The best open-weight models now outscore the closed flagships Google and OpenAI shipped in February 2026, and anyone can run them inside a trusted execution environment (TEE), where even the server's operator cannot read the chat.

The newest is a build of DeepSeek V4.1 Flash that DeepSeek released on 17 October under the MIT license. It joined Xiaomi's MiMo-V2.6-Pro and GLM-5.3 at the top of the open-weight field, with Step 5 Preview and Kimi K3 close behind.

Open-weight models passed the February flagships

Artificial Analysis runs major models through the same set of evaluations, so its Intelligence Index compares like with like. On 21 October 2026, version 4.3.2 of the index read:

Model Weights Score
MiMo-V2.6-Pro Open, MIT 46
DeepSeek V4.1 Flash, 17 Oct build (max) Open, MIT 45
GLM-5.3 (max) Open 45
Step 5 Preview Open 44
Kimi K3 (max) Open 44
GPT-5.6 Terra (max), July 2026 Closed 42
DeepSeek V4.1 Flash, September build (max) Open, MIT 39
Qwen3.8 27B (xhigh) Open, Apache 2.0 34
GPT-5.3 Codex (xhigh), February 2026 Closed 33, estimated
Gemini 3.1 Pro Preview, February 2026 Closed 30

Five open-weight models now score above GPT-5.6 Terra, which OpenAI released in July. Qwen3.8 27B, a model of only 27 billion parameters under the Apache 2.0 license, also beats both February flagships.

The gap is now counted in months

The best closed models still lead: Claude Opus 5.5, released in September, scores 58 on the same index.

Epoch AI, which tracks the capability of models across many benchmarks, measures that lead in months. It found in May 2026 that "since January 2026, the most capable open-weight models have lagged frontier closed models by an average of four months" on its capability index. Epoch puts that gap at 8 points, about the step from GPT-5 to GPT-5.5.

On a tuned stack, TEEs run them at close to full speed

A strong open-weight model only helps privacy if it can run inside a trusted execution environment: hardware that keeps data encrypted in memory and proves, with a signed attestation, exactly what code it runs. On a tuned stack in 2026, that costs 1% to 8% of throughput.

  • In July 2026, NVIDIA served Qwen3.5-397B on an HGX B300 with confidential computing on, under Intel TDX. Throughput fell by 1.0% to 7.5% across 4 to 256 concurrent requests. Once the workload runs, NVIDIA wrote, "attestation does not add latency to individual inference requests."
  • A team at Mozilla benchmarked a standard confidential instance with one H100 under Intel TDX. Throughput fell by 17.7% to 21.1%. The authors write that the results suggest confidential GPU inference "can retain usable throughput under load," as long as capacity planning accounts for the penalty.
  • Two preprints from companies that build confidential inference, one on B200 and one on B300, report that a tuned serving stack wins back most of what a default setup loses.

So the cost runs from a few percent on a tuned stack to a fifth or more on a standard one, and the model is the same in both cases.

Open-weight models in TEEs already serve users

  • Since 15 October 2026, Brave's assistant Leo encrypts chats with the open-weight GLM 5.3 Flash end to end, and runs the model in an enclave of NEAR AI, on NVIDIA GPUs in confidential computing mode. It is available in the release channel of the browser.
  • NEAR AI serves a catalog of open-weight models, each inside an attested enclave, Kimi K3 among them.

The largest companies in AI are moving the same way, as we report in Five weeks, seven giants.

What it means for a private chat

In 2026, the best open-weight models trail the closed frontier by about four months, and on a tuned stack a TEE runs them at close to full speed.

Thinkr is built on that. Its private lane, the default, runs open-weight models such as Kimi K3 and DeepSeek V4.1 Flash in TEEs. Before your browser sends a word, it verifies the enclave's remote attestation; then every chat is encrypted on your device and decrypted only inside the enclave.

Sources