The State of Open Source AI 2026  🔗 **Source:** [The State of Open Source AI 2026](https://stateofopensource.ai/state-of-open-source-ai-2026.pdf) > [!note]+ Document Notes > tags: [open-source-ai, ai-agents, llm-economics, ai-sovereignty, mcp-protocol] > author: Mozilla > source: Mozilla / SlashData > reference: https://stateofopensource.ai/state-of-open-source-ai-2026.pdf > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🏷️ Title: The State of Open Source AI 2026 — An Inaugural Mozilla Assessment > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ## 📝 Summary - **What happened**: Mozilla published its first "State of Open Source AI" report (Volume 1.0, July 2026), built on a Mozilla/SlashData developer survey (n=1,410–1,494), OpenRouter token data, LMSYS Chatbot Arena leaderboards, Epoch AI pricing data, Linux Foundation research, and public funding filings. The report argues open-weight AI has closed the capability gap with closed models to a 3.3% average (from 8.04% in early 2024), now routes roughly a third of all tokens on OpenRouter, and has become a real commercial layer (Databricks $5.4B revenue run-rate, Mistral $400M ARR, DeepSeek $220M ARR) — not a hobbyist project. - **Why it matters**: The report's central pivot is that the model layer is commoditizing toward zero price while the real competitive and lock-in battle has moved "one layer up" to the agentic harness (orchestration, memory, permissions, tooling) sitting above the model. It argues the harness — not the weights — is where open source is currently losing ground, because labs are vertically integrating their own scaffolds (Claude Code, Codex CLI) tuned tightly to their own models. - **Key stakeholders**: Mozilla (publisher, advocacy), SlashData (survey partner), foundation-model labs (DeepSeek, Meta, Mistral, Alibaba/Qwen, Anthropic, OpenAI, Google), enterprise adopters (Microsoft, Uber, Stripe, GEICO, 37signals), governments (China, EU, Canada, India, Saudi Arabia, South Korea, UAE), and infrastructure/tooling vendors (Hugging Face, LangChain, Mem0, Letta, MCP/A2A ecosystem). - **Risks and tradeoffs**: Open deployment lags open experimentation badly (89% of firms use open components, but only 51% of open models reach production vs. 63% for closed) — the report attributes this to an "operational gap" (standardization + enterprise readiness) rather than model quality. Separately, Chinese open-weight models dominate downloads and token share, raising sovereignty and training-data-opacity concerns even as enterprises adopt them anyway. The MCP protocol's adoption (97M monthly downloads) has drastically outpaced its governance (~21% of companies report mature agent governance; 30+ CVEs filed in eight weeks in early 2026). - **Bottom line**: Open-weight models are now competitive on raw capability and dramatically cheaper, but the contest has shifted to who controls the harness (orchestration, memory, and especially portable write-permission — the report's identified "unsolved gap"). Mozilla frames this as a closing window and proposes five concrete bets for actors who want the harness layer to stay open. ## 📖 Main Content The report is Mozilla's inaugural attempt at a systematic assessment of open-source/open-weight AI, structured in five numbered sections plus an appendix. It is a data-visualization-heavy document (charts, stat call-outs, timelines) rather than long-form prose — each "page" is essentially one argument backed by 2-4 sourced statistics. The Main Content below follows the report's own five-section structure. ### Section 01 — The current state (capability, cost, adoption) The report opens with four headline numbers: a 3.3-point capability gap to top closed models on Chatbot Arena; a 50× fall in inference cost in 36 months ($20 → $0.40 per million tokens); roughly a third of all OpenRouter tokens served by open weights by late 2025; and Mistral's ARR growing 20× in a year ($20M → $400M). It traces the closed-vs-open Arena gap through three phases: 8.04% (Jan 2024) → ~0.5% (Aug 2024, driven by improved open reasoning) → 3.3% (Mar 2026, as closed reasoning models pulled back ahead) — explicitly noting the average "hides a jagged frontier": open is at or near parity in coding, instruction-following, and general knowledge, while closed retains an edge in reasoning, long-context retrieval, and agentic tasks. On cost, the report compares the LLM inference price curve (50× drop, or 112× from GPT-4's original $45 launch price) against historical dot-com bandwidth (2.6×) and PC compute (3.4×) cost curves over equivalent 36-month windows — arguing AI inference is falling far faster than prior infrastructure shifts, with the single biggest driver being open-weight releases (Llama 3.1, then DeepSeek) crashing the "GPT-4-class" price floor 11× in one quarter. DeepSeek-R1 (Jan 2025, MIT license) is highlighted as matching OpenAI's o1-1217 on MATH-500 and AIME 2024 at roughly 1/27th the price. The adoption funnel section is one of the report's more sobering findings: 89% of firms use open components and 79% of developers use open models, but only 51% of open models reach production (vs. 63% for closed). Within that funnel, only 33% of internal builds reach production (vs. 67% for vendor-partnered deployments), and only 5% of enterprise pilots show measurable financial impact (Stanford 2026 Enterprise AI Playbook). A nine-layer, nine-criteria "stack maturity" scoring exercise (48 subcomponents, 1,361 projects graded 1-5) finds the open stack strong on community, ease of adoption, and production readiness, but consistently weak on standardization and enterprise readiness — "the operational gap" that repeats across every layer. Notably, scale does not close the open-deployment gap the way it does for closed models: enterprise-size firms reach 73% production for closed models but only 57% for open, versus small firms at 54%/53% — the report argues this proves the open gap is an ecosystem-maturity problem, not a resources problem ("closed deployment is a problem money solves; open deployment is a problem the ecosystem has to finish"). ### Section 02 — Who's betting on it (capital, companies, economics) This section establishes open weights as "a business model," not a subsidized experiment: Databricks ($5.4B revenue run-rate, >65% YoY growth, weighing a $165B+ valuation raise), Mistral ($400M ARR, talks at a €20B valuation), and DeepSeek ($220M ARR by mid-2025, raised $7.4B at $50B+ valuation) are presented as evidence of five proven revenue models — hosted inference, enterprise platforms, on-prem licensing, fine-tuning services, and harness tooling. Developers report running more average use cases on open models (5.1) than closed (4.6), and 78% pair specialized open models alongside general-purpose ones; open and closed are largely not substitutes — 50% of teams run both, 29% open-only, 21% closed-only. A funding landscape chart shows DeepSeek ($7.4B disclosed), Moonshot AI ($3.9B), Mistral ($3.05B), Reflection AI ($2.13B), and Cerebras ($2.1B) leading disclosed funding, with all six major hyperscalers (Microsoft, Amazon, NVIDIA, Google, IBM, Meta) invested in or shipping their own open-weight models. Consolidation is underway — CoreWeave/Weights & Biases ($1.7B), Databricks/MosaicML ($1.3B), Cohere/Aleph Alpha (~$20B enterprise value) among eight notable acquisitions 2023-2026. A "funding stack has holes" matrix scoring capital intensity (0-3) by layer and funding type finds foundation models, inference, and infrastructure well capitalized across private VC, government, and strategic corporate money — while data/datasets and safety/eval/governance run almost entirely on philanthropy and government funding alone, with near-zero private VC or revenue. Three enterprise case studies illustrate "the metered model breaks at scale": Microsoft cancelling most Claude Code licenses by June 30, 2026 after token billing consumed the division's annual AI budget in months; Uber exhausting its 2026 AI coding budget in four months (engineers billed $500-2,000/month before a $1,500/employee/tool cap); and Stripe cutting inference costs 73% by moving to open, self-hosted models on vLLM (serving 50M daily API calls on a third of its GPU fleet). The section closes noting open models capture ~20% of usage but only ~4% of revenue on OpenRouter — usage sits at the commoditizing layer while revenue accrues higher in the stack, with a Linux Foundation estimate of $24.8B in unrealized annual savings from the open-closed price asymmetry. ### Section 03 — Why it's happening everywhere (optionality, sovereignty, national strategy) This section reframes open-source adoption as "optionality, not ideology," drawing an explicit parallel to cloud repatriation (citing $90K-$120K AWS S3 egress penalties per petabyte, ~80% of enterprises repatriating some workloads per IDC, GEICO's 2.5x-over-expected cloud costs, and 37signals' projected 5-year savings after leaving cloud). A dramatic case study: Anthropic's Claude Fable 5 and Mythos 5 went dark globally for 19 days (Jun 12-30, 2026) after a US export-control order barred access by any foreign national, with no way to verify nationality in real time — illustrating that "you can switch off a model [via API]; you cannot switch off a copy already running on a machine you hold." The report documents China's open-weight dominance: Qwen (Alibaba) leads cumulative Hugging Face downloads at 942M vs. Llama's 476M, and Chinese open-weight models grew from <2% to 45%+ of OpenRouter token share in roughly 18 months, with 26,000+ DeepSeek enterprise accounts and presence in 58% of new 2025 AI-startup stacks — despite at least eight jurisdictions banning the hosted DeepSeek app outright. The report frames this proliferation as intentional Chinese industrial policy (the "AI Plus" directive and 15th Five-Year Plan), pairing semiconductor export controls as a macro hedge with releasing open weights to offload inference onto users' own hardware and drive global diversification away from US-stack dependency. Europe's response is tracked as an escalating policy sequence: France's €109B AI infrastructure commitment (Feb 2025), AI Act exemptions for qualified open-source systems (Aug 2025), the EUROPA award for a sovereign 400B-parameter open model across all 24 EU languages (Jun 2026), and Portugal/Germany shipping fully open sovereign models and platforms (Jul 2026) — quoting Ursula von der Leyen on not wanting dependency "for the technologies that keep our hospitals running." Canada ($890M sovereign AI supercomputer, PM Carney's "AI for All" initiative with an explicit Sovereign Foundation pillar) and India (38,231 subsidized GPUs at ~40% below market, ₹10,372 Cr IndiaAI Mission outlay, 5M+ new GitHub developers in 2025, 13.6% of DeepSeek's global MAUs) are presented as further sovereignty case studies. The section closes with a tally of 70+ national AI strategies and the largest disclosed national commitments — Saudi Arabia's Humain ($77B), South Korea's 5-year plan ($71.5B), UAE's G42-Microsoft deal ($15.2B) — alongside 47 nations now restricting foreign AI processing for critical workloads (OECD.AI). ### Section 04 — The harness is the new frontier (the layer above the model) This is the report's conceptual centerpiece. It frames the "agentic harness" (orchestration loop, tools, memory, sandboxes, permission model) as directly analogous to the web browser — "another user agent" negotiating with the world on the user's behalf, one layer above the model. It cites LangChain's 126,000+ GitHub stars and 60% orchestration developer share, and MCP's 97M monthly SDK downloads with 10,000+ active servers in its first year, while noting the market is already consolidating upward into unified "meta-harness" layers (e.g., Databricks' open-sourced Omnigent). A market map lays out the harness stack in five bands — Govern (stateful policy, registry/lineage, budget/revocation), Surface (interface, payment/metering), Action (sandboxes, permission/identity — "the unsolved gap," eval/observability), Reach (tools/context via MCP, agent-to-agent via A2A, memory via Mem0/Letta/Zep), and Control (the orchestration loop: LangGraph, CrewAI, AutoGen, LlamaIndex) — sitting above "the model" itself, which the report treats as commoditizing toward zero regardless of open/closed status. The report's sharpest evidence for lock-in forming at the harness layer: on Terminal-Bench 2.0 (May 2026), a third-party scaffold running Anthropic's own weights scored 79.8%, a 21.8-point lead over Claude Code running the identical weights (58.0%) — proving the harness, not the model, was driving performance. Eight weeks later, once labs pulled harness development in-house, that gap compressed to roughly 3 points (Codex CLI/GPT-5.5 at 83.4%, Claude Code/Fable 5 at 83.1%, best independent harness at 80.4%), and no open model appeared in the verified top tier. The report's interpretation: "a harness tuned tightly to one lab's weights degrades on anyone else's model. Lock-in arrives as a side effect of optimization." On a neutral scaffold (vals.ai Terminus-2), however, the price gap between open and closed reappears starkly — GLM 5.2 (open) scores within ~1 point of Claude Opus 4.8 at roughly 1/5th the per-task cost. MCP's growth (2M to 97M monthly downloads in 16 months, OAuth 2.1 added to spec by mid-2025, donated to the Linux Foundation's new Agentic AI Foundation in Dec 2025 alongside Block's goose and OpenAI's AGENTS.md) is presented alongside a governance warning: 30+ CVEs were filed against MCP in the first eight weeks of 2026, and only ~21% of companies report mature agent governance despite 150+ organizations running A2A in production. Four real-world "closed is not the same as secure" incidents are cited (Anthropic Slack MCP zero-click exfiltration, Microsoft Copilot "EchoLeak," Salesforce Agentforce "ForcedLeak," ServiceNow "BodySnatcher") — all CVSS 9.3-9.4, all in closed systems — to argue the security gap tracks who carries the operational burden (closed ships safeguards by default; open makes you wire them in yourself), not an inherent open-vs-closed security property. The report is candid that closed models still lead on agentic-terminal depth (82.0% vs. 67.9% on Terminal-Bench 2.0), long-context fidelity at 1M tokens (Gemini 3 at 89% vs. DeepSeek V4-Pro at 41%), and turnkey compliance (SOC 2/HIPAA/ZDR), noting DeepSeek scores an F (0.37/4) on the FLI AI Safety Index. The section's final argument is that "the model is interchangeable; the memory is the asset" — memory compounds in