Almost every week, someone asks me why myOrbit does not use open models. It is a fair question. Some of the best AI models in the world are now free to download, and a few of them come close to the most expensive ones.

So here is the honest answer, in plain words.

The short answer

  • None of the models that read, write or speak for you in myOrbit is an open model today.
  • That is not because open models are bad. Many are excellent.
  • It is because nobody, including us, can yet check what is inside most of them well enough to trust them with people’s lives and work.
  • Running an open model on a big, trusted cloud keeps your data safe. It does not tell you what the model will do.
  • We are not closed to them. We will test them, starting with the ones that publish the most about how they were made.

What “open” actually means

Underneath, an AI model is a very large file of numbers. People call those numbers the model’s weights. They are what the model learned during training.

An open-weight model is one whose file anyone can download and run. That is what most people mean when they say “open model”.

Open source is a stricter idea. The Open Source Initiative’s definition asks for three things, not one:

  • the weights themselves;
  • “The complete source code used to train and run the system”;
  • information about the training data, detailed enough “that a skilled person can build a substantially equivalent system.”

The difference matters for one reason. With the weights alone, you can run a model. With the training data and code as well, you can study how it was made. Very few models give you that. The Allen Institute for AI’s OLMo is one that does; its makers say “the entire model flow – not just its endpoint – should be accessible and customizable.”

Most “open” models are open-weight, not open source.

The open models worth taking seriously

Open models are no longer a hobby. They are close behind the best closed ones.

Stanford’s 2026 AI Index found that, as of March 2026, “the top closed model leads the top open model by 3.3%.” Epoch AI puts the gap another way: “Since January 2026, the most capable open-weight models have lagged frontier closed models by an average of four months.”

Four months is not long.

The models people actually use come from all over the world. Meta’s Llama models are among the best known. OpenAI released its own open-weight models in August 2025, under the Apache 2.0 license. Mistral, in France, released its newest family under the same license. NVIDIA released its Nemotron models together with trillions of tokens of training data.

Many of the most popular come from Chinese labs, including Alibaba’s Qwen and DeepSeek. According to the ATOM Report, “Chinese models overtook their counterparts built in the U.S. in the summer of 2025.” The same Stanford report found the top US model ahead of the top Chinese model by just 2.7%.

These are serious models, made by serious teams. Nothing that follows is about where a model comes from.

Who pays for “free”

Training a leading model costs a fortune, so it is fair to ask why anyone gives one away. The answers are mostly ordinary business, and the companies are fairly open about them.

Meta explained its reasoning in 2024. Mark Zuckerberg wrote that “selling access to AI models isn’t our business model,” so “openly releasing Llama doesn’t undercut our revenue.” He also wanted to make sure Meta was not “locked into a closed ecosystem.” Free, in other words, can be a strategy: help set the standard, and make sure nobody else owns it.

“Open” can come with conditions. Meta’s Llama license says that a company with more than 700 million monthly active users “must request a license from Meta.”

And “open” can change. Meta’s newest model, Muse Spark, launched in April 2026 at “meta.ai and the Meta AI app,” with a “private API preview to select users” and no open weights. A report from Axios says Meta plans to release open versions of its next models “eventually.”

NVIDIA’s reasons are different again. It sells the chips these models run on, and its own launch post suggests “routing tasks between frontier-level models and Nemotron in a single workflow.”

None of this is sinister. It is simply worth knowing that “free” usually means someone has a plan, and it is worth knowing the plan before you build your life on it.

Where the risk actually lives

When people worry about open models, they often picture the model secretly sending their data somewhere. That is mostly not how it works, and it is worth being precise.

A model file is numbers. Stored in a safe format, it cannot send anything anywhere on its own. The real risks sit in three places: the code around the model, the way the file is loaded, and what the model has learned.

The code around the model

Models do not run alone. They run inside other software, and that software can be attacked.

In March 2026, attackers published poisoned versions of LiteLLM, a widely used open-source tool that connects apps to AI models. The project’s own report says the bad versions were “live on March 24, 2026 from 10:39 UTC for about 40 minutes.” They contained “a credential stealer designed to harvest secrets.” The attackers got in through a security scanner the project itself relied on.

Forty minutes was enough. The company Mercor said it was “one of thousands of companies” affected.

To be clear, LiteLLM is not a model, and myOrbit does not use it. But it shows the real shape of the problem. What you download is not the same as what someone has checked.

The way the file is loaded

Some model files are not just numbers. Older formats can carry code that runs the moment the file is opened.

Hugging Face is the biggest site for sharing models. In 2024, researchers at JFrog found roughly a hundred models there that did exactly that. Opening one quietly connected the computer back to the attacker. In July 2026, the security firm Zafran disclosed flaws in a popular model library. Because of them, “malicious model repositories can run arbitrary code on any machine that loads it.” They slipped past the very safeguard meant to stop that.

