Open Models Meet Cyber Offense, Grid Strain and Agent Plumbing

Open models are converging with three fields that seem unrelated at first: AI-driven cyber offense, the strained US power grid, and the open protocols that agents run on. Each one changes what it means to release model weights.

Key points

• Gating the most capable vulnerability-finding models works only until open weights close the gap, and on current compute trends that could take a few years.
• Open weights could also give ISPs and utilities defensive tools that do not depend on one vendor's standing with Washington.
• Data centers are now a grid stability hazard, which makes efficient open models and local inference part of energy policy, not just a pricing story.
• Open agent plumbing lets open-weight models slot into production workflows, but vendor caching discounts pull the other way, toward lock-in.
• Long agent runs of about 10 million tokens reward the cheapest capable model, and open weights are usually the cheapest.

Where the lines cross

Open weights and AI cyber offense

Offensive capability has arrived. Anthropic's Mythos Preview helped partners find more than 10,000 high- or critical-severity vulnerabilities across every major OS and browser, and access was held to a closed circle of large firms¹. A criminal group has already used an LLM to find a 2FA-bypass zero-day and write the exploit for a planned mass campaign². On the open-models side, open-weight models crossed 1e26 training FLOP around late 2025, and Epoch expects hundreds of frontier-scale models by 2030³. US officials also accuse Chinese firms of distilling capabilities through US APIs⁴.

Together, these suggest the gated-access model for defense has a short shelf life. We think it is likely, about 65%, that an open-weight model reaches Mythos-class vulnerability discovery by 2028. After that, gating would slow nobody who holds the weights. The risk grows because Chinese actors already sit inside US carrier routers⁵, and the legal basis for sharing threat data now survives on short extensions⁶. There is also a defensive opening. Access to Mythos depends on one firm, and the Pentagon has already tried to blacklist that firm over a policy dispute⁷. An ISP or utility that runs open weights on its own hardware could scan its own firmware without relying on any vendor's politics.

Local inference and the strained grid

Token prices fell about 43% in ten weeks in mid-2026, and Epoch measures a median decline of about 50x a year⁸. Meanwhile the grid is running short of margin. NERC issued a rare Level 3 alert after data centers dropped more than 1,000 MW of load within seconds⁹. DOE models a 34-fold rise in blackout risk from data center demand alone, though critics contest the method¹⁰. Large transformers now take 2.5 to 5 years to deliver¹¹.

This is where small models on people's own devices become an energy question. Inference that runs on laptops and phones spreads load across millions of meters instead of concentrating it in Northern Virginia or ERCOT. The limit is demand growth: cheaper tokens mostly mean more tokens get used. We think distributed inference plausibly eases local siting fights but will not bend national load curves before 2030.

Open protocols and cheap agent loops

The agent stack is becoming shared infrastructure. MCP now sits under the Linux Foundation at close to 500 million SDK downloads a month¹². Plain Markdown context files are the main way developers control coding agents¹³. Neither is tied to a model vendor, so an open-weight model can drop into the same harness as a closed one. The economics favor that swap. The best agents burn about 9.9 million tokens per hours-long attempt and still pass only 11 to 15% of tasks¹⁴, so cost per attempt decides who can afford to retry. Caching pulls the other way: Anthropic bills cache reads at about one-tenth of base input price, and other vendors meter caching differently¹⁵. That rewards shaping context around one vendor's cache.

What the overlap opens up

Neither field shows this on its own. The same open weights that would let a regional utility audit its routers offline, run agents cheaply over open protocols, and keep inference off a fragile grid would also give attackers a stock of zero-days that no export control or API gate can recall. The strategic question moves from whether to release weights to who gets defensive capability first. As our contradictions piece argued, open models are winning on use while trailing at the frontier. In cyber defense, that trailing position is the gap that matters most, and it is closing.