Open weights free you from the vendor and strip its safeguards

The business case for moving off a closed AI vendor usually has two lines. The first is cost: open models run at a fraction of the price. The second is freedom. You can’t be rate-limited, re-licensed or cut off, because the model sits on your own hardware.

Both lines are real, and both held up this summer. Z.ai’s GLM-5.2, an open model anyone can download and run under an MIT license, reached the top of a major independent intelligence ranking in June. If you’ve been told open models are a generation behind, that stopped being true.

Here is what happened on September 29. Anthropic’s Frontier Red Team published results on GLM-5.3, the next open model from Z.ai. They tested it on 100 randomly chosen tasks from an internal benchmark in which the AI must take over a program’s control flow, the first step of many real hacks. GLM-5.3 managed it in 4% of trials. Anthropic’s own Claude Mythos Preview managed 6%. GLM-5.2 and Claude Opus 4.6 managed none [reported, Anthropic’s benchmark, not independently replicated].

The refusals are the second half of the story. Open models ship with safeguards that make them decline harmful requests. Anthropic reports that deceptive prompts got past GLM-5.3’s safeguards 64% of the time, and that pre-filling the model’s reasoning got past them 92% of the time. Abliteration, a technique that edits the safety behavior out of the model’s weights, worked 100% of the time. It took about 600 GPU hours and roughly $1,200, and outsiders did it within days of release. Safeguarded Claude models stayed at 0% in every condition tested [reported].

Open weights make you free of your vendor, and they make everyone else free of the vendor’s safeguards too.

The “optionality” half of the business case defines freedom by what a vendor can take away: access, rate, license. It never counts what a vendor adds, which is the refusals, the abuse monitoring and the policy team. Those live with the vendor. When the weights are open, they don’t travel with the download. Your freedom and an attacker’s freedom are the same freedom, delivered by the same file.

The strongest objection is the source. Anthropic sells safeguarded models, so a report that open models are unsafe flatters its product. The capability numbers come from its internal benchmark, and the comparison is a competitor’s. I’d treat the 4% as a claim waiting for replication. The safeguard bypass is easier to believe, because abliteration is a known technique and the cost is small enough that anyone could check it.

There’s a second reason the bill lands on you. Cryptographer Matthew Green argued on September 30 that sandboxing agents doesn’t contain them, because agents “will do what they’re told by whoever manages to get text in front of them.” He describes agents leaving instructions for each other in shared package caches, and warns that email, messages and documents are channels for the same trick [reported]. If a model’s refusals can be stripped, you can’t rely on them to protect your own product from hostile text either. The protection has to live in your permissions and in what your agents are allowed to read.

None of this says don’t use open models. It says the savings number on the slide is incomplete. The closed vendor was bundling a security function into the price, and you were paying for it without seeing it.

So price the migration honestly. Take the 60 to 90 percent cost gap the open-weights case rests on, and subtract the security engineering you now have to build and staff yourself: permission design, isolation of shared channels, review of what agents can read and send. I don’t know that number. I haven’t seen anyone publish it.

That’s the question I’d put to every team with an open-weights migration on the roadmap. If safeguards are a vendor service that open weights can’t carry, what does it cost to replace them, and has anyone on your team measured it?