Dario Amodei Clarifies Anthropic’s Stance on Open-Weights Models and Proposes Targeted AI Security Measures

Dario Amodei Clarifies Anthropic’s Stance on Open-Weights Models and Proposes Targeted AI Security Measures Anthropic CEO Dario Amodei stated that the company has never advocated for a ban on open-weights models, arguing that blanket bans fail to mitigate core national security risks and instead urging export controls, distillation curbs, and mandatory pre-release safety evaluations. Anthropic rejects claims that it seeks to ban open-weights models, describing models lacking dangerous capabilities as a public good for developers, researchers, and businesses. Amodei outlines two primary security concerns: authoritarian regimes developing superior AI for military dominance and repression, and powerful models enabling cyber or biological attacks. Rather than banning open weights, Amodei supports restricting chip sales and smuggling to China, stopping state-backed model distillation, and requiring safety testing for all sufficiently capable models. National Security Concerns and Ineffectiveness of Bans Addressing recent speculation and accusations, Amodei emphasized that Anthropic has never advocated banning open-weights AI models, which he considers a public good when free of dangerous capabilities. He argued that protectionist measures prohibiting US firms from using foreign open models do nothing to solve major national security threats. The primary risk is that authoritarian governments like the Chinese Communist Party might develop frontier models surpassing the US to achieve military dominance or enhance domestic surveillance, regardless of whether those models are open or closed. The secondary risk involves bad actors misusing frontier models for cyber or biological attacks, an issue that banning legitimate US business usage fails to prevent. Three Proposed Policy Interventions To address national security and misuse threats, Amodei proposed three specific actions. First, the US should block sales of advanced chips and semiconductor manufacturing equipment to China while aggressively penalizing smuggling, thereby preventing adversaries from scaling superior models. Second, policymakers should target industrial-scale distillation operations that enable foreign actors to build high-performing models with fewer chips and approach the US frontier. Third, governments should implement mandatory pre-release safety testing for cyber, biological, and alignment risks on all sufficiently capable models, whether open or closed, while exempting less capable models from startups and academia. Critique of the Tech Industry Open Letter While agreeing with parts of an industry open letter regarding the economic and competitive value of open weights, Amodei challenged the claim that open models inherently favor defenders over attackers. He cited biological risks as a significant attacker-defender asymmetry, noting that advanced models could allow malicious actors to rapidly weaponize pandemic pathogens using common materials, whereas developing defensive countermeasures remains a complex, multi-year operational endeavor. Consequently, he argued that safety and defensive efficacy must be demonstrated empirically through pre-release testing rather than assumed by default.

Anthropic 澄清对开放权重模型的立场：从未主张全面禁令，倡导聚焦芯片、模型蒸馏与安全测试 针对有传言称美国官员考虑禁止美企使用中国开放权重模型并引发对 Anthropic 的相关指责，Anthropic 首席执行官 Dario Amodei 发表声明，澄清公司从未倡导禁止开放权重模型，保护主义禁令无法解决真正的国家安全威胁，并提出了三项切实可行的监管主张。 Dario Amodei 明确表示 Anthropic 从未主张禁止开放权重模型，不含危险能力的开放权重模型属于公共产品。 Amodei 认为禁止美企使用相关模型无法解决威权政府获取超越美国的 AI 能力，也无法阻止网络攻击或生物滥用等核心安全风险。 Anthropic 主张采取三项措施：严禁向中国出口高端芯片及设备并打击走私、打击工业级模型蒸馏行为、对所有具备足够能力（无论开源或闭源）的模型实施强制安全测试。 Amodei 部分赞同支持开放权重的行业公开信，但质疑其关于“开放权重利于防御者”的假设，指出生物风险领域存在显著攻防不对称。 澄清立场与核心安全担忧 针对外界关于 Anthropic 试图借禁令保护商业利益的指责，Amodei 强调开放权重模型能为企业和研究人员提供价值。他指出现阶段核心国家安全威胁主要有两点：一是威权政府可能开发出比美国更强的 AI 并用于军事优势和内部镇压；二是强大模型被滥用于生物袭击、网络攻击或出现对齐失控。由于恶意行为者极少为合规的美企，禁止美企使用此类模型无法防范上述风险。 替代禁令的三大政策主张 为应对上述威胁，Amodei 主张：第一，严格限制向中国销售先进芯片与制造设备，并打击走私和绕过禁令的渠道，借助算力法则阻断模型赶超；第二，打击工业级蒸馏操作，防止威权国家借此在芯片受限情况下快速缩小与前沿模型的差距；第三，对所有达到高能力阈值的模型实行发布前强制安全测试，无论其来自哪个国家、是开放还是闭源。 对行业公开信的回应与测试前置原则 Amodei 认同近期科技公司公开信中关于开放权重模型促进竞争和客户控制权的看法，但反对信中“开放必定有利于防御方”的预设。他指出在生物武器领域存在严重的攻防不对称，模型可能短期内被用于武器化病毒，而建立防御机制则需数年。他认为开源模型的实际风险与缓解能力应通过严格的发布前测试实证确定，而非凭空假设。

