That distinction matters more than the shouting. Most coverage has framed this as open source versus closed source, or safety versus freedom. The actual policy content is narrower and more specific, and once you read it in Anthropic’s own words, both the company’s defenders and its loudest critics turn out to be partly right.

The Short Answer: Anthropic Never Proposed a Ban — It Proposed Three Levers

On July 27, 2026, Anthropic published “Our position on open-weights models.” The fifth sentence is unambiguous:

“Anthropic has never advocated for a ban on open-weights models.”

The post goes further. It calls open-weights models that lack dangerous capabilities “a public good” — something that “cost[s] nothing beyond compute” and is “valuable to businesses, developers and researchers.” That is not the language of a company at war with open source. It is the language of a company drawing a line between two categories of model and arguing that only one of them is a problem.

What Anthropic actually asked for instead of a ban was three things:

None of the three is a ban on open weights. All three are aimed at a specific country, a specific practice, and a specific capability threshold. That is why the fight is confusing: the levers are narrow, but their cumulative effect on the open-weight ecosystem is not obviously narrow at all.

The honest summary — and the one this article builds toward — is that Anthropic’s argument contains real technical reasoning and real commercial self-interest, and it has never fully separated the two. So does the industry letter it declined to sign.

What Actually Happened: A Three-Day Timeline (July 20–27, 2026)

The news cycle that produced “Anthropic’s war on open source” ran for one week. The compressed timeline explains why the story escalated so fast, and why the perception of a war stuck even after Anthropic denied one.

• July 20, 2026 — Axios reports that US officials are weighing a ban on US companies using Chinese open-weights models. The same report notes that OpenAI and Anthropic are united on China-restriction policy. (Retrieved from a Wayback snapshot dated 2026-09-22; the live page returns 403.)
• July 24, 2026 — The “Open Weights and American AI Leadership” letter is published on NVIDIA’s servers with roughly 25 initial signatories.
• July 25–26, 2026 — OpenAI, Google and SpaceX add their names over the weekend. Signatories pass 50 within about 48 hours. Their earlier absence had briefly become the story itself.
• July 27, 2026 — Dario Amodei publishes Anthropic’s position post. The signature count on the letter is now above 70 and climbing.
• Now — The letter carries 175 signatories in its signature block, counted programmatically from the PDF itself.

The Axios Report That Started It

The Axios story is what made Anthropic’s later silence on the letter look contradictory. If OpenAI and Anthropic were aligned on restricting use of Chinese open models, then Anthropic declining to sign a letter calling open weights good for America read as an unforced inconsistency — the safety company sitting out the one industry-wide statement about openness.

The distinction Anthropic later drew is that opposing use restrictions on Chinese models is not the same as endorsing open weights as a category. That is a coherent position on paper. It is also a position that arrived three days after the industry had already lined up, which is precisely what critics seized on.

The Letter Anthropic Wouldn’t Sign (175 Signatories)

The “Open Weights and American AI Leadership” letter is short, business-oriented, and deliberately not a manifesto. Its three arguments:

1. Access. Open weights let startups, universities and public institutions build without training from scratch or “paying frontier-model prices for every task.” Frontier-scale capability should be reserved for genuine frontier problems.
2. Competition. “Competition is what keeps the gains of AI broadly shared rather than concentrated in a few hands” — rivalry across models, cloud, chips and applications.
3. Control and sovereignty. Customers want no vendor lock-in, and open weights let organizations own the value they create.

It concedes the central risk explicitly: “Once released, the weights are beyond the original developer’s control, and modified versions are difficult to trace or reverse. But the right response to this risk is not to prohibit open weights.”

Its hardest line is aimed squarely at closed-model incumbents: “Relying solely on closed models is not inherently safe: they can be breached, misused, or fail in ways that outsiders cannot detect. And concentrating advanced AI capabilities behind a small number of closed models compounds that risk.”

The signatory list is the part that made Anthropic’s absence conspicuous. It includes Microsoft, Meta, Google, OpenAI, NVIDIA, IBM, Mistral, Hugging Face, Dell, Palantir, Mozilla, Databricks, Snowflake, Salesforce, ServiceNow, Workday, Uber, DoorDash, Notion, Vercel, Ollama, LM Studio, Red Hat, Intel, AMD, Qualcomm, SpaceX, The Linux Foundation, Andreessen Horowitz, Y Combinator and Nous Research. Every major US frontier lab except Anthropic. Amazon also did not sign, but Amazon is not a frontier model lab in the same sense, so the story attached to Anthropic.

