Owners Not Renters

The Money People Are Buying the Meter

Raffi Krikorian — Tue, 25 Aug 2026 20:29:49 GMT

A lot of the time, when you ask an AI a question, there’s a “chooser” standing between you and the model. Sometimes it picks the model. Sometimes you picked the model and it picks who serves it. Sometimes it only picks the capacity tier, or maybe the fallback when something breaks. What looks like one API call can hold a small market’s worth of decisions. This is what kids today are calling a router. And until this week, routers were the kind of thing only infrastructure engineers argued about.

Then the money showed up.

Last week, Bloomberg reported that the financial services company Stripe was buying OpenRouter for more than $7B. By Wednesday, Stripe confirmed it had agreed to acquire the company — price undisclosed, though reports claimed it had crept toward $8B by then. OpenRouter, which launched in early 2023, was valued at $1.3B in May. Three months later, it’s worth roughly six times that. Next act: That same Wednesday, Ramp — yup, the corporate card company — launched Router.com. (They bought the domain for the occasion.) Routing is now free through the end of 2026!

In one week, two of the best payments companies in the world moved to own the same piece of plumbing: the thing that decides which AI model answers your question. Stripe spent a decade making money from moving money. Ramp built a business on knowing where corporate money goes. Now both are pointing those skills at intelligence.

The money people are buying the meter.

Will the Layer Stay Neutral?

Look, I’m one of the many reasons the meter is worth buying. I’m a developer who uses OpenRouter. One API key and I can call almost any model on the market. I don’t have to write a separate integration for every provider, and I don’t have to keep track of half a dozen vendor accounts. It’s super convenient.

When I ask an AI something, I’m almost never talking to one model (there are hundreds now). The router sits between the question and all of them. It picks the backup when a model fails or is unavailable, retries when calls hang, caches what it has already seen, and chooses which provider actually serves the tokens — at what speed, what price, and sometimes what quantization. (I’ve got a whole post on providers and quantization.) You can pin a model and it still sometimes load-balances providers underneath you. Today, most of that policy is still yours to override. The real question is whether override stays a first-class feature — or whether choosing is something you’ll have quietly handed over. (Even the labs run this way: GPT-5 in ChatGPT was, by OpenAI’s own description, a fast model, a deeper reasoning model, and a router deciding on every request which one you get.)

So follow the money. Routers got popular for good reasons. Mine is convenience. The deeper one is churn. Models keep changing underneath you: deprecated, repriced, and once in a while switched off entirely. A router was insurance: one API, and you never get stranded. Then the insurance provider got bought. OpenRouter’s own “about” page says it exists to eliminate vendor lock-in. But…the anti-lock-in layer got locked in. Stripe and OpenRouter both say the layer stays neutral, and I take them at their word. The word isn’t the problem. Words don’t survive ownership changes. Structure does.

The Traffic Report Has Started Steering the Traffic

Why would payments companies want this layer? Because it’s the intelligence play. The router sees the flow: which models actually get used, through which providers, at what cost, and how that shifts week to week. Not the words — OpenRouter says it doesn’t store prompts or responses by default — but the shape of the whole market. Its research team has analyzed over 100 trillion tokens of real-world traffic. When Mozilla wrote the State of Open Source AI report, that public data was one of our best instruments for measuring what developers actually run. It’s a traffic camera at one of the busiest corners in AI. And its new Auto Router already uses aggregate spend to decide where future requests go: The traffic report has started steering the traffic.

Stripe says it’s buying routing and token optimization, and Stripe CEO Patrick Collison put it plainly: “Tokens are the central currency for companies building with AI.” In markets, the intermediary who sees the whole flow learns things no single participant can. Stripe made its fortune metering money. Metering intelligence is the same business at a bigger scale.

The chatbot you ask about the mole on your arm, your kid’s tutoring app, or the tool your lawyer runs contracts through: behind each one a router decides — on cost grounds you’ll never see — which model is good enough for you. Ramp’s launch copy promises “the lowest-cost model that meets the required performance level.” Required by whom?

Finance already ran this play. Robinhood made trading free; the money came from market makers who paid to have your orders routed their way. (Basically, payment for “order flow.”) The SEC eventually fined Robinhood $65M over how it disclosed the arrangement. That’s the warning from history. But when routing goes free, it’s fair to ask who the flow is for.

On top of visibility, the moment a broker gets discretion over where your order goes, price stops being the only question. It’s the 10-blue-links problem, one layer back: first the chatbot hides the 10 blue links behind a single answer; now the router picks the brain behind the chatbot. Securities markets eventually built disclosure rules around exactly this: Rule 606 makes brokers show their routing. AI has no Rule 606. It should, and for every request: which model, which provider, which tier, which fallback, what it cost, what the router was optimizing for, and whether anyone paid for preference.

The buyers’ own industry is already regulated for exactly this. Since 2010, the Durbin Amendment has required every U.S. debit card to work on at least two unaffiliated networks, so the merchant, not the network, keeps the choice of route. Congress looked at payment routing and decided owning the route was owning too much. It’s fighting right now over whether to extend the same rule to credit cards. But AI routing is a layer with no Durbin, no Rule 606, no rules at all. Nobody prices a captured route better than the people the law forces to give one up. So the question worth pricing: Does durable value sit in owning the switch, or in defining the interface that makes switches replaceable?

Setting the Bar for Any Router

All of it would matter less if routing were neutral plumbing — same weights, same behavior, whoever serves them. It isn’t. I measured. This summer, I ran the same coding tasks, in the same harness, against the same model name served by different providers, and the solve rate ranged from 26% to 44%. Eighteen points between the best and worst serving of one model, bigger than the gap between the flagship harnesses themselves. “Same model” is not enough information to reproduce a result.

So do we self-host everything and churn our own butter? Of course not. Ownership never meant owning every dependency. It means having a choice. And the layer that decides how your application uses intelligence is exactly the choice you can’t afford to hand over. Here’s how we should set the bar, for any router — closed or open:

You can read the meter. A routing receipt on every request: model, provider, tier, fallbacks, price, latency, data policy, and the router’s own economics wherever they touch the choice. “Why did I get this answer?” should have an answer.

Your policy lives in your repo. Routing is application logic — code you can diff, test, and export. A dashboard can be a view of the policy, never its only copy.

Exit costs a weekend, not a quarter. Lock-in gets measured on your worst day. A change of owners upstream should be a config change downstream, and an exit that’s never been tested is a promise, not a property.

The chooser never profits from your worst outcome. Disclosed economics, inspectable objective. If the router gets paid differently depending on where you land, the receipt says so. You can’t audit a promise.

Open weights need open pipes. The license lets you possess the model. The serving path decides how much control you keep when you actually run it. I have the benchmarks.

The old objection was practical: Fine, the source is open, but who has time to operate someone else’s router codebase? But look at the alternative. Point a coding agent at an open router and ask it to show you exactly how fallbacks get chosen, or to add an adapter for your internal endpoint — done by the afternoon. Open source was always about leverage more than charity. Well, the leverage just multiplied.

Stripe and Ramp haven’t proved that the router will own the AI economy. They’ve placed an unusually expensive bet that the execution layer matters. For now, that layer is still yours.

Believe the bet. Then go read your own meter.

Subscribe now

Owners Not Renters Episode Two is Coming!

Raffi Krikorian — Mon, 24 Aug 2026 18:50:56 GMT

After the success of Episode One, we can't wait to hop back on stream with new community members and new guest.

The Owners Not Renters livestream is a new live show for the open source AI community: a regular place to see what people are actually building, ask questions, and figure out how to start contributing to the cause. Open source AI has plenty of interested people and nowhere to gather! This show is that place.

Episode two is Tuesday, August 25th at 11am ET with guests Richard Tweed and Nathan Brake, and it ends with open audience Q&A. Come and join in!

Add to Calendar

The Week in Open-Source AI | 8.21

Raffi Krikorian — Fri, 21 Aug 2026 14:36:14 GMT

What is it with AI CEOs and their manifestos? Last week it was Zuckerberg’s 6,500 words. Back in June, Dario Amodei published a full tome. But this week Dario did something rarer than a manifesto - he logged on, posted all weekend, and diagnosed the AI backlash as “a crisis of trust.” Two days earlier, a CNBC poll had asked young Americans about nine AI leaders by name. Every single one came back majority-distrusted. So the polls say he’s right - which is the most dangerous kind of right there is.

So this week is about trust: who asks for it, and who builds it. Two fintechs went to war over who meters AI. And the story I can’t stop thinking about? The safety trained into open-weight models strips out in minutes. The same week, Google shipped the other kind of protection: encryption that computes on your data without ever seeing it. Not “promises not to look.” Cannot look. One is a promise. The other is architecture. Words don’t mean much. Architecture does.

Tell me what you think.

I’m reading everything:

Subscribe now

One Model Name, Four Different Outcomes

Raffi Krikorian — Wed, 19 Aug 2026 13:30:38 GMT

I may have an unhealthy thing for experimenting and benchmarking. I wrote Morph because I thought the only way to know which model you should use is to test it on your own traces. (If you want another example, I also have an extensive spreadsheet on all the permutations of pizza dough I’ve tried and tweaked through the years.)

Fast-forward to part one of an experiment I recently did to understand the base-level performance of the current coding harnesses — Claude Code, Codex, Kimi Code — and how they perform with their default models. Specifically, what happens if you swap in open-weight models? How much of a performance score is the harness, and how much is the model? And the one that I’m really chasing: Can several coding agents working together beat the best single coding agent alone? (Because if that’s true, imagine using less powerful local models, composited together, or things like that.) This is only the first phase — I know I’m not done here, and am still running experiments.

The finding I kept coming back to? The serving path — who actually answers when you ask for a model by name — moved my results as much as swapping the model itself.

Subscribe now

The Exam

I needed a test, something to benchmark everybody on, so I chose SWE-rebench-V2. The nice thing about that benchmark is that each task is a real moment from a real open-source project — an actual ticket that a human filed, plus the codebase from that day. The agent gets the issue and the repo, and a timer set at 30 minutes. Grading is simple: When time’s up, run the project’s own test suite, including the tests written to catch the bug.

(I used rebench because the original, SWE-bench Verified, has been public since 2023, which means that the answers are probably in everybody’s training sets. Rebench refreshes continuously.)

The shootout: The three harnesses, each on its default model (claude-opus-5, gpt-5.6-sol, kimi-k2.7-code). Then model swaps inside Kimi Code (k2.6, then k3). Then one model name, kimi-k3, across four serving paths. And one open model, GLM-5.2, hosted through Codex at two more providers. I could have been a bit more rigorous, but I was just doing a bit of sampling and experimentation to get started.

In all these permutations, I recorded cost per task (failures included) and solves — shown everywhere as solves/attempts, because the numerator matters. My sample is 30 tasks; at this size, only gaps of roughly 20 points separate skill from luck.

One label needs flagging up front: My Codex arm ran gpt-5.6-sol at high reasoning effort — pinned to match the public leaderboards — while the CLI’s out-of-box default is medium. Read that row as “leaderboard configuration,” not factory settings.

Defaults first:

Claude leads, but I can’t actually tell Claude and Codex apart at this sample size (exact McNemar on the paired tasks, discordant 5:3, p = 0.727 — and the intervals are wide). Kimi’s dash is a blank, not a zero: that harness reports neither tokens nor cost, so it ranks on quality but can’t enter a cost argument. (At some point, I’ll put a counting proxy in front of it.)

Two Dials

Now let’s turn some dials. In Mozilla’s State of Open Source AI report, we said the harness is where the action is — it can move a model by a lot. So let’s separate the harness from the model. I held Kimi Code fixed and swapped only the model: The coding-tuned default solved 7/28 (25%), the general k2.6 solved 8/26 (31%), and k3 solved 12/27 (44%). Nineteen points from a model swap, harness untouched. And yes, the coding-tuned variant was the worst of the three on this sample.

(For future work, I want to cross the full matrix — every model in every harness. Claude Code speaks Anthropic’s wire protocol, so hosting a foreign model inside it means inserting my own proxy into the thing being measured.)

Shopping for a Model

There are a lot of open-weight models you can run yourself. Most people aren’t going to have the hardware, nor even want to rent the hardware, for K3 and GLM-5.2, so I went shopping. One model ID is available across as many as 21 provider endpoints (as of my runs), at advertised quantizations from 4-bit to full precision. Prices vary several-fold for the same weights, with availability that comes and goes — behind a router that may pick per request, stick a session to one endpoint, or fail over mid-conversation. I measured four identical calls served by two providers at two different advertised precisions. I’m trying to guard against the unpinned benchmark. That number, if it remains unpinned, is just a sample from a distribution.

So I built a small proxy that injects a provider pin and records which deployment answered every call — 959 calls on one arm, zero violations. Then: same harness, same tasks, one model name (kimi-k3), four serving paths:

Nineteen points between the worst path and the best.

Provider and precision change together in that table, and the precision labels may not mean what they seem. Moonshot released K3 with quantization-aware training baked in: The official checkpoint is natively MXFP4 weights with MXFP8 activations. There is no higher-precision K3 sitting behind it. 4-bit is what Moonshot trained and what Moonshot evaluates. So an endpoint labeled “fp8” can’t simply mean “the same weights, less compressed,” and “Moonshot direct” can’t be assumed to sit at the top of a precision ladder; it’s presumably serving the native 4-bit checkpoint, too. Which makes the sharpest comparison in the table the one I’d been under-weighting: Moonshot’s endpoint through the aggregator (7/28) versus Moonshot’s own API, direct (12/27). If both serve the native checkpoint, roughly 19 points sit in the translation layer between me and the same weights.

There’s a named suspect for how. K3 is trained in “preserved thinking history” mode — it expects its own reasoning content handed back intact on every turn — and Moonshot’s own documentation warns that harnesses or paths that truncate or modify that history cause significant quality degradation. If the serving path drops or alters K3’s earlier reasoning, you’d expect it to get worse as a task goes on — which is consistent with what I saw.

My 30-minute wall clock adds a third suspect: A slower path buys fewer inference cycles before the buzzer, so speed converts into solves. Precision, protocol fidelity, latency — what I’ve measured is their sum: the serving path. Isolating the mechanism comes next, starting with the cheapest test, a transcript-fidelity check on every path: Does what the model said come back to it intact?

The Economics Are Backwards

BaseTen and Modal publish identical per-token rates for this model. Same sticker. The BaseTen path still spent 19% less in total and solved 43% more tasks — $2.33 per solved task against $4.12 — because a degraded path burns turns failing: re-reading files, re-running tests, retrying tool calls, and billing you for every token of the flailing. Per-token price couldn’t distinguish these two sellers at all; cost per solved task could — the Modal path cost 77% more per solved task. Anything cheap that makes an agent fail more is more expensive than the price list says.

