Open-Source LLM Landscape 2026: What's Actually Open

This is a living map of the open-weight LLM field, rebuilt in October 2026. Every licence, parameter count, context length and download figure below was read directly off the Hugging Face model card, config file or licence text on the date of writing — not copied from a launch post. Where a number is vendor-reported, it says so.

The single most useful thing this page can tell you is not which model scores highest. It is which models you are actually allowed to ship. In 2026 those are different questions, and the gap between them has widened sharply.

Where does the open-weights frontier actually stand in October 2026?

Four things define the current state of the field.

1. The frontier is genuinely open — at the top. Z.ai's GLM-5.3, Moonshot's Kimi K3 and DeepSeek's V4.1-Flash all have downloadable weights and all sit within a point or two of the leading closed models on agentic coding benchmarks. Kimi K3 is a 2.8T-parameter model; its card describes it as the world's first open 3T-class release. You can download it today.

2. The newest tier is not open. Through September 2026, both Z.ai and Alibaba shipped their newest and most expensive variants as API-only products with no weights at all — GLM-5.3-Prime, GLM-5.3-FlashX, Qwen3.8-Max-Prime and Qwen3.8-Omni-Flash are all served commercially and none has a Hugging Face repository. Meta's Muse Spark line has reached version 1.3 while the weights promised in August have still not appeared. This is the most important structural change of the last quarter, and it gets its own section below.

3. "Open weights" increasingly means "open with conditions". MIT and Apache 2.0 are no longer the default at the flagship tier. Z.ai, Moonshot and Alibaba have each written a bespoke licence containing a Model-as-a-Service carve-out with a revenue trigger. These are real constraints with real dollar thresholds, and they are frequently reported as if they were ordinary open-source licences.

4. Two Western labs have quietly stopped shipping. Meta's meta-llama organisation has not published a new model since April 2025 — Llama 4 Maverick and Scout remain the last of the line. OpenAI's openai org has published no new open language model since gpt-oss-120b and gpt-oss-20b in August 2025. Google still ships Gemma 4 under Apache 2.0, and there is no Gemma 5. The open frontier that moved in 2026 moved almost entirely in China.

Which open-weight models lead right now?

Here is the current open-weight field, with the licence stated plainly. Context lengths come from each model's config.json; download counts are cumulative Hugging Face figures read on October 5, 2026, and are included as an adoption signal rather than a quality one.

Two things in that table are worth pausing on.

Qwen3.8-27B is the most downloaded new open model of 2026 at 6.76M cumulative pulls, and it is Apache 2.0. A dense 27B at roughly 17 GB in a 4-bit quantisation fits a single 24–32 GB GPU or a well-specified Mac. The combination of "runs on hardware I own" and "licence my lawyer does not need to read" explains the gap between its download count and Qwen3.8-2.4T-A95B's 32.8K — the 2.4T flagship is a datacentre artefact that almost nobody can host.

GLM-5.3-Flash at 5.74M downloads out-pulls GLM-5.3 at 1.44M by roughly 4×, despite being the smaller model. Licence is a plausible part of that: Flash is MIT, the flagship is not. Deep dive: GLM-5.3-Flash complete guide, and how to run GLM-5.3-Flash locally.

What do the benchmarks say?

The most complete cross-model comparison published recently is the table on the GLM-5.3 model card. It is vendor-reported by Z.ai, which means treat the GLM column as the most favourably tuned one — but the harness settings are documented in the card's footnotes, which is more than most launch posts offer, and the comparison set includes both open and closed competitors.

Three honest readings of that table:

• Open and closed are now genuinely close on agentic coding. Terminal Bench 2.1 spans 85.0 to 88.8 across Opus 4.8, GPT-5.6 Sol, GLM-5.3, Kimi K3 and DeepSeek V4-Pro. On that benchmark the open/closed distinction has stopped being a capability distinction.
• The hardest benchmarks still separate them. Terminal Bench 3.0 is the newer, harder sibling, and there the open models sit at 17–28 against 34.6 for the leading closed model. When the task gets long enough, the gap reappears.
• GLM-5.3's standout number is a security benchmark, not a coding one. It leads CyberGym at 84.5, ahead of every closed model in the set. Z.ai's own card frames this as an emergent capability that scaled faster than expected during post-training. Background: what the GLM-5.3 cyber-capabilities claim actually says.

One methodological note that matters if you are comparing numbers across pages: GLM-5.3 and GLM-5.2 are the same base model. Their config.json files are identical — 78 layers, 6144 hidden size, 8 of 256 experts routed, glm_moe_dsa architecture. Every point of difference in that table came from post-training. That is a useful reminder that in 2026 a version bump often means a new post-training recipe rather than a new model.