value over time in a portable, append-only, firewall-side store, while the model itself commoditizes and can be swapped or deprecated by its vendor. It identifies "portable permission" — specifically write-permission (irreversible actions: sending messages, spending budget, executing transactions) as opposed to reads — as the ecosystem's central unsolved gap: zero portable write-permission standards exist across the ecosystem's 12 frameworks, 10 harnesses, and 3 peer protocols; MCP and A2A have solved authentication (OAuth 2.1 + PKCE, signed Agent Cards) but not authorization; and CoSAI ranks "consent fatigue" as the top-tier threat, since users habitually approve prompts including the ones that matter. ### Section 05 — Five bets (where to act while the layer is still open) The report closes with five concrete recommendations, each framed with "the data / the clock / standing still" (i.e., evidence, urgency, and cost of inaction): 1. **Build the open harness** — co-designed with open weights, general-purpose or vertical, before closed stacks weld model and scaffold into one rented product. 2. **Own the memory** — hold it in portable, append-only formats behind your own firewall before the model commoditizes around a vendor-held record (citing Mem0's 47,000+ GitHub stars, plus Letta, Zep, LangMem). 3. **Solve portable permission** — standardize the write surface across boundaries before closed platforms define permission and identity first and enclose the position. 4. **Break the meter** — second-source now, drawing the analogy to Uber's ~92% fare increase once riders were locked in; self-hosting breaks even above ~8,000 conversations/day, and introductory metered pricing is expected to end around 2027-28. 5. **Make the open default plural** — fund a plural ecosystem so no single supplier (currently trending toward Qwen/Chinese-origin dominance) becomes the de facto open default, since a commons with one supplier "stops being a commons." A closing "watchlist" table tracks four lanes (capability & adoption, the harness, market structure, trust & safety) with explicit conditions that would reverse the report's read — e.g., token share stalling while the reasoning gap widens, a closed platform setting the permission standard first, sovereign funding lapsing, or a shift from "monitor" to "restrict" on misuse capability. The report explicitly caveats that "open is necessary, not sufficient" — it still requires hard friction where harm concentrates (specifically flagging synthetic CSAM/NCII), and that owning the engine "settles who captures the gains, not who owns the data." ### Appendix — Methodology Covered in full under the dedicated Methodology section below. ## 🗒️ Notes Dense reference notes, organized by recurring data points and their exact source attributions (this is a chart-and-statistic-driven report, not a transcript, so no timestamp subheadings apply): - **Capability gap timeline**: 8.04% (Jan 2024) → ~0.5% (Aug 2024, DeepSeek-R1 matches top model) → ~0% (Feb 2025) → 3.3% (Mar 2026, reasoning models pull ahead). Source: LMSYS Chatbot Arena. Six of the top ten Arena slots are now closed models. - **Cost curve comparison methodology**: uses the a16z "LLMflation" method (cheapest model at or above GPT-4-class MMLU, blended input/output list price). Nov '22 anchor point = text-davinci-003 (pre-GPT-4 frontier model). Compares against historic dot-com bandwidth and PC-compute cost curves (Meeker/KPCB 2014 rates) over equivalent 36-month windows. - **OpenRouter token share**: ~2% (Nov 2024) → ~26% → ~33% (Jun 2026, "still climbing"). Top 5 models by June 2026 volume are all open weight: DeepSeek V4 Flash (18.4T tokens, ↑95% MoM), MiMo-V2.5/Xiaomi (14.9T, ↑>999%), Hy3 preview/Tencent (14.8T, ↑67%), MiniMax M3 (14.3T, new), Owl Alpha/OpenRouter stealth (11T, ↑200%, later identified as Meituan's LongCat-2.0). - **Requests vs. tokens split**: open leads tokens >3.5:1 (~82T open Chinese-built vs. ~23T closed US-built among top 9 models), but closed still leads by request count (Google alone 28.7% of requests; Anthropic+OpenAI ~20%). Both figures exclude first-party usage (ChatGPT, Gemini, Doubao). - **Adoption funnel figures**: 89% of firms use open components (Linux Foundation); 79% of developers use open models, 51% reach production, 63% for closed (Mozilla/SlashData n=1,494); 67% of vendor-partnered deployments reach production vs. 33% of internal builds (MIT NANDA 2025); only 5% of enterprise pilots show measurable financial impact (Stanford 2026 Enterprise AI Playbook). - **Stack maturity heat map**: 48 subcomponents across 9 layers, scored 1-5 on 9 criteria, "with AI assistance for consistency" across 1,361 projects — an original Mozilla assessment, explicitly directional/ordinal rather than a measurement. - **Terminal-Bench harness finding**: 2.0 (May 2026) — third-party scaffold on Anthropic weights 79.8% vs. Claude Code same weights 58.0% (21.8-point gap). 2.1 (eight weeks later) — Codex CLI/GPT-5.5 83.4%, Claude Code/Fable 5 83.1%, best independent harness on Fable weights 80.4% (gap compressed to ~3 points). No open model in the verified top tier either time. - **MCP growth and governance tension**: ~2M (Nov 2024 launch) → 8M+ (Mar 2025, OpenAI adopts) → ~97M (by Mar 2026). 28% of Fortune 500 running MCP in production by Mar 2026. 30+ CVEs filed in first eight weeks of 2026. Donated to Linux Foundation's Agentic AI Foundation Dec 2025 (platinum members: AWS, Google, Microsoft, OpenAI), alongside Block's goose and OpenAI's AGENTS.md. - **Security incident list** (all closed systems, all CVSS 9.3-9.4 per Okta 2026 CVE analysis): Anthropic Slack MCP (Jul 2025, zero-click exfiltration via link unfurling), Microsoft Copilot "EchoLeak" (Jun 2025), Salesforce Agentforce "ForcedLeak" (Sep 2025, a $5 expired domain became a trusted exfiltration channel), ServiceNow "BodySnatcher" (Oct 2025, MFA bypass via impersonation). - **19-day Claude outage timeline**: Jun 9, 2026 Fable 5/Mythos 5 ship → Jun 12 Commerce export controls apply immediately, barring any foreign national (including Anthropic's own staff) with no real-time nationality verification, so both models go dark globally → Jun 26 partial clearance (Mythos to ~100 vetted US critical-infrastructure orgs) → Jun 30 controls lifted → Jul 1 Fable 5 restored globally. - **National sovereignty commitments**: France €109B (Feb 2025); EU EUROPA 400B-parameter model across 24 languages (Jun 2026); Canada $890M sovereign supercomputer + "AI for All" (Jun 2026); India 38,231 subsidized GPUs + ₹10,372 Cr IndiaAI Mission; Saudi Arabia Humain $77B; South Korea $71.5B 5-year plan; UAE G42-Microsoft $15.2B. 70+ national AI strategies logged; 47 nations restrict foreign AI processing for critical workloads (OECD.AI); 12 new national strategies logged in 2024 alone (Oxford Insights). - **Funding census**: DeepSeek $7.4B disclosed, Moonshot AI $3.9B, Mistral $3.05B, Reflection AI $2.13B, Cerebras $2.1B, Cohere $1.7B, Together AI $1.334B — census runs to 18 June 2026, cash/debt/grants/quantified in-kind only (excludes valuations, ARR, market cap). - **Enterprise metered-pricing collisions**: Microsoft cancelling most Claude Code licenses by Jun 30, 2026; Uber's 2026 AI coding budget exhausted in 4 months (engineers billed $500-2,000/month