Open-Source AI & Open Models Reading List

Nathan Lambert published this list on interconnects on 11 September 2026, while preparing policy-facing writing on open models, and updated it two days later. It is short on its own words — a one-line gloss per link — but the selection and the glosses carry a position, and the vault ingested nearly every piece it points to. This page is the way into those pages.

The list has three parts. The first asks what open models are and why anyone releases them. The second asks who leads in open models and how China got there. The third takes the three contested questions of 2026: how far open models trail the closed frontier, what they do to cyber risk, and distillation.

About a third of the links are Lambert's own writing, his book chapter, his talk, or projects he runs. He says so implicitly by signing each one, and it is worth keeping in mind: this is a reading list from a participant — he builds olmo at AI2 and started the ATOM Project — not a neutral survey.

Why open models exist

The strategy pieces come from very different seats. Bill Gurley's from-open-source-software-to-open-source-strategy walks through how businesses have used open source software and reads AI through that history. open-source-ai-is-the-path-forward is Mark Zuckerberg's July 2024 case for Llama, which Lambert calls one of the clearest statements of why a company releases weights (see meta-platforms for what Meta did afterwards). Irene Solaiman's gradient-of-generative-ai-release replaces open-versus-closed with a gradient of release options — license, cost to run, access to data.

Lambert's own view is that open models should stop chasing the frontier and build small specialized models that closed agents call as tools, the pieces of custom enterprise workflows (what-comes-next-with-open-models). Christian Catalini's some-simple-economics-of-open-versus-closed-ai makes a similar argument from the history of intellectual property. Two more Lambert essays set expectations: open models stay behind in raw performance (open-models-in-perpetual-catch-up), and their adoption follows a different, slower curve from closed models (open-and-closed-models-are-on-different-exponentials).

On safety, the list pairs a lab's answer with the skeptics. Thinking Machines Lab's a-safe-path-to-open-weights is Lambert's pick for how to release powerful weights while taking safety seriously. societal-impact-of-open-foundation-models (Kapoor, Bommasani et al., 2024) is the marginal-risk paper. Lambert reads it as showing that text models added little risk; the paper's own finding is narrower, that most earlier misuse studies were too incomplete to measure marginal risk at all. Florian Brand's myth-of-unsafe-open-source-ai argues that closed models' guardrails are bypassed so routinely that the real harms have come from closed models first. consent-in-crisis-ai-data-commons documents the collapse of openly usable web data, which Lambert names as the thing that most hampers truly open research.

The section ends with the Chinese releases that changed the argument — kimi-k3-open-weights-escalation and glm-5-2-step-change-for-open-agents — and Lambert's talk at The Curve 2025, lambert-china-ai-ecosystem-open-model-gap, as the summary of 2025. atom-report-open-model-ecosystem carries the adoption numbers by country. Two further links, the Interconnects adoption dashboard and the Artifacts Hub of models to know, are live data pages and were not ingested.

Who leads, and why China

The American side is Lambert's ATOM Project, atom-project-american-truly-open-models, which argues the US has to fund open models for research and innovation because China is out-releasing it. Around it sit why-i-build-open-language-models, banning-open-source-ai-would-be-a-mistake (with Kevin Xu), and six-months-to-live-for-open-models, which predicts that vague federal oversight — "vibe regulation" — sets up a clash with, or a ban on, frontier open models. It is the natural companion to Tom Bedor's arguments-against-open-source-ai, which the vault already had. The fully open technical reports he lists as the state of the art in openness are pythia-suite-for-analyzing-llms, olmo-accelerating-the-science-of-language-models, olmo-2-furious and olmo-3-technical-report.

The Chinese side starts before AI. Kevin Xu's chinese-open-source-a-definitive-history and chinas-structural-advantage-in-open-source-ai explain why open source became a national habit there. Lambert's notes-from-inside-chinas-ai-labs reports how the labs describe their own work, glm-5-3-how-chinese-labs-keep-stride explains how they keep pace with American labs, and ChinaTalk's zai-playbook gives z-ai's release discipline in one line: "Get it out fast. We open source it within a few hours." That was November 2025. By GLM-5.3 the lab was staging releases, security partners first and weights after safety evaluations (glm-5-3-how-chinese-labs-keep-stride).

The list closes the section on consequences in the US. Lawmakers have questioned DoorDash, Airbnb, Anysphere (Cursor) and Apple over their use of Chinese models, while Perplexity and Thomson Reuters moved to DeepSeek R1 and Qwen to cut costs. us-scrutiny-of-chinese-model-use collects the reporting that could be fetched. The Bloomberg, Reuters and Forbes articles refused every fetch and are linked from that page unread.

The gap, cyber, and distillation

Lambert puts the open-closed gap at roughly four to six months in 2026, and says the leading open models have all been Chinese since about 2024. His own number moved within the year — about six months in February, six to eighteen in March, three to five after Kimi K3 — and the measurements disagree on direction: SemiAnalysis sees the gap closing, Håvard Tveit Ihle sees it widening since R1, most on private benchmarks. open-closed-model-gap is the vault's concept page for that claim and the measurements behind it: SemiAnalysis's independent evaluations (are-open-models-catching-up), Håvard Tveit Ihle's public-plus-private analysis (how-far-behind-are-open-models), and the point that open models sit on the cost frontier without holding the performance frontier, with DeepSeek V4 Flash as the example (deepseek-v4-flash-0731-artificial-analysis, deepseek).

The cyber part is explicitly unfinished — "I plan to develop this further". What is there argues against access control as the main tool. Joshua Saxe's openai-huggingface-incident-autonomous-hacking says bad actors will always have capable open models for hacking. His national-ai-cybersecurity-policy asks the government to watch and respond to threats rather than block models on in-house capability tests. Helen Toner's nonproliferation-is-the-wrong-approach-to-ai-misuse says intelligence past a threshold cannot be kept contained, so society has to prepare for what follows from it being available.

Distillation — training on another model's output tokens — gets the longest section, because Lambert calls it the single most eventful open-model debate of 2026. llm-distillation is the concept page. The reading goes from background (the synthetic data chapter of his RLHF book, rlhf-book-synthetic-data-distillation), through his argument that distillation helps Chinese labs without explaining away their work (how-much-does-distillation-matter-for-chinese-llms, the-distillation-panic, how-distillation-is-used-today), to the evidence: stealing-reasoning-traces-from-proprietary-llm-apis showed that frontier APIs leaked hidden reasoning traces, and Anthropic's anthropic-threat-report-september-2026 reported that Chinese labs used the technique and described banned parties routing Claude into their own products.

The section ends with a correction worth recording. In frontiers-in-synthetic-data (2024) Lambert described SFT on a stronger model's outputs as the dominant form of distillation, with frontier labs moving to logit-based knowledge distillation. In April 2025 he wrote confidently that DeepSeek had not distilled OpenAI's o1 to build R1. In light of the trace-extraction results he now says it is more possible than he allowed that DeepSeek used some o1 traces to ease R1's training. He does not think that erases the innovation, but he retracts the confidence.

What the list does not cover

The gaps are the ones Lambert names or implies. Cyber risk is a placeholder. Biological and chemical uplift, the other half of most open-weights safety arguments, is not covered at all. Europe, Mistral, and open-weight releases from American closed labs barely appear, so the story reads as the US versus China. And because so much of it is his own writing, the counter-case — that open frontier weights should be restricted — comes through mostly as the position being argued against.