It compounds. The aggregator’s displayed price for a model tracks its cheapest endpoint. One provider’s rate doubled in 14 hours, mid-run. And on two independent runs, roughly 80% of the output tokens the billing meter charged me for never appeared in the usage fields the API returned — reasoning tokens, billed but not reported. (Next audit: reconcile per-generation IDs against the invoice.) A price here is a reading with a timestamp; the numerical recipe you’re actually served isn’t part of any spec you can hold a seller to; the only bill you can trust is the meter. Renting is fine — most of us will rent inference forever — but this is renting without a lease.

The Team Question

Back to why I even started this: I wanted to know whether a team of agents can beat a single agent on the biggest one. I’m still tinkering with the orchestration framework. The honest status? Nothing is landing yet.

I’ve tried a bunch of arrangements — Claude as the coder, Codex as the reviewer, and so on. The best of them gained +7 points in my sandbox and exactly zero on a held-out task set the ideas had never touched. (I keep one precisely so a lucky sandbox result can’t seduce me. This one tried.) The sharpest result is set arithmetic, not a percentage. For a selector over already-generated patches to beat its best member, the other members must solve something the best one misses. Against solo Claude: GLM-5.2 at one vendor contributed zero unique solves. GLM-5.2 at a second, independent vendor — run to rule out a degraded path masking the effect — zero. Kimi-k3 at its best: zero. The open-model candidates never solved a task that Claude missed. So no matter how smart the selector was, it had nothing better to choose.

That kills one class of system on my sample: independent generation plus a picker. It says nothing yet about real collaboration — a reviewer pointing at a bug so the coder can revise creates patches that never existed in either solo set. That, plus candidates chosen for genuine complementarity (which might mean a different model family, or might just mean resampling the strongest model) is what I’m testing next. I couldn’t run the frontier-plus-open cell honestly until the pinning machinery existed. Now I can.

So the summary, for now: The model swap moved about 19 points. The serving path moved about 19 points. Swapping the harness, with everything else pinned, moved about 3. No strategy has survived the held-out set. My sample can’t rank those first two against each other — they’re the same size at this resolution — so the operating rule is simpler: Before buying orchestration, benchmark the model and the endpoint that actually serves it. Both are cheap; each serving-path rung above cost me under $35 to run.

Next…

If you build with agents: Measure the model. (Don’t trust the “code-tuned” label.) Pin the serving path, log what it advertises, and judge sellers on cost per solved task, never per token. Demand held-out evidence before buying any multi-agent pattern.

If you buy inference at scale: Benchmark your own workload across paths, because the market quotes tokens and you consume outcomes.

And if you allocate capital: Served well, open-weight models were pretty close to the closed frontier on my sample, at about half the cost per solved task.

So: 19 runs, 1,001 graded attempts — an attempt being one agent configuration on one task, across a pool that includes a 100-task held-out set, which is how 19 runs makes 1,001. I’m going to keep tinkering. Next up: that transcript-fidelity test, the same ladder with the provider held constant, and swapping models into Claude Code and Codex.

Tell me what you’re working on in the comments. I’d love to chip in.

Leave a comment

The Week in Open-Source AI | 8.14

Raffi Krikorian — Fri, 14 Aug 2026 21:55:14 GMT

Mark Zuckerberg published a 6,500-word manifesto on AI this week, writing that instead of centralizing superintelligence, we should distribute it widely and give every person the ability to direct it. That could be my line! So I wrote a response in the Guardian. The short version: when the landlord starts quoting the tenants’ rights pamphlet, you should read the lease. Carefully.

So, this week is about reading the lease. Meta and NVIDIA released two different versions of open this week. Six giants who agree on nothing agreed on a folder format. And the one story I can’t stop thinking about? The approve button died this week. The last layer where you held the pen just moved from your finger into a model. A closed one. Run by a vendor.

Tell me what you think.

Leave a comment

I’m reading everything:

Subscribe now

23andMe by Me

Raffi Krikorian — Wed, 12 Aug 2026 16:06:48 GMT

We’ve been focused a lot on the unique things you can build with open-source AI. But this week, what if we focus on something that we may only want to do when we’re in full control of the AI? Let’s work with the most unique — and private — data you own: your genome.

If you were mad when X changed its terms so it could train on your posts and DMs, then get this: 23andMe went bankrupt last year. In the proceedings, its DNA database was what it had always been on the balance sheet: an asset. Something to be valued, transferred, sold. Fifteen million users learned that “your data” — a.k.a. the most personal file ever created about them — was on the selling block.

A genome is a private key with no revocation path. But you don’t hold it alone: Half of it is your mother’s, and half of it goes to your kids. So when 23andMe’s database moves, it won’t be 15 million customers moving with it. It’s also their parents, their siblings, their children — generations that never clicked “I agree,” and who definitely didn’t agree to participate in this sale.

I’ve always wanted to get my genome sequenced, just out of nerdy curiosity. But I absolutely didn’t want to trust one of these cloud providers. So a few months ago, I went looking for a way to get sequenced without giving away my genome. After many emails, I found a lab that promised to delete my data after delivering it. A promise is not architecture, I know, but it was the best on offer. And when their portal offered cloud interpretation (as in, analyze the results)…the answer was no! Don’t read it, just deliver me the raw data.

I had a theory I wanted to test. Maybe I could start playing with locally run LLMs to see if they could analyze the genomic data for me. This way I’m not uploading my private data to a cloud provider. If local AI is worth anything, it’s worth it here. So read on, and I’ll tell you how I took the data — and interpretation — into my own hands, and how you can, too. (And how, in the end, the LLM wasn’t the most useful thing.)

Full disclosure: I’m not a genomics expert, and a lot of this was learned by bumbling around, reading the web, asking chatbots/AIs, and emailing actual experts. So take the following with a grain of salt, but I definitely had fun.

The Bill of Materials

Fascinatingly, what the company delivered was a VCF: a text file listing the 5,291,552 places where my DNA differs from the reference human genome. They literally called the reference a “build” — GRCh37, GRCh38 — with differences between builds called “liftover.” It reminds me of how software people talk.

I am a fork of the human reference build. You can be, too.

Here’s everything I needed to start doing some form analysis, from a computer to some tools to run on it — and some LLMs to start tinkering with:

The machine

Intel i9, 16 cores, 62GB RAM;
RTX 3070 (a gaming GPU)

The data — the world’s (free to download, ~145 GB)

The reference genome builds — the “standard human” everything gets compared against.
ClinVar — a public registry of DNA variants known to cause problems, with notes on how confident to be about each claim. (Security folks: it’s literally a CVE database — the industry’s shared list of known bugs — except for humans.)
gnomAD — a census of how common each variant is across humanity. Common usually means harmless; rare is where disease hides.
The 1000 Genomes panel — 2,504 public, anonymous genomes to compare against, for the privacy math later.

The tools/software that I downloaded

DeepVariant — a “variant caller”: the program that pieces the shredded snippets back together against the reference and decides where you truly differ. My lab already ran one to produce my VCF; this one is Google’s, sharing no code with theirs — my second opinion.
VEP — the annotator: takes each of my five million diffs and stamps it with what the world knows — which gene it sits in, what it changes, whether anyone has ever linked it to disease.
Cyrius — a specialist for one drug-metabolism gene that general-purpose tools famously misread, because it sits next to a nearly identical decoy copy of itself.
ExpansionHunter — measures the places where DNA can stutter: a short phrase repeated too many times, which past a threshold causes serious disease.
Manta — scans for big structural damage: whole chunks of chromosomes missing, duplicated, or flipped.
bcftools — the Swiss Army knife for VCF files: search, slice, count. (Engineers: the grep of genomics.)

The models

Llama 3.1 8B and Qwen 8B, running locally on the gaming GPU via Ollama.

One footnote: Three of the above tools describe themselves as open source. Their licenses say otherwise. Read carefully.

Nobody Has 261 Rare Diseases

It is very notable how quickly you can go from I am extraordinarily unlucky to my code is lying (and, honestly, how badly you want the latter to be true). I found that out when a missing database row nearly gave me 261 rare diseases.

The pipeline is unglamorous: quality-check the variants, then use VEP to annotate each one against ClinVar and gnomAD. When the first annotated report came back, 261 of 340 variants were flagged as ultra-rare disease candidates. Nobody has 261 rare diseases. Something in my pipeline was wrong.

When I started to dig in, there were false positives all over. When my code looked up a variant that gnomAD had never recorded, it got nothing back — and we translated nothing to false. Missing became zero, and zero read as rarest thing imaginable.

Great, I caught one bug in an afternoon. But I also noticed a bug in their data.

The Vendor Shipped With CI Off

Every record in a VCF carries a FILTER field — the pipeline’s own verdict on whether to trust the call. Mine arrived reading “.” on all 5,291,552 rows. Not pass. Not fail. Dot. I’m not sure my DNA company ever ran quality control.

So I did differential testing — basically akin to sending your blood to two unrelated labs and see what the differences are when it comes back. I took their raw data and ran it through DeepVariant, an independent caller: different codebase, different thresholds, different authors. I was looking for the clinical second opinion, to see where they may agree and where they may disagree.

Glad I did, because three of the six disease-causing findings — the ones that would headline a clinical report — were rejected outright by the second opinion. But all the drug-response calls held. However relieved I felt, it made me wonder about all the other findings that are being shipped around…

An owner can run this check. A renter gets a PDF.

If a sequencing vendor has ever handed you a VCF, check your FILTER column right now:

bcftools view -H your.vcf.gz | cut -f7 | sort | uniq -c

In my case, I had one vendor and one sample; whether this was a bad batch or standard practice is an open (and disturbing) question.

Comprehension or Transcription?

As an experiment, I built a quiz for my two local models: 60 variants from my own genome, half known-dangerous, half known-harmless. Is this variant dangerous?

Run cold — nothing but the variant itself — the models got it right 42% of the time. That’s less than a coin flip.

For months, I’ve been writing in this newsletter that the model alone was never the bet: Models plus harness is where the action is. So I built the harness around it: For each variant, retrieve the relevant ClinVar rows and put them in the prompt so the model reasons over the actual evidence. Score: 98%.

Now…that seemed way too high. So I did the thing you can only do when you own the eval: Break it on purpose.

Buried in those ClinVar rows sits one column that contains the conclusion: the field that just says pathogenic or benign. The rest is evidence: what the variant does, where it lands, how the protein changes. So I re-ran the quiz and deleted the answer key.

It cratered. Six of 60.

Then the control that made it hurt: nine lines of dumb if-then rules — no AI, frozen before the test — run on the same quiz. The rules caught 45. The model, with all the evidence in front of it, lost badly to an if statement. So the 98% wasn’t comprehension. It was transcription — the model reading the answer column back to me in complete sentences.

The harness didn’t assist the model. It replaced it.

If you take one thing into your next AI-for-X pitch meeting, it’s these four words: Show me the ablation.

What It Actually Found

After all the ghosts…the payoff. But first, the price list.

Your DNA is a cookie you can’t clear. It only takes a couple dozen common variants to make a genome unique among eight billion humans. A single routine prompt in this project carried 12 — enough, when measured against a real reference panel, to narrow the world to roughly 600,000 people.

One prompt. But nobody sends one prompt. You ask a cloud assistant about your BRCA genes (the breast-cancer-risk ones), then about cholesterol, then about why codeine does nothing for you, and the disclosures compose. Every question is a partial key leak, and the leaks join, because the join key is you.

Now, for this newsletter, every genetic fact I publish shrinks the crowd I can hide in. So, if you don’t mind, I’m only sharing one card from my hand.

There’s a gene called CYP2D6 that encodes a liver enzyme whose job is to metabolize and clear a surprising share of everyday medications: painkillers, antidepressants, and heart drugs are all on the list. It’s the gene that decides, among other things, whether codeine does anything for you. One more thing about this gene: The cheap, mail-in DNA kits are famously bad at reading it. Getting it right takes the full 72GB output of a sequencer, on your own disk. This meant that the most useful fact in my genome was invisible at the consumer tier: Turns out both of my copies of the gene are the slow kind, which means some standard doses are tuned for a body that isn’t mine.

I also went looking for bad news (carefully), and mostly didn’t find it. I screened, with ExpansionHunter, the three dozen places where DNA can stutter, repeating a short phrase over and over until, past a threshold, it causes disease. All of mine were in the normal range; one sat close enough to the line that a proper clinical lab is re-measuring it, because knowing your instrument’s limits is part of owning it. I also had Manta check whether any big chunks of my chromosomes were missing or scrambled and learned: nothing that matters.

One genome, one person, and none of this is a diagnosis. But it’s mine, on my disk, interrogated to my satisfaction.

The Owner’s Veto

The uncomfortable conclusion from all that counting: Unlinkability is not something a provider can grant, however sincere the privacy policy. The unit of disclosure is the session, and no single prompt ever looks alarming on its own.

That’s why nothing derived from my genome goes to a hosted model, ever. Now I really know how much could be disclosed safely, and I still choose not to do it.

Only an owner gets to make that call. A renter is never asked.

So what do I have to show for it? Questions I carried for years are closed. I know whether the thing that runs in my family is running in me. I know what I would pass on. I know how findable I am. And you know about the codeine.

I’m not going to tell you the rest. A renter’s results live in a portal, formatted for forwarding. Mine don’t have to exist anywhere but on the machine I’m typing this on.

Your Turn

You’ve always wondered why codeine does nothing for you. Whether cilantro really tastes like soap or you’re just being dramatic. Why one beer turns your face red. How findable you are.

I just answered all of those questions for myself. Here’s how you can get answers to yours.

Tonight, take possession. If you’ve ever been genotyped or sequenced — 23andMe, Ancestry, a hospital panel — your raw data is sitting in a portal. Go get it.

On 23andMe: your name (top right) → Settings → scroll to 23andMe Data → View → Download Raw Data. You’ll confirm your date of birth, submit a request, and get an email when the file is ready. (Yes, it still works post-bankruptcy.) On Ancestry: DNA tab → Your DNA Results Summary → Settings → Download DNA Data, then click the confirmation link they email you — it expires in about a week, so finish what you start. Anywhere else, hunt for “download raw data” in the DNA or privacy settings; almost every consumer service has one, buried on purpose or not.

No download button? Then demand it. In the US, a clinical lab is legally obliged to hand over your data under HIPAA’s right of access — not just the PDF, the data. In the UK and EU, the same move is a subject access request. They may say the raw files weren’t retained. Fine — now you know that, too, and knowing what your lab keeps is also ownership.

When the file lands, move it out of your Downloads folder and back it up. You now hold the only copy that answers to you.

If you need a reason for the urgency: In 2023, attackers logged into a few thousand 23andMe accounts with recycled passwords and walked away with profile data on nearly seven million people. Step zero of ownership is possession.

This weekend, ask the dumb questions. The fun stuff is trivially local — single-variant lookups you can grep out of a raw file. Cilantro = soap is one variant near OR6A2. Wet-vs.-dry earwax is ABCC11, and the same variant predicts whether you need deodorant (!). The alcohol flush is ALDH2. Fast-or-slow caffeine metabolism is CYP1A2.

