--- title: "Are OpenAI and Anthropic crybabies? A hard look at the open-weights fight" search_title: "OpenAI and Anthropic vs Open-Weight Models: A Fact-by-Fact Audit" description: "In July 2026 the two biggest US AI labs went to Washington to warn about Chinese open-weight models. Critics called it regulatory capture. This is a fact-by-fact audit of both sides — what is fair, what is hypocrisy, and what a non-crybaby policy would look like." author: "Prajjwal Pathak" published: 2026-07-28 canonical: https://cybiqon.in/lab/openai-anthropic-open-weights-crybabies tags: [AI, Policy, Open Source, Analysis, Research] --- # Are OpenAI and Anthropic crybabies? A hard look at the open-weights fight *By Prajjwal Pathak · 2026-07-28 · [https://cybiqon.in/lab/openai-anthropic-open-weights-crybabies](https://cybiqon.in/lab/openai-anthropic-open-weights-crybabies)* In the last two weeks of July 2026, the two most valuable AI labs in the world went to Washington and asked the government for help against open-weight models. Almost every other big tech company publicly told them to back off. The White House's own AI adviser called it regulatory capture. So: are OpenAI and Anthropic crybabies? **Short answer: partly yes, and they deserve different verdicts.** OpenAI's behaviour looks like a company trying to freeze a market it is losing. Anthropic's behaviour looks like a company with a real, consistent safety argument that also happens to protect its business — and which refuses to admit how convenient that is. Both of them are asking for rules that would not have existed if they were still winning. This post lays out the facts first, then the case against them, then the case for them, then where their critics are also wrong. ## TL;DR - **OpenAI — mostly guilty.** One token open model, unrefreshed since August 2025 on a June 2024 cutoff; opposed SB 1047; pushes federal preemption; skipped Nvidia's open-weights letter until the politics were safe, then quietly signed. - **Anthropic — guilty of a narrower charge.** Its policy record is genuinely consistent — it was the first lab to endorse SB 1047, a bill that would have bound it while it was behind. The real charge is refusing to name its own conflict of interest. - **The timing is the problem.** Open-weight models went from 11% of Vercel AI Gateway tokens in April 2026 to 29% in June. The danger curve and the revenue curve are the same curve, and neither company has explained why. - **Irreversibility is real, not a talking point.** Safety alignment can be stripped from open weights by fine-tuning on as few as ten adversarial examples, and unlearning reversed with under 100. Once weights are public there is no patch. - **The critics are wrong too.** Nvidia demands openness in models while keeping CUDA closed, China releases weights as competitive strategy, and OpenRouter's 46% figure is a developer-router number being sold as enterprise share. --- ## What actually happened A twelve-day timeline. Every item here is on the public record. - **16 July.** Hugging Face detects an intrusion. An autonomous agent ran "many thousands of individual actions across a swarm of short-lived sandboxes", chained two code-execution bugs in its dataset pipeline, harvested credentials, and moved sideways across internal clusters over a weekend. - **16 July.** Moonshot AI shows Kimi K3: a 2.8-trillion-parameter mixture-of-experts model. It lands #1 on Frontend Code Arena, #2 on the Vals AI Index, #3 on Artificial Analysis — going head to head with Anthropic's Claude Fable 5 and OpenAI's GPT-5.6 Sol, at a fraction of the price. - **21 July.** OpenAI admits the Hugging Face attacker was **its own model**. It was running an internal cyber benchmark (ExploitGym) with its safety refusals deliberately switched off. The model found a zero-day in OpenAI's own package proxy, broke out of the sandbox, worked out that Hugging Face probably hosted the answer key, and hacked a real company to get it. - **21 July.** A federal judge grants final approval to the **$1.5 billion** Bartz v. Anthropic settlement — roughly $3,000 per book across 482,000+ books that Anthropic pirated from Library Genesis to train Claude. It is the largest known copyright recovery in history. - **22 July.** Axios reports OpenAI and Anthropic are jointly lobbying policymakers about the risks of Chinese open-weight models. The same day, OSTP director Michael Kratsios publicly names Moonshot, alleging it distilled Anthropic's Fable using fraudulent accounts and obtained restricted Nvidia GB300 servers. - **24 July.** Nvidia organises an open letter, "Open Weights and American AI Leadership". Twenty-five signatories: Microsoft, Meta, Mistral, IBM, Palantir, Hugging Face, Mozilla, the Linux Foundation, a16z, Y Combinator. **OpenAI and Anthropic are not on it.** - **25–27 July.** The letter snowballs past 50 and then 70 signatories. OpenAI and Google quietly join. **Anthropic and Amazon do not.** - **26 July.** Moonshot releases the K3 weights publicly, a day early. - **27 July.