It is worth noting what the letter’s framing invites. “Our AI leadership will be judged not by one frontier AI model, but by whether the United States builds a strong, open ecosystem that diffuses into every sector” is a direct callback to the 1980s open-source fights. That framing makes the holdout look like an opponent of the open ecosystem, whether or not it is one.

Amodei’s Rebuttal, Published Only After the Industry Lined Up

Anthropic’s response arrived on the fourth day. It agreed with parts of the letter and disagreed with two specific claims:

• It disputes that open weights “necessarily make it easier to develop safeguards.”
• It disputes that broad access “necessarily helps defenders more than attackers,” arguing that biology in particular likely has “a strong attacker-defender asymmetry.”

The timing is the part critics keep returning to. Three days of silence, and a response only once every peer lab had signed. That pattern — not the content — is what produced the “war on open source” headline.

What Anthropic Actually Said — In Its Own Words

Strip away the framing and Anthropic’s post makes four moves. Each is worth reading carefully, because the strongest criticism of the post is that it never fully answers the question it raises.

The Concession: Non-Dangerous Open Weights Are “a Public Good”

Anthropic’s stated position is that open weights without dangerous capabilities are a net positive — cheap to replicate beyond compute cost, useful to businesses, developers and researchers. This is a real concession, not a rhetorical feint. A company that wanted open weights banned would not describe them as a public good.

The Two Nightmare Scenarios

Anthropic names two scenarios it treats as genuinely catastrophic:

1. Authoritarian capability. Governments — it names the CCP as “the most capable threat,” while noting it is not the only one — building models more powerful than the US for “permanent military superiority” or deep domestic repression.
2. Misuse and misalignment. Cyberattacks, biological attacks, and alignment failures in models that are widely deployed.

The interesting move is what Anthropic says next about scenario one: it is “irrelevant whether these models are released with open weights,” because “the most dangerous model may be one that is trained in secret and handed only to the PLA.” That is an argument against protectionism as a tool, made by the lab that is most often accused of seeking protectionism.

Why a Usage Ban “Does Nothing” — and Why That Admission Matters

Anthropic’s own words on the proposed US usage ban:

“A US-business usage ban does nothing to address this risk, because bad actors are unlikely to be legitimate US businesses. It would protect US AI companies from competition, but that has never been my goal.”

Read that sentence twice. It is an explicit acknowledgment that the policy under discussion would function as protectionism, paired with a denial of protectionist intent. Whether you find the denial credible depends on how you weigh the next section — because the three levers Anthropic does support each raise costs for competitors, and none of them constrain Anthropic’s API revenue.

Anthropic’s stated alternative to releasing weights is gated access rather than openness: Project Glasswing, launched in early 2026, gives vetted enterprises access to its cybersecurity model instead of publishing the weights. It is a coherent third path, and it is also a path that keeps the capability inside one company.

Lever 1 — Chip Export Controls: The Scaling-Law Argument

Anthropic’s first ask is the least controversial and the most mechanical: no sales of powerful chips or chipmaking equipment to China, plus enforcement against smuggling. The reasoning rests on scaling laws.

China has limited domestic production capacity for leading-edge accelerators. Anthropic’s argument is that because capability scales with compute, a country that cannot buy or build the chips cannot out-train a country that can. Blocking chip supply is therefore, in Anthropic’s framing, “the most efficient and direct way” to prevent an authoritarian government from reaching permanent capability superiority.

This is the lever with the clearest precedent, and it is also the one where the causal chain is longest. Export controls have been in place for years while Chinese open-weight releases have accelerated. In July 2026, Moonshot AI published Kimi K3 — a 2.78-trillion-parameter mixture-of-experts model with a 1M-token context window, the largest open-weight release to date, and the strongest single data point that compute restriction has not stopped frontier-adjacent releases from arriving.

Lever 2 — The Anti-Distillation Crackdown (And the Hypocrisy Charge)

Anthropic’s second ask is to crack down on “industrial-scale distillation” — training a model on the outputs of another model. This is the most technically interesting lever and the most contested.