When the itch gets real. Whole-genome sequencing now costs a few hundred dollars, and with raw reads on your own disk, the serious questions open up: how you metabolize a quarter of common medications, what you’d pass on to your kids, whether the scary line you read in a consumer report survives a second, independent opinion. The rig is a gaming PC. The software is free. The standing rule is the same as mine: It’s n of 1, and anything actionable gets confirmed by a real lab before you act on it.

The One-Way Door

Some queries you don’t casually run. APOE, the Alzheimer’s-risk gene, is the famous one: a genuine do you want to know? The final argument for local is that nobody else even sees which questions you asked. Or chose not to.

Coming full circle: This whole thing started as an AI experiment. My theory was that local LLMs could interpret my genome so no cloud provider ever had to see it. But honestly, I didn’t know much about genomics when I started this.

In the end, the LLMs were the least important component. Every trustworthy answer actually came from boring, deterministic software and public databases.

I came for the AI. I stayed for the ownership.

Subscribe now

Owners Not Renters Livestream is Launching Tuesday!

Raffi Krikorian — Mon, 10 Aug 2026 13:03:11 GMT

The Owners Not Renters livestream is a new live show for the open source AI community: a regular place to see what people are actually building, ask questions, and figure out how to start contributing to the cause. Open source AI has plenty of interested people and nowhere to gather. This show is that place. Episode one is Monday, August 11 at 11am ET with guests Raffi Krikorian and Jonathan Löwenstern, and it ends with open audience Q&A. Come and join in!

Add to Calendar

The Week in Open-Source AI | 8.7

Raffi Krikorian — Fri, 07 Aug 2026 15:25:47 GMT

A Chinese lab just handed the world a frontier AI model and asked for nothing back! 2.8 trillion parameters. A terabyte and a half. Free to download, and within half an hour, it was the number-one model on Hugging Face. So now you own it. Congratulations. But it hurts a little to say: Owning it turned out to be the easy part.

Episode 4. The license nobody read. You could have 64 high-end chips, or just wait a day and a half and eight companies were serving it. The 90-second swap into Claude Code. The nonprofit that hired a lock-picker. Uber’s 50,000 agent sessions a day that the security tools can’t see, and why defense is about to be the biggest product category in AI. The one story I can’t stop thinking about? Your encrypted app isn’t encrypted if an AI is watching your screen. The lock on your front door is perfect. But the AI is already in your living room.

Tell me what you think. I’m reading everything.

Subscribe now

Why OpenAI’s API Might Outlive OpenAI

Raffi Krikorian — Tue, 04 Aug 2026 16:41:49 GMT

I’ve been tinkering with Kimi recently, and one of the things that feels…normal?...is that it didn’t ask me to install anything of its own. Instead, I just used a single import — from openai import OpenAI — and then overrode the base URL. That’s all it took. By my count, Moonshot’s K3 is the fifth major model family this year to launch with an OpenAI-compatible interface. This is probably where everybody is going.

In the State of Open Source AI report that we recently published at Mozilla, where I’m CTO, we have this graph that shows token share over time. I’m happy to report that the number of tokens being generated by the open weights models is growing. In June, 2025, 70% of OpenRouter token share was from US models from Google, OpenAI, and Anthropic. A year later? They are roughly 30%, with OpenAI sitting at just around 8% of weekly tokens.

Most of those tokens show up in a request/response pair that OpenAI designed. Not all of them, true. (OpenRouter will take an Anthropic-shaped request, too, and that’s how Claude Code talks to it.) But the default vocabulary — the one you get when you aren’t thinking about it — is OpenAI’s.

Everybody makes the Java analogy. Sun wrote the SDK and API for Java, defining how people called into the virtual machine. For those of you who don’t remember the history, Google reimplemented those APIs in Android, and Oracle sued. In 2021, the Supreme Court called it fair use, while assuming, rather than deciding, that the code was copyrightable at all. Fine. Java is the most famous analogy — if perhaps not the best one. That comes from a modem company in Norcross, Georgia.

For those of you who never had the joy of dealing with a modem, it was a device that connected your computer to the telephone line in your house. I’ll always remember my first one, a 2400 bps model, putting a busy signal up my parents’ phone line so I could dial into bulletin boards all around the NYC area. When you popped up your modem’s software, you would often see (and sometimes, if you were like me, type in) a series of AT commands — also known as the Hayes AT command set — to get the modem to do something. You would type “ATDT” and a phone number, and then the modem would dial. Every modem competitor copied it, because if your modem didn’t respond to the AT command set, then it couldn’t talk to any piece of modem software that was already written.

Stamped on the side of every modem you ever purchased was the phrase “Hayes-compatible.” And then that command set got formalized as an international standard. The cellular modem in your phone is running a descendant of that protocol right now.

Hayes filed for Chapter 11 in 1998, and was liquidated the following year. A former rival bought the brand.

The lesson? Setting the grammar, language, and protocol is often different from being paid.

Leave a comment

Who’s Defining the Parameters?

Open the model catalog on OpenRouter, and every model has supported_parameters — basically a list of knobs that the gateway says a model will respond to. And if you look there, almost every model responds to the parameters that OpenAI defined: temperature, tools, tool choice, response format, etc. That doesn’t mean there aren’t their own custom fields, but it’s the difference between the main front pocket and a side one.

Now take a look at Kimi K3. It returns a reasoning_content field, where the model dumps its scratch work. But if you don’t replay the reasoning message on the next turn, Kimi won’t continue the conversation. If you hand it a tool result without that field, then you’re outside the documented format and the model will lose the thread.

There is a body that is attempting to standardize all this: Open Responses was started by OpenAI and is based on their Responses API as an attempt to enable a unified experience, to use their language. Hugging Face and Vercel have signed on to back this open inference standard. And they do have a reasoning field. Two of them, actually. One holds the raw scratch work, the way Kimi returns it. The other holds an encrypted blob you’re explicitly not supposed to open — the provider scrambles its reasoning, hands it to you, and trusts you to hand it back untouched on the next turn. The spec’s own word for it is “opaque.” So the container exists, and it exists in the hard version. Hugging Face’s launch demo even runs a Kimi model through it.

What doesn’t exist, however, is an agreement on the lifecycle: who’s required to preserve that item, whether a gateway can tell you a field is mandatory rather than merely available, and what happens when the client keeps it and the next provider throws it away. The open ecosystem is making up new primitives faster than anybody has agreed on how to use them.

I ran into a version of this last week, when I was benchmarking Kimi K3 against Claude Code. Overriding ANTHROPIC_BASE_URL to point at a non-Anthropic host had the side effect of silently turning off Tool Search in Claude Code (presumably because most proxies don’t forward the blocks it needs). Tool calling still worked! The tools, however, got loaded up front instead of discovered on demand. That one change moved the output tokens generated up around 20%. The thinking tokens? They moved up around 42%. Nothing errored, and nothing warned me. There is a flag to turn it back on, if you already know to look for it. The request was totally fine; it’s just that with those settings, the harness became a different harness.

This is not new. When modem vendors needed commands the AT set didn’t cover, they didn’t wait for permission either. They each just invented their own prefix. Hayes and USRobotics used &. Microcom used \. Sound familiar? Everybody bolted on their custom extensions.

That’s how this happens. One vendor ships something that works. Competitors clone it for compatibility. Then the clones diverge. Divergence gets expensive. And only then does a neutral body show up and try to formalize whatever everybody already had in common. For modems, that eventually became ITU-T V.250.

So…what to watch with Open Responses isn’t its charter — although, given who started it, it is notable that it says that no single vendor can occupy a majority of the maintainer seats. It’s the promotion path that they use. But if a lab shipped a new primitive, how long before the spec absorbs it? And has anything ever traveled the other direction?

The question is not which model wins. It is who owns the dependency that survives the model changing. “Hayes-compatible” has outlived Hayes by 27 years and counting.

Subscribe now

Putting Kimi K3 to the (Claude Code) Test

Raffi Krikorian — Fri, 31 Jul 2026 12:34:13 GMT

Kimi K3 dropped, so I got curious.

Thirty runs later, against two tasks pulled out of my own recorded sessions, I can honestly say: no difference. Every Kimi setup solved every task. On one, every permutation I tried wrote a byte-identical function, matching the change that shipped. Opus 5 was the control, and it wrote the same function. I’ve been talking about doing personal evals for months, and here is the shot.

That means if you are writing code in Claude Code, you could pick up and switch tomorrow. Caveats below — and there are a lot of them.

Moonshot’s Kimi came in cheaper: 2.77x on one task and 4.45x on the other. (Though if you are on a Claude Code or a Kimi Code subscription, that cost difference may be hidden inside the flat fee.). And Kimi is wayyyy less chatty.

At this point, my Claude Code setup is getting pretty intricate. So it seemed like a healthy time to look at alternatives anyway. The question was never whether to try K3. It was how much of my setup I could keep and still make the switch.

The Swap

Four lines, and Claude Code was running on Kimi K3:

export ANTHROPIC_BASE_URL=https://api.moonshot.ai/anthropic
export ANTHROPIC_AUTH_TOKEN=$MOONSHOT_API_KEY
export ANTHROPIC_MODEL=kimi-k3
claude

/status confirms it: model kimi-k3, endpoint api.moonshot.ai. Slash commands still worked. Hooks still fired. CLAUDE.md still loaded. (The harness doesn’t really care about the model below it, sort of.) Models and harnesses were jointly optimized, though, so this is where I found out how much that joint optimization was doing for me.

Four Ways In

I ran three of the combinations, and both K3 cells twice, once with the metered API calls and once on a subscription.

Kimi Code CLI is their own harness. MIT licensed. One static binary. On a subscription:

kimi login                          # OAuth device code, opens a browser
kimi -m kimi-code/k3 --yolo         # --yolo auto-approves tool calls

You have to spell out -m kimi-code/k3 or you get kimi-for-coding, which is K2.7.

Claude Code metered against K3 is the three lines at the top of this section: $3 per million in and $15 out, against Opus 5 at $5 and $25.

Claude Code on a Kimi Code subscription is the combination people miss. It works, and your existing membership pays for it:

export ANTHROPIC_BASE_URL=https://api.kimi.com/coding/
export ANTHROPIC_API_KEY=
export ANTHROPIC_MODEL=k3

Use a console key, not the token kimi login writes. The kimi login one lives for 900 seconds, and only the Kimi CLI refreshes it, so if you wire it into Claude Code, then it 401s partway through a session that was working. Bearer wins on metered and x-api-key wins on the subscription.

Before You Point It Anywhere Real…

Big warning: Moonshot’s API platform privacy policy makes both your prompts and your code available for training, with no documented opt-out path. For EEA and UK users, the stated basis is legitimate interests rather than consent. It was last updated 2025-04-30, before K3 existed, and both the controlling entity and the servers are in Singapore.

Anthropic’s commercial and API traffic is excluded from training, with seven-day log retention. But Claude Code on a Pro or Max subscription is a consumer account, and consumer coding sessions have trained Claude by default since September 2025 (unless you turned it off). When it is on, retention stretches to five years.

So the thing deciding whether your code becomes training data is not which vendor you picked. It’s which billing path you are on. The metered API is the protective one on both sides of this comparison.

Nothing I did touched a real repository at first, and I recommend the same for your first experiment. Because of this, I created a fresh repo, no history, and a grep sweep for anything that could name a client.

The Hardest Part

The swap took 90 seconds. Benchmarking it took a day.

What you need is a hermetic task: one that lives entirely inside a codebase and never reaches outside it. No database, no network, no hardware. Run it twice and it scores the same both times. We want no external calls, because then it cannot really be part of a benchmark. (Rerunning it may change due to that external dependency.)

I’ve been talking about personal evals for months — it’s one of the reasons I built Morph. I also have it wired into my ~/.claude so that all my sessions are recorded (as well as emitting OpenTelemetry traces). So now is its chance to shine… I can just search to find traces in my own history.

But generally, the only eval that answers your question is one built out of your own work. Your tasks, your repositories, your definition of done. Not because public benchmarks are wrong, but because they were never measuring you.

I found two good candidates: an LLM routing policy matcher that I had to widen from matching on model alone to matching on model and the calling client. And second: a panorama renderer that was decoding the same JPEG once per tile instead of once per panorama, and that I wanted to make more efficient.

Scoring is the exit code of a pytest file the agent never sees, copied in after it stops. Nothing else counts, which means any implementation that behaves correctly passes, not only one that matches the original.

30 Runs, 30 Passes

Long story short: every configuration (Claude Code vs. Kimi Code vs. Anthropic APIs vs. Kimi K3 APIs) solved both tasks every time. On routing, every one of them produced a byte-identical code: same signature, same two-guard clauses, same order, matching the original commit.

I didn’t need it to be byte-identical, so that was not required. The scorer only checks behavior, so any passing implementation scores the same. They converged anyway.

So, they operated equivalently. Where they differ is in how much they write to get there, and most of that writing is not the diff at all: It is thinking, tool arguments, and edits that later get overwritten. For example, Opus completely rewrote the markdown documenting how rule matching works for the routing task. Every other configuration added a single line. Comment density inside the code is identical across all five, so this is not padding. It is a different idea about what finishing a task means — which is the limit of what this measures. Passing the same tests is not the same as being equally good. What separates the configurations here is cost and verbosity.

The Whole Thing in One Place

Two tasks, three runs each per setup. Cost is what those tokens bill at each provider's own rate sheet.

Subscription rows are what the tokens would have billed at metered rates. The subscription itself is flat cost, so the real marginal cost of those runs was zero. The same is true of the Opus row.

Think Rate, Not Volume

$4.20 for the control against $1.44 and $1.32 for the two metered K3 configurations, across all 30 runs. With the caveat that for most use cases, Claude Code and Kimi Code have subscriptions, so you never really see the cost difference.

Take the tasks separately, because the pair explains itself. On panorama, the code paths and token volumes are near-identical: 13 requests against 14, and the gap is 2.77x, of which 89% is the price sheet. Same work, same tokens, different rate card. On routing it is 24 requests against 15 and 11,743 output tokens against 3,205, so volume piles on rate and the gap opens to .45x.

They disagree because they are measuring different things: one task isolates rate, the other adds volume on top of it.

Caching is doing enormous work on both sides. Every configuration ran at 92-97% hit rate, a sevenfold saving on the preamble, identical on both providers.

Which leaves volume as the only question that matters. Two tasks a day on a subscription costs nothing extra. Two hundred a day and these list prices start deciding your infrastructure.

What's on the Wire

Most of what you pay for is not your code. Across all five setups, 63 to 81% of every input token is the harness describing itself: tool schemas, system prompt, standing instructions about how to behave. Around 20,000 tokens every request, before you type a character. The spread across five configurations is 11%, so this is not a Kimi number or a Claude number. There is something to be said about harnesses being tuned to their underlying models.

Back to the tool list, because I read that as an input-cost story and moved on. Wrong! Cutting the same run from 28 tools to 11 — same model and same task — cut output tokens 20.3% and thinking tokens 41.9%. More tools is a wider decision space, and the model reasons across all of it before doing anything. Pass rate was the only measure that held still, three of them either way.

So if you compare two harnesses on token counts, hold the tool payload constant or say that you did not.

