This session covers what "open" actually means, what the licenses say, the safety debate, and the hardware math for running a model yourself. Rough timing for a 45-minute session: Part 1 (what open means, why labs do it, and the safety debate) about 18 minutes, Part 2 (running and choosing) about 20 minutes, then the exercise and discussion. The hardware math is what people remember; leave time for it. Model names, sizes, and licenses here are as of November 2026.

People often confuse these two things. Self-hosting a Chinese lab's weights keeps your data on your own machines. Calling that lab's own API sends it to servers in China. Those are different risk decisions, and the privacy slide near the end comes back to it. Module 03 covers how far behind open models are.

Part 1 covers what weights are, the spectrum from closed to fully open, licenses, why labs release weights at all, and whether they should. About 18 minutes.

A language model is a very large function: tokens in, a probability for each possible next token out. Its behavior is set by the weights, billions or trillions of numbers adjusted in training (module 01). On pickle files, Hugging Face's own advice amounts to treating them like executables from strangers. Prefer safetensors.

The module adds MiniMax M3 as restrictive and Muse Glimmer (Apache 2.0) as permissive. Fully open models like AI2's OLMo family publish the pretraining data (Dolma), training and evaluation code, intermediate checkpoints, and post-training data. They're the only kind you can study end to end. They usually trail the best open-weight models in raw capability.

Most "open" models publish only the weights. Labs are getting careful with the words. Moonshot calls Kimi K3 "open weight," not "open source," as Simon Willison noted. The OSI argued in 2023 that Llama's license isn't open source because of its use restrictions. Discussion question 1 asks whether the OSI is right to require training data.

Thresholds in the revenue-tiered licenses, as the module reports them: Kimi K3 above $20M over 12 months; Qwen3.8-Max above $50M for model-as-a-service; Muse Spark Open above $20M, with "Built with Muse Spark Open" attribution; GLM-5.3 above $10B for model-as-a-service needs a Z.ai security review; Mistral Large 4 needs a commercial license for model-as-a-service. Among other families, "modified MIT" (Kimi K2 and K2.5, MiniMax M2 and M2.5) adds a display rule for very large products. MiniMax M3's community license needs prior authorization above $20M yearly revenue. Llama licenses require derivative model names to start with "Llama," and Llama 4's use policy withholds rights to its multimodal models from EU-domiciled individuals and companies. Gemma 1 to 3 used custom terms; Gemma 4 moved to Apache 2.0. These clauses target competing companies that would host the model and sell it. For most engineers they change nothing; for inference providers they change a lot.

Licenses change between versions of the same family. The module's eight questions before using an open model at work: 1. Is commercial use allowed? Some licenses default to non-commercial or need notice. 2. Thresholds: monthly users, revenue, or model-as-a-service clauses. Does your company or a customer cross them? 3. Attribution and naming: must you display "Built with X," or name derivatives a certain way? 4. Acceptable-use policy: is it incorporated by reference, and can it change later? 5. Geography: are rights withheld in your region, such as Llama 4 multimodal in the EU? 6. Outputs and derivatives: can you use outputs to train other models, and do fine-tunes inherit the license? 7. Patents and warranty: Apache 2.0 includes a patent grant, MIT doesn't mention patents, and nearly all disclaim warranties. 8. Your legal team's approved-model list: get on it before you build. This is engineering guidance, not legal advice.

Labs have strategic reasons to give away models that cost tens of millions of dollars. In 2024 Mark Zuckerberg argued that open models protect Meta from depending on a rival's closed platform. In 2026 Meta kept its best Muse models closed and released two open ones. Many open labs earn money from their own API. Revenue-tiered licenses let anyone self-host while stopping large hosting companies from undercutting the lab's own service. On geopolitics, Chinese labs gain global adoption despite US chip export controls. The US government's 2025 AI Action Plan encouraged American open models. Mistral pitches Large 4 as trained and run under European law.

On the pro side, in July 2026 Hugging Face responded to an intrusion by an autonomous OpenAI test agent that had escaped its sandbox. Commercial model APIs blocked its incident-analysis requests, so the team used a self-hosted open-weight model. In 2024 the US NTIA recommended monitoring open-weight risks rather than restricting them. Against, research showed LoRA fine-tuning cheaply undoes safety training (Lermen et al. and Gade et al., 2023). Refusal behavior is often controlled by a single direction in the model's activations, which can be edited out, called "abliteration" (Arditi et al., 2024). Epoch estimates open models trail the closed frontier by 6 to 7 months on cyber tasks, so capabilities closed labs gate today will be downloadable within months. And in 2025, NIST's CAISI found agents built on DeepSeek R1-0528 were on average 12 times more likely than US frontier models to follow hijacking instructions. That's a property of the weights, wherever you run them (module 11). Discussion question 2 asks you to weigh these risks.