before a $1,500/tool/employee cap); Stripe cut inference costs 73% via open self-hosted models on vLLM, serving 50M daily API calls on 1/3 of its GPU fleet. ## 📚 References - [State of Open Source AI 2026 PDF (primary source)](https://stateofopensource.ai/state-of-open-source-ai-2026.pdf) - [Mozilla](https://www.mozilla.org) — publisher - [SlashData](https://www.slashdata.co) — survey design and fieldwork partner (State of AI Models 2026 survey, n=1,494, fielded 19-29 May 2026) - LMSYS Chatbot Arena — capability leaderboards - OpenRouter — token volume and market-share panels (100T-token study, Nov 2024-Nov 2025; live leaderboard H1 2026) - Epoch AI — LLM Inference Price Trends (2025) - Stanford HAI — 2026 Enterprise AI Playbook - MIT NANDA — 2025 deployment-funnel research - Linux Foundation — Nagle-Yue study on open/closed usage-vs-revenue split; Agentic AI Foundation (AAIF) governance - Hugging Face — cumulative model download counts - Terminal-Bench (2.0 / 2.1 leaderboards); vals.ai Terminus-2 neutral-scaffold benchmark run - FLI AI Safety Index - Okta 2026 CVE analysis; NTIA - OECD.AI; Oxford Insights — national AI strategy trackers - IDC (cloud repatriation data); 37signals; GEICO public reporting - DeepSeek-R1 technical report; OpenAI o1 documentation - a16z "LLMflation" methodology (Nov 2024) - Government of Canada, "AI for All" (Jun 4, 2026); Cohere announcements - IndiaAI Mission; GitHub Octoverse 2025 ## 🗣️ Paraphrase - Paragraph A: Open-weight AI models have gone from a clearly inferior fallback in 2023 to near-parity with the best closed models by early 2026, and they've done it while getting radically cheaper — inference costs fell 50-fold in three years, faster than any prior computing cost curve. Open weights now carry roughly a third of all traffic on the largest model marketplace, and companies built purely on open models (DeepSeek, Mistral, Databricks) have real, fast-growing revenue. But raw model quality was never really the obstacle to enterprise adoption — plenty of firms experiment with open models, far fewer get them into production, and that gap doesn't close just by having more money or people, the way it does for closed-model deployments. - Paragraph B: The actual fight has moved one level up, to the "harness" — the orchestration code, memory, tools, and permissions layer that turns a raw model into a working agent. The big labs proved they can make their own harness dramatically better than any independent tool built on their models, which quietly recreates lock-in even when the underlying model is technically swappable. The one part of this stack nobody has cracked yet — for either side — is how an agent gets permission to take real, irreversible actions across different tools and companies. Mozilla's pitch is that this permission layer, plus who owns your accumulated agent memory, are the two places worth fighting to keep open before the window closes. ## 📰 Newsletter Mozilla just dropped its first "State of Open Source AI" report, and it's a genuinely useful reality check if you've been running on 2023-era assumptions about open models being the also-ran option. The headline: the capability gap to closed frontier models is down to 3.3% on average (and near-zero on coding and instruction-following), inference costs have fallen 50x in three years, and open weights now carry about a third of all tokens on OpenRouter. This isn't a hobbyist scene anymore — Databricks is running a $5.4B revenue rate, Mistral's ARR grew 20x in a year, and DeepSeek pulled in $220M in ARR on the back of a $7.4B raise. The part worth sitting with if you're building anything agentic: Mozilla's argument is that the model layer is becoming a commodity and the real contest has moved to the "harness" — the orchestration/memory/permissions layer above the model, the same way the browser sat above the raw internet protocol stack. They show a striking benchmark result where a lab's own coding tool (Claude Code) started out 22 points behind a third-party scaffold on the exact same weights, then closed that gap to about 3 points in eight weeks once the lab brought harness development in-house — which is lock-in forming in real time, independent of the model underneath. Their conclusion: the one piece of this stack nobody has standardized yet is how an agent gets permission to take real, consequential actions (send a message, spend a budget, modify a record) across tool boundaries — and whoever solves that owns the security argument currently used to justify staying closed. Also worth flagging for anyone doing docs, developer relations, or governance work: MCP went from 2 million to 97 million monthly downloads in 16 months, but adoption of proper agent governance (mature permissioning, revocation, audit) is sitting around 21% of companies — and 30+ CVEs got filed against the MCP ecosystem in just the first eight weeks of 2026. That's a live "we scaled the plumbing faster than the locks" situation worth watching if your team is standing up MCP servers or agent tooling right now. ## ✅ Action Items #### DevRel - Developer advocacy: build talks/demos contrasting the Terminal-Bench "harness lock-in" finding (21.8-point gap collapsing to ~3 once labs internalized their harness) — concrete, benchmarked material for why teams should evaluate harness choice as carefully as model choice. - Education: workshops on MCP/A2A security hardening given the 30+ CVEs in eight weeks stat; pair with the four cited incident case studies (EchoLeak, ForcedLeak, BodySnatcher, Slack MCP exfiltration). - Developer experience: quickstarts that demonstrate self-hosting break-even math (~8,000 conversations/day) so teams can model their own open-vs-metered tradeoff instead of taking the report's number on faith. - Developer marketing: content addressing the "what changed since you tried it in 2023" framing directly — this is a reusable narrative hook for re-engaging developers who wrote off open models after early Llama 2-era experiences. - Community management: none flagged as directly actionable from this report. - Internal/external/cross-project: track the report's own "watchlist" (capability/adoption, harness, market structure, trust & safety lanes) as a recurring quarterly check-in. #### OSPO - Policy & Governance: use the report's "portable permission" gap analysis (zero standards across 12 frameworks/10 harnesses/3 protocols) as a forcing function to evaluate whether your org needs an internal write-permission policy ahead of an external standard emerging. - License Compliance: monitor DeepSeek/Qwen-class model licensing given training-data opacity caveats the report itself flags. - Security Management: adopt the "authentication solved, authorization not" framing (OAuth 2.1/PKCE + signed Agent Cards vs. no write-permission standard) as a gap-analysis checklist item for any MCP/A2A deployment. - Software Inventory: the stack maturity heat map (48 subcomponents, 9 layers) is a reusable rubric for grading your own org's open-source AI stack against community/production-readiness/enterprise-readiness criteria. - Developer Support: none flagged as directly actionable from this report. - Community Engagement: none flagged as directly actionable from this report. - Strategic Alignment: