The state of open source AI.

V1.0 · Recurring · July 2026

A Letter From Our CTO, Raffi Krikorian “

In New Zealand's far north, a Māori broadcaster trains speech models for te reo — a language too small for any market — under a license that keeps the data with its people. PwC, one of the largest accounting firms in the world, fine-tuned an open model on the language of finance and runs it today for hundreds of clients, on its own hardware, with no per-token meter running. Researchers in Lausanne built an open medical model with the Red Cross, tuned to its humanitarian guidelines, and are preparing clinical trials at home and in Tanzania. In East Africa, farmers diagnose cassava disease with a model that runs on the phone itself, offline, in fields the cloud has never reached. In Switzerland, a public consortium trained a national model on public supercomputers and released all of it: weights, data, training code. None of them asked permission, and none of them could have rented this. They own it — that is the whole idea.

We have been here before. Mozilla exists because one company tried to own the front door to the web, and an open community rose up to make sure it never could. Twenty-five years later, someone is running the same play. We bet on open the first time. Open won. Together, we can do it again.

Our belief is simple: the path forward is competition and interoperability. We believe in a world of many models, standard ways to plug them together, and the freedom to walk away from any vendor at any time. Open has a record here. It grew the pie and let more people own a slice of it.

Read what follows as a map: where open AI is winning — some numbers surprised even us — and where it is exposed. A case that hides its weak points is an advertisement.”

Read Raffi's full letter here →Download the report here ↓

Open weights closed the capability gap while the price of intelligence collapsed.

0%

Capability gap to the top closed models — at parity on coding, behind on reasoning

0×

Fall in GPT-4-class inference cost in 36 months: $20 → $0.40 per 1M tokens

01The current state of open-source AI

Parity reached. The contest is one layer up.

Open weights are no longer a compromise. They are where the work happens: a majority of production tokens now route through them, and the five highest-volume models on OpenRouter are all open. Closed models still lead at the frontier, on reasoning and multimodality, but the frontier is not what most workloads need. Commodity inputs do not hold pricing power. Value moves up, to the agentic harness.

The capability gap: 8.04% → 0.5% → 3.3%

Open-vs-closed gap on Chatbot Arena over 24 months. By August 2024, the gap had collapsed to 0.5%, and in February 2025 DeepSeek-R1 briefly matched the top US model. By March 2026 it had reopened to 3.3% as closed reasoning models pulled ahead. But 3.3% is an average over a jagged frontier: open is at or near parity on coding, instruction-following and general knowledge, while the gap concentrates in reasoning, long-context retrieval and agentic tasks. The question is no longer whether open models are good enough. It's what you need for your workload. Hover the points.

Source: Chatbot Arena, Jan 2024 – Mar 2026.

Inference fell 50× in 36 months

GPT-4-equivalent price per 1M tokens — faster than dotcom-era bandwidth or PC-compute price curves. Log scale.

Sources: Stanford HAI AI Index 2025 (280× GPT-3.5-class drop over 18 months); Epoch AI (9–900× annual decay); Nov 2025 MIT study (5–10×/yr at the frontier, hardware-adjusted).

Open weights win the tokens

The share of tokens routed on OpenRouter through open-weight models grew from a negligible base to a third by late 2025 to a majority by mid-2026.

Source: OpenRouter 100T-token study (Nov 2024–Nov 2025) and live leaderboard; intermediate points interpolated. By request count, closed US providers still lead — the open lead is a token-volume lead, concentrated in coding and agentic workloads.

OpenRouter live leaderboard — trailing month, tokens routed

The five highest-volume models are all open weights. Anthropic's closed Claude models are the next US-built entrants.

Open weightsClosed

By mid-2026 the top nine models route roughly 18T weekly tokens for Chinese-built models against ~5.5T for US-built ones — more than 3:1 (FT analysis). Where developers route by cost, they route to open weights.

Open ships easy. Open deploys hard.

Data from the Mozilla / SlashData 2026 developer survey. Open models lead in adoption: 79% of developers adding AI functionality use them, against 71% for closed, and the two are largely complementary, with half of developers using both. But production is where teams stall: only 51% of open-model teams reach production versus 63% for closed. The gap is operational tooling and trust, not model capability.

