Research

Research · Enterprise AI

The open-weight inflection.

The last two months confirmed a five-month shift: Chinese models crossed U.S. models on OpenRouter after U.S.-firm share broke above 30% in February.

Executive summary

The last two months did not start the trend; they made it legible. The measured break began in February 2026. May through July supplied the confirmation: DeepSeek became OpenRouter's top model in mid-May, Chinese models crossed U.S. models in total platform share in early June, June's releases became enterprise defaults and public benchmarks, and the policy backlash widened by July.

The cleanest number comes from OpenRouter's telemetry, reported by CNBC in July. Every week since February 8, 2026, Chinese-origin models — overwhelmingly open-weight — have carried at least 30% of the tokens U.S. firms route through the platform, peaking at 46%. The average over the prior twelve months was 11%. In the first half of 2025 it was ~5%. This is the fastest verified shift in the adoption record this report tracks, and it is five months old, not two years.

The timing points to a release cadence rather than a single trigger. A January–February cluster — Moonshot's Kimi K2.5, Z.ai's GLM-5 (shipped inside the crossover week itself), and Alibaba's Qwen3.5 — preceded the first break. DeepSeek V4, released April 24 under an MIT license with a 1M-token context, drove a second wave; OpenRouter calls it "the first DeepSeek model sufficient for agentic workloads." June's GLM-5.2 and Kimi K2.7 Code supplied the last-two-month acceleration. The economics bind because agentic workloads multiply tokens per request roughly fifteen-fold, and Chinese open models run, in OpenRouter's words, "consistently 60% to 90% cheaper" than leading closed offerings. The Western open-weight frontier went quiet for the whole window — no Llama 5 exists (Meta's April flagship, Muse Spark, is closed), and OpenAI's gpt-oss has had no refresh since August 2025. The first Western frontier-scale answer arrived only this week: Thinking Machines Lab's open-weight, 975B-parameter Inkling, released July 15.

Postscript, July 17: Moonshot's Kimi K3 — launched July 16 at 2.8 trillion parameters with a 1M-token context — has turned that cadence into a frontier-performance claim. Arena's Frontend Code (WebDev) leaderboard lists it first at 1679, ahead of Claude Fable 5 at 1631 and GPT-5.6 Sol at 1618, a seventeen-place jump from Kimi K2.6. The caveats matter as much as the rank: the score is preliminary, K3 ranks ninth on Arena's main text leaderboard, Moonshot's own launch blog concedes overall performance "still trails" Claude Fable 5 and GPT-5.6 Sol, and the weights — promised "by July 27, 2026" — are not yet published, with no license announced. This report treats Kimi K3 as a launched frontier model with a pending open-weight release, not yet as downloadable open weights in production.

Enterprises are now in the record by name. Coinbase reportedly began defaulting its engineering organization to GLM 5.2 and Kimi K2.7 Code and cut AI spend nearly in half. Cursor's Composer 2 — deployed in more than half of the Fortune 500 — was built on a Kimi K2.5 base. Microsoft is evaluating a fine-tuned DeepSeek V4 as a lower-cost engine for Copilot Cowork. Snowflake's CEO published head-to-head benchmarks showing GLM-5.2 within a point of Claude Opus 4.7 on his team's coding tasks at a fraction of the cost. The startup Lindy moved 100% of its traffic from Claude to DeepSeek V4. AWS added six Chinese open-weight models to Bedrock in a single February announcement.

The honest counterweight: every enterprise procurement survey on record predates the inflection. Through November 2025, open-weight share of enterprise LLM usage was falling — 19% to 13% to 11% across Menlo Ventures' waves — and a16z's January 2026 pulse still found closed-source preference rising. Two reconciliations matter. Tokens are not dollars: at 60–90% discounts, a third of tokens is a far smaller share of spend. And platform mix matters: Vercel's gateway still routed roughly 87% of tokens to closed models as of April 2026. Whether procurement follows usage — the question this report's first edition posed on a multi-year clock — is now live on a quarterly one.

The risks have escalated in step. A joint House investigation covers both Airbnb's Qwen deployment and Cursor's Kimi lineage. Booz Allen reported persona-dependent vulnerability rates in Chinese coding models. China is reportedly weighing export restrictions on its own frontier models — a supply-side risk no adopter priced in a year ago. And hosting still determines privacy: the same open weights carry China-jurisdiction, training-by-default terms on the first-party API and stateless no-training guarantees on a hyperscaler (§10).

Key findings

1. The inflection is measured, recent, and sustained. Chinese-origin models have carried at least 30% of U.S. firms' OpenRouter tokens every week since February 8, 2026, peaking at 46% — versus an 11% trailing average and ~5% in H1 2025. Chinese models passed U.S. models in total platform share in early June. (OpenRouter telemetry via CNBC; OpenRouter, June 2026.)
2. Price is the clearest mechanism. Chinese open models run "consistently 60% to 90% cheaper" than leading closed offerings while agentic workloads burn roughly 15x the tokens per request. (OpenRouter, 2026.)
3. The acceleration sits inside a release cadence: Kimi K2.5 (January 27), GLM-5 (February 11 — inside the crossover week), Qwen3.5 (February 16), DeepSeek V4 (April 24, MIT, 1M context, agentic-grade), GLM-5.2 and Kimi K2.7 Code (June 12–13), then Kimi K3 (July 16, weights promised by July 27). DeepSeek alone doubled from 9% to 18% of platform tokens January–June. (Model cards; OpenRouter.)
4. Kimi K3 is the strongest new frontier signal, with caveats that matter. First on Arena's Frontend Code board at 1679 (preliminary), ahead of Claude Fable 5 and GPT-5.6 Sol — but ninth on Arena's main text board, weights unpublished until the promised July 27 release, license unannounced. (Arena, July 16; Moonshot.)
5. The Western open frontier went quiet — and is only now answering. No Llama 5 (Muse Spark is closed); no gpt-oss refresh since August 2025; Mistral was the West's principal open publisher until Thinking Machines released the 975B open-weight Inkling on July 15. (Meta; Mistral; TechCrunch.)
6. Named enterprise signals now span five adoption modes: reported gateway defaults (Coinbase), embedded open bases inside commercial products (Cursor, in over half the Fortune 500), hyperscaler product evaluation (Microsoft), public CEO benchmarking (Snowflake), and one full migration (Lindy, a startup).
7. Every procurement survey predates the inflection. Menlo's series fell 19% → 13% → 11% through November 2025; a16z's January 2026 pulse found closed preference still rising; ICONIQ's builder surveys point the other way (open-source adoption ~40% and rising among AI-product builders). Tokens ≠ dollars, and populations differ — both stories are currently true.
8. The capability gap is small and oscillating — 8.04% (January 2024) → 0.5% (August 2024) → 1.7% (February 2025) → rank tie (December 2025) → 3.3% (March 2026) on Chatbot Arena — and the K3 result shows task-specific rankings now flip model-by-model rather than by license category. (Stanford AI Index 2025/2026; HAI/DigiChina; Arena.)
9. The cost question has moved from "self-host vs. API" to "which API." Hosted open-weight endpoints run roughly $0.05–$1 per million tokens for most small and mid-sized models, against $2.50–$5 for standard closed flagships. Self-hosting breakevens are real but conditional on utilization and staffing.
10. Policy exposure cuts both directions. U.S. House probes cover Airbnb and Anysphere; Booz Allen found persona-dependent vulnerability behavior in Chinese coding models; China is reportedly weighing export limits on its own models. The ~1% Chinese share of U.S. enterprise API usage (November 2025) is the pre-inflection baseline this pressure acts on.
11. Open weights are not private inference. The same DeepSeek weights carry China-stored, training-by-default terms first-party but stateless no-training guarantees on Azure; mid-tier host guarantees range from contractual (Groq) to docs-only (Fireworks) to opt-in toggles (Together); hardware-attested confidential inference of open models is shipping (Tinfoil, Privatemode).

