, a re-release and a successor, all inside seven weeks.
Weights on Hugging Face get mirrored in minutes. There is no version of that fix-forward loop available. So the same rule, applied evenly to open and closed, produces wildly uneven consequences, and "we are applying it evenly" is the part that makes it sound fair.
Takeaway
Watch the exemption, not the rule. "Sufficiently capable" is a number somebody has to write down, and every lab on the wrong side of it will spend the next decade lobbying about where the line sits. Anyone who has watched a compute threshold get drafted into a bill knows how stable those numbers turn out to be.
The honest version of the counterargument
I am not going to pretend this is settled, because the strongest piece of Anthropic's case is not about domestic open weights at all.
The distillation argument is real. If a lab can spend a fraction of your training budget to pull most of your capability back out of your own API, then the cost of reaching the frontier and the cost of copying it diverge permanently, and no amount of "just compete on merit" fixes that. Anthropic told the Senate Banking Committee (opens in a new tab) it had been hit by the largest such attack it knows of: 28.8 million exchanges through roughly 25,000 fraudulent accounts, run against Claude between April and June 2026. I do not have a good rebuttal to that one, and I went looking for one.
The safety record is not invented either. Anthropic was pushing export controls before GLM 5.2 existed, filed comments backing the Commerce Department's AI Diffusion Rule in 2025, and shipped Fable 5 classifiers so cautious that its own help center warns security users to expect high fallback rates. I have had a Fable 5 session bail on a CVE impact question that any junior analyst is allowed to ask, which is the same failure mode I wrote about when Hugging Face's own AI tooling refused to examine the evidence of its own breach. That is a company eating a cost, not just imposing one.
Forbes (opens in a new tab) and TheStreet (opens in a new tab) both landed on "both can be true," and I think that is right. Sincere safety conviction and a fortunate regulatory outcome are not mutually exclusive, and treating them as mutually exclusive is how this argument keeps going in circles.
What I object to is the bundling. China chip policy and a domestic rule covering every capable model are separate questions with separate answers, and they keep arriving in the same paragraph.
Open weights are not a free lunch either
Open weights is not open source, and my side of this argument is sloppy about it. You get the weights and usually the inference code. You do not get the training data or the training code, which means you cannot audit what went into the model or reproduce it. The Open Source Initiative's Open Source AI Definition (opens in a new tab) has been saying this for two years and mostly getting ignored by people quoting it in support of the opposite point.
Self-hosting has a floor. GLM 5.2 wants somewhere around 240GB of combined memory even heavily quantized. The celebrated demo, 21.6 tokens per second on Unsloth's 1-bit dynamic quant (opens in a new tab) with the internet disconnected, ran on a Mac Studio M3 Ultra with 256GB, a machine that costs about as much as a used car. Real, genuinely impressive, not a laptop.
Capability is not uniform either. Kimi K3's accuracy on AA-Omniscience (opens in a new tab) rose from 33% to 46% between versions while its hallucination rate rose from 39% to 51%. Smarter, and more confidently wrong at the same time. Ship that in front of customers without a verification layer and you will find out the expensive way, which is roughly the same argument I made about what running your own model actually costs.
Open-weight model ban debate: FAQ
Did Anthropic ask for a ban on open-weight models?
No. In a position post published July 27, 2026, Dario Amodei stated in bold that Anthropic has never advocated for a ban on open-weights models, and described open models without dangerous capabilities as a public good. Anthropic advocates for chip export controls on China, a crackdown on industrial-scale distillation, and mandatory pre-release safety testing for all sufficiently capable models, open or closed.
What is the Open Weights and American AI Leadership letter?
It is an open letter published July 24, 2026 and hosted on Nvidia's servers, urging US policymakers to resist sweeping restrictions on open-weight AI models and to use targeted legal frameworks instead of broad bans. It launched with 25 signatories and roughly doubled to 50 within a day. Anthropic, Amazon and xAI did not sign.
Are open-weight models actually as good as closed frontier models now?
On specific tasks, yes. Open-weight models sit at or near the top of the blind human-preference boards for design and frontend code. As of July 30, 2026, Kimi K3 leads Design Arena's website design board at 1375 Elo, and GLM 5.2 sits within three points of both GPT-5.6 Sol and Claude Opus 5 on that same board at a fraction of the price. Across general capability the gap persists but is measured in months: Epoch AI puts open models about four months behind state of the art, and the UK AI Security Institute measured four to seven months on cyber tasks.
Is an open-weight model the same as open source?
No. An open-weight release gives you the model weights and usually inference code, but typically not the training data or training code, so the model cannot be independently audited or reproduced. You still get self-hosting, fine-tuning control and no data egress, which is what most teams are actually buying.
What I think happens next
I think the safety-testing framework gets written. I think it passes with a small-lab exemption that everyone points to as proof it is reasonable, and I think the threshold defining "sufficiently capable" drifts downward every time it is revised.
I would like to be wrong about that last part, and the tell will be simple enough to check. Watch whether the number ever moves up.