Open weights make AI competitive. Open integrity makes it trustworthy.

This week, Cogensec joined NVIDIA, Microsoft, Meta, Hugging Face, CrowdStrike, Palantir, the Linux Foundation, and more than 230 other companies and organizations in signing the Open Weights and American AI Leadership letter.

Most of the coverage has framed this as a policy fight: open versus closed, America versus China, model providers versus regulators. Those debates matter. But they're not why we signed.

We signed because of a question we ask about everything we build: can the people depending on this system verify that it's secure?

Open weights pass that test. Closed black boxes don't. And the principle behind that answer runs deeper than model weights. It defines how our entire industry should think about securing what comes next.

The letter makes an argument that security practitioners have been making for over a century: openness broadens defensive capability. Transparency lets vulnerabilities be discovered and remediated by many teams instead of hidden inside one.

This isn't a new idea dressed up for the AI era. It's Kerckhoffs's principle, stated in 1883: a system should remain secure even when everything about it, except the key, is public knowledge. Every durable security movement since has proven it again. Published cryptographic algorithms outlasted secret ones. Open protocols outlasted proprietary ones. Coordinated vulnerability disclosure made software safer than silence ever did.

The pattern is consistent because the mechanism is consistent: inspection is how trust is earned. A defense that can't be examined can't be verified, and a defense that can't be verified is an assumption wearing a uniform.

Open-weight models bring that mechanism to AI. Researchers can probe them. Red teams can stress them. Defenders can study exactly what they're deploying instead of trusting a vendor's word for it. That is a security posture, not just a licensing choice.

Here's what the open weights debate mostly misses: the model is no longer where the danger concentrates.

The systems being deployed today are agents: models wired into tools, credentials, APIs, other agents, and real-world consequences. And when agents fail in production, the attack almost never comes from inside the weights. It comes from outside:

• Poisoned tool outputs that inject instructions through data the agent was told to trust
• Coerced peer agents that manipulate multi-agent systems through their own collaborators
• Tampered execution chains that alter what an agent does between decision and action

These are exogenous threats, attacks on the system from its environment, not flaws born in the model itself. We've documented this pattern repeatedly in our Agents Gone Rogue incident registry, and the industry's own benchmarks confirm how far detection still has to go. When we ran Agentegrity against the InjecAgent benchmark early in its development, our tool-output injection detection scored a true positive rate of zero. We published that number. It became the organizing principle of our roadmap.

Which brings us to the real point.

If openness is what makes models trustworthy, the same must be true of the infrastructure that secures agents built on those models.

You cannot defend an open agentic ecosystem with closed, black-box security. An enterprise deploying autonomous agents into finance, healthcare, or defense workflows needs to answer hard questions: What did this agent actually do? Was its chain of actions tampered with? Can we prove it? If the integrity layer answering those questions is itself a sealed box, you haven't solved the trust problem, you've relocated it.

That's why Agentegrity is open source. It's framework-agnostic. It composes with LangChain, CrewAI, AutoGen, Bedrock, Google ADK, OpenAI Agents, and others, because agent security infrastructure has to meet builders where they already are, the same way open-weight models do. And it's inspectable end to end, because we believe trust in autonomous systems has to be demonstrated, not asserted.

We publish our benchmarks. We publish our detection gaps. We'd rather show you where the armor is thin than sell you a promise we can't prove.

If you're responsible for deploying agents in a regulated or high-stakes environment, the letter's logic gives you a useful procurement test. Ask of every layer in your agentic stack, the model, the framework, the security tooling:

• Can my team inspect it?
• Can vulnerabilities in it be found and fixed by many parties, or only one vendor?
• When something goes wrong, can I independently verify what happened?

Open weights let you answer yes at the model layer. Open integrity infrastructure lets you answer yes at the agent layer. Anything that forces a "no" is a place where your trust is borrowed, not owned.

The coalition behind this letter understands something important: openness keeps the American AI ecosystem competitive, innovative, and sovereign. We agree, and we're proud to stand with it.

But competitiveness is only half the future. The other half is whether anyone can trust what gets built, whether the agents now entering our hospitals, banks, supply chains, and government systems can prove their own integrity.

Open weights make AI competitive. Open integrity makes it trustworthy.

We signed for the first. We're building the second.