Garry Tan relocates AI's moat from the model weights to the price list

Tan's condition is where the money is. CNBC reports that he wants regulators to build an equilibrium between open weight models and frontier models, on the condition that frontier models keep a price premium big enough to make their business model feasible ^[10]. That puts the defensible asset in the price list, or rather in the size of the gap between two price lists. Distillation, as the practice is defined, uses the outputs of a more capable model to train a smaller or less capable one ^[3]. A rule against it is a rule protecting that gap.

Then there is Y Combinator's own book. Of the 196 startups presenting at Demo Day, 149 were categorised as machine learning and AI ventures ^[18], about 76 per cent of the cohort, with 47 outside it ^[19][20]. Those 149 are buyers of inference. Open weights that come within reach of frontier capability cut their cost of goods, and Tan runs the firm that owns a slice of each of them.

The copyright point is the one doing real work, and Tan raised it: much of the data used to train these models may be covered by copyright ^[7]. The New York Times sued OpenAI and Microsoft in 2023 over unauthorised use of its articles as training data ^[8]. A consortium of book authors settled with Anthropic in 2025 on a similar claim ^[9]. A lab asking Washington to police what comes out of its models is simultaneously defending how it got what went in.

What this record does not contain is the advisory. The NSA, CISA and FBI released an official cyber security advisory on distillation on Tuesday ^[6], and CNBC's account does not say what it recommends or whether it names a company ^[21]. OpenAI's side of the case is stated as a belief, that DeepSeek's V3 and R1 architectures were distilled from GPT-4 and GPT-4o ^[5]. Anthropic has named Moonshot AI, DeepSeek and MiniMax ^[4].

On safety Tan drew the line at operational risk. "We need to be focused on science fact, not science fiction," he said ^[13]. "We need to be responding to what is happening right now. If there was a breach and a coordinated attempt by agents to take over our infrastructure, what do we do about it?" ^[14] Anthropic said on Thursday that it had blocked Claude access in five cases of scientists in unspecified foreign countries researching dangerous pathogens, out of concern they were covertly building bioweapons ^[16].

There are three ways this goes from here. Enforcement arrives with teeth, bulk sampling of frontier APIs gets metered, and proprietary weights keep some scarcity value. Or frontier capability compounds faster than a distiller can copy it, and the premium survives with no rule at all. Or the premium compresses toward open weight pricing and the frontier margin comes to rest on distribution and switching costs. Tan called the balance he wants "a tightrope" and said it "could result in the best possible outcome" ^[12].

My read is the third one. What would prove it wrong is an open weight model matching frontier benchmarks while frontier list prices hold, because that would locate the premium in distribution and reliability, which no amount of sampling can copy.