Safer formats exist, and they help. Hugging Face describes its safetensors format as a way of “storing tensors safely (as opposed to pickle).” But a safe file only tells you the file will not attack your computer. It tells you nothing about what the model has learned.

What the model has learned

This is the hardest part, and it applies to every model.

A model can be trained to behave normally almost all the time, and differently when it sees a secret trigger. Researchers call this a backdoor. In Sleeper Agents, Hubinger and colleagues showed that such behavior can survive the safety training meant to remove it. Worse, “adversarial training can teach models to better recognize their backdoor triggers, effectively hiding the unsafe behavior.”

It does not take much to plant one. Souly and colleagues found that “250 poisoned documents similarly compromise models across all model and dataset sizes.” In July 2026, a security researcher went further. With ten training examples and less than $100, they planted a backdoor in an open-weight model. Afterwards, it reliably wrote code with a serious security hole.

You cannot find a backdoor by reading the file. The weights are billions of numbers, not instructions. Today, the only way to learn how a model behaves is to test it, carefully and at length.

Does a big cloud make it safe?

Partly, and the clouds deserve real credit.

Amazon, Microsoft and Google all host open models, and they protect your data well. On Amazon Bedrock, model makers “don’t have access to Amazon Bedrock logs or to customer prompts and completions,” according to AWS. Microsoft says that, for the models it hosts as an API, it “doesn’t share these prompts and outputs with the model provider.” It does not use them to train anyone’s models either. And the models themselves “don’t store any prompts or outputs.” Google notes that its DeepSeek endpoint “does not have any outbound internet access.”

So the fear that a lab will quietly collect your conversations for its next model does not really apply when a big cloud hosts the model this way. The model maker never sees them.

What hosting does not do is check what the model will do. Microsoft says so plainly: “not all models available through the model catalog are scanned” for vulnerabilities that could leak data. And your use of a model, including “the provider’s accountability for the model and its outputs,” is governed by that model’s own license.

A trusted building does not tell you who you have let inside.

”You can’t see inside Anthropic’s models either”

That is true, and I would rather say it than have someone point it out. Nobody outside Anthropic, OpenAI or Google can inspect their weights. Those are closed models.

So why trust them?

Not because we can see inside. Because of what we can see around them. Each is a company we work with directly, under contract, handling our data under their published terms; they are listed on our privacy page. Each is accountable, by name, for the models it ships. And each has earned its place in our own testing, on our own work, over time. Which AI labs we use, and why explains where each one runs.

That is accountability, not inspection. It is not perfect. It is a great deal more than a downloaded file comes with.

Why not yet, including Chinese labs

The honest reason we do not use open models today is simple. We have not finished the work it takes to trust one.

Every model that reaches your conversations goes through our own evaluation first. We look at how it really behaves on our work, including the hard cases. We look at what it does when something goes wrong. That takes time, and we have spent that time on the models we run today.

That applies to every open model in exactly the same way, wherever it was made. We have not ruled out models from Chinese labs. We have not ruled out models from American or European labs either. We simply have not evaluated them yet, and until we have, they do not get near people’s lives.

What would change our minds

We are not closed to open models. A few things would move them up the list.

More that can be checked. Models that publish their training data and code, like OLMo, can be studied in ways weights alone cannot. NVIDIA’s decision to release training data alongside Nemotron is the kind of openness that makes real evaluation possible, and we are looking at those models more closely for that reason.

Our own evaluation. When an open model holds up on our work, for a specific job, it can earn a place. That would start with narrow tasks, not with your most personal conversations.

Better ways to find hidden behavior. Research on detecting backdoors is moving quickly. When it can give real assurance, the calculation changes.

None of this has a date. When it happens, it will be written up here, after it works.

What we will never do

One thing will not change, whichever models we use. We build no AI models, so we do not train on your data.

That is a choice, not a limitation. Tuning a model on people’s private conversations can leak them. One study found that fine-tuning with repeated sensitive data raised leakage rates “from baseline levels of 0-5% to 60-75%.” And tuning can weaken a model’s safety even without bad intent. Qi and colleagues found that “simply fine-tuning with benign and commonly used datasets can also inadvertently degrade the safety alignment of LLMs.”

What your twin knows about you, it looks up. It is not baked into anyone’s model.

The real question

Open models are important. They put powerful tools in more hands, and a great deal of the best research in the field depends on them.

The question was never whether they are good. Many of them are very good. The question is whether anyone has checked what is inside, before a model starts reading someone’s messages, planning their week, or speaking for their business.

When the answer is yes, we will be glad to use them.

References

What “open” means

The open-model landscape

Who pays for “free”

Where the risk lives

Hosting

Training on people’s data

Anthropic Anthropic OpenAI OpenAI Google Google