Master the Mix

The one-sentence answer

For an operator, the open-weight question is not which model is smartest. It is what owning the model layer unlocks: cost you can predict, data you can keep, and a price and a place to run that you actually get to choose.

The leaderboard answers a different question. It answers the coder's question. That question matters, but for a founder running a company it is the second question, not the first.

Why operators read the leaderboard backwards

OpenRouter published a clean piece in June 2026, "The Open-Weight Models That Matter." It ranked four models on the Artificial Analysis Intelligence Index and on a coding benchmark. GLM 5.2 on top. Nemotron 3 Ultra, MiniMax M3, and DeepSeek V4 Flash behind it. Good data, honestly presented.

But read it as a founder and the ranking inverts. You are not shipping a coding agent. You are running a company. The question that actually pays rent is not "which of these scores highest." It is closer to this: where can I move expensive, repetitive, sensitive work off a metered frontier API and onto a model I control, without giving up the quality the work actually needs?

That is a cost question, a data question, and a lock-in question. Coding capability is one input. It is not the frame.

So this piece keeps the four models OpenRouter chose, adds the parts of the landscape it left out, and reads all of it for the operator. The smartest model is rarely the one you should reach for first. The one you own usually is.

The four models, read for what they do for you

Here is OpenRouter's slate, re-columned. The intelligence score stays, because it is real signal. But the column that should move your hand is the last one.

Two notes before you read anything into the numbers. First, OpenRouter listed Nemotron at 48. That was its launch score on the old version of the index. The index was rescaled in mid-June, and on the current version Nemotron reads 38. Same model, different ruler. Always pair an intelligence score with the date and version it came from, or you will compare numbers that cannot be compared.

Second, and more useful: notice the table refuses to crown a single winner, because for an operator there is no single winner. There is a model for the hard reasoning job, a model for the multimodal job, a model for the high-volume cheap job, and a model for the procurement-constrained job. You probably want more than one of them. Hold that thought. It becomes the decision rule at the end.

And widen the lens past these four, because the field is bigger than OpenRouter's slate. Google's Gemma 4 quietly flipped to a true Apache 2.0 license this spring and is the best thing going for running a small model on a phone or an edge box, offline. Mistral's Large 3, out of France, is Europe's open flagship, fully Apache-licensed. Both matter to an operator for reasons the coding leaderboard never surfaces: a license you can build a business on, and a size you can run where your data lives.

One number on the board is worth pausing on. DeepSeek V4 Flash carries the lowest intelligence score and, not coincidentally, the lowest price and the cleanest license. For a great deal of real operational work, "smart enough, dirt cheap, and truly yours" beats "smartest" every time. The leaderboard cannot see that. You can.

One name, two completely different objects

Here is the fact almost every headline gets wrong, and the single most useful thing in this piece.

DeepSeek has been banned by roughly fifteen US states, the US Navy, NASA, the Pentagon's network, the US House, the Commerce Department, Italy, Australia, Taiwan, the Czech Republic, and, by one count, around 70% of the corporate clients of the security firm Armis. If you only read the headlines, the lesson is obvious: Chinese AI is radioactive, stay away.

The headlines are describing the wrong object.

There are two completely different things called "DeepSeek," and they have opposite data implications. There is the hosted service: the app, the website, the first-party API. And there is the open weights: a set of MIT-licensed files you can download and run anywhere.

The hosted service is the real risk, and it is well documented. DeepSeek's own privacy policy says it stores user data on servers in the People's Republic of China and uses your inputs to train its models. South Korea's privacy regulator formally found that DeepSeek had shipped Korean users' prompts to ByteDance without consent. Security firm Wiz found a DeepSeek database sitting open on the internet, leaking more than a million log lines including plaintext chat history and API keys. Every government and corporate ban above is a response to that: sensitive data, flowing to a Chinese-jurisdiction service. The bans are reasonable. They are also about the app.

The open weights are a different animal entirely. They are static files. Inert math, not a program. They cannot open a network connection, cannot phone home, cannot exfiltrate anything, because they do not run themselves. The software you wrap around them, Ollama or vLLM or a cloud host, owns the network.