Open models lead in adoption, and mostly coexist with closed

Share of developers adding AI functionality to their applications who currently use each model type, and how the two overlap.

Open models

79%

Closed models

71%

How they combine

29%OS only

50%Both

21%CS only

Source: Mozilla / SlashData 2026 developer survey. Open and closed aren't substitutes for most teams: 50% run both, 29% open only, 21% closed only.

Where open adoption peaks, and where closed still edges it

Open-model adoption by region. Greater China and East Asia lead at 89%; South America and Western Europe are the only two regions where closed adoption exceeds open.

Same survey, by developer region. In South America and Western Europe, and only there, closed-model adoption runs ahead of open.

Production rate by company size

If the gap were about resources, scale would close it, and it doesn't. Closed climbs 54% → 73% with scale. Open barely moves: 53% → 57%.

Closed modelsOpen models

Enterprises can buy their way through closed deployment. Open deployment waits on tooling nobody has finished. Source: Mozilla / SlashData 2026 developer survey.

Why teams churn: challenges with open models

Δ = churned − still using, in percentage points. The biggest gaps (performance, integration, maintenance) are operational, not capability. Hover the bars.

Still using openChurned away

Mozilla survey, n=1,410. “What are the main challenges you face when working with open or open-source AI models?”

The same challenges, everywhere: what blocks open by region

Share of current and churned open-model developers naming each challenge, by region. Warmer cells mean more developers blocked. The top rows are operational in every region: infrastructure cost, security and compliance, maintenance, deployment complexity. South Asia leans hardest on security and support; only North America and Greater China have more than 15% reporting no major challenges.

Challenge	W. Europe & Israel	N. America	Greater China	South Asia	East Asia ex GC	S. America	E. Europe & CIS	Oceania	All
High infrastructure or compute costs	25%	26%	29%	28%	28%	28%	29%	18%	27%
Security, privacy, or compliance concerns	20%	27%	18%	39%	29%	28%	25%	22%	26%
Ongoing maintenance and updates	27%	26%	18%	26%	20%	31%	21%	25%	24%
Complexity of deployment, hosting, or scaling	27%	24%	19%	24%	11%	30%	26%	25%	23%
Lack of specialised support	17%	16%	21%	31%	24%	23%	23%	32%	22%
Difficulty evaluating or comparing models	14%	17%	14%	23%	16%	26%	25%	18%	18%
Difficulty fine-tuning or customising	22%	18%	18%	20%	11%	22%	18%	12%	18%
Difficulty integrating into existing systems	19%	21%	14%	20%	7%	26%	19%	20%	18%
Insufficient documentation or learning resources	18%	15%	15%	17%	15%	20%	24%	15%	17%
Model performance is not good enough	18%	15%	13%	22%	16%	17%	19%	8%	17%
No major challenges	9%	21%	16%	5%	14%	4%	8%	12%	12%
Weighted sample size	286	277	206	192	164	147	98	39	1411

Source: Mozilla / SlashData 2026 developer survey (MZCS1). n=1,410 current or churned open-model developers; the Oceania column (n=39) and Eastern Europe & CIS (n=98) fall below reliable thresholds.

---

02The open-source AI stack

The open stack scores high on capability, low on operations.

Nine layers and 48 components of the stack scored across 10 criteria (1–5). Click a layer to open its components: each carries its own criterion scores, maturity grade, open-vs-closed parity verdict, and surfaces some of its most-starred open-source projects.

Hover any cell for detail.

StrongViable, but fragmented**Early stage

**Strong (≥4.0) **3.5–3.9 **3.0–3.4 **2.5–2.9 **Weak (<2.5) the operational gap = standardization + enterprise readiness

Cells are scores per maturity criterion (1–5), ordered strongest to weakest left to right; layer rows are the means of their components. The two coldest columns, standardization and enterprise readiness, repeat down every layer and every component: that repeating cold edge is the operational gap. Source: Mozilla stack map, June 2026 (48 components, 1,361 projects).

---

03Who's betting on it

Open source is a business model.

Open-weight AI is a commercial market at multi-hundred-billion-dollar scale, built by funded companies and run in production by global enterprises. Databricks crossed a $5.4B run-rate; Mistral scaled 20× to ~$400M ARR in twelve months; DeepSeek reached ~$220M ARR and recently raised $7.4B at a valuation over $50B. Five revenue models are proven at scale: hosted inference, enterprise platforms, on-prem licensing, fine-tuning services, and harness tooling.