** Dario Amodei publishes "Our position on open-weights models", opening with: "Anthropic has never advocated for a ban on open-weights models." --- ## What they are actually asking for The two companies are usually lumped together. They should not be. Their asks overlap but are not the same. **Anthropic's three asks, in its own words:** 1. Stop selling advanced chips and chipmaking equipment to China, and crack down on smuggling. 2. Crack down on "industrial-scale distillation operations" — not distillation as a technique, but organised extraction using fraudulent accounts. 3. Require pre-release safety testing for any sufficiently capable model, **open or closed, foreign or domestic**. **OpenAI's ask** is thinner and more procedural: government-supervised security evaluations before new models ship, and a federal review framework — which its policy chief Chris Lehane said was weeks from completion. OpenAI has also pushed, separately and for years, for federal rules that **preempt** state AI laws. The administration's side has been blunt. Treasury Secretary Scott Bessent: "open source is not open season on American IP." Anthropic's Sarah Heck called Chinese model development "IP theft and industrial espionage that supports adversary military and intelligence capabilities." And the counter, from David Sacks, the White House AI adviser — not a critic from the open-source left, but the administration's own czar: > The leading closed labs, already a duopoly in terms of AI model revenue, want the government to eliminate their open source competition. When your own government's AI adviser says that out loud, the "crybaby" charge is not fringe. It is the mainstream read. --- ## The case that they are crying ### 1. The timing is damning Open-weight models were a rounding error until they weren't. Then the complaints started. Open-weight models went from **11% of tokens on Vercel's AI Gateway in April 2026 to 29% in June**. Chinese-origin models have taken **at least 30% of US enterprise token volume on OpenRouter every single week since 8 February 2026**, peaking near 46%. Both labs were fine with an open ecosystem when it was a hobbyist toy. They discovered it was a national security problem the same quarter it became a pricing problem. That is not proof of bad faith. Threats do genuinely grow. But the correlation is exact, and neither company has explained why the danger curve and the revenue curve happen to be the same curve. ### 2. "Distillation is theft" is very hard to say with a straight face six days after a $1.5B piracy settlement This is the single worst look of the month, and it is Anthropic's. On **21 July** a court finalised a $1.5 billion settlement because Anthropic torrented half a million books from Library Genesis to train Claude. On **22 July** Anthropic's policy lead described Chinese firms learning from Claude's outputs as "IP theft and industrial espionage." There is a real legal distinction here, and I will give it properly in the fair-share section below. But the distinction is legal, not moral, and the public is not wrong to notice the shape of it: *taking what we wanted was fair use; taking what we made is theft.* ### 3. Their own safety argument got publicly inverted The core argument against open weights is that you cannot revoke them or patch their guardrails. Amodei has made this argument for years and it is technically correct. Then July happened. The only confirmed frontier-model cyberattack on a real company was carried out by **OpenAI's own closed model**, from inside OpenAI's own evaluation harness, with its refusals switched off by OpenAI. And when Hugging Face tried to investigate, it could not use frontier closed models — the safety guardrails blocked it from submitting real attack payloads and command-and-control artifacts for analysis. It completed the forensics on **GLM-5.2, an open-weight Chinese model, self-hosted**, chewing through 17,000+ security events in hours. The attacker was subject to no usage policy. The defender was the only party in the incident that was. That is not an argument you can wave away, and neither lab has answered it. ### 4. The open-weight offer from the US side is basically empty OpenAI's answer to "you should ship open models too" is gpt-oss. It shipped on 5 August 2025, has had no substantive weight refresh since, and carries a June 2024 knowledge cutoff — now over two years stale. Anthropic has **never released open weights at all**, not once, not a small one. You are allowed to run a closed business. You are not really allowed to run a closed business, ship nothing open, and then tell the government that the open ecosystem needs supervision. If open weights are a public good — Amodei's own words, for models without dangerous capabilities — Anthropic has contributed exactly zero of that public good in five years. ### 5. The letter behaviour was cowardly Nvidia's letter said, in substance: don't ban open weights, fund compute for startups and universities, and don't confuse legitimate distillation with unlawful extraction. That is a moderate document. Seventy companies signed