本周 Claude Mythos 模型的发布，以及其声称的、尤其在网络安全领域极为强大的能力，引发了一波新的反对开源权重模型的论调。该论点的核心大意是，我们的数字基础设施将无法及时为这款模型的开源权重版本做好准备，而该版本将使得多方能够发起攻击。
在 Mythos 消息传出后，对开源模型的反对声浪，将太多普遍存在的未知因素混为一谈，并简单化为一项宽泛的政策建议，而这实际上可能进一步削弱网络安全的准备状态。
我们以前就经历过这种情况——2019 年 OpenAI withheld GPT-2 权重时，以及 2023 年 OpenAI 发布 GPT-4 时，开源权重模型都曾被讨论为极其危险。这两波浪潮都来了又去。当前犯下的核心错误在于将两个问题混为一谈：1）认为开源与闭源模型之间的差距是静态不变的；2）将开源权重模型的可行性普遍地与特定问题挂钩。
我最近已详细撰文，阐述我认为在未来，最优秀的前沿级开源权重模型在整体能力上将会落后于最好的闭源模型。我也写过开源权重生态系统需要如何适应并接受这一现实。这是 AI 行业中一个我会反复强调的时刻：一项能力在闭源实验室中可用，到它在开源领域中被复现，这中间存在 6 到 18 个月的延迟，这完全是件幸事。这是在安全性与对 AI 系统前沿的监控之间取得的良好平衡，同时也能让一个有用的开源生态系统得以存在并蓬勃发展。
我在开源与闭源模型时间差问题上关注的核心论点，一直在于通用能力——即面向通用目的的前沿模型，例如 Claude Opus 4.X 或 GPT Thinking 5.X。这些闭源模型作为智能体在多样化场景中稳健解决问题和执行任务的能力，仍然超出了最佳开源权重模型的能力范围。开源权重模型通常更擅长的，是在关键基准测试上快速跟进（诚然，这在某种程度上得益于知识蒸馏，但并非实质性依赖）。而这场讨论则完全不同，它关乎开源权重模型能否在网络安全相关的特定技能上保持同步，以及我们何时能预期这类模型的开源版本面向全球开放。
在我看来，达到 Claude Mythos 级别的开源权重模型这一案例，确实比社区此前经历过的几种反开源权重叙事更为微妙。如果说 GPT-4 关乎一种更偏假设性的风险（尤其是在生物风险等领域），那么网络基础设施易受攻击这一清晰且现实的威胁则要具体得多。不过，当前这种微妙性很大程度上源于我们既不清楚该系统实际能做什么的全部细节（即 Mythos），也不了解它将运行的环境状态（即我们的数字基础设施）。
要正确评估这一风险，我们需要了解构建和部署一个 Claude Mythos 级别模型需要什么。这包括三个部分：1）训练并发布模型权重，2）为模型提供其知晓如何使用的有效工具的配套框架，以及 3）推理所需的算力与软件。
（下文我会做一些模型规模与价格估算，以展示我的思考过程，这些不应被视为绝对事实。）
目前对 Claude Opus 4.6 或 GPT 5.4 等领先模型的规模估算，其参数量大约在 3 万亿到 5 万亿之间。当前最大的开源模型（主要来自中国实验室）参数量约为 1 万亿。Claude Mythos 的预览定价是 Opus 的 5 倍，这可能是由活跃参数量的简单倍增（采用相同的服务系统设计）、远更高的推理时扩展、使推理效率降低的更复杂控制机制、更低的利用率预期等多种因素共同导致的。最简单的猜测是，这是上述所有因素的混合结果——参数量大约增大 2 倍，且服务效率低得多。这是一个巨大的模型，很可能与 GPT 4.5 类似，但后训练做得很好（GPT 4.5 在基础设施方面是超前的）。
规模带来了训练模型的实际挑战，因为更大的模型总会带来新的技术问题，必须解决这些问题才能解锁其能力。就网络安全领域而言，我的猜测是，大部分能力可以通过训练一个在编程方面达到超人类水平的模型来习得。与知识工作、医学、法律等某些能力不同，编程可以通过 GitHub 等公开数据进行研究和大幅提升。我更为乐观地认为，在代码执行和处理等狭窄领域，开放权重模型能够与前沿模型保持相当接近的水平，但我并不完全了解在网络安全理解方面达到超人类水平所需的全套技能。训练 Claude Mythos 投入了多少专业知识与独门技术？这是我对其影响评估存在较大误差范围的主要原因。
其次，我们对模型内部运作机制一无所知。如今，模型是复杂的系统，其内涵远不止权重本身。它们需要复杂的工具和基础设施来运行，Claude Code 是我们最熟悉的一个。Mythos 很可能在这方面有自己的创新。
我对服务一个 8T 参数、现代 MoE 架构模型所需 GPU 数量的估计大约是 O(100) 块 H100 GPU，每天成本约 1 万美元（而且按 token/秒计算可能非常慢）。甚至，Nvidia GB200 VL72 系统的官方营销文案就是“在机架上实现实时万亿参数模型”。Mythos 能装进一个机架吗？重点不在于把我的具体估算当作政策参考，而是要重申：运行领先的 AI 系统极其昂贵，不是随便在笔记本电脑或自助云门户上就能做到的事。
与能下载模型的人相比，能够获取这些资源的行为者要少得多。当然，仍然有很多，但详细说明扩散 Mythos 这类模型能力所需的所有细节非常重要。总之，像 Mythos 这样的工具会让最顶尖的攻击者拥有更强大的攻击手段，但并不会把核武器交到每个联网的青少年手中。
就我个人而言，我确实承认存在一种可能性：网络安全滥用是一条红线，使得发布超过一定能力阈值的开放权重文本模型在道德上变得模糊。许多人曾以为这条红线会来得更早，大约在 GPT-2 到 GPT-4 之间，通过虚假/错误信息这一危害维度体现，但那条路径存在不同的瓶颈。对于图像生成模型，我们早已跨过了第一条红线——即利用现成的开放权重模型制作非自愿的 AI 深度伪造。我们正在平衡这些恐惧曾经出现又消退的现实，以及一项能力日益增强的技术。
因此，我的第二个主要误差来源是：就网络安全现状而言，“实际情况到底有多糟”？人类在最重要的软件上，利用像 Claude Mythos 这样的模型进行数月的私有访问，能清理多少问题？哪些问题永远无法修复？
例如，如果我们获得了能力接近 Claude Mythos 的开放权重模型，这些模型能否被组织微调，以加强其工具的安全性？
目前，以此为由全面叫停开源模型的发展还为时过早。当 Claude Mythos 仅对极少数合作伙伴开放时，从某些角度看，拥有接近阈值的强大开源模型反而更容易评估风险。完全依赖一家私营公司来决定关键国际基础设施的安全，并非可持续的平衡状态。
因此，我呼吁大家进一步研究以下三个问题：
