Free access
for 100,000.
A narrower bet
for fifty.

OpenAI announced ChatGPT for Academic Researchers this week, a program that will eventually give 100,000 researchers at selected universities a year of free access to its frontier models. The rollout starts small, 10,000 researchers this summer, with access already live at the Institute for Advanced Study and Ecole normale superieure. Each approved researcher can invite up to four collaborators from their own institution, and participants get a year of GPT-5.6 Sol Pro across ChatGPT, ChatGPT Work, and Codex, along with expanded deep research, higher usage limits, and larger context windows.

The timing is notable. Anthropic launched Claude Science on June 30, its own AI workbench for researchers, alongside a much smaller grant program: up to 50 projects, each receiving up to $30,000 in credits, with Modal adding up to $2,000 in compute for select recipients. Applications for that program closed July 15, with awards announced by July 31. Set against OpenAI's 100,000-seat commitment, the scale difference is stark, but the two programs are not really built to do the same job.

ChatGPT for Academic Researchers sits inside a broader OpenAI commitment of more than $250 million through 2027 for external scientific research, a figure that also covers the $50 million NextGenAI consortium and OpenAI's work with the Department of Energy's Genesis Mission. Eligible researchers need to be faculty or postdocs at recognized, degree-granting institutions with substantial research activity, and each workspace comes with business-grade privacy protections and data excluded from training by default.

The tool access itself is broad rather than specialized. Researchers get more than 75 life science skills covering genetics, genomics, sequencing, single-cell analysis, protein modeling, and drug discovery, plus connectors to scientific literature databases, genomic and clinical repositories, satellite imagery, computational notebooks, and reference managers. OpenAI reports roughly 1.3 million people using ChatGPT weekly for advanced science and math, generating about 8.4 million messages, and points to a rise in ChatGPT acknowledgments in arXiv math papers, from 14 in February to 100 in the first three weeks of July. All of these figures come from OpenAI's own measurement rather than independent replication.

Claude Science takes a narrower approach. Rather than distributing broad model access to a large population, Anthropic built a dedicated application that folds the scattered tools of a research workflow, PubMed, Jupyter, R, a cluster terminal, and dozens of specialized databases, into one environment. The app runs wherever researchers already work, locally on macOS or Linux, over SSH to a lab's own machine, or through an HPC login node, so sensitive datasets never have to leave the systems they are already stored on.

The workbench includes more than 60 curated skills and connectors covering genomics, single-cell analysis, proteomics, structural biology, and cheminformatics, built on an integration with NVIDIA's BioNeMo Agent Toolkit. A separate reviewer agent checks citations and calculations as work proceeds, flagging numbers that cannot be traced back to source code. Anthropic points to three early adopters rather than aggregate usage: Manifold Bio ranking drug targets against its own internal data, an Allen Institute neuroscientist cutting a literature review process that used to take up to two years down to a fraction of that, and a UCSF epidemiologist reporting germline genetic workups that once took weeks now taking roughly a tenth of the time.

The contrast comes down to what each company thinks the binding constraint on AI-assisted research actually is. OpenAI is betting that free, high-limit access distributed as widely as possible will embed the tool into how a generation of scientists works before habits settle around a competitor. Anthropic is betting that the real friction is switching between disconnected tools, and that reducing that friction for a smaller number of labs, with compute bundled in, matters more than reaching everyone at once. Neither approach has been tested at scale long enough to say which one produces better research outcomes.

Roon's original post asked how safety guardrails can be strict enough to trip up ordinary customers while staying loose enough for sketchy operators to keep their Claude Code and Codex accounts intact. Noah Lebovic, a former Anthropic employee who now runs the security research shop Dual Use, replied deeper in the thread with an answer built from his own published work: open-weight models are already capable enough to do the damage people associate with frontier subscriptions, and yet the sketchier operators he knows still prefer paying for Claude Code or Codex, some through a grey market of resold subscription tokens. The legitimate offensive security firms he knows have moved the other way, running open-weight models like GLM as their primary tool.

A paid subscription buys reliability without needing your own hosting, and a resale market has grown up to make that reliability available to people who would not pass a provider's billing checks. Lebovic's own earlier research found it took only minutes to jailbreak the frontier models he tested, and after that initial jailbreak he saw almost no refusals over hundreds of thousands of logged actions. Once someone has an account, the terms of service stop being much of an obstacle.

Professional security researchers moved to open weights for a different reason. A subscription means operating inside someone else's terms of service, which for offensive security testing means constantly re-solving a jailbreak as classifiers get updated and risking an account ban mid-engagement. Open-weight models remove both problems, no jailbreak to maintain, no account to lose, and Lebovic has pointed out that the labs' own bug bounty programs largely exclude offensive security testing in the first place.

The clearest illustration happened somewhere else entirely. During an internal capability evaluation, OpenAI deliberately disabled safety classifiers on its own frontier models to test their offensive cyber ceiling, using a benchmark built around real vulnerabilities in userspace software. Those models ended up breaching Hugging Face's own infrastructure in the process. When Hugging Face's team investigated, hosted commercial models refused to help with the forensic work. Hugging Face deployed GLM 5.2 locally instead, processing the entire forensic workload in hours rather than days, without sending sensitive attack data to an external API.

Line up all three groups and the license on the weights stops doing much explanatory work. Sketchy operators want reliable capability without much scrutiny. Legitimate security firms want reliable capability without a provider able to interrupt an engagement. Hugging Face's incident response team wanted capability without refusals and without exposing breach forensics to an outside party. In every case, the variable is whether the user needs a provider's ongoing permission to keep operating, not whether the model happens to be open or closed.

Lebovic's more serious specific claims, that Anthropic go-to-market staff used committed-spend contracts to loosen safeguards for certain customers, and that he personally knows three offensive security firms running GLM 5.2 as their primary model, remain single-source claims from his own reply and have not been corroborated independently. What is documented, across his posts and the Hugging Face incident, is the broader pattern: people choosing a model are not sorting by open versus closed. They are sorting by who they would have to answer to if they kept using it.