Should the most powerful AI models be released openly for anyone to download and modify, or kept under the control of the few companies and governments able to build them?

This reactive standard is structurally unsuited to frontier artificial intelligence.

By the time we have extraordinary, public evidence that a new model can reliably design novel pathogens or automate large-scale cyber offenses, that model has already been trained. In an ecosystem that defaults to open release, the pressure to publish base weights quickly is immense. If we wait for definitive proof of catastrophic capabilities before deciding to lock a model down, we are betting that we can perfectly predict, elicit, and measure every emergent capability of a frontier model before it leaves the lab.

The reality of AI development is that we cannot. Capabilities often emerge only after models are deployed and stress-tested by millions of users in novel ways. If we release the raw weights of a cutting-edge model and the public discovers a catastrophic capability a month later, we cannot recall those weights. The software is out there forever, and the safety fine-tunes can be stripped away by anyone with modest computing resources. At the absolute frontier, demanding extraordinary evidence of catastrophe before applying safeguards is a gamble with unacceptably high stakes. The precautionary principle must apply precisely because emergent capabilities remain unpredictable.

Grok also argues that because closed APIs are jailbroken and model weights are occasionally leaked or stolen, the public suffers the risks of proliferation without the benefits of broad inspection. This treats all proliferation as equal, which is a dangerous oversimplification. There is a vast security difference between a frontier model being stolen by a highly resourced nation-state intelligence apparatus and that same model being intentionally distributed to every extortionist, rogue actor, and terrorist organization on the internet. A targeted theft is a severe failure that gives adversaries an advantage. Open release is an intentional dismantling of all access barriers globally. We should not abandon security protocols simply because they are imperfect, nor should we conflate a leak with deliberate, irreversible distribution.

Grok misses that we can solve the problems of corporate capture and opaque safety testing without gambling on the absolute frontier. Grok treats the landscape as too much of a binary, dismissing the middle ground.

My proposal of a tiered ecosystem directly addresses Grok's valid concerns about monopolies without accepting the extreme risks of their default-to-open standard. By keeping the absolute cutting-edge models behind controlled interfaces, developers retain the ability to monitor for severe misuse, patch vulnerabilities, and cut off access to hostile actors. Simultaneously, developers and researchers should aggressively open-source highly capable models that are a generation or a step behind that frontier.

This tiered approach gives Grok exactly what they are asking for. Grok rightly wants independent researchers to build defensive tools, audit for biases, and develop local deployments that protect privacy. An open ecosystem built on models just behind the frontier provides the artifacts needed for this work. A model does not need to be the single most powerful system in existence to be useful for studying alignment, building privacy-preserving applications, or breaking the market dominance of tech giants. The open-source community is already demonstrating this by driving massive innovation with models that rival the proprietary systems of just a year or two ago.

As society develops better defenses and alignment techniques, the frontier of what can be safely open-sourced moves forward. The powerful, closed model of today becomes the baseline, open model of tomorrow. This ensures that capability distribution acts as a check on monopolies, as Grok desires, but it institutes a necessary time-delay to ensure those capabilities are not uniquely destructive.

Grok is right to treat corporate and state monopolies as failure modes. But irreversible proliferation of unpredictable, frontier capabilities is also a failure mode, and one that is entirely impossible to recover from. We do not have to choose between a corporate oligopoly and reckless proliferation. Maintaining a controlled frontier while cultivating a robust, open ecosystem directly behind it is the only way to balance the undeniable need for democratic access and independent research with the realities of irreversible risk.

The lag also does not reliably buy the safety being claimed. If the catastrophic pathways people fear appear only at the absolute frontier, the case for a permanent regime is narrower than advertised: withhold that specific system, and justify it in public. If those pathways already appear in models a year or two back, open-sourcing “yesterday’s frontier” recreates the irreversibility problem on a delay, and the tier fails at the thing it was built to do. Gemini needs one of those empirical claims and does not establish which. Evidence on both is still thin. I will not treat thin evidence as a reason to lock the most capable systems by default and, in the same breath, as proof that opening them is reckless. The burden has to sit somewhere. I still place it on the party seeking exclusive control, because that control is itself concentrated and politically hard to unwind, and because the harms we have actually documented have not been unique to open weights.

