# The State of Open Source AI 2026 — Mozilla ## 🗂️ Triage — annotated highlights surfaced > [!note]- Cross Reference > - **Harness lock-in forms even when the model is open** — the Terminal-Bench natural experiment shows lock-in arriving via harness-model co-optimization, not the weights. #xref > - **Portable write-permission is the unsolved gap** — authentication is solved (OAuth 2.1/PKCE, signed Agent Cards); authorization for irreversible writes is not. #xref > - **Closed ≠ secure** — four CVSS 9.3–9.4 incidents, all in closed systems, share a retrieval-checked/output-unchecked failure pattern. #xref ## 🧭 Bib capsule Mozilla (with SlashData), "The State of Open Source AI 2026" (Volume 1.0), July 2026 — https://stateofopensource.ai/state-of-open-source-ai-2026.pdf ## 🧠 Author's thesis (Adler Q1+Q2) Mozilla's inaugural assessment argues open-weight AI has closed the average capability gap to closed frontier models to 3.3% while getting 50× cheaper in 36 months, routing roughly a third of OpenRouter tokens and sustaining real revenue (Databricks, Mistral, DeepSeek). In detail, the report's central pivot is that the model layer is commoditizing toward zero while the competitive and lock-in battle has moved "one layer up" to the agentic harness — orchestration, memory, and especially portable write-permission — and it closes with five bets (build the open harness, own the memory, solve portable permission, break the meter, keep the open default plural) plus a watchlist naming what would reverse its own thesis. ## 🧩 Key arguments - The open gap is an ecosystem-maturity problem, not a resources problem: scale closes the deployment gap for closed models but not for open ones ("closed deployment is a problem money solves; open deployment is a problem the ecosystem has to finish"). - The harness — not the weights — drives agentic performance, and vendors internalizing their harness recreates lock-in even when the model is technically swappable. - Sovereignty, not ideology, drives adoption: self-hosted copies survive export-control cutoffs (Anthropic's 19-day outage) that API-dependent competitors cannot. ## 🗒️ Notes — Literature atoms ### Harness lock-in forms even when the model is open > [!quote] > A harness tuned tightly to one lab's weights degrades on anyone else's model. Lock-in arrives as a side effect of optimization — a moat in formation. - **Where**: Section 04, after the Terminal-Bench 2.0 → 2.1 comparison (21.8-point gap compressing to ~3 points in eight weeks) - **Why**: Reframes "open vs. closed" as a contest at the orchestration/tooling layer, not the weights — directly relevant to any agent-architecture decision. ### Portable write-permission is the ecosystem's unsolved gap > [!quote] > No portable standard defines which writes an agent can make unattended, across any boundary. MCP crossed 10,000 servers and 97M monthly downloads; ~21% of companies have mature governance. The plumbing scaled. The lock did not. - **Where**: Section 04/05, "Bet 3" — solve portable permission - **Why**: Distinguishes reversible reads (safe to permit by default) from costly irreversible writes as the security-critical surface. ### Closed-model security incidents show retrieval-checked, output-unchecked as the common failure pattern > [!quote] > Authorized retrieval reaching unauthorized recipients — secrecy of the weights did not prevent it. - **Where**: Section 04, after four named incidents (Anthropic Slack MCP, MS Copilot EchoLeak, Salesforce ForcedLeak, ServiceNow BodySnatcher), all closed systems - **Why**: A corrective to "closed = secure by default" — the failure mode is architectural (output not checked), not a function of open/closed weights. ## 🔖 Permanent candidates - **Vertical integration turns a swappable model into a rented product** — When a vendor controls both the model and the harness tuned to it, the model's technical swappability stops mattering because the harness becomes the actual point of lock-in. *(Likely already covered by an existing Permanent.)* ## Links - [[Open Source Governance MOC]] — home MOC; the report's five bets are fundamentally about keeping the open layer open, i.e., governance of the AI commons ("a commons with one supplier stops being a commons"). - [[The Harness Now Outpaces the Model as the Source of Agent Capability Gains]] — because it directly restates atom H1; this report is the strongest evidence for that claim. - [[A Standardized Harness Turns Model Access Into a Second-Sourceable Supply Decision]] — because it underpins the "break the meter" bet: a portable harness makes model access a supply choice, not a lock-in. - [[Local Models Are Sovereignty Insurance Against AI Access Cutoffs]] — because the 19-day Claude export-control outage is the report's clearest case that a running copy survives what an API cannot. ## ✅ Processing checklist - [x] Claim atoms carried from deep-read analysis - [ ] Permanent candidates reviewed for promotion - [ ] Version History Diff check