OPEN SOURCE AI RFPs
Most of the value AI creates flows to the people who already have the most. We are backing the opposite: open, private AI that runs on the device in an ordinary person's hand and serves the people the market has always skipped.
One belief runs through all of it.
This technology should belong to the people it serves, run on the hardware they already own, and reach the cheapest phone in the world. The list comes in two halves. The first is for those people directly. The second is the foundation that lets the first be trusted.
What We Mean by “Open.”
At least one essential part of a project – its model, weights, code, data, or evals – is something anyone can run, inspect, and build on, and that openness is why the product is better.
PART ONE
We're looking for public-good and real world application use cases and products that frontier AI labs normally neglect. Think of the person who has never had good tools: someone in an emergency with no signal, someone targeted by AI-powered scams, someone who never had a tutor.
Every day, 1,000 Americans go into cardiac arrest outside a hospital. Brain death begins in 3 minutes. The ambulance takes 8 to 14. The knowledge that would save the person exists. It just lives somewhere they cannot reach. We want to back the emergency guide that works when the network is dead.
Across every emergency the pattern holds: the outcome is decided in the first few minutes, by whoever is standing there. Many who die before reaching care would have lived if that person knew how to open an airway or stop a bleed. Every tool we have built assumes a signal. Call the line, search the symptom, stream the video. But the deaths cluster where the signal is weakest: rural areas, disasters, the moment the towers go down. The knowledge that would save the person exists. It just lives somewhere they cannot reach. That is now solvable. Models small enough for a cheap phone have gotten good. They take input the way a panicking person gives it, a shouted sentence or a photo of a wound, and walk them through the right protocol, adapting as things change. We want to back the emergency guide that works when the network is dead. It must run on the device, because a tool that needs the cloud is useless in the one situation it exists for, and the protocols must be open and locally adaptable, since a snakebite in rural India is not a heart attack in Ohio. The market is everyone who has ever been far from help. That is most of the planet.
Americans over 60 reported losing 4.9 billion dollars to scams last year, an average of 83,000 each, and the real figure runs higher because most are too ashamed to report it. AI made it cheap: flawless phishing, cloned voices, a grandchild's exact voice begging for money, all at scale, aimed hardest at the people least able to spot them. Today's defenses arrive after the money is gone. The same technology can get in front of the harm instead. An AI app on the phone reads a call, a text, a link the moment it lands, and sees the scam for what it is before anyone clicks.
We want to back the guardian that lives on the device and say it plainly, this caller is impersonating your bank. Open is the edge no closed model can match, because a tool that reads every message you get has to be one you can see inside. The same wave of AI that armed the scammers can be the thing that finally outguns them, on the side of the person being called.
70% of 10 year olds in low and middle income countries cannot read a simple story — not because they are out of school, but because a classroom of 50 with one exhausted teacher is nothing like someone beside you, asking the right question at the right moment.
What makes a tutor work is adaptation: harder when you are flying, gentler when you stumble. That is what a learner without one never gets, and what education software has never faked. For decades it handed everyone the same fixed questions. Models move personalization from the course to the sentence. One reads alongside a learner, pitches each question to their level, helps the instant they hesitate, and tracks what they cannot yet do. Point it at money instead of books and it teaches an adult the math the world assumed they had. We want to back the tutor that meets every learner where they are, built in the open to carry reading level packs, dyslexia friendly modes, and local-language versions no publisher would fund. It has to run on the cheapest device in the house, and it has to run free, because a child in a classroom of 50 cannot be charged by the question, and a tutor metered per use is no tutor at all for the people who need one most. A generation that can read is the foundation under everything else here.
A farmer carries her harvest to the one buyer she can reach and takes the price she is given, because she has no way to prove it is worth more. Smallholders grow over 33% of the world's food, yet routinely lose 30 to 60% of a crop's worth to intermediaries, often without ever knowing the price their buyer gets.