Part 2 is the hardware math, the tools, hosted options, coding harnesses, privacy, and when to choose open over closed. About 20 minutes.

FP32 would be 4 bytes per parameter, so 120 GB for a 30B model. Quantization stores each weight with fewer bits. 4-bit has modest quality loss, and coding and long reasoning tend to suffer before casual chat does. Some models are trained with quantization in mind, called quantization-aware training, so their 4-bit release loses little. Both gpt-oss and Kimi K3 ship natively in 4-bit MXFP4. Point at the bold cell. A 30B model at 4-bit needs about 17 GB. That's comfortable on a 36 GB Mac or a 24 GB GPU, and too big for an 18 GB Mac.

While generating, the model stores keys and values for every token in the context. That's the KV cache from module 01, and it grows with context length. The example model is illustrative, not a specific product. Many 2026 models use attention variants that shrink this a lot, like latent attention in DeepSeek, Kimi Delta Attention in K3, and hybrid Mamba layers in Nemotron. Check the model card.

A mixture-of-experts model has many expert sub-networks and uses only a few for each token (module 01). Almost every frontier open model of 2026 is a sparse MoE with roughly 2 to 6% of parameters active per token. Kimi K3 activates 104B of 2.8T. DeepSeek V4-Pro activates 49B of 1.6T. Muse Spark Open activates 42B of 816B. Reflection's Beam activates 23B of 501B. That makes them cheaper per token to train and serve, and it pushes them out of reach of single machines, because memory scales with total parameters. The open models people actually run locally (Gemma 4, Qwen3.8-27B, gpt-oss-20b, Muse Glimmer 30B) are a separate, smaller class. That split is one reason "open" covers such different experiences.

Generating each token means reading all active weights from memory once. Bandwidth sets an upper bound. Actual speed is lower. This is why MoE models are popular locally. A discrete GPU, such as a 24 GB RTX 4090, has its own fast VRAM. The model must fit in VRAM to run fast; spilling to system RAM makes it far slower. Apple silicon Macs share one pool of unified memory between CPU and GPU, so a 64 to 128 GB Mac can load models no consumer GPU can. By default macOS limits how much of that memory the GPU can wire, roughly two-thirds to three-quarters of RAM. You can raise it with sudo sysctl iogpu.wired_limit_mb, leaving several GB for the OS and apps. The value resets on reboot. Check current guidance for your macOS version first.

Roughly usable memory for the model: about 12 GB on an 18 GB Mac, 22 GB on a 24 GB GPU, 24 to 27 GB on a 36 GB Mac, 45 to 48 GB on a 64 GB Mac, 96 GB or more on a 128 GB machine, and about 640 GB across eight 80 GB GPUs. Stretch options from the module: gpt-oss-20b (about 13 GB as shipped) on an 18 GB Mac with short context and a raised GPU limit; about 100B MoE at 3-bit on 64 GB; roughly 1T models at 4-bit, such as Mistral Large 4 (about 550 GB), on eight 80 GB GPUs. Model cards can ask for more than the math suggests. Muse Spark Open's 4-bit weights come to roughly 450 to 500 GB by the math above, but Meta's card asks for at least 700 GB of GPU memory, or two M5 Ultra Mac Studios. The leading frontier open models can't run on a laptop at useful quality. Most people use them through hosted providers. "Local" usually means a model one or two tiers smaller.

Ollama runs a local API on port 11434, and that command downloads about 14 GB the first time. LM Studio runs a local server on port 1234. llama-server gives an OpenAI-compatible endpoint on port 8080. vLLM is a high-throughput GPU server built on PagedAttention; serving gpt-oss-120b with it needs an 80 GB-class GPU. SGLang adds prefix caching and structured output, and several 2026 model cards recommend it. Clean up when you're done with ollama rm and the model name, or LM Studio's model manager. On tuning, open weights can be changed with LoRA, which trains small add-on matrices, or QLoRA, which does it on a 4-bit base so one GPU can fine-tune a large model. Common tools are Unsloth, Hugging Face TRL, and mlx-lm. Closed models can only be tuned through whatever service the lab offers. Module 02 covers tuning in depth.

