DeepSeek V4.1-Flash, GLM-5.3 and MiniCPM5-2B: three different readings of "open", mid-September 2026

Three releases from the same week, between September 7 and 14, 2026, tell three very different stories about what "open model" means today. DeepSeek published V4.1-Flash under a clean MIT license, no hidden conditions attached. Z.ai, by contrast, changed the rules for GLM-5.3, the new generation of its flagship family: weights available, but under a bespoke license, after discovering the model was better at finding critical exploits than anyone planned for. And OpenBMB showed that you don't need a giant model to matter: MiniCPM5-2B, just 2.5 billion parameters, beats models twice its size and is built to run on a laptop. Three stories, one useful question for anyone deciding an AI architecture at a company: what actually changes, beyond the parameter count.

DeepSeek V4.1-Flash: multimodal, a one-million-token context, MIT with no conditions

On September 10, 2026, DeepSeek released V4.1-Flash, replacing V4 Pro as the family's more efficient flagship model. It's a Mixture-of-Experts model with a 552-billion-parameter total backbone, built on a causal encoder-decoder architecture that activates only 8 billion parameters for reading and 16 billion for writing — a choice designed to keep compute cost down without sacrificing quality. Context reaches a million tokens, and image understanding is native, not bolted on with a later patch. The license stays the one DeepSeek has used for this tier of models all along: MIT, no revenue thresholds, no attribution clauses, no geographic restrictions. It confirms a trend we've been tracking for months: labs that commit to the most permissive license possible tend to stay consistent about it, release after release.

GLM-5.3: the license is no longer MIT, and the reason is technical before it's commercial

Z.ai had announced GLM-5.3 on August 14, 2026 as its new flagship model for coding and long-horizon agentic tasks — 320 billion total parameters, 18 billion active, an architecture combining linear and sparse attention to cut compute cost and KV-cache memory significantly. But the weights didn't arrive right away: Z.ai held them back for two weeks, stating explicitly that it wanted to complete a cybersecurity review before publishing. They landed on Hugging Face on August 28, no longer under the clean MIT used for GLM-5.2, but under a bespoke license — the "GLM-5.3 License": for nearly every company, Swiss SMEs included, the permissions stay equivalent to MIT. The difference kicks in only for anyone offering the model as a service (Model-as-a-Service) with aggregate revenue above $10 billion over the trailing 12 months: in that case, a Z.ai security review is required before any commercial use. A threshold aimed at a handful of hyperscalers, not at anyone adopting the model internally — but still a reminder that "weights available" no longer automatically means "open source license" in the strict sense.

The reason for the review is in the numbers: on CyberGym, the benchmark that measures the ability to discover real vulnerabilities, GLM-5.3 scores 84.5%, up from 77.2% for GLM-5.2. In testing, Z.ai found 1,097 critical vulnerabilities across Linux, WebKit and FreeBSD, plus a real vulnerability in Cursor — and states that this ability to discover and chain exploits emerged from post-training without being an explicit project goal. For a company evaluating self-hosting GLM-5.3, this isn't an academic footnote: a model capable of this level of offensive analysis needs to be treated, in your own risk assessment, as a dual-use tool — useful for your red team, but to be governed with restricted permissions and isolated environments like any advanced security tool.

MiniCPM5-2B: 2.5 billion parameters, Apache 2.0, built for a laptop

On September 7, 2026, OpenBMB published MiniCPM5-2B, a dense model with 2.52 billion parameters under an Apache 2.0 license — as permissive as MIT, with no thresholds or special clauses. On the average of 34 benchmarks it scores 53.9, beating Qwen3.5-4B, which has nearly twice the parameters and lands at 51.1. The architecture is a standard LlamaForCausalLM with grouped-query attention and a native 131,072-token context: no custom kernels, no fork of the model code, immediately compatible with the tools most teams already use — vLLM, llama.cpp, Ollama, MLX, LM Studio. It's explicitly built to run on hardware you already own: a laptop, a phone, a single modest GPU, not a rented cluster.

What actually changes for a Swiss company evaluating AI this week

• The license needs re-reading on every release, even within the same family: GLM-5.2 was clean MIT, GLM-5.3 no longer is. Knowing a lab "usually ships open" isn't enough.
• A model with elevated offensive cyber capability, like GLM-5.3, needs its own risk assessment before self-hosting — isolated environments, restricted permissions, usage logging — regardless of how permissive the license is.
• Not every project needs a giant model: MiniCPM5-2B shows a well-optimized model under 3 billion parameters can be enough for many business use cases and run on hardware you already have in the office.
• With AI Act enforcement obligations already in force since August 2, 2026, checking a model's license and risk profile before adoption is no longer just prudence — it's part of the compliance you need to be able to demonstrate.

This is exactly the work we do every week for our clients: reading the exact license of every release, assessing a model's risk profile before giving it access to your systems, and choosing — between a giant model and a small, well-optimized one — the one your use case actually needs, not the one taking up the most space on a leaderboard.