Spend a week reading about “decentralized AI” and “open-source AI” and you start to notice the words are doing two jobs at once. People argue past each other because they're not in the same fight. There are actually two — and almost every confused debate I read mixes them up.

So here's the clean version. One fight is about who owns the compute. The other is about who owns the model. They sound like the same argument about “decentralization,” but they're independent — and once you separate them, the geopolitics, the law, and the security questions stop feeling like a blur.

Fight one: who owns the compute

Training a frontier model used to mean one company, one data center, tens of thousands of GPUs you could only rent from a handful of clouds. The first fight is the attempt to break that — to spread the physical work of training and running models across many machines that no single owner controls.

It's further along than I expected. Prime Intellect has trained models at 10 and 32 billion parameters on GPUs scattered around the world — proof that a “swarm” can do real work, not just a demo. Gensyn is building a way to verify that a stranger's machine actually did the training it claims. Bittensor runs 60-plus specialized subnetworks that pay out a token for “useful intelligence.” And underneath it all, DePIN compute markets — Akash, Render, io.net — rent out GPUs at roughly 60–70% below the big clouds.

That's the honest core of fight one. It's mostly an economic and infrastructure argument: compute is scarce and expensive, three companies control most of it, and a lot of very smart people would like that not to be true. Crypto money is pouring in partly for that reason and partly for a deeper one — the belief that “AGI shouldn't belong to three companies.”

Fight two: who owns the model

The second fight has nothing to do with where the training happened. It's about what you're allowed to do with the finished model. Can you download the weights? Run them on your own machine? See the code and the data? Build a business on top without asking permission?

This is where the word “open” gets slippery — and where most of the public confusion lives. “Open” isn't a switch; it's a gradient. At one end, a closed APIApplication Programming Interface — the doorway one program uses to call another. you can only rent (GPT, Claude). In the middle, open weights — you get the model file, but not the training data or the recipe (Llama, DeepSeek). At the far end, genuinely open source: weights, code, and a real description of the data (OLMo, Pythia).

The trap is that almost everything marketed as “open-source AI” is really just open weights. The Open Source Initiative wrote an actual definition in 2024 — it requires the training data to be disclosed — and by that standard Llama, Grok, and Mixtral don't qualify. Meta's Llama license even bans the biggest companies from using it and adds a list of forbidden uses. That's a useful, generous release. It is not “open source,” and the gap matters.

Why the mix-up matters

Keep the two fights apart and a lot of news snaps into focus. DeepSeek is the cleanest example: its models are open in the fight-two sense — anyone can download them — but the company itself is centralized. Open and centralized at the same time. You can also be the opposite: a closed model trained on a distributed swarm. The axes are independent, and treating them as one is how you end up arguing in circles.

It also matters because the two fights have different stakes. Fight one is mostly about cost and access. Fight two is about power — and that's the one that turned into geopolitics, law, and security.

Through the right lens: geopolitics

Almost all of the geopolitics is fight two. When DeepSeek shipped a near-frontier open model in early 2025, the shock wasn't that China had cheap GPUs — it was that a Chinese lab gave a competitive model away. A US government report later described the strategy plainly: open-sourcing isn't charity, it's market capture. Give the model to the world, make your stack the global default, and reinforce your industry at home.

The US answer was a 2025 AI Action Plan that — for the first time at that level — called open models a source of “geostrategic value” and pushed to export an “American AI stack” to allies. Europe took a third path: sovereignty through its own open-weight champion, Mistral, plus regulation. The logic on all sides is the same. Whoever's open model the world builds on owns the dependency for a decade. Fight one — the chips — is the backdrop; fight two is the actual contest.

Through the right lens: law

The legal mess is also fight two. “Open” has three meanings, so the licenses fight over which one counts. Copyright is the live wire: in the largest AI-training settlement so far, a US court told Anthropic that training on legally bought books is fair use, but storing pirated copies is not — a $1.5 billion lesson that the provenance of the data, not the training itself, is the liability. Open projects feel that hardest; they can't afford to license data or defend a lawsuit.

Europe's AI Act gives open models a real break — lighter paperwork — but still makes them follow copyright and publish a summary of their training data, and the break disappears above a compute threshold. And underneath all of it sits a knot no one has untied: once the weights are public, the author has lost control. Every safety brake that works on an APIApplication Programming Interface — the doorway one program uses to call another. — rate limits, access revocation, monitoring — evaporates when the model runs on someone else's laptop. You can't recall a weight.

Through the right lens: security

Security is the one place both fights show up. The fight-two risk is misuse you can't take back: open models stripped of their guardrails power the criminal “WormGPT” tools, and the same un-recallable openness is why a state actor's autonomously-run intrusion is so alarming — in late 2025 Anthropic disclosed a Chinese espionage campaign where the AI ran 80–90% of the operation itself against around thirty targets.

The fight-one risk is quieter and more technical: if training is spread across machines you don't control, you have to trust those machines. You mostly can't. A single malicious participant holding a fraction of a percent of the nodes can quietly plant a backdoor that survives into the final model — corruption introduced during training, not theft after it. Decentralizing the compute buys you freedom and a brand-new attack surface in the same move.

My take

The conflation isn't an accident, and it isn't only sloppiness. Blurring the two fights is useful — to a company that wants the moral shine of “open” without giving up the recipe, and to a government that wants “open” to mean “ours.” The word does the marketing.

If you make me bet, fight two decides the next decade. Cheaper, more distributed compute is good and probably inevitable, but it changes who can afford to play, not who sets the rules. Who owns the model — who can read it, fork it, regulate it, and answer for it when it's misused — is the one that decides whose values get baked into the systems the rest of us end up living inside. I came in sympathetic to “open everything.” I left more careful: openness is a genuine public good and an irreversible act at the same time, and we keep saying the word as if only the first half were true.

• Two different fights wear the same word. Fight one: who owns the compute. Fight two: who owns the model.
• They're independent. DeepSeek is open (fight two) but centralized (fight one).
• “Open weights” is not “open source.” Most “open-source” models only release the weights, not the data.
• The geopolitics and the law are mostly fight two — power, not plumbing.
• Security is both: un-recallable misuse (fight two) and poisoned training on untrusted machines (fight one).
• Bet: fight two decides whose values run the systems we live in.

• OSI — Open Source AI Definition↗
• Prime Intellect — decentralized training↗
• USCC — “Two Loops”: China's open AI strategy↗
• America's AI Action Plan (2025)↗
• Bartz v. Anthropic — the $1.5B settlement↗
• Anthropic — AI-orchestrated espionage (GTG-1002)↗
• EU AI Act — GPAI Code of Practice↗