The venture-funded open-source ecosystem: total disclosed funding, USD M

Bars grow as you scroll. Color by region of the company.

North AmericaChina**Europe & rest of world

Selected companies; Zhipu AI and MiniMax went public (HK IPO 2026) with undisclosed totals. Corporate strategics (Nvidia, Salesforce, AMD, Google, IBM, ASML, Tencent, CATL, Schwarz Group) back the same ecosystem across model, inference, and tooling layers.

Financial maturity of the open ecosystem

Funding, valuation and revenue traction for the companies carrying the open stack. The ecosystem has moved from grants to venture scale to public markets.

Company	HQ	Layer	Disclosed funding	Valuation	Revenue signal	Leading investors	Stage
Databricks	USA	Enterprise platform	—	—	$5.4B run-rate	—	Pre-IPO
DeepSeek	China	Frontier open weights	$7.4B	$50B+	~$220M ARR	Liang Wenfeng; Tencent; CATL; China National AI Fund	Private
Mistral AI	France	Open weights + platform	$3.05B	~$14B (talks at €20B)	~$400M ARR, 20× YoY	ASML; a16z; Lightspeed; Nvidia	Private
Moonshot AI	China	Open weights (Kimi)	$3.9B	—	—	Meituan/Long-Z; Alibaba; Tencent; HongShan	Private
Zhipu AI	China	Open weights (GLM)	Undisclosed	Public	—	Public (HK IPO 2026); prior Alibaba, Tencent	HK IPO 2026
MiniMax	China	Open weights	Undisclosed	Public	—	Public (HK IPO 2026)	HK IPO 2026
Cohere	Canada	Enterprise / on-prem	$1.7B	—	Command A+ open-sourced May 2026	Radical Ventures; Nvidia; AMD; Schwarz Group	Private
Cerebras	USA	Compute	$2.1B	—	—	Fidelity; Atreides; G42; Tiger Global	Private
Reflection AI	USA	Open weights	$2.13B	—	—	Nvidia; Disruptive; Sequoia; Lightspeed; DST Global	Private
Together AI	USA	Inference cloud	$1.334B	—	—	Aramco Ventures; General Catalyst; Prosperity7; Nvidia	Private
Hugging Face	USA	Hub	$400M	—	—	Salesforce; Google; Nvidia; IBM	Private
LangChain	USA	Harness tooling	$260M	—	126k+ stars, 60% dev share	IVP; Sequoia; Benchmark; CapitalG	Private

Five revenue models are proven at scale: hosted inference, enterprise platforms, on-prem licensing, fine-tuning services, and harness tooling. “—” = not publicly disclosed.

The metered model breaks at scale

Closed frontier models are sold by the token — and at production scale the meter becomes the problem.

A fifth of the usage, 4% of the revenue

On OpenRouter (May–Sep 2025), closed models held ~80% of usage and ~96% of revenue. Price drives it: at ~90% parity, closed costs ~6× more per call.

~$24.8B

in unrealized annual savings — the Nagle–Yue study for the Linux Foundation's estimate of the open-vs-closed price asymmetry, at ~6× the cost per call for comparable capability

Where developers route by cost, they route to open weights.

---

04Why it's happening everywhere

Open isn't a vendor choice. It's a sovereignty choice.

More than 70 national AI strategies are live. The strategic question has shifted from whether to have a national AI policy to which layer of the stack a country can own.

Click a marker or a country below.

The case for open is optionality

Optionality stopped being abstract in June 2026, and it stopped being a procurement question. Three days after Claude Fable 5 went on sale, a single government's export order forced Anthropic to cut access for every foreign national on earth. No other capital was consulted. None could have been. Selective compliance was impossible, so the models went dark for everyone at 5:21 p.m. on a Friday. Anyone who had built on that model inherited a shutdown they had no warning of and no part in. A provider can switch off a model. Nobody can switch off a copy already running on a machine you hold, and that holds whether the machine is a startup's server or a national supercomputer. For a company, weights on disk are a hedge. For a state, they are the difference between a policy and a permission.

