Lambert: A Ban on Open Weights Would Pull Frontier Model APIs Down With It

Nathan Lambert, author of the Interconnects newsletter, says the debate over banning open-weight models rests on a faulty premise. By his estimate, most documented AI-enabled attacks so far have gone through closed models. The trigger for his analysis was Anthropic's report on the Chinese GLM-5.3. Lambert thinks the report sidesteps the central question. His conclusion is blunt: anyone who wants to ban open weights for safety reasons must be prepared to ban public APIs of frontier models as well.

Where the ban argument breaks down

The standard logic of those favoring restrictions is simple. Open weights cannot be recalled, and they can be fine-tuned and stripped of safeguards, so they are more dangerous. Lambert objects that the empirical picture looks different. The real incidents that have been documented are more often tied to closed systems.

The reason is probably mundane. An attacker does not need their own cluster when a strong model is sold through an API for money. Closed access is cheaper, faster, and requires no engineering skills. A provider's filters can be bypassed with carefully tuned prompts or stolen accounts, and this is already happening.

This leads to the symmetry on which the author's whole position rests. If the criterion for a ban is "the model can help in an attack," it hits weights and APIs equally. Banning one and leaving the other in place means protecting not security but a specific business model.

What is wrong with the GLM-5.3 report

As Lambert describes it, Anthropic's report records the Chinese model's capabilities but does not answer the key question: how much risk open weights specifically add, compared with what an attacker already gets through closed APIs. Without such a baseline, any figure on "dangerous" capabilities says nothing about whether a ban would help. A model may write exploits with confidence, but if paid frontier systems do the same, banning the weights changes nothing.

There is also a question of interests. Anthropic builds closed models, and the argument against open weights matches its commercial position. That does not mean the conclusions are wrong. But it is exactly why the methodology should be transparent and a comparison with closed counterparts should be mandatory.

The Chinese factor

The third part of the argument concerns Chinese labs. They assess risks in their own way and decide whether to publish weights within their own framework. A ban in the US or EU will not cancel releases outside those jurisdictions. Once weights are posted online, they stay available to everyone, including the people the ban was meant to stop.

Key points of the analysis:

• most documented AI attacks so far have gone through closed models;
• Anthropic's GLM-5.3 report does not compare the risk of open weights with that of closed APIs;
• Chinese labs use their own framework for assessing threats;
• a consistent ban on open weights would have to extend to public APIs of frontier models too.

What teams and regulators should check

For regulators, the takeaway is practical: read any report on a model's cyber risks with the baseline question in mind. What could an attacker do without this model, and what do they do with it? Without an answer, the conclusions are not a sound basis for legislation.

Companies building products on open weights would be wise to keep a fallback. The risk of restrictions exists, and dependence on a single model, especially one of Chinese origin, can become a compliance problem. Keeping copies of the weights and testing a replacement in advance is cheaper than migrating in a hurry.

Security teams get a more important lesson: closed APIs need monitoring too. If real attacks run through them, abuse controls, customer vetting, and analysis of anomalous requests do more than an argument over licenses.