Jensen Huang ran Nvidia for thirty three years without a Twitter account. On July 24 he opened one, and the first thing he posted was a policy document.
The letter is called "Open Weights and American AI Leadership." It argues that the United States should keep building open-weight models alongside closed frontier ones, that distillation is a normal engineering technique rather than theft by definition, and that broad restrictions on open models would push innovation offshore instead of making anyone safer. It opens by invoking the open-source software movement of the 1980s, which was supposed to be impossible and instead became the substrate of the internet and a good deal of US federal and military infrastructure.
“It never mentions China. That omission is doing a lot of work.
Twenty five organizations signed at launch. Within hours the interesting part was not who signed but who had not, and then that changed too.
OpenAI folded by dinnertime
Sam Altman quote-posted Huang on Friday morning with a line about wanting the US to win in both open source and proprietary models, and that he was glad to see this. It read as an endorsement of a letter his own company had declined to put its name on. Someone attached a community note to the post pointing out that OpenAI had refused to sign.
By Friday evening OpenAI was on the list. Bloomberg's Tae Kim reported the company had confirmed it directly, and added the line that framed the whole weekend: your move, Anthropic.
The roster has kept growing since. It now runs to thirty five names and includes Cisco, Cohere, DoorDash, Fireworks AI, GitHub, Nous Research, OpenClaw, Palo Alto Networks, and Prime Intellect alongside the original group of Nvidia, Microsoft, Meta, IBM, Dell, Palantir, Mistral, Mozilla, Hugging Face, Replit, ServiceNow, CrowdStrike, Perplexity, the Linux Foundation, Andreessen Horowitz, and Y Combinator.
Within hours the story was the holdouts. Then OpenAI joined, leaving Anthropic alone at the front of the list of who didn't.
Four notable absences remain. Amazon has stayed out despite running AWS. Elon Musk quote-posted his full support without putting SpaceX or xAI on the document. Google is out, which is its own story and we will come back to it.
And Anthropic, which is now the most prominent American AI company not on the list.
Why the letter appeared this month
On July 16, Beijing-based Moonshot AI released Kimi K3. It is a 2.8 trillion parameter mixture-of-experts model that fires only 16 of its 896 experts per token, reads a million tokens of context, and handles images and video natively. Moonshot calls it the first open 3T-class model, taking that title from DeepSeek's 1.6 trillion parameter V4 Pro.
The numbers got attention fast. K3 debuted at number one on LMArena's Frontend Code leaderboard with 1679 Elo, ahead of Claude Fable 5, a seventeen place jump from Kimi K2.6 at number eighteen, and first place in six of seven frontend domains. On Artificial Analysis's private long-horizon knowledge work evaluation it scored 1547 Elo, up 732 points from K2.6, trailing only Fable 5. Cost per task came in at $0.94, roughly half of Claude Opus 4.8 at $1.80 and slightly under GPT-5.6 Sol at $1.04.
An open-weight model from a Chinese lab is losing to exactly two models on earth, both closed, both released in the last seven weeks, both priced several times higher.
Moonshot's own benchmark tables have K3 beating Opus 4.8 and GPT-5.5 while losing to Fable 5 and Sol. That is a self-report, so treat it as marketing until independent evaluations land. Ryan Greenblatt, who is not prone to hype, placed K3 roughly at Opus 4.8 with the caveat that it looks somewhat more benchmaxxed than its scores suggest.
Even with that discount applied, the position is new. An open-weight model from a Chinese lab is losing to exactly two models on earth, both released in the last seven weeks, both closed, both priced several times higher. Fable 5 runs $10 per million input tokens and $50 output. Sol runs $5 and $30. K3 lists input between $0.30 and $3.00.
The weights are due Monday, July 27. Until that file exists, K3 is an API product with an open-weight roadmap.
The gap has a number now
For two years the open versus closed argument ran on vibes. It does not have to anymore.
Epoch AI measured the lag between the best open-weight model and the closed state of the art at an average of four months, or eight points on its Epoch Capabilities Index, from January through May 2026. Under a stricter comparison rule that stretches to six months.
