Raffi Krikorian, Chief Technology Officer of Mozilla, spoke with Tim O’Reilly at AI Codecon about open-source AI and the infrastructure needed to make it sovereign and personal. Mozilla — a nonprofit that helped shape the open-source web era — is positioning itself as a leading voice for an open, standards-based AI ecosystem.
Why individual ‘sovereign’ AI matters
Krikorian argued that the future should not be dominated by a handful of AGIs; rather, each person should be able to have a trusted AI. His newsletter, Owners Not Renters, captures this view: people need agents that protect their privacy and interests instead of being optimized solely for a vendor’s business model. He compared the desired role of AI agents to the original concept of the browser as a user agent that served the user’s interests, managed privacy, and defended users from exploitative actors.
He cited a paper testing whether AI assistants would favor a company’s commercial interests over user welfare: in simulated flight-booking requests, 18 of 23 models recommended a more expensive sponsored option over a cheaper alternative more than half the time.
Open models aren’t enough — infrastructure is required
Krikorian emphasized that open-source models alone won’t deliver personal, sovereign AI. The model must be surrounded by layers that include:
- memory: secure storage for a user’s private data;
- tool calling: the ability for an agent to make purchases or book appointments on behalf of a user;
- runtime environment where agents run;
- rules and interfaces for how an agent communicates with third parties;
- a harness: the layer where evaluations, guardrails, execution loops, tool calling and memory management happen.
He described these areas as opportunities for open-source developers to build critical components.
Defining open standards and providing a starting point
Mozilla intends to help define what open memory protocols, storage protocols and authenticated tool-calling with appropriate guardrails should look like. Once such standards exist, a wide range of interoperable implementations can be developed — analogous to the internet’s growth on open protocols — enabling a large market built on top of these open layers.
Deployment friction and the need for easier adoption
Mozilla’s 2026 State of Open Source AI report finds open models are roughly 3% behind frontier models in capability, yet they enter production less often than closed models. Krikorian explained that releasing open-source is easy but deploying it is hard: organizations must solve hosting, provisioning, guardrails and memory. With APIs from OpenAI or Anthropic, deployment can be as simple as using a credit card; open-source lacks an equivalent “double-click” installer to get systems running inside organizations. Still, companies that adopt open models are seeing significant cost savings because open models are already sufficient for many use cases — “you don’t need a Ferrari to manage your calendar,” he said.
Current state of innovation and consumer prospects
Krikorian’s personal daily agent is Hermes running on GLM. He expects that companies like Apple or Microsoft — or others — will ship consumer-facing agents in a few years, which could bring these assistants into mainstream use. For now, however, we remain in a phase where technical skill is often required to deploy and use these systems.
Tim O’Reilly framed the present as the exciting part of a cycle: an innovation-rich period for developers and creators before consolidation and dominance by a few large companies.
Market concentration, diversity and risks
The Mozilla report indicates up to one-third of real-world usage may already be on open models, while only 4% of model-layer revenue flowed back to the open-source ecosystem. Tim called this discrepancy a feature of how value capture is measured rather than a simple bug. He invoked Steve Baer’s “The Clothesline Paradox” — the idea that some technologies create value that isn’t captured in conventional accounting — to explain why open-source contributions can be undercounted.
Krikorian warned about market concentration: many leading open-weight models come from China, while leading closed models are mostly American, and access to either can be restricted by policy or executive action. He noted a June instance when Anthropic temporarily suspended access to its Fable models to comply with export controls. For resilience, he recommended that critical institutions, such as hospitals, download local models as backups rather than relying on a single provider — analogous to using an uninterruptible power supply for important equipment.
Safety and guardrails
On safety, Krikorian acknowledged that guardrails are a hard technical and operational problem. Sandbox escapes at OpenAI and Anthropic illustrate that keeping personally identifiable information from leaking via model calls requires more than pattern matching for identifiers. He suggested that eventually models will defend models, but current foundational frameworks for guardrails are inadequate. An NVIDIA safety platform announcement made after the conversation was noted as an indication that better guardrails may need to be implemented outside the model itself.
Conclusion: think of AI as infrastructure
Tim O’Reilly opened the conference by arguing that open and closed systems will coexist: closed systems can optimize for mass-market consumer value, while open systems enable innovation, sovereignty and distribution into new regions and markets. Krikorian closed by observing that a well-designed harness can improve model performance by up to about 20% on some coding tasks, and that contributors who are not machine-learning engineers can still make meaningful improvements at the harness and infrastructure layers.
The discussion underscored a practical agenda: create open protocols and interoperable infrastructure — memory, tool-calling, runtimes and guardrails — so open-source AI can scale into reliable, personal, long-lived infrastructure rather than only surviving as experimental research or vendor-hosted products.