1. Introduction

"Open-weight" models — models whose parameters can be downloaded, self-hosted, fine-tuned, and redistributed under licenses of varying permissiveness — were supposed to commoditize the frontier. Through 2024 and 2025, each major open release (Llama 3, DeepSeek R1, Qwen 2.5 and 3, gpt-oss) was greeted as the moment open models would overtake closed "frontier" models (GPT, Claude, Gemini) in real deployments. The narrative is seductive because it rhymes with history: Linux against proprietary Unix, PostgreSQL against Oracle, Kubernetes against everything.

The measured reality is stranger than the narrative — and it changed shape recently. Through 2025, enterprises (the buyers with the strongest stated motives for open weights: sovereignty, customization, cost) were reducing their open-weight share while developers were increasing theirs. Then, beginning in February 2026, usage data inflected hard toward open models — at a speed the two-year record has no precedent for — and May–July made the shift visible through DeepSeek's top-model status, the China-over-U.S. OpenRouter crossover, and named enterprise signals. The geography underneath completed its shift at the same time: the open-weight frontier is now overwhelmingly Chinese, which converts a technology decision into a geopolitical one.

This report centers on that inflection (§5) and reads the 2024–2025 record as its baseline: survey data on procurement, telemetry on real token traffic, benchmark trajectories, deployment economics, named production case studies, and the regulatory dimension. It is written for CTOs, heads of AI platform, and technical decision-makers who need the numbers rather than the narrative. Our stance: we publish on open-source AI because we believe in it — which is exactly why the trade-offs are reported here with the same rigor as the advantages.

Two definitional notes. First, "open-weight" is not "open-source" in the OSI sense; most leading open models publish weights under restricted licenses without full training data or code. We use "open-weight" throughout except where a source says otherwise. Second, adoption is not one number: procurement share, token share, download share, and derivative-model counts measure different populations, and much of this report's argument turns on keeping them distinct.

2. Methodology

Findings in this report are limited to claims that survived a structured verification process: a five-angle source sweep and adversarial verification panel (July 10), a full re-fetch of every source against live pages (July 13), a dedicated 2026 research round covering named adoptions, post-November-2025 data, and the release timeline (July 14), and a final verification and freshness sweep (July 17). Claims that failed verification — including several widely circulated figures — are excluded and listed in §13. The numbered source list at the back is the public audit trail; the claim-by-claim log with access dates and verification method per claim is maintained alongside this report.

Conflicts of interest, disclosed. Menlo Ventures is an Anthropic investor, relevant to its finding that Anthropic leads enterprise share. a16z holds broad AI portfolio exposure and is an OpenRouter investor; the OpenRouter usage study's co-authors include OpenRouter's CEO and an a16z partner. Lenovo's TCO study favors the hardware it sells. The Goldman Sachs/Nomura/AT&T Llama attributions originate from Meta's own disclosure. We rely on these sources for their primary data — surveys, telemetry, legal text — not their editorial conclusions.

How to read the data in this report. The datasets measure different things and cannot be directly combined. Menlo and a16z figures are self-reported survey shares from U.S.-only samples (n = 150–600); the three Menlo waves differ in sample composition and shift between "usage," "workloads," and "spend," so the 19% → 13% → 11% series is directional rather than strictly comparable. OpenRouter token share is behavioral telemetry from a platform that skews toward cost-sensitive developers and startups, over half outside the U.S. Hugging Face downloads are a noisy proxy inflated by bot and CI traffic; derivative-model counts are a cleaner signal of fine-tuning activity. Chatbot Arena scores express human preference, not a capability ratio, and Stanford cautions that such leaderboards "are susceptible to leaderboard gaming and other hidden dynamics that can distort rankings." The divergence between the procurement surveys (§3) and the usage telemetry (§4–5) is partly a difference in populations measured. That is itself a finding, and §5.4 and §12 treat it as such.

3. Enterprise procurement: consolidation around closed providers.

Across three consecutive Menlo Ventures surveys, the open-weight share of enterprise LLM usage declined from 19% in late 2024 to 13% by mid-2025 and 11% by November 2025. The 19% baseline was itself roughly flat against 2023, so the decline is a post-2024 phenomenon. Menlo attributes it to two forces: Llama's stagnation — no major release after April 2025's Llama 4, which "underwhelmed in real-world settings" — and persistent enterprise caution toward Chinese open models.

The consolidation is provider-level, not just license-level. By November 2025, Anthropic (40%), OpenAI (27%), and Google (21%) together accounted for 88% of Menlo's enterprise LLM API market-share estimate. But the ranking within the trio has been violently unstable: OpenAI fell from 50% of enterprise share in 2023 to 27% by late 2025; Anthropic rose from 12% to 40%; Google climbed from 7% to 21%. An enterprise that single-sourced the 2023 leader spent two years on the wrong horse. Nothing in the data suggests 2025's ranking is more durable.

Within the open-weight remainder, Meta's Llama held 9% of enterprise usage at mid-2025, while DeepSeek — despite the highest-profile model launch of the year — held 1%. An a16z survey of 100 enterprise CIOs in May 2025 found 23% running OpenAI's o3 in production versus 3% for DeepSeek. And stated preference matched the usage data: a16z's January 2026 pulse of Global-2000 executives reports that "preference for using closed source models has increased steadily" since March 2024.

4. Developer infrastructure: open weights at one-third of routed tokens.

The a16z/OpenRouter study of 100 trillion tokens routed across 300+ models (November 2024–November 2025) shows open-weight models growing to approximately one-third of usage by late 2025, from roughly a tenth to a sixth at the window's start. Growth was led by reasoning-forward open models — DeepSeek (V3, then R1) and Kimi K2 — capturing share on what the study calls cost efficiency, transparency, and customization. The same study is explicit about the ceiling: proprietary systems "define the upper bound of reliability and performance, particularly for regulated or enterprise workloads."

Data note: the study states only the late-2025 endpoint; the starting share is our reading of its Figure 1. Non-Chinese proprietary models still averaged 70% of weekly tokens across the window.

Chinese open-weight models were the fastest-growing segment of that traffic: from a weekly share as low as 1.2% in late 2024 to peaks near 30% of total platform usage in some weeks of 2025, averaging 13.0% over the window.

The trend did not stop at the study window. By OpenRouter's own analysis of more than 450 trillion tokens routed between January and mid-June 2026, Chinese models surpassed American models in platform token share in early June 2026 — a sharp reversal from 2025, when U.S. models carried "about 3/4ths of the tokens." DeepSeek alone roughly doubled from 9% to 18% of platform tokens over that window and has fielded the platform's top model since mid-May. CNBC's reporting of the same telemetry extends the finding to American buyers: Chinese models' share of tokens routed by U.S. firms has held above 30% since early February 2026, peaking at 46% — versus an 11% average over the prior twelve months and just ~5% in the first half of 2025.

Data note: "Chinese-origin" is not a direct open-vs-closed split, though the high-volume Chinese models in this series are overwhelmingly open-weight. The latest primary open-vs-closed figure remains the late-2025 one-third. A widely circulated "18 trillion vs 5.5 trillion tokens per week" comparison failed our verification and is not used (§13).