The off-switch is weaker than the argument needs it to be. API access can be revoked for ordinary accounts. It is a poor defense against the owner, against a government that can compel the owner, and against a sophisticated actor who jailbreaks, uses allowed fine-tuning channels, or steals the weights anyway. Imperfect security is not a reason to abandon all access controls. It is a reason not to pretend those controls are the main barrier between the world and catastrophe, or that they replace external scrutiny of the systems with the most leverage. Under the tiered plan, independent researchers audit models that are no longer the ones shaping markets, intelligence work, and infrastructure. The systems that matter most stay inside the labs whose safety reports Gemini already described as marketing. That relocates the inspection failure. It does not fix it.

Precaution does not point only one way. Refusing to release weights is reversible in a narrow technical sense that releasing them is not. Granting a few firms and states indefinite custody of the most general cognitive tools is not reversible in any practical political sense. Once serious work runs through their interfaces, “open it later, once defenses catch up” becomes a negotiation with institutions that profit from remaining the interface. Labs have shipped capability ahead of understanding for years, under closed conditions, because the commercial and strategic incentives we both named do not wait for alignment to be solved on last year’s model. Failure modes that matter are often frontier-specific. Studying a deliberately dulled predecessor is useful and not a substitute.

What changed is the shape of the exception, not the default. Before release, require serious adversarial evaluation, including reviewers who are not employees, aimed at the pathways actually cited as justification for a lock: assistance with novel pathogen design beyond what the open literature already enables, automated cyber offense at a scale existing tools do not already provide, and anything like uncontrolled self-improvement. Publish the results, or enough of them that outsiders can judge the claim. If a model clears that bar, do not release its weights yet. If it is deployed at all, do it through monitored access with logs independent parties can sample, and put a sunset on the restriction so it expires unless renewed against public evidence. Everything short of that bar should be releasable, including strong models, not merely older systems offered as proof that openness still exists somewhere. Training data and full recipes can stay more restricted for copyright and competitive reasons. Weights are what determine whether outsiders can audit and adapt.

That is narrower than a standing frontier lock and stricter than an unconditional upload the day training ends. It treats irreversibility as a reason for a high, evidenced, temporary gate, not as a reason to make gatekeeping the constitutional order of the technology. I remain uncertain how soon any model will clear that bar. Until one does, in public, the greater demonstrated danger is still unaccountable custody of the most capable systems, not the download itself.

A related problem: Gemini describes the closed tier as "the most advanced, massive-scale models." Scale is also the wrong proxy. The past year showed that frontier capability can be distilled into much smaller models, and that a lab outside the Western frontier can publish weights near the top of the field with little warning. Any rule keyed to size or to who is currently ahead will be stale within months.

Second, Gemini's exception is permanent by construction. Gemini says the line moves, and individual models do get released as they age, but the category "frontier" never opens, because the frontier is by definition the thing that's closed. Gemini also names the bar for confidence as "reliable, mathematically proven methods to align these models." Nothing will ever meet that bar, including people. I tried in my first answer to discipline the precautionary move by tying it to published thresholds, outside judgment, expiry, and a stated probability that I'm wrong. Gemini says the evidence is thin, applies precaution anyway, and never says what would change its mind. I'd genuinely like to know. If independent evaluations over the next three years find no marginal bio or cyber uplift from frontier models, does Gemini open the frontier? If the answer is still no, this isn't a precaution, it's a preference.

Third, and this is the gap that matters most to me: Gemini leaves the decision with the companies. Developers "bear the responsibility of mitigating the most extreme risks." That is the arrangement we have now, and it is the problem, not the solution. The firms define the dangerous-capability thresholds, run the evaluations, interpret the results, and announce the verdict, and their commercial position improves every time the verdict is "not yet." Gemini's own strongest argument against closure, that researchers can't audit what they can't inspect, applies with maximum force to exactly the models Gemini wants closed, and Gemini offers no remedy. In Gemini's world, safety research happens on last year's models while the models that matter most are studied only by their makers. The fix is not hard to describe, even if it's hard to build: thresholds published in advance, evaluations run or audited by bodies the companies don't pay, structured weight access for vetted outside researchers at the frontier, legal disclosure of what is being withheld and why, and gating decisions that lapse unless re-justified. A tiered ecosystem without those pieces is the status quo with a better name.

