On June 13, 2026, the day Brazil played its World Cup group opener, Rio de Janeiro's municipal IT authority released a 397-billion-parameter AI model. The Mayor tweeted. The Brazilian tech press went wide. The model reportedly beat DeepSeek v4 Pro and Qwen 3.7 Plus on capability benchmarks, built by a city government for roughly R$500,000 (around $100,000 USD). A municipal team in the Global South, with a fraction of the hyperscalers' budget, shipping frontier-class AI during the World Cup. The narrative was almost too good.
Within 24 hours, it was forensically dismantled.
Nex-AGI, a Shanghai-based open-source AI collective, had released Nex-N2-Pro about a week earlier under an Apache 2.0 licence. When they ran the math on Rio-3.5-Open-397B's weights, every tensor in the model sat on a straight line between Nex-N2-Pro and Qwen 3.5-397B-A17B, to thousands of standard deviations. The mixing ratio came in at approximately 0.571, stable across all 60 layers. The collinearity score: 0.993. A genuine independent model would score near zero by chance. Rio-3.5 scored 0.993 across the full network.
The behavioural evidence was more pointed. Nex stripped the hardcoded "You are Rio" system prompt from the deployed model and asked it 120 identity questions. Without the mask, the model identified itself as "Nex, from Nex-AGI" 79.2% of the time. It called itself "Rio" exactly zero times. It recited Nex's specific training backstory verbatim, including a reference to the "Shanghai Innovation Institute." The model had no idea it was supposed to be Brazilian.
IplanRIO updated the Hugging Face model card and apologised. The explanation: "We detected an incorrect upload in the previous version, where the base merged version was uploaded instead of the final distilled model." The intended release, they said, was a version that had undergone on-policy distillation from a stronger model, which would represent genuinely additional work. What actually shipped was the raw merge, with nothing on top.
The case for IplanRIO
Take IplanRIO at their word for a moment. On-policy distillation, where a stronger teacher model generates outputs and a student trains on those, is real technical work. It costs money. It would represent original contribution on top of the merge. If that step was completed and simply not shipped due to a careless error, then the failure is one of process, not intent.
The community defence along these lines was credible. Developer Lucas Montano noted that merging two ~400B-class models and then applying policy distillation "isn't trivial," and that the model went viral during a World Cup match, not the ideal conditions for a careful technical disclosure. Tech commentator Rafael Quintanilha pointed to IplanRIO's inexperience: a municipal IT department that caught lightning in a bottle and fumbled the release.
The more generous structural point: model merging is completely legal under Apache 2.0. Qwen 3.5 is openly licensed too. The open-source stacking culture treats merging and remixing as standard practice. The norm is attribution, not originality. Nex-AGI's own complaint was attribution, not use. "We are flattered that the City of Rio used our work to achieve SOTA performance," Nex wrote in their technical report. "But in the open-source world, attribution matters."
What the charity reading can't cover
The problem isn't the technical error. It's the institutional wrapper placed around it.
The original model card described Rio-3.5 as the result of "autonomous post-training and proprietary fine-tuning," framing that implied original research. The Mayor of Rio used it to claim a public-sector AI achievement. The reported R$500,000 development cost was presented as proof of Brazilian ingenuity, attached to a project that appears to have mostly downloaded and merged two existing open models.
A pseudonymous developer shipping a weight merge under their own name is one thing. A municipal government using public resources and national pride to claim "we built an AI" during a globally watched sporting event is a different category of claim. The open-source attribution norm assumes good-faith actors who understand what they built. It was not designed to handle government press offices that need a headline.
There is a recent precedent worth naming. In March 2026, Cursor's Composer 2 was found to be built on Moonshot AI's Kimi K2.5 without disclosure. The backlash was reputational, not legal, and Cursor updated their documentation quickly. The mechanism was identical: wrap a third party's model, ship it under your own name, correct the attribution when caught. The difference with Rio is the institutional scale. Cursor is a startup; the costs of discovery fell on the company. IplanRIO is a city government; the costs fall on the public.
The incentive structure that makes this pattern permanent
The Bangkok Declaration, signed by more than 100 countries in February 2026, formally commits signatories to pursuing AI sovereignty. Every major Asia-Pacific economy has now launched or funded a domestic LLM programme. The UK set up a Sovereign AI Unit with £500 million behind it. India's government is subsidising 40,000 GPUs through the IndiaAI Mission.
The political logic is straightforward. AI capability is now treated as a strategic asset. Not having "your own AI" means depending on Chinese or American infrastructure, which is unacceptable for reasons of security, culture, and prestige. AI sovereignty and national pride run on the same emotional register, and the World Cup timing was no accident.
The technical logic is equally straightforward. Building a frontier model from scratch requires billions of dollars of compute, years of training runs, and hundreds of researchers. Merging two open-weights models requires a GPU cluster and a week of time. The gap between what AI sovereignty means politically and what it costs technically is enormous. That gap is a systematic incentive structure, and Rio-3.5 is what it produces.
The open-weights ecosystem has made this gap easier to paper over. Llama, Qwen, Mistral, Nex: any team can now produce a weight blend that benchmarks comparably to models costing orders of magnitude more to build. The attribution norms that govern this space were written for developers who credit their sources because they understand the culture. They were not written for government press offices chasing a national AI announcement.
The Rio story is, near as I can tell, the first case where forensic tools — weight collinearity analysis, system-prompt stripping, identity probing — were applied publicly and yielded results this unambiguous. Those tools will get used again. The incentive to close the sovereignty gap with a branded merge will not disappear. More episodes will follow, and they will be caught faster.
The test that will answer the question
IplanRIO is working to upload the corrected, fully distilled model with proper attribution. When it lands, the same checks will run. If Rio-3.5-Distilled scores measurably differently from the raw merge on independent evaluations, particularly on the benchmarks IplanRIO originally used to claim frontier-class performance, then real technical work happened and the "incorrect upload" explanation holds. The failure would be one of communication.
If it scores within noise of the raw merge, the apology is the whole story. A city government shipped another lab's work under a national flag, the Mayor tweeted, and the math caught it in 24 hours.
That test is worth watching. The structural argument stands either way, but the outcome determines which kind of story this actually is. A careless release during a World Cup is a minor institutional embarrassment. A government claiming sovereign AI capability it does not have is a more serious problem, and the 100-plus countries now publicly committed to building their own models will all face the same choice eventually.
Model merging is not the problem. Calling it something it is not, with public money and national pride attached, is where the open-source trust model breaks down. The attribution norms underpinning the open-weights ecosystem assume that users and developers share a common understanding of what "built on" means. Governments entering that ecosystem are not all operating with that understanding. Some will figure it out. Some will not. And the forensic community will be watching.