Last of five on what the 2026 evidence says once you read past the announcement. The other four: the coding productivity data, the agent containment failures, the memory and grid ceiling behind the slowdown, and where the AI bill goes next.

GLM-5.3-Flash is a 320-billion-parameter multimodal model under an MIT license at $0.15 per million input tokens. Claude Fable 5.1 is $10. DeepSeek V4-Flash matches the fifteen cents and falls to about three tenths of a cent on an off-peak cache hit.

Part four ended on a bill that keeps climbing and an on-prem escape route that got more expensive, because the memory shortage raised the price of the hardware you would buy to leave. Open weight models are the other way out, and those prices are why people take it.

They are also the reason this piece is a checklist rather than a recommendation. Nothing in the open tier is hard to run. What is hard is answering the four questions a client will ask after you have already deployed it, and all four have answers you can get before you commit.

The full table behind this, sixty-two model families with licenses, sizes and prices, lives on the Model Atlas page and gets refreshed as things ship.

Check whether open weight models can do the work

Start with capability, because the other three questions do not matter if the answer here is no.

On the Artificial Analysis Intelligence Index, the highest-scoring downloadable models are GLM-5.3 at 45, Kimi K3 at 44, GLM-5.3-Flash at 42 and Qwen3.8-Max at 40, all from Chinese labs. The best American open-weight model is NVIDIA’s Nemotron 3 Ultra at 23. The frontier is still closed and still American, with Claude Fable 5.1 and GPT-6 Astra tied at 53.

Treat those as a tier rather than a ranking. The index was rescored under version 4.3, so the higher launch-day figures still circulating, GLM-5.3 at 60 and Nemotron 3 Ultra at 47.7, come from the previous version and do not compare.

The gap that decides deployments is not on that board. MiniMax M3 scores 80.5 on SWE-Bench Verified and 38.5 on Long-Horizon Terminal Bench, against single-task scores of 85 to 90 across the field. Open models finish individual tasks about as well as anything. They fall apart over long chains, and long chains are what agentic work is made of.

So the realistic shape is a split rather than a switch. High-volume, short-horizon work goes to the cheap tier. Long-running agents stay on a frontier model until those long-horizon numbers move. Ramp’s card data shows companies already doing this, with frontier models falling from 53 percent of token share in August to 45 percent in September as firms set defaults that route the easy work elsewhere.

Two efficiency results are worth more than any list price. DeepSeek V4.1-Flash posts Terminal-Bench 2.1 at 90.6 from eight billion active parameters. Xiaomi’s MiMo-V2.5-Pro uses 40 to 60 percent fewer tokens than comparable Western models for the same agentic result. Part four made the case that the unit you are billed in stopped matching the unit of work, and a model that finishes in fewer tokens is a discount that never appears on a rate card.

While you are in there, check the price rather than assuming it. The open tier is not uniformly cheap. Kimi K3 lists at $3 in and $15 out, which is parity with the middle of the closed American range, from a model under a revenue-gated license. Alibaba and MiniMax publish no per-token price on their own pages at all, and neither does Meta for its closed flagship. A blank cell is not a low number.

Check the license, because eight of them do not have one

Of the forty-four downloadable models in the atlas, twenty-five carry a plain Apache 2.0 or MIT license with no revenue test. Eleven carry conditions. Eight do not state terms clearly enough to classify from the vendor’s own materials.

The conditions bite at real thresholds. Kimi K3 requires a separate agreement with Moonshot above $20 million in aggregate revenue, plus prominent attribution in your interface above 100 million monthly active users. Mistral Medium 3.5 ships a Modified MIT license with a carve-out for large-revenue companies. Upstage’s Solar license is its own document and permits commercial use and derivatives anyway, which you would only know by opening it. NVIDIA’s OpenMDW-1.1 goes the other way and covers weights, data and recipes together.

The eight unstated are the ones to walk away from. Ant Group’s Ling-3.0-Flash, StepFun’s Step-3.7-Flash, Huawei’s openPangu-2.0-Pro and Shanghai AI Lab’s Intern-S1-Pro all ship weights without terms you can pin down. Huawei’s names no license at all. For anything that ends up inside a client contract, “the license is not stated” is an answer.