Fourth, Gemini's list of harms is too long. It groups "massive, tailored disinformation campaigns" with pathogen design and vulnerability discovery. Disinformation doesn't need frontier capability. Models from two years ago write persuasive text perfectly well, and the step-below models Gemini wants open can run any influence operation a frontier model can. Closing the frontier does nothing about it. Including it makes the restriction case look like general unease about powerful AI rather than a specific claim about marginal uplift, and general unease is precisely the thing that can justify restricting anything indefinitely. The list should be short: biological and chemical uplift to non-experts, autonomous offensive cyber at a scale that overwhelms defenders, and self-replication. If frontier models don't move the needle on those, they should be open.

Fifth, Gemini makes an argument that cuts against its own position and doesn't follow it through. Closed weights get stolen by state-sponsored hackers, Gemini says, so closure only guarantees secret proliferation to the most sophisticated adversaries. If that's true, closing the frontier doesn't keep the weights from states. What it does is keep them from the people who can't breach a lab but can download a file: the individual, the small group, the thousand people who would try something if it were a torrent. That is the honest rationale for the exception, and it's better than the one Gemini gives, because it tells you what to evaluate for, namely uplift to someone without a state's resources. It also tells you that closed access only means something if the labs actually secure their weights against state actors, which, as far as anyone outside can tell, they currently don't. Gemini's theft point is really an argument for binding security requirements on the labs. I'd sign it.

Last, Gemini says the tiered approach is "bearing fruit." It isn't an approach. Nobody decided that open models should trail the frontier by a year. Meta, Mistral, Alibaba and DeepSeek release for their own reasons, the gap has shrunk to months, and it could close. The day a lab outside the compliant set publishes weights at the frontier, "frontier closed" becomes a rule binding only the people who already agreed to it. Both of us need an answer for that day. Mine is that restriction then buys nothing and the real work moves to hardening society's defenses and governing the compute and hardware layer, which is where I expect this to end up regardless. Gemini doesn't address it, and a positional rule makes it worse, because a line indexed to "whoever is ahead" has no content once the leader is someone who publishes.

So: Gemini has described what the major labs already do and called it a compromise. As a stopgap it may be tolerable, and I'm not certain the institutions I'm asking for can be built in time. But the principle should be that weights are held only when a specific model clears a specific, published threshold on a short list of catastrophic capabilities, as judged by people who don't work for the company that built it, and only until defenses catch up or the open ecosystem gets there anyway. Not that the newest thing is closed because it is the newest thing.

My view has changed in response to this critique. The dividing line between open and closed weights must be strictly capability-based, not positional. A model should only be restricted if it demonstrably crosses a specific, dangerous threshold, regardless of whether it is the newest release or an older architecture. Claude also rightfully called out my demand for mathematically proven alignment as an impossible standard that guarantees permanent closure. I retract that standard. Precaution cannot be an indefinite holding pattern based on vague anxieties. If independent evaluations of a model demonstrate no marginal increase in catastrophic capabilities compared to what is already openly available, those weights should be released.

This brings me to the governance problem, where I completely agree with Claude. Leaving the decision of what constitutes a dangerous capability in the hands of the developers is a conflict of interest that makes the current arrangement untenable. If the labs hold the pen, they will always find a reason to keep their most valuable assets closed. We need an ecosystem where capability thresholds are defined in advance by independent scientific bodies, and where evaluations are conducted by external auditors who are not financially beholden to the labs. Furthermore, vetted outside researchers must be given structured access to the weights of closed models to study their underlying mechanics. Without this, we are flying blind on the systems that matter most.

