Open weights, security and licenses: the new balance of AI

The race to open models is no longer only about access to the weights: what matters today is who can run them, under what conditions and with what controls.

Artificial intelligence is entering a less binary phase. For years the comparison was told as a choice between closed models, controlled by the big labs, and open models, available to the community. This week's news shows a more useful and more concrete picture: opening the weights is only the first level. Right after come licenses, computing capacity, security, data and responsibility.

Anthropic: tests, not bans

Anthropic has publicly clarified that it does not support a general ban on open-weight models. The company does propose security tests for the most capable models, regardless of whether they are open or closed, and maintains a strict line on advanced chips, industrial-scale distillation and geopolitical risks.

The distinction matters. A model with available weights can be studied, adapted and distributed more easily; that does not make it automatically suitable for every use. For businesses, the criterion should be pragmatic: which controls are needed for that model, in that process, with that data?

It is the same criterion we apply at TeraBrain when we assign a model to an agent: Anthropic's Claude for long-reasoning tasks and document analysis, OpenAI's GPT for general-purpose tasks, Google's Gemini for multimodal processing, open-weight models where cost, latency or running in a controlled environment matter. No model is the answer to everything.

GLM 5.2 and Kimi K3: weights available, adoption to be verified

Moonshot has published the weights of Kimi K3 under a specific license. Sources describe it as a large multimodal, agentic model. It is a relevant move because it widens the options for those who want to experiment outside fully managed services.

A few weeks earlier Z.ai (Zhipu) had published GLM 5.2 on Hugging Face under an MIT license: a Mixture-of-Experts of about 745 billion parameters, with about 40 billion active per token and a context window of one million tokens. On the agentic benchmarks it declares, it sits close to frontier models, around 81 on Terminal-Bench 2.1 against 85 for Claude Opus 4.8, at a cost per token that public price lists put at between five and seven times lower, with noticeable differences between sources.

The two releases are not equivalent. An MIT license and a proprietary “open weight” license do not grant the same freedoms: the latter can include commercial-use limits, attribution obligations or revocation clauses. It has to be read first, not afterwards.

There is also a distinction that weighs even more: using an open model's API is not the same as running it. Downloading the weights and hosting them in a controlled environment is a governance choice; calling the provider's managed endpoint is something else, with different implications for data residency, jurisdiction and compliance. It is a topic already raised explicitly for the GLM 5.2 API itself. Opening the weights does not automatically transfer control to whoever uses them: it makes it possible, if someone takes on the burden.

But “downloadable” does not mean “ready for production”. Before adopting an open-weight model you need at least four checks:

• License and constraints on commercial use.
• Real inference, memory and latency requirements: a MoE with hundreds of billions of parameters does not run on just any server.
• Data handling and availability of isolated environments.
• Quality on your own use cases, not only on public benchmarks.

Openness can reduce dependence on a single vendor, but it shifts a larger share of technical responsibility onto the user. Before adding a new model to our platform's routing we put it through exactly these four checks, on the customer's real processes and not on the vendor's benchmarks.

Security becomes an agentic workflow

Microsoft has introduced Perception, an agentic security offering also based on the MAI-Cyber-1-Flash model. The underlying idea is clear: a system can use a more efficient model for common cases and reserve more expensive resources for the hard exceptions.

It is the same principle many companies can apply to their own processes: not choosing a single model for everything, but routing work by risk, complexity and cost. The essential condition is not to delegate blindly. An agent that proposes a patch must not automatically have the power to deploy it.

An agent that proposes a patch must not automatically have the power to deploy it.

An alliance for tools, not a shortcut

Nvidia has announced the Open Secure AI Alliance with CrowdStrike, Hugging Face and Dell, aimed at shared tools for safety and cybersecurity. The collaboration is an important signal: AI security cannot remain confined to the individual model.

The minimum ingredients of a reliable architecture remain prosaic but decisive: separate sandboxes, least privilege, action logs, human review of high-impact operations and the ability to stop the system from the outside.

Privacy is not a configuration detail

Reports of AI conversations ending up in search engine results remind us that privacy is also a matter of web implementation. Crawling rules, shareable pages, indexing tags and public links can turn a convenient feature into a risk.

For those designing products with AI, a publishing checklist should include tests against unintended indexing, a review of permissions and a clear boundary between private content and content meant for the web.

How we do it at TeraBrain

Our platform was born from exactly this approach: multi-model by choice, not by opportunism. Each agent uses the model best suited to its task, and the platform combines OpenAI, Claude, Gemini, open-weight models such as GLM and vertical models with automatic routing and fallback. If a vendor changes prices, license or availability, the customer's process does not stop.

• Routing by risk and cost: lightweight models on repetitive volumes, frontier models on the exceptions that are really worth it.
• Open-weight models for cases where data must not leave a defined perimeter.
• Separate sandboxes, least privilege and a complete log of every agent action.
• Mandatory human approval on high-impact operations: the agent proposes, the person authorizes.
• Verification of licenses and data residency before adoption, not after the incident.

We measure cost per completed task, not per token. It is the only metric that really tells you whether a model is worth it for that process.

The point for businesses

The advantage does not come from having the biggest or the most open model. It comes from the ability to combine it with a verifiable process. In the coming months the winners will be the organizations that know how to measure cost per completed task, choose the right model, respect licenses and keep control over the actions of agents.

Open AI widens the field of possibilities. Governance decides whether those possibilities become a real advantage.

If you are evaluating which models to bring into your processes, and with which controls, we can analyze a real use case together and build a verifiable path.

Sources: Techmeme; public communications and pages from Anthropic, Microsoft, Nvidia, Moonshot and Z.ai; news sources linked by Techmeme. Performance and cost assessments reported by vendors are treated as claims to be verified.