What Industrial-Scale Distillation Actually Looks Like

Anthropic describes coordinated campaigns run out of DeepSeek, Moonshot AI and MiniMax, totaling roughly 16 million exchanges across about 24,000 fraudulent accounts routed through “hydra clusters” — automated traffic blended with organic queries, with credentials rotated whenever accounts were flagged. Anthropic separately alleged to the Senate Banking Committee that Alibaba carried out “the largest known distillation attack” against it, reported elsewhere as 25,000 fake accounts and 29 million exchanges. Those two figures conflict; treat the range as disputed and do not quote either as settled.

The economics explain why the practice is attractive. Ten to twenty million high-quality exchanges — a few million dollars in API fees — is enough to train a competitive student model on a narrow capability such as agentic coding. Against training a teacher from scratch, that is not a discount; it is a different order of magnitude.

Anthropic’s logic is that distillation is far more compute-efficient than training from scratch, which lets Chinese labs “build much better models than their number of chips would ordinarily enable” and bring their frontier “within a few months of the US frontier.” Even so, the post insists: “a blanket ban on open-weights models is neither the correct remedy nor something we have called for.”

The Training-Data Asymmetry Anthropic Doesn’t Answer

The sharpest criticism of the distillation argument is that it is asymmetric in exactly the way that favors the accuser.

Every frontier model, Anthropic’s included, was trained by ingesting whatever data its developers could obtain. Anthropic paid a large settlement to authors over its use of a “pirate library” of books. The company now wants distillation of its own outputs treated as theft. On the narrow factual question of whether Anthropic’s training data was itself obtained cleanly, critics are on solid ground, and Anthropic’s post does not address the charge.

The counterargument is that these are different legal questions, and it is stronger than it first appears. Distillation of API outputs is a contract matter, not a copyright matter. When a developer calls the Messages API, they accept terms of service; if those terms forbid using outputs to train a competing model, the restriction is enforceable as a contract regardless of what copyright law says about training on public text. The fair-use defense that protects training on scraped web text does not automatically extend to outputs governed by an agreement the customer signed.

That is the honest shape of the dispute. It is not “hypocrisy versus principle.” It is two different legal regimes, and each side is arguing under the one that suits it.

The broader consequence is the one to watch. If anti-distillation enforcement becomes a regulatory priority rather than a terms-of-service matter, it touches standard practice. Fine-tuning on API outputs is how a large share of production-grade narrow models get built today. A regime that makes that practice risky — legally, contractually, or through detection and account termination — raises the cost of building on top of any frontier API.

Lever 3 — Mandatory Safety Testing: Standard, or “a Ban With More Steps”?

Anthropic’s third ask is pre-release testing for cyber, biological and alignment risks, applied to all sufficiently capable models regardless of origin or openness, with exemptions for less capable startup and academic models. Anthropic describes this as “close to a consensus” and cites UK AI Security Institute work and joint Anthropic–AE Studio research on modular training strategies.

The proposal is the most reasonable-sounding of the three, and the criticism of it is the most procedural. The post does not specify:

• Who administers the test. No named agency, body or certification regime.
• What the threshold is. “Sufficiently capable” is never defined by a measurable criterion.
• What happens on failure. No stated consequence, appeal path or remediation process.

A mandate with no administrator, no threshold and no consequence is not a policy; it is a placeholder. Two readings are available. The generous one is that Anthropic is laying out a principle and leaving the mechanics to legislators, which is a normal thing for a company post to do. The suspicious one is that an unstated threshold is a threshold that gets set later, by whoever writes the rules, and that a compliance-cost barrier favors incumbents with legal teams over open-weight challengers who publish weights and walk away. Both readings are defensible from the text.

Evidence From Anthropic’s Own Products: The Fable 5 System Card

The abstract debate about what a testing regime might do becomes concrete when you read what Anthropic already ships. Claude Fable 5’s system card, Section 1.5, documents a classifier-based safeguard system that applies to four topic classes:

1. Cybersecurity
2. Biology and chemistry
3. Distillation attempts
4. “Accelerating frontier AI development”

Four Classifier Categories, Three Different Behaviors

The card describes three separate user-visible behaviors depending on which surface the request arrives through:

The frontier-development classifiers are described as narrowly targeting “frontier LLM development (for example, on building pretraining pipelines, distributed training infrastructure, or ML accelerator design)” — and Anthropic states they should not affect the vast majority of AI development.

