Ad Tech Needs Open Models
Open models became the biggest story in AI this month, and ad tech has a direct stake in how it resolves. The clearest reason is agentic buying. Running agents that negotiate and optimize campaigns continuously is a different kind of workload from anything the industry has bought inference for before, and it does not sit comfortably behind a metered API.
What just happened
Moonshot AI released Kimi K3 on July 17, a 2.8 trillion parameter open weight model that matched or beat leading American systems on several benchmarks. Washington moved quickly. On July 22, White House OSTP Director Michael Kratsios alleged that Moonshot had built K3 by distilling outputs from a U.S. frontier model, Treasury Secretary Scott Bessent raised the prospect of sanctions, and reports followed that the administration was weighing a ban on Chinese open models.
Two days later, more than two dozen technology companies published a joint letter asking policymakers not to impose broad restrictions. Signatories include NVIDIA, Microsoft, IBM, Dell, Palantir, Mistral, Hugging Face, Mozilla, and the Linux Foundation. Meta signed as well, which is worth noting here: the largest advertising business in the world, and the publisher of the Llama family, treats downloadable weights as strategic infrastructure. The letter argues for matching the model to the job at the right cost, and warns that premature restrictions would "stifle competition or drive innovation overseas."
On July 27, NVIDIA launched the Open Secure AI Alliance with more than thirty inaugural partners including Microsoft, IBM, Red Hat, Cloudflare, Databricks, Salesforce, SAP, Palo Alto Networks, CrowdStrike, and the Linux Foundation. Its position is that the world needs both closed and open models, and that open ones are necessary wherever defenders need to inspect, adapt, and run AI on infrastructure they control. Adgentek is a member of the NVIDIA Inception program.
Agentic buying is where this lands
Agentic advertising replaces the single scored decision with reasoning agents working continuously on both sides of the trade. On the buy side, agents interpret objectives, discover supply, negotiate terms, and optimize toward an outcome for as long as a campaign runs. On the sell side, publishers expose inventory through seller agents that respond to those requests directly. Adgentek builds for both, with ORCA on the buy side and the Agentic Ad Server on the sell side.
Three things about that shape bear directly on where the models come from.
Agents are a standing load. A pacing check every few minutes, an audience review every hour, anomaly detection running throughout, multiplied across every campaign under management, produces call volume that looks nothing like a person typing into an assistant. Per-token pricing was designed for bursty human usage. A system of agents running continuously is the opposite of that.
Different agents need different models. Working out how to counter a seller's proposal is hard reasoning and deserves a large model. Checking whether a pacing index crossed a threshold does not. Sizing the model to the task is the letter's own argument applied inside one system, and it only works if there is a range of options at different capability and price points.
Agents holding budget authority need stable versions. When a model changes underneath a system authorized to commit spend, its behavior changes and the audit trail stops explaining decisions. A downloadable checkpoint can be pinned, tested against past campaigns, and rolled back. A hosted endpoint updates on someone else's schedule.
NVIDIA's Alliance makes a related point: an agent is not just a model, and its safety depends on the whole stack of identity, permissions, harnesses, logs, and evaluation. That stack is easier to audit when the components can be inspected. Agents spending money warrant the same treatment.
None of this is hypothetical. FreeWheel, NBCU, and agency RPA executed a cross-platform agentic media transaction over MCP in January 2026, with buy-side agents negotiating directly against sell-side agents. The Ad Context Protocol (AdCP) and Model Context Protocol (MCP) standardize how agents transact, but neither says anything about where their inference runs. That stays an architecture decision, and increasingly a policy one.
Why a metered API does not fit
Three conditions work against it, and agentic buying hits all three.
Duty cycle. Continuous agents and per-impression classification both generate volume that per-token pricing was never built for. Latency. Agent-to-agent negotiation runs against seller timeouts, and request-path decisioning finishes in tens of milliseconds, which a network round trip to an outside provider consumes before the model starts. Data gravity. Much of the most valuable signal is contractually pinned inside someone's environment, so the model has to travel to the data.
The Open Secure AI Alliance cites a case that makes the third one concrete. During a July security incident, Hugging Face found that closed AI tools could not distinguish attackers from defenders and blocked the forensic analysis it needed. It ran the open weight GLM 5.2 model on its own infrastructure instead, analyzed more than 17,000 actions, and contained the intrusion. Fraud and invalid traffic work in advertising has the same shape: enormous volumes of raw logs, analyzed at speed, on data nobody wants to ship outside.
The request path still needs models, just smaller ones
Scaled decisioning has not gone away, and it is where the size constraint bites hardest. A model at the scale of this month's releases needs on the order of a terabyte to hold the weights at 4-bit quantization, before the KV cache, which at long context takes tens of gigabytes more. An NVIDIA H200 carries 141GB. Nothing of that size is going inside a bid request.
What the request path uses is what comes after those releases: the quantized checkpoints and small specialized variants that follow a frontier open weight drop. They exist because the large ones were published, so restricting the flagships would cut off the supply of the small models the industry actually deploys in production.
| Work | Cadence | Budget | Model |
|---|---|---|---|
| Campaign agents | Continuous, campaign-long | Seconds | Large model, frontier or open, chosen per agent |
| Session decisioning | Per conversational turn | Hundreds of milliseconds | Quantized open model, self-hosted |
| Request path | Per impression | Tens of milliseconds | Small fine-tuned open model you host |
The Adgentek Agentic Ad Server works on that split. Intent classification and entity extraction run in the request path on small specialized models, and larger reasoning stays off it. The Ad Server sends only derived signals to demand partners, never raw prompts or transcripts, which works because classification finishes before anything leaves the perimeter. That is what makes a conversation usable as intent data from AI ads without exporting the conversation, and it lets the Spark format judge in-session whether a unit fits the moment. Publishers connect through AdsMCP without handing user conversations to a third-party model provider.
Where else this shows up
- Brand safety. Suitability classification across billions of daily requests, where self-hosting makes each additional check nearly free. On AI surfaces it also means processing a live conversation, which publishers will not send to a third party. See brand safety in AI advertising.
- Contextual targeting. Embedding a full content catalog and re-embedding as it changes. Commercial embedding APIs make this uneconomic at archive scale; open models in the 100M to 600M range run it at hardware cost.
- Creative generation. Hundreds of asset variants per campaign under the advertiser's own cost and governance control. Licensing differs sharply here, with some open image models Apache licensed and others requiring a commercial licence.
- Retail media. First-party purchase data that cannot leave its environment, so any modeling has to run where the data already sits.
- Data residency. A downloadable model deploys in Frankfurt as easily as Virginia. A closed endpoint goes where the provider decides.
What to do about it
Know which cadence each model in your stack serves, because that determines your cost curve and your latency exposure. Read the licences properly, since MIT and Apache 2.0 carry different obligations than the custom terms on several major model families. And expect your advantage to come from models fine-tuned on your own campaign and conversation data rather than from picking the right model this quarter, because capability is commoditizing fast.
Self-hosting is more work, and that is a fair objection. You take on serving, scaling, evaluation, and security a vendor would otherwise handle, and frontier models remain better at hard reasoning. But the work is falling as tooling matures, while the control is becoming a requirement.
Roughly 800M+ weekly AI assistant users are generating conversational signal right now, and agent-to-agent buying is moving from demonstration to production. Both trends increase the number of models running per dollar of media managed. The platforms monetizing AI surfaces and buying against them will need somewhere to get those models.
Adgentek builds ad decisioning infrastructure for AI surfaces and agentic buying. If you are working out where inference should sit in your stack, or how conversational ads work inside a real latency budget, we are happy to compare notes.
