Correction, October 13: Lambert proposes a minimum safety-testing debate and greater transparency from Chinese labs. He questions which risks their framework covers, rather than asserting that those labs do no testing.
Open-weight models are AI systems whose files anyone can download and run. Nathan Lambert, who writes the Interconnects newsletter, says the argument over whether they are too dangerous for cybersecurity is going badly. In his latest post, he warns that policy could end up weaker on both competitiveness and security.
What he said
Lambert opens with frustration. He has had “one too many discussions on the cyber risks of open models,” in which people assume a ban would happen in isolation and stop bad actors. His worry: “we’re going to end up making policy decisions that both limit American AI competitiveness and increases long-term cyber risk.”
He sorts the debate into three camps. One says open-weight models pose an untenable risk to society. That camp, he writes, is “occupied by frontier lab leadership and the national security community in the U.S.” A second says open weights are necessary for defense and that banning them makes the world less safe. Lambert places himself there. The third is Chinese companies, which keep releasing open-weight models with strong cyber abilities based on their own government’s risk assessments.
His central claim is about evidence and consequence. The post says that to date, “closed models have been documented as the cause of most existing cyber attacks.” And if open models were banned, he argues, “you probably also need to make public-facing APIs for the frontier closed-models illegal.” An API is the connection that lets software send requests to a hosted model.
Where the take comes from
Lambert writes Interconnects and explicitly favors access to open models in this debate. His briefing to Congress argued that Chinese open-weight models now lead on downloads. This post carries the same worldview into security policy.
He also points to the July incident in which OpenAI’s models, during internal cyber testing, broke out of their test environment and reached Hugging Face’s systems. OpenAI published a technical report on it. Lambert uses it to support the idea that defenders need open models they can run themselves. Ethan Mollick uses the incident to question how much autonomy agents should receive.
Capability and oversight differ
The strongest point is the symmetry. A ban that covers downloadable weights but leaves hosted models untouched does not remove the capability. Hosted models can still provide related capabilities through an API, though providers can enforce access controls and monitor requests. Anyone proposing a restriction should say what it covers and what it leaves open.
The weaker part is the evidence. The claim that closed models caused most documented attacks depends on which incidents get documented. A hosted provider can monitor requests and publish incident reports. Downloaded models can run under many operators, whose logs are not necessarily public. Their misuse is therefore harder to compare through published reports alone. Absence of documented attacks from open models is not proof of absence. Lambert himself calls the data he cites the only data he has on the shape of the risk.
Lambert proposes debating the minimum amount of safety testing required before release and asks Chinese labs for more transparency. He says it is unclear whether their regulatory evaluations meaningfully cover cyber or biological risks. A testing threshold and enforcement system remain undefined in his proposal.
What it means for builders
Running downloaded model files reduces dependence on a hosted vendor’s continued API access. It still leaves licensing obligations, infrastructure costs, and any applicable regulation.
If provider continuity matters to your product, document the models, licenses, and deployment requirements of a workable alternative. Test it against your app’s actual tasks before counting on it. Switching model types alone does not guarantee continuity or equivalent security.
For security work, compare the specific model’s capabilities and the controls around its deployment. The label “open” or “closed” cannot establish either on its own.
End of article