If the ethernet cable is unplugged, the model cannot spy on you. The inert-weights fact, in one line

Download the weights, run them on your own hardware or in a Western cloud, and your data never touches China. That is not a loophole. It is the basic architecture, confirmed by security firms like Endor Labs, by the venture firm a16z, and by the IISS.

You want the cleanest proof that the people who know best treat these as two different objects? Microsoft. In May 2025 its president testified to the US Senate that Microsoft does not allow employees to use the DeepSeek app. The same Microsoft sells the open DeepSeek model, hosted on Azure, to its customers. App banned. Weights on the shelf. They are not being inconsistent. They are being precise.

But those last two options are not the same promise, and the difference is the most important thing an operator can get right about open weights. We come back to it in the next section.

This is the operator's edge over the headline reader. The model you can inspect and run yourself is, very often, the one being banned in its hosted form. Knowing the difference is worth more than knowing the leaderboard.

Four things, none of them about coding

Strip away the geopolitics and here is why an open-weight model belongs in your stack at all.

The cost-versus-capability trade, in four numbers (June 2026 list prices):

Cost you can predict, and that collapses. This is not a small edge. The closed frontier, in June 2026, prices its output tokens at roughly thirty dollars per million for GPT-5.5, twenty-five for Claude Opus 4.8, twelve for Gemini 3.1 Pro. DeepSeek V4 Flash prices its output at twenty-eight cents. Run the division: on output, the cheap open workhorse is on the order of a hundred times cheaper than the closed flagship, and even the best open model, GLM 5.2, runs roughly eight times cheaper than Opus while scoring only about five points behind it. Put that in operator terms. A document-classification or email-triage or transcript-summarization workflow that is uneconomic at frontier prices becomes a rounding error at open-weight prices. You stop rationing the AI. You start running it on everything that benefits. The cost-collapse rule is exactly this: find the place where AI buys you a 10-to-1 improvement or better, then go wide. Open weights are where the ratio gets absurd.

Data you keep, but only if you keep it yourself. Here is the one place closed frontier cannot compete, and the one place an operator has to be precise, because the word "open" hides a fork that decides who can see your data.

Run an open model on your own hardware, or in a private environment you fully control, and your data never leaves it. Nobody else sees your prompts. That is an architectural guarantee, not a pinky promise: the data physically does not go anywhere, so there is nothing to retain, leak, or subpoena.

Run that same open model on a third-party host (AWS Bedrock, Together, Azure, Fireworks, Groq), and the picture changes. Your data does leave your walls. It goes to that host, and the host's servers see your prompts as they serve them. What protects you there is not physics, it is a contract: a no-retention clause, a no-training pledge, a promise to keep the data in your jurisdiction and out of China, often a signed business-associate agreement. That is a real and usually sufficient protection. It is not the same protection as self-hosting, and conflating the two is exactly the mistake that gets a regulated company in trouble.

Both open-weight rows beat shipping your data to a model vendor in China. But only the first row means nobody but you ever touches the data, and for the most sensitive work that is the only row that qualifies. This is not theory. Harvard Medical School found that an open Llama model matched a top proprietary model on hard diagnostic cases, and noted that hospital CIOs preferred it precisely because, run on the hospital's own infrastructure, the patient data never leaves the hospital. More than three hundred hospitals in China run private, local DeepSeek inside their own systems. The US defense world fine-tunes open Llama on its own hardware for classified work, because the data cannot go to anyone else's API, so the model has to come to the data. For a founder in legal, health, finance, or anyone holding a client confidentiality clause, knowing which row you are on is the difference between "we can use AI on this" and "we just created a breach."

A floor no single vendor can move. Earlier this month, Claude took a global outage attributed to capacity constraints, and the major labs have run usage limits all through 2026. When you rent intelligence from one closed vendor, their outage is your outage, their price hike is your margin, their model deprecation is your weekend. An open-weight model is a file you keep. It does not get throttled, sunset, or repriced out from under you. It will not be the smartest thing in your stack. It will be the thing that still works when the smartest thing is down. That is what owning a floor means.

