Frontier models, open models, and how they are compared

What counts as a frontier model#

A frontier model is one of the most capable general-purpose AI models of its time, so the label moves as better models appear.12 Industry groups, researchers and lawmakers each define it their own way.123

One test is capability.1 The Frontier Model Forum, an industry body formed by Anthropic, Google, Microsoft and OpenAI, counts large-scale models that exceed the most advanced existing models and can perform a wide variety of tasks.1 Another test uses a stand-in for capability, such as training compute, the total calculation used to train a model, counted in operations (the individual arithmetic steps a computer performs).4 Epoch AI, a research group, counts a model as frontier if it was in the top five by training compute when it was released.2 The same word names related ideas: "frontier AI" for these models and the work on them, and "frontier labs" or "frontier developers" for the companies that build them.56

In September 2025, California Governor Gavin Newsom signed SB 53, a law that turns the term into a legal test.73 As signed in 2025, the law defines a frontier model by compute: a large general-purpose model trained using more than 10^26 such operations (a 1 followed by 26 zeros).37 As signed, it adds a company-size test: a "large frontier developer" is a company that has trained a frontier model and has more than $500 million in annual revenue.37 The law requires California's Department of Technology to assess new evidence each year, starting by January 1, 2027, and recommend whether and how to update these definitions.37

Open-weight models: releasing the model itself#

An open-weight release lets anyone download a trained model's weights, the learned numbers that make up the model, and run or modify it.8 A closed model keeps its weights private, reachable only through the developer's interfaces.8

Open-weight is not open source: the weights leave out the training data, and a license can limit use.91011 The Open Source Initiative's open source AI definition asks for more: enough information about the training data to recreate a substantially equivalent system.12 With the weights, a company can host a model privately, fine-tune it, and pay only for computing power, while researchers can run safety studies that need the weights.89 But a release cannot be undone: safeguards can be stripped from a copy, which can then run unmonitored, a concern for dual-use skills such as cyberattacks.8 A February 2024 position paper argued that open models aid innovation, competition, transparency and the spread of decision-making power, and that their misuse risk should be judged against existing technology.13

In January 2025, DeepSeek, a Chinese lab, released its reasoning model DeepSeek-R1 with open weights.141516 It also distilled R1 into smaller models built on Meta's Llama and Alibaba's Qwen.14151116 That is what public weights allow: one lab building directly on another's work.17

In October 2026, we covered Anthropic's September 29, 2026 report that Z.ai's open-weight model GLM-5.3 can build working cyberattacks.18 In October 2026, an Interconnects analyst replied that closed frontier models, used through their makers' interfaces, have been documented as the cause of most AI-enabled cyberattacks so far.18

Benchmarks and their limits: contamination and gaming#

Benchmark scores, results on standard sets of tasks used to compare models, are a useful guide, but they can overstate what a model can do.1920 Scores mislead when test questions leak into training, when developers tune for the test, or when they publish only the best of many privately tested versions.2021

Many benchmarks are graded automatically against known answers, so a model that saw the test items in pretraining or post-training can repeat the answers, a problem called contamination.222324 Gaming, tuning a model for the test instead of the skill, is an instance of Goodhart's law: once a score is optimized hard enough, pushing it higher stops improving the real skill and can even hurt it.2025 Saturation is a separate limit: once top models all score near the maximum, a test cannot tell them apart.19 Defenses against contamination include fresh human-written test sets, questions refreshed every month, and arenas where crowds compare two models' answers.242226 For a maintained comparison, Epoch AI's Benchmarking Hub collects results of leading models on challenging benchmarks, from its own tests and outside sources.272829

In April 2025, researchers studying Chatbot Arena, one of the most cited arenas of this kind, reported that a few developers could privately test model versions and retract scores.2126 They found that Meta, in one extreme case, tested 27 private variants on the arena before releasing Llama 4.21 They concluded that letting developers keep only the best score biased the rankings.21 They wrote that this, plus closed models getting more matchups and so more arena data to tune on, led developers to fit their models to the arena's quirks rather than to general quality.21