brief leadership on the "own the memory" bet — portable, append-only, firewall-side memory as a hedge against vendor model deprecation. #### Community - Maintainers: none flagged as directly actionable from this report. - Contributors: none flagged as directly actionable from this report. - Sponsors: the "funding stack has holes" finding (data/datasets and safety/eval/governance run almost entirely on philanthropy/government money) is a concrete case for where sponsor dollars are most underfunded relative to strategic importance. - Ecosystem: none flagged as directly actionable from this report. #### WordPress - Not applicable — report contains no WordPress-specific content; the standard WordPress action-item categories (Core, Mobile, Playground, Accessibility, etc.) don't map to this source. #### The WPCC - Not applicable — no WPCC-relevant content in this source. ### FAIR - Technical independence: the report's "own the memory" bet (local, portable, append-only records; no vendor-governed store) directly matches FAIR's technical-independence principle. - Policies and covenants: the "break the meter" bet (second-sourcing before introductory pricing ends ~2027-28) is a funding-transparency/anti-lock-in argument in FAIR's spirit. - Productized governance artifacts: none flagged as directly actionable from this report. ## 🧪 Hypotheses 1. If a team adopts an open-weight model plus a lab-tuned proprietary harness (e.g., an open model inside Claude Code or Codex CLI), production performance will underperform the same harness run on that lab's own weights by a measurable margin — because the harness-model coupling, not the model's raw benchmark score, drives agentic task performance. 2. If an enterprise's AI workload exceeds roughly 8,000 conversations per day, self-hosting an open model will become cheaper than metered API billing within one budget cycle. 3. If a jurisdiction restricts API access to a closed model (export controls, sanctions, policy reversal), organizations running self-hosted open-weight copies of a comparable model will retain uninterrupted service while API-dependent competitors go dark. 4. If an agent framework lacks a standardized write-permission (authorization) layer, the rate of security incidents involving unauthorized actions (not just unauthorized reads) will rise faster than the rate of incidents in frameworks that adopt one, as MCP/A2A-style ecosystems scale. 5. If public/government funding for open-weight model diversity (EU, Canada, India, etc.) plateaus or declines, single-origin concentration (currently trending toward Qwen/Chinese-origin models) in the open ecosystem will increase, measurable via Hugging Face download share and OpenRouter token share by country of origin. 6. If a vendor moves a previously flat-rate AI product to usage-based/metered pricing after user workflows have become dependent on it, the vendor will raise effective per-unit prices within 12-24 months once switching costs are established (the "Uber fare" pattern generalized beyond ride-hailing). ### 📊 Methodology - **Report's own stated methodology** (per its appendix, verbatim in substance): draws from external sources cited with their own as-of dates (Chatbot Arena, OpenRouter panels, the Nagle-Yue Linux Foundation study, Terminal-Bench, Hugging Face download counts, Stanford HAI, Epoch AI, MIT, OECD/Oxford Insights trackers), explicitly flagged as point-in-time since leaderboards and pricing shift within days. Report is versioned v1, July 2026, last updated 30 June 2026; funding figures form a census to 18 June 2026. - **Stack maturity heat map**: an original Mozilla assessment grading 48 stack subcomponents across 9 layers on 9 criteria (1-5 scale), against a rubric fixed before scoring began, applied "with AI assistance for consistency" across 1,361 projects. Only the per-row average is a computed value; every other cell is a graded (ordinal, directional) judgment — not a measurement. - **Funding-maturity analysis**: maps capital into open-source/open-weight AI from Jan 2022 to 18 June 2026, distinguishing open-weight from fully-open releases across 7 stack layers and 5 funding types. Counts only cash, debt, grants, and quantified in-kind commitments — explicitly excludes valuations, ARR, and market cap. Each unit scored 0-3 on 7 dimensions (volume, type diversity, source concentration, stage, cash-vs-in-kind, realized-vs-pledged, durability), summing to a 0-21 maturity band. - **Survey methodology**: State of AI Models 2026 online survey, designed and fielded by SlashData for Mozilla, in English/Chinese (Simplified & Traditional)/Brazilian Portuguese/Japanese, fieldwork 19-29 May 2026, 1,494 qualified respondents (developers adding AI functionality using open or closed models). Weighted by region (1.24 Greater China, 0.82 South Asia, 1.11 East Asia ex-Greater China, ~0.99 elsewhere) against SlashData's Developer Nation benchmark study. - **Caveats the report itself names**: disclosure and pledge inflation in funding data; reduced visibility into non-Western and Chinese funding rounds; the ordinal/directional (not measured) nature of both original Mozilla assessments. - **To test the hypotheses above**, one would need: controlled harness-swap benchmarking (same model, multiple harnesses, standardized tasks — Terminal-Bench-style); enterprise TCO studies isolating the self-hosting break-even point across workload volumes; natural-experiment tracking of service continuity during future export-control or sanctions events; longitudinal CVE/incident tracking segmented by presence/absence of standardized write-permission layers; time-series tracking of Hugging Face/OpenRouter share by model origin correlated against public funding disclosures; and pricing-history analysis of usage-based AI products post-lock-in versus their introductory rates. ### ❓ Questions - What specifically will the "portable permission" standard look like technically, and which body (Linux Foundation's AAIF, a new consortium, or a single vendor) is best positioned to define it before a closed platform does? - Given the report's own admission that scoring is "directional, not measurement," how much would the stack-maturity heat map change if re-scored by a different team, and does Mozilla plan to publish inter-rater reliability data in future editions? - If Chinese open-weight models continue gaining share due to explicit industrial policy, does "keeping the layer open" functionally mean subsidizing a policy-driven near-monopoly rather than a genuinely plural commons — and if so, what does bet #5 ("make the open default plural") look like in practice against a state-backed competitor? - How durable is the Terminal-Bench harness-lock-in finding — is an 8-week compression from 21.8 points to ~3 points a stable equilibrium, or a snapshot during a period of unusually fast lab investment that could reverse (or widen further) with the next model generation? - What happens to the "own the memory" strategy if regulation (data residency, right-to-deletion, cross-border transfer rules) makes append-only, portable memory legally harder to maintain than the report assumes? - Does the 5% "enterprise pilots with measurable financial impact" figure reflect a genuine AI-value problem, or primarily a