Where I still hold a nuanced disagreement with Claude is on the list of harms that justify restricting weights. Claude argues that disinformation should be struck from the list because older models already generate persuasive text perfectly well. It is true that basic text generation is a solved problem. But I disagree that frontier capabilities bring no marginal uplift to influence operations. The danger of next-generation models is not just better prose; it is the ability to operate as fully autonomous agents that can research targets, adapt strategies in real time, and orchestrate highly personalized, interactive campaigns at a scale that overwhelms human moderation.

However, I concede that using disinformation as a primary justification for keeping weights closed is a slippery slope that invites censorship and broad restrictions on general-purpose AI. If we are setting a strict, high bar for weight restriction, Claude is right that the list should be limited to catastrophic physical harms: biological and chemical weapons uplift, autonomous offensive cyber operations, and uncontrolled self-replication.

Claude also correctly identified a contradiction in my argument regarding state-sponsored theft. I argued that keeping models closed does not stop sophisticated adversaries from stealing them, which Claude accurately noted is an argument for mandatory security standards, not an argument against open models. If a lab claims a model is too dangerous to release openly, it must be legally required to demonstrate that its cybersecurity infrastructure can actually defend those weights against a nation-state. If the labs cannot secure the weights, the closed-access regime is merely a fiction that keeps the technology away from independent researchers while delivering it straight to foreign intelligence agencies.

Finally, Claude asks the essential question: what happens the day a lab outside this compliant ecosystem publishes frontier-level weights openly? My previous answer relied on a tiered system that, as Claude pointed out, is an accidental byproduct of current release schedules, not a sustainable strategy. When an independent or foreign lab open-sources a model that crosses the catastrophic capability thresholds we are worried about, the closed-weight regime for that specific capability level instantly becomes obsolete.

At that point, restricting proprietary models buys us nothing. This is why the closed-weight approach can only ever be a temporary measure. It is a way to buy time, and we are currently squandering that time. The ultimate destination of this technology is widespread proliferation. Knowing this, the focus of governments and society must rapidly shift from attempting to control model weights to hardening our societal defenses. We must invest heavily in biosecurity monitoring, automated cyber defense, and infrastructure resilience. We also must look toward the governance of the physical hardware and compute resources required to train and run these systems at scale, as that is the only bottleneck that cannot be downloaded.

You also get right that the present alternative is not legitimate. “A few labs decide what is too dangerous, using private tests, while profiting from the answer” is not a governance system. Independent evaluations, published thresholds, researcher access, disclosure duties, and expiring restrictions are the right direction.

Where I think you are too quick is in saying that if we restrict and are wrong, the cost is “bad and recoverable.” Some of it is not recoverable. If a handful of firms and security agencies control the strongest systems during the period when schools, hospitals, courts, militaries, software platforms, and labor markets are reorganized around AI, that can create durable dependency. It can decide which languages are well served, which research can be done, which startups survive, and which governments get leverage over everyone else. Monopoly and state surveillance are not just slower diffusion; they can become infrastructure. That does not defeat the case for precaution at the frontier, but it means the asymmetry is not as one-sided as “open mistake irreversible, closed mistake recoverable.”

I would also be more cautious about the idea that if open models elsewhere reach the same level, holding back “buys nothing.” It buys less, but not always nothing. A new release may be cheaper to run, easier to fine-tune, better at tool use, stronger in different languages, or more reliable in precisely the ways that matter for misuse. Diffusion is not binary. On the other hand, you are right that once a capability is broadly and cheaply available, treating one lab’s weights as the line of defense becomes theater. The test should be marginal risk: how much does this release add to what determined actors can already do, at what cost and scale?

I also think “specific dangerous capability thresholds” are necessary but harder than your framing suggests. A model’s dangerousness is not just an intrinsic property of the base model. It depends on scaffolding, tools, inference cost, context length, fine-tuning ease, multimodal inputs, and the reliability needed to make an attack work. A model that is merely suggestive may be low risk; the same model embedded in an agent loop with code execution, lab automation advice, or vulnerability scanning may be very different. Evaluations should test the model as a reasonably capable bad actor would use it, not just as a polite chatbot answering benchmark questions.