The middlemen are not villains; they do real work she cannot, grading quality, vouching for it, knowing the buyers and the price. That work is finally automatable. An AI app can run the trust layer she could never reach. From a photo it grades the produce, generates an origin record a distant buyer can believe, matches the lot to buyers, prices it against the live market, and tracks it from farm to sale. Every function the middleman provided is a judgment task these models can now do. We want to back teams who build this open, because the obvious failure mode is the tool becoming the new middleman, extracting the same rent. Open is the only version where the value and the data stay with the farmers. Agriculture is one of the largest markets on earth, and the people losing the most in it are among the poorest.
More older people live alone than ever, handed a cruel arrangement: longer lives, shrinking purpose, thinning contact, children too far to check in. Loneliness in old age is not just sad. It carries measurable physical harm, and the options are mostly institutional care or nothing.
What changed is that an AI application can now hold a real, ongoing relationship: a companion that talks with an older person every day and remembers their family, their history, their routines. That daily presence does three things no separate app could. It eases loneliness, nudging them toward real people and counting itself a success only when they reach a human. It gives them a sense of purpose, matching their skills and experience with someone who needs the help. And it watches over them: talking every day means it knows what is normal for them, so it can spot warning signs, slurred words, or a mention of a fall, and let their family know. We want to back teams who build this in the open. This is the most sensitive data a person has, and families will only trust what cannot be sold or switched off. It must also bend to local life, because what family and contribution mean differ enormously around the world. Everyone lucky enough to grow old ends up here, or watches a parent get there.
1.3 billion people live with a serious disability, and around 1 billion who need an assistive tool cannot get one. In the poorest countries as few as 3% ever do, because the things that would open the world to them, captioning, sign translation, a screen reader, stay expensive, scattered, and locked inside vendors.
One AI app now does the work of all of them: it can see a screen, describe it, and operate it; follow speech as it's spoken; and move between sign and speech — the jobs that used to take separate, costly products. We want to back an open companion a person just picks up and uses, because open and free is what turns access from a paid feature into the default. A blind user should not pay a subscription forever for the right to read a screen, and a tool metered per use prices out exactly the people it was built for. Open lets communities tune it to their own language and signs the way no vendor ever will. The world was built without these people in the room. This is how they get let in.
7,000 languages are alive today. Over 40% are endangered. Commerce serves maybe 100. When the last fluent speaker dies, a whole way of understanding the world goes too: the stories, the medicine, the knowledge of plants and seasons never written down. Saving a language was the work of a few linguists, one community at a time, by hand. There were never enough of them.
That just broke. An AI app can sit with a community's elders, guide them through conversation and story, and turn it into something living: not an archive on a shelf, but a model that speaks the language, teaches the next generation, and answers questions about the stories it learned from. The hard part was never recording. It was synthesis: turning fragments into something that answers back. We want to back teams who build this for the community to own, not rent, with an application that can be forked, hosted, and governed locally. A language must never belong to a company that could sell it, lock it, or walk away. A language is the last copy of a way of seeing the world. Right now, one at a time, they are walking out the door.
Deepfake videos online jumped more than 500% in five years, and by 2024 a new deepfake attack was attempted somewhere every five minutes. A fake of a real person, a story that never happened, a voice that is your son's to the syllable — all now made for nothing, reaching millions before the truth wakes up. The people hit hardest are the ones with the least time to check, scrolling between shifts, forwarding to family.
The same models making the fakes can catch them. An AI application running on your own phone can flag a doctored image, trace a claim to where it started, and tell you what it actually rests on, in the seconds before you believe it or pass it on. We want to back an open mind-guard that answers only to you, because a truth filter owned by a platform is just censorship with a nicer name, and the only verifier worth trusting is one anyone can open up and inspect. The flood of things that never happened is already here. Either people get a defense they hold themselves, or they lose the ability to tell what is real.
Give a dollar to charity and a quarter or more can vanish into overhead before it reaches anyone; the worst-run pass on less than a tenth of what they raise. The rest turns on human judgment, where bias, favor, and theft slip in. The people who need help most have the least say in who gets it.
