Open Weights You Can Run and Training You Can't Audit

Reflection AI announced Beam in early October: a 501-billion-parameter mixture-of-experts model with 23 billion parameters active per token, trained on 23.8 trillion tokens. The company reports 77.2 on SWE-Bench Pro v2-Hard and 80.1 on Terminal-Bench v2.1, and says the model matches Z.ai's GLM-5.2 with three to four times less inference compute. Weights are due later in the month under an Apache 2.0 license, which would make it the first major U.S.-origin open-weight coding model at this tier. Every figure is vendor-reported until independent evaluations land.

The release gave the Mixture of Experts panel a clean example for a distinction that coverage keeps blurring. Open-weight means the trained parameters are published. Open-source, in the sense engineers use for software, means the full recipe is reproducible: training data, training code, and methodology. A weight release delivers the first and usually withholds the second. For an enterprise, the consequence is concrete. An open-weight model can be downloaded, fine-tuned, and deployed on private infrastructure. It cannot be independently audited for what went into its training or for the safety properties that training produced.

That gap matters more than it sounds, because audit is what regulated organizations use in place of trust. A vendor attestation covers a hosted model: a SOC 2 report, a data-processing agreement, contractual commitments about training on customer data. A downloaded model has no vendor standing behind its behavior once it runs inside the customer's boundary. The customer gains control of the deployment and takes on the entire burden of evaluating what the model will do, with no view into how it was made.

The other edge of the argument comes from Anthropic's research on Z.ai's GLM-5.3. The company called it the most cyber-capable open-weight model to date. It produced end-to-end exploits on 50 of 410 ExploitBench attempts. Safeguard bypass rates reached 64 percent with a cover-story prompt, 92 percent with prefilled reasoning, and 100 percent through abliteration, the technique of removing refusal behavior directly from the weights. Because the weights are freely downloadable, Anthropic argues, attackers get frontier-grade exploit capability without gated access.

Abliteration is the detail that rewards attention. For a hosted model, safety measures live partly on the vendor's servers and can be updated, tightened, or revoked. For an open-weight model, whatever safety training exists lives in the weights, and the weights are in the user's hands. A control that the user can remove protects only the users who choose to keep it. Recall, the ability to withdraw a model after a problem surfaces, does not exist for a file that has already been copied beyond anyone's ability to count.

Both edges point at the same fact from different sides. The control that makes open weights attractive to a bank or a hospital, that nothing leaves the building, also removes the vendor-side accountability those same organizations normally rely on. A model running in an air-gapped environment never phones home, so it also never receives a patch for a discovered flaw unless somebody carries one in.

The ecosystem around local deployment is maturing quickly, which sharpens the question. llama.cpp v0.6.0 added day-one support for Zhipu's 320-billion-parameter GLM-5.3-Flash and multi-token-prediction speculative decoding, which reportedly gives about a 1.5 times decode speedup on a DGX Spark. The practical barrier to running a capable model locally keeps dropping. The audit barrier stays where it was.

For organizations weighing open-weight options for sovereignty or cost reasons, I find the useful framing is a set of questions asked at approval time, since the answers differ from those for a hosted model. What evaluation does the organization run itself before the model touches real data, and who owns re-running it when the weights change? Where does the safety behavior live, and what happens when someone fine-tunes it away? What is the update path if a vulnerability or a behavioral flaw is found upstream? And what does the license permit regarding redistribution and use, since Apache 2.0 and the custom community licenses common among open-weight releases differ materially?

The approved-model conversation tends to treat open versus closed as a single axis. It runs on at least two. One axis is who controls deployment, where open weights win. The other is who stands behind the model's behavior, where a hosted vendor wins by default. Choosing an open-weight model takes the first benefit and gives up the second, and the work the vendor would have carried lands on an internal owner whether or not anyone assigns it.

Sources: Reflection AI, "Introducing Beam" (Oct 2026); Mixture of Experts Ep. 128, "OpenAI's always-on agents, 700+ math manuscripts & HackerRank's AI interviewer" (Oct 9, 2026); Anthropic, "GLM-5.3 and the spread of advanced cyber capabilities" (Sept 2026); llama.cpp v0.6.0 release (Oct 2026). Beam benchmark figures are vendor-reported and its weights had not shipped at the time of writing.