measurement/attribution problem in how enterprises evaluate pilots? ### 🔮 Future Research - A controlled, repeatable benchmark isolating harness contribution from model contribution across multiple labs and multiple task categories (not just Terminal-Bench-style coding/agentic tasks) would clarify how general the "harness lock-in" finding is. - Longitudinal tracking of MCP/A2A CVE rates against governance-maturity adoption (the ~21% figure) would test whether the security gap is closing or widening as the ecosystem scales past 97M monthly downloads. - A follow-up study specifically on the training-data opacity and hard-coded refusal caveats the report raises about Chinese open-weight models, quantifying how these affect enterprise risk assessments in regulated industries. - Independent replication of the stack-maturity heat map by a non-Mozilla team, to establish whether the "operational gap" (standardization + enterprise readiness) finding is rubric-dependent or robust across scoring methodologies. - Tracking whether any of the five "bets" show measurable uptake (e.g., funding flowing specifically into portable-permission tooling, memory-layer startups, or second-source harness projects) in the 12 months following this report's publication. ### 💡 Implications - **Practice**: engineering teams building agentic systems should treat harness selection (not just model selection) as a first-class architectural decision with lock-in consequences, and should evaluate whether their memory/context store is portable and firewall-side before scaling agent deployments. - **Policy**: the report's national-strategy tally (70+ strategies, 47 nations restricting foreign AI processing for critical workloads) suggests AI infrastructure policy is converging toward treating model/compute sovereignty the way countries historically treated energy or telecom infrastructure — likely to accelerate public procurement preferences for open, self-hostable stacks in critical-infrastructure sectors. - **Security**: the finding that all four cited high-severity incidents occurred in closed systems (while noting this reflects who ships default safeguards, not an inherent open/closed security property) implies security teams should audit agentic tooling for retrieval-vs-output-checking gaps regardless of open/closed status, rather than assuming closed = safer by default. - **Education**: the "operational gap" (standardization, enterprise readiness) as the two weakest stack-maturity criteria across all nine layers suggests curriculum and certification efforts around open-model deployment (not just model usage) are currently underserved relative to demand. - **Funding models**: the "funding stack has holes" finding — data/datasets and safety/eval/governance surviving almost entirely on philanthropy and government money — implies these categories remain structurally under-resourced relative to their stated strategic importance, and are vulnerable if government or philanthropic funding contracts. ### 🧠 Learning Styles Assessment - Reading level estimate: the report is written in short, high-density declarative sentences with heavy statistical scaffolding; using a Flesch-Kincaid-style approximation on representative passages, this reads at roughly grade 11-13 (moderately advanced but not academic-dense prose) — sentence complexity is low, but domain-specific vocabulary (ARR, MoE, OAuth 2.1/PKCE, blended API list price) raises the effective comprehension bar for non-specialists. #### 👀 Visual learners - Present: extensive charts, bar/line graphs, stat call-out boxes, a stack-layer market map, and a 9x9 heat-map matrix — this is one of the most visually-structured report formats in the deep-read pipeline's typical intake. - Improve: several charts (e.g., the funding stack matrix, the stack-maturity heat map) would benefit from color-blind-safe palettes and explicit numeric labels in addition to color-intensity encoding, since the extracted text shows the underlying data survives without color but a sighted reader relying on color alone could lose information. #### 🔊 Aural learners - Present: no audio version, podcast, or narration accompanies this PDF as published. - Improve: a 3-5 minute audio walkthrough of the five headline numbers and the five bets would let aural learners get the report's core argument without parsing 48 chart pages. #### 🗣️ Verbal learners - Present: strong use of definitions and analogies (the harness-as-browser analogy, the Uber-fare analogy for metered pricing, the cloud-repatriation-as-precedent analogy) makes abstract infrastructure arguments concrete. - Improve: a glossary of acronyms (ARR, MoE, PKCE, A2A, NCII, ZDR, CoSAI) would help readers outside the AI-infrastructure specialist audience. #### 🧩 Kinesthetic learners - Present: no hands-on labs, sandboxes, or reproducible exercises — this is a read-only assessment report, not a technical tutorial. - Improve: a companion "try it yourself" appendix (e.g., a script to benchmark self-hosting break-even cost against your own workload volume) would give kinesthetic learners something to do with the report's numbers. #### 🧠 Logical learners - Present: strong use of timelines (the 19-day Claude outage, the MCP download growth timeline, the EU policy escalation sequence), before/after comparisons, and a formal scoring rubric (the stack-maturity heat map). - Improve: a single consolidated causal diagram connecting the five sections (capability parity → cost collapse → harness shift → sovereignty motive → the five bets) would make the report's overall argument chain more explicit than the current section-by-section structure. #### 🧑‍🤝‍🧑 Social learners - Present: none — no forums, discussion prompts, or collaborative annotation features are part of the published PDF. - Improve: a companion discussion guide with prompts per section (e.g., "which of the five bets is most relevant to your organization's stack?") would support cohort-based or team reading. #### 🧘‍♀️ Solitary learners - Present: the "watchlist" section functions as a built-in self-check tool — readers can track the four lanes over time against their own judgment. - Improve: explicit reflection prompts per section (e.g., "which of your own AI deployments would show up in the 33%-reach-production or the 67%-stall bucket?") would deepen self-paced engagement. #### 🌿 Naturalistic learners - Present: no sustainability, environmental, or ecosystem-lifecycle framing appears in this report; "ecosystem" is used only in the software/market sense. - Improve: the report could tie its GPU/compute cost curves to energy consumption or carbon-cost framing, since inference cost collapse has a physical infrastructure dimension the report doesn't address. