What "open source" actually protects you from

A headline says a piece of AI infrastructure is now open source, and from the outside you cannot tell whether that is a fact about your business or a fact about somebody else’s. On 18 August 2026, Modular, now a Qualcomm company, put the Mojo compiler and its tooling under the Apache 2.0 licence with LLVM exceptions, a week after the language reached version 1.0 [1]. If you run a two-person studio, nothing about your Tuesday changed. A compiler sits several floors below anything you will ever open.

But the same word gets used for the model behind your assistant, the automation tool holding your workflows, and the protocol your tools talk over, and in those places it decides real things: whether you can be cut off, repriced, or told your use is not permitted. This guide is about telling those cases apart, and about the number that actually measures your exposure, which is not on any licence page. It is not written for people who ship model weights, write GPU kernels or run a procurement function. It is for the person who wants to know whether the word “open” on a product page changes anything they should do.

Three different things wear the word open

Open source code is the strict case. Someone publishes the source, under a licence that lets you read it, change it, run it for any purpose and pass it on. Mojo is now that: compiler and tooling under Apache 2.0 with LLVM exceptions, on top of a standard library that has been taking outside contributions since 2024 [1]. Even here the fine print matters. Modular says it is not ready to take contributions to the compiler and tooling, and aims to accept them by the end of 2026 [1]. You can fork it today. You cannot get your patch merged today.

Open weights is the loose case, and it is the one you meet most. A lab publishes the trained numbers, and you may download and run them. DeepSeek publishes DeepSeek-V4-Flash-Vision-Exp, 305 billion parameters, under the MIT licence [5]. OpenAI released gpt-oss-120b and gpt-oss-20b under Apache 2.0 on 5 August 2025 [4]. That is generous, and it is still not open source in the strict sense. The Open Source Initiative’s Open Source AI Definition 1.0, published on 28 October 2024, asks for three things: information about the training data detailed enough that a skilled person can build a substantially equivalent system, “the complete source code used to train and run the system”, and the parameters [2]. Publishing the third without the first two is what open weights means. Using that phrase instead of open source is not pedantry. It tells you exactly what you got: a file you can run, not a recipe you can rebuild.

Open standards are the third kind, and the cheapest for a small operator to benefit from. The Model Context Protocol, which is how AI apps connect to outside tools and data, was donated by Anthropic to the Agentic AI Foundation, a directed fund under the Linux Foundation, on 9 December 2025, with Block and OpenAI as co-founders and Google, Microsoft, Amazon Web Services, Cloudflare and Bloomberg among the supporting organisations [6]. You will never read that specification. You still get the benefit, because a connector written against a neutral standard keeps working when you change which assistant you point at it.

An open licence removes a veto, not a moat

An open, hardware-neutral compiler gets read as a challenge to NVIDIA, and the reason it is a smaller one than it looks shows up in your own stack too. NVIDIA introduced CUDA in November 2006, a general purpose parallel computing platform and programming model that uses the parallel compute engine in NVIDIA GPUs [7]. Two decades later, what keeps AI work on NVIDIA hardware is not only the chips. It is the accumulated libraries, sample code, tutorials and the population of engineers who already know it. An open, hardware-neutral alternative removes one objection, that the toolchain belongs to a single vendor. It does not remove twenty years of accumulation, and no licence change ever will.

Scale that down to your size and the lesson survives intact. Suppose the automation platform holding your 40 workflows open-sourced itself tomorrow. Your position would improve in exactly one way: the vendor could no longer end your access unilaterally, because you or someone you hire could run it yourself. Everything that actually makes leaving expensive would be untouched. The 40 workflows are still 40 workflows. The webhooks in other people’s systems still point at yours. The person who understands the branching logic is still you. Openness is insurance against a vendor’s decisions. It is not a discount on your own migration.

This is also why the strategic reading of these announcements rarely helps you. A company that opens a layer is usually attacking a competitor’s lock-in rather than yours, and you are the terrain, not the beneficiary. Judge the artefact, not the motive.

Openness only helps at a layer you can actually touch

Run one test on any “now open” headline: whether you could personally act on it within a week, with the skills and machines you already have. If not, it is news, not leverage.

For most small operators the answer sorts the stack cleanly. The compiler and kernel layer, where Mojo and CUDA live, is not actionable at any price, and it is fine to skip those stories entirely. The model layer is semi-actionable, because you can download open weights and run a smaller model, at a cost in setup time and quality that is real. The automation layer is genuinely actionable: a technical person can stand up a self-hosted workflow tool without asking anyone’s permission, and it is the layer where losing access hurts most, because it runs while you sleep. The application layer, meaning the assistant you type into and the workspace your documents live in, is almost entirely closed, and the protection you get there comes from exports and standards rather than from source code.