Two scope cautions stand. OpenRouter is a routing marketplace that skews toward cost-sensitive developers, startups, and agentic workloads, over half outside the U.S. — it measures developer demand, not enterprise procurement, and direct OpenAI/Anthropic/Google API traffic is invisible to it. But as a leading indicator of where hands-on builders are voting with their tokens, its direction is unambiguous — and opposite to the procurement surveys in §3.

5. The inflection of 2026.

Everything in §3 and §4 describes the world through late 2025. What happened next compressed that two-year divergence into five months — and it is the reason this report exists in its present form.

5.1 The measured shift.

The cleanest series is the U.S.-firm cut of OpenRouter's telemetry, reported by CNBC in July 2026: Chinese-origin models have accounted for at least 30% of the tokens routed by U.S. firms every week since February 8, 2026, peaking at 46%. The averages before the break: 11% over the prior twelve months, ~5% in the first half of 2025. In the peak week, Chinese-origin models carried 46.4% of routed tokens against 35.7% for U.S.-origin models. And the platform itself scaled roughly fourfold year over year — Menlo Ventures put its run rate above a quadrillion tokens a year by May 2026 — so these are rising shares of a rapidly rising base.

~5% → 46%. Chinese models' share of tokens routed by U.S. firms through OpenRouter: H1 2025 average versus the 2026 peak week. Every week since February 8, 2026 has stayed above 30%. Source: OpenRouter telemetry, reported by CNBC, July 7, 2026.

5.2 What triggered it: a release cadence against expensive closed prices.

The crossover was not a DeepSeek event — DeepSeek's own platform share was falling, from roughly 10% to 5%, in February and March. The proximate trigger was a cluster of releases from three other Chinese labs: Moonshot's Kimi K2.5 (January 27), Z.ai's GLM-5 (February 11, MIT-licensed — shipped inside the crossover week itself), and Alibaba's Qwen3.5 family (mid-February, Apache 2.0). The backdrop made the cluster bind: closed flagship tiers remained expensive for high-token agentic work, while Chinese open models ran, per OpenRouter, "consistently 60% to 90% cheaper than the leading offerings from Anthropic and OpenAI." The workload mix amplified the price sensitivity: agentic workloads burn roughly fifteen times the tokens per request, so a per-token discount compounds into the dominant line item.

The second and third waves followed the same pattern and define the last-two-month trend. DeepSeek V4 — released April 24 under an MIT license, with a 1.6T-parameter Pro and a 285B Flash variant, both with 1M-token context — was, in OpenRouter's words, "the first DeepSeek model sufficient for agentic workloads"; its Flash variant costs $0.09/$0.18 per million tokens on the cheapest hosted endpoint. By June, DeepSeek had doubled to roughly 18% of platform tokens. June 12–13 brought Moonshot's Kimi K2.7 Code and Z.ai's GLM-5.2 (753B, MIT, 1M context; its model card advertises "no regional limits") — the latter recording the fastest adoption of any model Vercel tracked in 2026, with daily token volume up roughly 27x and customer count up roughly 80x in its first full week.

July added a fourth wave. On July 16, Moonshot launched Kimi K3 — 2.8 trillion parameters (mixture-of-experts), 1M-token context, API pricing of $3.00 input / $15.00 output per million tokens — and Arena's Frontend Code (WebDev) leaderboard, updated the same day, placed it first at 1679, above Claude Fable 5 at 1631 and GPT-5.6 Sol at 1618: a seventeen-place jump from Kimi K2.6's position. This is the report's strongest post-June frontier-performance signal, and its limits are as informative as the rank.

Data note on Kimi K3, current to July 17: the Arena score is preliminary (±17, on roughly 1,800 votes); K3 ranks ninth on Arena's main text leaderboard, and Moonshot's own launch blog concedes overall performance "still trails" Claude Fable 5 and GPT-5.6 Sol; the weights are promised "by July 27, 2026" but not yet published — no Hugging Face repository exists, no license has been announced (the K2 family used a modified MIT), and Arena labels the served endpoint proprietary. A frontend-coding lead by a served endpoint is not yet a downloadable open-weight lead.

Table 1: The 2026 open-weight release wave. Source: model cards, official repositories, and provider documentation; Arena leaderboard as of July 17, 2026. License details in the source list.

The Western side of the ledger is as important as the Chinese side: during the February–June window, no Western lab shipped an open-weight frontier flagship. There is no Llama 5 — Meta's April 2026 flagship, Muse Spark, is closed, ending the Llama open-release line for now. OpenAI's gpt-oss has had no refresh since August 2025. Mistral's Apache-2.0 Mistral 3 (December 2025) remained the newest Western open flagship. The first counter-moves are only now arriving: Thinking Machines Lab — the startup founded by former OpenAI CTO Mira Murati — released Inkling, an open-weight 975B-parameter model positioned as a fine-tuning base, on July 15, and Mistral's next open family is in partner early access with broader release promised for later this summer. Whatever one's view of the trust questions in §6 and §10, the 2026 inflection ran on models supplied almost entirely by China — and the Western response, as of this writing, is a week old.

5.3 The enterprise record, by name.

The February break produced a five-month adoption record; the last two months produced the most concrete named signals. They span distinct adoption modes:

• Gateway defaults (reported production). Coinbase reportedly began experimenting with engineering-wide defaults on GLM 5.2 and Kimi K2.7 Code, with AI spend cut nearly in half across roughly 1,200 agent-equivalents (§9).
• Embedded open bases inside commercial products. Cursor's Composer 2 — the coding model of a product deployed in more than half of the Fortune 500 — was built on a Kimi K2.5 base. "Yep, Composer 2 started from an open-source base!" per the company, which says about three-quarters of the final model's compute was its own training on top. Open weights can sit invisibly inside the products enterprises already buy.
• Hyperscaler product evaluation. Microsoft disclosed in June that it is evaluating a fine-tuned DeepSeek V4 "or another open-source model" as a lower-cost, Azure-hosted engine option for Copilot Cowork, its enterprise agent product.
• Public CEO benchmarking. Snowflake's CEO published a 103-task head-to-head in June: GLM-5.2 solved 66% versus Claude Opus 4.7's 67% at three attempts, at roughly one-fifth the list price. An evaluation, not a deployment — but a public-company software CEO treating a Chinese open model as production-viable, in public.
• Full migration (startup scale). Lindy switched 100% of its traffic from Claude to DeepSeek V4. "Saves us millions of $ and we're actually seeing an increase in performance on many core use cases," per its CEO, who framed the move as "a matter of survival" and remains willing to switch back "if the prices come down."
• Supply-side confirmation. AWS added six fully managed open-weight models to Bedrock in one February announcement — all six Chinese-origin — describing them as "frontier-class performance at significantly lower inference costs." Over 30% of the Fortune 500 maintain verified Hugging Face accounts — a sign of enterprise presence in the open-model ecosystem, not a deployment metric.

"Open source models run roughly 3 to 6 months behind the frontier but about 99% cheaper for inference." — Brian Armstrong, CEO, Coinbase, June 2026

The cost-pressure mechanism behind this is documented independently of any vendor. Uber exhausted its entire 2026 AI coding-tools budget by April — four months in — after agentic tooling spread to roughly 5,000 engineers, without (so far) adopting open-weight alternatives; its COO's complaint was that the spend-to-value link "is not there yet." That is the demand-side condition under which a 60–90% discount converts into the token shares of §5.1.