The Fallback You Can’t Configure

The third row of that table is the one enterprise buyers should read carefully. On some surfaces, a classifier hit silently routes the request elsewhere, and the only signal is a session event. If you are paying for a specific model and building against its documented behavior, a non-configurable, quiet substitution changes your product’s behavior without changing your code.

That is a concrete commercial fact, not an ideological one. It is the argument that the more abstract open-versus-closed framing tends to crowd out: what matters to a buyer is whether the product they paid for behaves the way it is documented to behave.

“Using Claude to Develop Competing Models Already Violates Our Terms of Service”

The distillation classifier has an explicit rationale in the card:

“Using Claude to develop competing models already violates our Terms of Service, but enforcing this restriction through classifiers avoids accelerating the actors most willing to violate these terms.”

This is a useful line because it clarifies the commercial logic. The restriction is not new policy — it is existing policy, now enforced automatically. The stated reason is that manual enforcement selectively punishes the actors least willing to break the rules, so automated enforcement is fairer. The stated reason is coherent. It is also, unavoidably, enforcement that happens to land hardest on the companies Anthropic competes with.

Who Objected, and Why It Got Personal

Sacks, Gurley, Kai-Fu Lee, and Anthropic’s Own Engineer

The reaction to Anthropic’s position was unusually personal for a policy debate. Four examples:

• David Sacks, White House AI and crypto adviser, has repeatedly accused Anthropic of “running a sophisticated regulatory capture strategy based on fear-mongering.” After the letter, he posted: “The entire tech industry, except Anthropic, has publicly supported open-source AI.”
• Bill Gurley of Benchmark said the real problem with open weights “is it competes with their corporate economic strategy.”
• Kai-Fu Lee of 01.AI noted: “who DIDN’T sign the Open Weight letter is far more interesting than who did.”
• Peter Steinberger of OpenClaw called out the silence on openness while noting that OpenAI — the company whose “Open” branding had long been a punchline — signed the letter.

Then there is the internal one. Anthropic staffer Julian Schrittwieser posted mocking replies the day the letter went up — “looking forward to the CUDA and GPU driver open source release!” — before clarifying: “I actually think open models can be very useful! But it’s interesting how some historically extremely open source companies are suddenly all in favor of openness.”

That clarification is the sharpest thing written about this controversy, and it cuts both ways. He is right that NVIDIA, Microsoft and Meta are not obviously the natural constituency for open weights. He is also, by implication, describing Anthropic’s own coherence problem: it publishes a large volume of safety and interpretability research openly, and has never released a single weight.

On the Hacker News thread for Anthropic’s position post — 1,180 points and 1,747 comments — the dominant reactions were regulatory-capture accusations (“As expected they will try hard to use government to kill competitors”) and hypocrisy claims about distillation (“The ban on distillation seems hypocritical”), with a minority defending the risk framing. That distribution is a reasonable proxy for how the technical audience read the post.

The Data Nobody Leads With: Open Models Win Volume, Frontier Labs Keep Spend

The most useful practical finding in this entire debate is not about policy at all. It is about token economics, and almost nobody leads with it.

Token Volume vs Token Spend on Vercel’s Gateway and OpenRouter

Open-weight models are winning usage. They are not winning revenue.

On Vercel’s AI gateway, DeepSeek surged to lead token volume at just over a third of all tokens, with Z.ai’s GLM-5.2 fourth. On OpenRouter, DeepSeek V4 Flash processed roughly 5.3 trillion tokens weekly versus about 2.0 trillion for Opus 4.8, the most popular frontier model.

Now the spend side. Anthropic still accounted for more than half of overall AI spend on Vercel’s gateway, down only slightly month over month. The reason is price. Opus 4.8’s token cost is roughly 23x higher than DeepSeek V4 Flash’s, so a lab can lose the volume war by a factor of 2.6 and still win the revenue war by a wide margin.