So the practical move is to spend your attention where the openness is usable. Do not congratulate yourself for choosing an open compiler you cannot compile. Do check whether the tool that holds your logic could survive its vendor.

Open weights buy you a floor you get to keep

The concrete thing open weights give a one-person business is a fallback that cannot be withdrawn. A hosted model can be deprecated, repriced, rate-limited or refuse your request. A file on your disk does none of those things. OpenAI states that gpt-oss-120b runs within 80GB of memory and gpt-oss-20b requires only 16GB [4], which puts the smaller one inside a well-specified laptop and the larger one inside a rented GPU box. That is the floor: if every subscription you have went away this month, a version of the work still runs.

Be honest about what the floor is worth. Assume the model you run yourself is behind the hosted one you pay for, and test that assumption on your own work rather than taking either side’s word for it. The gap costs you in output quality, in the time you spend on setup, and in becoming your own operations team. The sensible use of open weights for a small operator is narrow and worth naming: work you are contractually barred from sending to a third party, work whose volume makes per-token pricing painful, and a documented plan B you have tested once so you know it works.

One trap to avoid. Renting an open-weight model from a hosted provider gives you the licence’s freedoms in theory and that provider’s terms in practice. The weights being MIT [5] says nothing about whether the company serving them to you logs your prompts. Openness is a property of the artefact. Data handling is a property of whoever is running it.

The clause that applies to you is usually not the famous one

Reading a licence takes ten minutes, and you are looking for the sentence that touches your situation, not the one that gets quoted.

Meta’s Llama 4 Community License Agreement, with a version effective date of 5 April 2025, is the standard example [3]. The clause everyone repeats requires you to request a licence from Meta if, on the Llama 4 version release date, the products made available by or for you had more than 700 million monthly active users in the preceding calendar month [3]. That clause will never apply to you. Two others might. You must “prominently display ‘Built with Llama’” on a related website, user interface, blogpost, about page or product documentation when you distribute the materials or a derivative work, and if you use the materials to create another AI model you must “include ‘Llama’ at the beginning of any such AI model name” [3]. If you are selling a product with a model inside it, those are design and marketing constraints, and MIT-licensed [5] or Apache-licensed [4] weights carry neither of them.

The same care applies to tools that sit closer to your work. n8n’s repository is public, which is not the same thing as an open-source licence. Its licence is the Sustainable Use License v1.0, which lets you “use or modify the software only for your own internal business purposes or for non-commercial or personal use” and distribute it to others “only if you do so free of charge for non-commercial purposes” [8]. If you self-host it to run your own business, that is squarely allowed. If you were planning to host it for clients as a paid service, the licence is the first thing you needed to read, and the word “open” on a blog post would have told you the opposite of the truth.

Lock-in is measured in hours, not licences

The number that decides how exposed you are is how long it would take to move your work somewhere else, multiplied by what your time is worth. Estimate it honestly and it changes how you buy.

Count four things for any tool you depend on. The content it holds and whether you can export it in a format you can read without the vendor. The logic it holds, meaning prompts, templates and workflows, which almost never transfers between platforms and gets rebuilt by hand. The connections it owns, meaning the other systems pointed at it. And the habits, meaning the number of people who would have to relearn a way of working. A chat assistant such as Claude or ChatGPT scores low on all four, which is why moving between them is mostly a matter of re-saving your prompts. A workspace such as Notion holds content and habits. An automation platform holds logic and connections, which is the expensive combination.

Once you have the number, you can lower it without changing tools. Keep prompts and templates in plain text files you own rather than inside a vendor’s interface. Export your content on a schedule and check that the export opens. Prefer connectors built on a neutral standard such as MCP [6] over one-off integrations that only exist inside one product. Each of those shaves hours off the estimate, and unlike a licence change, you can do them this week.

What still goes wrong

The right to fork is worth exactly what your ability to exercise it is worth. For a business of one or five, that is usually close to zero, and pretending otherwise is how people talk themselves into a self-hosted stack they cannot maintain. The honest version of the argument is narrower: an open licence means somebody could keep the thing alive without the vendor’s consent. Whether anybody actually does is not something the licence promises you.

Licences also move, and a public repository tells you nothing on its own, as the n8n case shows [8]. A company can open a toolchain that used to be closed, as Modular did with Mojo [1], and nothing in an open licence obliges the next release to carry the same terms. The licence you accepted is the one attached to the version you actually hold, so the practical protection is a copy of the code or the weights on your own disk, not a promise on a website. Open weights carry a quieter version of the same problem: a model can be published under MIT and then simply abandoned, and nobody owes you an update, a security fix or a reply.

Finally, none of this touches the thing most likely to hurt you, which is quality. An open option that is noticeably worse at your actual job costs more than the subscription you were avoiding, and no licence compensates for output you have to fix by hand. Choose on the work first, check the licence second, and treat openness as what it is: a reduction in one specific risk, priced in hours you can count.