Mozilla Just Dropped the Definitive Open Source AI Report — And It Reveals the 'Harness Gap' That Validates Every No-Code Platform

**TL;DR:** Mozilla's State of Open Source AI 2026 report finds open models are within 3.3% of closed ones on capability and 50x cheaper than they were three years ago. But only 51% of teams using open models actually ship them. The bottleneck isn't model quality. It's everything above the model: auth, permissions, audit trails, deployment, governance. Mozilla calls this the "harness gap." Governed no-code platforms like Stacker, Bubble, and Webflow already own this layer. That makes them the accidental winners of the next phase of AI.

---

Mozilla published its inaugural State of Open Source AI report last week, and the headline numbers are the kind of thing that makes closed-model vendors sweat. The capability gap between open and closed models has collapsed to 3.3% on Chatbot Arena. Inference costs dropped 50x in 36 months, from $20 per million tokens to $0.40. A third of all tokens on OpenRouter now route through open-weight models, up from roughly 2% in late 2024. The top five models by volume are all open weights. Stripe cut its AI bill by 73% by moving 50 million daily requests off closed APIs onto its own hardware.

The model war is basically over, and open won the economics.

But buried a few sections deeper is the finding that actually matters. And it's the one that validates the entire governed no-code platform model in a way I'm not sure even Mozilla fully clocked.

## What's the deployment gap, and why is it bigger than the capability gap?

79% of developers already use open models. Only 51% have shipped one to production. For closed models, that number is 63%. That's a 12-point production gap, and it's not about model quality. The report is explicit about this. Álvaro Ruiz Cubero from SlashData, which ran the survey for Mozilla, put it plainly: "this gap indicates that there is not an issue purely of model quality, but of missing infrastructure."

The five blockers developers cite: infrastructure and compute costs (27%), security and compliance concerns (26%), maintenance burden (24%), deployment complexity (23%), and a shortage of specialist support (22%). None of these are "the model isn't good enough."

Then there's the enterprise scaling data, which is the bit that made me put down my coffee. Closed-model production success climbs from 54% at small companies to 73% at organisations with 1,000+ employees. Open models? 53% to 57%. They barely budge. Enterprises can buy their way through closed-model deployment with vendor support, SLAs, and implementation teams. Open-model deployment waits on tooling that, in Mozilla's own words, "nobody has finished."

If you get vendor support for your open-model deployment, your production success rate jumps to 67%. Running it purely in-house? 33%. The model is the same. The difference is the scaffolding around it.

## What exactly is the harness gap?

Mozilla defines the "agentic harness" as the software layer between users and models that controls what an AI system can see, remember, and do. Context management, tool selection, permission boundaries, sandboxing, cost caps, approval workflows — all of it lives here.

The report's most striking behavioural finding: users approve AI agent requests by default 93% of the time. Consent fatigue has kicked in so hard that most agent approvals are performative. The Model Context Protocol hit 97 million monthly SDK downloads and 10,000+ active servers. But governance maturity across companies using it sits at 21%. The pipes are growing faster than the guardrails.

Mozilla's CTO Raffi Krikorian told TIME they're building their own harness layer, and that "you shouldn't be surprised if in a few months you see that we've released our own harness." They see the vacuum. But here's the thing: no-code platforms have been quietly filling it for years.

## Why governed no-code platforms already solved this

I've spent enough time inside platforms like Stacker, Bubble, and Webflow to know what separates them from a raw AI code generator, and it's exactly the layer Mozilla's report says the industry is missing.

When you build on a governed no-code platform, you don't start from a blank terminal. You start inside a system that already has role-based access control, audit trails, deployment pipelines, data residency controls, and a permission model that knows which user can touch which record. Those things aren't bolt-ons. They're the floor, not the ceiling.

AI without governance isn't a product; it's a liability. A vibe-coded app that generates SQL queries from user prompts is clever until someone drops a table. An AI agent that can modify customer records is useful until it modifies the wrong ones, and nobody can tell you why because there's no audit trail.

The harness gap Mozilla describes isn't theoretical. It's the reason enterprises still pick closed models even when open ones are cheaper and nearly as capable. They're not buying the model. They're buying the confidence that comes from knowing who did what, when, and with which permissions.

## Stacker's architecture is a harness by design

Stacker is the purest example here because it was never built as an AI platform. It was built as a governed layer on top of existing data sources: Airtable, Google Sheets, Salesforce, SQL databases. The entire product is permissions-first. You don't give a user access to Stacker. You give them access to specific views, specific records, specific actions, all inherited from the underlying data source's own permission model.

That architecture turns out to be exactly what AI deployment needs. When you bolt an AI feature onto Stacker, it inherits the governance framework that's already there. The AI doesn't get a separate permission surface. It operates inside the same RBAC, the same audit trail, the same record-level access controls as every other component.

Compare that to the raw AI code generation workflow. You prompt an AI. It generates code. You deploy it. Where do permissions live? How do you audit what the AI-generated component actually does? What happens when it gets a prompt injection and starts returning data from the wrong tenant?

The answer in most vibe-coded apps right now is: hope. And hope isn't a governance strategy.

## Raw AI generation skips the layer that matters most

I've watched this play out in real projects. The current wave of AI code generators (Bolt, Lovable, Replit Agent, v0) are optimised for one thing: getting from prompt to deployed app as fast as possible. They do that well. But they skip the harness layer entirely.

There's no built-in RBAC. No audit trail. No approval workflow for destructive actions. No portable permission boundaries that survive a redeployment. Every one of those things has to be built from scratch, per app, by someone who probably isn't a security engineer.

This is exactly the deployment gap Mozilla identified, just in a different costume. The model (or in this case, the code generator) is good enough. The scaffolding around it isn't. And unlike the open-model ecosystem, where at least there's a community acknowledging the gap and building tooling like Otari to close it, the vibe-coding ecosystem is mostly pretending the gap doesn't exist.

## The takeaway

Mozilla's report accidentally made the case for governed no-code platforms. The models are free. The models are good enough. What isn't free, and what isn't good enough yet, is everything that makes AI safe and auditable in production: permissions, deployment pipelines, audit trails, access controls.

No-code platforms spent the last decade building that layer because they had to. You can't sell to enterprises without RBAC. You can't pass a SOC 2 audit without audit trails. You can't handle multi-tenant data without record-level permissions. These weren't AI features. They were table stakes for serious software.

Now AI has made them the most valuable layer in the stack.

If you're building with no-code tools right now, you already have a harness. If you're generating raw code with AI, you don't. The gap starts hurting the moment your app has more than one user, or touches data that matters, or needs to pass a compliance review.

The moat isn't the model. It was never the model. It's the governance layer that turns raw capability into something you can actually trust in production. Mozilla's report proves it with data. Governed no-code platforms prove it with architecture.