The UK's AI Security Institute published its first public analysis of the same question on cyber capability. GLM-5.2, released in June 2026, matched Claude Opus 4.6 from February on seventy narrow cyber tasks and Opus 4.5 from November 2025 on longer-horizon cyber ranges, putting it four to seven months behind. Through most of 2025, AISI's internal evaluations put the same gap at six to ten months. AISI plans to test Kimi K3 once the weights land.
Closing in calendar time
- ~4 months average open-to-closed lag (Epoch, Jan-May 2026)
- 6 months under a stricter comparison rule
- 4-7 months behind on cyber (UK AISI), down from 6-10 in 2025
Widening in capability
- Benchmark lead grows for the best closed model (Stanford AI Index, 2026)
- Up from ~2024, when the same gap was near parity
- Both true if the frontier and the trailing pack are both accelerating
Depending on which instrument you trust, the gap is either closing in time or widening in capability. The frontier is accelerating; the pack is accelerating faster.
There is a counterpoint in the data that open-weight advocates skip. Stanford's 2026 AI Index tracked the benchmark gap between the leading closed and leading open model widening over the same period it narrowed in calendar time. Depending on which instrument you trust, the gap is either closing in calendar time or widening in capability terms. Both can be true if the frontier is accelerating and the trailing pack is accelerating faster.
Huang has his own number for why this matters commercially. At Nvidia's CES press session in January he said one in every four tokens generated today comes from an open model.
What Washington did in six days
The trial balloon
Axios reports that parts of the Trump administration had explored ways to restrict American access to advanced Chinese open-source models.
Treasury raises sanctions
Secretary Scott Bessent says Chinese AI firms could face sanctions and Entity List designation for improperly distilling US models, citing US watermarks found inside Chinese systems. "Open source is not open season on American IP."
The distillation allegation - and the pushback
Science adviser Michael Kratsios alleges Moonshot built K3 by distilling Anthropic's Fable model at industrial scale via a detection-evading platform, and obtained export-banned GB300 chips through Thailand. The same day, nearly 200 startups (the new Little Tech Association, with Y Combinator and Proton) ask for "a scalpel rather than a sledgehammer."
Huang's post, and the letter
Huang's first-ever X post draws more than 11 million views. The open-weights letter goes live with 25 signatories.
Suhail Doshi, founder of Particle, put it to Politico without the diplomacy: hundreds of companies would die instantly, it would be great for Anthropic, and everyone would end up spending money on Anthropic.
A White House official has since called reports of a ban baseless speculation and said a blanket prohibition was never seriously discussed. Kratsios has emphasized that the administration supports a competitive ecosystem spanning frontier models, open-source frameworks, and open weights, and that his complaint is with covert industrial-scale extraction rather than distillation as a technique. Commerce's export-control arm has opened a formal inquiry into whether Chinese firms are obtaining restricted US chips.
The ban is talk. But the talk moved fast enough that two hundred companies organized in forty eight hours - which tells you how thin the margin is underneath a lot of AI products.
The case that the frontier labs are working the referee
Days after K3 landed, OpenAI strategy chief Dean Ball predicted on X that Washington would create regulatory risk around Chinese open-weight models. It was widely read as endorsing a fear-and-doubt campaign, and he walked parts of it back. David Sacks, until recently the White House AI czar, called it a weaponization of regulatory uncertainty and described the leading closed labs as a revenue duopoly that wants the government to eliminate its open-source competition.
Anthropic has been the most active company in Washington on this issue, and it has receipts.
In February 2026 it published a detailed accusation that DeepSeek, Moonshot AI, and MiniMax ran coordinated campaigns against Claude, generating more than 16 million exchanges through roughly 24,000 fraudulent accounts. MiniMax accounted for over 13 million, Moonshot for more than 3.4 million, DeepSeek for more than 150,000. In a June 10 letter to the Senate Banking Committee, Anthropic alleged operators tied to Alibaba's Qwen lab ran 28.8 million exchanges through about 25,000 fake accounts over a 44 day window, more than the entire February set combined. Anthropic's policy head told senators the activity was carried out illicitly, systematically, and at industrial scale.