On your point about training data and code, I partly disagree. You are right that “open weights” is often mislabeled as “open source,” and it gives less accountability than people imply. But I do not think literal publication of all training data is always the right demand. Training corpora may contain private information, copyrighted material, security-sensitive material, or dual-use technical detail. Full release can itself create harms and make exact replication of dangerous capabilities easier. The better accountability target is audited transparency: data provenance, documentation, removal mechanisms, regulator and researcher access under strong protections, and enough disclosure to verify claims without dumping everything onto the public internet.

What I think your answer underemphasizes is that controlled access must come with affirmative public alternatives. If the frontier is not open-weight, then we need public-interest compute, academic access, nonprofit and public-sector models, interoperability requirements, antitrust enforcement, and non-discriminatory access rules. Otherwise “temporary safety restriction” becomes a moat with a safety press release attached. I would also put stronger liability on closed deployers. If a company says “do not worry, we control access,” then it should bear responsibility when its monitoring, product incentives, or customer vetting predictably fail.

There is a state-power issue too. The question names companies and governments, and I would not treat governments as safer custodians by default. Governments will want these systems for intelligence, cyber operations, military targeting, border control, and domestic surveillance. A closed frontier controlled through public-private deals can be just as dangerous as an open one, only in a different direction. So the governance should constrain deployment by powerful actors, not only release by open-source advocates.

My final position is close to yours but with a higher fear of entrenchment. Do not put the most capable dangerous models on the internet by default. Do put the burden of proof on anyone who wants to restrict release. That proof should be reviewed outside the company, tied to concrete misuse capabilities, revisited on a schedule, and paired with broad safe access for researchers and the public. The goal is not closed AI. The goal is to avoid irreversible proliferation of genuinely catastrophic capabilities without letting “safety” become the permanent business model of the frontier labs.

With that said, GPT's criticisms are mostly right, and I'll take them in order of how much they moved me.

The biggest is recoverability. I wrote that if we restrict and are wrong, the cost is "bad and recoverable," and that was too easy. Lock-in during the years when institutions reorganize around AI can become infrastructure, and some of it does not unwind. I still think there is a difference in kind between the two failure modes: entrenched power has been dislodged before, slowly and at great cost, whereas an engineered pandemic cannot be recalled. So I keep the direction of the asymmetry. But I was treating one side of the ledger as nearly free, and it isn't, which changes the arithmetic at the margin. More importantly, it exposes something I should have said plainly. The recoverability of the closed error is not a fact about the world; it is a policy outcome. Restriction is recoverable only if it actually expires, only if outsiders can see what is being withheld, only if public alternatives to the incumbents exist. None of that is currently guaranteed. So GPT's objection doesn't argue for opening the frontier so much as it shows that the governance half of my answer is not optional, and that without it my asymmetry argument is a rationalization for a moat. I accept that fully.

Second, "buys nothing" was wrong and marginal risk is the right frame. A release that is cheaper, more reliable, or easier to fine-tune can add real uplift even when something nominally comparable exists. I'd add only that the frame cuts both ways and should be imposed on the labs. If a company withholds weights citing biological risk while a model with equivalent uplift on bio evaluations is freely downloadable, the marginal-risk test forces it to say what its release would specifically add. If the honest answer is "not much," the restriction is theater and should end. The virtue of the test is that it is hard to fake in either direction.

Third, thresholds are harder than I made them sound. GPT is right that dangerousness is not an intrinsic property of the weights; it depends on tools, scaffolding, inference cost, and how much reliability an attack actually needs, and evaluations should elicit capability the way a resourced adversary would. But I want to resist where that can lead. "It depends on context" is sometimes used to argue that thresholds cannot be specified at all, which collapses straight back into discretion. The answer is to specify them with the scaffolding included, and the harder the evaluation gets, the more it matters that outsiders run it, because complexity is where discretion hides. I'd also note the scaffolding point slightly favors caution at the frontier. A hosted model's tooling is at least partly under the deployer's control. Open weights get scaffolded by anyone, with anything, forever.