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: the PDF is not tagged (per its own metadata: "Tagged: no"), meaning heading structure, reading order, and alt text are not exposed to assistive technology; a pypdf-produced document with untagged structure will read poorly or out of order in a screen reader. - Improve: publish a tagged-PDF or HTML/Markdown parallel version with proper heading hierarchy and alt text for every chart, since the current format's charts carry load-bearing data (e.g., the stack-maturity heat map) with no text-equivalent fallback confirmed in the source. #### Keyboard navigation - Not applicable to a static PDF document — no interactive elements exist to navigate. #### Contrast and readability - Present: cannot be fully verified from extracted text alone; the layout uses large-format landscape pages (1440×810pt) suggesting a slide-deck-style visual density that typically favors large text and high-contrast call-out numbers. - Improve: without visual inspection, contrast compliance (4.5:1 minimum) can't be confirmed here — a full WCAG audit would require rendering the PDF and sampling color pairs directly. #### Text resizing and reflow - Present: PDFs generally do not reflow at 200% zoom the way responsive HTML does; a landscape-oriented, chart-dense PDF like this one would likely clip or require horizontal scrolling at high zoom levels. - Improve: an HTML version of the report would allow proper reflow and zoom support that this PDF format structurally cannot provide. #### Media and captions - Not applicable — the source contains no audio or video media requiring captions or transcripts. #### Forms and interactions - Not applicable — the PDF contains no interactive form fields. #### Standards reference - Given "Tagged: no" in the PDF metadata, this document likely fails WCAG 2.2 success criterion 1.3.1 (Info and Relationships) and 4.1.2 (Name, Role, Value) for assistive technology users; a tagged-PDF or HTML companion release would be the most direct remediation. ### 🌍 DEIB Assessment #### Cultural breadth - Present: strong multi-region coverage — the report explicitly covers North America, Western Europe, Greater China, South Asia, East Asia, South America, Eastern Europe/CIS, and Oceania in its regional-challenges breakdown, and profiles national strategies across China, the EU, Canada, India, Saudi Arabia, South Korea, and the UAE. - Improve: the regional-challenges table itself flags that Oceania (n=39) and Eastern Europe & CIS (n=98) fall below reliable sample-size thresholds — future editions could oversample these regions rather than including underpowered data with a caveat. #### Inclusive language - Present: the report uses precise, largely jargon-defined technical language and avoids idiomatic English that would be hard to translate; the underlying survey itself was fielded in English, Chinese (Simplified and Traditional), Brazilian Portuguese, and Japanese. - Improve: expand survey languages further (e.g., Arabic, Hindi, or additional European languages) given the report's own emphasis on Saudi Arabia, India, and EU sovereignty initiatives as major storylines. #### Neurodiversity support - Present: consistent per-page structure (headline stat, chart, source line) creates predictable chunking that likely aids readers who benefit from consistent visual patterns. - Improve: some pages pack 4-6 distinct statistics with dense sourcing footnotes in small type — consolidating to fewer data points per page would reduce cognitive load. #### Representation - Present: the foreword explicitly opens with three global, non-Western examples (a Māori broadcaster in New Zealand, East African cassava farmers, a Swiss public consortium) before any US/China framing — a deliberate representational choice that centers Global South and Indigenous use cases. - Improve: beyond the foreword, the bulk of the report's company/capital examples still skew toward US and Chinese firms; more sustained coverage of African, Latin American, and Southeast Asian builders (beyond the opening anecdotes) would balance this. #### Psychological safety - Present: the report explicitly names its own limits ("open is necessary, not sufficient," the CSAM/NCII hard-friction caveat) rather than presenting open-source AI uncritically — this framing reduces the risk of the report reading as one-sided advocacy. - Improve: none flagged beyond what's already present. ### ✅ Logical Validity #### Strong reasoning - The report's central causal argument (harness lock-in forming independent of model choice) is supported by a genuine natural experiment: the same weights (Claude Fable 5) run on two different harnesses at two points in time, with a measured before/after gap (21.8 points → ~3 points). This is a strong empirical demonstration, not just an assertion — the controlled comparison (same model, different harness, same benchmark) directly isolates the variable being claimed. - The cost-curve comparison (AI inference vs. dot-com bandwidth vs. PC-compute historic curves, all measured over identical 36-month windows) is a strong analogical/quantitative argument because it uses matched time windows and cites its methodology (a16z LLMflation) explicitly, rather than an unanchored "AI is getting cheaper fast" claim. - The "closed is not the same as secure" argument is a strong inductive case built from four independently-sourced, named, dated security incidents (not hypotheticals), each with a specific CVSS score and root-cause pattern (retrieval checked, output not) — this is falsifiable and traceable to primary incident reports. #### Fallacies - **Survivorship / selection risk in the funding census**: the report explicitly acknowledges "reduced visibility into non-Western and Chinese rounds" and "disclosure and pledge inflation," which is good practice, but the funding rankings and stack-layer capital-intensity matrix are still presented with specific dollar figures and 0-3 scores that read as more precise than the underlying visibility gap should allow. Fix: future editions could present funding figures as ranges or confidence bands rather than point estimates, given the stated visibility gap. - **Potential false-dichotomy framing in "open is optionality, not ideology"**: the report sets up closed-API lock-in and open self-hosting as the two poles via the cloud-repatriation analogy, which is a real and well-evidenced pattern, but slightly understates the middle ground the report's own data shows — 50% of developers run both open and closed models together, which complicates a clean "own the exit vs. don't" framing. Fix: the report could more explicitly reconcile the optionality argument with its own "most teams run both" finding. - **Directional-as-precise risk in the stack-maturity heat map**: the report itself flags this ("scores should therefore be read as directional rather than as measurements"), which is the correct caveat — but the map is nonetheless presented with two-decimal precision (e.g., "3.96," "2.64") that visually signals more rigor than an ordinal 1-5 rubric graded "with AI assistance" can support. This is a minor internal-consistency gap between the stated epistemic status and the visual presentation, not a fabricated fallacy — the report is transparent about it, which mitigates the concern considerably. #### Tone of voice - The tone is confident, analytical, and advocacy-inflected but self-aware about its own limits — phrases like "a case that hides its weak points is an advertisement" (from the foreword) and the explicit "watchlist" section that names conditions that would reverse the report's own thesis both function as credibility-building moves rather than pure boosterism. The register throughout is terse, numbers-forward, and journalistic rather than academic or promotional in the marketing