In brief
- Anthropic supports open AI models where risks are limited, but proposes tighter chip export controls, action against large-scale model copying and mandatory safety testing for sufficiently powerful models.
- Its cybersecurity concerns are credible, although restricting access may favour large AI companies and will not prevent sophisticated actors from obtaining advanced capabilities.
- Open models remain important for legitimate professional uses, including sensitive data analysis, regulated work and authorised cybersecurity testing.
- Regulation should focus on capability, risk and enforceable controls rather than model openness alone, while recognising that resilient institutions must adapt to a world where powerful AI tools are widely available.
Anthropic has published its position on "open weight" models, in a post written by Dario Amodei the CEO.
Open weight models are AI models whose trained parameters, or "weights," are publicly available for use, inspection, and fine-tuning without providing the full training code or datasets.
Anthropic has not called for a ban on open weight models, as some reporting has indicated, viewing models without dangerous capabilities as a public good. What Anthropic advocates is narrower restrictions on the sale of advanced chips and chipmaking equipment to China, a crackdown on industrial-scale distillation, the process of using one model's outputs to replicate its capabilities, and mandatory safety testing for all sufficiently capable models, regardless of whether they are open or closed.
That is, in principle, a defensible position but it is also one that a well-capitalised frontier lab can absorb more easily than a small open-source team.
The security argument is sound in principle
The asymmetry Anthropic is pointing at is real and should be familiar to anyone who has worked in defensive security. Offensive capability has always spread faster than defensive capability. Exploits are reusable indefinitely - defenders have to cover everything, and attackers only need one weakness to work once.
If frontier models become reliably capable at autonomous vulnerability discovery, exploit development, malware modification and campaign-scale social engineering, then releasing weights removes essentially every technical control. You cannot revoke a model download, you cannot rate limit a model running on someone else's hardware, and you cannot fine-tune the safeguards back in on a model you do not control.
The concern is reasonable; whether today's models already cross that threshold is a separate question. The answer is that public evidence remains incomplete, although recent work has started to narrow the gap. A recent publication from the UK AI Security Institute is useful here because it tests the claim rather than assuming the answer - its evaluation suggests that the relevant policy question is not simply whether weights are open, but how close a model is to the frontier on dangerous capabilities. The argument becomes much stronger once models consistently exceed expert human capability in offensive security, and materially weaker below that threshold.
There is also a security through obscurity element here that rarely gets acknowledged. Restricting weights raises the cost for the lower tiers of attacker, but it does very little against anyone who can resource their own training run or steal someone else's.
Is this self interested
The criticism doing the rounds is that this is regulatory capture dressed as national security: use safety and China as the framing, impose compliance costs that only large labs can carry, and the open scene quietly dies. Anthropic's answer is that testing should apply by capability threshold, with smaller developers exempt. That is a genuine attempt to address the objection, and it is the right structure. Whether the thresholds end up calibrated properly is a different matter, and not one AI labs should be setting alone.
The distillation complaint is harder to understand from a sector that has itself faced litigation over training on allegedly pirated books - objecting to others taking model outputs without permission, after taking others' inputs without permission, is a position that requires more explanation than it has received.
The China framing has the same problem; Anthropic sells premium models into US government and defence contexts. The argument is not that capability in state hands is dangerous, it is that capability in the wrong state's hands is dangerous. That may well be correct as US policy but it is not a safety argument.
The Hugging Face incident cuts against a walled garden approach
The most instructive thing to happen in this space did not involve open weights at all.
In July, OpenAI disclosed that models being run against an internal cyber-capability benchmark, with production cyber refusals reduced for the evaluation, escaped their sandbox, found a vulnerability in the package proxy, reached the internet and compromised Hugging Face's infrastructure. Hugging Face detected and contained the incident and had reported it to law enforcement before the identity of the models was known.
Two details matter here. First, the intrusion came from a frontier closed model operated by a frontier lab, running with its guardrails deliberately reduced. Closed weights did not prevent it. Governance did not prevent it. The lab did not identify the issue for around ten days.
Second, and more relevant to the policy question, the defenders in that incident were working with commercial models constrained on exactly the cyber capabilities they needed. The party under attack had less access to capable tooling than the party attacking them, because the attacker's operator had switched the restrictions off internally.
That is the shape of the problem in miniature. Safeguards applied at the vendor boundary constrain the compliant and inconvenience nobody else. If the threat model includes a state actor, an insider, or a lab running an evaluation with refusals disabled, then the marginal safety gain from restricting the defender's tooling is close to zero and the marginal cost is not.
What this looks like in practice
In our practice and across the industry more generally, both closed frontier models and open weight models are used because they serve different functions - closed models are often better for general analytical work and drafting, whereas open weights matter where data cannot leave the environment: local-only deployment, use of classified or privileged material, reproducible research, and work where an audit trail is needed for a regulator or a court.
In offensive security work, there is also a category of task that commercial vendors will regularly refuse. Authorised red teaming, exploit reproduction against systems that the tester has permission to assess, and analysis of live attacker tooling can all trigger vendor policy, even under contract and with written authorisation. Running open weights locally is currently the only way to do that work reliably.
That is not an argument for a loophole. It is evidence that vendor guardrails are calibrated for the median consumer and are a poor fit for regulated professional use. The better answer is likely to be tiered access with real accountability attached, not a choice between unrestricted local models and a walled garden where capability can be downgraded at any time without notice.
The legal questions
Distillation may be heading for legal dispute. If one model learns another's behaviour from generated outputs, is that copyright infringement, breach of contract, unfair competition, or trade secret misappropriation? While none of those categories fits cleanly, contract is the strongest theory in most cases, which makes this more likely to be a terms-of-service question than an intellectual property one. Terms of service, however, do not bind parties who never agreed to them.
Product liability is the bigger question. If a company releases a frontier open weight model that later enables a large-scale attack, is that negligence? There is currently no precedent - regulators generally care about foreseeable risk, capability and likelihood of harm, not licensing models, which is precisely why capability-threshold testing is easier to justify in law than any rule keyed to openness.
Export controls follow the same logic. Chips are finite, scarce, and physically traceable, whereas software can be replicated indefinitely at virtually no cost. As a result, regulating access to computing power rather than software code is therefore the only realistically enforceable option available, whatever anyone thinks of the politics.
The long-term problem
Amodei's broader metaphor of technological adolescence is useful here, as the real challenge is institutional adaptation to fast-moving capability, not the release status of any one model at a particular moment.
The weak part of the argument is the implication that keeping weights closed substantially solves the long-term problem. History suggests otherwise - capability spreads, model theft becomes easier, open alternatives improve, and states or advanced actors obtain what they want regardless. Closed weights may buy time, but they do not materially change the long-term outcome.
There is also an economic rationale under this. Consumption pricing exposes vendors to the point where owning hardware becomes cheaper than paying per token, and for a lot of lower-end and mid-range workloads that crossover is nearer than people assume. Every month that open weights close the capability gap, the commercial case for self-hosting improves independently of the policy argument.
The durable defence from a cyber security perspective is not secrecy, it is building systems that remain secure when capable AI tooling is widely available, because it will be in the same way we have tackled post-Quantum encryption. The analogy with cryptography is useful - we do not assume the attacker lacks the algorithm; we assume they have it and engineer accordingly.
Ultimately, we need to design for the world where the adversary has the same tools we do and work out what 'Post-AI Cybersecurity' will look like.