Open Weights, Open Risks: The Z.ai Cyberattack Warning and What It Means for Model Deployment

Anthropic dropped a report this week flagging a powerful model from Chinese AI company Z.ai as a serious cyberattack risk. The core issue isn't capability alone, it's distribution. The model is freely downloadable and modifiable, which means any safety guardrails baked in at release can be stripped out by anyone with the right hardware and motivation.

This is the open-versus-closed debate in its latest form, and it's not going away. Safety researchers keep pointing out that once weights are public, you can't recall them. Fine-tune away the refusal behavior, strip the moderation layer, and you've got a model that'll help with things the original developers explicitly tried to prevent. That's a different threat model than a closed API, where a provider can monitor usage patterns and cut off bad actors after the fact.

The counterargument hasn't lost force either. Open weights mean independent researchers can audit what a model actually does instead of trusting a lab's marketing copy. They mean startups and academic labs outside the handful of companies with frontier-scale compute budgets can still build competitive products. And they mean no single company, American or Chinese, gets to be the sole gatekeeper for a technology this consequential. MIT Technology Review's deeper explainer on this tension is worth a read if you want the full policy weeds, but the practical upshot for anyone deploying models is simpler: the calculus between open and closed isn't about picking a side, it's about matching the deployment context to the actual risk surface.

The Infrastructure Side of the Equation

While the access debate plays out, the compute and energy side of AI keeps grinding forward, and it's arguably the more concrete engineering problem.

Meta just shipped a new batch of models under its Muse and Wonder branding, explicitly built for complex, multi-step reasoning tasks. The pitch is straightforward: compete directly with OpenAI and Anthropic on the kind of agentic workloads that require chaining several steps of reasoning, tool use, and planning together. Early benchmark numbers reportedly look solid across reasoning, writing, and coding tasks, and Mark Zuckerberg is framing this release as Meta's arrival at the genuine frontier rather than a fast-follow. The models will also power Meta's Muse agent product, so this isn't just a benchmark flex, it's meant to ship into a real product surface.

Here's the thing nobody talks about enough when a new frontier-class model drops: every one of these releases, open or closed, has a power bill attached. Training runs at this scale pull enormous amounts of electricity, and inference at scale, especially multi-step agentic inference where a single user query might trigger dozens of internal reasoning steps, multiplies that draw across millions of queries per day.

That's exactly the gap Fervo Energy is trying to fill. The company specializes in enhanced geothermal, using horizontal drilling and hydraulic fracturing (the same subsurface techniques that made shale gas viable) to crack open pathways through underground rock and extract heat in places where conventional geothermal never worked. Fervo just closed a $2.2 billion public offering and expanded its partnership with Google, with plans to scale up plant size and drive unit costs down. The company's Utah facility recently went online as what IEEE Spectrum calls the world's first utility-scale enhanced geothermal plant, delivering carbon-free baseload power, the kind of steady, always-on supply that intermittent solar and wind can't match and that data centers desperately need.

The open question is whether Fervo's drilling techniques generalize beyond the favorable geology of Utah and Nevada. Enhanced geothermal works best where the underlying rock conditions cooperate; scaling it to less favorable formations elsewhere is a genuinely unsolved engineering problem, not a guaranteed win. Still, the fact that Google is doubling down on the partnership tells you something about how seriously hyperscalers are taking the baseload power crunch. AI is also being used to help find untapped geothermal resources in the first place, which is a neat bit of the technology bootstrapping its own power supply.

There's a darker thread running through all of this too. Anthropic separately warned this week that AI models might eventually self-replicate across consumer devices like smart TVs and appliances, without needing data center access at all. That's a speculative, longer-horizon concern compared to the Z.ai cyberattack warning, but it's part of the same pattern: as models get more capable and more distributed, control becomes a systems problem, not just a training-time problem. You can't fully reason about model safety without also reasoning about where the model physically runs and who controls that hardware.

Key Takeaways

The open-weights debate isn't resolving anytime soon, and treating it as a binary (open bad, closed safe, or vice versa) misses the real engineering question: who controls the deployment surface, and what's the actual exploit path. Z.ai's model is risky specifically because it's downloadable and modifiable, not because open models are inherently dangerous.

Meanwhile, the infrastructure layer underneath all of this, power, cooling, compute siting, is becoming just as strategically important as model architecture itself. Fervo's geothermal bet and Google's expanded commitment suggest hyperscalers see baseload power as a genuine bottleneck, not a side concern. If enhanced geothermal can scale past its current geographic sweet spot, it could become a meaningful piece of the answer to AI's growing energy appetite. If it can't, expect the power constraint to shape model deployment decisions just as much as any safety debate does.