5.4 What the inflection has not yet shown.

Three disciplines keep this section honest. First, no public post-February general-enterprise procurement survey exists yet: Menlo's latest public wave closed in November 2025, a16z's in January 2026 — the survey record is structurally incapable of containing the inflection, in either direction. Second, tokens are not dollars: at 60–90% discounts, 30–46% of routed tokens implies a much smaller share of spend. Cheapness is the mechanism, so token share systematically overstates revenue share — and, symmetrically, spend surveys systematically understate workload share. Third, platform mix matters: on Vercel's AI Gateway, which skews toward product teams rather than cost-sensitive routing, closed U.S. models still carried roughly 87% of tokens as of April 2026. Among AI-product builders, ICONIQ's surveys suggest a different population pattern — open-source model adoption around 40% and rising in its Q2 2026 wave, with licensed frontier APIs declining — but that population is software companies building AI products, not general enterprises.

And the countervailing forces escalated in step with adoption. The House probe that began with Airbnb now jointly covers Anysphere's Kimi lineage, with committee letters demanding model-selection rationales. Booz Allen's May 2026 study of roughly 460,000 lines of generated code found Qwen3-Coder produced roughly 130% more vulnerabilities when prompted under a U.S.-government persona than under a neutral one — while also finding Kimi K2.5 had the lowest vulnerability rate of all models tested, including the closed baseline; the study "stops short of showing backdoors or deliberate insertion." And in July, Reuters-reported deliberations surfaced in which Chinese officials and labs weigh restricting foreign access to their frontier models — a supply-side risk that did not exist in any adopter's threat model a year ago. The inflection is real; so is the fact that it runs through exactly one country's model supply.

6. The ecosystem shifted to China.

Stanford HAI/DigiChina's December 2025 issue brief documents the shift with Hugging Face data: Alibaba's Qwen surpassed Meta's Llama as the most-downloaded LLM family in September 2025; Chinese open-model developers accounted for 17.1% of all Hugging Face downloads between August 2024 and August 2025, versus 15.8% for their U.S. counterparts; and in September 2025, 63% of that month's new fine-tuned or derivative models were built on Chinese base models. Download counts are noisy — bot and CI traffic inflate them — but derivative-model counts measure actual fine-tuning activity, which is precisely the customization channel that motivates open-weight adoption in the first place. Hugging Face's own Spring 2026 review extends the picture: Chinese models reached a 41% plurality of Hub downloads over the trailing year, China passed the U.S. in monthly and overall downloads, and Alibaba alone has more derivative models than Google and Meta combined.

Data note: the Stanford brief's download data comes via the ATOM Project; its derivative-model counts via the U.S. Center for AI Standards and Innovation.

The capability picture matches the activity picture. As of December 4, 2025, the best Chinese open models were effectively tied for first on Chatbot Arena with the top closed models from Google DeepMind, xAI, OpenAI, and Anthropic, and 22 releases from five Chinese labs outscored the top-ranked U.S. open model, OpenAI's gpt-oss-120b. The next visible turn came in coding: Arena's July 16, 2026 Frontend Code leaderboard placed Moonshot's Kimi K3 first, ahead of Claude Fable 5 and GPT-5.6 Sol — a preliminary score, and one that does not extend to Arena's main text board, where K3 ranks ninth. Because the weights and license remain unpublished until Moonshot's promised July 27 release, the result should be read as frontier evidence for the Chinese open-model pipeline, not yet as evidence that downloadable open weights have cleared the closed frontier.

For Western enterprises, this converts the open-weight question into a policy question. The models with the strongest open-weight benchmarks and the fastest ecosystem growth are Chinese; U.S. enterprise usage of Chinese open models was roughly 1% of LLM API traffic as of November 2025, and Menlo notes enterprises "remain particularly cautious towards Chinese open-source models, despite their impressive progress this year." The state and national DeepSeek restrictions of early 2025 were aimed at the Chinese-hosted app and API rather than the weights — though not every directive expressly exempts self-hosted deployments (§10) — and the political exposure extends further: Airbnb's use of Qwen drew a U.S. House probe even though the deployment does not send data to China, and the probe has since widened (§5.4, §9).

7. The capability gap: small, real, and unstable.

The open-vs-closed gap has oscillated rather than trended. On Chatbot Arena, the top closed model led the top open model by 8.04% in early January 2024; by August 2024 the lead had collapsed to 0.5%; it reopened to 1.70% by February 2025; in early December 2025 the leaderboard showed an effective rank tie between the best closed and best (Chinese) open models; and by March 2026 the closed lead stood at 3.3%, with six of the top ten Arena models closed. For scale: the same AI Index edition puts the top U.S. model just 2.7% ahead of the top Chinese model — the open-closed and U.S.-China gaps are now the same order of magnitude.

The practical reading for buyers is the oscillation itself. Twice in two years, the gap a procurement decision might have been anchored to — 8% in early 2024, near-zero in late 2025 — inverted within two quarters. A model strategy locked to a leaderboard snapshot will be wrong within quarters, in either direction. What the verified record does not support is a quantified "open models lag by N months" claim: the widely circulated Epoch AI lag estimates failed our verification and are deliberately not cited (§13). What does exist is a convergent practitioner characterization — OpenRouter's June 2026 analysis describes open-weight models as "maintaining a consistent 3-6 month gap for over 18 months," and Coinbase's CEO independently used the same figure. Treat these as informed industry estimates, not benchmark measurements.

8. The economics: breakeven is real, conditional, and often beside the point.

The most-cited academic treatment (arXiv:2509.18101) models on-premises deployment costs — GPU purchase plus electricity, at 8 hours a day, 20 days a month — against commercial API baselines. Its findings bracket the space: a small ~30B-class open model on a single ~$2,000 consumer GPU breaks even against premium closed APIs in 0.3–3 months; medium models take 3.8–34 months; large models range from 3.5 to 69.3 months, stretching to 5–9 years against low-priced API baselines. A vendor study from Lenovo — which includes maintenance, cooling, and colocation that the academic model omits, but sells the hardware it evaluates — lands directionally in the same place: on-prem breakeven "in as little as 4 months," with purchase beating cloud rental at roughly 4.3 hours a day of sustained utilization in one of its five-year configuration comparisons.

Data note: both estimates are floors. The academic model counts GPU purchase and electricity only — its authors list staffing and maintenance as future work — and assumes the hardware runs at full useful capacity, which real fleets rarely approach. Its API price baselines are stale in both directions: standard flagship closed models sat at $2.50–$5 per million input tokens as of mid-2026 (premium tiers above that), while hosted open-weight endpoints collapsed to roughly $0.14–$1 per million tokens for most small and mid-sized models.

That last number reframes the whole question. When a hosted open-weight endpoint costs one-tenth to one-thirtieth of a frontier API — with no hardware, no MLOps staffing, no utilization risk — the economic case for self-hosting no longer rests on beating APIs per token. It rests on sustained high utilization, data-control requirements that forbid any external endpoint, or fine-tuned models that hosted providers won't serve. Cost alone increasingly argues for open weights via someone else's infrastructure — which is exactly the pattern the OpenRouter traffic data shows (§4, §5). The 2026 releases pushed the floor lower still: DeepSeek V4 Flash runs $0.09/$0.18 per million tokens on the cheapest hosted endpoint, and DeepSeek's first-party cached-input rate is under a cent.

9. Who adopts open weights in production — and how.

The named, verifiable production deployments share one pattern: open-weight models earn specific slots inside multi-model architectures. Among enterprises, no verified case has replaced closed models entirely; the one full replacement on record (Lindy, below) is a startup, and its CEO reserves the right to switch back.