A model that can become yours. Fine-tuning an open model on your own playbooks used to be a research project. It is now an experiment you can run for the price of a team lunch. Hosted tools fine-tune a mid-size open model on your data for tens of dollars; one team fine-tuned a small model to classify seventy thousand support tickets for around five hundred dollars total. The result carries your operating context rather than the generic internet's. You cannot do that, durably and privately, with a closed API. The caveat: for most operators the first move is retrieval, not fine-tuning. Point the model at your knowledge base before you retrain it. But when you do have one narrow, high-volume task that needs to sound like you, the door is open and the price is low.

The honest costs

A recommendation is only as trustworthy as its "what it's not" column. Start with the most important correction, because it cuts against the hype.

The two adoption numbers point opposite ways, and both are true. Among builders and startups, open models have surged: on OpenRouter, the share of traffic going to US closed models fell from about 70% to about 30% in a year, and Chinese open models now move the majority of tokens, with DeepSeek alone accounting for more than any single Western lab. But that is developer traffic. Look at what large enterprises actually run in production, and the picture flips: open-weight usage is only around 11 to 13% of enterprise spend, and it recently fell from 19%, because the closed frontier is still better and arrives with the support and compliance paperwork big companies want. They measure different rooms. The honest read for an operator is not "everyone is switching to open." It is "open weights have earned a defined, growing role, and the smart move is to use them for what they are good at."

They trail the frontier, and the gap is not closing on its own. The best open model, GLM 5.2, sits about five points behind the best generally-available closed model and about nine behind the very top, which remains closed. And do not bet on that gap shrinking. OpenRouter argued it has held steady for a year and a half, but the two most rigorous trackers disagree: Epoch AI shows it widening slightly, and Stanford's AI Index shows it reopening, from half a percent in mid-2024 to more than three percent by early 2026. The frontier is inching ahead again, which is the whole reason you keep a frontier model in the mix. Notice, too, who is close: the Chinese labs. The best American open model trails by roughly twice that margin, and the best European one by more. For your hardest reasoning and your highest-stakes judgment, the frontier flagship is still worth its price. Do not put open weights on the work that cannot afford to be second-best.

"Free" is not free. The weights cost nothing. Running them in production does. Raw GPU is only a third of the true cost once you add the engineer to keep it serving, and a self-hosted open model can quietly cost six figures a year in salary and maintenance. It is a point worth stating plainly, and one I made on X the day this piece was written: "Local is far from free as is often stated," and the economics are a large factor. The honest version of the move is to burst the hard, capability-hungry work to the cloud, and run local only to the degree you can actually afford. The good news, in the next section, is that you rarely need to own the hardware at all. But "open and free to download" never meant "free to operate."

"Open" hides a ladder of licenses. MIT, which covers DeepSeek and GLM 5.2, is genuinely permissive: use it, modify it, sell on top of it. But MiniMax ships under a community license with attribution and a revenue threshold. NVIDIA's license can terminate if you weaken its safety guardrails or sue NVIDIA. Meta's Llama license has a user-count cap and naming rules. Google's Gemma was restrictive through version 3 and only became truly open at version 4. "Open-weight" on the label is not "do anything you want." Read the license before you build a business on it, the same way you would read any vendor contract.

Chinese weights carry Chinese censorship, and every model carries its flaws. Self-hosting removes the data-residency problem. It does not remove the model's training: the Chinese open models will dodge topics the Chinese state dislikes, which is why Perplexity re-trained that bias out of one and re-released it. And the usual model weaknesses, jailbreak susceptibility and occasional insecure code, travel with the weights whether you host them or someone else does. None of this moves your data anywhere. All of it means open weights need the same validation discipline as any other model.

Who makes the floor you would stand on

Step back from the four models and look at who makes the open-weight layer now, because the map changed in a way most operators have not registered.

The original open-weight standard-bearer left. Meta, whose Llama models defined "open" for two years, froze the line at Llama 4 in early 2025, never shipped the giant successor it announced, and in April 2026 released its new frontier model, Muse Spark, as a closed, proprietary system. The company that taught the industry to open its weights now keeps its best one shut. Llama is still downloadable, but it is a frozen asset, not a leading edge.

