Open Weights You Can't Actually Run

Kimi K3's weights are free. The license is close to MIT. Anyone can download 2.8 trillion parameters right now.

Almost nobody can run them.

At the model's native MXFP4 precision — already 4-bit, so this is a floor and not a compression estimate — the weights alone occupy about 1.4 terabytes of memory. That's roughly eighteen H100s, or three full DGX nodes, before you allocate a single token of the 1-million-token context it advertises. On consumer hardware it's around forty-four RTX 5090s. The most open frontier model ever released is, for an individual, functionally unavailable.

It's worth asking whether this is the direction open weights is heading in general. I went back through four years of release data in the arcade to check.

What the data actually shows

Taking every open-weight release with a disclosed parameter count:

Year	Releases	Median size	Largest	≥200B	≤32B
2022	4	152.5B	176B	0	1
2023	12	43.4B	180B	0	4
2024	27	70.0B	671B	5	11
2025	22	120.0B	1,000B	10	10
2026	33	118.0B	2,800B	13	13

The intuition is half right, and the half it gets wrong is the interesting part.

The ceiling exploded. From 176B in 2022 to 2.8T in 2026 — a 16× rise, most of it in the last eighteen months. Kimi K2 broke the trillion barrier in July 2025; DeepSeek v4 and LongCat-2.0 hit 1.6T; K3 nearly doubled that again.

The median didn't move. 120B in 2025, 118B in 2026. Flat.

And the small end grew in absolute terms. Thirteen open releases at 32B or under in 2026, against ten in 2025 and eleven in 2024. Nobody stopped shipping small models.

So this isn't a drift upward. It's a barbell. The distribution is pulling apart at both ends while the middle stays put, and describing it as "open models are getting too big" collapses two different things that are both happening at once.

Two tiers that share a word

Look at what sits at each end and the split stops looking accidental.

Model	Size	4-bit weights	Runs on
Kimi K3	2.8T	~1,400 GB	~18× H100
DeepSeek v4	1.6T	~800 GB	~10× H100
Kimi K2.7-Code	1T	~500 GB	~7× H100
GLM-5.2	753B	~377 GB	~5× H100
DiffusionGemma	26B (4B active)	~13 GB	one consumer GPU
Antares-1B	1B	~0.5 GB	a laptop

These are not competing points on one curve. They're answers to different questions.

The giants are sovereignty artifacts. Their audience is governments, national labs, cloud providers and well-funded enterprises — organizations that need a frontier model they control rather than rent, and that already own or can rent the hardware. K3 being downloadable matters enormously to a European bank or a Chinese cloud, and not at all to a developer with a 4090. That the weights are public still does real work: it's the difference between a capability you can audit, fine-tune and deploy on your own metal, and one that lives behind someone else's API and terms of service.

The small models are deployment artifacts, and they're increasingly built for a specific job rather than general capability. Cisco's Antares does vulnerability localization at 1B and beats 753B GLM-5.2 at that one task. DiffusionGemma trades reasoning accuracy for local latency. NVIDIA ships Nemotron at 3B/8B/14B. These are the models the individual developer actually runs, and they got better, not scarcer.

The word "open" is doing too much work

The real problem isn't that big open models exist. It's that one word now covers two things with almost nothing in common, and the ambiguity gets exploited in both directions.

When a lab says "we released an open frontier model," the implied claim is democratization — anyone can have this. When the practical requirement is eighteen H100s, the honest version is "we released it to the two hundred organizations that can afford to run it." That's still meaningful. It just isn't what most people hear.

The policy debate inherits the confusion wholesale. The argument over restricting Chinese open weights treats "open weights" as a single category, but the proliferation risk profile of a 1B security model you can run on a laptop and a 2.8T frontier model requiring a datacenter are not remotely comparable. Cisco could ship Antares openly because it's small and narrow. K3's openness is bounded by physics regardless of what any regulator decides — and simultaneously, weights once downloaded genuinely cannot be recalled, which is why the enforcement argument keeps going in circles.

Where this actually bites

Two consequences follow, and neither is the one people usually reach for.

Openness at the frontier is becoming a licensing question, not an access question. K3's license is the interesting artifact, not the download link — MIT-style, with a carve-out only for Model-as-a-Service operators above $20M revenue. That clause tells you exactly who Moonshot expects to run this: not individuals, but companies large enough to resell it. The license is written for the audience the hardware requirement already selected.

The gap that matters is service providers, not individuals. The individual developer was never going to run a frontier model locally, and the small-model tier serves them better each quarter. What open frontier weights change is the middle — the regional cloud, the national lab, the enterprise with a compliance requirement. Before, their only frontier option was an American API. Now there's an alternative that runs on hardware they control. That's a genuine shift in market structure, and it has nothing to do with whether anyone can run K3 on a desktop.

So: yes, open releases at the top are getting enormous, and no, that isn't crowding out the models normal people run. What it does mean is that "open weights" has stopped being one thing, and the sooner the vocabulary catches up — sovereignty-tier versus local-tier — the less confused both the marketing and the regulation will be.

The honest caveat on all of this: the size data covers only models that disclosed a parameter count, which is overwhelmingly the open ones. Closed labs stopped publishing sizes years ago. The barbell is real, but it's a barbell we can only see one end of clearly.