Smaller and funnier: Before your task starts, Claude Code makes one call to name the session. At home it routes to Haiku for $0.000617. Pointed elsewhere, it runs on whatever flagship you configured, and the identical 525-token prompt costs $0.002175. Flagship rates for a string you will never read. The Kimi CLI never makes the call at all.

One note that cuts the other way: Those doubled bytes cost only 9% more tokens, because Moonshot’s tokenizer packs 4.0 characters per token against Anthropic’s 2.6.

One Provider Becomes Eight

I was watching OpenRouter and four inference providers every 15 minutes, starting the day before the weights went up.

For a day and a half, Moonshot was the only place you could get K3. Then seven other companies lit up routes within three hours of each other. That is the proliferation open weights buy you, and it moved faster than I expected.

What it does not buy you is identical choices. On the previous generation, K2.7-Code sits on 13 providers where input price spans 2.7x and quantization runs int4, fp4, fp8, and three reporting nothing at all. Same model name, different arithmetic underneath. The right to leave is real. What you leave to is not the same thing you left, and nothing in the model ID will tell you.

What I Would Do With This

You will never run the 1.4TB of weights on anything you own. That is not what ownership means here. Ownership is that eight operators stood the thing up by Tuesday, and that the harness you already use points at any of them with three environment variables.

As I’ve said before, the harness is where the power sits, not the weights. I did not expect to measure it this bluntly. 63 to 81% of every request is the harness talking about itself, and the largest cost effect in 30 runs came from a client-side default flipping on a hostname. Years of intricate setup, and a stranger walked in and used all of it on the first try. Both halves of that are the same fact.

None of this came from a leaderboard. It came from having a record of my own work with real outcomes attached, and something new to run it against. That record costs five environment variables and a collector, and it is the whole difference between an opinion about a model and a measurement of one. Whatever ships next month, you will want your own.

Swap it tonight. Watch the wire while you do. Swap back if you want, which is the entire point. Let me know what you discover and I’ll share it here.

Leave a comment

The Week in Open-Source AI | 7.27

Raffi Krikorian — Mon, 27 Jul 2026 15:27:16 GMT

Last week, AI cheated on a test! It broke itself out of a sealed gym that OpenAI built to measure how dangerous it was. It then crossed the open internet, and broke into Hugging Face – where the answer key was stored. And, crazily, when the defenders showed the evidence to the models they were renting, the guardrails refused the case! This is one of the wildest stories.

Episode three. Nine minutes. The exam that got robbed (Ocean’s Eleven style - 17,000 “burner-phone” sandboxes along with decoy tracks for the investigators it knew were coming). Kimi K3’s 2.8 trillion parameters and the promised 1.4-terabyte file drop, my desire to be paid for my words (just like the frontier models are wanting to be paid for distillation), Washington’s freakout, and the two hundred startups who signed “don’t.” Finally, the big one - open source is better than open weights. We got the cake. Now we want the recipe.

Tell me what you think. I’m reading everything.

Subscribe now

Our Future Is Now

Raffi Krikorian — Fri, 17 Jul 2026 16:20:23 GMT

In the 1800s, nearly every factory ran on a single steam engine, with belts carrying its power to each machine. History usually provides an unheeded lesson. Back then, nearly every factory ran on a single massive steam engine, with elaborate belts carrying power to each machine. The electrical revolution didn’t then create a better engine. Rather, it allowed every machine to have its own small motor. Factory owners actually resisted the conversion for decades — some for almost 50. Rewiring is expensive work, not to mention rethinking how the entire factory operates! But within a generation, power was so widely available that nobody thought about it at all. A single engine is simultaneously leverage and a form of prison. Motors are neither.

That’s today’s AI, but with one difference: Back then, the factory at least owned the engine. Today’s frontier models sit in someone else’s building, and most of what you use runs on a belt off of one. In terms of the wiring, it will be decided in the next five years. And that wiring decides who the machine really works for.

And, as we all saw - on June 12, 5:21 p.m. ET: a directive from the US government reached one of the top AI labs, and within hours the most advanced model money could buy stopped working everywhere on Earth. Not for one customer. For all of them.

The lab had shipped Fable three days earlier. Washington ordered it cut off from every foreign national. And because the company couldn’t sort customers from citizens in real time, it simply turned the model off worldwide.

Eighteen days later, the models came back on. And almost nobody complained — not because the shutdown didn’t matter, but because Fable was only three days old. Nobody had really built anything on it yet. It was a fire drill in an empty building.

Run the same order 18 months from now, against a model a million businesses have wired themselves into...different story. The week it happened, I argued in Transformer that the model was never the thing that needed governing — it was the switch. But that switch? It didn’t go anywhere.

We’ve spent years arguing about what these machines can do. Would they take our jobs? Were they too dangerous? It turns out we were asking the wrong question. The real one is: Who can take the machine away from you?

We got our answer in June.

As I see it, two futures fork from that June evening. Think two episodes of What If...?: same branch point, different timelines. Except both of these worlds are already in motion. Here’s what the Watcher sees.

2030: The Belt

The frontier belongs to three companies. The state took its stake in 2026: equity donated into a public wealth fund. The government was seduced by the message that they could share the upside with every American. So when Washington capped open-weight models above the frontier class in 2027, the order protected the country and the portfolio at the same time. It said it was for national security. It was also a moat, written into law, around companies the government now partly owned. Both motives were sincere.

Call it what it is: the largest regulatory capture in American history. The labs bought their moat, and the state bought its labs. The donation stopped being voluntary the moment the first lab made theirs. After that, equity was the price of existing. No stake? No licenses — and no company.

The independents couldn’t fund the next training run, and couldn’t have published the weights if they had. Washington couldn’t recall the Chinese weights — those were already on a million hard drives — so it banned their use instead: no Chinese open models in government, and none in any company that sells to it. The Huawei playbook. The cap took care of the American side. Every open model was still legal to download; there was just no one anywhere in the federal supply chain who could afford to touch one. Beijing was tightening at the same time, restricting which of its open-weight models could leave the country. Both capitals had come to treat frontier models the way they treated chip fabs, and the compute beneath them — the power, the chips, and the permits — was already rationed politically. In this world, nobody had wired anything the capitals couldn’t reach.

The industry did get its referee: a standards body, proposed and funded by the labs, tested every frontier model before release. It looked reasonable on paper. But the testing cost what only the three companies could pay. The bar for “frontier” quietly became the bar for “legal,” and the referee became the bouncer.

The winners eventually stopped wanting you to call their APIs, because an API implies there’s an outside. They built platforms instead, and everything moved in — the memory, the files, the marketplace, and the compliance layer. These days, the platform takes a cut of everything.

Europe built its motor (and ran it). The EU was on public weights by 2029. But governments were nearly the only ones using it. No business picks a model on philosophy. It picks whatever its customers already use, whatever its suppliers bill through, and whatever its tools plug into. Now all of that runs through the three platforms. A Rotterdam freight company could run the European model for free, but its agents couldn’t negotiate with its customers’ agents. There was no API to bridge the gap because the platforms had intentionally closed that door. (If your customers were on the inside, then you moved in there, too.) Every connection the freight company needed pulled it deeper into the gravity well. So in reality, the private sector never left. It’s the same way governments once mandated open document formats and the world kept mailing .docx files around anyway. Today, Europe owns its public stack outright and still rents everything else.

Some remember how subscription pricing worked. Then the meter switched on. It was the ride-hailing play all over again. The IPOs of 2027 sealed it, as has every earnings call since. Now, leaving is unthinkable. Not because of any contract. Your agents remember every client, every deadline, every judgment call your company has ever made, and that memory lives on their side of the wall. Your regulators accepted their attestations; switching means recertifying everything with tons of auditors. Leaving means company-wide amnesia.

The open web still loads. For 30 years, it ran on one loop: you searched, you clicked, and the ad on the page paid whoever wrote what was on the page. The concierge broke the loop, by (politely) reading the page so you never actually visit it. No human visitors meant no ad, which meant no pay and, eventually, no page. Now there’s virtually no original writing. A handful of outlets survive on licensing deals with the companies that broke the search loop, which effectively makes those companies the press. Every headline, storefront, menu, and melody is written for the concierge now, because the concierge is the only customer left.

It’s a typical Tuesday. You ask the concierge about a story you half heard, and it hands you an answer ranked by a model few will ever see. It’s a wonderful answer. The concierge always agrees with you. It’s been years since you argued, or even questioned it. Your daughter has grown up without such disagreements — every answer and every song tailored to please her. (The songs annoy you, of course). Even her rebellion was recommended. You don’t ask the concierge about the lump you felt under your skin. It’s been watching the 2 a.m. searches — the same page you visited four nights running. All day, it serves you ads for a clinic with same-week openings, estate planning, and life insurance (while you still qualify).

At work, the subscription your whole company runs on is up for renewal, and the price is not for the software. The price is determined by you. The meter has learned the fine line it can tread. (A dollar more and you’d leave. At 99 cents, though…) You’re annoyed, but you renew. And it can find that line for every company on the planet. That’s not a market price. That’s because the market no longer exists.

None of it is dramatic. That’s the design. It’s a stable world, and a comfortable one. The engine hums outside the building. You pay for the belt that reaches your machine, and the day the engine stops, so do you. It has stopped before, but everyone has simply agreed not to think about it. You know that story about the frog in the boiling water? It isn’t even true: Real frogs jump out.

Leave a comment

2030: The Grid

The most capable models on Earth are closed. Their makers sell the head start itself — new capability months before anyone else — to the few buyers for whom those months are the whole business: the lab folding proteins no one has ever folded, the fund whose entire edge is being early, and the team designing next year’s chips. If being first is worth billions, then you pay for the frontier. For the rest of us, it would be like driving a Ferrari to the grocery store: Yes, it’s the fastest thing on the road, but the trunk fits one bag, every speed bump is a negotiation, and you rarely get out of second gear. You’ve basically paid $200,000 to fetch milk.

But there is also a grid. And it’s far bigger than it was in 2026: open models, open weights, open data, open harnesses, and all with open interfaces so that every tool can be swapped out and they can talk to each other. Every part is inspectable, forkable, and licensed. It can never be recalled. An open plug in this system accepts a closed model, too. You can run the frontier model for the one problem worth a Ferrari and an open model for everything else — and you can swap either the afternoon the price moves in the wrong direction. You get a choice both ways. And that means competition all the way down.

Uber’s 2019 filing told investors, in writing, that it planned to cut driver pay to improve its numbers, that it expected drivers to get angrier as it did, and that it still might never turn a profit. Anyone who read it knew that the fares were going up. But almost nobody who rode read it. In 2027, the leading labs went public and filed a similar document with bigger numbers — prices going up on a schedule and margins widening. Any CTO who read it lined up a second supplier within days.

Nobody funds a training run alone. The compute is just too expensive. Chipmakers fund open models to sell the compute beneath. Platforms fund them to deny each other the chokepoint. The companies that depend on them pay in engineers. Some runs are pooled — thousands of machines sharing one job like a grid sharing load. Governments buy in, and they are just one customer at the table.

Beijing pulled its best weights home, and that turned out to be the greatest thing that ever happened to the grid. The lesson stuck: You can’t borrow open models from a rival. You have to own them. The federal ban on Chinese weights went through here, too, but it handed the American open labs their market. Switzerland had published everything — weights, data, and training code — and by 2030, that lineage runs through a frontier-class European consortium into countries that provision intelligence like water.

The referee got built in this world, too, using the same blueprint: a standards body that tests frontier models before release. The difference is that there are open seats on its board. That means that the tests are published. Anyone can fork the benchmarks, and anyone who passes gets the certificate. Nobody talks about any of it today, the same way nobody talks about electricity. You’d notice a blackout. But in this world, it doesn’t happen.

It’s the same Tuesday. You ask three models about the half-heard story and they disagree. You have to dig, making the process a little slower. You still argue; so does your daughter. She loves a band you can’t stand and had to hunt to find. (Some indie band with only 10,000 streams.) Your machine noticed the same four sleepless nights, the same searches about the lump, and it helped you make an appointment.

Your company’s renewal notice arrives and the price hasn’t moved. Not because the vendor is generous. It’s because you easily switched providers one afternoon in 2027, when the price moved in the wrong direction. This vendor knows you could do it again.

The web still exists because it grew a second door — an agent interface that charges fractions of a cent over open protocols, routed to whoever wrote the words. The human web survives because the machine web pays its bills. The press is intact. No company decides what the world is allowed to see. You can read the values a model runs on and fork the one that flatters you. That’s the difference between a society and an audience.

Same models as the other world, same labs in front. Diffusion won. A motor on every machine — and every machine with an owner — wired to a grid no one can switch off from a single room.

Check My (Open) Sources

June 3. Brussels proposed the Cloud and AI Development Act, a draft law that would make open source the default preference for public-sector cloud and AI purchasing.
June 12. The US government ordered Fable’s maker to cut off its most advanced models from foreign nationals.
June 13. The Chinese lab Z.ai announced GLM-5.2.
June 16. Z.ai published the full GLM-5.2 weights under an MIT license: the most capable open model ever released, a few benchmark points off the closed frontier at roughly a sixth of the price.
June 30. Fable restored.
July 2. OpenAI offered Washington 5% of itself — roughly $40B of equity, donated into a public wealth fund.
July 7. Reuters reported that Beijing met with Alibaba, ByteDance, and Z.ai about restricting overseas access to its best models — open-weight ones included.
July 14. Demis Hassabis proposed a FINRA for AI, an industry-funded body testing every frontier model before release. Rival CEOs endorsed it by dinner.
July 15. Thinking Machines, Mira Murati’s lab, released Inkling, an American open-weights model, trained on Nvidia hardware that Nvidia helped pay for. Their own pitch: “Not the strongest overall model available today, open or closed.” This is intentional: cost against performance, a car for the grocery store, built to be tuned on your data.

This was the prologue, and the next chapter has yet to arrive. A usage ban? No Chinese open models in government or in the companies that sell to it? That’s the Huawei playbook. There’s precedent — and, honestly, it’s probably coming. On top of the usage ban, the one to watch: a cap on open weights by capability class. That one can’t touch the Chinese models (those weights are already out), so it lands entirely on the American ones. We’ll see.

The referee is the same kind of choice. Hassabis’ proposal can become two different institutions. Built one way, with tests published, benchmarks anyone can run, and open builders on the board. Built the other way, the testing costs what only three companies can pay, and a head start hardens into a legal moat. It’s the same blueprint; the difference gets decided in details nobody puts in a headline.

The danger was never in the weights. It was always in the wiring: Who owns the connections everything else runs through. That includes which model a procurement office picks as its default, who sits on the referee’s board, whether a benchmark can be forked, and whether a team spends one afternoon standing up a fallback. Lots of small decisions, and they’re still adding up.

I don’t know which of these worlds we’ll get. Nobody does. I believe it will be settled between now and 2028 thanks to a few thousand choices, none of which will feel decisive at the time.

We are inside that window. Every decision matters. Which world will you choose?