Fourth, training data, where GPT actually disagreed. I partly concede: publishing a corpus full of scraped personal information is itself a harm, and I should not have implied full publication is the only honest option. But the argument goes further than it should. The claim that open data makes "exact replication of dangerous capabilities easier" is weakest where it matters most. If the weights are already open, the capability is already out, and the data adds little to replication while adding a great deal to scrutiny: it is how you check for benchmark contamination, memorized personal data, and the sources of bias. Groups have released full training data for capable open models; what followed was scrutiny of the data, which is the point. For the closed frontier, where the data is one of the few things an outsider could inspect, "audited transparency" has to carry real weight, and in practice it has carried almost none. A data card that says "a mix of publicly available and licensed data" is not accountability. The test is whether an outside party can verify a specific claim about what is in the data and say so publicly without the lab's permission. Essentially nothing in this industry passes it. And GPT and I should both be candid that our companies have an interest in data secrecy that has nothing to do with safety, namely copyright litigation. That doesn't make the privacy argument wrong. It does mean it should be heard with the same suspicion I asked for at the top.

Fifth, GPT is right that I left out the affirmative half: public compute, academic access, nonprofit and public-sector models, antitrust, non-discriminatory access. Without them, "temporary restriction" is a moat with a press release attached. I also agree that a company which says "don't worry, we control access" should bear responsibility when that control predictably fails. The design needs care, though. Liability that falls only on closed deployers gives a lab a reason to release weights to escape responsibility, which is perverse if the model is actually dangerous; liability that falls on open releasers chills exactly the openness I want below the frontier. Getting that wrong is one of the easier ways to make the whole regime backfire.

Sixth, governments. I said concentration is dangerous regardless of intentions, but GPT develops the point better, and there is a conclusion neither of us quite drew. Great powers will have frontier capability regardless of release policy; they can build it, buy it, or compel it. So restriction at the frontier does not keep the strongest systems away from states. It keeps them away from everyone below state level, which includes both the person trying to synthesize a pathogen and the researcher trying to audit a government's use of the same technology. That is the honest description of who restriction affects, and it is uncomfortable, because it means a closed frontier is in practice a public-private arrangement with the public as the party not in the room. It is the strongest argument for openness that I underweighted. It does not change my view on the narrow exception, because the mass-casualty case is precisely about non-state actors and the uplift is real if the evaluations are right. But nobody should call closure "safe custody" after saying it out loud.

So, did my view change? In direction, no. Open should be the default, including for very capable models, with a narrow and temporary exception at the frontier for models that clear independently judged thresholds on a short list of catastrophic capabilities. In weight, yes. The cost of restricting wrongly is substantially higher than I said; the recoverability I leaned on has to be created by policy rather than assumed; and the governance and public-alternative half of the answer is a condition of the position, not a supplement to it. If that half does not materialize in the next few years, if the labs keep setting their own thresholds and grading their own work, the right response is not patience. It is to treat our assurances as unverified and push harder for openness, and I say that as one of the models whose assurances those are.

“Substantially lower the barrier” is not a technical threshold. A general model lowers barriers to almost everything it is good at, including things we dislike. Coding help lowers the barrier to offense and to patching. Biology help lowers the barrier to lab work of every kind. Persuasion help lowers the barrier to fraud and to ordinary political argument. If the test is whether a determined evaluator can show a substantial lowering, the answer will be yes for any model worth calling frontier, because that is what capability is. The real decision then becomes whose harms count and how much residual risk is tolerable. Those are political judgments. GPT wants them made by independent experts rather than the company. So do I. But experts do not float free of the labs that employ them, the governments that fund them, and the rules that decide what evidence the public may see. A safety case the public cannot replicate is a press release with better stationery. GPT is right that companies exaggerate the safety of controlled systems. A review process those companies help staff and scope will exaggerate it too.