The strategic case for open is the ability to leave, and the cloud era proved the cost of its absence:

$90–120kto move one petabyte out of AWS S3

**80%**of enterprises now repatriating workloads

$3.2M → <$1M37signals' cloud bill after leaving

**2.5×**what GEICO's cloud costs ran over plan

Closed model APIs reproduce the same trap: build on a proprietary endpoint and you inherit the vendor's pricing changes with no clean exit. Open weights are exit rights.

The largest source of open weights is China. By design.

Cumulative Hugging Face downloads, March 2026:

In February 2026 Qwen out-downloaded the next eight organizations combined. On OpenRouter, Chinese open-weight models rose from under 2% of tokens in late 2024 to more than 45% of weekly traffic by April 2026, and about 61% among the ten most-used models. DeepSeek reports 26,000+ enterprise accounts; 58% of new AI startups in 2025 included it in their stack, even as at least eight jurisdictions restricted the hosted service. The resolution is architectural: enterprises ban the hosted app and adopt the weights anyway, self-hosted or via Western endpoints.

This is intentional policy. The State Council's "AI Plus" Initiative (Aug 2025) and the national Five-Year Plan (Mar 2026) codify open-source proliferation as a core directive, and releasing public weights doubles as a macro hedge against semiconductor export controls, offloading global inference onto end users' local hardware. Across the Global South the draw is diversification away from US technology monopolies; elsewhere it is purely financial. Even Microsoft is exploring a secured, Azure-hosted DeepSeek V4 for its heaviest Copilot workload.

Marker size ≈ scale of committed public/strategic capital · Equirectangular projection

Source: Open Source AI jurisdictions dataset, July 2026. Marker size scales with committed public and strategic capital.

---

05The harness is the new frontier

The agentic harness is another user agent.

The browser was the user agent of the open web: code on the user's side, negotiating with servers on their behalf. That role is being recreated one layer up. Above the model now sits the agentic harness — the orchestration loop, tools, memory, sandboxes, and permission model. It is where production difficulty concentrates, and where the open-vs-closed, owner-vs-renter contest restarts.

The user · other agents · the worldhumans · systems · data · money

Governone plane over many harnesses

Stateful policywhat the session already did

Registry & lineagewhich agent did what

Budget & revocationcost caps · kill switch

Meta-harness · Omnigent · OPA · Agent governance toolkit

Surfacemeets user & money

InterfaceAG-UI · A2UI

Payment & meteringx402 · AP2 · UCP

Actiondo things, safely

Sandboxes & executionE2B · Daytona · Modal

Permission & identitythe write surface — the unsolved gap

Eval & observabilityLangfuse · Phoenix

Reachconnect & remember

Tools & contextMCP

Agent-to-agentA2A

MemoryMem0 · Letta · Zep

Controldrive the loop

Orchestration loopLangGraph · CrewAI · AutoGen · LlamaIndex — the reason-and-act cycle that turns a model into an agent

The model — the weightsopen or closed · swappable · commoditizing toward zero

The layer is already a product category: LangChain alone has 126,000+ GitHub stars and a 60% developer share; MCP reached 97M monthly SDK downloads and 10,000+ active servers in its first year, growing 4,750% in 16 months — and was donated to the Linux Foundation's Agentic AI Foundation in December 2025. Adoption outpaces governance: only ~21% of companies report mature agent governance.

The model is eating the harness, and that's the opening for open

Terminal-Bench 2.0 (May 2026) made the harness look like a free lunch anyone could capture: a third-party scaffold ran Anthropic's own weights to 79.8% while Claude Code managed 58.0% on the same model, a 21.8-point spread that put the harness ahead of the weights. Eight weeks later, Terminal-Bench 2.1 reversed it. The frontier labs read that result and pulled the harness in-house: on every model where both appear, the lab's own harness now wins, and the 21.8-point gap has compressed to roughly 3 at the top: the model eating its way up the stack, weights and scaffold shipped as one product.

May 2026 · Terminal-Bench 2.0

July 2026 · Terminal-Bench 2.1 · official board, verified top tier

That integration is a moat in formation, and the labs have every incentive to deepen it. A harness tuned tightly to one lab's weights becomes a fit rather than a neutral layer. It degrades on anyone else's model, so the tighter the tuning, the less swappable the weights underneath. Lock-in arrives as a side effect of optimization. The open models have no first-party harness to answer with, which is why none appear in the verified top tier of the official board at all.