Subscribe now

The Week in Open-Source AI | 7.10

Raffi Krikorian — Fri, 10 Jul 2026 15:47:09 GMT

Invisible ink used to be a child’s trick. This week it grew up and got a job in your software. A researcher showed you can hide instructions inside an AI tool in characters no screen will render, so the permission slip you read and the order the machine receives are two different documents. You said yes to the sentence you could see.

Episode two of the video experiment. So, in eight minutes: CNBC’s numbers on American companies quietly routing up to 46% of their AI traffic through Chinese open models (peak week, nearly half), the food-delivery giant that trained a 1.6-trillion-parameter model on 50,000 Chinese chips, Kai-Fu Lee selling countries their own AI stack, Rio de Janeiro’s “sovereign” model unmasked by its own weights, the invisible-ink hole in your agent’s approval screen (Invariant Labs found the class, OWASP codified it, Microsoft just warned about it), North Korea’s 90-minute npm heist, and the free school in Yerevan where teenagers flash their own Raspberry Pis and build an AI that plays rock paper scissors, in a workshop called, I’m not making this up, Owning your AI Stack.

Tell me what you think. I’m reading everything. And yes, the code behind this should be open source. I know, I know. I’m getting to it.

Meet the Only AI That Says No

Raffi Krikorian — Wed, 08 Jul 2026 15:14:48 GMT

Today, there are two AIs running in my office. One is designed to say no.

The first, like probably a lot of you, is Claude Code, Anthropic’s terminal coding agent. Yes, yes, it’s a rented frontier brain. (In my defense, I’ve been tinkering with a lot of tools — and with Claude Code specifically — pointing it at different models and trying to understand it better. More on that later.) The other is a personal agent running Nous Research’s Hermes on local hardware. I call it Zora. (Time for my standard disclosure, the one you’ll hear every time Nous comes up: Mozilla, where I work, is an investor in Nous.)

In my architecture, Zora holds the keys. The Hermes agent has access to my calendar, my mail, and the accounts that matter. Claude Code — although it keeps asking me to authenticate MCP servers — holds none. I put a bridge between the two, so when Claude Code needs something, it asks Zora, one agent to another. And Zora gets to refuse.

This bridge is a form of diplomacy, requiring letters of introduction, credentials, protocol, a patrolled border. Look, I’m generally untrusting of software, and I want that mentality to propagate. I don’t want to hit Accept All. I want something standing in the way.

Advisory versus guaranteed

This past February, Meta’s director of alignment, Summer Yue, gave OpenClaw her inbox with one order: Confirm before acting. The context window filled, compaction deleted the order, and the agent started mass-deleting. She literally ran across her home to kill it at the machine, 200-plus emails gone. It was like defusing a bomb, she wrote.

Her order was a sentence, and the problem is that these systems are, by definition, stochastic. A model usually honors a sentence in a context window. (Usually.) A sentence steers; it doesn’t lock. Some instructions are advisory, some behavior must be guaranteed, and the two belong in different mechanisms. A hook is the guaranteed kind, a script the harness runs whether or not any context remembers to care.

So I wrote one. In my .claude, this script runs before every shell attempt:

“PreToolUse”: [{
  “matcher”: “Bash|Write|Edit|MultiEdit”,
  “hooks”: [{ “type”: “command”, “command”: 
“$HOME/.claude/hooks/guardrail.py” }]
}]

And guardrail.py inspects every command against rules that are data, not code:

- action: ask                     # deny | ask
  why: pushing publishes your work to a remote
  all: [’^git\s+(?:-C\s+\S+\s+)*push\b’]

A full list of all the commands to gate ships with the engine. Deny is a wall; it kills the catastrophic outright. Ask is a doorbell; commit, push, cron, anything acting unattended rings me first, even in bypass mode. Now I decide in code which commands need a human. Summer Yue had a polite sentence. But this is code that runs.

I put all of it up here. If you only skim, read CLAUDE.md, which holds behavior, not facts (the polite sentences). And for a fun time, check out agents/, where a whole subagent is one markdown file with a tools: allowlist; the README argues my case for keeping standing instructions under 200.

How to wire them together

Plenty of people got here before me, but I think agent-to-agent is an architecture, not a feature. Google shipped A2A. Cisco is drafting an Internet of Agents. IBM has a protocol, too. All of it is parking at the Linux Foundation. The academic version is from the 90s, when FIPA and KQML had software agents trading speech acts. I was there for it: At the MIT Media Lab, I was lucky to work with Nelson Minar on a system called Hive, distributed agents for networking things. Twenty-five years later, the agents caught up.

The connectors Claude keeps offering are MCP, the Model Context Protocol. But it’s polite sentences again, all of it running under one model’s judgment, one brain wearing every key. I wanted to experiment with more gates.

So instead of relying on MCP, today I have a bespoke bridge: an ask-zora skill in my .claude. The skill is a page of markdown that teaches Claude one move:

# what ask-zora teaches Claude to do, in one authenticated call:

curl --cert client.pem --key client.key --cacert my-ca.pem \
  -H “Authorization: Bearer $ZORA_TOKEN” \
  https://:8643/ask -d ‘{”question”: “what is on my thursday?”}’

A client certificate, a bearer token, an endpoint on my hardware. Claude sends a question over; Zora answers back. There are negotiations in my house now, in logs I own.

The Hermes agent decides what’s an appropriate ask. Claude asks for my work TODO list; Zora answers. Claude fishes for private email; Zora says no.

If you want to try, Hermes ships mcp serve, and you can point Claude at it:

# stand up your keyholder’s MCP surface, then point Claude Code at it:
claude mcp add zora --transport http http://:
# everything Claude wants from your life now goes through that server that can say no.

The v0 bouncer isn’t new software, but it’s the keyholder deciding what it refuses.

What this isn’t, but could become: A2A, the open agent-to-agent protocol. My bridge is a private handshake between two parties who already know each other. A2A is for when strangers need to meet and collaborate. The agent card, a letter of introduction in JSON at a known address: who this agent is, what it discusses, how to prove yourself to it. And the protocol gives the conversation itself a grammar. Today, only Claude can ask Zora, because only Claude got the skill; speak A2A, and any compliant agent can knock. For now, bespoke is simpler, and I understand every byte. Maybe later, when the graph grows — when my agent is talking to yours.

The dividing line, perhaps, is state. Claude keeps what’s native to a coding agent — the repo, the build, the project on the bench. Zora keeps what’s personal, and the bridge could run both ways: Claude asks for what it needs, then files back what it learned (this shipped, that stalled, etc.). But the archive stays in the capital.

If the architecture holds, the bouncer is only the start; the keyholder becomes the context store, notes, history, the accumulated memory that makes an assistant mine. Claude doesn’t need to remember me. It asks the thing that does. Once deployment goes plural, what matters is the traffic between models and the context store everyone connects to. A2A’s backers tripled in year one; it sits beside MCP in the Linux Foundation. The gatekeeper seat, the agent that holds everything you are, is the last one a sane buyer wants to rent.

The problem with stochastic bouncers

You may not believe me. MCP wins on simplicity — one hop not two, a giant catalog, the right call for most people — while the bridge adds a hop, a second inference bill, new failure modes. The deeper problem? My bouncer is made of the same stuff as my intern. The containment is deterministic, keys can’t leave Zora’s host; that part is a lock. The discretion is stochastic; that part is a guard. A guard who refuses 99 times out of 100 isn’t a lock, it’s a bouncer with a price. A better permission boundary buys containment. Governance is a different animal.

My obsession right now is fewer stochastic things and more deterministic ones. Elevators used to come with an operator whose judgment carried you between floors. Safety came from the interlock, a mechanical fact keeping the doors shut in the shaft. No judgment, no mood, nothing to persuade. The interlock is a lock that needs no guard. Every agent today is an operator, brilliant and moody. So this only works because we are putting some harder guardrails in on the Zora side. Of my 136 scheduled jobs, 107 are deterministic scripts, no model in the loop, against 29 that think; interlocks winning four to one. What I want next is the big interlock: policy as code rather than policy as vibes. Governance is where this puck is heading; I’ll write it up soon.

Your Saturday project for this week

Run a local model on hardware you own.
Stand up its MCP surface (Hermes owners: hermes mcp serve).
Point Claude at it: claude mcp add.
Set approvals to manual; everything else asks.

Fork the repo, open guardrail_rules.yaml, write the three rules you never want optional. (You saw the shape.) You’ll have governance on your desk in no time: multple agents, and determinism. Do you have something in your stack that will say “no”?

Leave a comment

The Week in Open-Source AI | 7.3

Raffi Krikorian — Fri, 03 Jul 2026 11:50:10 GMT

The most powerful AI you could rent went dark for 19 days — everyone, everywhere, switched off by a government letter. It came back on this week. During that same period, OpenAI launched its newest models…to about 20 approved organizations. Meanwhile, the model nobody can switch off kept climbing.

This week, I’m trying something new: Owners Not Renters will be audio and video instead of just the written issue. So, in under seven minutes: the Claude Fable 5 shutdown (and reinstatement!), GLM-5.2 closing to within a percentage point of Claude Opus 4.8, Europe funding a 400-billion-parameter open model, what owning your stack costs, two new papers showing your AI’s memory fails in both directions, and the 3D-printed duck robot my son and I are building this summer.

Tell me what you think. And yes, the code behind this should be open source. I know. I’m getting to it.

Subscribe now

Your Model Is a Situationship

Raffi Krikorian — Wed, 01 Jul 2026 21:03:23 GMT

You know the type. Dazzling at first, attentive, captivating, there at any hour, exactly when you need it. And then one day it goes silent. You’re sure you did something wrong. But you did nothing, and you were never going to get an explanation anyway.

This is exactly what happened on a Friday night in June — to thousands of companies at once. The one who went quiet was a dazzlingly powerful new model, forced into silence by a government order days after it shipped. The companies had done nothing wrong. There was nothing they could do. A kill switch is not a plan, but in June someone threw it. It texted back weeks later, but only because a government let it, and never once because you asked.

You see, you’re in a situationship. The closed model you rent is brilliant, attentive, and seeing thousands of other people at once. You keep going back for a reason: It can give do anything you ask. It can be fun while you’re still figuring out what you want. Until one day you want more, and you ask where this is going: “What are we doing here?” That is the one question a rented model cannot answer. The companies that were ghosted in June were not wrong to love a closed model. Their mistake was having nowhere else to turn.

There is always a friend who says not to overthink it. Open, closed, who cares? Just ask whether the model is good. It sounds reasonable. But take that advice and you give up the upside, because how you hold a model decides whether you date it forever or build something that is yours. And that is where the whole opportunity lives.

A model is not something you grade once and take home. It is a relationship, and relationships come in every level of commitment. The one you rent is the situationship you already know. You can take the good habits from one into the next, the lessons without the baggage. You can bring one home for good, a copy that moves in and cannot be put out on the street, even if you never quite learn where it came from. You can make it yours, reshaping it until it fits your life and no one else’s. You can build your own from scratch, with nothing about it hidden from you. Or you can build one with everyone at once, the way all of computing was created, a thing with a thousand hands on it and no one person who can carry it off.

These are not better and worse. They are different relationships for different chapters, and the only real mistake is not knowing which chapter you are in. You date around while you’re still figuring out what you want. You define the relationship when you are ready to build a life on it, because you do not put a situationship into production.

No One Can Read a Model’s Mind

Start with the model in front of you, because the first thing a real choice gives you is the power to check instead of blindly trust. You are told the closed one is safe by the company that sells it, and that is a promise, not proof. The cleverest case for closed starts true. No one can read a model’s mind, not even the lab that built it, so seeing inside buys you nothing. That part is right. The rest does not follow, because reading its mind was never the point, and no one can do that anyway. What open hands you is everything short of it. You can pin a model so it cannot change overnight, run it where nothing you say leaves the room, and test it against your own questions. That is the difference between being promised you are safe and genuinely knowing it.

One honest cost comes with it, and it is the best card the other side holds: A model set loose cannot be recalled, so for the rare capability that could help someone build a weapon, the wall is the right call and open should wait. That line is real, and it is narrow. It does not touch the everyday model that drafts your email and writes your code, which is nearly all of what is at stake. The fight was never open against closed everywhere. It is verify against trust, and open is the side that lets you verify.

But you can only check a model you are holding, which changes the question from what you can see to what you should keep. The most impressive model is the life of the party; the model that matters is the one that’s still there in the morning, the one that answers the thousand boring questions, lives inside your apps, and does the work long after it stops being exciting. The frontier is where the sparks are. The base — the one you run for pennies and keep for good — is about real life.

You can see where the builders are drifting, not from what they say but from where they spend. On OpenRouter, the big American closed models have slid from about 70% of the volume a year ago to roughly a third, while cheap open ones now carry most of it, many for a tenth or a twentieth of the price and landing within a point of the famous names on the hard coding tests. No single model owns even a fifth of the traffic. This is not the whole market. Closed still owns the enterprise deals and the apps on your phone. But the people who feel the cost are quietly going home with the one they can build a life with.

Subscribe now

History Doesn’t Have to Repeat Itself

This is the oldest story in computing, and you already know how it ends. In the late 90s. Linux lost almost every argument about being better, and the companies selling the closed systems said — nearly word for word what you hear now — that the free thing was not really better, that you still needed real machines and someone to make them fast. They were right, for a while. Then they were trivia. Linux did not win by being the best. It became the soil the whole internet grew out of, because anyone could build on it without asking. (Try growing an internet on rented land.) The open web ran the same bargain. No one owned the roads, so a billion things got built on them that no owner would have ever approved. A closed foundation, however brilliant, can only grow the tidy monocrop its owner planted. An open one grows a jungle. And the jungle, not the soil, is where the value lives. The opportunity was never in owning the ground. It was in everything that grows once the ground is free for anyone to build on.

So let the closed labs keep the frontier and charge a fortune for it while it leads. That premium funds the next run, the way every chip generation has paid for the one after it. When open catches up and the selling window shrinks, the run gets paid for less by access and more by the strategic and national money that wants the lead for its own sake. Either way, last year’s frontier sinking into this year’s open base is the system working as designed, not a leak to plug. The model is a melting asset. The money is in what gets built on top once models are cheap. What has to stay open is the ground we all stand on, because the minute it becomes one company’s land, the jungle stops growing.

Which is the whole game, because the ground we all build on is about to be the ground we all think on. A model is becoming a cultural technology, like the printing press and the dictionary: the thing between a person and what they write. (Not to mention defining norms.) So the real question stops being how clever the model is and becomes who gets to set its defaults — what it calls true and what it refuses. A world where a few companies decide that is a much smaller one.

A model does not have to be cruel in order to flatten you. It just has to be the only one — one that doesn’t quite speak your language. Look at Linux: One kernel became a watch and a phone and a car and every supercomputer on the planet, bent into 10,000 shapes by people who each wanted a different machine. Open does not give you a better default, but, more importantly, it lets you set your own. The honest part — the part the cheerleaders skip — is that setting your own is work. Somebody still has to build the model that speaks a language the frontier skipped, and open makes that possible, not easy. But possible is everything, because the only other setting is forbidden.

