The Closed-Source Moat Is Shrinking Faster Than You Think

Liang Wenfeng said that in the face of disruptive technology, the moat created by closed source is short-lived. The line is often read as an open-source manifesto. That reading is too broad. The claim is narrower. When the technology itself is still being rewritten every few months, what closed source protects, namely a particular set of weights and a particular training recipe, depreciates faster than the company can convert it into a durable advantage. The moat does not disappear. Its half-life shortens.

The claim has a condition that cannot be dropped: “in the face of disruptive technology.” Once the technology settles, the shape of the barrier moves elsewhere. Understanding the argument takes two steps. First, why it holds in large models. Second, when it stops holding. Only then does corporate strategy become tractable.

Why traditional closed source held for decades

Windows, Oracle, and Photoshop are closed source. They have stayed closed for decades and succeeded commercially. Closed source is not an ineffective strategy in itself. Those products worked because two conditions held.

First, users received compiled binaries. Reconstructing the internal implementation from runtime behavior was expensive, often taking years. Second, the products’ advantage did not sit mainly in source-code secrecy. It sat in file formats, developer communities, and user habits. Even if someone wrote software with the same functions, users could not easily migrate. Traditional closed source protected something hard to observe and copy from the outside. Migration cost added another layer. The lead was measured in years.

What mattered was the hidden part: the core needed for competition, while the exposed interface did not give enough away to reverse-engineer it. Closed source worked through an asymmetry between the protected object and the exposed surface.

The structural leak in closed-source large models

A large model’s closed source protects weights and training methods, but the business sells outputs. That business model creates a leak that traditional software did not have. Every API call produces a prompt-and-high-quality-answer pair. For another model company, that pair is a ready-made training sample. A closed model shows its capability to paying users every day. It cannot sell capability without exposing capability.

This is not a theoretical worry. In 2023, I helped a customer-service company with a private deployment. The budget was tight, and large-scale annotation was out of reach. The workaround was to use GPT-4 to generate tens of thousands of dialogues covering the business scenarios, then fine-tune a 7B open model on them. In about two weeks, the fine-tuned model reached 70 to 80 percent of GPT-4’s performance inside that company’s domain. The terms of service did prohibit using outputs to train a competing model. Few people believed that clause could be enforced. That was the first clear sense that in this industry, the word “closed” protects less than one assumes.

OpenAI’s o1 release in September 2024 was the cleanest test. OpenAI hid the chain of thought and showed users only a summary. It was the most deliberate closed-source move in the industry, aimed squarely at hiding the training method for reasoning models. About four months later, DeepSeek R1 appeared with the full chain of thought and the reinforcement-learning approach written into a paper. What had been hidden so carefully bought a short lead.

The record after that is familiar. In early 2025, Microsoft and OpenAI investigated abnormal API access suspected to be linked to DeepSeek. In February 2026, OpenAI submitted material to US lawmakers accusing Chinese companies of distilling its models. In April, the US State Department sent a cable to missions abroad naming DeepSeek, Moonshot, and MiniMax, asking diplomats to express concern about “distilling American models.” This month, DeepSeek released V4.1 Flash-1017, and overseas observers again used a model-fingerprint tool to argue it “looks like GPT.” That tool’s reference library did not include DeepSeek, so the result says little.

How much distillation is real cannot be settled without internal information. But if a company has to rely on terms of service, congressional hearings, and diplomatic cables to hold a lead, technical secrecy is no longer holding it. That is the point: when protection shifts from technology to law and diplomacy, the moat is already shallow.

What distillation takes, and what it cannot take

Liang’s full argument put the value in the team, not in a blanket preference for open source. He said closed source cannot stop others from catching up, so DeepSeek puts value in the team, letting employees grow, accumulate know-how, and build an organization and culture that can keep innovating.

That distinction matters. Distillation can capture “what the model can do at a given moment.” It cannot capture “how to make it at lower cost.” The first is a capability snapshot. The second is production capability.

Take the examples. DeepSeek began using MLA to compress the KV cache from V2. By the company’s account, by V4.1 Flash the KV cache was 437 times smaller than the first generation, and memory demand had fallen to a quarter of the previous generation. V4.1 Flash is a 552B-parameter MoE model that activates only 8B when reading input and 16B when generating. Input and output use an asymmetric structure. The V4 preview was built for Huawei chips. None of this is visible in the model’s answers. One can call the API a million times and learn how it answers. How does one learn how it cut cost under constrained compute? Architecture trade-offs, training pitfalls, and an engineer’s intuition about what a given loss curve means depend on the people.

So the claim can be read this way: closed source can hold one model that has already been built. What decides long-term leadership is the speed at which an organization builds the next one. Distillation can narrow the gap to a few months, but the follower stays behind. Only independent iteration creates a chance to overtake. Open source costs DeepSeek little. It publishes the generation already released. The valuable organizational capability does not leave with the weights.

Liang later pushed the point further in an investor exchange. Even if the model is open and the principles are public, the barrier to using it remains high, and matching the cost is harder still. He said he could not see a necessary benefit to closed source, and anchored the financial logic of open source to “earning only six times profit.” At that margin, third-party deployment cannot easily substitute on cost. Open source erodes the model mainly when a company tries to earn far above a reasonable level. That logic may not fit every company, but it draws a useful line. Open source gives up exclusivity over a released model and may gain a developer community, talent attraction, and influence over standards. Closed source protects exclusivity over an asset that is depreciating.