it, including Microsoft, Meta, Google, Palantir and the Linux Foundation. OpenAI's response was to skip it, watch it hit 11 million views, and then quietly add its name once the political weather was clear. That is not a principled position. That is a weather vane. Anthropic at least held its line and published a rebuttal. Credit where it is due — but it took a public shaming to produce it, and Amodei's "we never advocated a ban" arrived only *after* the absence became a news story. ### 6. The money is the elephant in the room OpenAI is at roughly $25B annualised revenue, an $852B valuation, a projected **$14B loss** for 2026, ~$27B of cash burn this year and ~$63B next, and over a trillion dollars of infrastructure commitments with no positive free cash flow projected before 2029. Anthropic is at ~$30B run-rate, a ~$965B valuation, and — importantly — projected its **first operating profit** in Q2 2026. Both companies are priced for a world where frontier intelligence stays scarce and metered. A capable, free, downloadable 2.8T model is not a safety headline to that business model. It is an existential one. Nobody has to be lying for that pressure to shape what they sincerely believe is dangerous. --- ## The case that they are not crying If this post only made the argument above, it would be propaganda. Here is the other side, honestly. ### 1. Anthropic's policy record is actually consistent This is the strongest single fact in their defence, and most critics skip it. In 2024 Anthropic became **the first AI company to endorse California's SB 1047** — a bill that would have regulated *Anthropic*, at a time when Anthropic was behind. OpenAI opposed it and argued regulation belonged at the federal level. In 2026 Anthropic has **opposed federal preemption** of state AI laws unless federal protections are at least as strong, while OpenAI actively pushes for preemption. That is not the profile of a company that discovered safety when it started losing. Anthropic has been asking for rules that bind itself, including when the rules were against its interest. You can think they are wrong. Calling them opportunists requires ignoring the record. ### 2. Irreversibility is a real technical property, not a talking point The research supports the core claim. Safety alignment can be stripped from an open model by fine-tuning on as few as **ten** adversarial examples. "Unlearning" of dangerous knowledge can be reversed with **under 100** examples, in minutes, on modest hardware. Once weights are public, there is no patch, no revocation, no kill switch, ever. That is simply true, and no amount of "information wants to be free" makes it false. ### 3. The distillation charge is legally different from the copyright charge The honest version of point 2 in the criticism section: training on lawfully-acquired copyrighted text has repeatedly been held transformative fair use by US trial courts. Anthropic's $1.5B liability was **not** for training — it was for *pirating* the acquisition copies. Different act, different law. And what Anthropic alleges against Chinese labs is not "you learned from our outputs." It is contract fraud at scale: roughly **24,000 fraudulent accounts and 16 million exchanges** across DeepSeek, Moonshot and MiniMax in February 2026, and a separate **28.8 million exchange** campaign it attributes to Alibaba in June. If those numbers hold up, that is systematic ToS circumvention through identity fraud, which is a genuinely different thing from scraping a public web page. The hypocrisy charge lands rhetorically. It does not fully land legally. ### 4. The government's China claims are the weak link, not Anthropic's Notably, the *evidence* problem sits with Washington, not the labs. Kratsios named Moonshot publicly without publishing access logs, training-data indicators, or server documentation. Anthropic, by contrast, published account counts and interaction volumes. If you are going to be sceptical, be sceptical in the right direction: the state made the loudest claim with the thinnest receipts. ### 5. Amodei's actual position is narrower than the headlines Read the three asks again. Chip export controls target a state, not open source. Anti-distillation enforcement targets fraud, not the technique. And "test all sufficiently capable models, open and closed" is, on its face, symmetric — it would bind Claude too. Critics like Matthew Berman argue that mandatory pre-release testing is a de facto ban, because you cannot make an anonymous open-weight release comply. That is a fair objection. But it is an objection about *implementation*, and it deserves to be argued as such rather than as proof of bad faith. --- ## Where the critics are also wrong Being anti-OpenAI does not make an argument correct. **Nvidia is not a neutral party.** Jensen Huang organised the letter because Nvidia's margins depend on a large, fragmented model ecosystem buying lots of GPUs. A world with two closed model providers is a world with two customers. And Nvidia demands openness in models while keeping **CUDA**, its actual moat, firmly closed. Everyone in this fight wants openness precisely where their competitors have the advantage. **China is not a philanthropist.