The Weights Get Out

“Meta’s powerful AI language model has leaked online.” — The Verge, March 8, 2023

On February 24, 2023, Meta released a large language model called LLaMA, and it did so the way a careful institution releases anything it considers dangerous: behind a form. The model came in four sizes, the largest 65 billion parameters, and Meta’s own paper made a claim that got the field’s attention. The 13-billion-parameter version, it said, beat OpenAI’s GPT-3 on most benchmarks, and GPT-3 had 175 billion parameters. A model an order of magnitude smaller, matching the system that three months earlier had made ChatGPT possible. To get the weights you applied through a Google form, agreed to a noncommercial research license, and waited for Meta to email you a download link. The weights, the trained numerical innards that are the model, were supposed to circulate only inside an approved ring of academics and labs.

The ring held for about a week.

Around March 3, 2023, a torrent magnet link appeared on the message board 4chan. A magnet link is not a file or even a place; it is a short string of text, a hash, that tells peer-to-peer software how to find a file across a swarm of strangers’ computers, with no central server anyone can take down. This one pointed at all four LLaMA models. Then a user went a step further and opened a pull request on Meta’s own public code repository on GitHub, formally proposing to paste the magnet link into Meta’s instructions so future downloaders could skip the application entirely. It was a small act of trolling with permanent consequences. The weights were now on BitTorrent, which meant they were everywhere, which meant they could never be retrieved. You cannot unpublish a number. The Verge wrote it up on March 8, framing the event as both an accident and a warning.

Inside Meta the immediate response was muted. The company filed a few copyright takedown notices, which did nothing, and otherwise let it run. What the leak set loose in the weeks that followed is the part that mattered. Researchers who had never been on any approved list began fine-tuning LLaMA on rented GPUs and home machines. A small team at Stanford took the 7-billion-parameter model, trained it on roughly fifty-two thousand example instructions that they had generated cheaply using OpenAI’s own API, and on March 13 released something they called Alpaca, which behaved like a budget ChatGPT. They put the cost of the fine-tuning at under a hundred dollars and the data at a few hundred more. A developer named Georgi Gerganov wrote a compact program in C and C++ called llama.cpp that ran the model on an ordinary laptop, no data center involved. The thing Meta had tried to gate became, within a month, the foundation of a worldwide hobbyist industry, built against the company’s stated wishes.

And here is the turn no one had drawn up. The accident worked in Meta’s favor. The leak handed Meta something its closed competitors could not purchase at any price: thousands of outside developers improving Meta’s model for free, finding its weaknesses, extending it into new languages and uses, and making the name Llama the default vocabulary of anyone who wanted an AI they could run themselves. By the time Meta shipped its next version, the leak looked less like a security failure than like a market test that had come back strongly positive. So Meta decided to do on purpose what had been done to it by accident.

The man who made that call was Mark Zuckerberg, which is one of the odder facts in this story. Zuckerberg had spent more than a decade as the most-criticized executive in technology, the architect of an advertising machine that monetized attention and personal data with a thoroughness that produced Congressional hearings and multibillion-dollar European fines. He was nobody’s idea of an open-source idealist. But he had also watched Apple tax Meta for years through its control of the iPhone, taking a cut of transactions and, with a single 2021 privacy change that let iPhone users block ad tracking, knocking roughly ten billion dollars out of Meta’s annual revenue. The lesson Zuckerberg drew had nothing to do with ideology. Never again build your business on a platform a rival owns. If artificial intelligence was the next platform, and if a few American labs were going to own the closed frontier models the way Apple owned iOS, then Meta’s defense was to make the foundation itself free. Commoditize the layer your competitors mean to charge for. Get the world to standardize on your model, and the model becomes infrastructure, and a company that everyone’s infrastructure depends on holds the high ground.

On July 18, 2023, Meta released Llama 2 in 7-, 13-, and 70-billion-parameter sizes, trained on two trillion tokens, with Microsoft as a launch partner and a license that permitted commercial use. There was one pointed exception. Any company with more than 700 million monthly active users had to seek Meta’s permission first, a clause that excluded exactly the small set of rivals large enough to threaten Meta directly. The company called Llama 2 open source. The Open Source Initiative, the nonprofit that had defined and policed that phrase since 1998, said plainly that it was not. A license that restricts who may use the software, and for what, fails the foundational test of open source, and Meta disclosed nothing about the data the model was trained on, so no outsider could actually reproduce it. The argument over a single phrase had begun, and it would harden into one of the defining fights of the era, the subject of the chapter that follows. It is worth fixing the vocabulary now, because the imprecision is deliberate on all sides. The accurate, neutral term for what Meta shipped is open weights. You can download the model and run it yourself, full stop. Whether that also earns the older, prouder label of open source is a separate and contested question.

A year on, Meta stopped hedging about capability. On July 23, 2024, it released Llama 3.1, including a 405-billion-parameter version trained on roughly fifteen trillion tokens across as many as sixteen thousand of Nvidia’s H100 GPUs, with a context window of 128,000 tokens. On the standard benchmarks it landed at rough parity with the closed flagships of the moment, OpenAI’s GPT-4o and Anthropic’s Claude 3.5 Sonnet. For the first time a model anyone could download for free sat at the actual frontier rather than a year behind it. Meta also rewrote the license to permit using the model’s outputs to train other models, an explicit blessing of the distillation that the closed labs forbade in their terms of service. And the same day, Zuckerberg published an open letter titled “Open Source AI Is the Path Forward.”