The ~120x Price Spread, and the Two-Tier Model Economy

The live OpenRouter catalogue as of October 1, 2026 lists 462 models, 16 of them :free variants — open weight is a large share of supply, not a fringe. The price spread across that catalogue is what makes the two-tier economy function:

That is a spread of roughly 120x from top to bottom. Kimi K3 — the largest open-weight model ever shipped at 2,779,931,837,184 parameters, with 1,302,723 downloads and 11,562 likes on Hugging Face and a modified-MIT license requiring a separate agreement for Model-as-a-Service vendors above $20M revenue — costs about 18x less per input token than Opus 4.8.

The Decagon CEO Jesse Zhang, quoted by TechCrunch, described the resulting pattern as a two-phase life cycle: frontier models prove out use cases, which then migrate to cheaper open models as they mature, while new use cases keep arriving and hold frontier spend roughly flat. His summary: “The frontier labs will keep owning discovery. Open source will increasingly own production.”

Why “Not Hurting Anthropic Yet” Is the Honest Headline

If that framing is right, the two-tier model economy may be a stable feature rather than a transition phase. Open models commoditize the production tier — the high-volume, well-understood workloads — while frontier labs keep the discovery tier, where buyers pay for capability they cannot get elsewhere.

This is the strongest argument against Anthropic’s urgency, and it comes from Anthropic’s own business results rather than from an ideologue. If open weights were an existential competitive threat, the spend data would show it. It does not. It shows a company losing volume share and retaining spend share, which is what a company in the premium tier of a commoditizing market should expect.

The Case for Withholding Weights — Steelmanned

The strongest version of Anthropic’s position, stated without the framing:

1. Irreversibility is real. Anthropic’s own footnote concedes the asymmetry directly: open models present higher risk “because it is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn.” A closed model can be patched, rate-limited or withdrawn. A released weight file cannot.
2. Cyber capability is converging fast. UK AI Security Institute evaluations in mid-2026 put the cyber capability gap between frontier and best open-weight models at 4–7 months, down from 6–10 months a year earlier. Anthropic reads that as: release a frontier open model today and you hand everyone 2027 capability. The trend is real even if the interpretation is contested.
3. Biology may be attacker-favored. This is Anthropic’s most specific technical claim and the one the letter does not rebut: if biological capability has a “strong attacker-defender asymmetry,” then the “defenders need parity” argument does not hold for that domain.
4. Testing all models equally is not, on its face, protectionism. A rule that applies to open and closed models alike is a burden on everyone, including Anthropic.

The Case for Open Weights — Steelmanned

The strongest version of the opposing case:

1. Concentration is its own risk. The letter’s hardest line is correct: closed models “can be breached, misused, or fail in ways that outsiders cannot detect,” and concentrating capability behind a few closed models “compounds that risk.” A single point of failure in a system that important is not a safety property.
2. Concrete defense use case, not abstraction. Hugging Face reported that it used an open-source model from China’s Z.ai to defend against a security incident involving a rogue OpenAI AI agent, because restrictions made closed models unavailable for the task. That is one paragraph of evidence doing more persuasive work than any amount of policy prose: when defenders needed capability, openness is what gave it to them.
3. Withholding buys a moat, not safety. The coalition reads the same capability-gap trend Anthropic reads and reaches the opposite conclusion. If the gap narrows on its own — 6–10 months to 4–7 months in a single year — then withholding weights delays the arrival of a capability that was going to arrive anyway, while extending the incumbent’s lead. On that reading, the safety benefit is small and the competitive benefit is large.
4. Restrictions build the wrong ecosystem. Techdirt’s Mike Masnick made the point sharply: restricting the open ecosystem “would guarantee that the wider open ecosystem gets built on non-American tools.” The best open-weight models come from China partly because releasing weights is the most effective path to becoming the default infrastructure for the next generation of tooling — the Linux-of-AI argument. A policy that pushes developers away from US models strengthens exactly the labs it is meant to constrain.
5. Testing without thresholds is a moat. As covered above, an unspecified “sufficiently capable” bar with an unstated administrator and no stated consequence is a rule whose cost lands on whoever cannot afford to litigate it.

What It Means for Developers and Enterprise Buyers

Set the geopolitics aside. Three things in this story change what you should do this quarter.

If You Fine-Tune on API Outputs

Fine-tuning on API outputs — distillation, in Anthropic’s framing — is standard practice for building narrow production models. Anthropic’s system card is explicit that using Claude to develop competing models already violates its terms of service, and that classifiers now enforce this automatically.

