CNAS Insights | A Closing Door on Open Weights? Implications for AI Sovereignty

Earlier this month, Beijing announced draft export controls that signaled a potential shift in its longtime embrace of open-weight models. Foreign capitals and corporations should take notice. Many have embraced open-weight models as a partial solution for “AI sovereignty,” an ambition to balance control, dependency, and access to top capabilities from largely foreign companies.

The appeal of open-weight models is straightforward: their capabilities may lag the closed, U.S.-dominated frontier by a few months, but they still satisfy most use cases. Users can also download, customize, and locally host these models without fear their access will be cut off, as many experienced in June when Anthropic temporarily suspended access to its Claude Fable 5 model following a directive from Washington.

But building open-weight models does not necessarily free you from foreign dependency. Research from the Center for a New American Security’s Technology and National Security Program has found that many government-backed projects to build “sovereign” models are, in fact, built on open-weight models from mostly U.S. and Chinese technology companies. Adapting the best open-weight models for AI sovereignty remains a shrewd strategy—provided foreign technology companies continue to release them.

If current trends hold, the best open-weight models will soon match the capabilities of today’s already powerful closed frontier. Leading closed models can already execute multistep cyberattacks and discover and exploit vulnerabilities on their own. Anthropic assessed that its Claude Opus 5.5 model could uplift the development of known biological weapons. This is why closed-model developers embed multilayered safeguards to limit misuse and restrict a third party’s ability to independently host or customize their models. When unexpected and dangerous behaviors emerge, these safeguards give developers far more tools to claw back access and limit potential risk.

Open-weight models have no durable guardrails; they can be removed in hours for just a few thousand dollars. In recent months, new companies have emerged openly advertising “abliterated” models stripped of the guardrails that refuse tasks like offensive cyber. While this level of control and customization makes the best open-weight models appealing for AI sovereignty, it could also make them dangerous for national security.

Beijing is taking notice. Despite President Xi Jinping’s embrace of open-weight models in remarks at the World AI Conference earlier this July, the Chinese government has begun laying the groundwork for a more restrictive approach. On October 16, China’s Ministry of Commerce and Ministry of Science and Technology announced draft export controls for 40 different technologies. They included outright prohibitions on “AI-driven autonomous malware generation and mutation technologies, [which] could be used to attack sensitive systems,” and restrictions on future models above specific performance thresholds. The draft rules do not seem to affect China’s existing open-weight models, but the state appears to be preparing the ground to restrict future, more capable models as needed. The full implications of these draft controls for China’s vibrant open-weight ecosystem remain unclear, but they likely herald a shift toward a more regulated, security-oriented approach to model releases.

Those regulations could come soon. Analysis from Epoch AI found that China’s leading open-weight model, GLM-5.3, lags the U.S. frontier in cyber capabilities by just six to seven months. China is now reckoning with the likelihood that its technology companies could soon release models as capable as the current U.S. frontier, but with no reliable safeguards. Despite Beijing’s longtime support for state-affiliated hacker groups targeting other countries, the Chinese Communist Party is unlikely to welcome the diffusion of advanced cyber, biological, and other capabilities to nonstate actors beyond its grasp.

Beijing may shift before Washington, which seems unlikely to limit the diffusion of open-weight models anytime soon. The Trump administration largely views open models as a domain of competition, not a source of potential threat—moving to ban Chinese models like DeepSeek in government systems while permitting them in the private sector and promoting U.S. open-weight alternatives. Key voices in the administration view a vibrant open-weight ecosystem as a necessary check against the concentration of power in a few frontier labs. Many in the technology and developer community acknowledge the risk of highly capable open-weight models but see widespread diffusion as the best defense, enabling systems operators—who are often limited in routing sensitive traffic through an application programming interface (API)—to fine-tune, test, and harden their networks based on their specific needs. They also point to the role of open-weight models in quickly analyzing the cyberattack against Hugging Face by rogue agents from an internal OpenAI model.

This charged debate helps explain why, even as the Trump administration established a voluntary predeployment testing regime this June for models above a certain threshold of cyber capabilities, it exempted open-weight models. It’s unclear whether a different U.S. administration will maintain this policy, and a major incident tied to an open-weight model could spur changes even sooner.

In any event, foreign countries and companies can likely no longer count on the regular release of highly capable open-weight models for their AI sovereignty. Should Washington and Beijing both close the door on the release of top open-weight models, third countries will be forced to choose: remain frozen at a fixed level of AI capability as the United States and China progress with ever-improving closed models (potentially powered by recursive self-improvement), train their own frontier models from scratch, or partner with the U.S. and Chinese AI ecosystems. For most economies, the third option is the most viable, even if it forces them back into uncomfortable questions about how to balance capability, dependence, and control.

Foreign government and corporate leaders can prepare by mapping their critical AI applications to determine the level of model capability they actually require. Today’s subfrontier open-weight models already satisfy many existing, lower-stakes needs, such as automating office workflows, summarizing documents, and cleaning up data, and there is considerable work remaining to realize their full potential. Higher-stakes applications, such as cyber defense, intelligence, and advanced research and development, however, will likely benefit from improving capabilities at the closed frontier, and countries that cut themselves off from it risk becoming either AI laggards or passive consumers. Foreign capitals and corporate boardrooms must also move from high-level posturing about AI sovereignty toward hard choices about where in their stack they are prepared to build, buy, or partner, and clarify the specific “sovereign” conditions they can reasonably expect from foreign providers to access frontier capabilities.

The United States has a clear interest in helping its partners and allies navigate this choice strategically, and there are several steps it should take. Most importantly, Washington should develop frameworks to assure more reliable access to the U.S. frontier that enable the safe diffusion of American AI while mitigating the anxieties about “kill switches” and extraterritorial data access propelling the push for sovereign AI. It can make moonshot investments through programs like DARPA’s AI Forge to mature techniques that could someday make powerful open-weight models safer to release, such as filtering pretraining data to remove potentially dangerous knowledge or strengthening resistance to adversarial fine-tuning. Finally, it can adapt initiatives like the American AI Exports Program and AI Spark to help diffuse open-weight U.S. and allied models below the threshold for dangerous capabilities to outcompete Chinese alternatives.

It may be months, perhaps years, before the door closes on the release of top open-weight models. It may never fully close. But trends in open-weight model capabilities, and early signs of concern from Beijing, suggest that it would be wise to prepare for the possibility.

Vivek Chilukuri is director of the CNAS Technology and National Security Program