The Library of Alexandria did not burn down in one night, whatever the story says. It declined across centuries — funding withdrawn, a civil war, a fire that took part of the collection, neglect that took the rest. What was lost was never the building. It was the only copy. Works cited by a dozen later writers survive now only as those citations, because the knowledge lived in one place and one place turned out to be a bad place for it to live. That is the failure we are naming this after. Not fire. Centralisation.
We are announcing Project Alexandria: a standing commitment that the general-purpose knowledge our models accumulate gets published rather than held. Open distillations, an open training corpus, and honest write-ups of what worked and what did not — permissively licensed, on a fixed cadence, whether or not it suits us in a given quarter.
What follows is what we are committing to, what we are explicitly refusing to do, and why this is in our interest rather than an act of generosity. The last part carries the most weight, because pledges founded on generosity get dropped quietly at the next budget review and pledges founded on self-interest survive one.
Why we can afford to publish this
The honest answer to "why would a company give away its models" is that the thing being given away was never the product.
July 2026 made that about as clear as it is going to get. Moonshot released 2.8 trillion parameters as a free download that ranks third in the world. PrismML compressed a capable model into 3.9 GB that runs on a phone, Apache 2.0. Alibaba announced a 2.4-trillion-parameter open-weight model. The interval between "frontier" and "free" is now measured in months, and at the tier carrying most production traffic it has effectively closed.
A company treating general model weights as a trade secret in that environment is guarding an asset with a visible expiry date. Someone will publish the equivalent within two quarters. The only open question is whether you contributed to it or waited for it.
We have argued at length that the durable advantage sits elsewhere: the moat is a tailored model, not a general one. A model shaped by a customer's own data, failures and domain cannot be downloaded by anyone, because the inputs exist nowhere else. That is what we build and what we sell. The general layer beneath it is infrastructure, and we would rather infrastructure be cheap, open and everywhere — including for people who will never pay us — than expensive and rationed.
So this is not charity. If the general layer is not our moat, withholding it costs us nothing and costs everyone else something. Publishing is what our own strategy already implies, and we would rather say so publicly and be held to it.
The four commitments
1. Open distillations
Every general-purpose capability we develop that is not specific to a customer gets distilled into a small open-weight model and published under Apache 2.0 — weights, tokenizer, evaluation results, and the recipe that produced it.
Sizes will be ones people can run: the 3B to 30B range, in formats that work on llama.cpp, MLX and vLLM, with quantized builds alongside full precision. A model nobody can run is a press release. The test is whether it runs on hardware somebody already owns.
Each release ships with its failure profile in the same size type as its scores. If a distillation loses fourteen points on agentic work — which, as the Bonsai numbers showed, is what aggressive compression does to multi-step reliability — that goes in the model card. Publishing a model without publishing where it breaks transfers our unexamined risk to someone with less context than us, which is worse than not publishing at all.
2. The Alexandria Corpus
We are building and releasing a permissively licensed dataset for training and evaluating agentic and workflow-oriented models, targeting the areas where the public commons is thinnest.
Public corpora are rich in web text and code and remarkably poor in what agent builders need: long, multi-step, tool-using trajectories with the failures included. The reason is structural. Successful trajectories are boring to publish and failed ones are embarrassing, so almost every team building agents reconstructs this privately, at real expense, and the artefact dies with the project. One copy, one place — an Alexandria problem exactly.
Three sources, and only three:
Synthetic trajectories generated in sandboxed environments against tools we control, with the generation code published so anyone can extend it or audit it rather than trusting a description.
Explicitly contributed data, where an organisation has opted in deliberately — a specific decision about a specific dataset with a written scope, not a checkbox in terms of service.
Public-domain and permissively licensed material, with provenance recorded per record.
Every record carries its source, licence, generation method and date, so downstream users can verify what they are training on instead of taking our word for it. Datasets that cannot say where they came from have caused real harm to real people, and we are not adding to that pile.
3. What we learned, failures included
Quarterly: evaluation methodology and results, taxonomies of how agents fail in production, and negative results — approaches that looked obviously correct and were not.
Negative results are the most valuable item on this list and the least likely to be published by anyone, because no one is rewarded for announcing that a promising idea did not work. The consequence is that the same dead ends are rediscovered independently by hundreds of teams, each paying full price. We would rather that bill were paid once.
4. A cadence and a public ledger
Quarterly releases, with a public record of what shipped and when. If a quarter passes with nothing, the ledger will say so and say why. A pledge you can fail silently is a sentiment, not a pledge.
What we will never publish
This section is what makes the rest credible, so it is stated without hedging.