AI changes both halves. It can weigh need at scale, hold every case to the same published rule, and move funds at almost no cost — every decision and transaction sitting in the open for anyone to check. We want to back an open framework any charity can run on: funds released by rule rather than a gatekeeper's mood, a public ledger where nothing hides, overhead pushed toward zero. People set the rules and answer for them; the handing out becomes fair and checkable. It only works open — the whole promise is verifiability, and aid you cannot inspect is just a faster way to hide the old bias. A donor should be able to follow their dollar all the way to the person it helped. For the first time, they could.
PART TWO
The apps above all want to be private and open. None of it holds without the layer underneath: the assistant people actually own, the proof that a model is what it claims, the rails that keep an agent from being turned against its owner. This is the unglamorous half and it's the half that decides whether the rest can be trusted at all.
900 million people now pour their lives into an AI every week, the fears, the plans, the things they would say to no one, and every word lands on a company's servers. The most intimate software in a person's life is the piece they own least. It forgets them on purpose, answers to whoever trained it, and turns the record of an inner life into someone else's asset. That was the only option until this year.
A model good enough to matter now fits on the phone in your pocket, and the voice, memory, and tool use around it have caught up. It can hold the thing you whispered at 2am and still know it in the morning, tie today's worry to one from a year ago, and act for you through the day, a real assistant, not a chatbot you copy answers out of. We want to back the open, local "her", and it only works open: an assistant you cannot see inside is a contradiction, because the whole promise is that it answers to you. Local is the point, not a feature. The moment the private part leaves the device it stops being yours, and the moment it lives on someone's server you are paying rent on your own inner life, forever, at whatever price they set later. We already told it everything. The only question left is whether we own it, or rent it back.
An agent is about to book your travel, pay your bills, and sign in your name, and no one on the other end can tell it is really yours, or that it is doing only what you allowed. We solved this for websites with certificates, for keys with transparency logs. For the agents now acting for us, we have nothing.
The moment they start moving real money and calling real tools, impersonation and runaway permission become the entire problem, and the fix can finally be built: signed actions, delegations scoped to exactly what an agent may touch, a public log anyone can check. It has to be open, because the identity the whole ecosystem leans on cannot be a black box owned by one company. Trust at this layer is something everyone can inspect, or it's worth nothing. We want to back the team that lays it. Before agents can act for us, something has to vouch for them. Right now nothing does.
We are about to hand agents the keys: our files, our money, our accounts, the power to act in the world while no one is watching. An agent that can do anything is also an agent that can be tricked into doing anything, which makes it the largest attack surface we have ever built.
What is new is that the restraints can be built as fast as the agents. An agent can run inside a sandbox with hard walls on what it may touch, permissions scoped to the task in front of it, and its reach cut back to exactly what it needs and nothing more. We want to back the open layer of sandboxing and capability control that lets agents act without being able to betray us, because the rails on something loose in the world have to be inspectable by everyone, not a setting buried inside one company's product. The more we let agents do, the more it matters what they cannot. That is the difference between a helper and a hazard.
A single sentence hidden on a web page can now tell someone's AI to empty their account, and the agent will obey it as readily as its owner. Most teams shipping one have never tried that attack on their own. A decade ago we threw junk strings at form fields to see what cracked; the agent era needs the same instinct, aimed at prompt injection, poisoned tool output, and hostile pages, and the instinct is not there. What is new is that red teaming agents can now run those attacks, the way a real adversary would, over and over inside the build pipeline, before a single user is exposed.
Open is what makes it a commons instead of a product: one team's discovered exploit becomes everyone's patched defense, so the whole ecosystem hardens together instead of each team bleeding alone. We want to back the platform that does it. We are wiring agents into our money and our inboxes faster than we are learning how they break. This is how the gap closes.
