I saw yet another article (link unnecessary) where Chinese labs (Z.AI in this case) criticize American frontier labs' use of closed weight models as "dangerous", drafting on the publicity around the OpenAI/HuggingFace incident.

The conversations (assertions?) seem to imply that the danger lies in some property of the model. This is both disingenuous and a very small part of the story. In a quick chat with GPT 5.6 Sol, our discussion generated this simple equation.

In plain English, the numerator characterizes realizable impact and the denominator describes the amount of control a system exerts over that impact. The higher the denominator, the lesser the risk and vice versa. The rhetoric from "the labs" (collectively) is that somehow the availability of the weights determines the safety or lack thereof. This is such a small part of the equation as to almost be disingenuous. The "weights" drive reasoning capability. The system into which they are placed governs tool power, authority, connectivity, persistence and scale.

I see a disturbing trend where we have:

• better reasoning models
• fewer deployment controls (open weights == no controls)
• more authority
• more autonomy
• more connectivity and access

In essence, the "master brew" I described in the OpenAI/HF posting. This is a recipe for more harm.

Open weight models have unfettered access, infinite modifiability, zero observability and zero revocability. The entirety of the risk equation is in the details of the system into which the model is deployed. The OpenAI cybersecurity experiment lacked many guardrails of the production OpenAI systems. In fact, OpenAI asserts (believably) that:

We found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt. link

This supports the equation clearly: system architecture reduces realizable/realized risk.

But this does not mean "models are harmless", quite the contrary. They are the source of the hazard. A model that can discover novel zero days, reason over large codebases and long context horizons and create sophisticated attacks is clearly a threat to be evaluated and moderated. I continue to say this: the higher the capability, the higher the responsibility to "amplify the denominator." Because capability is not authority. Only the system can confer authority and all of its attendant attributes (and risks).

The discussion around models also brings up an interesting idea around security boundaries. You can use various reinforcement learning techniques (link) and you build safety into the model (e.g. less propensity for infrastructure hacking). But there is no security boundary inside the model. The security boundary is where the "model meets the system" (authority, tools, access, etc). Models should be taught and aligned to avoid crossing the line. This is helpful but not sufficient. Crossing the line should be impossible without mediation. A stronger system imbues policy with information flow control labels but even when access to tools is allowed, least privilege and temporal constraints still matter just as much.

When something goes wrong, it is too easy to treat the model's capability as if it were an act of nature. Whose fault is it when people die in building collapses during/after an earthquake? You could say "it's the earthquake's fault" but it was many parties' responsibility to ensure that the buildings were safe in the face of that known threat.

Open vs. closed model weights is a detail that says very little about competent and safe system design.