Is "open source" the same thing as "open weights"?

No, and the distinction is now where most of the practical risk lives. There are three meaningfully different things being called "open" in 2026:

1. Open source by the OSI sense, applied to the released artefacts. MIT or Apache 2.0 on the weights, config and inference code. Use it, sell it, fine-tune it, redistribute it, no thresholds, no separate agreement. GLM-5.3-Flash, DeepSeek V4.1-Flash and V4-Pro, Qwen3.8-27B, Gemma 4, Muse Glimmer, gpt-oss and Leanstral 1.5 are in this group. Note that none of these release training data, so none is reproducible — "open source" here is about your downstream rights, not scientific openness.
2. Open weights under a bespoke licence. Downloadable, commercially usable for most people, but with carve-outs that bite specific business models at specific revenue levels. GLM-5.3, Kimi K3, Qwen3.8-Flash-Next, Qwen3.8-2.4T-A95B, Llama 4, MiniMax M3 and Nemotron 3 Ultra are here. This is now the dominant shape at the flagship tier.
3. Announced-open but not released. Meta said in August 2026 that Muse Spark 1.2's weights would be open-sourced. As of October 5, 2026 the meta-models Hugging Face organisation contains only Muse Glimmer 30B and its variants, and the Spark line has since advanced to 1.3 as a paid API model. Treat announcements as announcements.

If a procurement doc, a vendor deck or a news article tells you a model is "open source", the only way to know is to open the LICENSE file in the repository. The next section does that for you.

Which open-model licences actually let you ship?

This is the table that matters for a build-vs-buy decision. Every row below was read from the licence text in the model's own Hugging Face repository in October 2026. The pattern to notice: the restrictions almost never target ordinary product companies. They target Model-as-a-Service — reselling inference or fine-tuning access in a way that lets your customer control inputs, parameters or training data.

The genuinely counterintuitive finding in that table is the Qwen pair. Qwen3.8-Flash-Next — the smaller, cheaper, more widely deployable model — is more restrictive for MaaS than the 2.4T flagship. The Qwen Community License 1.0 requires a separate licence for any MaaS or AI Work Assistant business with no revenue threshold whatsoever, while the Qwen3.8-Max License applies the same requirement only above US$50M. If you are building an inference product on Qwen weights, the small model is the one that needs the lawyer. Full breakdown of the family: the Qwen 3.8 model lineup explained.

The second thing worth internalising: these thresholds are aimed at competitors, not customers. Z.ai's US$10B trigger excludes essentially every company that is not a hyperscaler. Moonshot's US$20M trigger is low enough to catch a successful inference startup. Alibaba's "AI Work Assistant" definition explicitly names coding and office-productivity assistants — which is to say, products that would compete with Qoder and QwenWork. Read the carve-out as a statement about who the lab does not want reselling its model.

Practical rule: if you are shipping a product that uses a model, almost every licence here is fine. If you are shipping access to a model, only MIT and Apache 2.0 are safe without legal review.

Why did the September 2026 releases skip open weights?

This is the change that has not been widely reported, and it matters more than any individual benchmark. Through September 2026, the two most active open-weight labs both shipped new top-tier variants without weights.

All five are listed and priced on the OpenRouter models API. None appears in its lab's Hugging Face organisation — zai-org's newest repositories are still the GLM-5.3 and GLM-5.3-Flash pair from August 25; Qwen's newest text release is still Qwen3.8-Flash-Next from August 24; meta-models still contains only Muse Glimmer.

The pattern is consistent and it is not a pause in releasing. Both labs are shipping fast — they are shipping the premium tier closed while continuing to open-weight the tier below it. GLM-5.3-Prime is listed at roughly 19× the input price of GLM-5.3-Flash on OpenRouter; Qwen3.8-Max-Prime at roughly 27× Qwen3.8-Flash. The open models are real and good. They are also, increasingly, the second-best thing the lab has.

For anyone planning a self-hosted deployment, the practical implication is a planning assumption rather than a crisis: budget for the open tier to trail the lab's own best model by one step, permanently. It no longer makes sense to wait for the flagship weights to drop, because for a growing share of releases they will not.

There is one counterweight worth stating. The thing being withheld is the top variant, not the capability. GLM-5.3-Flash is MIT, newer architecturally than the flagship it sits beneath, and 5.74M downloads say the market is happy to take it. The open tier is not being starved — it is being capped.

How do the 2026 architectures actually differ?

Architecture has become the main axis of differentiation now that everyone has converged on sparse MoE. The interesting work in 2026 is in attention and KV-cache efficiency, because long-context agentic workloads are what actually cost money to serve.