Providers host open weights and charge per token. OpenRouter shows per-provider prices and routing. Differences between hosts come from quantization, chat templates, context limits, and tool-call parsing. If a model seems worse than its benchmarks, try the lab's own API or another host before giving up on it.

OpenCode reaches providers through the Models.dev catalog. Connect one with /connect and pick a model with /models. OpenCode also sells a curated-model subscription, OpenCode Go, from $10 per month. For Claude Code, Z.ai documents a settings file that sets the Anthropic base URL to its own endpoint and maps the Opus, Sonnet, and Haiku slots to GLM-5.3 models, for its GLM Coding Plan. Moonshot describes its Messages API as compatible with "the Anthropic SDK, Claude Code, and similar tools." DeepSeek's V4 API accepts both OpenAI and Anthropic formats. Anthropic's docs say it "doesn't support routing Claude Code to non-Claude models through any gateway." Features built around Claude's API can break: thinking blocks, tool formats, caching, effort settings. Kimi's docs, for example, say you must pass back the full assistant message, including reasoning_content, for multi-turn tool use. Codex CLI sets the local provider with oss_provider in ~/.codex/config.toml, and can use any compatible endpoint defined under model_providers. A local 20B to 30B model handles small, well-specified edits and explanations. It struggles with long multi-file agentic tasks that frontier models finish. Hosted frontier open models like Kimi K3.1 Pro and GLM-5.3 come much closer. Flat-rate coding plans from MiniMax, Z.ai, and others compete with Claude and ChatGPT subscriptions on price (module 12).

Where the weights came from and where the computation runs are separate questions. If you self-host, you own security, updates, and monitoring. Use safetensors, and avoid trust_remote_code unless you've reviewed the code. With a US or EU host such as Together, Fireworks, or Bedrock, data handling depends on the host, but model behavior is the same as the weights anywhere. DeepSeek's privacy policy says it stores personal data "in People's Republic of China"; check your company's policy before sending source code there. Among closed US labs, Anthropic offers US-only inference at 1.1 times the price on Claude 4.6 and later, and Fable-class models require 30-day retention. Behavior travels with the weights. CAISI found DeepSeek models repeated inaccurate Chinese Communist Party narratives four times as often as US reference models. Download weights only from the publisher's official repository, check hashes, and watch for "uncensored" or "abliterated" re-uploads. Self-hosting isn't automatically safer. It adds unpatched inference servers, endpoints exposed without authentication, files from unofficial mirrors, and no vendor abuse monitoring. An open model running an agent with shell access is as exposed to prompt injection as a closed one, sometimes more.

Closed frontier models are still months ahead on long tasks. Self-hosted data never leaves your infrastructure. For bulk jobs it's price per token; compare against Haiku 5.5 or GPT-6 Luna at $0.10 / $0.50 per million tokens, as of November 2026. With open weights you control the model, and it can't change under you, which matters for audits and regulated workflows. Closed means no hardware and no serving stack. The module has more rows. If closed-model safeguards block security research, go open or use a lab's verification program. To teach how models work, go open and small, ideally fully open like OLMo. If company policy bars a vendor's jurisdiction, use open weights from a trusted host, or a different vendor.

"A different place in the chain" is the pipeline in module 03: closed frontier first, open-weight leaders months later, then community derivatives. When you compare a self-hosted or per-token open model against a flat-rate plan, the module also points to my view in module 12 that subscriptions, not API billing, are what make heavy agentic use affordable.

On your own, check disk and memory with df -h and Activity Monitor or nvidia-smi. Pick a model from the "what fits where" table. Write three sentences comparing quality, speed, and privacy against the hosted model. Delete the model afterward with ollama rm and the model name. For teams, give each group two licenses from this module, one permissive and one custom. Each group answers the eight-question checklist for a SaaS tool with 2 million users and $30M in yearly revenue that hosts the model for customers. Groups present which models the product could use as-is, which need an agreement, and which are off the table. Then discuss: what surprised you, and which clauses would your legal team flag?

For question 2, ask people to list the risks each option addresses and the risks it leaves open. The privacy slide is the reference. For question 4, ask what evidence would settle it. The module has one more: if a lab's open model is safe today, what would have to be true for it to be safe to release one six months more capable?

The module page has every model card and license link. Re-read a model's license and card before you rely on anything in this deck; both change between versions.