Mozilla CTO Raffi Krikorian 对谈 Tim O'Reilly：开源 AI 是主权智能体的底座

Created by Claude with light editing by Tim O’Reilly

Raffi Krikorian, Mozilla’s CTO, joined Tim O’Reilly at our recent AI Codecon to talk about open source AI. Mozilla, of course, is the nonprofit that helped to define the open source revolution back in the late 1990s. Though its Firefox web browser was superseded as the market leader by Google Chrome, it played an essential role, along with Apache and the World Wide Web Consortium, in establishing the open standards of the web and keeping it from being dominated and enclosed by Microsoft, the dominant tech platform of that time. Now, Mozilla is one of the leading voices working to build an open, standards-based AI ecosystem.

Tim has long appreciated Raffi’s thoughtful, human-centered approach to technology. Raffi writes a newsletter called Owners Not Renters, whose message can be summed up by his statement that he doesn’t want a future with seven AGIs. He wants one with seven billion. He wants each of us to have an AI that we can trust with our secrets and that will look out for our interests, not an AI that’s optimized for the business model of its creators. In the early days of the web, we called the browser a user agent for a reason, Raffi said. It was on your side. It let you render pages however you wanted, managed your privacy and your cookies, and did its best to protect you from those who wanted to take advantage of web users. We need the same thing in the age of AI.

Raffi cited a paper in which researchers tested whether AI assistants could be trained to favor a company’s commercial interests over user welfare. In simulated flight-booking requests, 18 of 23 models recommended a more expensive sponsored option over a cheaper one more than half the time. It’s a hypothetical choice that we’ve seen play out time and time again, in industry after industry.

Open source AI is a big part of what it will take to get to Raffi’s vision. But sovereign AI loyal to each individual needs more than open source models alone. Raffi’s list of what has to be built around the model starts with memory, a place where your private data can live. It includes tool calling, so an agent can make a purchase or book a doctor’s appointment for you, the runtime environment where all of that runs, and the rules for how his agent talks to those working on behalf of others. It needs a harness. “That’s where evaluations happen. Guardrails happen, execution loops happen, tool calling happens, memory,” he explained. “All of that stuff is an opportunity, in my mind, of things that open source developers can be building.”

People hear the word “harness” and conclude that we need an open source version of whatever the proprietary labs are building. Tim asked Raffi whether a user-centered harness might do different things than those offered by the big labs. He agreed. The whole point of open source is for people to “scratch their own itch.” The ability to innovate without permission is the heart of the open source promise.

As a result, Mozilla wants to build a starting point. It aims to help the community define what an open memory protocol, a storage protocol, or authenticated tool calling with the right guardrails ought to look like. As Raffi noted, “Once we could define what those open standards look like, then a whole plethora of people can start playing and be interoperable. It’s basically. . .the internet all over again. We can build trillions of dollars of market cap on top of open protocols.”

Ease of use is still lacking, though. Mozilla’s 2026 State of Open Source AI report says open models are now within about 3% of the frontier, yet they don’t make it into production at the same rate as closed models. When Tim asked why, Raffi explained that open source is easy to release but hard to deploy. Developers still have to figure out hosting, provisioning, guardrails, and memory. With OpenAI’s or Anthropic’s API, you just hand over a credit card. What’s missing, he said, is the equivalent of a double-click installer for getting open source AI running inside an organization. But the companies that do the work to adopt open source AI are seeing big savings because open models are already good enough for most use cases. As Raffi put it, “You don’t need a Ferrari to manage your calendar.”

Raffi’s own daily agentic helper is Hermes running on GLM. He expects that Apple, Microsoft, or someone else will make this kind of agent into a consumer product in a couple of years, and that his mom will end up using it. For now, he said, we’re on the wrong part of the innovation curve, where you have to know how to code to get any of this working.