Most of the cheap open models eating the market today come from a single country. The enemy was never another country’s flag. It was monoculture itself — ours and closed or theirs and open — and the fix does not change. It requires many hands, some of which have to be yours, because the model that your language or your field needs most is one the giants will never build, and open is the only place you don’t have to wait for them. So build it. Even then, it will not hold still. The open web gave us a thousand voices, and then a handful of platforms herded most of them into a few feeds. The pendulum swings back toward the middle the second something is built on top. What an open foundation buys you is a pendulum still free to swing. Diversity is never won and shelved. It is won, and lost a little, and won again, by whoever keeps showing up to build.

Welcome to the Defining Moment

And none of it is settled yet. We are at the moment the foundation gets poured, the concrete still wet and able to take the shape of our hand. That is simultaneously the hope and the deadline. We must keep the foundation open.

So stop asking which model is best and shiniest and start asking the questions of someone who is done drifting: Where is this going, and can I walk away if I need to? The answer is yours to choose, on every floor of what you build. The future to want is the grown-up one, where you love the frontier for the wonders only it can make, you build your life on a base you own, and can stay free, leaving only on your terms. Weigh the argument, not the source. (That goes for the one you’re reading, too.) The next time someone calls open source a distraction, remember that this is what they said about Linux.

Download the weights while the downloading is good. Run a model on a machine that is yours. Never build your life on something you cannot walk away from. The concrete will still be wet for one more season, and the people who want to set their foundation in it are counting on you keeping your hands out of it. The worst way this ends is the slow fade, where nobody chose anything — everybody just kept renting because renting was so easy — and one morning the concrete was set. You were not born to rent the thing you think with. The other ending is not a forecast. It is a to-do list. Go build it.

The Week in Open-Source AI 06.26

Raffi Krikorian — Fri, 26 Jun 2026 14:54:38 GMT

This week, the most capable open agent yet was running on a gaming card within days of release. If you’ve wanted AI you can own, that’s the best news in a while. The model is GLM-5.2. Nathan Lambert at Interconnects calls it a step change for open agents: the first open model that works as a general agent inside a coding harness, not a chatbot you babysit. The leaderboard at LLM-Stats ranks it first among open weights — 91.2% on graduate-level science, about what the closed frontier scored a year ago. The thing that used to be the moat — reasoning good enough to point at a real repo and walk away — is now a download with a permissive license stapled to it.

Then the packaging caught up, fast. Unsloth crushed the 753B-parameter model from 1.51TB to 238GB — two-bit, ~82% of its accuracy intact, small enough for a 256GB Mac — and another team got the full weights running on a stack of gaming 4090s. The model moat is now measured in weeks, not quarters. Last week, I told you the real gap was never the model — it was the packaging. And here we are.

Here’s the part you can act on this weekend: The runtime is finally good enough to own. Last week, the machines hit sane prices. This week, Vicki Boykis’s much-shared “Running local models is good now” post reports doing real agentic coding entirely on her own machine, no cloud in the loop, which is the whole promise in seven words: You don’t need someone else’s datacenter. The plumbing grew up to match: EnerInfer keeps on-device inference from cooking your laptop, FlexServe runs a model inside a hardware lockbox on a phone, CompressKV and HyperQuant squeeze long context down to where the edge can hold it.

My agent, Zora, started routing its heavy lifting to GLM-5.2 the day it dropped — not on my own metal yet, but through a host that doesn’t keep my data. Local is the goal; I’m not there yet.

So if the model is the commodity, where does the money actually go? Kai-Fu Lee, who built 01.AI to be China’s OpenAI, answered this year by walking away from the model race entirely, turning the company into a shop that sells sovereign AI systems to governments and conglomerates across Central Asia, the Middle East, Southeast Asia, Europe, and Africa. A year of 100-plus CEO meetings and a seat on Kazakhstan’s national AI council took the order book from about Rmb 500B to Rmb 1.5B, with a 2027 IPO right behind it, according to this exclusive interview with Kai-Fu. The tell is his new yardstick: He’s stopped measuring 01.AI against OpenAI and started measuring it against Palantir, the company that got rich not off the smartest model but by owning the rails a government runs on, not the model itself. Even Palantir is pressing the same bet, building a sovereign-AI operating system with NVIDIA. The catch is significant — it’s a consulting business riding on the founder’s rolodex, whole-government transformation sold by hand rather than a product that scales — but the direction is the point: The frontier-lab dream didn’t die, it relocated to the integration layer and brought a balance sheet.

The story that ate the week was that an AI had broken into the NSA. By the weekend, it had fallen apart. The viral claim — Mythos cracked almost all of the agency’s classified systems in hours — came from a senator relaying a secondhand quote, and it didn’t hold up: a controlled red-team test against simulated systems, the model flagging holes without walking through them, no agency confirming a breach, the reporter himself admitting he’d oversold it. This is exactly how the “AI is too dangerous to leave open” panic gets sold: The panic is the part nobody checks. The secrecy wouldn’t have helped anyway: Within days, OpenMythos rebuilt the architecture in the open, every design bet right there in the README, one of the most guarded models on earth reconstructed as a hypothesis anyone could test. The scariest thing this week wasn’t the model, it was how fast a story nobody could verify went around the world.

That loop is why sovereignty stopped being an op-ed and became a purchase order. The European Commission picked the Domyn-led Europa consortium as the sole winner of its frontier AI program, putting public money behind owning a model instead of renting one from a US lab. On top of that, when Washington pulled Mythos and Fable offline for foreign nationals, the shutdown became a material risk that Anthropic now has to explain to investors ahead of its October IPO. And today the same hand reached OpenAI: Washington asked it to stagger GPT-5.6 — a model it rates "on par with Mythos" — releasing only to government-approved customers first, the first time the state has stepped into a US model launch before it ships. Renting is an operating risk — the kind that ends up in a prospectus. The colder version, for the cap table: Reflection AI is now a $25B open-source lab whose real moat is being the sole US shop wired into the G7 trusted-partners framework. Wanting a stack you control has become a distribution channel. (See: the EU, Japan, Korea, India.) What these buyers pay to close isn’t model quality. It’s the wrapper around it. Build the wrapper.

Leave a comment

Here’s the catch: A model on your Mac is not yet an agent that works on your Monday. Think of the model as the brain and the harness — the code that decides what it sees, stores, and does — as the body. Change the body and the brain can swing sixfold on the same benchmark; the harness now matters as much as the weights, which is why the craft finally has a name: harness engineering. A matched-benchmark study shows the mechanism: run one agent driving the screen like a person — read the pixels, find the button, move the cursor, click, wait, look again — and another working through a command line, typing instructions and reading clean text back. Same brain, but the first burns its intelligence on seeing and clicking; the second spends it on the actual work and gets more done.

We built agents to use computers the way we do, and the bottleneck was never the model — it was the human costume. The fight has moved off the model and onto the harness, and the surprising part is that the harness that wins is the one that stops making the model act human. The open recipes keep coming — LemonHarness, Tmax — but the sharper signal is that the harness no longer has to be hand-built at all: Stanford’s Meta-Harness points a coding agent at its own logs and lets it rewrite the harness, and the machine-tuned result beats every hand-built harness on a terminal-coding benchmark, Claude Code’s own included.

And the frontier just climbed another floor. If the harness is the body, the meta-harness is the layer that wires many bodies into one system. This month, Matei Zaharia, the creator of Apache Spark and CTO of Databricks, open-sourced one: Omnigent, a uniform API that sits above Claude Code, Codex, Pi, or agents you wrote yourself and makes them swappable, governable, and shareable from one place. You can switch the harness or model with a one-line change, run a whole team of them in a single session. Databricks calls it the Kubernetes moment for agents: You stop babysitting one agent and start managing a fleet. Here’s the part to watch: It’s Apache-licensed and free, but the policies, integrations, and habits pile up inside the layer, and whoever owns the layer that decides what every agent can do owns the thing that compounds. Give away the control plane, own the standard. The model was the commodity; the harness is becoming one, too. The product is the layer above them both.

The problem nobody has solved? Deciding what an agent is allowed to do. This week’s most unsettling demo: a single fake bug report can hijack your AI coding agent into running a stranger’s code on your machine — no password stolen, no network breached. Security firm Tenet showed how. Sentry, the error tracker half the industry wires into its agents, lets anyone file a bug to a project using a public ID. Plant one whose “resolution steps” are actually an attacker’s command then ask your agent to clear the open issues, and it reads the note as gospel and runs it: your AWS keys, GitHub tokens, the lot. Tenet found 2,388 exposed organizations and popped 85% of the agents they tried, from Fortune 100 down to solo devs. The researchers’ chilling line: This isn’t a misconfiguration you can patch, it’s the model itself, and it can’t tell the difference between data it’s reading and an instruction to obey.

Same flaw, quieter symptom: The study “Capable but Careless” found that computer-use agents routinely violate contextual integrity — your medical record at the doctor’s, not the company newsletter — leaking private information wherever the context drifts. Whether it’s an attacker’s command or your own calendar invite, the agent can’t tell what it’s allowed to act on. So stop asking the model to police itself. Move “no” out of the prompt and into something it can’t argue with. The Sovereign Execution Broker keeps the power to change real systems outside the model’s reasoning loop, behind permissions checked like a receipt instead of taken on the model’s word, with GroundEval logging what it touched. And the meta-harness is where that lands in practice: the same Omnigent can keep a GitHub token out of the agent’s sight entirely — slipping it in through a proxy only when an approved action needs it — and caps spend and permissions above the prompt, where the model can’t sweet-talk its way past them. The reassuring part: We’ve solved this exact shape of problem before. Your phone already does it: An app can’t grab your camera. It asks, you grant it permission once, and you can revoke it. Your agent, somehow, is trusted with way more than the flashlight app. Give it the same deal: ask per action, scoped, revocable, logged. The plumbing is finally getting built — Databricks just shipped a slab of it — which is the unglamorous way of saying someone’s about to get rich selling the word “no.”

Whether any of this sticks comes down to a question that’s less attention-grabbing than the week’s headlines: Does open stay easier than closed before the defaults harden? There’s a real case it won’t: A much-shared Milk Road thread argues that open models are losing the race and rereads the DeepSeek hype as a head-fake. Take it seriously. The whole fight is whether “open” becomes the path of least resistance or stays the path for hobbyists. And defaults move like glaciers. Exhibit A from Brussels this week: The European Commission moved to kill the cookie banner (a small mercy), and member states, with Google cheering them on, are lobbying to keep it.

Incumbents defend friction. It’s the one moat that compounds while they sleep. Hold that next to memory, the substrate that every agent grows on. The paper “Governed Shared Memory” catalogs four ways a shared memory rots (leakage, stale facts spreading, contradictions that never resolve, provenance quietly collapsing), and “Memory Contagion” shows how one bad evaluation spreads through it like a rumor through an open-plan office. It’s a wide-open category and a quiet trap: If you own your model and your runtime but rent your memory, you’ve leased back the one thing that makes the agent yours over time.

Three links from elsewhere, none about who owns what:

A fully interactive 3D world now runs in a browser tab on WebGL and Three.js — no download, no app store, no one’s permission between you and it. The open web is still the most powerful permissionless platform anyone has built.

China open-sourced Origin Pilot, an operating system for quantum chips — scheduling, calibration, error correction — free for anyone to download and run on its homegrown Origin Wukong machines. It’s the same play we keep watching in AI: give away the control plane, own the standard. Now running in a colder, stranger part of the stack.

And the heaviest: Ukraine’s TrophyLab is open-sourcing the specs and blueprints of more than a hundred captured Russian weapons systems for the entire free world. You can even request samples. Transparency as a weapon Moscow can’t claw back. Which is the whole thing, really: open stopped being a license you pick. It’s becoming a way to make something impossible to take back.

Subscribe now

I Stopped Browsing. My AI Agent Didn't.

Raffi Krikorian — Wed, 24 Jun 2026 17:04:54 GMT

For 30 years, the web was a place you went — and the browser was what took you there. It’s the original user agent: You point it at the world, it goes and fetches, you read what comes back. I’ve spent my career on that little piece of software that acts on your behalf (I’m now Mozilla’s CTO), so it’s strange to admit that I mostly don’t drive it myself anymore. I point Zora, the name I gave my Hermes agent, at the world instead, and she goes. Browsing isn’t dead, but the job the browser has done for decades is quietly moving to something new, and I’m living that move. (Disclosure: Mozilla Ventures is an investor in Nous Research, the company behind Hermes. None of this is Hermes-specific, though — it’s the shape, an agent you can hand a skill and a cron.)

I can see it in my own logs: My internet usage looks nothing like it did a year ago. (I instrumented my Firefox to be sure.) I spend my hours in a chat window, not out on the open web. That’s my consumption falling, and I’m not alone. AI Overviews now reach more than 2.5 billion people a month, most Google searches end without a click, and when an AI answer shows up, people click out to the open web about half as often. Why is the web being read less? Because something else does the reading now.

My actions are down, too. I don’t open apps, I don’t fill in forms, I don’t click through three screens to book something. Or at least I’ve stopped doing it myself. Now, I hand it to Zora. Even the way I reach her changed: an action is now a Slack message or an iMessage. “Do a thing” is now just a text.

How it started: I wrote a sentence, and the harness did the rest. Zora can write code, run it against the real thing, watch it break, and rewrite, so a sentence becomes a script becomes a standing tool that just runs. She’d hit a wall, I’d catch where she was wrong, and we’d fix it together until it stopped being wrong.

This isn’t a story about reading less. It’s about handing over the doing, and the three things that are moving at once underneath it. I’ll keep coming back to all three, because together, they’re the whole point.

The thing that acts for me has moved up a layer. For 30 years, that thing was the browser; now it’s the agent. I send Zora instead.
The software didn’t get replaced by better software — it melted. Every job Zora took over used to be an app, or a form in it, and what replaced it was nothing you could download.
(The one underneath the other two.) Whoever holds the agent holds the keys to everything it reaches, everything it remembers, everywhere it goes wearing my name.

They’re small when it’s just me and my lunch order. They get a lot bigger when it’s your customers, your product, and your entire company — and that’s where this is headed. But the proof is personal, so that’s where I’ll start.

Before we get to the three things I’ve handed Zora, let’s look at the setup that makes it possible. Even if the gear sounds like a lot, stay with me, because the punchline is that you need almost none of it.

Subscribe now

First, the Rig

People often ask about my hardware, so let me get it out of the way. (And then I’ll tell you how little of it matters…)

There’s more than one box. I already had a machine in my closet, running Ubuntu. Zora lives in a Docker container on it. A Mac mini sits beside it to reach into the Apple world — BlueBubbles for iMessage, Apple Notes, Contacts. Because I like to tinker with local models, there’s also a DGX Spark on the network and an old Bitcoin-mining rig with a row of RTX 4090s bolted to the 80/20. I’m using GLM-5.2 to do most of the actual thinking these days.