如何衡量开源与闭源模型在网络安全相关能力上的差异？基于此，开源模型是否真的以 6 至 9 个月的滞后时间持续追赶，还是仅在编程的其他领域保持性能相关性？
如何独立衡量 Claude Mythos 和 Project Glasswing 对现有网络安全问题的实际影响？
如果模型确实在持续追赶，而 Claude Mythos 的防御能力又较弱，我们该如何更好地监控（并在必要时尝试监管）开源权重模型在狭窄领域内的特定能力？
目标是让对开源模型的担忧保持高度具体化。任何国家若对开源模型实施全面禁令，将立即且很可能不可逆转地削弱该国对这项关键且形态多变的技术的影响力。如果我们停止在美国打造最优秀的开源模型，那么其他国家就会接手，并成为该技术的中心。开源模型无法被彻底扼杀，只能去影响、理解和引导。
With the announcement of the Claude Mythos model this week and the admittedly very strong stated abilities, especially in cybersecurity, a new wave of anti open-weight AI model narratives surged. The TL;DR of the argument is that our digital infrastructure will not be ready in time for an open-weight version of this model, which will allow attacks to be conducted by numerous parties.
The backlash against open models in the wake of the Mythos news conflates too many general unknowns into a simple, broad policy recommendation that could actually further weaken cybersecurity readiness.
We’ve been here before – open-weight models were discussed as being extremely dangerous when OpenAI withheld GPT-2 weights in 2019, and when OpenAI released GPT-4 in 2023. Both of these waves came and went. The core mistake that is being made is the composition of two issues: 1) the acceptance of the open-closed model gap being static in time and 2) linking open-weight viability generally to specific issues.
I’ve written at length recently on how I think that the best, frontier-level open weight models are going to fall behind the best closed models in overall capabilities in the near future. I’ve also written about how the open-weight ecosystem needs to adapt to accept this reality. This is one of the times for the AI industry where I will repeat that it’s a total blessing to have the 6-18 month delay from when a certain capability is available within a closed lab to it being reproduced in the open. It’s a good balance of safety and monitoring the frontier of AI systems while allowing a useful open-source ecosystem to exist and thrive.
The core argument I’ve focused on in the open-closed model time gap has been in general capabilities – i.e. for general purpose, frontier models such as Claude Opus 4.X or GPT Thinking 5.X. The abilities of these closed models to robustly solve and work in diverse situations as agents remains out of scope of the best open-weight models. What the open-weight models have tended to be better at is quickly keeping pace on key benchmarks (which admittedly is helped to some extent, but not necessarily substantially by distillation). This discussion is entirely different, it has to do with if open weight models can keep pace on the specific skills related to cybersecurity, and when we could expect an open version of this model to be available to the world.