The torch passed, and it passed mostly east. The open-weight frontier today is overwhelmingly Chinese: DeepSeek, Z-AI behind GLM, MiniMax, Moonshot, and above all Alibaba's Qwen, which by early 2026 accounted for more than half of all open-model downloads worldwide and more derivative models than Google and Meta combined. Stanford's AI Index recorded Chinese developers passing US developers in open-model downloads for the first time.

The US answer is NVIDIA's Nemotron, and the motive is worth naming in terms you already run. NVIDIA gives the weights away to sell more of the chips that run them. The model is a lead magnet. It is the free, genuinely useful thing a company hands you to pull you toward the thing it actually sells, the same move as the free tool that feeds your funnel or the sample that sells the subscription. NVIDIA's product is silicon, and Nemotron is the magnet. That is not a knock. It is the most reliable kind of alignment, because their interest in a thriving open ecosystem is identical to yours for exactly as long as they are selling chips.

So read every free model the way you would read a lead magnet: ask what it is a magnet for. NVIDIA's pulls you toward GPUs. Mistral's pulls you toward its compute and its enterprise contracts, with European sovereignty as the hook. Meta opened Llama when commoditizing the model layer served it, then closed its best model the moment it did not. The business model behind a free model is not a footnote, it is the forecast. It tells you how long that model will keep getting funded and supported, and therefore which free gift you can safely build on. A lead magnet wired to a real business gets maintained. A magnet for nothing gets abandoned a year later.

Europe is building its own answer, slowly and publicly. The fully-open Apertus model out of Switzerland publishes not just weights but training data and recipe. Mistral, the European champion, ships everything under Apache 2.0 and took a 1.7 billion euro round led by the chip-equipment maker ASML. The EU AI Act even wrote open-source models a carve-out, narrow but real, that evaporates for any model large enough to count as systemic risk.

Here is what that crowded, contested map means for you. The intelligence layer is becoming a commodity floor that no single company and no single country controls. That is precisely its strategic value. When the capability you depend on is available from a dozen labs across three continents under a range of licenses, you are not a hostage to any one of them. You can pick on price. You can pick on where it runs. You can pick on who you are willing to depend on. Optionality is the asset. Open weights are how you buy it.

Build a portfolio, then route the work

Stop choosing a model. Build a portfolio and route the work to the right tier. This is not a hedge; it is what the operators who are furthest along already do. In a survey of a hundred enterprise technology chiefs, 81% now run three or more model families in production, and the pattern that keeps recurring is the same one the selecting-ai-tools skill would draw: closed frontier for the critical fifth of the work, open weights for the routine four-fifths. Match the capability to the function. Do not crown a favorite.

Then the practical question: can a normal company actually run these? Yes, and for almost everyone the answer is not a rack of GPUs in a closet. It is a hosted open-weight provider with the right paperwork. Together, Fireworks, Baseten, AWS Bedrock, and Azure all run the same open weights for you, in your jurisdiction, with HIPAA agreements, SOC 2, zero-data-retention, and private-network options available off the shelf. You get the open-weight price without owning a single GPU. Just be clear, per the annotation above, on what you are buying: the host still sees your prompts as it serves them, so this is a strong contractual data guarantee, not the nobody-else-touches-it guarantee of self-hosting. For most operators that contract is plenty. For the most sensitive or regulated data it is not, and that is the one case where you bring the model onto hardware you control. The hosted path is right for roughly nine operators in ten.

Owning the hardware only pays off in two cases: when your volume is genuinely large, past tens of millions of tokens a day, or when a hard data-residency mandate leaves you no choice. And the demos you have seen of a giant model humming on a single Mac on someone's desk are real, but they are demos. Single-stream speed on that hardware is hobbyist-grade. It is a sandbox for prototyping, not a server for your business. Know which one you are building before you buy.

Religion about one model or one vendor is the expensive mistake here, in either direction. The correct architecture is a portfolio, routed by the table above, served the easy way until volume or law forces the hard way.