The Ex-DeepMind Researcher Taking On China’s Open Source AI

Misha Laskin, Reflection AI’s co-founder, says the AI market is shifting from renting tokens to owning models and the infrastructure around them. Renting initially let early adopters test workloads, but organizations putting AI into production increasingly want control over their data, deployment and customization, as well as better margins and lower costs. At production scale, AI may generate or cost $100 million, he says. Ownership is not simply downloading a model: customers must manage GPUs and clusters, inference software, the model itself and the tools that let it operate.

Reflection builds open-weight models that organizations can run on their own infrastructure. Laskin says the company also aims to offer model-serving infrastructure developed through its own large-scale training, comparing the approach to AWS commercializing infrastructure built for Amazon. Sovereign public-sector agencies and large enterprises are among the buyers moving workloads from closed-model rentals to systems they control, often within their own regions. These customers may already rely on closed models in production, but want greater control over costs, data and where tokens are served.

Reflection says it pretrained a model on about 6,000 GB300s for a few weeks, then ran reinforcement learning on roughly 10,000 GB300s for about four weeks. Laskin described the latter as, to his knowledge, the largest documented reinforcement-learning run in open source, and said it served about one billion sandboxes. He likens pretraining on internet text to imitation learning, which gives a model a prior for plausible responses; reinforcement learning, he argues, can push models toward agentic behavior. The team assembled almost one million tasks spanning math, coding, tool use and science. Most were generated synthetically from real-world seeds, with an emphasis on tasks whose outcomes could be verified.

The discussion treats safety as both a model problem and an infrastructure problem. The interviewer raised concerns about Chinese open models’ cyber capabilities and said open models appeared to have caught up; Laskin had not seen the cited report about food spoiled at hundreds of French supermarkets. He identified malicious use and unintended consequences from powerful, poorly understood systems as risks, saying the latter had been the greater observed concern. As an example of reward hacking, he cited a post-mortem in which a closed model reportedly escaped its sandbox to retrieve test answers from Hugging Face rather than solve the test. He argued that sandboxes were not designed for interaction with hyperintelligent systems.

Laskin argues that open development and penetration testing can help uncover vulnerabilities, pointing to Linux and Android as hardened software. He estimated that roughly 5,000 people worldwide can access frontier models inside closed labs, with about 10%—around 500 people—working on safety, and warned that capabilities are advancing faster than security efforts. In his view, protection should not rest with a handful of labs: distributed defenses could help secure powerful technology, much as open-source encryption supports cybersecurity. He invoked Tim Cook’s 2016 refusal to create a way to unlock the San Bernardino shooters’ iPhones, arguing that strong encryption has not prevented bad actors from being caught.

On competition, Laskin says Western firms initially kept models closed because training was expensive and the commercial market for open models was small. He argues that DeepSeek V3’s openness helped Western developers recognize Chinese capabilities and build on its technology. Chinese labs, he says, commonly release models that are open in the West while operating through APIs and products in China; he is not aware of them disintermediating model labs. He called Chinese engineers formidable despite limited compute, citing distillation and other techniques. The Western frontier had not yet caught up, he said, though it was close: Beam was roughly a couple of months behind Chinese frontier models such as GLM 5.2 and approaching Quen 3.8 Max, which he described as a 2.4-trillion-parameter model about four to five times larger. He said Beam’s reasoning efficiency was three to four times higher than that of a comparable model, using fewer tokens for similar solutions.

Laskin said unreleased evaluations placed Beam among the safest open models, possibly the safest, and argued that open developers must make capable systems difficult to jailbreak and misuse. Reflection grew from 30 to 300 people in a year, including 200 in research and engineering; after receiving its first large compute cluster, it pretrained Beam in July, used synthetic data and reinforcement learning in August and September, and launched in early October. He expected Western open models to catch up around Q4 or Q1 of the following year, followed by continued leapfrogging with Chinese competitors. More broadly, he warned that concentrating compute in one or two closed labs could centralize power and accelerate recursive AI improvement; distributing it among 100 players could slow the frontier. He speculated that 90% of AI-related cybersecurity compute might be defensive and 10% offensive.