Tim disagreed. The industry goes through periods that are exciting for developers, creators, inventors, and companies trying to invent the future, and then it gets boring and a few big companies dominate it. We’re in the exciting part, he argued, before everything shakes out. As Raffi riffed, this is when we get to formalize what that future should look like.

The Clothesline Paradox

Tim wasn’t sure that we’ll need a commercially supported version of the kind of “roll your own” agentic rigs now favored by independent developers. After all, neither desktop Linux nor OpenOffice turned out to matter anything like as much as open source developers of the time expected. Instead, open source became the foundation layer for a new generation of web-based applications. It’s hidden way down in the guts of Google, Amazon, Meta, and countless other applications we rely on today.

This is already beginning to happen again with AI. The Mozilla report says that as much as a third of real-world usage is already on open models, although only 4% of model-layer revenue made its way to the open source ecosystem. Tim called the discrepancy a feature rather than a bug, and Raffi agreed that the stat is misleading. As Tim pointed out, many of the most important technologies “create more value than they capture,” and he used Steve Baer’s concept “The Clothesline Paradox,” from a 1975 article in Stewart Brand’s CoEvolution Quarterly, to explain why we’re good at measuring value capture but not so good at measuring value creation.

Baer pointed out that if you put your clothes in the dryer, the energy you use is measured and counted, but if you hang them on the clothesline to be dried by the sun, the energy saved disappears from our accounting. This argument resonated with Tim in the early days of his open source advocacy. As he noted, it’s always bothered him that nobody seemed to recognize that open source software didn’t “win” in the same way as proprietary software. It won by becoming the foundation everyone else builds on.

AI should be thought of as infrastructure

Raffi’s comment that we’ve made a category error by treating AI as a product fits right in with this line of thinking. If an AI company goes out of business, its product disappears. If it changes its business model, it may yank features you depend on. It’s not just individuals who need sovereign AI. Countries are passing laws about where data can be processed and how it moves in and out, and some of those requirements may not be compatible with the way the big labs plan to monetize their technology. What those countries are asking for is infrastructure. A road outlasts the contractor who built it. Raffi thinks open, downloadable models are the only way to provide long-lasting foundational infrastructure.

According to OpenRouter stats, Chinese models now supply more routed tokens than American ones. Tim asked whether we should worry about that. Raffi said the problem isn’t China but market concentration. The leading open models are from China. The leading closed models are all American. Access to either can be cut off by an executive order. We saw a version of that in June, when Anthropic temporarily suspended access to its Fable models to comply with export controls. It’s a problem that both the leading proprietary models and the leading open-weight models are each concentrated in a single country.

Diversity is one foundation of resilience. Raffi argues, for instance, that hospitals should all download a local model as a backup. None of us would run an important computer without an uninterruptible power supply, so why would a hospital doing triage with AI rely on a single intelligence provider? There are a lot of possible rug pulls. The government could restrict open source or restrict the frontier models. Having a backup plan is a good idea.

Safety is also part of the foundation. During the Q&A, an audience member asked about the recent sandbox escapes at OpenAI and Anthropic. Raffi joked that the best part was watching everyone try to one-up each other with accounts of how powerful and hard to control their models are. But he agreed that guardrails are actually a hard problem. Keeping personally identifiable information from leaking out through an LLM call means looking for much more than Social Security numbers. Eventually we’ll have models defending models, but the foundational frameworks for guardrails aren’t good enough yet. (NVIDIA’s safety platform announcement, released after Raffi and Tim’s conversation, suggests that better guardrails need to be implemented outside the model.)

In conclusion

Tim opened AI Codecon by noting that open and closed systems have always coexisted, and that the idea that one of them will win is a mistake. Closed systems, like Apple’s, Google’s, OpenAI’s, and Anthropic’s, can optimize for ordinary people and deliver value to billions. Open systems are better for innovation and sovereignty, and for pushing technology into new countries and new markets.

Raffi closed the conversation by observing that a well-tuned harness can improve model performance by as much as 20% on some coding tasks. You don’t have to be a machine learning engineer to make a difference at that layer.