The practical exposure is narrower than the rhetoric suggests: if you are not building a competing frontier model, the classifiers are documented as narrowly targeting pretraining pipelines, distributed training infrastructure and accelerator design. But three questions are worth answering before your next fine-tune:

• Does your provider’s ToS restrict training on outputs, and does it restrict it only for competing models?
• Are your outputs attributable to a single provider, or aggregated across several?
• If anti-distillation enforcement becomes regulatory rather than contractual, does your training data lineage survive an audit?

If You Deploy Open-Weight Models Internally

The cost case is now overwhelming for the production tier. DeepSeek V4 Flash at $0.042 per million input tokens against Opus 4.8 at $5.00 is a 120x spread, and Kimi K3 — 2.78T parameters, 1M context — sits at $0.28 while holding 1.3 million downloads. If your workload is high-volume and well-specified, the two-tier economy says your inference should be running on the open tier.

The risk case is not technical; it is regulatory. Every lever in this debate is aimed at the supply chain behind Chinese open-weight models. A dependency on that supply chain is a dependency on chip export policy, distillation enforcement and testing mandates resolving in a particular direction. Portfolio your model dependencies the way you portfolio any other single-source risk.

If You Route Frontier-AI-Development Requests Through Claude

This is the most immediately actionable item and the one most likely to surprise teams. If your product asks Claude to help build ML infrastructure, write distributed training code or work on accelerator design, you may be hitting a frontier-development classifier. Depending on your surface, the result is a fallback to Opus 4.8 with a notification, a structured block, or — on some interfaces — a non-configurable fallback that emits only a session event.

Test your integration for that third case explicitly. A silent model substitution is the kind of behavior that produces a bug report six weeks later about “the model got worse,” with nothing in the logs.

GRAM and Modular Training: The One Proposal That Could Satisfy Both Sides

There is exactly one genuinely new technical idea on the table, and it is underreported: Anthropic’s GRAM research — Gradient Routed Auxiliary Modules — attempts to sequester dual-use knowledge into switchable parameters that can be deleted at deployment without degrading general reasoning.

If that works, it dissolves the core dilemma. A lab could release weights under a permissive license while structurally excising the cyber or bio capability that makes the release dangerous, and both sides could claim a win: open weights ship, and the specific capability Anthropic objects to does not.

Anthropic cites this work alongside UK AI Security Institute research as a possible path to making open weights safer. The honest caveat is that it is research, not a product, and “delete the dangerous capability, keep the general reasoning” is the kind of claim that sounds clean in a paper and gets messier in evaluation. But it is the only proposal in this entire debate that does not require someone to lose.

How to Read This Debate Without Taking a Side

Four rules that hold up under both readings of the evidence:

1. Separate the levers from the framing. “Anthropic is at war with open source” and “Anthropic never proposed a ban” are both defensible statements about different things. Judge the three levers on their specifics — who pays, what threshold, what consequence — not on the tone of the post announcing them.
2. Check the coherence problem on both sides. Anthropic publishes research openly and has never released a weight. Microsoft and Meta signed a letter calling open weights essential while keeping most of their own frontier weights closed and building their fortunes on proprietary software. Anthropic’s own engineer said it best: it is interesting how historically un-open companies are suddenly all in favor of openness.
3. Follow the spend, not the volume. Token volume leadership by open models is real and largely irrelevant to the question of whether open source is threatening frontier labs. Spend is the metric that answers that question, and spend still favors the frontier labs by a wide margin.
4. Treat the capability gap as the pivot. Everything in Anthropic’s argument depends on whether the frontier-to-open cyber gap (4–7 months, down from 6–10) keeps narrowing. If it does, withholding weights buys a moat and little else. If the gap closes, a single release hands everyone 2027 capability. Both trajectories are live, and no one in this debate knows which one is happening.

FAQ

Is Anthropic trying to ban open-weight models?

No. Anthropic’s position post states verbatim that “Anthropic has never advocated for a ban on open-weights models,” and calls open-weights models without dangerous capabilities “a public good.” What Anthropic supports instead is three narrower measures: chip export controls on China, enforcement against industrial-scale distillation, and mandatory pre-release safety testing for sufficiently capable models. Each of those raises costs for open-weight competitors, which is why the “war” framing persists despite the explicit denial.