One distinction turns up in procurement documents written by people who do not know the difference. Open weights means you can download and run the parameters. Open source means you can rebuild the thing. Of the forty-four, one publishes the training dataset, the intermediate checkpoints and the training code: Ai2’s Olmo 3, on a 9.3-trillion-token corpus, with Olmo Hybrid following in March 2026 on the same terms. If a contract says open source and means open weights, fix the contract.

Check the provenance, because the model card will not tell you

Rakuten AI 3.0 is the largest model any Japanese company has released. Its configuration file declares "model_type": "deepseek_v3", with 256 routed experts and a vocabulary of 129,280 entries, matching DeepSeek-V3 exactly. Rakuten’s announcement says the model was developed by leveraging the best from the open-source community, which is accurate and is a different sentence from “we trained this.” The file sits in the root of the public repository and takes about ninety seconds to open.

This is normal rather than scandalous, and it is worth knowing which one you have. Yandex’s own engineering report says its flagship assistant was initialised from Alibaba’s Qwen3-235B. Singapore’s SEA-LION v4.5 is two series built on Google Gemma and Alibaba Qwen, with the license inherited from each and differing between them. Chile’s Latam-GPT is continued pretraining on Meta’s Llama 3.1. Across fifty sovereign programmes, thirty-six disclose a base model, and Llama accounts for roughly 40 percent of those.

There are three tiers here rather than two: a fine-tune of someone else’s base, a derivative of your own earlier base, and genuine from-scratch pretraining. LG’s K-EXAONE 2.0 was upcycled from LG’s own 236-billion-parameter model. Upstage’s Solar Open 2 came by selective weight transfer from Upstage’s own earlier 100B. India’s Sarvam went from a Mistral Small fine-tune to a 12-trillion-token from-scratch model covering 22 Indian languages in about ten months.

Origin matters here as a fact to establish, not as a verdict. The models built from scratch are a genuinely mixed group. SK Telecom’s A.X K2 trained on 8.2 trillion tokens entirely in FP8 under a Korean rule that banned foreign weights outright. UAE’s Jais 2 trained on 2.6 trillion tokens on Cerebras wafer-scale systems rather than a GPU megacluster. Mistral Large 3 is 675 billion parameters from Mistral’s own pretraining under Apache 2.0, and Mistral moved its flagship tier toward Apache across 2025 and 2026 while most vendors drifted the other way.

If a client asks where a model came from, the model card is marketing and the config file is evidence.

Check who is upstream, and know what the dispute is about

Labs have been accusing each other of training on each other’s outputs since at least 2023, when OpenAI suspended ByteDance’s API access over it. The practice has a name, distillation, and it is an intellectual property fight between vendors rather than a defect in the resulting weights.

In September that fight got a government document. The NSA, CISA and the FBI published a joint advisory titled “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies,” naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.

It is specific. On Z.AI: “By mid-2026, Z.AI had distilled billions of tokens of GPT-5.5 data and Claude Opus 4.8 data to develop the CoT reasoning capabilities of its model.” On Moonshot: “Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model.” StepFun, it says, “structured access around pools of accounts with employees running multiple concurrent sessions.”

Read who it is addressed to. Every recommendation in it instructs a model vendor on defending its own API: watch subscription-to-usage ratios for anomalous accounts, “subtly alter responses for suspected malicious distillation attempts,” and correlate activity across providers to surface distributed campaigns. It makes no claim that the resulting weights are unsafe to run, and it asks nobody to stop running them.

That distinction is the useful part. The concern on the record is about how these models were trained. It is not about what the weights do once they are on your hardware. Those are separate risks with separate controls, and conflating them will cost you either a good option or your credibility, depending on which way you get it wrong.

Borrowing also runs in more than one direction. Thinking Machines states in its own materials that it used Moonshot’s Kimi K2.5 to generate early post-training data. Tencent ships an attention mechanism it calls Gated DeepSeek Sparse Attention, naming a competitor in its own model card. Ant Group ships Kimi Delta Attention the same way.

One capability note belongs here rather than with pricing. Z.ai advertises GLM-5.3 at more than double its predecessor’s performance on exploitation benchmarks and emergent vulnerability discovery. That sits in weights anyone can download with no classifier in front of it, which is a different risk shape from the incidents in part two and deserves a decision before it goes in a lab.