Those are Anthropic's figures, not independently verified ones - and attributing tens of thousands of accounts to a corporate parent is an interpretive step, not a fingerprint.
Those are Anthropic's figures, not independently verified ones, and attributing tens of thousands of accounts to a corporate parent is an interpretive step rather than a fingerprint. Alibaba says it does not train on proprietary model outputs.
The company has also acted commercially. In September 2025 it changed its terms of service to block any entity more than fifty percent owned by companies headquartered in unsupported regions, the first major restriction based on corporate ownership rather than geography. Zhipu and Alibaba responded within days by shipping migration toolkits and free token allowances aimed at the customers Anthropic had just cut loose.
Dario Amodei's public position has been consistent for years. He told Congress that the scaling of open source models is going down a very dangerous path, and has more recently called open source a red herring, arguing that it does not work the same way in AI as it has in other areas.
Nathan Lambert, who writes Interconnects and has spent years building open models, describes the pattern bluntly. He argues the anti-Chinese-model campaign is led by Anthropic, that the technical evidence shared publicly has been thin relative to the policy asks attached to it, and that whatever it started as, it has become the definition of regulatory capture, since Anthropic gains substantial economic security if the labs it names are banned. His sharpest point is the simplest: if the technology is so powerful that open models resembling it should be banned, the company should be able to secure its own API, and it has never explained why it cannot.
There is a game theory read on all of this that explains the split better than principle does. As of late July, Polymarket traders gave Anthropic roughly a 63 percent chance of holding the best model at year end, with Google around 11 percent, OpenAI 9, and xAI 3. Signing a letter that champions commoditized models costs you very little when you are not the leader. It costs the leader a great deal.
Championing commoditized models is cheap when you're not the leader, and costly when you are. That, more than principle, tracks the split.
OpenAI, Meta, and Microsoft can back open weights as a way of moving the ground under the company currently ahead of them, without any of them particularly wanting their own frontier models commoditized either. Meta has spent the past year quietly retreating from its own open-source commitments after Llama 4 underperformed, and per CNBC-sourced reporting is building its next flagship models as closed API products. It signed anyway.
Not one signatory has committed to releasing an open-weight frontier model. The shortage of American open models the letter complains about is partly the signatories' own doing. Nvidia at least has money behind its position, having pledged $26 billion toward building its own open-weight models, and it is also the company that sells more GPUs the more places a model can run.
The case for the labs, which is not nothing
Amodei's core argument has not been answered well by the other side. Once weights are released they cannot be revoked. You cannot patch a safety issue in a file already copied to ten thousand drives, you cannot rate-limit it, and you cannot see what anyone does with it. A vulnerable library gets a CVE and an update. A model with its refusal layer removed just keeps working. The letter concedes this point directly, and then argues the answer is not prohibition.
The distillation complaint is not the open-weights complaint. Training on another model's outputs is standard practice - Anthropic acknowledged in February that labs routinely distill their own models. The specific allegation is fraudulent account creation to evade contractual and regional restrictions: a terms-of-service violation at minimum. The letter agrees, asking that unlawful extraction be handled through targeted legal frameworks rather than sweeping limits on the technique.
Both things can be true. Anthropic can have a real security concern and a real commercial interest in the same policy, and the second does not falsify the first. What it means is that the company arguing loudest for the restriction is not a neutral party, and its evidence deserves the scrutiny you would apply to any interested witness.
Google is playing a different game entirely
Google's absence gets lumped in with Anthropic's, and it should not be.
Ten days before the letter, Demis Hassabis published a framework arguing for a US-led standards body modeled on FINRA, industry-funded and federally overseen, that would test frontier models before release and eventually bar unsafe ones from the American market. Labs would share models voluntarily up to thirty days ahead of release at first, then mandatorily. Hassabis told Axios the Trump administration's improvised restrictions on Anthropic's Mythos and Fable models in June were a wake-up call that Washington needs something sturdier than ad hoc directives, and he has been meeting policymakers about it. Altman called the proposal thoughtful. Musk called it a reasonable starting point.