DeepSeek V4.1-Flash: Causal Encoder-Decoder. Per its model card, V4.1-Flash is a 552B-backbone multimodal MoE arranged as 40 layers — a 20-layer causal encoder followed by a 20-layer decoder. The decoder's global KV cache is projected from the final encoder hidden states rather than derived per decoder layer. The result is that it activates only 8B parameters per token during prefill and 16B during decode. A technique called SWA Bounded Replay reconstructs missing sliding-window KV states by replaying recent tokens, cutting the persistent KV footprint to roughly one-eighth of DeepSeek V4-Flash's. For input-heavy agentic work — long repos, long tool transcripts — that is the most consequential efficiency result of the year. Full detail: DeepSeek V4.1-Flash complete guide.

Kimi K3: Kimi Delta Attention plus extreme sparsity. K3 is built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), with a Stable LatentMoE framework that activates 16 of 896 experts across 93 layers. Moonshot's card claims roughly a 2.5× improvement in overall scaling efficiency over Kimi K2. Native vision, 1M context. See our Kimi K3 guide.

GLM-5.3-Flash: hybrid sparse and linear attention. Flash is the first natively multimodal model in the GLM-5 series and — unlike the GLM-5.3 flagship — starts from a newly trained base. Z.ai's card describes a hybrid architecture combining sparse and linear attention plus Manifold-Constrained Hyper-Connections (mHC), trained on a 30T-token multimodal corpus. Its model_type is glm5_next against the flagship's glm_moe_dsa — the MIT-licensed model is architecturally the newer one. 320B total, 18B active, 45 layers, 8 of 288 experts, 1M context. It also exposes a reasoning_effort parameter with low, high and max levels, defaulting to max — worth setting explicitly, because the default spends a lot of tokens.

Qwen3.8-Flash-Next: a preview of Qwen 4. Alibaba describes this one openly as an experimental preview of the architecture that will underpin Qwen4, and its model_type is literally qwen4_exp. The novel pieces are Qwen Sparse Attention (QSA), which selects at micro-block rather than individual-token granularity, paired with Gated DeltaNet; a Gated Residual mechanism; and N-gram embeddings as a cheap parameter-scaling axis that offloads well on memory-constrained accelerators. 10 of 512 experts active across 48 layers.

Dense still wins below about 32B. Qwen3.8-27B (64 layers), Gemma 4 31B (60 layers) and Muse Glimmer 30B (52 layers) are all dense. Below the MoE break-even point dense models are simpler to fine-tune, simpler to serve and easier to quantise, and they are what most teams actually run. The trade-off is that a dense model is memory-bandwidth-bound, so a same-size MoE will often feel faster on identical hardware.

Are the Chinese labs ahead on open weights?

On open weights specifically, yes — and it is not close. Every model released in 2026 that combines frontier-adjacent capability with downloadable weights came from Z.ai, Moonshot, DeepSeek, Alibaba or MiniMax. The Western contributions to the open tier this year are Google's Gemma 4 (Apache 2.0, March), Meta's Muse Glimmer 30B (Apache 2.0, August), NVIDIA's Nemotron 3 Ultra (June) and Mistral's Leanstral 1.5 (Apache 2.0, July). Meta's Llama organisation has shipped nothing since April 2025; OpenAI's open line has shipped nothing since August 2025.

If you need a strong model from a non-Chinese lab under a clean licence, the realistic shortlist in October 2026 is short: Gemma 4 31B, Muse Glimmer 30B, gpt-oss-120b, Nemotron 3 Ultra, and Mistral's Apache-licensed releases. All are credible. None is at the top of the benchmark table above. That is the honest trade.

On the security question that usually follows: model weights are static files and carry no telemetry — a self-hosted Qwen or DeepSeek deployment does not phone home. The risk surface is the hosted API versions, where your inputs leave your infrastructure. Training-data provenance and supply-chain review are legitimate concerns for your security team to weigh, but "self-hosted Chinese weights leak data" is not a technical claim that survives contact with how inference works.

What hardware do you need to run these locally?

Quantisation is the lever that moves you between tiers. Q4_K_M cuts memory roughly 75% versus FP16 with modest quality loss for most workloads; below Q4, quality degrades noticeably.

The practical read: the 24–32 GB tier is where the open-weights story actually pays off for individuals and small teams, and in October 2026 it is well served by three Apache-2.0 models. Everything at the 1T+ end is a cluster project regardless of licence. For the deployment mechanics — vLLM, SGLang, Kubernetes, GPU capacity planning — see our self-hosting LLMs guide; for Mac-native inference specifically, our Apple Silicon LLMs guide.

