On August 5, 2025, OpenAI did something it had not done since GPT-2 in 2019: it published the trained parameters of two capable models, gpt-oss-120b and gpt-oss-20b, under the permissive Apache 2.0 license and told anyone with a laptop to download them.[1][2] The everyday framing of AI as "open versus closed" misses the real structure of the debate, which now runs across a spectrum: open-source (weights plus training code and data), open-weight (downloadable parameters, recipe partly withheld), and closed (access only through a company's hosted service).[3][4] The distinction is not academic. It decides who can run a model on their own machines, who can fine-tune it, and, increasingly, which models a government reviews before release.
Why it matters now
Within a year the vocabulary went from niche to regulatory. On May 28–29, 2026, G7 Digital and Technology Ministers agreed on a first shared definition of "open-source AI" and "open-weights models" in Paris.[5] Reporting in August 2026 described a White House AI safety framework that focused pre-release scrutiny on closed frontier systems and excluded open-weight ones.[6] Separate reporting said closed models from OpenAI and Anthropic face a 30-day government review for cyberattack and national-security risk before release, while open-weight models are exempt even when they match closed-model performance.[7] Meanwhile the products kept coming: Meta launched a new open-weight model in August 2026, and Moonshot AI's Kimi K3 arrived as an open-weight release in July 2026.[8][9] The label you attach to a model now determines the legal path it travels.
The longer view
The center of gravity in this fight is moving from technical capability toward governance and provenance. Two or three years ago "open" mostly meant Meta's Llama 2 or Google's Gemma being downloadable.[3] Now standards bodies are competing to define the term: the Open Source Initiative's Open Source AI Definition 1.0 demands the four freedoms plus enough data information to recreate the system, while its "Open Weights" note stresses that publishing final weights and biases alone does not clear that bar.[10][11][12] The commercial map is shifting too. The most popular open models are increasingly Chinese, from DeepSeek, Alibaba's Qwen, and Moonshot, and open-weight systems tend to run much cheaper than American closed offerings.[4] That pushes closed labs toward a hybrid posture, monetizing hosted access and safety tooling while conceding the commodity model layer. The durable leverage is drifting to whoever controls distribution hubs, evaluation, and the definitions regulators adopt.
The key insight
The whole spectrum collapses onto one question: can you hold the weights? Weights are the learned numerical parameters of a trained network, the values that, once locked in, determine how a model reads input and generates output.[12][13] A closed model keeps them on the provider's servers, so every guardrail, price, and usage limit stays under the provider's control.[14] Publish the weights and that control transfers with the file. A downloader can run the model offline, fine-tune it, and, critically, strip the safety behavior the original trainer baked in. That single transfer of possession is why "open-weight" is a genuine category and not a marketing gloss: it changes who governs the model after release, not merely who can see inside it.
How it works
The binding constraint is this: weights are the model's behavior, but they are not the model's reproducibility. You can hold everything needed to run and modify a system while lacking what you would need to rebuild it from scratch.
Start with what "open-weight" actually requires. The Open Weight Definition says the actual weight files must be included and distributable, available at no more than reasonable reproduction cost, and in the form practitioners would really use.[15] It explicitly does not require releasing the training source code or training data, which is precisely why open-weight is a weaker claim than open source.[15][16] So what you get is the finished parameters and a license; what you don't get is the recipe that produced them.
