Mozilla, Alibaba, and WordPress Headlines Reflect Changing Definitions in AI and Open Source

Robert Jacobi:

Welcome to OCN, the Open Channels News broadcast. Today is August 13th, 2026. I’m Robert Jacobi, your host. We lead today with artificial intelligence, open source, and a question that’s becoming increasingly difficult to answer. What does open mean anymore?

Alibaba opens Qwen with a few strings attached. According to reporting from the South China Morning Post, Alibaba has released the weights for its new flagship Qwen 3.8 Max artificial intelligence model. That’s significant. Qwen has become — and I’m probably saying it incorrectly — Qwen, Q-W-E-N, Qwen has become one of the most important families of open AI models in the world. I’m gonna go with Qwen.

And Qwen 3.8 Max is enormous. We’re talking about 2.4 trillion parameters. Developers can download it, they can run it themselves, they can modify it. Of course, they can distribute it. And for most developers, they can do all of that without paying Alibaba.

But there’s a catch, and it’s a pretty interesting catch that we’ve seen in other open source projects. If you’re operating a model as a service business or an AI work assistant business generating more than $50 million of revenue over a 12-month period, Alibaba says you need a separate commercial license. Internal use is exempt as long as you’re not making the software its output or its underlying model capabilities available to third parties.

So Qwen 3.8 Max is open weight, but it’s not open source in the way that we think about it. And that distinction is becoming increasingly important. Open source has historically been pretty simple. You can use the software, you can study it, you can modify it, you can redistribute it. Obviously, depending on the license, you need to attribute it. Yada, yada, yada, but we get the gist. Those freedoms don’t suddenly disappear because your company becomes successful.

So these are the fun things. Imagine the Linux Foundation saying, congratulations on reaching $50 million in revenue, please call sales. That’s not really how we’ve traditionally thought about open source, but AI is creating a strange middle ground. Companies want the advantage of openness, or the marketing ability to say open, and they want developers downloading their models. They want researchers improving them. They want startups building products around them. They want an ecosystem. Not shocking that they want it all for free. I mean, they spend enormous amounts of money training these models, and eventually somebody in finance asks a perfectly reasonable question: how are we going to make money from this?

Alibaba’s answer appears to be open until you’re big enough to pay. There’s nothing inherently wrong with that business model, not at all. But we should probably be precise about what we’re calling it. Open weight isn’t necessarily open source, and downloadable doesn’t necessarily mean unrestricted.

That’s particularly interesting because Qwen has become incredibly popular. Mozilla says that in February of this year, Qwen models were downloaded more than the next 8 most popular models combined. So these licensing decisions aren’t academic anymore. They’re becoming infrastructure decisions. If you’re building a company on top of an open-weighted model today, you need to understand whether the license you’re accepting today still works if your company becomes successful tomorrow, because switching models after you’ve built your product, trained your systems, and created an entire business model around one of them may not be simple.

Open is useful. Open is great. Licenses matter. They always have. The story was reported by the South China Morning Post.

On to more AI. Shockingly, Mozilla says AI should look more like the internet. And that brings us directly to our second story, because Mozilla’s Chief Technology Officer Rafi Krikorian thinks we’re looking at AI the wrong way. In an interview with Rest of World, Krikorian argues that AI shouldn’t primarily be thought of as a product. It should be thought of as infrastructure. That’s a pretty important distinction. Products belong to companies. Infrastructure becomes something everybody builds upon.

Think about the internet. Nobody owns HTTP. Nobody owns SMTP or email. Nobody owns the fundamental protocols that allow us to do our web stuff. Companies have built enormous businesses on top of those techs, but the foundation remains open. Mozilla believes AI needs something similar.

And Krikorian says something is already happening beneath the headlines that most people aren’t noticing. Consumers may be using ChatGPT or Claude or name your AI, but businesses are increasingly experimenting with open and open-weight models. It’s pretty simple: cost, control, and data — topics that we’ve covered earlier this week. If you’re a company processing enormous amounts of information through AI, sending every request to somebody else’s proprietary model can get expensive very quickly. And if you’re in healthcare, finance, government, any regulated industry, you probably don’t want or literally can’t have your information leaving your infrastructure.

Open models give organizations another option. Download the model, run it yourself, keep the data behind your firewall, fine-tune it for your particular business, and don’t depend entirely on one AI provider.

Mozilla says the performance argument is also getting weaker. According to research cited by Rest of World, the performance gap between leading models and proprietary systems has narrowed to around 3%. That’s huge. Meaning it’s such a small difference at this point. And at some point, businesses are going to start asking whether that last few percent is worth giving up control over their data infrastructure and costs.