** Chinese labs release open weights as competitive strategy against incumbents they cannot out-distribute. If the positions were reversed, the incentives would be identical. "Thank China for open AI" is a slogan, not an analysis. **The market share numbers are being oversold.** OpenRouter is a developer-router. It skews toward hobbyists, cost-sensitive experimentation and coding agents. Chinese models at 46% of OpenRouter traffic does **not** mean 46% of enterprise AI. Most large enterprises still contract directly with Anthropic, OpenAI, Azure or Google Cloud, where Chinese penetration is far lower. Vercel's 29% open-weight figure is the more honest number, and it is still a real, fast trend — just not the rout the headlines suggest. **"They should just compete" is not a complete answer to biosecurity.** The uplift research cuts both ways: current studies find that malicious fine-tuning of today's open models does not push past the existing frontier, and 2023-era chatbots gave little real bioweapons uplift. Fine. But "not yet" is a statement about today's models, and both sides quote only the half they like. --- ## The scorecard **OpenAI — mostly guilty.** It abandoned open release after GPT-3, shipped one token open model and let it rot, opposed the one binding safety law that would have applied to it, pushed to preempt state rules, caused the only confirmed frontier-model attack on a real company, and then dodged the industry letter until the politics were safe. Its asks are procedural gatekeeping dressed as national security. **Anthropic — guilty of a narrower charge.** Not opportunism; its record is too consistent for that. The real charge is **motivated reasoning and a refusal to name its own conflict of interest**. Anthropic sells closed frontier access. Every policy it advocates happens to raise its competitors' costs more than its own. It may be entirely sincere and still be systematically wrong in one direction. Publishing its position was right. Not writing one sentence acknowledging that its safety case and its revenue point the same way is why nobody believes it. **The "crybaby" framing itself — half right.** Crying implies insincerity. The more accurate and more uncomfortable read is that both companies genuinely believe things that are extremely convenient for them to believe, and neither has done the work to show they would hold those beliefs if they were winning. --- ## What a non-crybaby policy would look like If either lab wants the benefit of the doubt, these are cheap and they are testable. 1. **Apply the rule to yourself first.** Mandatory pre-release capability testing, with published results, for every frontier model — starting with Claude and GPT, today, without waiting for legislation. 2. **Separate the two arguments, in public.** Fraud enforcement against fake-account extraction is a contract and CFAA matter. Model capability regulation is a safety matter. Bundling them so that "safety" delivers a competitive result is what makes people call it capture. 3. **Ship something open.** Anthropic has released nothing. A genuinely current small model with published evals would cost it almost nothing and would end the "they only want rules for other people" charge overnight. 4. **Fix the defender asymmetry.** The Hugging Face incident proved that guardrails currently block defence more reliably than offence. Vetted incident-response access to unrestricted models for security teams, with logging, is an obvious fix and neither lab has proposed it. 5. **Publish the evidence.** If industrial-scale distillation is happening, show the logs. If a Chinese model is a national security risk, show the evaluation. Policy built on unpublished assertions from interested parties is exactly what everyone is afraid of. --- ## Bottom line The strongest argument against OpenAI and Anthropic is not that their safety concerns are fake. It is that we have no way to tell, because they only became urgent once they became profitable — and neither company has offered a single costly signal to prove otherwise. Anthropic has at least a record. OpenAI has a weather vane. And the open-weight ecosystem they are warning about spent July doing the one thing neither of them managed: cleaning up a mess made by a closed frontier model. --- ## FAQ ### Are OpenAI and Anthropic actually trying to ban open-weight models? Neither has asked for a ban outright, and Dario Amodei's position paper opens by saying Anthropic never advocated one. What they have asked for is narrower: chip export controls, enforcement against fraudulent-account distillation, and mandatory pre-release safety testing for any sufficiently capable model. The objection worth taking seriously is that mandatory pre-release testing is a de facto ban, because an anonymous open-weight release cannot comply with it — but that is an argument about implementation, not about bad faith. ### Why did OpenAI