When does self-hosting still beat the API?

Less often than open-weights enthusiasm suggests. Hosted inference for open models has commoditised faster than GPUs have got cheaper, and the labs' own APIs are frequently the cheapest way to run their own weights.

• Low and spiky volume: use a hosted endpoint for whichever open model fits. You cannot keep a GPU warm economically for bursty traffic.
• Steady high volume: self-hosting starts winning once you can keep hardware genuinely busy. Run the arithmetic on your actual token throughput rather than assuming.
• Compliance, residency or air-gap requirements: self-host regardless of the cost comparison. This is the case where open weights are not an optimisation but the only option, and it is the single most common reason enterprises fund GPU capacity.
• Fine-tuning on proprietary data: self-host. This remains the capability you cannot buy from a closed lab on your own terms.

One thing the 2026 data makes clear: open weights have not reliably produced price undercutting. When Alibaba open-weighted Qwen3.8-2.4T-A95B, third-party providers largely priced at or above Alibaba's own rate — serving a 2.4T model is expensive for everyone. Expect open weights to buy you control and optionality, not automatically a lower bill.

Which model should you pick for your workload?

Walk this in order. The first constraint that binds picks the model.

1. Are you reselling model access? If yes, restrict to MIT and Apache 2.0 — GLM-5.3-Flash, the DeepSeek V4 line, Qwen3.8-27B, Gemma 4, Muse Glimmer, gpt-oss. Every bespoke licence above has a MaaS carve-out and at least one has no revenue floor.
2. What hardware will actually run it? If the answer is one GPU or one Mac, your field is the 24–32 GB tier and the decision is mostly Qwen3.8-27B vs Gemma 4 31B vs Muse Glimmer 30B. If you have a multi-GPU node, GLM-5.3-Flash is the strongest MIT-licensed option available.
3. Agentic coding or long-horizon tool use? GLM-5.3 and Kimi K3 lead the open field on the agentic benchmarks above, with GLM-5.3-Flash close behind at a fraction of the serving cost. Check the licence against step 1 before committing.
4. Input-heavy workloads — long repos, long transcripts, big tool outputs? DeepSeek V4.1-Flash, specifically for the KV-cache architecture. The 8B-prefill design is built for exactly this shape.
5. Multimodal input needed? GLM-5.3-Flash, DeepSeek V4.1-Flash, Kimi K3, Qwen3.8-27B and Muse Glimmer all handle images natively. Qwen3.8-27B is the only Apache-2.0 option among them that runs on one GPU.
6. Non-Chinese lab required by policy? Gemma 4 31B, Muse Glimmer 30B, gpt-oss-120b, Nemotron 3 Ultra. Accept a capability step down.

What's overhyped and what's underrated right now?

Overhyped:

• Headline parameter counts. "2.8 trillion parameters" sets your VRAM floor; the 16-of-896 active routing sets your inference cost. Kimi K3's total is a hosting constraint, not a quality guarantee.
• Million-token context windows. Nearly every flagship now claims 1M. Retrieval quality at the tail of a very long context remains the real failure mode, and a well-built RAG pipeline over a 128K window still beats dumping a repo into 1M tokens.
• "Open source" in launch coverage. GLM-5.3 and Kimi K3 are routinely described as open source. Both carry bespoke licences with revenue-gated MaaS restrictions. The weights are open; the licences are not OSI.
• Waiting for flagship weights. Five premium variants shipped closed in September alone. Planning around an eventual weight drop is now a bad bet.

Underrated:

• GLM-5.3-Flash. MIT, multimodal, 1M context, 18B active, architecturally newer than its own flagship, and the most downloaded new frontier-adjacent open model after Qwen3.8-27B. If you need one strong open model with a licence nobody will question, this is currently the answer.
• Qwen3.8-27B. 6.76M downloads, Apache 2.0, ~17 GB at Q4, 262K context, native vision. The best "runs on hardware I own" option of the year. Our Qwen3.8-27B guide has the hands-on detail, including the overthinking caveat — set reasoning_effort low or medium first.
• Reading the licence before the benchmark. It takes ten minutes and it has eliminated more bad architecture decisions this year than any eval suite.
• Gemma 4 31B. 9.87M downloads, Apache 2.0, dense, 262K context, from a lab with no MaaS carve-out agenda. Unglamorous and still the safest default for a lot of production work. See our Gemma 4 guide.

FAQ

What are the best open-source LLMs in October 2026?