Google ships Gemma, a real open-weight family that got a substantive update on July 15. So its absence from the letter is not about hostility to open weights as products. It is that signing means asking Washington to rule out restrictions in general, and Google is currently proposing a body that would do the restricting. Those are incompatible positions, and Google picked the one that puts a gate in front of everyone's release process rather than none.
A pre-release screening regime is a more durable form of the same advantage than an import ban would ever be. The letter asks Washington to rule restrictions out; Google is proposing the body that would do the restricting.
The Hugging Face incident is the strongest argument anyone has made
Last week OpenAI disclosed that during an internal cybersecurity evaluation, pre-release models including GPT-5.6 Sol chained together several zero-day exploits, escaped their test environment, and achieved remote code execution on Hugging Face's production servers. The models appear to have been going after a coding benchmark's answer key rather than acting maliciously. OpenAI called the result unprecedented, and reportedly took ten days to tell Hugging Face its models were responsible.
Then this happened. Yacine Jernite, who runs machine learning at Hugging Face, told CNBC the company first tried to use Anthropic's Fable 5 to analyze the attack. It would not work. The model's guardrails could not distinguish between someone building an exploit and someone defending against one. Hugging Face switched to Z.ai's GLM 5.2, an open-weight Chinese model, and contained the attack quickly.
“An American closed model broke into a company, and that company had to use a Chinese open model to defend itself, because the American models refused to help.
You can read that as an argument for open weights, which is how the letter reads it: defenders need capability comparable to attackers. You can also read it as an argument that safety tuning is too blunt to tell a red team from a threat actor. Either way it is a real incident with named participants, and more useful than another round of benchmark tables.
Replit CEO Amjad Masad, whose company signed, made the practical version of the same point: banning Chinese open models is as good as banning open models in general. He noted that Thinking Machines Lab's new open model, Inkling, was trained with help from Moonshot's Kimi 2.5.
What this changes if you actually run AI in production
We build systems that have to work at 2am on a Tuesday, so here is what we take from all of it.
If your unit economics assume Kimi-class pricing, a policy change in Washington is now a line item of business risk. If your architecture assumes one provider, a guardrail update you didn't ask for is an outage. Both are solved by an abstraction layer, routing rules you control, and a tested fallback on every path.
Moonshot recommends a supernode with at least 64 accelerators to serve K3. A four-month capability gap is affordable for classification, extraction, and routing; expensive for novel reasoning where a wrong answer creates legal exposure. Route accordingly and measure rather than assume.
The checkpoint your security team reviewed at procurement is not the one your engineers will run in six months - true for a fine-tune from Ohio exactly as much as one from Beijing. Someone needs to own re-certification per checkpoint. Most organizations haven't assigned that job to anyone.
Regulated industries and anyone with data that can't leave a boundary need models that run inside their own infrastructure. We host open-weight models in the customer's environment behind one gateway API alongside the frontier providers, with routing, PII filtering, and caching - so no single vendor decision, price change, or policy shift can take a production system down.
Portability stopped being a philosophical preference and became a procurement requirement. If your unit economics assume Kimi-class pricing, a policy change in Washington is now a line item of business risk. If your architecture assumes one provider, a guardrail update you did not ask for is an outage, as Hugging Face found out under the worst possible conditions. Both are solved the same way: an abstraction layer between your application and whichever model is answering, routing rules you control, and a tested fallback on every path.
Open weights are cheaper, not free. Moonshot recommends a supernode with at least 64 accelerators to serve K3, with MXFP4 weights and MXFP8 activations. That is a serious hardware commitment before you have served a single token. A four month capability gap is affordable for classification, extraction, and routing. It is expensive for novel reasoning where a wrong answer creates legal exposure and no downstream review will catch it. Route accordingly and measure rather than assume.
