Open Weights, Distillation, and Free Market Dynamics

TL;DR

Moonshot recently released Kimi K3 as an open-weight model competitive with current frontier models (Fable 5 and GPT-5.6 Sol) on many tasks, which spurred debate in Washington about export controls, distillation policy, and outright bans.

An open letter signed by NVIDIA, Microsoft, OpenAI, and dozens of others argues that open weights expand access, competition, and customer control. Additionally, it asserts that distillation concerns belong in targeted legal and commercial frameworks, not a sweep against open models.

Anthropic was a notable non-signatory.

Anthropic's CEO responded to the letter with mixed feedback. He agreed that a categorical ban on open weights would not solve the adversarial threat issue and would carry broad costs. He also clarified what he does advocate for:

• Chip export pressure
• Policy-level crackdown on industrial distillation
• Mandatory safety testing for sufficiently capable models

My thoughts:

• Chip export controls do represent an effective and lower-risk method to address the adversarial threat.
• The same does not hold at the model and application layers.
• Distillation as a category is legitimate and primarily a company-level concern with KYC and terms-of-service enforcement as a strong first-line defense.
• Any mandated safety gate should apply only above a clear capability threshold and must be globally adopted; otherwise, it risks slowing American innovation while adversaries continue toward the frontier.

What the letter and Anthropic agree on

The letter's core claims are straightforward. Open weights enable organizations to match model cost to task complexity, increasing competition between models/companies and giving customers optionality instead of vendor lock-in. Once weights leave the developer's control, risks surface from many directions. Prohibiting open-weight models is the wrong response. Distillation (using one model's outputs to help train or improve another) is a widely used technique that does not consist of accessing the internals of the closed system. Addressing true misappropriation should happen through legal and commercial frameworks, not sweeping restrictions on the technique.

Amodei and Anthropic agree with much of the letter, including the rejection of categorical open-weight bans. They are less convinced that open access necessarily benefits defenders more than attackers when models have capabilities with catastrophic misuse potential. That remains an important empirical question, but it does not by itself justify shrinking the market for publicly available models.

The more concrete disagreement concerns enforcement. Both sides support targeted legal and commercial responses to misappropriation. Anthropic goes further, however, arguing that company-level controls cannot fully address state-backed industrial distillation and therefore calling for policy intervention. The question is not whether abuse deserves a response, but which actors have the information and tools to respond effectively.

Anthropic's advocated actions

On selling powerful chips/chipmaking equipment to China and cracking down on smuggling

I agree here. Physical export controls already exist and can make it harder for adversarial entities to obtain advanced training capacity. Tighter enforcement can help keep frontier-scale compute scarce for adversaries; it also carries less economic risk than the broader methods discussed next.

On cracking down on industrial-scale distillation via policy

Distillation broadly means using one model’s outputs to train or improve another. It has legitimate uses: developers employ it to build smaller or more specialized models, transfer capabilities between their own systems, and learn from the observable behavior of competing products. The method relies on outputs rather than access to another model’s weights or internal architecture. Learning from observable product behavior is common in competitive markets, although authorization and the method of access still matter.

The frontier labs themselves have made a related argument in copyright litigation: using accessible material for training is not necessarily equivalent to copying the underlying work or system. The analogy is imperfect because published works and contract-governed API outputs raise different questions, but it reinforces the importance of separating the training technique from how the source material was acquired.

At the same time, ordinary competitive learning is not the same as industrial-scale distillation conducted through fake accounts, unauthorized resellers, concealed identities, or deliberate efforts to evade a provider’s access controls. Those practices raise legitimate contractual and legal concerns even though the underlying technique remains valid. Gross misuse of a valid technique does not render it invalid.

Moreover, distillation does not make you superior to the model you studied. It can pull a rival within months of the lead a model provides; it does not lead to equivalence by itself. Parity and/or surpassing requires your own post-training and product work (i.e. reinforcement learning and the application layer on top of it). Absent any work to combat this large-scale distillation, compete there. Anthropic is at or near the frontier on product and enterprise traction, and I highly doubt that edge is due only to foundation model training; distillation will not remove it.

Anthropic says it already finds and bans accounts used for industrial distillation. It also acknowledges that this is difficult. Operators use fake accounts, change tactics, and may only be detected after they have collected a large amount of data. Amodei argues that one company cannot fully stop a coordinated, state-backed operation. That is a fair concern, but model providers are in the best position to detect this activity. They have the query logs, account histories, payment details, and usage patterns. Stronger identity checks and risk-based KYC could give them more useful signals, while also affecting privacy, access, and customer growth.