The letter was an argument from history. Closed platforms had lost to open ones before, he wrote, pointing at the way the open-source operating system Linux had displaced proprietary Unix to become the standard that runs most of the world’s servers. He expected AI to follow the same arc, with open models becoming the industry standard the way Linux had. The doctrine had a name now, and it stuck: Llama would be the Linux of AI. Zuckerberg cast the closed labs not as competitors so much as a danger to be routed around, a concentration of power that ought to be broken up by giving everyone the tools. A few weeks earlier, in a June 2024 interview, he had put the contrast more bluntly, saying he found it a turnoff when people in the industry talked about building one true all-powerful AI as if they were “creating God,” and arguing that the future would hold many AIs reflecting many different interests rather than a single system one company controlled. Meta, by his framing, was merely shipping useful software, the way an infrastructure company should.

The intellectual case for openness inside Meta had a louder and older champion than Zuckerberg, and his presence is the reason the doctrine read as conviction rather than mere calculation. Yann LeCun, by then Meta’s chief AI scientist, had built the company’s research lab a decade earlier and won a share of computing’s highest honor for the foundational work on the neural networks that made all of this possible. He had spent his career publishing in the open and believed, as a matter of scientific principle, that progress came from many eyes on a problem rather than few. Applied to model weights, his argument was the mirror image of the safety camp’s fear. Releasing the weights, LeCun held, meant more researchers probing them for flaws, more independent red-teaming, more security through scrutiny rather than through secrecy, and he regarded the dread of catastrophic misuse as wildly overstated, given how much capability was already loose in the world. He had been making versions of this case in public for years, often sharply, against former collaborators who had come to believe the opposite. Where Zuckerberg framed openness as a business hedge, LeCun framed it as how science is supposed to work, and the two arguments together gave Meta’s open-weights program both a balance sheet and a conscience.

For a while the strategy looked like it was winning on its own terms. Llama became the most-downloaded model family on the public commons where open models live, the substrate that a generation of startups and researchers built on without asking anyone’s permission. The leak that had embarrassed Meta in 2023 had been converted into a genuine asset, and the asset was working. Other players were picking up the open banner too, a defiant Paris startup throwing its models onto the internet as bare magnet links, and Chinese labs releasing capable models under permissive licenses, until the open frontier began to look less like Meta’s project and more like a global movement with momentum of its own. That widening contest, and the fight over what “open” even meant once policymakers got involved, is where this part of the book is headed.

What is striking, with the benefit of standing in 2026 and looking back, is that the most consequential consequence of the leak was the one nobody had argued about at the time. The debate in 2023 had been framed almost entirely as a safety question, whether putting frontier weights in anyone’s hands handed dangerous capability to people who would misuse it. That argument continued, unresolved. But the leak’s deeper effect was structural. It demonstrated, by accident, that a single company could not control the diffusion of a model once the numbers existed, and it converted that loss of control into a strategy that reshaped the competitive map. Open weights became the way a challenger could enter a market dominated by a few American giants without first raising the hundreds of millions of dollars those giants spent. It became the way a country that did not own a closed frontier lab could refuse dependence on one. The release of model weights stopped being mainly a researchers’ ethical question and started becoming something closer to industrial policy, decided as much by competitive logic and national interest as by principle.

Which is what makes Meta’s later hesitation the natural end of this chapter and the bridge to the next. The company that had turned a leak into a doctrine began, by 2025, to wonder whether the doctrine should hold all the way to the top. Meta’s launch of Llama 4 on April 5, 2025, was overtaken by a benchmark embarrassment that the next chapter tells in full, and the episode dented confidence in the whole program. Then came the deeper shift. Through 2025 Meta reorganized its AI work around the explicit pursuit of superintelligence, forming a new group it called Meta Superintelligence Labs and recruiting for it with compensation packages that became their own news. On July 30, 2025, Zuckerberg published a memo titled “Personal Superintelligence” that read very differently from his confident open-source manifesto of the year before. Superintelligence, he wrote, would raise novel safety concerns, and Meta would need to be rigorous about mitigating those risks and, in his words, “careful about what we choose to open source.” The man who had argued in 2024 that open was simply the path forward was now reserving the right to close the door on the most powerful systems his company built.

The reorganization put strain on the conviction that had underwritten the whole program. The new structure put Meta’s AI work under Alexandr Wang, the founder of the data-labeling company Scale AI, brought in through the deal Chapter 41 lays out, and the priority shifted toward commercial products built on large language models. LeCun, who had spent years arguing that those models were a dead end on the road to real machine intelligence, did not fit the new map. In November 2025 he confirmed what had been rumored for weeks, that after twelve years he was leaving Meta to build the world-models research he had long championed into a new Paris company, AMI Labs — a departure Chapter 41 follows in detail. The in-house conscience of Meta’s open-weights doctrine had walked out the door at the precise moment the company turned cautious about the doctrine itself.

So the leak resolved into a paradox that the rest of this part of the book has to reckon with. The thing Meta could not stop in March 2023 became the thing Meta chose to do, and then became the thing Meta did so well that it lost ownership of it, as Europe and China took the open banner and ran further with it than Meta intended. By the time Meta began wondering whether its best models were too dangerous to give away, the question had stopped being Meta’s to answer alone. Once the weights are loose they stay loose, and that simple, irreversible fact turned out to be less a danger to manage than a force to be reckoned with, one that had already escaped the company that first set it free.