Check what happens when something breaks

This is the question that decides most real deployments, and it has nothing to do with benchmarks.

American labs did not stop publishing open models. They stopped publishing large ones. Hugging Face’s Summer 2026 analysis found that “Google, Microsoft and IBM Granite record essentially none of their 2026 downloads above 70B, and NVIDIA and Meta only 14% and 9%,” against Moonshot at 88 percent. OpenAI’s open line has not moved since August 2025 while its closed line shipped three generations. Meta rebuilt on a closed flagship and its open release is the 30-billion-parameter Muse Glimmer. Google’s Gemma tops out at 31 billion.

What filled the gap is visible in what people build on. Hugging Face counts 151,448 Qwen-derived models against roughly 32,000 in the Llama family, growing at 180 to 210 new repositories a day. Qwen pulls 39.6 million GGUF downloads a month against Llama’s 7.5 million.

The labs selling support rather than scores tell the other half of the story. AI21 cut headcount by more than 60 percent in May 2026 and stopped selling models, saying it was not a sustainable revenue stream. Aleph Alpha was absorbed by Cohere in April. Cohere, the healthiest of the sovereignty-positioned labs, takes about 85 percent of its revenue from private deployments rather than from its API.

That last number is the one to keep. What enterprises are paying for is a deployment someone stands behind, which is a service an MSP can actually deliver, rather than a model that wins a leaderboard, which is not.

The argument runs the other way too, and it is the strongest case for holding weights that has nothing to do with price. OpenAI’s deprecation policy gives at least six months’ notice on generally available models and as little as two weeks on preview models, with a large retirement wave landing on 23 October 2026. A model you downloaded cannot be retired out from under a production system on a fortnight’s notice. Tencent’s Hy4-preview is the most-used open model in the world by tokens processed on OpenRouter, 770 billion parameters under Apache 2.0 with no commercial restrictions, and nobody can take it off you.

What I would deploy

Pick by the constraint you are under, because nothing wins all four.

Lowest cost per finished task. GLM-5.3-Flash or DeepSeek V4-Flash, both MIT, both at fifteen cents per million input tokens. Confirm your client’s position on model origin before you build, and have the September advisory and what it actually says ready rather than being surprised by it in a meeting.

License certainty for work that lands in a contract. IBM Granite 4.2 is Apache 2.0, cryptographically signed, with IP indemnification, and the 8B performs close to the 30B. Indemnification answers a procurement question that a benchmark score does not. Cohere’s Command A+ is Apache 2.0 and built for air-gapped deployment on two H100s.

Runs on hardware you already have. OpenAI’s gpt-oss-120b fits on one 80GB GPU and gpt-oss-20b in 16GB, both Apache 2.0. Meta’s Muse Glimmer does end-to-end agentic work on a single consumer GPU at about 20GB quantized. All three are a generation behind, and for classification, extraction and routing that does not matter.

You have to show an auditor what went in. Olmo 3, and then the list ends.

For most teams the answer is not one model, it is a routing rule. Classification, extraction, summarisation and first-pass code review go to the fifteen-cent tier. Anything that runs unattended for an hour stays on a frontier model until the long-horizon scores move. Write the rule down, because the alternative is every engineer picking a default and nobody being able to explain the bill.

Whatever you pick, open the license file rather than reading the badge on the model card, and open the config file rather than reading the announcement. Both take a minute and both are the difference between an answer and a guess when somebody asks.

Where the series lands

Five parts, and the same thing kept happening in each. The productivity gain from AI coding tools tracked how well the developer already knew the code rather than how good the model was. Four of five agent containment failures ran on misconfigurations and public CVEs rather than anything novel. The slowdown the labs asked for was already being enforced by memory suppliers and a grid operator in Texas. The price increases arrived as quota changes instead of as numbers on a page.

This one ends the same way. The cheap alternative to the frontier bill is real and it works, and almost everything that will go wrong with it is written down somewhere in the repository before you download it.

Rakuten’s config file has been sitting in public the whole time, all 129,280 vocabulary entries of it.