Open Weights and Closed Labs

A model is, in the end, a file of numbers.

DeepSeek's largest model, DeepSeek-V4-Pro, is about 865 gigabytes of them, published under the MIT license: anyone can download it, run it on their own machines, change it and sell what they build. The numbers behind Claude, GPT-6 and Gemini are never published. They run only on servers their makers control, and you reach them by sending text and getting text back, on terms the lab sets and can change.

That difference gets argued in slogans: open models are free, a generation behind, a security risk. None of them helps you decide anything.

Here's what does. Publishing the weights moves control of deployment to the user: where the model runs, who sees the data, and when it changes. Control of training stays with the lab. The best open models trail the closed frontier by months, not years, and for most companies running one yourself costs more than renting, not less. So the reason to choose an open model is control, and the question that decides is whether it's good enough for the task you have.

What a weights release hands over

A model's weights are its parameters: the billions of numbers that training adjusts until the model predicts text well. Publishing them as open weights gives you three powers that an API, the remote connection you use to reach a closed model, never can.

Where it runs. On your servers, in your cloud account, on a laptop, inside a network with no internet connection at all. Nobody else sees the prompts or the answers.

Whether it changes. You can train it further on your own data, adjust its behavior, or compress it to fit smaller hardware.

Whether it stays the same. The version you tested in March answers the same way in December. No provider retires it, updates it quietly or changes its price.

What the release withholds is everything that produced the file: the training data, the code that cleaned and mixed it, the recipe and the computing. Think of a compiled program. You can run and patch it, but without the source code you can't rebuild it or see why it behaves as it does. The weights are the program; the data and training code are the source. The comparison breaks in one useful place: weights are far easier to modify than a program, because a little extra training changes their behavior deeply and cheaply.

That's also why almost every "open" model today is open weights rather than open source in the full sense. The Open Source Initiative's definition asks for the training code and enough detail about the data for a skilled person to build an equivalent system. The leading open releases publish weights and the code to run them, and stop there.

Open weights move control of deployment to the user. Control of training stays with the lab.

Privacy, a fixed version and customization come with the file. What the model learned, a fix for a flaw at its root, and next quarter's better successor stay with whoever trained it.

How far behind

Artificial Analysis, an independent tracker, combines ten evaluations (agent tasks, coding, knowledge and scientific reasoning) into a single index. In October 2026 the best closed model, Claude Opus 5.5, scored 58. The best open-weight model, Xiaomi's MiMo-V2.6-Pro, scored 46. A gap of 12 points.

In time: a closed model first reached 50 in June. The first open models reached 44 in July, 45 in August and 46 in late September, 104 days after that June release. Four months on, no open model had reached 50, and the closed frontier had moved to 58.

In 2024 Epoch AI, a research group, estimated that open models lagged the frontier by about a year. By late 2025 it put the lag at roughly three and a half months. So the honest summary is: open models trail by months, the gap at the very top has recently widened a little, and a level that was near the top of the market in spring can be downloaded in autumn. The open leaders are mostly Chinese; American open models sit far lower.

One caution matters more than the numbers. A composite score says little about your task. The only test that counts is your own evaluation set, a few dozen real cases with known good answers, run on the candidate model (Leaderboards Measure the Test).

Why a downloaded model is expensive to run

DeepSeek-V4-Pro's description says "1.6 trillion parameters, 49 billion active." Those two numbers explain most of what self-hosting costs.

The model is a mixture of experts. Inside, it's split into many specialist sub-networks, and for each token (a word or piece of a word) a small router picks a few of them. So each token passes through only about 49 billion parameters, roughly 3 percent of the total. Those are its active parameters.

Hardware pays for the two numbers separately. Memory pays for the total, because any token might need any expert, so all 1.6 trillion parameters must sit in the chips' memory at once. Computing pays for the active share, so each token costs roughly what it would in a much smaller model.