The case of a Claude Mythos level open weight model is admittedly more nuanced to me than the previous few anti-open weight narratives the community has experienced. Where GPT-4 was about a more hypothetical risk, especially in areas like bio-risk, the clear and present reality of cyber infrastructure being prone to attack is far more tangible. Still, much of this nuance in the moment comes down to not knowing the full details of what the system can actually do (i.e. Mythos), and the state of the environment it would act in (i.e. our digital infrastructure).
To properly assess this risk, we need to know what it takes to build and deploy a Claude Mythos scale model. This entails three pieces: 1) training and releasing the weights, 2) the harness that gives the model effective tools it knows how to use, and 3) the inference compute and software.
(Below I make some model size & price estimates to show my thinking, these should not be taken as ground truth.)
Current estimates put the size ranges of leading models like Claude Opus 4.6 or GPT 5.4 as being around 3-5T parameters. Currently, the largest open-source models, which have been coming from Chinese labs, are around 1T parameters. Claude Mythos’s preview pricing is 5X Opus, which could come from a simple multiplicative increase in active parameters (with the same serving system design), far higher inference-time scaling, more complex harnesses that make inference less efficient, lower utilization expectations, and so on. The simplest guess is that it’s a mix of all of the above, something like 2X bigger in parameters and much less efficient to serve. That’s a huge model, likely something similar to GPT 4.5, but actually post-trained well (GPT 4.5 was ahead of its time, infra-wise).
With size comes the challenge actually training the model, as bigger models always come with new technical problems that must be solved to unlock the capabilities. For the case of cybersecurity, my guess is that most of the capabilities can be learned by training a model to be superhuman on coding. Unlike some capabilities such as knowledge work, medicine, law, etc., coding can be studied and improved substantially with public data like GitHub. I’m far more optimistic in open-weight models staying fairly close to the frontier in narrow domains of code execution and processing, but I don’t understand the full scope of skills needed to be superhuman in cybersecurity understanding. How much expert knowledge and special sauce went into training Claude Mythos? That’s a substantial source of my error bars on the impact.
Second, we know nothing about how the model works under the hood. Today, models are complex systems that entail far more than just weights. They require complex tools and infrastructure to run them, of which Claude Code is the one we are most used to. Mythos very likely has its own innovations here.
My estimate for how many GPUs you’d need to serve an 8T parameter, modern MoE is something like O(100) H100 GPUs, which costs something like $10K a day (and this may be very slow in terms of tok/s). Heck, the official marketing copy of the Nvidia GB200 VL72 system is “Unlocking Real-Time Trillion-Parameter Models” on the rack. Does Mythos fit on one rack? The point isn’t to rely on my specific estimate as a policy reference, but to repeat that running leading AI systems is very expensive and not something you can just do on a laptop or self-service cloud portals.
There are far fewer actors who can get their hands on these resources, relative to those who can download the model. Of course, there are still many, but it’s important to flesh out all the details of what it would take to proliferate the capabilities of a Mythos-like model. In summary, tools like Mythos will make the best attackers have more powerful tools of the trade, but it won’t be handing a nuke to every teenager connected to the internet.
Personally, I do acknowledge there’s a chance that cybersecurity abuse is a red line that makes releasing open-weight text models above a certain capability threshold morally grey. Many people thought this red line would come far earlier, somewhere in between GPT-2 and GPT-4, through the harm axis of mis/disinformation, but that had different bottlenecks. For image generation models, we’re well past the first red line which is enabling non-consensual AI deepfakes with readily available open-weight models. We’re balancing the reality of these fears having come and gone before with a technology that’s becoming increasingly capable.
So, my second large source of error bars is “how bad is it actually” with respect to the state of cybersecurity. How much can humans clean up in the most important software with months of private access to a model like Claude Mythos? What will never get fixed?
For example, if we get open-weight models that are close to the capabilities of Claude Mythos, could those be fine-tuned by organizations to harden the security of their tools?
Currently, it’s too soon to call it as a general reason to stop progress in open models. When Claude Mythos is closed to so few partners, in some ways having strong open models close to the threshold makes assessing the danger easier. Having to rely fully on a single private company to determine the security of essential, international infrastructure is not a tenable equilibrium.
So, in conclusion, I urge people to further study three things:
How do we measure cybersecurity related capabilities across open and closed models. With this, are open models truly keeping up at a 6-9month lag, or are they only maintaining performance relevance in other areas of coding?
How do we independently measure the true impact of Claude Mythos and Project Glasswing on existing cybersecurity concerns?
If it is the case that the models are keeping up and the defensive capabilities of Claude Mythos are weak, how do we better monitor (and if needed, try to regulate) the targeted capabilities of open-weight models in narrow domains?
The goal is to encourage fears about open models remaining very specific. Any general ban on open models in a nation will immediately and likely irrevocably remove that entity’s ability to influence a crucial, and amorphous technology. If we stop building the best open models in the U.S., then another country will do this and become the center of the technology. There’s no way to fully kill open models, only influencing, understanding, and steering.