Customer data will never enter the corpus. Not aggregated, not anonymised, not de-identified, not as a seed for synthetic generation. Not by default and not by opt-out. The only path by which customer-originated data reaches a public artefact is an explicit, scoped, written opt-in for a named dataset, and without that the answer is no.
We are being categorical because the loopholes available here are well known and we want none of them. Anonymisation is not a safe harbour — re-identification from "anonymous" behavioural data is a solved problem for a motivated adversary holding one auxiliary dataset. Aggregation is not one either. And laundering data through a synthetic generator does not sanitise it: language models demonstrably memorise and reproduce training examples, so a generator trained on your data can emit your data. If it is in our platform, it stays in your tenant, and no gradient computed from your traces reaches a model anyone else touches.
Models tuned on customer data stay with the customer. A specialised model built from your traces is your asset. We do not publish it, distil from it, or use it to improve anything anyone else uses. This is not a policy we could reverse later without breaking the product's central promise, which is exactly why we are comfortable committing to it in public.
We will not publish something we would not deploy. If an artefact is unsafe enough that we would not run it, open release does not make it safer — it makes it someone else's problem. Where a release carries genuine dual-use weight we will say so, delay if delay helps, and explain the reasoning rather than going quiet.
The objections
"This is marketing." Partly, yes — we are writing a blog post about it, which is not subtle. The test is not the announcement but whether artefacts appear on schedule with licences attached, which is why the ledger exists and why it will record empty quarters. Judge it in six months against that record.
"You are publishing scraps and keeping the valuable part." We are keeping the customer-specific models, and said so above. That is the product, and it is also not ours to give — it belongs to the customer whose data made it. What we publish is the general layer, which is the more useful thing for anyone building on top and which is heading toward free regardless. We are not claiming to give away our best work; we are saying our best work is inseparable from a specific customer's data and the remainder belongs in the commons.
"Open weights are a safety risk." This deserves better than a dismissal. Our position, considered rather than convenient: at the 3B–30B scale we are releasing, marginal risk over what is already openly available is small, and marginal benefit to people who can afford nothing else is large. We publish evaluation results with each release so the argument can be had over evidence. If a specific release appears to cross a threshold we will not ship it, and we will explain why rather than going silent. Being wrong in public and correctable beats being right in private.
"Open models undercut the labs funding the research." There is a real version of this. Open weights compress margins at the tier below the frontier, margin funds research, and the market reaction to Kimi K3 — where other open labs, not closed ones, took the damage — shows the mechanism is live. We think diffusion benefits dominate at the scale we operate at, and nothing we release threatens a frontier lab's economics. We hold this with less confidence than the other three, and would revise it if the evidence moved.
Why this follows from everything else we do
We have a stated ambition of getting AI to everyone rather than to the organisations that can afford it, and it is fair to ask what that means past the slogan.
It means the floor matters more than the ceiling. The most consequential development of 2026 was not the best model getting better; it was capable models becoming free, small and local — running offline on hardware people already own, with no bill, no rate limit and no telemetry leaving the device. We would rather accelerate that than resist it.
It means durable advantage has to sit somewhere other than access to intelligence, because if it sits there then AI simply reproduces the existing distribution of capital. We think it sits in specialisation, which is available to a five-person team with good data as readily as to an enterprise with a procurement department. That is a fairer place for advantage to live, and we think it is where it actually is.
And it means being a net contributor to the commons we build on. Every model we ship stands on open research, open weights and open tooling that other people published without charging us. Taking from that and returning nothing works exactly once, and only if few enough people do it.
What happens next
The first release is in preparation: an initial corpus slice of synthetic agentic trajectories with the generation code published, and a distillation sized for laptop-local use. Both Apache 2.0, both with full evaluation results including the parts that do not flatter us.
If you want to contribute data, we would rather have a conversation about scope than a signature on a form — get in touch. If you want to hold us to this, the ledger will be public and it will record the quarters where nothing shipped as plainly as the ones where something did.
The bottom line
Alexandria's real lesson was never fire. It was that knowledge concentrated in one place is knowledge waiting to be lost, and that the loss is permanent in a way that feels impossible right up until it happens.
We are not positioned to make grand claims about civilisation. We are positioned to decide what happens to what our models learn, and the decision is that the general part gets published — weights, data, methods and failures — under licences that let anyone use it, on a schedule we can be measured against.
The moat is not the AI. It never was. It is what you build once everyone has the AI, and the sooner everyone has it, the sooner that work starts.
Libraries burn. Distributed ones do not.