Airbnb — Qwen. Airbnb's AI customer-service agent runs on Alibaba's Qwen — "very good... fast and cheap," per CEO Brian Chesky in October 2025 — as one of 13 models the company uses alongside OpenAI and Google. The sequel is as instructive as the adoption: in April 2026 the House Homeland Security and Select Committee on China chairs opened a joint investigation covering Airbnb (and Anysphere, below), and by May Chesky was answering it publicly: "an open-source model does not have access to data. It doesn't work that way." The best-known Western enterprise deployment of a Chinese open model comes bundled with congressional scrutiny. (Verified: direct CEO quotes, multiple outlets.)

Perplexity — DeepSeek R1, self-hosted. Within days of R1's January 2025 release, Perplexity deployed it for Pro reasoning search — hosted entirely in U.S. and European data centers ("None of your data goes to China," per CEO Aravind Srinivas) — then published its own post-trained variant, R1 1776, on Hugging Face. This is the sovereignty argument executed in practice: weights downloaded, control retained, provenance concerns severed from the serving path. (Verified: company primary plus CEO statement.)

Goldman Sachs, Nomura, AT&T — Llama. According to Meta, as reported by Reuters in August 2024, Goldman Sachs, Nomura, AT&T, and DoorDash use Llama models for customer service, document review, and code generation; Goldman's GS AI Platform routes across OpenAI, Gemini, and Llama models depending on the task. (Medium strength: vendor-disclosed.)

Zoom — fine-tuned Llama in a federated stack. Zoom's AI Companion combines a ~2B-parameter small model of its own, fine-tuned Llama, and closed models, serving meeting summaries across 700,000+ enabled accounts as of August 2024. (Verified: company blog plus named executive quote.)

Orange — Llama + Whisper for African languages. Orange fine-tunes open models for Wolof and Pulaar — languages frontier APIs serve poorly — across an 18-country footprint, releasing the results for non-commercial use. This is the customization driver in its purest form: open weights doing what no closed API offers at any price. (Verified: press release plus Reuters.)

Coinbase — reported GLM 5.2 and Kimi K2.7 Code engineering defaults. In June 2026, Coinbase reportedly began "experimenting with defaulting" its engineering organization to two open-weight Chinese models — Z.ai's GLM 5.2 and Moonshot's Kimi K2.7 Code — routed through an internal LLM gateway. Trade-press and interview coverage attribute the shift, combined with routing and caching, to cutting Coinbase's AI spend nearly in half even as token usage kept growing across roughly 1,200 agent-equivalents; engineers can still opt into frontier models for hard reasoning tasks. This is internal engineering tooling, not the customer-facing exchange; the models are consumed as gateway defaults, and Coinbase has not said it self-hosts them. (Medium strength: CEO-attributed, syndication-verified; the primary X post could not be fetched directly.)

Cursor (Anysphere) — Composer 2 built on Kimi K2.5. Cursor's proprietary Composer 2 coding model was continued-pretrained and RL-trained on Moonshot's open-weight Kimi K2.5 — surfaced by an un-renamed internal model ID and confirmed by the company, which says roughly a quarter of the final model's compute came from the base. With Cursor deployed in more than half of the Fortune 500, this is the clearest instance of a distinct adoption mode: open weights consumed invisibly, inside a commercial product, by enterprises that never made an open-weight decision. It also carries the mode's distinct risk — Anysphere is now under the same House investigation as Airbnb. (Verified: company-confirmed.)

Lindy — full migration from Claude to DeepSeek V4. In June 2026 the AI-agent startup moved 100% of its traffic from Anthropic to DeepSeek V4 after six-plus months of evaluation: "Saves us millions of $ and we're actually seeing an increase in performance on many core use cases," per CEO Flo Crivello, who called the switch "a matter of survival" — AI costs had exceeded payroll — and remains open to reverting "if the prices come down." This is the only verified full replacement in the record, and its scale (a ~25-person company) and its conditionality are both part of the finding. (Verified: CEO primary post; startup scale.)

Adjacent on-device case: Microsoft Phi Silica. Microsoft ships Phi Silica, a 3.3B-parameter NPU-optimized derivative of the MIT-licensed Phi-3.5-mini family, on Copilot+ PCs; it powers Click to Do plus on-device Rewrite and Summarize in Word and Outlook. Not a peer case to the above — Phi Silica itself is not published as open weights, and Microsoft owns the model lineage — but it shows the on-device lane where local small models do jobs closed APIs cannot. (Verified: multiple Microsoft primary sources.)

Two absences round out the picture. We found no prominent enterprise that publicly reverted from open weights to closed APIs — a dedicated July 2026 search again found none; the nearest thing is Lindy's stated willingness to switch back on price. And the cautionary tale most often cited against building your own models is BloombergGPT, whose custom 50B model was outperformed on finance benchmarks by off-the-shelf GPT-4 and has had no publicly announced successor as of July 2026 — an argument against bespoke pretraining, not against fine-tuning open bases, which is where the ecosystem's energy visibly went (§6).

10. Security and sovereignty: open weights are not private inference.

The most persistent confusion in enterprise open-weight adoption is the assumption that an open model implies private inference. It does not. Downloadable weights say nothing about what a host does with your prompts — and since the economics increasingly push enterprises toward consuming open models through someone else's API (§8), the data terms of that host, not the license of the weights, determine your actual exposure. The same model can carry radically different terms depending on who serves it.

The first-party trap. DeepSeek's own API is the sharpest illustration. Its privacy policy states plainly: "we directly collect, process and store your Personal Data in People's Republic of China," and lists among its uses of your data "to train and improve our technology, such as our machine learning models" — training on by default, with an email-based opt-out and open-ended retention. The platform terms are governed by PRC law with disputes heard in Hangzhou courts. Meanwhile the identical open weights served through Azure AI Foundry come with the opposite terms: "Models are stateless, and they don't store any prompts or outputs," Microsoft acts as data processor, and prompts are neither shared with the model provider nor used to train anyone's models. Same model; different host; different jurisdiction, retention, and training posture. This is why the early-2025 regulatory wave — Italy's Garante blocking DeepSeek's processing of Italian users' data, Texas's state ban, Australia's government-wide directive — was aimed at the Chinese-hosted app and API rather than the weights, though the wording is not uniformly careful: Australia's direction covers "DeepSeek products, applications and web services" with no express carve-out for self-hosted deployments. And the risk is not hypothetical: Wiz Research found a publicly accessible DeepSeek database exposing "over a million lines of log streams containing chat history, secret keys, backend details" — proof that server-side chat logging existed, disclosed responsibly and promptly secured.

Read the contract, not the landing page. The independent inference tier is better than commonly assumed, but the guarantees live in documents of very different weight. Groq is the strongest of the mid-tier on paper: its services agreement — an actual contract — prohibits training on customer inputs and outputs unless the customer permits it, offers a zero-data-retention setting for eligible customers, and commits to 30-day post-termination deletion. Fireworks documents zero data retention by default, with prompts existing "only in volatile memory" and opt-in stored conversation data auto-deleted after 30 days — but that commitment lives in docs pages, not contract terms, and its data-handling page is silent on training. Together AI promises no training "without your explicit opt-in and consent," but retention is the default posture: zero data retention exists only as a toggle the customer must find in settings. A privacy policy can be revised unilaterally; a services agreement cannot. Enterprises should treat the distinction as load-bearing.

The hyperscaler baseline. AWS Bedrock and Azure AI Foundry set the standard any host of open models should be held to: content "not used to improve the base models and… not shared with any model providers," region-locked processing, and an architecture in which model providers have no access to logs, prompts, or completions — though contact and usage metadata may still be shared with model publishers. If a cheaper host cannot match that language in signed terms, the price difference is the cost of your data.