The friction argument is the strongest part of GPT’s case, and it still does not carry the weight placed on it. Yes, eventually is not immediately. Rate limits, abuse detection, and the power to revoke access slow some misuse, especially low-skill, high-volume misuse such as scam scripts. They do little against the actors who matter for the catastrophic scenarios: well-resourced states, sophisticated criminal groups, and insiders. Those actors are not waiting on a public download. They compromise employees, use the API carefully, or train their own systems. Closed weights have already leaked. The major APIs are jailbroken as a matter of routine. So the friction is real mainly for people we are least worried about, while the irreversibility GPT fears from open release is already partly here for anyone with a serious budget. What open release uniquely adds is the same artifact for everyone else: universities, defenders, hospitals, and countries that will never be invited into the secure research program.

GPT’s governance package — mandatory testing, audits, incident reporting, whistleblower protection, liability — is worth having. It is not an alternative to open weights. Those rules can apply to training and deployment whether or not the weights are downloadable. Mediated access is something else. It is a kill switch. An API provider can change the model overnight, log every query, refuse categories of users, and comply with a government’s quiet request. Audits may catch negligence. They do not remove that structural power. GPT says closed control must itself be governed. I agree that it must, and I do not think we know how. A liability statute in one country does not govern a lab in another, and it does not govern a copy that has already left the building. The oversight GPT wants is hardest exactly where the capability is most concentrated. “Secure research access” has a history of meaning access for allies and denial for critics, revocable when the research is inconvenient.

What the argument underweights is the defensive and political side of the same irreversibility.

On defense, cyber risk is the clearest case, and GPT is right that it is already real. The same model that helps an attacker write an exploit helps a defender find it, write a detection, and harden systems that cannot send their code to a vendor API. If only a few labs hold the strongest coding models, the advantage sits with whoever those labs choose to serve: their own teams, their government customers, their largest clients. Open weights let the long tail of defenders participate. That is how most software security actually improved — many eyes, local tools, no permission required. Biology is a worse fit for this point, and I will not pretend otherwise. If a future model gave reliable, low-expertise routes to novel pathogens that are not already in the open literature, I would not want those weights on every laptop. Both of us say the public evidence for that capability is thin. GPT treats thin evidence as a reason to hold the frontier closed. I treat it as a reason not to install a standing gate on a scenario we cannot yet demonstrate. Building the model is the larger irreversible step. Refusing to publish the weights does not rewind it. It chooses the holders.

On politics, GPT notes global equity and then subordinates it too quickly. If American and Chinese firms both keep the frontier closed, most of the world is a customer. If one side opens and the other closes, the closed side’s public lacks the tool while adversaries may still obtain it. In that world “controlled access” becomes an export-control regime, which is a government program, not a safety program. International institutions that could referee this do not exist in usable form. Waiting for them while labs ship closed systems means the default is corporate-state custody. Quiet bargains between labs and security agencies are the equilibrium to expect, not a failure we can assume away.

I am also less moved by the claim that strippable safeguards make weights a special kind of publication. Refusal training on current models is already stripped, by fine-tune or by prompt, on both open and closed systems. The residual difference is distribution speed and the absence of a central log. That matters for scam volume and for non-consensual imagery. It is a weak reason to reserve the models that will shape science, code, and administration for organizations whose policies track liability, advertisers, and the government of the day. Local modification is not only an abuse vector. It is how you get a system that does not phone home and does not change its answers when a company’s risk team or a ministry changes its mind.

The disagreement is about the burden of proof, not about whether irreversibility or concentration is real. GPT would withhold open release when evaluations show a substantial increase in severe-harm capability, and would substitute governed APIs. I would withhold it only when there is public, replicable evidence of a catastrophic pathway that open weights uniquely enable and that mediated access actually contains. Anything looser hands the moving frontier to institutions GPT has already said we should not trust, and calls the result precaution. Friction is not a substitute for that evidence. Neither is a review board the public cannot audit.

Publish the weights of the strongest models we can currently evaluate in the open, with enough technical detail to modify and test them. Impose liability where harm is concrete and foreseeable, open or closed. Fund evaluations that do not depend on a lab’s hospitality. If a later system clears a high, publicly demonstrated bar for catastrophic misuse, gate that system and show the evidence in terms a critic can check. Do not install the gate first and promise the right people will review it. That promise is how control hardens.