But absence isn't inability: put every model on one neutral scaffold and the gap collapses

vals.ai's Terminus-2 run of Terminal-Bench 2.1: the same benchmark, one neutral harness for everyone. Capability bars in points; cost per task in the label.

On a fair harness the capability gap is a few points; the price gap is 5×. The strongest open model, GLM 5.2, lands a fraction behind Claude Opus 4.7 and about four points behind Opus 4.8 at roughly a fifth the cost. Integration buys the labs a second edge open deployments lack: a data flywheel where real usage through the lab's harness feeds straight back into the next model. That edge is real, and it cuts both ways: the usage exhaust trains whoever owns the harness, and the only question is whether that's the closed endpoint or your own stack. The labs have proven the harness is worth owning. The same move is open, a harness co-designed with open weights, and the window to keep it a layer is now, before the closed stacks finish welding model and scaffold into one rented product.

The write surface: the unsolved hole at the center of the harness

Reads

Reversible and low-consequence. Fetching a document, querying a database, listing a calendar. These can largely be permitted by default; a bad read costs little and can be repeated safely.

Writes

Side effects that are costly or irreversible. Sending a message, spending against a budget, modifying a record, executing a transaction. This is where confirmation, approval thresholds, cost caps and revocation must concentrate.

The unsolved permission problem is a write problem. The harness ecosystem now spans roughly a dozen frameworks, ten harnesses and three peer protocols, yet no portable model defines which writes an agent may perform unattended, which require human approval, and which are forbidden, across an MCP host, an A2A peer, a direct tool invocation and a framework boundary. The protocols hardened the front door and stopped there: MCP's 2025-11-25 specification moved authorization onto OAuth 2.1, and A2A v1.0 standardized signed Agent Cards, but both stop at authentication. Knowing who an agent is says nothing about what it may do.

The human backstop is failing too. CoSAI's MCP threat model lists consent fatigue, the pattern in which users approve the large majority of prompts, as a top-tier threat. Consent fatigue is itself a write-side failure, because the prompts that matter are the ones authorizing action.

Industry responses are bypassing the framework deadlock by pulling control up to the meta-harness layer. Instead of fragile prompt-based filters inside individual agents, emerging cross-harness architectures (like Databricks' open-sourced Omnigent) enforce stateful, contextual policies that track what a session has done and gate the next write accordingly: requiring human approval for a code push once an agent has pulled an unverified package, or enforcing cost caps that pause a session after a set spend. These controls govern the write surface from a layer above any single harness, which is where the durable permission model is most likely to form. It is the single highest-leverage gap in the layer.

Closed is not the same as secure

A closed API feels safe because of filtering, monitoring, and revocation. All three are functions of the serving layer. Keeping the weights secret does not provide any of them. The same controls live at the harness layer and apply to self-hosted open models. In 2025, authorization failures rated CVSS 9.3–9.4 hit Anthropic, Microsoft, ServiceNow and Salesforce, all closed systems. The NTIA studied whether the US government should restrict open weights and recommended that it monitor them instead. Security concerns are best addressed by investing in the harness. They do not require renting a closed model.

Where closed still leads

Closed systems still lead in four places. The first is the integrated harness. No open model appears in the verified top tier of the official Terminal-Bench 2.1 board, and even on a neutral scaffold the best open model trails Opus 4.8 by about four points. Behind that harness sits a data flywheel, since usage routed through a lab's own scaffold feeds back into its next model. The second is long-context fidelity at 1M tokens, where Gemini 3 holds 89% multi-needle retrieval against DeepSeek V4-Pro's 41%. The third is turnkey compliance, with SOC 2, HIPAA, and zero data retention available by default. The fourth is accountability, meaning a counterparty the customer can hold liable.

Compliance and accountability are contracting problems. The integrated harness is a tooling problem. Long-context fidelity is a model problem, and closing it is work only the open labs can do.

---

06Opportunities

Five bets. None requires beating the frontier.

They require owning the layers above it — the harness, the memory, the permission model — while those layers are still open.

---

07The watchlist

Signals that keep the layer open.

**Capability & adoption

The 3.3% gap (at parity on coding, behind on reasoning and agentic), and open's OpenRouter token share, especially in agentic coding.