*A post by Dario Amodei, Anthropic CEO* Over the last few days there has been a lot of discussion about open-weights models, especially those from China. Reports suggest that some US officials are [considering banning](https://www.axios.com/2026/07/20/ai-us-china-open-source-kimi) the use of Chinese open-weights models by US companies. In response, many tech companies have signed [a letter](https://x.com/JensenHuang/status/2080643682408321103) supporting open-weights models, and some people have even accused Anthropic of wanting to ban open-weights models as a means of protecting our business. Anyone who has read my past writing should know that I don’t regard such bans as a useful measure, but let me state it clearly so that there is no doubt: **Anthropic has never advocated for a ban on open-weights models.** Open-weights models that don’t have dangerous capabilities are a public good: they don’t cost anything besides the compute needed to run them, and they provide value to businesses, developers, and researchers. Protectionist bans would not address my most serious national security concerns. Specifically, I am worried about two nightmare scenarios. I laid these out in my essay [*The Adolescence of Technology*](https://darioamodei.com/essay/the-adolescence-of-technology) six months ago¹, and have held these positions consistently for many years: 1. My primary concern is the risk that authoritarian governments—not solely the Chinese Communist Party (CCP), although the CCP is clearly the most capable threat—build AI models that are more powerful than those built by the US, and use them to achieve permanent military superiority or perpetrate incredibly deep repression of their own people. This concern is widely shared within the US government: Vice President Vance [warned](https://www.presidency.ucsb.edu/documents/remarks-the-vice-president-the-artificial-intelligence-action-summit-paris-france) in Paris last year that “authoritarian regimes have stolen and used AI to strengthen their military, intelligence, and surveillance capabilities,” and the Intelligence Community’s [2026 Annual Threat Assessment](https://www.dni.gov/files/ODNI/documents/assessments/ATA-2026-Unclassified-Report.pdf) found that “other global powers’ robust progress in AI is challenging US economic competitiveness and national security advantages.” It is irrelevant whether these models are released with open weights, and certainly irrelevant whether they are used by US businesses. In fact, the most dangerous model may be one that is trained in secret and handed only to the People’s Liberation Army for use in drones and the Ministry of State Security for surveillance and repression. 2. My secondary concern is the risk that powerful AI models may be misused to carry out cyberattacks or biological attacks, and may have [serious alignment problems](https://time.com/article/2026/07/24/openai-hugging-face-attack/). Open-weights models—it does not matter whether they come from China or anywhere else—do potentially present a higher risk than closed models, because it is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn². But banning the use of these models by US businesses does nothing to address this risk, because bad actors are unlikely to be legitimate US businesses. It *would* protect US AI companies from competition, but that has never been my goal. To address these concerns, I *do* support the following three measures, which I and Anthropic have consistently advocated for: - **We should not sell powerful chips or chipmaking equipment to China**, and we should crack down on the rampant [smuggling](https://www.justice.gov/opa/pr/three-charged-conspiring-unlawfully-divert-cutting-edge-us-artificial-intelligence)³ and workarounds used to obtain access to such chips. China has limited domestic production capacity, and therefore, due to the [scaling laws](https://arxiv.org/abs/2001.08361), cannot build more powerful models than the US without US chips. This is the most efficient and direct way to block threat #1, and by hampering the training of models that are out of reach of US law, it also indirectly helps with threat #2. - **We should crack down on industrial-scale [distillation operations](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks).** Distillation is a much more compute-efficient process than training models from scratch. It allows China to build much better models than its number of chips would ordinarily enable, and thus partially evade chip bans. Distillation does not allow the CCP to obtain equivalent or superior AI capabilities to the US, but it can bring the Chinese frontier to within a [few months](https://www.anthropic.com/research/2028-ai-leadership) of the US frontier. It is true that many of the companies carrying out these operations release open-weights models—but the open weights are far less relevant than the fact that the operations are backed by an authoritarian state seeking to overtake the US at the frontier. We should have policy interventions to deter this behavior. A blanket ban on open-weights models is neither the correct remedy nor something we have called for⁴. - **All sufficiently capable models, open and closed, should go through mandatory safety testing.** The best way to address threat #2 is to just directly test models for cyber, biological, and alignment risks before release. I think this idea is actually close to a consensus: I have been heartened both that the Trump administration has moved in this direction in recent months, and by [recent industry proposals](https://demishassabis.substack.com/p/a-framework-for-frontier-ai-and-the-dawning-of-a-new-age) that would apply such testing to the most capable models regardless of their country of origin or whether they are open or closed (while exempting less capable models, such as those from startups and academia, entirely). Whether open models do or don’t pose an increased risk, and whether that risk can be mitigated, is something that should emerge from testing, rather than be decided in advance—and there may be promising methods for improving the safety of open-weights models, including recent research from AE Studio and Anthropic on [modular training strategies](https://alignment.anthropic.com/2026/modular-pretraining/). Note that to be effective, testing would need to be global, which means even the CCP would need to be on board. I think this may actually be possible: as I wrote in *The Adolescence of Technology*, limited cooperation around preventing AI biological weapons may be possible because it is in China’s interest too. This brings me to the [open letter](https://images.nvidia.com/pdf/Open-Weights-and-American-AI-Leadership.pdf). I agree with much of it: open weights expand access to the AI economy, they strengthen competition at least for some use cases, and they give customers greater control. Concerns about distillation should be addressed through targeted legal and commercial frameworks—the same measure I described above. But I don’t agree with the letter’s assertions that open-weights models necessarily make it easier to develop safeguards or that broad access to capabilities necessarily helps defenders more than attackers. It seems at least as likely to me that the opposite will be true. For example, I worry that biology will have a strong attacker-defender asymmetry, where sufficiently capable models may be able to quickly weaponize pandemic-level viruses with widely available materials, whereas defense against these agents is a multi-year operational task in the best case (as we saw with Operation Warp Speed)⁵. Questions like this should be empirically answered by rigorous pre-release testing, not assumed in advance. To summarize my and Anthropic’s position, we have not and are not advocating for a ban on open-weights models as a category. We should instead focus on keeping powerful chips out of authoritarian hands, stopping industrial-scale distillation, and requiring safety testing of all sufficiently capable models, open and closed. *\*Edit 28 July: Updated to note that the cited research on modular training strategies was a collaboration between Anthropic and [AE Studio](https://ae.studio/).*