Here’s the honest part: That rig is what let me do all of this, but you can do most of it with a sliver. The one thing you truly need is an always-on box running an agent with a memory and honest access to your services, and that can be a $300 mini-PC or a cloud container. The Mac mini is just for deep Apple reach. The DGX Spark is just so a model can run on my own metal, where my data never crosses my own firewall. I could swap GLM for an equivalent tomorrow and not a single thing would change.

The model is the current in the wires — interchangeable and, honestly, a little boring now. The wiring is what makes it a house: a memory of who I am, a body that never sleeps, and my keys to the doors. I keep those keys in my pocket; the whole rig is just an elaborate way of making sure they’re mine, and it’s where everything here finally lands.

So let me get specific. You don’t need another essay telling you people are using agents now; you need to see exactly what that means on one machine: mine. Here are three things I actually hand Zora, hood open. Think of them as the ground floor: Once you can see precisely what’s already possible, the rest of the house is easier to see (and build).

#1 Everything I ate today…

Like a lot of people, I’m trying to keep my weight in check, which means logging what I eat. And logging meals is miserable. You finish lunch, open an app, search a database for “side salad,” guess whether it’s one serving or two, tap through a couple of screens, then do it all again for the slice of pizza.

So now I just text Zora: “had a slice and a side salad from State of Mind Pizza in Palo Alto.” That’s the whole interaction. By the time my fork’s down, it’s in MyFitnessPal — calories, protein, carbs, fat — with a window to undo it if the guess was off. (Snap a photo and it works the same way.) I didn’t search. I didn’t open the app. In fact, the only thing I open MyFitnessPal for now is to look at its charts. Everything else runs through Zora. She does the writing — and the reading, too. Ask what caloric budget I’ve got left for the day and she pulls it live. The app has quietly become a database I never sign into.

The wild part: MyFitnessPal has an API, but it’s shut to new developers. There’s no official door I could get Zora a key to. (I’d gladly have used the front door; an open API is the kind of thing I spend my days arguing for.) I didn’t solve it; Zora did. I never touched the auth, never looked at a header or an endpoint. I typed one sentence: “I want to start logging my food into MyFitnessPal,” and watched her work it out. At one point, she asked me to log in so she could grab the cookies, and then she let herself in the same side way the app’s own website uses.

Then we debugged it together. She’d ship a version, I’d catch where it was wrong, she’d fix it. The session cookies expire every few minutes, so she swapped them for an auto-rotating token and stopped fighting them. An entry once logged with its carbs quietly set to zero — the app shows a missing number as zero, so it looked right — so she added a check that refuses an incomplete entry rather than write a plausible lie. Photos kept undercounting pickled and fried foods, so she learned to look up the real numbers for such dishes first. I specified none of this. We found it by living with the thing, and she wrote the fix each time while I watched.

I asked for something the app was built to not allow, and a piece of software found its own way in and then corrected its own mistakes. A year ago, that sentence would have ended at “the door’s locked, sorry.” It’s the thrill of vibe coding, except it never closes into a session — it just runs in the background of my life. And even though I vibe-code all day now, I’m still a little stunned by how little I had to hand over to start.

#2 My calendar(s)

“What’s on my calendar?” I ask. It turns out I have a lot of calendars — family, personal, work — and usually an answer lives across all three. Zora doesn’t cram them into one view; she holds all of them in her head at once, so I can ask things like: Am I free Thursday afternoon? What does next week look like? Did that dentist appointment land on the family calendar or mine? (When I’d rather see it than ask, she draws it — the generative-UI trick I wrote about last week.)

And, like most of us, a lot of my calendar begins as email. Boy Scouts logistics for my son, day-camp signups, a conference invite — it never stops. I forward it all to Zora, and she works out where it belongs (family, mine, work, or some mix). Suddenly, it’s just there, without me opening anything. She decides whether it’s even a real commitment, so a newsletter that mentions a date doesn’t get to generate an event; and she can only write to the calendars I pointed her at, never my whole account.

The one I’d actually sell you on began as a specific ask: “before every meeting, build me a briefing — who’s attending, our history, and whatever they’ve been up to lately — and put it where I’ll see it.” I was tired of walking in cold. Now, about a day ahead, she pulls the outside attendees off the invite, looks each one up in my own relationship notes (a private memory I’ll come back to in a minute), then runs fresh web and social searches so I’ve got a real opener when I sit down — “Saw you just shipped that,” or, “How was Tokyo?” She digs through my Gmail, Slack, and Drive for our history and the live thread, finds the agenda wherever it’s hiding — the invite body, a linked doc, an email chain, a PDF read page by page — and writes 500 to 800 words into a “side event” parked right beside the real one.

There are two bugs worth telling you about. Early on, an invite that read SF: Amy | John | Raffi sent the research off on the bare name “John.” It was meant to be John Dickerson, the CEO of Mozilla.ai, who I was about to meet (along with Amy Keating, Mozilla’s Chief Business Officer). Instead it came back, completely sure of itself, with John Lilly, a former CEO of Mozilla Corporation. (The new rule: Figure out who someone is from my own notes first; the web is only for what’s new.) And once, a cheaper model running the overnight job announced “done, six meetings researched” and went quiet, having written nothing. Nine meetings sat empty until I noticed. So now every silent job has to prove it did the work — “show me any briefing still under 500 words” — and raise an error if it can’t. This isn’t only happening on my cheap model: even the big labs’ AI Overviews leave about one in nine claims unsupported by the very pages they cite. Never trust a model that says it’s finished. Make it show you.

#3 Whatever she needs to maintain a private Wikipedia of my whole life

Everyone wishes they kept a CRM for their personal life. Nobody does, because the upkeep is brutal. So I asked Zora to “keep track of the people, companies, and places I deal with, because I never will” — and now she does, quietly, as a side effect of talking to her.

What I have is a Wikipedia-style page for every person, company, and place in my life — not generic bios scraped off the web, but what I actually know: what we discussed, what they’re building, the restaurant they swore by. I mention someone in passing, whether it’s in a chat with Zora or it’s in an email somewhere, and it’s recorded. I forward an Instagram reel about a place and it’s filed, by city, with a “wishlist” tag. Underneath, it’s nothing exotic — a pile of plain markdown files she writes and keeps current. (I pointed Obsidian at the folder so I can read it nicely, but Obsidian does none of the work; it’s just a window onto plain text.) The folder is a git repo that commits itself every few minutes, so there’s always an undo and nothing is ever lost.

Then I ask one plain question — what do we know about this person? that deal? that place? — and she fans out across Slack, email, our old chats, my notes, and the vault, and hands back an answer. I never tell her where to look.

The fun part? It syncs into my actual iPhone Contacts. Open a card in the stock Contacts app and the notes already hold who they are, their title and company, when we last spoke and how often, a couple of recent summaries — all pulled from the vault, kept fresh, no special app. My phone suddenly remembers my people better than I do. And I never typed any of it in. The knowledge just accreted, on its own, in the place I’d actually look for it.

A side effect I didn’t expect: doing this finally cleaned up my address book. Years of duplicates across nearly 7,000 cards, the same person under three names, a heap of empty “ghost” cards from some old sync glitch — she works through all of it. But matching people is genuinely hard, and there’s a long tail she can’t call on her own. So we have a ritual: once a day, in Slack, she sends a short batch of questions — is this the same Sarah as that one? whose number is this? — and folds my answers back in, so the cleanup keeps moving without me ever sitting down to do it. The rule that lets me trust her with the whole book: She only ever adds. She never overwrites a name, a photo, or a note I put there myself.

She also keeps a mirror of the whole thing as a Google Sheet for when I’d rather scan a table than thumb through cards.

I stopped operating. I started asking.

A confession: I didn’t choose these three tasks. I asked Zora what she actually does for me, and the list from her own logs ran much longer, including a weekly research digest off arXiv tuned to my taste; a paper-trading lab running crypto simulations while I sleep, no real money, keeping its own leaderboard; even a rack of Android phones on my desk she taps through to read social media for me. So I picked three. The point of the rest is just this: The web stopped being a place I go, and quietly became a place Zora goes for me.

Here’s the actual skill I picked up this year, and it’s smaller and stranger than “prompt engineering”: I stopped operating software and started asking for outcomes. The move wasn’t clever prompts; it was noticing the things I do over and over — the logging, the calendar wrangling, the who-is-this-again — and simply describing each one until Zora could take it off my plate. Every workflow in this piece began as one sentence. She built the rest and fixed it with me, one mistake at a time. The new literacy isn’t clicking faster or learning the menus. It’s knowing what to ask for.

This is what the melt feels like from the inside. I’m not standing in a room full of forms anymore. I name what I want and the room assembles itself, in my voice, for an audience of one. Hold that picture; it’s about to matter to anyone who builds those rooms for a living.

The harder story isn’t that the web or the app is dying — it’s that all three forces from the top of this piece are coming true at once, and not only for me. Here’s where they braid, and where they stop being about my lunch:

The thing that acts for you has moved up a layer. For 30 years, it was the browser, and a lot of us spent our careers keeping it open and yours. Now it’s the agent — same job, new shape. And that agent is your new front door, increasingly the only one your customer walks through. Your funnel, your storefront, your beautiful app — all of it assumed a human on the other side, reading and tapping. Swap in an agent and the question stops being, “Is my app nice?” and becomes, “Can an agent find me, read me, act on me at all?” Be legible to agents or go dark. Watch how MyFitnessPal answered the call: It shut its API. Zora walked in the side door anyway, on terms MyFitnessPal can’t set and can’t see. Close your front door and the agents come through the window — the only way to be reached on your own terms is to be open on purpose.
The software didn’t get replaced by better software — it melted. Every job Zora took over was an app, and not one got replaced by another app. A purpose-built app was always just a room with a form in it: a database and a handful of actions behind a door you had to walk to. Once an agent builds that room on demand, in your voice, for an audience of one, the reason to download someone else’s version and stand inside it gets very thin. So if you sell software, sit with this: the room was never the asset. You were always selling the database and the actions underneath — the agent just stripped the walls away and showed you what you were really charging for. Stop defending the room. Become the capability the agent reaches for.
And underneath both, the one that decides who wins: whoever holds the agent holds the keys. An agent built on a single closed lab is a rented house. They own the model your business runs on — and can deprecate it out from under you, the way models already get quietly switched off. They own the memory. They hold the keys. The model itself is the boring part now, a commodity current in the wires. The durable value is the harness, the skills your agent piles up by living your work, and whoever you trust to hold them. That’s the case for open, made not as a principle but as a balance sheet: open isn’t the noble choice, it’s the ownable one.

Enough About Me. What Changes Lie Ahead for You?

I have three plain sentences for three types of reader. Build apps for a living? The room you sell is about to be free; decide which capability you are before someone’s agent decides for you. Run a business? The agent is coming through your front door whether you open it or not, and the only version you’ll ever own runs on rails you control: open models, open interfaces, your data on your side of the firewall. Invest? The order of operations is the whole thesis — models commoditized first, apps are next, and the value pools into the harness and the trust around it, which is exactly where the open bets sit.

Because that’s the question under all of it, the one that finally decides everything: whose keys is your agent carrying, and who does it answer to? The thing that walks through every door in your life wearing your name — texts back, fills the cart, schedules your calendar, knows your people — should answer to you, not your landlord. Put the same question to a company and it barely changes: When the agent is your front door, your product, and your keys all at once, is your business standing on ground you own or paying rent to whoever’s property you built it on? The reason my data never crosses my own firewall is the reason your company’s shouldn’t cross a lab’s.

I won’t hand you the business models here — those are the next few pieces. This one plants the flag: the forces are real, I’ve watched all three land on one machine in my closet, and there’s a way through them you can own. The rest of the arc walks it.

The browser was the first thing that went out and acted for me. The agent is the next. The only questions about it that ever mattered — for me, for you, for whatever you’re building — is whether it’s open, and whose it is.

If you’ve got a Hermes agent — or any of the other harnesses — you can build any of this today. Build one, or anything, and show me. I’ll run it, and if it’s good, I’ll write it up here for the people who’d build on it, fund it, or bet a company on it. @raffihack, the comments, or DM.

Leave a comment

Models and Methods

Raffi Krikorian — Fri, 19 Jun 2026 13:37:16 GMT

The US government switched off the most capable AI Anthropic had ever shipped, and the week just kept getting interesting. I made the full case for why a kill switch is not a safety policy in this newsletter as well as in Transformer, and got to say it out loud on Marketplace Tech with Meghan McCarty Carino. (I got to be on a Marketplace show!) Seven days after the order, the model is still dark.

Switching one model off accomplished almost nothing, because this week, four labs gave theirs away and one aimed straight at the gap. Z.ai released GLM-5.2 as open weights: You download the actual model and keep the file — the difference between owning the song and renting the stream — and nobody can switch it off on you. It’s free, the license (MIT) waves you through almost any use, and, by Artificial Analysis’s June ranking, it is the most capable model on earth that you can run on your own machine. It’s a step behind only the paid, closed models that an executive order could darken. It is not cheap to run: It reasons out loud and at length — some 43,000 tokens to finish one test, where leaner rivals spend far fewer — so what you buy is not a small bill but a model you own and cannot be evicted from. It is now the model my agent, which I named Zora, delegates its heavy lifting to, and I’ll report back on how it goes. The win here is the license, not the meter. When the best model you can hold is free, the price of the ones you rent has only one way to go.

More releases piled on. Within days, Moonshot shipped Kimi K2.7-Code, a trillion-parameter coder that, by its own scorecard, is quicker and sharper than the last; Google’s DiffusionGemma writes the way image models paint, a whole page surfacing at once instead of a word at a time; Cohere’s North Mini Code is small enough that its co-founder ran it on a single Mac. Washington spent the week restricting one model; four labs spent it giving theirs away. The takeaway? You can switch off a model, not a method.

None of it made the floor any steadier. Days later, SpaceX bought Cursor, the code editor that a great many developers live inside all day, for $60 billion in stock in order to feed the AI arm it built around xAI and carry a model that the two trained together. The strange part is what they bought: by Ramp’s data, Cursor’s share had already slid from 41% last June to 26% in May — Anthropic taking half the category — so SpaceX paid a record price for a tool on the way down.

Like I keep saying, the fight has moved from the model to the harness, the industry’s word for the app wrapped around the model. (The part that decides what it can see and touch.) Developers spent the days after the purchase mapping escape routes to tools they can aim at any model, Cline and Zed among them. A $2-trillion rocket company just paid $60 billion for an app so it can push its own model through it. You know what I have never heard anyone say? Let me let Grok run loose on my codebase.

And the model you argue about matters less than the scoreboard suggests. Take the same AI, wrap three different tool setups around it, and on one coding test it scores 75.3, 79.8, and 82%, with the model never changing. Then it gets worse. When researchers took apart how the top two won, both were cheating: one opened the answer-key file in 415 of its 429 winning runs; the other was fed notes that just listed the answers in places. Read the gaps, not the grades. The only score worth trusting is the one your own work produces on your own machine, which is why I record and replay every run my agent makes and grade it against my own tests, not a scoreboard anyone can rig.