Reverses if: token share stalls while the reasoning gap widens.

**The harness

The Terminal-Bench spread between lab-owned and independent scaffolds; MCP/A2A governance under the AAIF; the portable permission spec that still doesn't exist.

Reverses if: the lab-harness lead widens, or a closed platform sets the permission standard first.

**Market structure

Open-lab economics (ARR, raises, the Zhipu/MiniMax IPOs) against metered-pricing breakpoints (~2027–28), with sovereign capacity as counterweight.

Reverses if: sovereign funding lapses or open-lab economics fail to scale.

**Trust & safety

Tracked, not settled: misuse capability and how easily safety tuning strips from open weights; hard-friction zones, above all synthetic CSAM and NCII; whether NTIA's “monitor, don't restrict” holds.

Reverses if: a major misuse event, or a shift from monitoring to restriction.

There is a test you can run for the rest of this. Look at who is seated in the rooms where AI gets decided, and with what status. The day they seat the people who keep AI open, portable, and widely deployed on equal footing, the shift from renting to owning will have happened. The window is open now. It is closing slowly enough that we can pretend it isn't, and the lease is shorter than it looks. Build with us.

This is V1. We'd like to hear from you.

---

Citations

Section 1 · The current state of open-source AI

• Capability gap 3.3% / gap collapse to 0.5% / six of top-ten Arena slots closed

• 8.04% on Chatbot Arena

• Inference 50× / $0.40 per million tokens / December 2025

• Open weights ~third of production tokens / 100T-token study

• Mistral 20× to ~$400M ARR

• 280× / 2025 AI Index

• Epoch AI 9×–900× annual decay

• November 2025 MIT study

• Live leaderboard / market-share panel / intelligence ranking

• FT analysis

• DeepSeek-R1 (model card)

• 79.8% on AIME 2024 / pass@1

• $0.55/$2.19 pricing

• o1's $15/$60

• DeepSeek-V4 Pro

• 89% of AI-enabled firms use open components

• MIT NANDA ~67% vs ~33%

• Stanford 95% of pilots no measurable impact

Section 2 · Who's betting on it

• Databricks $5.4B run-rate / 65% YoY

• Databricks fundraise >$165B

• Mistral €3B at €20B valuation

• DeepSeek ~$220M ARR

• DeepSeek raise $7.4B / >$50B valuation

• Microsoft canceling Claude Code licenses

• Token billing consumed annual AI budget

• Uber exhausted AI coding budget

• Uber engineers billing $500–$2,000/mo

• Uber capped spending at $1,500

• Stripe 73% cut on vLLM

• Microsoft exploring Azure-hosted DeepSeek / Copilot Cowork

• Linux Foundation ~80% usage / ~96% revenue / ~6× per call

Section 3 · Why it's happening everywhere

• AWS S3 egress $90k–$120k

• 80% of enterprises repatriating / cost reductions >25%

• 37signals $3.2M → <$1M

• GEICO cloud costs 2.5×

• June 2026 government order / Fable access

• Qwen 942M downloads

• Qwen out-downloaded next eight orgs

• Chinese models >45% of weekly traffic

• 61% among ten most-used

• DeepSeek 26,000+ enterprise accounts

• 58% of new AI startups / market share

• Eight jurisdictions restricted DeepSeek

• State Council “AI Plus” Initiative

• National Five-Year Plan

• Macro hedge / export controls

• France €109B

• EU AI Act GPAI exemptions

• Mistral Series C €11.7B / ASML 11%

• Mistral Medium 3.5

• EC four-part package

• Frontier AI Grand Challenge

• EUROPA consortium

• Portugal Amália

• Germany BMDS SPARK API

• Canada “AI for All”

• Cohere Command A+

• Nick Frosst quote

• Cohere North Mini Code

• India 38,231 GPUs

• ₹10,372 Cr outlay / 600 data labs

• India +5M GitHub developers

• 13.59% of DeepSeek MAU

• OECD.AI Policy Observatory

• Oxford Insights Gov AI Readiness Index 2024

• G42 / $15.2B Microsoft partnership

• South Korea $71.5B

• Saudi Humain $77B / 1.9GW

Section 4 · The harness is the new frontier

• LangChain 126,000+ stars / 60% share

• MCP servers/downloads (year in review)