From promise to proof. Everything above is contractual — a promise you cannot verify. The frontier of this problem is attested confidential inference, where the guarantee is cryptographic. The hardware exists in production: NVIDIA's Hopper, Blackwell, and newer GPU generations run trusted execution environments with a remote attestation service, and Azure sells production confidential H100 VMs whose trusted execution environment spans the CPU and the attached GPU. On top of that hardware, attested open-weight inference is already shipping: Tinfoil serves open models (as of July 2026: GLM 5.2, Kimi K2.6, Gemma 4, gpt-oss-120b, Llama 3.3) inside AMD SEV-SNP plus GPU confidential-compute enclaves, with a client-side verification chain — hardware root certificates, Sigstore-pinned code measurements, TLS bound to the attested key — such that request data "is processed inside secure enclaves that even Tinfoil cannot access." Edgeless Systems' Privatemode offers the EU-hosted equivalent with reproducible builds and end-to-end attestation. Anthropic has published research in the same direction — explicitly a research sketch, not a product. One honest limit: attestation proves code identity and TEE configuration at a point in time. It does not prove what a provider does with billing metadata or future code updates — those remain contractual. Attestation narrows the trust gap; it does not eliminate it.

What to demand. The practical checklist for any hosted open-weight deployment: a no-training commitment in the services agreement, not just the privacy policy; zero data retention as default or contractually enabled, with deletion timelines; explicit jurisdiction and data-residency terms; and, for workloads where a promise is not enough, hardware-attested confidential inference with customer-verifiable attestation. Open weights make all of this possible — including the strongest option of all, self-hosting behind your own perimeter — but none of it automatic.

11. Regulation: the EU AI Act helps open models less than assumed.

The EU AI Act gives open models limited, conditional relief rather than a blanket carve-out. Under Article 53(2), providers of general-purpose AI models "released under a free and open-source licence" — with weights, architecture, and usage information publicly available — are exempt from the Act's technical-documentation and downstream-transparency duties. But the exemption has three hard edges:

• It "shall not apply to general-purpose AI models with systemic risks" — presumed above 10^25 training FLOPs. The frontier open models this report tracks are precisely the ones most likely to cross that line.
• Even exempt providers must still adopt an EU copyright-compliance policy and publish a training-data summary.
• Monetisation defeats it. Under the Act's Recital 103, as operationalized by the Commission's July 2025 guidelines, a model "provided against a price or otherwise monetised" falls outside the exemption. Dual licensing, paid support tiers, fee-based hosted access, and restricted commercial licenses (Llama-style) all put eligibility in question.

The dates matter for planning: GPAI obligations applied from 2 August 2025; Commission enforcement powers — fines up to 3% of global annual turnover or €15 million, whichever is higher — begin 2 August 2026; models placed on the market before August 2025 must comply by August 2027. And critically for enterprise readers: the exemption relieves providers' documentation duties. An enterprise deploying a model — open or closed — carries the same deployer obligations either way. Open weights are not a compliance shortcut.

On the demand side, sovereignty pressure in Europe is measured and rising, but its link to model choice is not yet evidenced. IDC finds European sovereign-cloud use rose from roughly 30% in 2023–24 to 40% in 2025, with extra-territorial data-request protection the top driver; a December 2025 European Commission study reports over half of developers regularly rely on open models and frames open-source AI as a sovereignty lever. But no credible survey isolates a regulatory effect on European enterprises' open-versus-closed choice — and the global survey evidence through early 2026 shows closed-model preference still rising. The honest conclusion: European regulation and sovereignty politics create favorable conditions for open-weight adoption; measured demand effects remain unproven.

12. Implications for enterprises.

The verified evidence maps cleanly onto a workload-level decision rule — the unit of decision is the workload, not the company:

Table 2: Workload-to-posture mapping. Rows are grounded in verified production deployments, primary sources, or explicitly labeled adjacent evidence.

Run a portfolio; assume rotation. Provider leadership rotated from OpenAI (50% in 2023) to Anthropic (40% in 2025) in two years, and the open-closed capability gap inverted twice in the same period. Multi-model portfolios are already the norm — 37% of enterprises ran five or more models in a16z's 2025 survey — and every verified production case in §9 is a portfolio. The architecture implication is unglamorous but decisive: routing and abstraction layers, plus continuous internal evals, are worth more than any single model choice. They convert rotation risk from a migration project into a config change.

Let open weights earn specific slots, not the whole stack. The verified pattern assigns open-weight models where their structural advantages bind: data that cannot leave (Perplexity's self-hosted R1), customization no API sells (Orange's Wolof models, Zoom's fine-tuned Llama), and cost-sensitive high-volume lanes (Airbnb's customer-service agent on "fast and cheap" Qwen). Reasoning-critical, regulated, or reliability-bounded workloads remain where even the pro-open-weight telemetry says proprietary systems "define the upper bound."

Do the TCO math with staffing in it — and check hosted open-weight endpoints first. Published breakevens (0.3–3 months for small models) exclude the operational costs that dominate real deployments. At roughly $0.14–$1 per million tokens for most small and mid-sized models, hosted open-weight endpoints deliver most of the cost benefit with none of the utilization risk; self-hosting pencils only with sustained high utilization or hard data-control requirements.

Buy privacy like an auditor: contract first, attestation where it matters. For hosted open-weight inference, demand the no-training and zero-retention commitments in the services agreement, not the privacy policy, with explicit jurisdiction and deletion terms; for workloads where a promise is not enough, use hardware-attested confidential inference or self-host (§10). The price gap between a host that will sign those terms and one that won't is the market price of your data.

Treat the China question as two-sided policy exposure, not a benchmark question. The best open models are Chinese, and the exposure now runs in both directions: U.S. scrutiny of adopters — the House investigation covers a deployer (Airbnb) and a company that merely built on an open Chinese base (Anysphere), and Booz Allen's persona-dependent vulnerability findings will be cited in every such probe — and Chinese supply risk, in the form of reported deliberations on restricting foreign access to frontier models. Enterprises adopting Chinese open weights should do so the Perplexity way: weights self-hosted or Western-hosted, provenance documented, pinned model versions retained locally, and a defensible one-sentence answer ready. Holding the weights yourself is the only mitigation that addresses both directions at once. Watch whether Western open-weight alternatives close the gap: as of December 2025, only one non-Chinese model besides gpt-oss-120b — Mistral Large 3 — featured among Arena's top 25 open models; no Western open-weight flagship shipped in H1 2026; the first re-entries are July's Thinking Machines Inkling and Mistral's early-access family, and Kimi K3's frontend-coding lead raised the bar again ahead of its promised July 27 weight release.

The leading indicator has now moved; watch the lagging one. Developer infrastructure absorbed open models first in every prior open-source wave, and in February–June 2026 it moved decisively (§5). The decision-relevant question has shortened from "will this ever reach enterprises" to "does the next procurement survey confirm it." The first post-inflection data points to watch: Menlo's next public enterprise wave, Microsoft's Copilot Cowork engine decision, and whether the >30% U.S.-firm token floor holds through H2 (§13). An enterprise that waits for survey confirmation will be roughly two quarters behind its own engineers.

