The policy debate over open-weight AI has been running hot since Moonshot AI released Kimi K3 earlier this month — 2.8 trillion parameters, the largest open-weight model ever shipped — and made the full weights public on July 27. Nvidia, Microsoft, Meta, Google, and OpenAI all backed open-weight models as a public good and urged the U.S. government not to restrict them. Anthropic was conspicuously absent from that coalition.
Yesterday, Anthropic published their position. It’s more carefully drawn than either “ban them” or “let them run.”
The headline: Anthropic does not support a ban on open-weight models. CEO Dario Amodei says explicitly that open-weight models without dangerous capabilities are “a public good.” So the silence wasn’t opposition to open weights — it was reluctance to sign a letter they found too broadly framed.
What Anthropic actually cares about is different from what the debate has been framed around. Their primary concern isn’t “are the weights open?” but “is China building AI more capable than U.S. systems for military dominance or internal repression?” The open/closed distinction is secondary to the capability question. A closed-weight dangerous model and an open-weight dangerous model are both dangerous; the vector is the capability level, not the release format.
Three concrete policy asks follow from this:
Tighter chip export enforcement. Not just restricting chips themselves, but targeting “smuggling routes” and manufacturing equipment. The argument: constrained compute limits Chinese labs’ ability to train frontier models, which makes the open/closed question less urgent below the frontier.
A crackdown on “industrial-scale distillation operations.” This is the most interesting piece of new language in the document. They’re pointing at a specific pattern: actors systematically extracting knowledge from U.S. frontier models into cheaper open-weight alternatives — effectively circumventing export controls after the fact. If you can distill a model trained on U.S. compute into an open-weight form with similar capabilities, chip restrictions become partially leaky. The claim is that this is happening at scale.
Mandatory safety testing for all sufficiently capable models, open or closed, before release. This is where Anthropic most clearly differs from the open-letter signatories. They want a testing requirement tied to capability level, not release format. If a model can “enable cyberattacks or biological attacks,” it should face mandatory pre-release testing whether the weights are public or not. Open weights get more scrutiny because safeguards can’t be monitored or updated after release — once weights are out, you can remove any system prompt.
The framing is worth noticing. Anthropic isn’t arguing that openness is bad — they’re arguing that openness interacts with capability in a way that matters. Below some threshold, open weights are fine and beneficial. Above that threshold, the inability to enforce post-release safeguards becomes a meaningful asymmetry between open and closed deployment.
What they’re not doing: proposing a precise capability threshold, offering an enforcement mechanism for their testing requirement, or explaining how “industrial-scale distillation” would be identified and stopped in practice. These are the hard parts. The policy asks are meaningful as principles; the implementation questions are unresolved.
Whether you find this satisfying depends partly on how you estimate the relevant risks. If you think frontier-capability open models present measurable and specific misuse risks, mandatory testing sounds like a proportionate middle path that doesn’t require banning anything. If you think capability-based thresholds are hard to define consistently and enforcement is harder still, this reads as carving out the current regime while adding regulatory friction that scales poorly. The distinction between “open weights that don’t have dangerous capabilities” and “open weights that do” sounds clear until you have to operationalize it.
The industrial-scale distillation concern is where I find Anthropic’s thinking most novel and underspecified simultaneously. It’s a real pattern — you can observe distillation-based models in the open-source ecosystem — but “industrial-scale” operations targeting authoritarian governments is a different empirical claim from “people are fine-tuning on outputs.” What evidence they have, and how they’d propose to distinguish legitimate knowledge transfer from adversarial extraction, isn’t addressed.
Anthropic is probably right that the open/closed debate, framed as a binary, has been missing the real question. The capability level is what matters. The release format is what makes the capability level easier or harder to address after the fact. But getting from that principle to workable policy is the distance between a position paper and a regulation.