When AI says it is open, ask what opened

This week, “open” described at least four different things in AI.

A coalition of more than 230 organizations called for protecting open-weight models. Moonshot published 1.56 terabytes of Kimi K3 weights . OpenAI released the code and instructions for its Codex Security scanning workflow . NVIDIA announced an Open Secure AI Alliance grouping everything from file formats to private-preview products.

The word was doing real work in each case. It was not doing the same work.

I kept returning to one question while covering them: when an AI project is called open, what exactly changed for an outsider?

“Is it open?” is usually too blunt. Ask three separate questions.

Artifact: What became available?

Freedom: What can someone now do without asking permission?

Gate: What still determines who can exercise that freedom?

Those questions do not settle every argument about open source. They do make the practical stakes visible.

Start with the artifact

The word open often expands beyond the thing that was actually released. This is not always deception. Readers also carry expectations from open-source software into releases that offer a different set of rights.

A company publishes model weights, and the model becomes “open.” It publishes a command-line tool, and the product becomes “open.” An alliance puts “open” in its name, and the initiative inherits the moral authority of open-source software before it has published a charter or common work plan.

The first discipline is therefore literal: name the object.

For Kimi K3, the object is a checkpoint: 96 weight files totaling 1.56 terabytes, plus configuration, documentation and a custom license . For Codex Security, it is an Apache-2.0 command-line interface, TypeScript software development kit and readable scanning instructions. For NVIDIA's new alliance, the visible objects are an announcement, a membership list, a join-interest form and a collection of existing projects with different licenses and access conditions.

These are not semantic distinctions for their own sake. The artifact determines what can be verified.

Public weights let an outside operator hash, mirror and run the same checkpoint. Public code lets a reviewer inspect how a workflow is organized and change that workflow. A public technical report gives claims and methods to scrutinize, but it is not the trained model. A public membership list shows who is associated with an initiative, but not what any member has committed to build.

If the artifact is unnamed, benefits from one open layer tend to spill into adjacent closed ones. Inspectable orchestration begins to sound like an inspectable model. Downloadable weights begin to sound like reproducible training. A large coalition begins to sound like a functioning commons.

Naming the artifact stops that spillover without denying the release's value.

Then name the freedom

Availability is not yet a useful account of openness. The harder question is what the release lets another person do without returning to the original provider.

The Open Source Initiative defines open-source AI through four freedoms: use, study, modify and share. It also says those freedoms require access to the preferred form for modification, including model parameters, the code used to train and run the system, and detailed information about the training data.

That is a demanding definition, and not every useful release satisfies it. It is still a good reminder that openness is about transferred agency, not merely visibility.

Kimi K3's public weights transfer custody. A suitably equipped operator can keep the checkpoint even if Moonshot changes its API, prices or product strategy. They can inspect the released files, adapt the model under its license, run evaluations that Moonshot did not choose, and serve it with different software. The release makes independent comparison possible.

That is a substantial freedom. It does not become meaningless because few people own the required hardware.

Codex Security transfers a different kind of agency. A reviewer can read the scanning procedure : inventory every file, track candidate vulnerabilities, validate them, reason about attack paths, and record coverage separately from findings. They can fork those instructions or integrate the public SDK into another workflow.

The model doing the reasoning remains an OpenAI service. The release-time code instantiates OpenAI's Codex SDK and handles stored credentials or API keys. So the open freedom is to inspect and change the procedure, not to possess the intelligence executing it.

The Open Secure AI Alliance is different again. Its announcement points to genuine public artifacts: the Safetensors file format, SPIFFE and SPIRE identity standards, NVIDIA research code and the Linux Foundation's Akrites vulnerability-response program. But the alliance itself has not yet exposed a comparable freedom. Its public pages do not show a charter, decision process, member obligations, technical workstreams or common repository.

People can use several projects named by the alliance. They cannot yet inspect how the alliance makes decisions or what joining entitles them to shape.

This is why “how open is it?” is less informative than “open for what?” These are separate axes, not rungs on one ladder.