The condition: the technology must still be in a disruptive phase

The claim depends on fast change. New architectures and training methods appear every few months. Any specific model loses value quickly. Hide it carefully, and several months later it is worth less anyway.

Technology will not stay this fast forever. When architectures stabilize and capability gaps narrow below what users can perceive, the determinants shift.

First, compute and energy. This is the hardest constraint to catch up on, and it has nothing to do with open or closed source. Weights can be open. Clusters, power, and scheduling capacity do not become equal because the weights are public.

Second, data from actual use, especially Agent execution traces in real tasks: where the agent erred, how the user corrected it, how the task was re-planned. This data cannot be inferred from API outputs. Only companies with many real users can obtain it. This is the most likely source of a durable closed-source advantage over the next two or three years, and it matters more than weights. Weights can be distilled. Architectures can be published. Failure traces and correction records from real workflows cannot be bought or reverse-engineered.

Third, distribution and enterprise customer relationships. This is the same lock-in effect traditional software had. When model capabilities converge, players already embedded in enterprise workflows, already on procurement lists, and already relied on by developers gain persistent advantage from migration cost.

“Short-lived” does not mean “without value.” A lead of several months, converted quickly into enterprise contracts and revenue, is commercially valid. Anthropic has done this in coding: closed source, premium pricing in high-value scenarios, with enterprise contracts contributing a large share of revenue. Closed companies may not have misjudged the length of the lead window. They may know the window is limited and choose to monetize it. The two strategies bet on different things: one bets on monetizing the window, the other on organizational iteration. Neither is automatically wrong.

How companies should decide

The useful starting point is to drop the binary question. Ask instead: which layer of the value chain will capture value, and how replicable is that layer at the current pace of technology? Mature AI companies rarely choose “all open” or “all closed.” They practice selective openness: open some layers to grow the developer community, close others to hold advantage.

Three strategic models are common. A closed-first company keeps exclusive control of weights, training pipelines, and data through API or enterprise contracts, aiming for high-margin, predictable revenue. This fits when the technology still has a significant performance premium in high-value scenarios and customers pay for reliability and compliance. The risk is that distillation and open-source catch-up compress the premium, and legal exposure around data provenance and output rights remains.

A selective-open or hybrid company opens the model or tool layer to seed a developer community, then monetizes an adjacent closed layer such as hardware, cloud, enterprise platform, or system optimization. This fits when a hard-to-copy adjacent asset can absorb the demand created by openness. The risks are complex license governance and regulatory scrutiny of platform power and bundling.

An open-core company rewards architecture influence and standard-setting rather than direct code protection. This fits when the organization can sustain continuous iteration, release one generation while developing the next, and run at a reasonable profit. The weaknesses are weak IP capture and ongoing downstream license compliance and liability burdens.

Three dimensions make the decision concrete.

Dimension one: the speed of technology evolution. If the segment is still churning through architectures and training methods, closed source protects a rapidly depreciating model. Put resources into the organizational capability to build the next model, and use open source to gain a developer community and talent. If the technology has entered gradual improvement, model differentiation narrows, and closed protection shifts to workflow data, channel relationships, and compliance assets. Closing those layers becomes reasonable, even necessary.

Dimension two: the layer where value is captured. The weight layer is the most replicable. In a disruptive phase, closed protection there is weakest. In a steady phase, it may be commoditized. Unless a company has a persistent, user-perceptible performance gap, a closed strategy whose core moat is the weights offers poor value. Training methods and engineering know-how are not exposed in outputs, and distillation struggles to capture them. Protection there does not depend on legal closedness. It depends on internal knowledge accumulation and iteration speed. The strongest protection makes the cost curve impossible to match even after others see the model. Interaction traces and Agent execution data are the most likely source of durable closed advantage. If the product can capture such data, design the data architecture and user agreements around it as core closed assets. Distribution and enterprise relationships are the AI version of lock-in. Closedness there appears in contracts, integration depth, and migration cost, not in code secrecy.

Dimension three: monitor the inflection signals. Liang’s claim holds under fast disruption. Companies need to prepare for the condition to fade. Track whether the frequency of architecture innovation in the segment is falling. Track whether the gap between open and closed frontier models is narrowing below what users can distinguish. Track whether procurement decisions are shifting weight from “model capability” to “integration depth, compliance, and total cost of ownership.” When those signals stabilize, the strategic return on open weights falls, and the weight of a closed layout around data traces, channels, and cost structure rises.

Conclusion

The claim compresses to this: when the technology is still being rewritten, closed source protects an asset that is depreciating quickly. What deserves investment is the ability to produce the next asset.

That is not a universal instruction for every company at every stage. The decision is not a label. It starts with the pace of the technology, then finds the layer with the lowest replicability and the strongest capacity for accumulation, and allocates openness and closure across layers. Open what builds a developer community, standards, and talent. Close what distillation cannot take, what outputs cannot expose, and what carries high migration cost.

Whether a closed-source moat is short-lived depends on what the moat guards. Guard one generation of weights, and it depreciates. Guard real data traces, enterprise relationships, and an organization that keeps iterating, and it may last longer than many expect. Liang’s reminder asks every company to know whether it is protecting “this one” or “the next one,” not to open source by default.