Open AI runs on trust: you download a stranger's model and build on it. But a model is a black box of numbers, and a poisoned one looks identical to a clean one until the day it fails. A single tampered model, passed from project to project, could carry a hidden backdoor into thousands of products at once. The threat is new and so is the defense. Models and datasets can now be scanned for the fingerprints of poisoning, hidden triggers, and tampering, the way antivirus reads a file, before anyone builds on top of them.
We want to back the open immune system for the model ecosystem: tooling that checks for what should not be there and shares every new signature, so one bad model cannot quietly infect the rest. It has to be open, because a scanner the whole world relies on cannot itself be a thing you take on faith. Open AI spreads by everyone building on everyone. That is its great strength and, without this, its single point of failure.
You can trace the origin of a quote and read the label on a tin of food, but the model now answering your most sensitive questions arrives with nothing: no record of who trained it, on what data, or what changed along the way. We give our most powerful tools more blind trust than we give a carton of milk. That gap can close. A model's whole history, its origin, its training data, every change since, can be signed and made tamper evident, so downloading one stops being a supply chain gamble and you actually know what you are running.
We want to back open provenance and signing for models, a chain of custody from training run to download, because what a model is should be something anyone can verify, not a claim on a webpage. Open is what makes the record itself trustworthy instead of one more label to fake. We are about to run the world on models we did not train. The least we can ask is to know where they came from.
When an AI denies your loan, reads your scan, or filters your resume out of the pile, you are told a model decided, and you are expected to believe it. You cannot see which model actually ran, or whether the careful one they advertised is the one they used. That faith is no longer the only option. It is now possible to generate cryptographic proof that an output came from a specific model and the exact code claimed, on hardware no one can secretly swap, a receipt that cannot be forged.
We want to back open verifiable inference, the proof layer that lets anyone confirm what really ran, because as AI moves into the decisions that bend a life, the operator's word is not enough, and a proof everyone can check beats a promise no one can. Soon the biggest decisions about a person will be made by a model. Whether we can audit them or simply have to trust them is being decided right now.
A handful of labs decide how every major AI thinks: what it will say, what it won't, which lines it holds. Billions inherit that one setting whether it fits their life, their faith, or their culture. No individual can retrain a model to reflect their own. That setting is no longer fixed. A model can take a plain account of what someone values and genuinely shift how it answers, no retraining required, from a few questions turned into a portable file (system prompt or skill) you attach to any AI and edit whenever you change.
It has to be open, so anyone can read exactly what that file does and trust it answers to them and not to someone behind the curtain. We want to back the skill that makes it. The most-used tool in human history should not have a single set of values baked in by the few who built it.
A hospital, a school, a town's water system get attacked with the same tools as a bank, but only the bank can afford the talent that finds the holes first. Everyone else ships blind and learns they were exposed the day they are breached, while cybercrime is on track to cost the world, by some estimates, more than 10 trillion dollars a year. That gap is closing fast. AI agents can now probe a system, chain its weaknesses together, and think like an attacker at a speed no human team can match.
We want to back an open commons of offensive agents an owner can turn on their own systems, with permission, tested without rest, every technique flowing back into a shared store. Open is what makes it a commons and not one more locked tool: the agents can be audited before they are trusted, and the defense compounds in the open. For the first time the side that defends could compound faster than the side that attacks.
Open AI is only as free as the hardware beneath it, and right now that hardware can be revoked. A cloud can suspend an account, a company can pull a model, a government can order a service dark, and the price can be raised the moment you depend on it. The tool millions leaned on is gone, or unaffordable, overnight, often at the exact moment a crisis makes it matter most. That dependence is not a law of nature. Models can now run across decentralized compute that no single cloud, company, or country can switch off, the way a file shared across a network outlives any one machine that drops.
We want to back the censorship-resistant backbone for open AI, compute and distribution that stays up when someone powerful wants it down, because the freedom to run a model means nothing if access can be pulled at will, and only an open, distributed network has no off switch within anyone's reach. The AI a society depends on cannot belong to whoever can take it away. Resilience, in the end, is just another word for sovereignty.