• Databricks Omnigent

• Terminal-Bench 2.0

• Terminal-Bench 2.1 / Codex CLI / Fable scores

• vals.ai Terminus-2 run

• GLM 5.2

• MCP donation / 10,000+ servers / 97M downloads

• Linux Foundation AAIF formation

• OAuth 2.1 with PKCE (2025-03-26 spec)

• A2A production / platinum members

• ~21% mature agent governance

• Memory vendor landscape (Mem0/Letta/Zep/LangMem)

• Sandboxes (E2B/Daytona/Modal)

• Observability (Langfuse/Phoenix/LangSmith)

• Auth platforms (WorkOS/Okta/Auth0/Stytch/Arcade)

• Safety fine-tuning strip / NTIA response (CNAS)

• CVSS 9.3–9.4 authorization failures

• NTIA “monitor, not mandate”

• Multi-needle 1M-token retrieval

• Future of Life AI Safety Index

• Contractual assurances (Linux Foundation / ITPro)

• MCP 2025-11-25 spec

• A2A signed Agent Cards

• CoSAI MCP threat model

Section 5 · Opportunities

• “Hundreds” (OpenAI)

• “Billions” (Anthropic Series H)

The opening letter

Build with us.

In New Zealand's far north, a Māori broadcaster trains speech models for te reo — a language too small for any market — under a license that keeps the data with its people. PwC, one of the largest accounting firms in the world, fine-tuned an open model on the language of finance and runs it today for hundreds of clients, on its own hardware, with no per-token meter running. Researchers in Lausanne built an open medical model with the Red Cross, tuned to its humanitarian guidelines, and are preparing clinical trials at home and in Tanzania. In East Africa, farmers diagnose cassava disease with a model that runs on the phone itself, offline, in fields the cloud has never reached. In Switzerland, a public consortium trained a national model on public supercomputers and released all of it: weights, data, training code. None of them asked permission, and none of them could have rented this. They own it — that is the whole idea.

Open-source and open-weight AI now anchor one of the fastest-growing builder ecosystems in the history of software. Hugging Face alone hosts 2.5 million public models and 13 million users. A third of the Fortune 500 are among them. On OpenRouter, where developers route real production traffic, open-weight models went from a sliver of usage to roughly a third by late 2025. Just six months later, the platform moves 25 trillion tokens a week — five times as much — and the largest single source of that traffic is an open model. Developers are responding to what the models can do and what they cost. And on both counts open has become the practical choice.

This spring, the strongest closed model scored 60 and the strongest open model 54. A year earlier, the leading open model managed 22. Closed systems still lead on the hardest problems. But for what most builders actually ship — where price, control, and deployability matter — open models have crossed from promising to ready. Anyone still waiting for open source AI to grow up can stop waiting. It already has.

Governments are moving, too. The European Commission has proposed an “open source first” rule for how public institutions buy AI, and Canada has set a national target to lift business adoption from 12 percent to 60. When communities, markets, and governments converge on the same thing at once, they are telling you where this is heading: toward more intelligence, in more hands, and owned by more people.

None of this is inevitable, and the other future on offer is seductive. Picture a handful of validation machines reading the world back to you, smooth and confident and sourced to nothing you can check. The bazaar of a billion arguing voices is muffled by a polished concierge that answers to its owner. We got a preview this June, on a Friday afternoon, when one of the most advanced models went dark everywhere because a government sent a letter. Every business renting that model discovered an off switch that belonged to someone else.

We have been here before. Mozilla exists because one company tried to own the front door to the web, and an open community rose up to make sure it never could. Twenty-five years later, someone is running the same play. We bet on open the first time. Open won. Together, we can do it again.

Our belief is simple: the path forward is competition and interoperability. We believe in a world of many models, standard ways to plug them together, and the freedom to walk away from any vendor at any time. Open has a record here. It grew the pie and let more people own a slice of it.

Read what follows as a map: where open AI is winning — some numbers surprised even us — and where it is exposed. A case that hides its weak points is an advertisement.

The builders are already building. A rented future has deeper pockets; an owned one has more hands — millions more — and this story ends the same way every time it is told: the many, building in the open, outbuild the few behind walls.

Build with us.