Now in 2026, almost everyone in the fight over AI training data agrees that building on someone else’s work without asking is theft. Artists are suing the large American labs for training on their published work, and those same labs, now backed by the US government, are moving against Chinese companies for training on the outputs of their models. The irony is hard to miss.
So what changed, that the accused are suddenly playing the victim?
What changed is that the open models caught up. For most of the modern LLM era, there was no serious open competitor. DeepSeek R1 ended that in early 2025, and the gap has been narrowing ever since. Zhipu’s GLM 5.2 and Moonshot’s Kimi K3, both released this summer, now sit within a few months of the closed frontier and outscore several of the paid models they are accused of copying. Both were published under permissive licenses, free to download, run, and modify.
That creates a commercial problem. Frontier models cost billions to build, financed against expected subscription and API revenue, so a free competitor of similar quality undercuts the price of everything the closed labs sell, and with it the projections that the funding rests on.
Copyright is only the public half of the case. The argument that actually keeps customers where they are is about data, and it is blunt: a Chinese model on your infrastructure is a Chinese pipe into your company- and customer data. The strongest version of that claim misunderstands what a model is.
Weights are inert. A file of parameters has no network stack and cannot send anything anywhere. What handles your data is the deployment around it: the inference server, the company operating it, and the jurisdiction that company sits in. So the same model behaves completely differently depending on who runs it. Sending prompts to Moonshot’s hosted API means sending them to a Beijing company operating under Chinese law, with everything that implies about state access. Sending the same prompts to a German provider running the same weights means sending them to a company bound by the GDPR, the BDSG, and the AI Act, where the model’s country of origin has no legal significance at all, because the operator is the data controller. Running it on your own hardware means the prompts go nowhere.
The obvious objection from anyone working in security is that data poisoning during training can install behavior that stays dormant until a specific trigger appears in the input, at which point the model’s alignment stops applying. The tempting response is to reach for Linus’s Law and say that open projects have many maintainers who find the problem sooner or later. That argument does not survive contact with the subject. Linus’s Law is about readable source code, where a malicious change is a diff a person can inspect and reason about. Nobody reads weights, and interpretability research is nowhere near the point where you could rule out a trigger you did not already know to look for.
The honest argument is not that open weights are safe, but that the risk is bounded, testable, and yours. The weights are a static artifact, so you can hash them, pin them, and evaluate the exact bytes you are serving, with no silent updates between testing and production. A triggered model still needs a channel to do real damage, which means egress filtering and tight scoping of tool permissions do a great deal of work here, particularly in agentic setups. An attacker also has to get the trigger into your input stream in the first place, which isn’t necessarily straightforward either.
For everyone outside the United States and China, this is the first real chance to cut dependency on a single vendor. That vendor sets the price, the terms, and the date your access ends. It is also the first time the legal path is open rather than contested. Distilling a closed model is the subject of this entire dispute. Distilling GLM 5.2 or Kimi K3 is not, because their licenses permit derivative work outright. European labs can generate training data from them, fine-tune on it, and ship the result commercially, with no terms of service to breach and nobody to sue them. Mistral, Teuken, and OpenGPT-X do not have to close the gap from scratch. They can start from the best open weights available and spend their far smaller budgets on what should actually differentiate them, rather than on catching up.
