One of the most capable AI models anyone can download was made in Beijing, and squeezed to fit, it weighs about four hundred gigabytes.
That is not a boast on anyone’s behalf. It is a description of a file. In August a Chinese company called Z.ai, the international brand of the firm known at home as Zhipu, posted the weights of its model GLM-5.3 on Hugging Face, the public library where such things are kept. “Weights” are the model itself: hundreds of billions of numbers, fixed by training, that turn a question into an answer. The official release comes to about 756 gigabytes. Squeezed to roughly four bits per number, which costs a little quality, the community’s compressed versions come to between 365 and 467 gigabytes. Anyone may download them.
The great Western flagships do not work like this. You do not own Claude or GPT-5; you visit them. You send your words to a building in another country, an answer comes back, and the terms of the visit can change while you sleep. The West does publish open models (OpenAI’s gpt-oss, Mistral’s, Google’s Gemma), but they are mostly smaller. The largest open models now mostly come from China, and I want to argue that holding them rather than visiting them matters more than any leaderboard, and also that it is not quite the gift it first appears.
What changes when you hold the thing
Begin with the desk. On 25 August Apple announced a new Mac Studio with up to 512 gigabytes of memory and, in Apple’s words, the ability to put “frontier-class AI models right on a user’s desk”. The largest configuration arrives, the company says, in late October. The previous model had the same memory ceiling, and people have been using it. One benchmarking site reports an earlier GLM, compressed to four bits, running on one at about seventeen tokens, or word-fragments, a second with short prompts. A blogger who tried a squeezed GLM-5.1 on a machine with half the memory called the result, fairly, “a party trick with genuinely good output”. These are individual reports, not laboratory measurements.
The more realistic desk companion is the flagship’s smaller sibling, GLM-5.3-Flash: 320 billion parameters, of which only 18 billion work on any given word, released the same day under the permissive MIT licence. Its official files come to about 330 gigabytes, which fits inside that 512-gigabyte memory.
Still, consider what that means. A model close to the class the large American companies rent out by the word, sitting on a desk, answering with the network cable unplugged. Nothing leaves the room. Nobody can change its manners overnight or switch it off because a policy shifted. You may probe it, retrain it on your own letters or your own law reports, and keep the result. A thing you visit can be very good. A thing you hold can be examined, at least up to a point: you get the finished model, not the reading list it learned from.
That is the real difference, and it is why these models feel unlike the closed Western ones even when the answers are similar. It is not a matter of style. It is a matter of tenure.
A short shelf
The shelf is crowded, and most of it cannot be lifted. DeepSeek’s flagship, V4-Pro, has 1.6 trillion parameters under the MIT licence. Its September V4.1-Flash uses only 8 to 16 billion of its 552-billion-parameter backbone for any given word, the trick most of these models rely on: a vast library of specialists, of which only a few are consulted at a time. Alibaba’s Qwen team has, “for the first time”, opened a model of its top Max class, Qwen3.8-2.4T-A95B, at 2.4 trillion parameters; its full-precision files run to nearly five terabytes. Moonshot’s Kimi K3, at 2.8 trillion, calls itself “the world’s first open 3T-class model” and weighs about 1.56 terabytes. MiniMax, another Chinese laboratory, offers its newest language model, M3, released in June, at about 854 gigabytes. Xiaomi, better known for telephones, has published a trillion-parameter model that reads text, images, video and sound. None of these fits a single desk; Apple itself suggests clustering several Mac Studios for the largest.
“Open”, meanwhile, covers more than one bargain. DeepSeek’s licence is MIT, which means do what you like; Xiaomi’s model is listed as MIT too. Qwen’s and Kimi’s largest models require a separate deal from big companies that resell them as a service, with thresholds of $50 million and $20 million in total revenue respectively; Qwen’s terms also cover AI coding and office assistants, and both require very large consumer products to display the model’s name. Kimi K3’s terms are stricter than its predecessor’s. MiniMax grants rights for non-commercial use and attaches conditions to everything else: a “Built with MiniMax M3” credit, a notice to the company, written permission above twenty million dollars of yearly revenue, and a list of prohibited uses that includes “any military purpose”.
Most of these terms are not sinister. They are what you would expect from companies who want the reputation of openness without arming their largest competitors. But “open weights” is not “open source”. The Open Source Initiative’s definition for AI asks for detailed information about the training data and the complete code used to train the system. None of this shelf meets that bar.
Why GLM
I have a soft spot for GLM, and I may as well say why.
Partly it is lineage. GLM began as an academic paper in 2021, from researchers centred on Tsinghua University, and its makers have kept something of the seminar room about them. The GLM-5 release in February came with a 744-billion-parameter model under the MIT licence and a technical report with the cheerfully unpretentious subtitle “From Vibe Coding to Agentic Engineering”. Only GLM-5.3 swaps MIT for its own licence, with one narrow condition: a company that runs a model-as-a-service business and whose group revenue exceeds ten billion dollars a year must pass Z.ai’s security review before commercial use. It shuts nobody out. It gates the largest cloud and technology groups behind a review, and the Flash sibling stays MIT.
Partly it is candour. The GLM-5.3 announcement states plainly that it uses the same base model as its predecessor, so that “every gain comes from post-training”, the later stage of teaching rather than the original reading. Few companies volunteer that their new model is the old one, better schooled. It also calls GLM-5.3 “the most capable open-weights model for coding”. That is Z.ai’s claim, and its own table does not wholly support it: Kimi K3 edges ahead on several coding rows. Every benchmark figure in this essay, I should add, was run and reported by the vendor concerned.
And partly it is a sentence I cannot stop rereading. Under the label “Emergent Cyber Capability”, Z.ai writes: “As we scaled post-training, cyber capability developed faster than we expected.” In August it reported what was then a leading score of 84.5 on CyberGym, a test of finding software vulnerabilities; newer Chinese models have since claimed higher. The blog adds a line of unusual honesty about the closed models still ahead of it: “Capability is growing fastest exactly where we are furthest behind.” Z.ai held the weights back for about two weeks, “once safety evaluation and hardening are complete”. Within two days of their release, versions advertised as uncensored had appeared on the same public library, and by 30 August some were billed as for “cybersecurity”.
The other column
This is where fairness asks for its turn. Open weights cannot be recalled. Whatever a model can do on the day of release, it can do for ever, for anyone, with whatever restraints its new owner chooses to remove.
And provenance matters. In September 2025 the American government’s AI evaluation centre, CAISI, published an assessment of DeepSeek models of that period. It found they echoed four times as many inaccurate and misleading Chinese Communist Party narratives as the American models tested, and that even the most secure of them responded to 94 per cent of overtly malicious requests under a common jailbreak, against 8 per cent for the American models. Those were older models, and the report comes from a party with interests of its own. It would be foolish to dismiss it, and equally foolish to treat it as the last word on every Chinese laboratory.
What I would say is this. A closed model asks you to trust its maker. An open one invites you to check, and puts some of the means of checking on your desk. That does not make it trustworthy. It makes trust something you can partly test rather than merely grant.
Tenure
There is an old English distinction between a tenant and a freeholder. The tenant may have the better house; the freeholder may have the draughtier one. But the freeholder can knock down a wall.
The West’s flagships are offered as the better house, on a lease. China’s laboratories, for reasons of commerce and strategy as much as principle, have been handing out the largest freeholds. Some of the deeds have clauses. Some of the houses have doors that should probably have stayed locked. And yet a person with a large desk and a larger budget can now own something close to the frontier, put it in a box, and switch it off at the wall when they choose.
That is not hype. It is property. And property, as the English have always known, changes how people behave.