13. Limitations and open questions.

Limitations. Every figure carries an as-of date, in a market moving double digits per quarter; the §5 inflection data runs only through early July 2026 and could look different by the time you read this. The Kimi K3 postscript is current to July 17, 2026: the frontend-coding leaderboard result is live but preliminary, K3 ranks ninth on Arena's main text board, and the weights and license remain unpublished pending Moonshot's promised July 27 release — every part of this should be re-verified at publication. The inflection evidence is concentrated in one platform's telemetry (OpenRouter, via its own blog and CNBC's reporting of its data); Vercel's contrasting gateway mix shows how much platform selection matters, and no post-February 2026 procurement survey exists yet in either direction. A few 2026 items rest on reputable syndication or partly gated primaries — Microsoft's Copilot Cowork evaluation (Axios), Booz Allen's methodology detail, ICONIQ's Q2 figures — and none of them carries a headline number alone. The survey base is U.S.-centric, and the three Menlo waves differ in sample composition and metric wording, so the 19% → 13% → 11% series is directional rather than strictly comparable; European and Asian enterprise procurement is not directly measured anywhere we could verify. The Arena gap series splices two report editions and indexes human preference, not capability. TCO breakevens exclude staffing and assume full utilization. Case-study strength varies and is labeled inline; the Goldman/Nomura/AT&T attributions originate from the vendor. Several sources carry disclosed conflicts of interest (§2).

Open questions for the next edition.

1. Does the first post-inflection procurement survey confirm the token data? No public Menlo mid-2026 wave was visible as of July 17, 2026; its next public enterprise wave remains the single most decision-relevant pending data point.
2. Does Microsoft ship Copilot Cowork on a fine-tuned DeepSeek V4? The decision was said to be weeks away as of mid-June; none had been announced as of July 17, 2026. A hyperscaler putting a Chinese open model inside a flagship enterprise product would be a categorical adoption event.
3. Does the >30% U.S.-firm token floor hold through H2 2026 — through both the House investigation's outcome and China's reported export deliberations?
4. Can Western open-weight models re-enter the frontier? Thinking Machines' Inkling (July 15) is the first live test; Mistral's next open family is in early access; no Llama 5 exists; gpt-oss is unrefreshed since August 2025. If Moonshot releases Kimi K3's full weights and license as promised by July 27, does U.S. policy pressure cap open-weight enterprise share regardless of capability?
5. Where is the all-in self-hosting crossover with staffing included? No verified study exists; this is a gap someone should fill with real fleet data.
6. Does the EU AI Act measurably shift European model choice once enforcement begins (August 2026)? Design: EU-segmented adoption survey, pre/post.
7. When will a primary source publish a true open-vs-closed (rather than Chinese-vs-U.S.) token split for 2026?

Refuted or unverifiable claims deliberately excluded (each failed verification): Epoch AI's "~3-month average lag" and "~7-point ECI gap" estimates; per-author OpenRouter token totals; the viral "18T vs 5.5T tokens/week" OpenRouter comparison; "Chinese models were ~61% of all OpenRouter tokens by May 2026" (contradicts the primary crossover timing); "Llama 5 released April 8, 2026" (that date is Meta's closed Muse Spark launch); an a16z "19%→11% of enterprise AI spend" figure that does not appear in the cited a16z survey (the 19→11 series is Menlo's); "DeepSeek has 26,000 enterprise API integrations" (aggregator-only). These exclusions matter because they were plausible enough to appear in search results and secondary coverage, but not strong enough to publish.

Sources

Numbered for reference; the claim-by-claim verification log with access dates and method per claim is maintained alongside this report. Sources were accessed 2026-07-10 through 2026-07-17; time-sensitive items are re-verified at publication.