What is the difference between open weights and open source?

Open weights means the trained parameters are published and can be downloaded, run and fine-tuned. Open source, in the traditional software sense, means the training code, data pipeline and licence permit modification and redistribution. Most “open” AI models are open-weight but not fully open source: Kimi K3, the largest open-weight release to date at 2.78 trillion parameters, ships under a modified-MIT licence that requires a separate agreement for Model-as-a-Service businesses above $20M in trailing revenue. The distinction matters because policy debates often use the two terms interchangeably when the obligations are quite different.

Why didn’t Anthropic sign the Open Weights and American AI Leadership letter?

Anthropic has not given a mechanical explanation of the decision, but its position post sets out two explicit disagreements with the letter’s argument. It disputes that open weights “necessarily make it easier to develop safeguards,” and it disputes that broad access “necessarily helps defenders more than attackers,” arguing biology in particular likely has “a strong attacker-defender asymmetry.” The letter, published July 24, 2026 with 175 signatories including every other major US frontier lab, never addresses that asymmetry directly.

Is it legal to fine-tune a model on another model’s outputs?

It depends on the contract, not on copyright. Distillation of API outputs is governed by the terms of service you accepted when you called the endpoint. Anthropic’s Claude Fable 5 system card states plainly that “using Claude to develop competing models already violates our Terms of Service,” and that classifiers now enforce this automatically. Training on publicly scraped text and training on a competitor’s API outputs are different legal questions — the fair-use defense that applies to the former does not automatically cover the latter, which is exactly why the two sides of this debate keep talking past each other.

Which labs have released open weights, and which haven’t?

Every major frontier lab has released open weights at least once — Meta with Llama and later releases, Google with Gemma, xAI with Grok weights, Mistral across its entire existence, Microsoft with Phi, NVIDIA with Nemotron, and OpenAI with GPT-2, Whisper and gpt-oss. Anthropic has released none, which is the single most-cited piece of evidence in the regulatory-capture argument against it. The counterpoint is that most of those releases are partial: the signatories with the strongest open-weights rhetoric keep their most capable models closed.

Will these policy levers actually stop Chinese frontier models?

The evidence so far says not yet. Export controls have been in force for years while Chinese open-weight releases accelerated: Kimi K3 shipped in July 2026 at 2.78 trillion parameters with a 1M-token context window, the largest open-weight model ever released, and GLM-5 was trained entirely on Huawei Ascend chips with no NVIDIA hardware at any stage. The UK AI Security Institute’s mid-2026 evaluations put the cyber capability gap at 4–7 months, narrowed from 6–10 months a year earlier — which is precisely the trend Anthropic cites as urgent and the open-weights coalition cites as proof that withholding weights achieves nothing but a delay.

Conclusion: A Fight Over Levers, Not a Ban

Anthropic is not at war with open source, and it is not a neutral party either. Both of those statements are true at once, which is why this debate has produced so much heat and so little agreement.

What Anthropic actually proposed is three levers — chip controls, distillation enforcement and testing mandates — each aimed at a specific threat and each carrying a specific cost that lands on open-weight competitors. None of them constrains Anthropic’s own API revenue. That asymmetry is the strongest evidence for the regulatory-capture reading, and no amount of technical framing erases it.

What Anthropic actually conceded is equally real: that most open weights are a public good, that a usage ban would function as protectionism and would miss the actual threat, that released weights cannot be withdrawn, and that the frontier-to-open cyber gap is narrowing on its own. Those admissions make the purely cynical reading hard to sustain.

The practical takeaway for anyone building on these models is not to pick a side but to notice what is already true. Open weights have won the production tier on price — a 120x spread between the cheapest and most expensive options on OpenRouter — while frontier labs still capture the majority of spend. Anthropic’s classifiers already route around some requests today. And the whole argument turns on a capability gap that is closing at a rate nobody can control. Build for both trajectories: keep the open tier for volume, keep the frontier tier for discovery, and portfolio the regulatory risk the same way you would any other single-source dependency.

If you want to see the open-weight side of this market in more depth, the Kimi K2 vs Claude vs GPT-5 coding comparison, the GLM-5 developer review and the local deployment guide to Ollama and LM Studio cover what these models do in practice.