An open-source AI model just promised to keep your bid data off someone else's server. The fine print says otherwise
Xiaomi open-sourced MiMo-V2.6, a top-ranked AI model any firm can run on its own hardware under an MIT license — but Anthropic says Xiaomi built it partly by covertly funneling data through Claude, and the flagship version needs a multi-node GPU cluster most contractors don't own.
Xiaomi open-sourced a new family of AI models on September 22 called MiMo-V2.6, and the flagship version, MiMo-V2.6-Pro, immediately became the top-ranked open-weight model in the world on the Artificial Analysis Intelligence Index — beating DeepSeek and Alibaba's Qwen3.8 Max. It's released under the MIT license, meaning any company can download it and run it on its own hardware, for free, with no restrictions on commercial use. For a construction firm that's been told the price of using AI on sensitive bid data is trusting a vendor's cloud servers, that sounds like the fix. It isn't quite that simple, on two counts.
What does "open-weight and MIT-licensed" actually get you?
MiMo-V2.6 comes in two main sizes: Pro, a trillion-parameter model that only activates a fraction of its parameters per query, and a smaller, faster Flash variant. Both are "omnimodal" — they read text, images, video, and audio in the same model — with a 1-million-token context window, enough to hold an entire spec book and a set of drawings in one session. Xiaomi also released computer-use and 3D spatial reasoning capabilities alongside the models.
The MIT license is the part that matters for data control. Unlike a subscription to a hosted AI product, an MIT-licensed model's weights are a file you own. Run it on your own servers, and no outside company's infrastructure ever sees your prompts, your drawings, or your pricing. That's the argument every firm weighing whether to paste bid data into a public chatbot has been waiting for.
Why is "self-hosted" harder than it sounds?
The catch is hardware. MiMo-V2.6-Pro's own documentation recommends running it across two nodes of H100- or H200-class GPUs — enterprise data-center hardware that costs well into six figures and needs staff who know how to operate it. That's realistic for a well-funded tech company, not a 50-person mechanical sub, and it's a stretch for most mid-size GCs too. The smaller Flash model is far cheaper to run, but it trades away capability to get there — the "affordable to self-host" versus "as good as the frontier tools" tradeoff hasn't gone away. It's just been made explicit.
| MiMo-V2.6-Pro (self-hosted) | MiMo-V2.6-Flash (self-hosted) | Cloud AI API (e.g., Claude, GPT) | |
|---|---|---|---|
| Data leaves your servers? | No | No | Yes — vendor's servers process every request |
| Hardware needed | Multi-node H100/H200 GPU cluster | Single capable GPU server | None — pay per use |
| Capability | Top-ranked open-weight model | Reduced, faster, cheaper | Frontier-level |
| Realistic for a mid-size contractor? | Rarely, without dedicated IT budget | More often | Yes |
What's the Anthropic dispute, and does it matter to a contractor?
The same week MiMo-V2.6 launched, Anthropic published a threat intelligence report naming Xiaomi as one of seven China-based AI labs it says ran what it calls "distillation attacks" against Claude between December 2025 and August 2026 — passing conversations and coding sessions from their own models through Claude, then training on Claude's answers. Anthropic says it tracked more than 400,000 such exchanges from Xiaomi over a 20-day window in March and April. Xiaomi has not published a detailed public response.
That doesn't make MiMo-V2.6 unsafe to run — nothing in the report suggests the model does anything improper once it's on your servers. But it does ship with an open, contested question about how part of its training data was obtained, which matters more to a firm that has to explain its AI vendor choices to an owner, a surety, or a public agency than to a hobbyist running a chatbot at home. If your firm handles data with contractual or regulatory provenance requirements — government work, anything ITAR-adjacent — that's a question for your compliance advisor before adoption, not after.
What should a mid-size GC or sub actually do with this?
Treat "open-source" and "private" as two separate claims, not one. An MIT license removes the licensing fee and the vendor lock-in; it doesn't by itself remove the infrastructure cost of running a capable model, and it doesn't erase questions about how the model was built. If your firm has genuinely sensitive data — unreleased bid pricing, owner-furnished drawings under an NDA — and you're evaluating whether to self-host something instead of pasting it into a cloud chatbot, start with the smaller Flash-class model on a single server as a pilot, not the flagship. Measure whether it's actually good enough for the task (spec extraction, drawing review, submittal drafting) before anyone budgets for the GPU cluster the top-ranked version needs.
This is the same data-control question we flagged when a DLP startup raised $72 million because employees keep pasting bid pricing and drawings into AI chatbots — that piece was about stopping the leak at the browser; this one is about whether running your own model is a real way around the problem, and what it actually costs to do that.
Forward this to whoever on your team has floated "let's just run our own AI model" as the fix for sensitive project data.
Friday one chart. Every week, one piece of data that should change a decision on your project. Subscribe at constructionaibrief.com.
- What is Xiaomi MiMo-V2.6, and is it really free to use?
- MiMo-V2.6 is a family of AI models Xiaomi released on September 22, 2026, under the MIT license — meaning any company can download the model weights, run them on its own servers, and use the output commercially with no per-token fee to Xiaomi. The flagship MiMo-V2.6-Pro scored highest of any open-weight model on the Artificial Analysis Intelligence Index at launch. Running it isn't free, though: it still requires GPU hardware, and the Pro version needs a multi-node cluster of H100- or H200-class GPUs to run at a usable speed.
- Does an open-source AI model keep company data more private than a cloud AI tool like ChatGPT or Claude?
- It can, if you self-host it — no vendor's servers see your prompts or files, because the model runs on hardware you control. That's the pitch. But self-hosting the capable version of a model like MiMo-V2.6-Pro takes real infrastructure (multiple high-end GPU servers), which puts it out of reach for most contractors without a dedicated IT budget for it. A smaller, easier-to-run variant like MiMo-V2.6-Flash trades away some capability for that convenience.
- What did Anthropic accuse Xiaomi of doing with Claude?
- In a September 2026 threat intelligence report, Anthropic said Xiaomi was one of seven China-based AI labs that ran user conversations and coding sessions from their own AI models through Claude between December 2025 and August 2026, then used Claude's responses as training data to improve their own models — a practice called distillation. Anthropic said it tracked more than 400,000 such exchanges from Xiaomi over a 20-day period. Xiaomi has not publicly detailed a response to the allegation.
- Should a construction firm avoid open-source AI models because of this dispute?
- Not necessarily — but the dispute is a reason to ask questions before adopting one, the same way you'd vet any new vendor. A model with an unresolved IP or data-provenance dispute attached to it is a harder thing to defend to an owner, a bonding company, or a government contracting officer than one without that baggage, regardless of how it benchmarks.
- What's the practical difference between running an AI model locally versus using a cloud API for sensitive bid or drawing data?
- Running a model locally (self-hosting) means your prompts, drawings, and pricing data never leave your own servers, which removes the vendor as a party that could see, log, or lose that data. A cloud API means a vendor's servers process every request. The tradeoff is cost and effort: self-hosting requires buying and maintaining GPU hardware and the staff to run it, while a cloud API is pay-as-you-go with no hardware to manage.