The Model Left; the Lock Stayed

Micron is committing $250 billion to U.S. manufacturing just as open-weight models make AI portable enough to leave a vendor and run on local devices. The software is dispersing at the same moment its physical constraint is concentrating.

Open-model AI weakened one form of control once access no longer depended on a single company’s API. From 2024 through 2026, weights became easier to copy, redistribute and operate elsewhere. Opening that gate shifted leverage to whatever remained scarce, trusted or legally reachable: the distribution route and the memory beneath it.

Portable weights make the route more valuable

API providers keep model access and operation in the same place. They serve the system, observe its use and retain the ability to change the terms. Open weights separate those functions. A recipient can operate the model outside the vendor’s service, but must decide where to obtain it, which package to trust, how to deploy it and who remains accountable when something breaks.

OpenAI released gpt-oss-120b and gpt-oss-20b, its first open-weight models since GPT-2, and said the smaller model could run locally on a device with at least 16GB of RAM. That threshold changed who could possess and operate the model. When a model fits outside the vendor’s infrastructure, companies that provide reliable discovery, authentication, packaging, benchmarking and deployment gain leverage across systems the developer does not control.

The same artifact can have several addresses. Google published its 1B-parameter VaultGemma model on both Hugging Face and Kaggle. Multiple channels preserve choice and make it harder for one venue to own access outright. Each venue can still become the place where a developer encounters the model, accepts its packaging and carries it into production.

Deployment-layer control emerges when widely available weights still reach users through hubs and operators. Those organizations set packaging, identity and deployment conditions across systems the original developer no longer runs.

A library becomes a checkpoint when everyone enters there

As developers depend on public repositories, governments can address orders to them, security failures can propagate through them and platform operators must decide which reports deserve scarce human attention. The interface still resembles a library, but the repository behaves like an enforcement surface.

India showed the legal version of that reversal when it directed GitHub to remove the Bitchat offline messaging app. The state did not need to redesign the app or control every device on which it had been installed. It targeted the public route through which users found and obtained the software.

CISA said weak controls around public GitHub repositories allowed a contractor to expose private cloud access keys and other credentials. The repository sat on a path between the contractor’s internal practices and its operational infrastructure, allowing a failure at that junction to reach farther than the file itself.

GitHub also narrowed its response to a flood of AI-generated vulnerability reports. It planned a two-tier bug-bounty program that reduced public rewards and shifted more compensation toward invited researchers because universal access to reporting had begun to destroy the signal it was supposed to produce.

Multiple hubs can preserve competition while each accumulates policy decisions, incident-response duties and trust judgments as dependence grows.

The cyber gap is narrowing before responsibility is settled

Open models expand innovation and abuse together. Developers could treat that trade-off as theoretical while open models remained well behind the closed frontier. A narrowing capability gap makes it operational.

Recent open-weight models trailed frontier closed models’ cyber capabilities by four to seven months, down from the six-to-ten-month gap observed through most of 2025. The lag remains material, but repositories and deployers must prepare to carry more provenance, policy, misuse detection and traceable records as the interval shrinks.

The U.S. Department of Homeland Security identified AI-driven attacks, attacks against AI systems and design flaws as core risks in its guidance for critical infrastructure. The NSA created an AI security center after identifying protection of American AI models as a national-security issue. Both treated model security as a chain extending beyond training to deployment.

Human reviewers catch errors and give accountability an address. A model downloaded, repackaged and run locally has no permanent service provider standing between the operator and the consequence. Operators must reconstruct trust through records, review and identifiable decisions, replacing one custodian with several accountable parties.

Software decentralization concentrates the physical load

Micron has no documented partnership with GitHub, Hugging Face or Kaggle; their relationship is structural. Broader model distribution creates more places where inference can occur, while every deployment still depends on the memory subsystem of the semiconductor layer.

OpenAI’s 16GB threshold makes that dependence concrete. Local AI access requires both the file and a capable device. At scale, device makers and cloud operators turn software portability into memory orders, whether models run on local machines or in infrastructure elsewhere.

Micron’s results reflect that demand. The company reported fiscal third-quarter revenue of $41.46 billion, up 346% from a year earlier, with an 84.9% gross margin as AI-driven memory demand continued. It then raised its U.S. capital commitment to $250 billion through 2035 and invested $500 million in GlobalWafers to expand capacity for demand it described as unprecedented.

Portable models add deployment endpoints, which raise memory demand and steer capital toward companies capable of financing fabs. Long construction cycles give those companies greater strategic weight before new supply arrives. Massive fabrication commitments can eventually ease the constraint, but Micron said it had no clear line of sight on when supply would catch up with demand. SEMI, whose members include Micron and Samsung, also warned that government intervention in memory pricing or production capacity could worsen shortages. Software can fork in an afternoon, while balancing memory supply requires concrete, equipment and years.

Sovereignty now spans the repository and the fab

India exposed both ends of the emerging control stack. It ordered GitHub to remove software from a public repository, then committed $13.3 billion to domestic chipmaking, building on a 2021 $10 billion program that attracted investment from Micron. The removal order governed what could move through a software channel; the subsidies governed where the physical capacity behind digital access would be built.

Apple faced the same collision in memory procurement. Sources said Apple sought clearance to use chips from blacklisted Chinese supplier CXMT in products sold outside the United States, while Micron warned that using Chinese memory could damage the U.S. chip industry. Access, price, industrial capacity and national policy met at a component consumers rarely see.

Together, these interventions form AI access sovereignty. Governments can act at the repository, import boundary, equipment supplier, memory purchase and fab subsidy. Each additional route gives policymakers and operators another point where trust can be granted, access withdrawn or capacity rationed.

A road network decentralizes destinations while concentrating traffic wherever the terrain requires a bridge; open models follow that geometry as repositories carry trust and memory fabs carry scale.

OpenAI’s smaller model can arrive on a 16GB device without asking an API for permission. Yet the file still crosses a named route and lands on purchased memory. The model left the locked room; the lock became a removal order on a download path and a $250 billion commitment to the capacity beneath it.