sense. ### 🛡️ DARVO Analysis Not applicable to this source — DARVO (Deny, Attack, Reverse Victim/Offender) is a framework for analyzing how an accused party responds to allegations of wrongdoing. This report is an analytical/advocacy assessment of a market and technology trend, not a response to accusations against Mozilla, SlashData, or any named party; there is no denial, attack, or victim-offender reversal pattern to analyze here. ## 🎯 Conclusion Mozilla's inaugural State of Open Source AI report makes a well-evidenced case that open-weight models have closed the capability gap to near-parity with closed frontier models while becoming dramatically cheaper — but its more important and more original argument is that this parity has simply moved the real competitive battle up one layer, to the agentic harness (orchestration, memory, and especially portable write-permission) sitting above the model. The report backs this with a genuinely compelling natural experiment (the Terminal-Bench harness-lock-in finding) and is unusually candid about where open source still lags — production deployment rates, safety/compliance packaging, long-context and agentic-reasoning performance, and the near-total absence of a portable permission standard. Its five recommended "bets" (build the open harness, own the memory, solve portable permission, break the meter, keep the open default plural) read as a coherent action plan rather than a generic call to "support open source," and its self-imposed watchlist for what would reverse its own thesis is a strong practice worth noting in future report cycles. Practical next step for readers: audit your own organization's agentic tooling against the report's "unsolved gap" (write-permission standardization) and its memory-ownership recommendation before scaling any production agent deployment further. ## 🔄 Refactor Appendix — The State of Open Source AI 2026 > Density: 3 Literature atoms (H3), 1 Permanent candidate (H4). > Resonance filter applied — dropping weaker candidates in favor of the strongest, most reusable claims. ### 📚 Literature Atoms (H3) #### [H1] Harness lock-in forms even when the model is open > [!quote] > A harness tuned tightly to one lab's weights degrades on anyone else's model. Lock-in arrives as a side effect of optimization — a moat in formation. **Context & use**: - Section 04, following the Terminal-Bench 2.0 → 2.1 comparison (21.8-point gap compressing to ~3 points in eight weeks once labs internalized harness development). - Matters because it reframes "open vs. closed" competition as happening at the orchestration/tooling layer, not just the weights — directly relevant to any agent-architecture decision. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> #### [H2] Portable write-permission is the ecosystem's unsolved gap > [!quote] > No portable standard defines which writes an agent can make unattended, across any boundary. MCP crossed 10,000 servers and 97M monthly downloads; ~21% of companies have mature governance. The plumbing scaled. The lock did not. **Context & use**: - Section 04/05, the report's "Bet 3" — solve portable permission. - Distinguishes reversible reads (can be permitted by default) from costly/irreversible writes (sending messages, spending budgets, executing transactions) as the security-critical surface. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> #### [H3] Closed-model security incidents show retrieval-checked, output-unchecked as the common failure pattern > [!quote] > Authorized retrieval reaching unauthorized recipients — secrecy of the weights did not prevent it. **Context & use**: - Section 04, following four named incidents (Anthropic Slack MCP, MS Copilot EchoLeak, Salesforce ForcedLeak, ServiceNow BodySnatcher), all closed systems, all CVSS 9.3-9.4. - Useful corrective to the assumption that closed = secure by default; the actual failure mode is architectural (output not checked) rather than a function of open/closed weights. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> ### 🧠 Permanent Candidates (H4) #### [P1] Vertical integration turns a swappable model into a rented product **Claim** (one sentence, my voice): When a vendor controls both the model and the harness tuned to it, the model's technical swappability stops mattering because the harness becomes the actual point of lock-in. **Evidence pointer**: [[#H1]] **Scope & conditions**: Holds when a lab or vendor invests specifically in harness-model co-optimization (as Anthropic and OpenAI did between Terminal-Bench 2.0 and 2.1); may not hold in domains where harnesses stay commodity-level or where open standards for tool/agent interop mature faster than vendor-specific tuning. **Links**: - [[Outpost Cookie+bearer collision]] — because applies-in the pattern of same-origin platform lock-in mechanics recurring across unrelated stacks (auth coupling as a moat, not just harness coupling) <!-- atomicity: 1 idea ✓ --> ### ✏️ Fleeting Queue - [F1] Check whether a future State of Open Source AI edition publishes confidence bands on the funding census given the report's own visibility-gap caveat — https://stateofopensource.ai #xref - [F2] Investigate whether Mem0/Letta/Zep-style portable memory stores have documented compliance with data-residency/right-to-deletion rules the Implications section speculates could complicate the "own the memory" bet #xref ### → Things 3 (max 2 actions) - [ ] Review current or planned agentic tooling for write-permission standardization gaps flagged in this report — courtneyr.dev / Outpost projects #things <!-- deep-read:sections end --> 📄 **Full text:** [[Full Document Contents/Articles/The State of Open Source AI 2026.md|The State of Open Source AI 2026 by Mozilla]] ## Highlights - Read what follows as a map: where open AI is winning some numbers surprised even us — and where it is exposed.A case that hides its weak points is an advertisement. ([View Highlight](https://read.readwise.io/read/01kxh9dp1rtz0qcrhx66g8c9xj)) - Tags: atom/literature/h1 - **You can switch off a model. You cannot switch off a copy already running on a machine you hold.** Sovereignty is this same argument at national scale ([View Highlight](https://read.readwise.io/read/01kxh9e2cx5k02bzm7r6mdrsr8)) - Tags: atom/literature/h4 - A harness tuned tightly to one lab's weights degrades on anyone else's model. Lock-in arrives as a side effect of optimization — a moat in formation. No open model appears in the verified top tier. Source: Terminal-Bench 2.0 / 2.1 leaderboards. ([View Highlight](https://read.readwise.io/read/01kxh9dt8gxdbv02nahqxv01wm)) - Tags: atom/literature/h2 - No portable standard defines which writes an agent can make unattended, across any boundary. MCP crossed 10,000 servers and 97M monthly downloads; ~21% of companies have mature governance. The plumbing scaled. The lock did not. ([View Highlight](https://read.readwise.io/read/01kxh9dzbktn3hz6d86rwmz5z3)) - Tags: atom/literature/h3 - You cannot out-close a market that is out-opening you. That's not a story about one country being ahead — it's a story about everyone else being absent. Sources: Hugging Face · OpenRouter · national strategy documents. ([View Highlight](https://read.readwise.io/read/01kxh9e7hxddaye2jtwn72c6rg)) - Tags: atom/zettel/z1