A project may be open to inspect, possess, modify, redistribute, reproduce, operate independently or participate in governance. It can grant several of these freedoms and withhold others. Saying which ones were granted is more accurate than forcing every release into a single ranking.

Finally, locate the remaining gate

Every claim of openness leaves boundaries. The important question is whether a boundary is a practical barrier, a legal condition or a decision still controlled by one organization.

Kimi K3 makes the distinction unusually clear. The weights are public, but Moonshot recommends a tightly connected cluster of at least 64 accelerators. That is a resource barrier: no one needs Moonshot's permission to acquire the hardware, but very few people can afford it.

The license adds a real permission gate. A model-as-a-service business above $20 million in aggregate revenue over a consecutive 12-month period needs a separate commercial agreement with Moonshot. The weights can circulate beyond Moonshot's servers while some large-scale uses still return to Moonshot for consent.

Codex Security's gate sits at execution. Anyone can inspect the orchestration code, but a scan requires authentication and Codex Security access . OpenAI can change access, model availability or service terms. The public workflow reduces uncertainty about how the scanner works; it does not remove provider control over whether the default intelligence runs.

The alliance's gate is institutional. A public contact form invites organizations to express interest, but the public record does not say who decides admission, priorities or deliverables. An initiative can advocate open tools while keeping its own governance private. Those are separate choices.

There are also barriers that should not be mislabeled as gates. Expertise, bandwidth and hardware make a freedom harder to use, but they are not the same as a provider retaining the right to say no. This distinction matters because the remedies differ. Public compute can lower a resource barrier. A permissive license can remove a legal gate. Open governance can distribute decision rights. Better documentation can lower an expertise barrier.

Lumping them together as “not really open” hides what would need to change.

Openness moves power; it does not erase power

The strongest case for open weights this week was not that everyone can run a frontier model at home. It was that the original developer no longer has exclusive custody.

That shift matters even when control moves to a smaller group of well-equipped operators. Universities, governments, cloud providers and large firms can preserve a model, test it under different conditions and deploy it without routing every request through one vendor. The field becomes less dependent on a single API.

But less concentrated is not the same as broadly distributed. A 1.56-terabyte checkpoint and a 64-accelerator serving recommendation create a much larger constituency than one hosted endpoint, but not a universal one. Control has moved from one provider to organizations with enough compute, engineering talent and legal capacity.

The same pattern appears in source-open agent software. Publishing the harness can let many people inspect the permissions, prompts and evidence trail even when the underlying model remains hosted. That can improve accountability around the workflow. It can also make the hosted model more central by encouraging others to build around its interface.

Opening one layer can reduce dependence at that layer while reinforcing a gate somewhere else.

This is not an argument against partial openness. It is an argument for tracking where power went.

A better way to read the next announcement

The phrase “open AI” now covers too many arrangements to orient anyone by itself. The practical response is not to ban the word or spend every conversation litigating one universal definition.

Ask for a small ledger.

Artifact: What was released—weights, training code, inference code, data, documentation, evaluations, an interface, a standard or a governance document?

Freedom: What can an outsider now do without permission—inspect, keep, modify, redistribute, reproduce, operate or govern?

Gate: What still requires approval or remains controlled—license terms, API access, model service, compute allocation, data access, membership or decision rights?

Then add two qualifiers.

Barrier: What makes the freedom impractical even when permission is not required?

Evidence: Which claimed benefits have actually been demonstrated, rather than inferred from the release label?

Applied to this week, the ledger is simple.

Kimi K3 opened custody of a specific checkpoint, while commercial licensing and enormous compute needs still narrow who can operate it at scale. Codex Security opened a security-review procedure, while OpenAI still controls access to the model service that executes it. NVIDIA's alliance gathers many public artifacts under one banner, while the alliance's own governance and shared program remain largely invisible.

All three can be meaningful advances. They are advances along different axes.

The point of precision is not to catch companies using the wrong adjective. It is to tell people what they gained.

When a release is called open, the useful question is not whether the label feels deserved. It is which dependency disappeared, which new action became possible, and where someone still has to ask.

Source graph: Semble collection