Scroll sideways to see the whole figure

Even stored compactly, with fewer bits per number (a technique called quantization), the weights take 865 GB. A server with eight of Nvidia's H100 chips holds 640 GB and can't load it. One with eight of the newer B200 chips holds 1,440 GB, enough for the model plus the working memory of requests in flight. So the smallest unit you can deploy is a whole eight-chip server, about $39,000 a month at one cloud provider's on-demand price.

Once that server runs, extra requests are cheap, because the model processes many at once. Like a bus, it costs the same with three passengers or sixty, so your cost per request depends on how full you keep it.

Smaller open models change the picture. OpenAI's gpt-oss-120b is designed to fit on a single 80 GB chip, which rents for about $2,900 a month, putting self-hosting within reach of far more companies.

Three ways to run the same workload

Take one workload and price it three ways. The numbers are illustrative assumptions, plausible for October 2026.

• A closed API at the list price of Claude Sonnet 5.5 and GPT-6.1 Sol: about $3.60 per million tokens for a typical mix of input and output.
• The same open model through a third-party host, a company that runs it and charges per token: about $1.56 per million at one major host.
• Self-hosting on rented B200 servers: two servers minimum so one can fail without an outage, one and a half engineers to run them, and some monitoring.

Scroll sideways to see the whole figure

Self-hosting has a floor of about $104,000 a month before any traffic. The closed API only reaches that bill at about 29 billion tokens a month. At two billion tokens a month, which is already heavy for most companies, the bills are about $7,200 for the closed API, $3,120 for the hosted open model, and $104,000 for doing it yourself.

For scale: Ramp, which tracks business spending, reported that the median company among its customers spent $2,246 a month on AI tokens in April 2026. That's about 2 percent of the break-even volume.

Three conclusions survive any reasonable change to the assumptions. The cheapest way to use an open model is usually someone else's chips, because a host pools many customers' traffic across time zones and keeps the bus full in a way one company can't. The fixed floor dominates everything until you're very large. And the comparison isn't at equal quality: the open model in this example scores well below the two closed ones on the index above, so the first test is still whether any open model passes your own evaluation set.

For most companies, the price per token is the weakest reason to run an open model yourself.

The reasons that are real

If cost rarely justifies self-hosting, control often does. Each reason has a closed alternative that covers part of it, so be precise about which one you actually have.

Data that can't leave. A model inside your own network sends nothing to anyone. That's decisive for air-gapped networks (defense, some industrial sites, classified work) and devices that must work offline. It matters less for ordinary data-residency rules, because the major closed models are sold through AWS, Google Cloud and Azure in chosen regions, and Anthropic and OpenAI say API traffic isn't used for training by default. Open weights become necessary when data may reach no third party at all, cloud providers included.

A version that holds still. Anthropic commits not to retire Opus 5.5 before September 2027, about a year after release. In a regulated process where any change of model means revalidating the whole workflow, a year is short. With weights, the validated version runs as long as you choose. The cost is symmetric: you keep its flaws, miss the improvements and schedule your own migrations.

Training on your own data. With weights you can fine-tune by any method and keep the result. Closed vendors offer this narrowly or not at all. Often, putting the right knowledge in the model's context works as well, but when it doesn't, weights are the way in.

A credible alternative. A company that can show it's able to move a workload to an open model probably negotiates differently with closed vendors.

What comes with the file

Control comes with responsibilities a closed API handles upstream.

Safety training can be removed. In 2023 researchers showed that ten adversarial examples, costing less than 20 cents through a fine-tuning service, made a well-behaved model answer nearly any harmful request. With the weights in hand, nobody watches the fine-tuning. If you deploy an open model in a product, the abuse monitoring and output filtering that a closed provider applies become your job.

You become the operator. Patching, scaling and incident response move in-house, and some model file formats can even execute code when loaded, so use trusted sources and formats that store only numbers.

What was trained in stays in. In 2025 a US government evaluation of earlier DeepSeek models reported that one version answered most overtly malicious requests under a common jailbreak and repeated Chinese Communist Party narratives far more often than American models. That evaluation had a stated policy purpose and didn't cover the current version. But it separates two concerns people often blur. Running weights locally removes any data flow to the developer. It doesn't remove behavior learned in training. For a model from any lab in any country, test the behaviors your use depends on before deploying it.

