The exchange keeps happening in enterprise AI, almost word for word. "We can't use an open-source model. It's all Chinese." Even if it's 100x cheaper? "No. We care about safety and security."
That answer gets both halves of the trade-off backwards. Running open-source models like GLM, Kimi, and DeepSeek yourself is usually cheaper and safer than piping your data to a closed frontier API. Not as a slogan, as a matter of how the two things actually work. Start with the one fact everything else follows from.
A model is a file. A few hundred gigabytes of numbers that, given some text, predict the next token. Anthropic and OpenAI keep their files secret and run them only on their own servers. The labs behind GLM, Kimi, and DeepSeek publish theirs, so anyone can download the file and run it. That single difference, secret-and-hosted versus published-and-yours, is what makes one path expensive and exposed and the other cheap and private.
Why it's cheaper
When you call a closed API, you're paying for three things bundled together: the compute to run the model, the cost of training it, and the lab's margin. There's exactly one seller of that specific model, so there's no price competition on it. You pay what they charge.
An open model unbundles that. The weights are free, so nobody is charging you to recoup a training run or protect a franchise. You pay for compute, and only compute. Then two mechanisms drive that compute cost down hard.
The first is architecture. Modern open models use a mixture-of-experts design, where only a small fraction of the network activates for any given token. The file is huge, but the work per token is small, which is why NVIDIA measures roughly a 10x drop in cost per token versus dense models of similar quality.
The second is competition. Because the weights are public, dozens of providers, Fireworks, Together, Groq, DeepInfra, all serve the exact same model and compete on nothing but price and speed. That races the cost toward the raw price of the GPUs. DeepInfra drove one large open model from 20 cents per million tokens to 10 to 5 just by moving hardware generations. NBC News reports the net effect is Chinese open models running ten to fifty times cheaper than Western equivalents. Nobody can do that to a closed model, because nobody else is allowed to serve it.
Why it's safer
Now the part people get exactly wrong. Safety was never a property of the model. It's a property of where the model runs.
A closed model is a service. Every prompt you send, the contract, the customer record, the roadmap, crosses the wire to the lab's servers, and it lives there. "Delete" is a policy, not a physical fact. The clearest proof arrived in 2025, when a court ordered OpenAI to preserve all ChatGPT and API output logs indefinitely, overriding its own deletion policy and its users' delete requests, and later to hand 20 million de-identified conversations to opposing counsel. Once your data is on someone else's servers, its fate is out of your hands. A subpoena, a breach, or a policy change reaches it, and you find out afterward.
A published model has none of that. You download the file and run it on your own hardware, or in a US datacenter you control on AWS, Azure, or GCP. The weights have no channel back to their creator. As Interconnects' Nathan Lambert puts it, "model weights alone cannot reveal anything to their creators." Beijing cannot see a prompt that never left your VPC, and neither can anyone else.
There's a second, subtler exposure the "safe" default carries. A frontier lab isn't just a vendor, it's a company with its own product roadmap, and lately it points at its customers. Figma and Cursor both built on Anthropic, then watched it launch Claude Design into Figma's market, knocking 7% off Figma's value in a day, and Claude Code into Cursor's. Nobody has to read your individual prompts to benefit from that arrangement; aggregate usage alone maps which categories are worth entering. Self-hosted weights don't have a product team, and they can't grow into your competitor.
The risks that survive the debunk
Open weights aren't risk-free. CEPA is right that backdoors buried in weights are hard to detect, and censorship on China-sensitive topics is baked in. But notice these are output risks, and they apply to every model from every lab. Any model can be prompt-injected or emit a bad dependency. Trusting a particular lab doesn't fix that. Architecture does: least privilege, secrets kept out of the model's reach, sandboxed outputs, everything logged.
Trust the architecture, not the flag
If your system is only safe when the model is benevolent, it isn't safe. That's the principle General Input is architected on: the AI never sees an API key. Credentials are encrypted at rest, injected at runtime, and stripped before anything reaches the model, and every external call it makes lands in an audit trail. The trust boundary sits below the model, so provenance stops being a security review and becomes a line item, price and latency and benchmark score.
The model doesn't matter. The host does. And the safest, cheapest host is you.