Thinking Machines' Inkling: Open Weights, Thin Data Provenance
Mira Murati's lab has open-sourced a 975-billion-parameter multimodal model under Apache 2.0 — but its training-data documentation gives security and governance teams little to work with.
Key Takeaways
- Thinking Machines Lab released Inkling, a 975B-parameter (41B active) Mixture-of-Experts model, under a permissive Apache 2.0 license that lets anyone fine-tune, strip safeguards from, or redeploy it.
- The model card discloses genuine dangerous-capability red-teaming — including CBRN and cyber-knowledge testing — and explicitly recommends defense-in-depth rather than relying on model refusals alone.
- The separate training-data documentation names no specific datasets, licensing terms, or filtering methodology, which weakens any provenance or supply-chain risk assessment done under frameworks like ISO 42001.
- For security teams, the vendor's red-teaming describes the base weights, not whatever fine-tuned variant ends up deployed — the running model, not the model card, is what needs testing.
On 15 July, Thinking Machines Lab — the AI lab founded by Mira Murati — released Inkling, its first open-weights model. It's a Mixture-of-Experts transformer with 975 billion total parameters and 41 billion active per token, trained on 45 trillion tokens spanning text, images, audio and video, and shipped under an Apache 2.0 license. A smaller sibling, Inkling-Small (276B total, 12B active), is still being tested and will follow once that work is complete. Weights are published on Hugging Face with a 1M-token context window; Thinking Machines' own Tinker fine-tuning API caps that at 256K.
Running it isn't casual: the BF16 checkpoint needs roughly 2TB of aggregate GPU memory, dropping to around 600GB with the NVFP4-quantized version — squarely lab or enterprise infrastructure, not a laptop download.
The red-teaming disclosure is the notable part
For a security audience, the model card's safety section is more interesting than its benchmark scores. Thinking Machines says it ran "multi-turn, open-ended external red-teaming" covering sycophancy, harmful manipulation and psychological harm, plus — more unusual for a card attached to an openly-licensed release — CBRN and cyber-knowledge dangerous-capability testing and loss-of-control risks. The card is candid that this isn't sufficient by itself: it recommends layering downstream moderation and "defense-in-depth" rather than trusting the model's own refusals. That's the right instinct, and it's also an implicit admission of what open weights change: once released, any party can fine-tune away the very refusal behaviour that testing measured.
A documentation gap that matters for governance
The separate Training Data Documentation page is where the transparency thins out. It confirms scale ("trillions of tokens"), broad sourcing ("publicly available content" plus third-party data), and that deduplication and filtering were applied — but names no specific datasets, no licensing terms, and no per-modality breakdown. For a team running IP-contamination or provenance checks, or documenting a model under an AI-governance framework such as ISO 42001, that's not enough to close out a risk assessment; it reads as a compliance-shaped paragraph rather than an audit trail.
What this means if you're evaluating Inkling
- Treat the model card's red-teaming results as a baseline for the *base* weights, not for whatever fine-tuned or wrapped variant your team ends up deploying — re-test the actual deployed configuration.
- Don't substitute the public training-data documentation for your own data-provenance review if the model will touch regulated workflows; it won't satisfy an ISO 42001 or similar audit on its own.
- Apache 2.0 means safety fine-tuning is optional for anyone downstream — assume any Inkling derivative you encounter in the wild may have had guardrails removed.
- Budget for defense-in-depth — moderation, monitoring, scoped tool/agent access — rather than relying on refusal behaviour, exactly as the model card itself recommends.
Frequently Asked Questions
What is Inkling?
Inkling is Thinking Machines Lab's first open-weights model: a 975-billion-parameter (41B active) Mixture-of-Experts transformer trained on 45 trillion tokens of text, image, audio and video data, released under an Apache 2.0 license.
Does Thinking Machines' safety testing still apply after someone fine-tunes Inkling?
Not reliably. The model card's red-teaming — including CBRN and cyber-knowledge dangerous-capability testing — describes the released base weights. Because the license permits unrestricted fine-tuning, a downstream deployment can remove or weaken those safeguards, which is why the card itself recommends defense-in-depth rather than relying on the model's refusals.
What's missing from Inkling's training-data documentation?
It states scale and general sourcing (public web content plus third-party data) and confirms deduplication and filtering were applied, but it doesn't name specific datasets, licensing terms, or a breakdown of data by modality — details a formal AI-governance or supply-chain review would typically need.
Sources
- 1Inkling: Our open-weights model — Simon Willison
- 2Introducing Inkling — Thinking Machines Lab
- 3Inkling Model Card — Thinking Machines Lab
- 4Thinking Machines has released Inkling, the new leading U.S. open weights model — Artificial Analysis