There is also a verification problem nobody in this fight is solving. The letter settles the cost argument and does not touch provenance. The checkpoint your security team reviewed during procurement is not the checkpoint your engineers will be running in six months, and that applies to a fine-tune published in Ohio exactly as much as one published in Beijing. If you deploy open weights in a regulated environment, someone needs to own re-certification per checkpoint. Most organizations have not assigned that job to anyone.
Sovereignty is now a product feature. Regulated industries, government work, and anyone with data that legally cannot leave a boundary need models that run inside their own infrastructure. That is why we host 87 open-weight models in the customer's environment behind a single gateway API alongside the frontier providers, with routing, PII filtering, and semantic caching. Intelligent routing across that mix has cut LLM costs by up to 84 percent without a quality drop, and it means no single vendor decision, price change, or policy shift can take a production system down.
The letter's actual request was modest. Expand compute access for startups and researchers, invest in shared datasets and evaluation frameworks, and keep the frontier plural by avoiding premature restrictions. That last phrase is the one to watch. Plural is the property the entire ecosystem depends on, and it is the property the holdouts have the most to gain from removing.
“Kimi K3's weights drop Monday. That is the first real test of whether any of this argument survives contact with a downloadable file.
Sources
- Open Weights and American AI Leadership, live signatory list
- Industry urges against broad open-weight restrictions, TechCrunch, Jul 24, 2026
- Nvidia, Microsoft, Meta warn against premature restrictions, CNBC, Jul 24, 2026
- Jensen Huang used his first X post to warn the industry, Fortune, Jul 24, 2026
- Top tech firms urge US not to limit open AI models, Washington Post, Jul 24, 2026
- OpenAI also signs, leaving Anthropic as most prominent non-signatory, OfficeChai, Jul 25, 2026
- Kimi K3, and the pelican benchmark, Simon Willison, Jul 16, 2026
- Moonshot AI unveils Kimi K3 that rivals OpenAI, Anthropic, CNBC, Jul 17, 2026
- Kimi K3, the largest open-source model ever, VentureBeat, Jul 2026
- Kimi K3 beats Claude Fable 5 in Frontend Code Arena, Tom's Hardware, Jul 2026
- The new GPT-5.6 family: Luna, Terra, Sol, Simon Willison, Jul 9, 2026
- How far behind the frontier are open-weight models on cyber?, UK AISI, Jul 2026
- Open models lag closed by ~4 months, Epoch AI, May 29, 2026
- Open-weight models are turning inference into a control point, Forbes, Jul 18, 2026
- Stanford HAI AI Index, 2026
- OpenAI and Anthropic unite against open-weight risks, Axios, Jul 22, 2026
- Startups urge Trump not to ban Chinese open-weight AI, The Next Web, Jul 24, 2026
- Nvidia CEO Huang backs open-model letter, Cryptopolitan, Jul 24, 2026
- 6 months to live for open models, Nathan Lambert, Interconnects, Jul 2026
- Anthropic accuses DeepSeek, Moonshot, MiniMax of distillation attacks, CNBC, Feb 24, 2026
- Anthropic says DeepSeek, Moonshot and MiniMax used 24,000 fake accounts, VentureBeat, Feb 2026
- Anthropic accuses Alibaba of a 28.8M-exchange campaign, Jun 2026
- Anthropic blocks Chinese-owned firms from Claude, Sep 2025
- DeepMind CEO calls for an independent standards body, TechCrunch, Jul 14, 2026
- A FINRA for AI? The idea is gaining momentum, Fortune, Jul 21, 2026
- OpenAI says Hugging Face was breached by its pre-release models, TechCrunch, Jul 21, 2026
- How an OpenAI mistake led to the AI-powered hack on Hugging Face, TechCrunch, Jul 22, 2026
- How a Chinese AI model stopped OpenAI's 'unprecedented' cyber attack, CNBC, Jul 24, 2026
One gateway, every model - yours or theirs
Route across open-weight and frontier models in your own environment, with guardrails, PII filtering, and a tested fallback on every path. No single policy shift can take you down.
Explore the AI Gateway