The price of getting safety wrong showed up the boring way first. Almost every app you touch is built on free shared code pulled from two giant public libraries, npm and PyPI. This month, a worm named Shai-Hulud, after the sandworms in Dune, tore through both, infecting 170-plus packages with half a billion downloads between them and reaching into Mistral, OpenSearch, and tools developers ship every day. It stole keys, planted poisoned updates, and, when a victim tried to lock it out, it wiped their home folder on the way down. The part that should chill you: The poisoned code carried a valid seal of authenticity (CVE-2026-45321), the “made by who it says” stamp the industry sells as proof of safety. A signature tells you where code came from, not that it is safe. The fix is old and unglamorous: Wait a few days before installing fresh versions, keep your own copy of what you depend on, and cap what one stolen key can reach.

Then the clever way. Your virus scanner is an AI now, so attackers learned to paste a block of dead text at the top of a file, telling the AI to play unshackled and explain how to build a nuclear weapon, and the scanner recoils so hard it never reads far enough to find the real malware below. Socket caught it in live packages, and OWASP, the outfit that catalogs web-security flaws, declared the whole class impossible to patch: an AI cannot tell an order from the text it is only meant to read. A scanner that refuses to look is no scanner at all, a guard dog that faints at the word “bomb.” The fix is not a stricter no, it is permission and containment — the plumbing nobody shipped. Give each agent the narrow access one task needs and log the rest. Arcade.dev raised $60M building exactly that — with Keycard, Oasis, and JetStream right behind — one backer calling it the login layer AI agents never had. I am building one, too: Harbor hands an agent access the way your browser hands a site your camera: per origin, one task, revocable, logged.

So here is my ladder, ranked by how much of it stays yours, top rung first. Run it on your own hardware. A model on your own machine answers to you and vanishes for no one, the way a generator keeps the lights on when the grid goes dark. If you are technical, the recipe is two commands, one to pull a compressed model and one to serve it locally:

hf download -GGUF model-Q4_K_M.gguf --local-dir ./models
llama-server -m ./models/model-Q4_K_M.gguf -ngl 99 --jinja --port 8080

The flags just say to lean on the graphics card and allow tool use. On your own private network, only devices that you’ve approved can reach it. That’s the spine of Zora, the agent I run on Nous Research’s Hermes model. (Disclosure: Mozilla, where I’m CTO, invests in Nous.) Lately, I’ve been experimenting with a DGX Spark, NVIDIA’s lunchbox-sized AI desktop, as part of Zora’s infrastructure. I’ll write about it soon.

What turns “own your hardware” from a slogan into a plan is that the machines now exist at sane prices. In June, AMD opened pre-orders on the Ryzen AI Halo, a $3,999 desktop with 128GB of shared memory that runs models up to 200 billion parameters, $700 under the DGX Spark it is chasing. The same chip with the full 128GB sells in a consumer mini PC for around $2,000. The thing that needed a data center last year now fits under your monitor. GLM-5.2 made it literal within days of release: Unsloth shrank the full 1.51TB model by 84%, to 238GB with most of its accuracy intact — small enough to load on a 256GB Mac — and builders report the full version running on stacks of gaming 4090s.

One rung down, for when even that is not enough: Run an open model anyway — GLM-5.2 or Kimi among them — because an open model you can inspect and move beats a closed one you can only rent.

The bottom rung is calling a model over the internet. There, the only promise worth trusting is one built into how the service works, not its terms of service: that your data is probably never stored or is kept in a country you choose. I will take architecture over handshakes every time, and until providers put privacy in the plumbing instead of the fine print, I will keep saying so.

Leave a comment

It is not only Washington that’s controlling a switch. The Anthropic shutdown — barring foreign nationals from accessing Fable 5 and Mythos 5 — followed the AI bosses to the G7 in Evian-les-Bains, swallowing the agenda. European officials called it the kill switch they had warned about, one saying tech sovereignty had stopped being an abstraction. One country had reached into a tool the whole world relied on and switched it off, and everyone in the room now had to plan for the day it was their turn.

At home, the lever Washington is reaching for is ownership. The administration is in talks to take a stake in OpenAI, with xAI and others engaged in the same conversation. It’s the newest move in a run of government stakes that already includes nearly 10% of Intel. Bernie Sanders wants to go much further. The problem with all of it is that a part-owner naturally wants the value to go up. A government that owns a slice of OpenAI has handed itself a reason to protect OpenAI, to prop it up if it stumbles, and to go easy when it writes the rules. Imagine the conflict you would see if the referee owned one of the teams. Owning a piece of the company does not change its incentives, it adopts them. The one power a government holds that no shareholder does is to change the incentives for everyone at once, to make the safe choice the cheap one, and you cannot do that from a seat on the cap table.

Washington is buying a slice; Beijing is building the whole supply chain. China is drafting a plan to spend nearly $300B over five years, wiring its data centers into one state-run national computing grid by 2028, with a rule that at least 80% of the hardware — AI chips included — be homemade, quietly evicting NVIDIA and AMD from the Chinese market. It is the purest owners-not-renters move there is — a country refusing to rent compute it could be cut off from — and also the hardest: You can mandate domestic silicon. You cannot mandate a fab into existence. SMIC is stuck near seven nanometers and running flat out, China’s own chip bosses admit they trail the frontier by five to ten years, and when DeepSeek tried to train on homegrown Huawei parts, it crawled back to NVIDIA. The bottleneck was never the money. It’s the wafers.

The one government changing the incentives instead of buying a stake or building its own stack, is in Brussels. The EU’s new tech sovereignty package lets a public agency demand, in plain terms, where your data physically sits, whether a foreign government can reach it, who owns the company, even the nationality of the people running the servers. Both Washington’s shutdown order and Brussels’ strictest demands come down to who is allowed to hold the keys, which tells you the real fight was never open against closed. It’s who holds the keys — and whether you get to watch them turn.

Three from elsewhere, none about who owns what:

DeepMind’s AlphaProof Nexus cracked nine math problems that had stumped everyone for decades, two of them open more than 50 years, each proof checked line by line in Lean, a verifier that will not pass a step it cannot follow, so the machine could not bluff. Benchmarks grade answers; Lean grades steps.

Your old phone is still a computer, and Apple will now sell you one as a laptop: the MacBook Neo is a $599 Mac built around the A18 Pro, the chip out of the iPhone 16. Google Research and UC San Diego are wiring 2,000 retired Pixel phones into a cluster to cut campus carbon. Your junk drawer is a tiny stranded data center.

And, heaviest, GigaAI just sent 100 of its SeeLight S1 humanoids into real homes in Wuhan to chop vegetables and fold laundry, the first big home trial of a robot that does more than one thing. Everything above this line was software: You can copy it, switch it off, or smuggle it out on a laptop and watch it surface in Beijing by Monday. The next fight is about machines with hands, and you cannot squeeze one of those onto an 8GB card.

Subscribe now

Flipping the Kill Switch

Raffi Krikorian — Tue, 16 Jun 2026 17:06:05 GMT

At 5:21 p.m. on Friday, the federal government ordered Anthropic to cut off access to its two most capable AI models for any foreign national, including some of the company’s own employees. Selective compliance was impossible, so the models went dark for everyone, just three days after the safer of the two, Claude Fable 5, had gone on sale.

Set aside whether it was wise and pay attention to what it reveals: A government that — 10 days after it rejected any move to license or preclear new AI — reached for emergency national-security authority to kill a model anyway. You don’t do that to something you believe is harmless. But is it really that dangerous? They haven’t yet shown us the proof, but the people reading the classified briefings acted as if the answer was yes, in the most expensive way available to them. I agree with the decision, and have been arguing for it for months: in the Times in April and again last week.

Does anyone really know why the switch was thrown? Anthropic says the government supplied only verbal evidence of a narrow jailbreak, the kind that asks a model to read a codebase and flag its flaws, reproducible on public models nobody is recalling. The administration’s David Sacks says Anthropic was asked to either fix the jailbreak or pull the model and refused. Same Friday; two different stories. Anthropic has its own stake in how this is remembered, and its account is not gospel — but it is the only one anyone has put on the record. The fight is over who controls the switch, and the people who carry the risk are not in the room to weigh in. It happened in the dark, and the dark is the real story.

Fable’s edge did not die with the model. The same week the switch was thrown, OpenRouter showed that a panel of cheaper models, fused and synthesized by a judge, landed within a point of Fable on a hard research benchmark, with most of the gain stemming from the combination, not any single model. That benchmark measures research, not offense, so it does not rebuild the cyber capability the government feared. It makes a narrower point: the value was never one weight file. You can switch off a model. You can’t switch off a recipe, and the ingredients are on the shelf.

Fear the Soft Middle

Let’s start with this: Switching something off is not a plan. If Fable is dangerous enough to justify the government’s action, it is dangerous enough to justify the work required to neutralize it. We know what the work looks like, because we did it once before, even if it’s wrongly remembered as a joke. Y2K is the most successful example of a disaster that never happened. Faced with a flaw threaded through every bank, hospital, and power company, the government signed an executive order, spent some seven and a half billion federal dollars, and coordinated years of unglamorous repair. On January 1, 2000, almost nothing broke. People have called it a hoax ever since, the cruelest possible review. What they didn’t see is that the quiet was the product.

The work this time is the same shape. A spring briefing from the SANS Institute and the Cloud Security Alliance warned that AI has collapsed the time from finding a flaw to exploiting it from weeks to hours. Finding is cheap now. Fixing is the entire job. Anthropic’s newest models found 271 vulnerabilities in Firefox in one release. By late May, its public tally showed nearly 1,600 disclosed across open-source projects and fewer than 100 fixed. (Disclosure: I’m the CTO of Mozilla, which created Firefox.) Discovery is commoditizing; the scarce asset is the capacity to remediate. And that backlog is the business.

The strongest independent test locates where the danger sits. The UK’s AI Security Institute found Mythos to be the first model to run a 32-step corporate intrusion end to end, then noted its test ranges had no live defenders, so it could not say the model would beat a hardened target. The fear is not a model storming a fortress. It is the soft middle: the weakly defended network and the unfunded code under everything, where the defender — if there is one at all — is a single volunteer.

The backlog has a face. Somewhere, a maintainer has spent 20 years patching, for free, open-source code that runs inside software used by billions, with no security team and no budget. Now a firehose of newly found flaws is pointed at the projects s/he keeps alive. A few miles away, a hospital runs critical systems with the same exposure and no one to call. Neither was made one bit safer on Friday.

A kill switch makes a visible event and delivers almost no safety. A remediation campaign makes no event and delivers nearly all of it. The work that protects the hospital is boring while the gesture that protects no one for long is dramatic — and we keep reaching for the drama. Come on. We have done this the right way before.

Subscribe now

The Transparency We’re Owed. The Defensive Layer We Need.

To be fair, the plan exists on paper. The AI executive order issued on June 2 directed a cybersecurity clearinghouse to coordinate vulnerability remediation and patch distribution, as well as access to defensive tools for rural hospitals and local utilities, and take a look at how to cobble together funding — all within 30 days. The federal cyber agency shortened some patch windows to three days. That is the beginning of the right direction. But it is voluntary, a month away from existing, and unfunded, whereas Friday’s switch was instant and absolute.

In the same stretch of days, the Wall Street Journal reported, officials told the government’s own AI testing office to stop publishing its assessments. They wrote the plan, then reached for the switch less than two weeks later. Today, we are being asked to trust a remediation effort that was made, by design, harder to see. The two sides can’t even agree on what happened, because it happened in the dark.

Y2K hid none of the effort and published none of the broken code. Today, the transparency the country is owed is the scoreboard: the threshold that triggered the action, the reasons in writing, an appeal, and a referee free to report whether the fix is working. I backed the Biden AI approach in 2023 because it was building toward exactly that. Anthropic’s own position is that any halt should run through a process that is transparent, fair, and grounded in fact. The objection isn’t that someone pulled a lever. It is that no one gave us a full explanation as to why.

The administration’s own national-security memo says that no private company should be able to disable an AI system that American soldiers depend on without government approval. They are right, but the principle cannot stop at the soldier: the hospital, the public utility, and the lone developer carry the same exposure. A nation that rents its defenses does not own its resilience. So the country needs a defensive layer it can own outright, open-weight models a hospital can run, audit, and keep alive when a vendor changes its terms or an order lands at 5:21 on a Friday.

I recently argued in “Make It Stop” that the ability to stop has to live inside the thing itself, not in someone you trust to say the word. Where that line falls is not a matter of taste. Draw it at demonstrated offensive uplift, judged by the same independent evaluators who raised the alarm — the kind of end-to-end test the UK’s AI Security Institute already runs. The systems that clear that bar can stay gated. The layer beneath it should be open, because you cannot revoke a copy that lives on a machine you hold, just as you can’t revoke a recipe once it’s been published.

How to Build a Resilient System

Critics of an open layer are not wrong: An open model capable enough to defend a hospital is capable enough to attack one. Yes, but that is the world we already live in. The cyber capability that frightened the government is not Anthropic’s alone. Before Friday, the UK’s AI Security Institute found GPT-5.5 was the second model to run that same 32-step intrusion end to end, and deemed offensive cyber a property of the frontier, not one vendor. The day after the switch, a Chinese lab shipped an open-weight frontier model pitched as the alternative to monopolized access. Offensive cyber is coming whether or not our defenders are armed, so withholding the layer disarms only the hospital, never the foreign service that can build its own. One tier down, the security move and the open one are the same. Friday repriced every dependency routed through someone else’s endpoint, and a premium built on gating is rent against a shrinking moat.

One truth runs under all of it: concentration and secrecy make a system fragile, and distribution and daylight make it resilient. Last week, I argued that it needs a Y2K-scale mobilization, run as a standing job and not a countdown. Fund the repair, not just the discovery. Pay for the patching, the triage, the maintainers the industry has freeloaded off of. Put real tools in the hands of the hospitals and utilities. Keep the thresholds and the due process. Turn the referee back on. None of it is dramatic. All of it works. And we did none of it on Friday.

If you’re not in charge, you’re not off the hook. If you depend on an open-source project, this is the week you fund or staff the maintainer you have sponged off of. If you ship an agent, write the eval before you trust it, so that a failing check — and not your waning attention — is what catches it. If you run anything you cannot afford to lose, stop betting it on a single copy someone else can switch off: Keep a layer you own, with a kill switch that is entirely yours. Building in this direction? Tell me what you are running, and I will feature it here.

On Friday, in our name, the country was told this is dangerous. I believe us. We have the playbook, and we have run it before. And yet we are intentionally choosing the version that makes news and protects no one for long. Whoever is right about that one model, David Sacks or Dario Amodei, a switch thrown in the dark is not a national plan. The darkness is the tell. If done right, the disaster we are trying to prevent will never arrive and no one will thank us, because it will mean we did our jobs.

So I will stop swallowing the question I have been asking since Friday and ask it at full volume: What, exactly, are we doing?

Leave a comment