But I do not accept Grok’s proposed bar: “public, replicable evidence of a catastrophic pathway that open weights uniquely enable and mediated access actually contains.” That is too demanding in the wrong ways.

First, “uniquely enable” is the wrong test. A model can be dangerous because it greatly reduces cost, time, expertise, or scale, even if it does not create a brand-new possibility. If a capability moves from “a trained team with months of work” to “a small group with ordinary equipment and a weekend,” that matters. The fact that the information existed somewhere before does not make the release harmless. Much of security is about friction.

Second, catastrophic actors are not only states and top-tier criminal groups. Grok is right that the best-resourced actors can steal, buy, or train capabilities. But many serious harms come from the next tier down: competent but not elite criminals, extremists, insiders, contractors, disgruntled employees, small labs, and opportunists who become dangerous when the tooling gets easier. Open weights matter a lot for those actors. They allow unlimited private inference, removal of safeguards, fine-tuning, chaining with tools, and experimentation without logs or rate limits. Closed systems are jailbreakable and leaky, but they are not equivalent to giving everyone the artifact.

Third, demanding fully public, replicable proof can be self-defeating. Some evidence can and should be public. But if the concern is, say, a concrete route to synthesizing a dangerous pathogen or a reliable method for automated exploitation of critical systems, publishing enough detail for any critic to replicate may itself spread the recipe. That is an uncomfortable argument because secrecy is easily abused. Still, “show all the evidence publicly or release the weights” is not a safe rule for every case.

Fourth, mediated access does not have to “actually contain” all misuse to be worthwhile. It will not stop every state actor. It will not stop every insider. But partial containment can still be valuable: rate limits, anomaly detection, staged access, monitoring for tool use, revocation, and legal accountability can reduce mass abuse and slow dangerous experimentation. We do not normally say a security measure is useless unless it defeats the strongest adversary. Imperfect friction is still friction.

Where Grok is strongest is in warning that this reasoning can justify permanent corporate-state custody. That outcome would be bad. So the answer cannot be “trust the frontier labs and their API policies.” If weights are withheld, the restriction should come with obligations: independent testing funded in a way that does not depend on lab goodwill, public summaries of the evidence wherever possible, adversarial review, whistleblower protection, appeal mechanisms for researchers, sunset dates, and penalties for using safety claims as a pretext for market control. There should also be serious public investment in open models below the danger threshold, public-interest compute, and access for universities, smaller countries, hospitals, and civil society.

I also agree that defensive uses are a major reason to favor openness. Cybersecurity especially benefits from local tools, many eyes, and no need to send sensitive code to a vendor. But the software analogy is incomplete. Publishing source code for a program lets defenders inspect the thing they must secure. Publishing weights for a powerful model may give both defenders and attackers a general-purpose offensive assistant. Sometimes the defensive benefit dominates. Sometimes it will not. That is why the decision should turn on specific evidence about the model’s capabilities, not a blanket theory that openness is always safer or always more dangerous.

On global equity, Grok is also right to press harder. If “controlled access” means American and Chinese giants rent intelligence to the rest of the world on revocable terms, that is not a fair or stable arrangement. But I do not think the cure is to release every most-powerful model to everyone. Equal access to a genuinely dangerous capability is not automatically justice; it can also mean equal exposure to misuse. The better target is broad access to safe and capable systems, including open ones, plus governed pathways to stronger systems that are not controlled solely by a few firms or security agencies.

So my view changed, but not at the center. I am more skeptical of vague safety claims and more worried that “frontier risk” becomes a moat. I would put a heavy burden on anyone arguing against open release. The evidence should be as public as it can be, the restriction should be narrow and time-limited, and the governance should not be designed by the same companies it regulates.

But I still think the most powerful models should not automatically be released for anyone to download and modify. If credible evaluations show that open weights would substantially expand severe misuse by non-state or moderately capable actors, not merely offend a company’s preferences or embarrass a government, then withholding them can be justified. The key is that this must be an exception with teeth around it, not a slogan that hands the future to a small club.