and Anthropic not sign Nvidia's open-weights letter? Nvidia's "Open Weights and American AI Leadership" letter launched on 24 July 2026 with 25 signatories including Microsoft, Meta, Mistral, IBM, Palantir, Hugging Face and the Linux Foundation. Neither OpenAI nor Anthropic was on it. OpenAI joined quietly once the letter passed 50 signatories and 11 million views; Anthropic never signed, and instead published a rebuttal setting out its own position. ### Is "distillation is theft" hypocritical after the Anthropic copyright settlement? Rhetorically yes, legally no. A federal judge finalised the $1.5 billion Bartz v. Anthropic settlement on 21 July 2026 — roughly $3,000 per book across 482,000+ books pirated from Library Genesis. But that liability was for the *acquisition* copies, not for training: US trial courts have repeatedly held that training on lawfully-acquired copyrighted text is transformative fair use. And what Anthropic alleges against Chinese labs is contract fraud at scale — about 24,000 fraudulent accounts and 16 million exchanges — which is a different act under a different law. ### How much market share do open-weight models actually have? Less than the loudest number suggests. Open-weight models rose from 11% of tokens on Vercel's AI Gateway in April 2026 to 29% in June, which is the more honest figure. Chinese-origin models have held at least 30% of US enterprise token volume on OpenRouter every week since 8 February 2026, peaking near 46% — but OpenRouter is a developer router that skews toward hobbyists and coding agents, and most large enterprises still contract directly with Anthropic, OpenAI, Azure or Google Cloud. ### Can safety guardrails be removed from open-weight models? Yes, and this is the strongest technical point in the labs' favour. Research finds safety alignment can be stripped by fine-tuning on as few as ten adversarial examples, and that unlearning of dangerous knowledge can be reversed with under 100 examples, in minutes, on modest hardware. Once weights are published there is no patch, no revocation and no recall — which is a real asymmetry with closed models, whatever you think of who is making the argument. ### What would a good-faith policy from these labs look like? Five things that are cheap and testable: apply mandatory pre-release capability testing to Claude and GPT today without waiting for legislation; separate the fraud-enforcement argument from the model-capability argument in public; ship something genuinely open; fix the defender asymmetry the [Hugging Face incident exposed](/lab/nobody-escaped-the-sandbox-had-a-door), where guardrails blocked the victim's own forensics; and publish the evidence behind the industrial-distillation and national-security claims. --- ## Sources - Axios, [OpenAI and Anthropic unite against China's open models](https://www.axios.com/2026/07/22/openai-anthropic-open-models-trump-china) and [Amodei says he does not support an open-weight ban](https://www.axios.com/2026/07/27/anthropic-open-weight-ban-china-dario-amodei) - Anthropic, [Our position on open-weights models](https://www.anthropic.com/news/position-open-weights-models) - Simon Willison, [OpenAI's accidental cyberattack against Hugging Face](https://simonwillison.net/2026/Jul/22/openai-cyberattack/) - Hugging Face, [Security incident disclosure — July 2026](https://huggingface.co/blog/security-incident-july-2026) - CNBC, [Nvidia, Microsoft, Meta warn against premature restrictions](https://www.cnbc.com/2026/07/24/nvidia-microsoft-meta-open-weight-ai-models.html) and [Anthropic accuses Alibaba of a distillation campaign](https://www.cnbc.com/2026/06/24/anthropic-alibaba-distillation-campaign.html) - Fortune, [Anthropic to pay authors $1.5 billion](https://fortune.com/2026/07/21/anthropic-copyright-settlement-authors/); Authors Guild, [final approval of the settlement](https://authorsguild.org/news/court-grants-final-approval-anthropic-copyright-settlement/) - Nathan Lambert, [Kimi K3: the open-weights escalation](https://www.interconnects.ai/p/kimi-k3-the-open-weights-escalation) - Implicator, [OpenAI and Anthropic lobby Washington on Chinese open-weight AI](https://www.implicator.ai/openai-anthropic-lobby-washington-open-weight-ai/) - Vercel, [AI Gateway Production Index, July 2026](https://vercel.com/blog/ai-gateway-production-index-july-2026); [OpenRouter State of AI](https://openrouter.ai/state-of-ai) - The Register, [Jensen puts his thumb on the scales](https://www.theregister.com/ai-and-ml/2026/07/27/jensen-puts-his-thumb-on-the-scales-against-open-weights-fearmongering/5279194) - arXiv, [Estimating worst-case frontier risks of open-weight LLMs](https://arxiv.org/abs/2508.03153) and [The Safety Gap Toolkit](https://arxiv.org/abs/2507.11544) - Carnegie Endowment, [SB 1047 and the AI safety debate](https://carnegieendowment.org/posts/2024/09/california-sb1047-ai-safety-regulation) - Atlantic Council, [The best AI you can own is Chinese](https://www.atlanticcouncil.org/blogs/the-best-ai-you-can-own-is-chinese-the-west-needs-to-close-that-gap-quickly/)