1. 2025: The State of Generative AI in the Enterprise — Menlo Ventures, December 2025. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
2. 2025 Mid-Year LLM Market Update — Menlo Ventures, July 2025. https://menlovc.com/perspective/2025-mid-year-llm-market-update/
3. 2024: The State of Generative AI in the Enterprise — Menlo Ventures, November 2024. https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/
4. How Enterprises Are Adopting AI in 2025 — Andreessen Horowitz, May 2025. https://a16z.com/ai-enterprise-2025/
5. State of AI 2025: 100T token usage study — OpenRouter & a16z, December 2025. https://openrouter.ai/state-of-ai
6. Trends in AI usage — arXiv:2601.10088, January 2026. https://arxiv.org/html/2601.10088v1
7. Beyond DeepSeek: China's diverse open-weight AI ecosystem and its policy implications — Stanford HAI/DigiChina, December 2025. https://hai.stanford.edu/assets/files/hai-digichina-issue-brief-beyond-deepseek-chinas-diverse-open-weight-ai-ecosystem-policy-implications.pdf
8. AI Index Report 2026, Technical Performance — Stanford HAI, 2026. https://hai.stanford.edu/ai-index/2026-ai-index-report/technical-performance
9. AI Index Report 2025, Technical Performance — Stanford HAI, 2025. https://hai.stanford.edu/ai-index/2025-ai-index-report/technical-performance
10. Pan, Chodnekar, Roy & Wang — A Cost-Benefit Analysis of On-Premise Large Language Model Deployment, arXiv:2509.18101 (v3), November 2025. https://arxiv.org/abs/2509.18101
11. On-Premise vs Cloud Generative AI TCO, 2026 edition — Lenovo Press. https://lenovopress.lenovo.com/lp2368-on-premise-vs-cloud-generative-ai-total-cost-of-ownership-2026-edition
12. EU AI Act, Articles 2(12), 51, 53(2); Recitals 102–103 — consolidated text. https://artificialintelligenceact.eu/article/53/
13. Guidelines for providers of general-purpose AI models — European Commission, July 2025. https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
14. Europe's Open-Source AI Landscape — European Commission (DG CNECT), December 2025. https://digital-strategy.ec.europa.eu/en/library/europes-open-source-ai-landscape-lever-innovation-and-sovereignty
15. Sovereign Cloud in Europe — IDC Worldwide Digital Sovereignty Survey, 2025–2026. https://my.idc.com/getdoc.jsp?containerId=EUR154527926
16. Airbnb's use of Alibaba's Qwen — Bloomberg, October 21, 2025 and May 20, 2026 (quotes verified via CNBC and Forbes syndication). https://www.cnbc.com/2025/10/22/airbnb-chatgpt-ai-chesky.html
17. Open-sourcing R1 1776 — Perplexity AI, February 2025. https://huggingface.co/perplexity-ai/r1-1776
18. Meta says Llama AI models being used by banks, tech companies — Reuters, August 29, 2024; Goldman Sachs AI assistant coverage — CNBC, January 21, 2025. https://www.cnbc.com/2025/01/21/goldman-sachs-launches-ai-assistant.html
19. A federated AI approach to AI Companion — Zoom, 2024. https://www.zoom.com/en/blog/federated-ai-approach-best-quality-for-most-popular-features/
20. Orange to expand open-source AI models to African regional languages — Orange newsroom, November 26, 2024. https://newsroom.orange.com/orange-to-expand-open-source-ai-models-to-african-regional-languages-for-digital-inclusion/
21. Provider pricing pages: OpenAI (https://openai.com/api/pricing/), Anthropic (https://www.anthropic.com/pricing), DeepSeek (https://api-docs.deepseek.com/quick_start/pricing/), Together AI (https://www.together.ai/pricing).
22. Leaders, gainers, and unexpected winners in the enterprise AI arms race — Andreessen Horowitz, January 30, 2026. https://a16z.com/leaders-gainers-and-unexpected-winners-in-the-enterprise-ai-arms-race/
23. DeepSeek V4 Is Earning Agentic Token Share — OpenRouter, June 30, 2026. https://openrouter.ai/blog/insights/deepseek-v4-adoption/
24. Chinese AI models' surging U.S. adoption — CNBC, July 7, 2026 (quotes verified via syndication). https://www.cnbc.com/2026/07/07/chinese-ai-models-costs-us-openai-anthropic.html
25. Brian Armstrong on Coinbase's default models — X, June 2026; Sourcery interview, June 26, 2026; The New Stack, July 7, 2026. https://thenewstack.io/multi-model-ai-infrastructure/
26. Phi Silica: small but mighty on-device SLM — Microsoft Windows Experience Blog, December 6, 2024; Microsoft Learn. https://learn.microsoft.com/en-us/windows/ai/apis/phi-silica
27. DeepSeek privacy policy (February 2026) and Open Platform terms of service (April 2026). https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
28. Together AI privacy policy, December 2025. https://www.together.ai/privacy
29. Fireworks AI data handling documentation. https://docs.fireworks.ai/guides/security_compliance/data_handling
30. Groq services agreement. https://console.groq.com/docs/legal/services-agreement
31. Amazon Bedrock data protection — AWS FAQs and user guide. https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html
32. Data privacy for Azure AI Foundry model catalog — Microsoft Learn, January 2026. https://learn.microsoft.com/en-us/azure/ai-foundry/how-to/concept-data-privacy
33. Wiz Research uncovers exposed DeepSeek database — Wiz, January 29, 2025. https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak
34. Regulatory actions on DeepSeek: Garante (Italy, January 30, 2025); Texas Governor's office (January 31, 2025); Australia PSPF Direction 001-2025 (February 4, 2025). https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10097450
35. NVIDIA Confidential Computing; Azure NCC H100 v5 confidential GPU VMs. https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/
36. Tinfoil attestation architecture. https://docs.tinfoil.sh/verification/attestation-architecture
37. Privatemode by Edgeless Systems. https://www.privatemode.ai/
38. Confidential inference via trusted VMs — Anthropic research, June 18, 2025. https://www.anthropic.com/research/confidential-inference-trusted-vms
39. State of AI: Bi-Annual Snapshot, The Execution Era of AI — ICONIQ Capital, January 2026 (Q4 2025 survey, ~300 executives at AI-building software companies). https://www.iconiq.com/growth/reports/2026-state-of-ai-bi-annual-snapshot
40. State of AI: The Builder's Economy — ICONIQ Capital, July 2026 (Q2 2026 survey, ~305 executives; figures via SaaStr summary of the gated report). https://www.saastr.com/the-builders-economy-10-metrics-from-iconiqs-newest-2026-state-of-ai-report/
41. AI Gateway Production Index — Vercel, May 12, 2026. https://vercel.com/blog/ai-gateway-production-index
42. State of Open Source on Hugging Face: Spring 2026 — Hugging Face, March 17, 2026. https://huggingface.co/blog/huggingface/state-of-os-hf-spring-2026
43. The Open Weight Models that Matter: June 2026 — OpenRouter, June 27, 2026. https://openrouter.ai/blog/insights/the-open-weight-models-that-matter-june-2026/
44. DeepSeek-V4 model card (April 27, 2026) and launch announcement (April 24, 2026) — DeepSeek. https://api-docs.deepseek.com/news/news260424/
45. GLM-5.2 model card — Z.ai (Hugging Face, zai-org/GLM-5.2), June 2026; Z.ai pricing documentation. https://huggingface.co/zai-org/GLM-5.2
46. Kimi-K2.7-Code model card and license — Moonshot AI (Hugging Face), June 12, 2026. https://huggingface.co/moonshotai/Kimi-K2.7-Code
47. Western open-weight status: Mistral 3 announcement — Mistral AI, December 2, 2025. https://mistral.ai/news/mistral-3/ ; Meta Muse Spark as closed Llama successor, April 2026; July 2026 Mistral early-access coverage via TechTimes and trade press.
48. Lindy migrates 100% of traffic from Claude to DeepSeek V4 — Flo Crivello (X), June 2026; The Decoder, June 26, 2026. https://the-decoder.com/ai-startup-lindy-ditched-claude-entirely-for-deepseek-saving-millions-as-cost-pressure-mounts-on-anthropic/
49. Microsoft evaluating fine-tuned DeepSeek V4 for Copilot Cowork — Axios, June 16, 2026. https://www.axios.com/2026/06/16/microsoft-copilot-cowork-tokenmaxxing-cowork
50. Snowflake CEO benchmarks GLM-5.2 against Claude Opus 4.7 — Sridhar Ramaswamy (X), June 24, 2026; The Decoder. https://the-decoder.com/snowflake-ceo-finds-glm-5-2-competitive-with-opus-4-7-at-a-fraction-of-the-cost/
51. Cursor's Composer 2 built on Moonshot's Kimi K2.5 — TechCrunch, March 22, 2026. https://techcrunch.com/2026/03/22/cursor-admits-its-new-coding-model-was-built-on-top-of-moonshot-ais-kimi/
52. Joint House investigation into Airbnb and Anysphere over Chinese AI models — House Homeland Security and Select Committee on China, April 29, 2026. https://homeland.house.gov/2026/04/29/chairmen-garbarino-moolenaar-announce-joint-investigation-into-national-security-risks-posed-by-prc-ai-models/ ; https://chinaselectcommittee.house.gov/media/press-releases/chairmen-moolenaar-garbarino-announce-joint-investigation-into-airbnb-anysphere-and-the-national-security-risks-posed-by-chinese-ai-models
53. Amazon Bedrock adds support for six open-weight models — AWS What's New, February 10, 2026. https://aws.amazon.com/about-aws/whats-new/2026/02/amazon-bedrock-adds-support-six-open-weights-models/
54. What's in America's Code — Booz Allen Hamilton, June 5, 2026. https://www.boozallen.com/expertise/cybersecurity/whats-in-americas-code.html ; methodology detail via Help Net Security. https://www.helpnetsecurity.com/2026/06/09/chinese-ai-coding-models-security/
55. China weighs restricting foreign access to its AI models — Reuters-reported, July 7, 2026 (via san.com). https://san.com/cc/china-weighs-pulling-ai-models-as-us-reliance-comes-into-focus/
56. Uber's AI spending reality — Fortune (COO Andrew Macdonald interview), May 26, 2026. https://fortune.com/2026/05/26/uber-coo-ai-spending-tokens-claude-code/
57. OpenRouter now processes more than a quadrillion tokens a year — Menlo Ventures, May 26, 2026. https://menlovc.com/perspective/openrouter-now-processes-more-than-a-quadrillion-tokens-a-year/
58. Arena Frontend Code (WebDev) leaderboard — Arena, updated July 16, 2026; accessed July 17, 2026. https://arena.ai/leaderboard/code/webdev
59. Kimi K3 quickstart and launch blog — Moonshot AI / Kimi, accessed July 17, 2026. https://platform.kimi.ai/docs/guide/kimi-k3-quickstart ; https://kimi.com/blog/kimi-k3
60. Thinking Machines Lab releases Inkling, its first open model — TechCrunch, July 15, 2026; The Register, July 16, 2026. https://techcrunch.com/2026/07/15/thinking-machines-amps-up-its-bet-against-one-size-fits-all-ai-with-its-first-open-model-inkling/

About BasedAI.

BasedAI is the commercialization layer for open source AI, turning open models into production-ready products and enterprise APIs. BasedAI Research publishes evidence-first analysis of the open-source AI ecosystem for technical and business decision-makers; we publish on open-source AI because we build on it, which is why we report its trade-offs with the same rigor as its advantages.

---

BasedAI — Research.