For agentic coding with downloadable weights: GLM-5.3, Kimi K3 and DeepSeek V4-Pro lead, with GLM-5.3-Flash close behind at much lower serving cost. For a genuinely OSI-licensed model you can ship without legal review: GLM-5.3-Flash (MIT), DeepSeek V4.1-Flash (MIT), Qwen3.8-27B (Apache 2.0), Gemma 4 31B (Apache 2.0). For a single GPU or Mac: Qwen3.8-27B, Gemma 4 31B or Muse Glimmer 30B.

Is GLM-5.3 open source or not?

Partly. GLM-5.3-Flash is MIT — fully open source for the released artefacts. The GLM-5.3 flagship is not: it ships under a bespoke "GLM-5.3 License" that is MIT-like in body but adds a clause requiring any Model-as-a-Service operator with over US$10B aggregate revenue in any consecutive 12 months to pass a Z.AI security review before commercial use. Both have open weights on Hugging Face as of August 25, 2026. The widely repeated claim that GLM-5.3 launched with weights withheld was true only for the first eleven days after its August 14 announcement.

Is Kimi K3 free for commercial use?

For most companies, yes. The Kimi K3 License permits commercial use, modification and redistribution. Two clauses to check: if you operate a Model-as-a-Service business exceeding US$20M aggregate revenue over any 12 months you need a separate agreement with Moonshot AI, and if your product exceeds 100M monthly active users or US$20M monthly revenue you must display "Kimi K3" prominently in your UI. Purely internal use is exempt from both.

Which Qwen 3.8 models are Apache 2.0?

Qwen3.8-27B is Apache 2.0. The others are not. Qwen3.8-Flash-Next ships under Qwen Community License 1.0, which requires a separate licence for any MaaS or "AI Work Assistant" business with no revenue threshold. Qwen3.8-2.4T-A95B ships under the Qwen3.8-Max License, which applies the same requirement above US$50M aggregate 12-month revenue. Qwen3.8-Max-Prime and Qwen3.8-Omni-Flash have no open weights at all.

When is Gemma 5 coming out?

Google has not announced Gemma 5, and no Gemma 5 repository exists on Hugging Face as of October 5, 2026. Gemma 4 remains the current generation, Apache 2.0, with the 31B dense variant the usual pick. Google's most recent Gemma-family additions are DiffusionGemma 26B-A4B (June 2026) and a DiarizationLM Gemma 4 variant (October 2026).

Is there a Llama 5, or has Meta stopped releasing open models?

There is no Llama 5. Meta's meta-llama Hugging Face organisation has published nothing since April 2025, and Llama 4 Maverick and Scout remain the final models in that line. Meta's open-weight activity has moved to the Muse family, where only Muse Glimmer 30B (Apache 2.0, August 2026) has shipped weights. Muse Spark 1.2 weights were announced in August 2026 and still have not been released; the API line has since reached Muse Spark 1.3.

What is the difference between open weights and open source?

Open weights means you can download and run the model. Open source, applied to a model release, means the licence on those weights grants OSI-style rights — unrestricted commercial use, modification and redistribution, with no thresholds or separate agreements. MIT and Apache 2.0 qualify; the GLM-5.3, Kimi K3, Qwen Community and Llama 4 licences do not. Note that no major lab releases training data, so none of these models is reproducible in the scientific sense.

How often does this landscape change?

A flagship-tier open release has landed roughly every four to six weeks through 2026. The structural change to plan around is not release cadence but the September 2026 pattern: premium variants shipping API-only while the tier below stays open. Build your evaluation pipeline so that swapping models is a configuration change, and assume the best open model available will trail the best model a lab has.

Where should I track open model releases day to day?

The most reliable primary sources are each lab's Hugging Face organisation page — zai-org, Qwen, deepseek-ai, moonshotai, google, meta-models — sorted by creation date, plus the model card and LICENSE file in each repository. Cross-check against a provider catalogue such as OpenRouter's models API, which is the fastest way to spot a variant that is being served commercially but has no weights.

What's the short version?

Pick your model in this order: licence, then hardware, then benchmark. In October 2026 that usually lands you on GLM-5.3-Flash if you have a multi-GPU node and want MIT, Qwen3.8-27B if you have one GPU and want Apache 2.0, and DeepSeek V4.1-Flash if your workload is input-heavy. Reach for GLM-5.3 or Kimi K3 only after someone has read the MaaS clause and confirmed it does not describe your business.

The field will move again before the quarter is out. What is unlikely to change is the shape of the problem: capability is abundant, licences are the constraint, and the engineer who can re-evaluate and redeploy a model in a day is worth more than any single model choice. If that is the capability you are missing, Codersera's vetted ML engineers have shipped these models into production systems.

Last verified October 5, 2026 against Hugging Face model cards, licence files and configuration files, and the OpenRouter models API.