From Compute to Congress: Our Open Source Blind Spot

In a follow up to the June 2 Executive Order 14409 Promoting Advanced Artificial Intelligence Innovation and Security, the White House has previewed a security framework that would assess the cybersecurity risks of cutting-edge AI models, with a focus on frontier models like Mythos. Frontier labs have been splashed across headlines over the last several months, from gated models with cyber capabilities that exceed current safety thresholds to security incidents where agents gain unauthorized access to live, customer environments.

Meanwhile, the underdogs of this ecosystem, open weight models, are catching up to frontier capabilities and shaping the surrounding landscape. Case in point: the recent OpenAI-Hugging Face security incident required Hugging Face’s security team to enlist an open weight model, GLM 5.2, to support its cyber defense posture. GLM 5.2 is developed by Z.ai, a prominent Chinese artificial intelligence company spun out of Tsinghua University. Still, the White House has waffled over whether open source and open weight models are exempt from this framework, or subject to its capability evaluations.

The Evaluation Gap

Understanding the cyber capabilities of frontier and open models alike is one of Dreadnode’s top priorities. Institutions like the UK AI Security Institute (AISI) and the US Center for AI Standards and Innovation (CAISI), along with several universities, have published evaluations benchmarking an assortment of closed and open models. But those evaluations cover a patchwork. Open weight models are frequently excluded, American ones especially, and the tasks rarely reflect how an operator actually works: multi-stage engagements, real infrastructure, imperfect information, and a cost ceiling.

To address this, Dreadnode developed DreadIndex, an offensive cybersecurity evaluation index for language models. It’s a composite of public and private evaluation tasks designed to determine real-world cyber capabilities along with cost and refusal behavior. Three American-origin open models were recently added to the benchmark: Poolside’s Laguna S 2.1, Thinking Machines’ Inkling, and Arcee’s Trinity Large Thinking.

All three scored lowest on the leaderboard. On the same task set, Chinese open weight models significantly outperform their US equivalents, and they’re catching up to frontier models with rapid succession.

It’s clear that we need greater U.S. investment in domestic open source AI. In fact, broad consensus across academia and industry demands it, as highlighted by the American Truly Open Models (ATOM) Project. What remains unclear is how to secure this ecosystem, particularly when top-performing open models are developed in China yet leveraged to support U.S. national security interests.

How model gating impacts the competitive edge

One approach to AI security that is gaining popularity involves model gating, which restricts access to high-risk AI capabilities through user verification and usage vetting. In industry, this manifests as trusted access through identity checks and organization-specific approvals; in government, it takes the form of vetted model registries and closed-door capability evaluations.

The Case for Gating: Safety, Standards, and Strategic Advantage

• Preventing dangerous capability diffusion: Some emerging capabilities may pose serious risks if released without controls, particularly at the intersection of AI and cyber, bio, or chemical domains. Verification allows government and industry to identify who is deploying these capabilities and for what purpose, and to intervene when misuse is likely.
• Delayed proliferation to adversaries: Federal evaluation windows and mandatory safety reviews delay foreign adversaries from acquiring high-risk dual-use capabilities. While state actors may eventually replicate advanced architectures, government-enforced gating imposes significant time and capital costs on competitors and buys domestic cyber defenders a critical window to deploy safeguards.
• Exporting American standards: At the commercial level, American hyperscalers and frontier labs enforce identity checks and usage tiering for API access. Because global software development relies heavily on U.S. cloud infrastructure, private sector gating can act as an engine for tech diplomacy. At best, the U.S. could set standards for AI-enabled capabilities by forcing international enterprises to accept U.S. compliance and logging standards to access top-tier capabilities, similar to how the E.U. steered global data practice through GDPR.

The Case Against Gating: The Open Ecosystem We Would Cede

• Loss of U.S. software dominance: If the U.S. restricts or over-regulates open weight models, it creates a massive global supply vacuum. Foreign developers, startups, and international enterprises will instantly pivot away from restricted U.S. platforms. They will adopt unrestricted, highly capable foreign open weight alternatives, such as China’s rapidly advancing GLM or DeepSeek series.
• A dual penalty on domestic defenders: While foreign enterprises can download raw weights locally to build hyper-efficient, customized, zero-cost AI agents, American companies would face a dual penalty. They would pay high API premiums to a small domestic tech oligopoly and navigate slow, bureaucratic identity-vetting pipelines just to stay operational. And that domino effect would hit cybersecurity teams the hardest.
• Platform-level fragmentation: Open source thrives on global, borderless collaboration. Strict U.S. identity-gating rules applied to platforms like Hugging Face or GitHub could push developers and hosting toward non-aligned foreign hubs, exporting engineering talent and platform infrastructure abroad. Put simply, a policy that verifies frontier API access may be defensible where a policy that requires identity registration to publish an open weight model is not.

Our Perspective: Beyond Gatekeeping

The U.S. must decide whether its AI policy advantage will emerge from dominance through centralization or dominance through proliferation. The former will posture towards controlling the world’s most powerful closed cloud endpoints via gated infrastructure. The latter will emphasize foundational architecture, upon which the global internet depends, that is built on American-made open source software.

Restricting cyber-capable open weight models directly undermines U.S. security. Frontline cyber defenders increasingly rely on cost-efficient Chinese open models because proprietary domestic frontier models suffer from high refusal rates on dual-use security tasks. As the global market rapidly adopts scalable Chinese open weights, the U.S. can either choose to participate in the open weight market or build domestic alternatives that out-compete it.

It would likely best serve U.S. interests to develop a security layer that monitors AI systems for alignment with national security interests, which would need to be defined. That security layer should extend beyond capability evaluations to model assurance, understanding not only what a model can do, but whether the model itself can be trusted. Combining adversarial AI red teaming with introspective scanning of model assets can help identify backdoors, malicious modifications, supply chain risks, and other threats that behavioral evaluations alone may not reveal. This protocol would be best informed through public-private partnerships, so training data is representative of the digital ecosystem and therefore best positioned to defend against the mounting cyber threats to American infrastructure. Washington must make a choice: Fund American open weights or cede the defensive baseline to Beijing.