Now trace the flow. You download the weights, run them on your own hardware, and fine-tune them for a task.[17] The system returns outputs governed by whatever behavior those parameters encode, plus whatever you retrain into them. The license, not the download, controls your redistribution and modification rights.[12] OpenAI's gpt-oss ships under Apache 2.0, which permits commercial use, modification, and redistribution, layered with an additional usage policy.[17][18]
Open source is the stricter tier. Under OSAID 1.0 you must also get training and inference code under an OSI-approved license, and enough data information for a skilled person to substantially recreate the system, with no field-of-use restrictions.[11] The gap between the tiers is exactly the training recipe: expose the learned behavior, withhold the path that made it.[15][19]
Implications
Near term. For product teams, the practical calculus is cost and control. Open-weight models run on user-controlled infrastructure and skip provider-managed endpoints, and they tend to be much cheaper than American closed systems, which makes them attractive for building products on top of a downloaded, fine-tuned base.[4][20] A company handling sensitive data can now keep a capable reasoning model entirely on its own machines rather than routing every request through an API. That is a real shift in where AI work can physically happen. OpenAI positioned gpt-oss precisely for teams that want to run and customize models on their own infrastructure.[2]
Medium term. Roles reorganize around governance rather than access. Because a model card, the documentation artifact describing intended use, training data, limitations, and ethics notes, cannot enforce anything downstream, compliance and safety work moves from "can we see the model" to "can we prove and constrain what a redistributed copy does."[21] One 2026 analysis found acceptable-use policies present in only 11.0% of the top 500 models, and 9.8% pairing permissive Apache 2.0 licensing with use restrictions that conflict with the license itself.[21] Expect new jobs and tooling around provenance, license reconciliation, and auditing of fine-tuned derivatives, plus regulators writing rules that hinge on downloadability as the trigger.
Tensions & open questions
Converged or fractured definitions. One reading holds that industry and policy have settled on a workable line: downloadable weights separate open-weight from closed.[3][14][20] Another notes that the very bodies invoked, OSI, IEEE-USA, the G7, are actively disputing whether weights-without-data counts as open at all.[12][15][5] Both are true at different scopes: an operational convention can coexist with an unresolved reproducibility fight.
Permissive or open-washing. Apache 2.0 does not admit field-of-use restrictions, so attaching a usage policy is arguably contradictory and hard to enforce downstream, which is why the 9.8% of models mixing the two matters.[18][21] Defenders read the policy as a narrow overlay on a genuinely permissive license.[17]
More dangerous, or just different. Researchers documented hundreds of cases of safety features deliberately removed from open models after download.[22] Yet whether open-weight systems are net more dangerous than closed ones is unproven, and provider-side monitoring for closed models is itself of contested efficacy.[21][22]
What review actually targets. Reporting shows open-weight models escaping a 30-day check that closed frontier systems face.[7][6] But it is unclear whether the trigger is release method or compute and capability thresholds that closed systems happen to cross.
Talking points
- "Open versus closed" is really a three-step ladder: closed keeps the weights on its servers, open-weight lets you download the parameters, open-source hands you the recipe too.
- The whole debate collapses to one question: once you hold the weights, you hold the behavior, including the ability to strip out the safety training.
- OpenAI hadn't done an open release since GPT-2 in 2019; gpt-oss in August 2025 was a real reversal, under a license that permits commercial use.[1][2][18]
- The most popular open models now come from China, from DeepSeek to Moonshot's Kimi K3, and they're much cheaper than American closed systems.[4][9]
- A model card documents intentions but enforces nothing once the file is downloaded, which is the core governance problem.[21]
The bottom line
- Core idea. Openness in AI is a spectrum, and the pivot is possession of the weights: closed keeps them hosted, open-weight ships the parameters, open-source adds the training recipe.[12][15][11]
- Why it matters. The label now decides who can run and fine-tune a model locally and which release faces pre-launch government review.[4][7]
- What to watch. Whether G7 and national definitions harden downloadability into a legal trigger, and how the open-washing fight over Apache-plus-policy resolves.[5][21]
Technical detail
The subtlety the OSI keeps pressing is that weights are a lossy artifact. "Open Weights refer to the final weights and biases of a trained neural network," and once locked in those values "determine how the model interprets input data and generates outputs."[12] They let you fine-tune, adapt, and deploy, but they do not include the training code or, where legally possible, the full dataset.[12] That is the reproducibility gap: you can perturb the model's behavior without ever being able to regenerate it.
The Open Weight Definition tries to close part of that gap without demanding full open source. It requires disclosure of architecture, training methodology, a description of training data and its provenance, and hyperparameter configurations, plus licenses that permit use, modification, and redistribution for any purpose with no discrimination against any user or industry.[23] Notably it also requires the training software itself to be open source or public domain.[23]
One artifact worth naming is the model card, the standard metadata layer on hubs like Hugging Face.[21] Because safety information often sits in generic README prose rather than structured fields, automated audit and policy mapping break down, which is why documentation cannot substitute for enforceable downstream control.[21]