But there’s another reason Mozilla thinks open AI matters. Honestly, the rest of the world. The largest proprietary AI companies are naturally going to optimize their products around their biggest markets. Some might say that’s evil, yucky, bad, but it’s not. I mean, that’s business. But it means that certain languages, cultures, and communities outside those markets may never become the highest priority.

Open models change the economics. A community can take an existing model and fine-tune it around its own language, its own knowledge, its own culture, and its needs. You don’t have to convince a trillion-dollar company that your community is important enough to put on the roadmap. Build it yourself, just like open source has always advocated.

And that’s where Mozilla sees a parallel with Linux. Linux wasn’t initially treated as serious enterprise infrastructure either. Today it is literally everywhere. Basically, no, literally servers, phones, clouds, embedded devices, your TV, your washing machine, your refrigerator. Open source became invisible infrastructure, and Mozilla believes open AI could follow the same path.

And that makes the Alibaba story even more interesting because we’re still figuring out what the rules for this infrastructure are going to be. Open source, open weights, commercial licenses, proprietary models. We’re throwing these terms around all over the place, and we probably shouldn’t. If AI really becomes infrastructure, the license underneath that infrastructure is going to matter enormously.

This story comes from Rest of World’s interview with Mozilla CTO Rafi Krikorian.

Oh, and in fun WordPress news, update WordPress now. Now from AI infrastructure and honestly all over the web, if you run WordPress, update it. WordPress 7.0.4 was released yesterday with a security fix for a high-severity remote code execution vulnerability. According to reporting from Security Week, the vulnerability is tracked as a lot of letters CVE and carries a CVSS severity score of 8.8. That’s pretty huge.

The attack requires an authenticated WP user with author-level or higher permissions and the ability to upload files. So not trivial, but the vulnerability involves something that looks like an image but isn’t entirely an image. Let’s go kind of through the process. WordPress looks at the file name, ImageMagick looks inside the file, an attacker could upload what appears to be a PNG but actually contains PostScript instructions. ImageMagick sees the PostScript and hands that content over to Ghostscript, and Ghostscript can execute it. Now your image upload has potentially become code execution.

The vulnerability only affects WordPress installs using ImageMagick and Ghostscript. So this isn’t every WordPress site on earth, and the attacker already needs an account with enough permissions to upload, but it’s not trivial. And in places like publishing environments, newsrooms, membership sites, multi-author blogs, this can be, you know, in a lot of areas. Any WordPress install where multiple people can create, upload content. An author account, as I said earlier, getting compromised is not exactly science fiction. It’s also not the easiest thing to do, but once it’s there, we have issues.

The fix changes how WordPress examines files before handing them to ImageMagick, preventing malicious PostScript from being executed through this path. And there’s some good news for older WordPress installs. The security fix has been backported all the way to 4.7, which is honestly an amazing feature of WordPress.

Still, the recommendation from WordPress itself is straightforward. Update immediately. Sites supporting automatic background updates should begin receiving the security update automatically, if not yesterday already, from major hosts and security providers. Otherwise, dashboard, updates, update now. This is just one of those security stories where there really isn’t a complicated conclusion. Patch your site. This story was reported by Security Week with WordPress confirming the security release.

Ooh, and guess what’s coming up? Yes, WordCamp US starts Sunday. And we’re just days away from WordCamp US. Starting Sunday, August 16th, at the Phoenix Convention Center in Phoenix, Arizona. Sunday is Contributor Day. Monday is Showcase Day, a new feature that was introduced last year. Then Tuesday and Wednesday are the 2 main conference days. More than 50 talks and workshops are scheduled covering development, accessibility, security, content, business, and you guessed it, AI. There is a strong AI thread running through this year’s program and well warranted. We have AI-assisted development, agentic workflows, AI search, and even legal implications of AI. Whether — and whether WordPress itself is ready for an increasingly agentic web.

I’ll be there throughout the week, and Wednesday afternoon I’ll be joining WordPress co-founder Matt Mullenweg on the main stage for the closing keynote fireside chat. We’re going to be talking about open source, not just WordPress. And it’s going to be great. So if you’re coming to Phoenix, and you’ve wanted to ask Matt something about WordPress, open source, AI, community, yada yada yada, this will be your chance. WordCamp US runs through August 16th through 19th in Phoenix.

And boy, that’s today’s edition of OCN, Open Channels News. Today we started with a deceptively simple question: what does open actually mean? Alibaba is testing the boundaries between open models and commercial software. Mozilla believes open AI could become infrastructure, much like Linux and the internet. And the WordPress community continues doing what open source communities have always done: build, fix, update. And we had our arguments about open.

Thank you for joining us. I’m Robert Jacobi, your host. Be open and stay secure.