Web scraping provides a long-standing and useful comparison. Website owners must actively monitor for unusual traffic, set rate limits, and block abusive visitors. Government agencies do not run their anti-bot systems. The law can still help when scrapers use stolen identities, break contracts, or operate beyond the website owner’s reach. This supports the website owner without banning web scraping itself.

Industrial distillation may call for a similar split. Model providers should handle detection and account enforcement to the fullest practical extent. Government can act against large-scale fraud, sanctions evasion, and proven theft without restricting distillation itself or policing public model weights. Providers should still be expected to invest seriously in their own defenses, including proportionate identity checks where the risk warrants them. That may include stronger KYC, even when it creates friction for growth.

On mandatory safety testing for sufficiently capable models, open and closed

Amodei notes that mandatory testing for catastrophic misuse would only work if it were adopted globally, including by adversarial governments. That is the central problem with a US-only release gate: it would slow American labs without placing the same limits on foreign competitors.

This does not make safety testing a bad idea. Testing can uncover cyber, biological, and alignment risks before release and help developers improve their safeguards. The harder question is who sets the standards, runs the tests, and decides whether a model can ship.

I have more confidence in industry-led testing against clear, public standards than in an open-ended government approval process. If testing becomes mandatory, it should apply only above a defined capability threshold, follow fixed review timelines, and be coordinated internationally. Otherwise, a safety measure meant to reduce risk could delay defensive progress without meaningfully constraining adversaries.

Open ecosystems benefit many facets

Open weights create a two-way ecosystem. American labs publish models, foreign labs publish models, and builders adapt models made available under their respective licenses. Organizations can run them on their own infrastructure and combine them with their own data, giving them options that hosted APIs do not always provide.

Hugging Face’s response to a recent AI-driven security incident offers a practical example. Its forensic work required analyzing real attack commands, exploit payloads, and other sensitive artifacts. Hosted frontier APIs blocked many of those requests because they resembled malicious activity. Hugging Face instead ran the open-weight GLM 5.2 model on its own infrastructure, allowing the company to complete the analysis without sending attacker data or referenced credentials outside its environment.

Amodei is right that open-weight models can also help attackers. The difficulty is that determined adversaries are likely to retain access even when compliant American organizations face restrictions. A domestic ban could reduce the options available to US defenders without removing the same capabilities from foreign attackers. That favors evaluating specific capabilities and risks over restricting open weights as a category.

Software history offers a useful, though imperfect, comparison. Open-weight models are not equivalent to open-source software because they may not include the training data, code, or process needed to reproduce them. Still, both give builders the ability to run and adapt important technology without depending entirely on one vendor.

Open infrastructure and closed commercial products have long existed side by side. Apache and Mozilla helped prevent the web from becoming dependent on a small number of proprietary systems, while companies continued to pay for closed databases, browsers, and business tools when those products offered enough value. Models can support the same kind of choice: open weights where control and adaptability matter, and hosted or closed models where convenience, support, and managed safeguards matter more.

Openness also creates real dual-use risks, just as publicly available security and networking tools do. That does not mean every capability should be unrestricted. It means restrictions should respond to demonstrated risks and misconduct—such as stolen weights, fraudulent access, or sanctions evasion—rather than treating openness itself as the offense.

The path forward

Anthropic is winning. But that lead comes from more than foundation-model training. It comes from post-training, product, safety work, and enterprise execution. Kimi K3’s results show that competitors can close parts of the gap quickly. Distillation alone does not copy the whole system or erase Anthropic’s edge.

Keep playing that game. Compete on the base model, the post-training, and the full product layer—and put the same talent to work making abusive distillation harder. Government can help address fraud, theft, and sanctions evasion without turning a technical lead into a protected market position.

Takeaway

Open-weight and closed-weight models both have a place. The same is true of distillation: it is a valid way to build better and more efficient models, even though it can be abused. Do not turn a hard enforcement problem into a ban on the underlying tool.

We need to draw the lines carefully. Model providers should enforce their terms and block abusive accounts. Courts should handle proven fraud, contract violations, and theft. Government should enforce chip controls and sanctions. None of that requires treating open weights or distillation itself as the offense.

Catastrophic risks are real, and keeping dangerous capabilities away from adversaries is a valid goal. But that does not make distillation itself the problem. Before government writes broad rules, it should show that industrial distillation creates a specific risk that providers cannot contain through detection, identity checks, account controls, and the courts. It should also show that the rule will reach state-backed operators instead of mainly burdening compliant US companies. If it cannot do both, target the fraud, stolen accounts, unauthorized resellers, and sanctions evasion—and leave legitimate distillation alone.

References

🌐 Microsoft. (2026, July 24). Open weights and American AI leadership.

🌐 Amodei, D. (2026, July 27). Our position on open-weights models. Anthropic.

▶️ All-In Podcast. (2026). Episode 282.