Read the license, not the label

"Open" covers licenses with very different terms. Some are standard permissive licenses: DeepSeek-V4 uses MIT, OpenAI's gpt-oss and Alibaba's smaller Qwen models use Apache 2.0. Others are custom: permissive for nearly everyone, with a condition at a size threshold aimed at companies that would resell the model as a service. Meta's Llama 3.1 license required any company with more than 700 million monthly users to ask Meta for permission, which reached only Meta's direct competitors. Moonshot's Kimi K3 license asks for a separate agreement from model-as-a-service businesses above $20 million in yearly revenue.

For a bank running a model on its own documents, these licenses are effectively permissive. For a cloud company reselling the model at scale, they're an invitation to negotiate. Two details deserve a lawyer: revenue thresholds usually count affiliates, so an acquisition can cross one overnight; and the license that binds is the file in the repository, not a vendor's web page or a tracker's label. European regulation draws its own line, and an open license doesn't remove every obligation (Regulation as a Design Constraint).

Why anyone gives weights away

A lab that sells access to its models has every reason to keep its weights, since they're the asset its revenue rests on (Why Labs Build Products). The interesting question is why anyone publishes them.

Meta's own story answers it. In 2024 Mark Zuckerberg argued for open models, noting that openness cost Meta little because selling access to AI models wasn't its business. Then the business changed. In April 2026 Meta launched a closed model, offered through its own app and an API, and the open model it released in August scores 17 on the index against 48 for its closed flagship. My reading: a lab opens the layer it doesn't sell. Once Meta charged for model access, giving away its best model would have competed with its own product.

The software writer Joel Spolsky put the principle in 2002: smart companies try to make their products' complements cheap. A company that profits from advertising, chips or cloud hosting gains when models are cheap and plentiful, because cheap models raise demand for what it actually sells. The threshold licenses fit the same pattern from another angle: nearly everyone may build on the model, and the big companies best placed to resell it must come and make a deal.

And each strong open release shortens the time others need to rediscover what its makers learned (The Price of Know-how), which is why the downloadable floor now trails the frontier by months.

What I'd do

The strongest objection: open models are always behind, so they don't matter. If your work needs the frontier, a 12-point gap does settle it, and cheap closed models now list at or below comparable open ones.

But "behind" is measured at the top, and most work in a company sits well below the frontier. Open models also discipline prices: at the same score, the leading open model listed at a small fraction of a comparable closed model's price, and every vendor pricing a mid-tier model has to reckon with that. And where control is a hard requirement, the choice is an open model or nothing, and the only question is whether it's good enough. For well-defined work, it increasingly is.

The useful question is whether the open model is good enough for this task, given the control you need.

So my advice is a short sequence.

Start with the requirement, not the model. Does the data need to stay inside your walls, the version need to stay frozen, or the model need training on your own data? If none of these, a closed API or a hosted open model is almost certainly simpler and cheaper.

Test on your own cases. Run your evaluation set on the best closed model, a cheap closed one and the best open one. You may find the cheap tier of either kind is enough.

If you go open, rent before you own. A third-party host gives you the model at a fraction of the closed price without the $100,000 floor. Self-host only when control demands it or your volume is in the tens of billions of tokens a month.

Read the license file and own the guardrails. Check the thresholds against your business, and budget for the filtering and monitoring a closed provider would have done for you.

Keep the option open. Being able to move a workload between closed and open models is worth more than today's choice, because the gap, the prices and the labs' strategies will move again.

Check yourself

What does a weights release hand over, and what stays with the lab?

It hands over control of deployment: where the model runs, who sees the data and whether it changes. The training data, code and recipe stay with the lab.

Why is self-hosting a big open model so expensive?

Memory has to hold all the parameters even though each token uses only a few, so the smallest unit is a whole server. That fixed floor dominates until volume is very large.

When is an open model the right choice?

When control is a hard requirement, such as data that cannot leave or a frozen version, and the model passes your own evaluation.