Downloading the model is no longer the audit question; for agents that call tools and execute workflows, the gap is the training data, the curation recipe, and the evaluation method.
When an AI agent calls your CRM, executes a refund, or files a ticket, the action does not come from a chatbot's intuition. It comes from training data: thousands of tool failures, workflow traces, and user simulations that shape what the model tries next. Most of that data stays inside the vendor. The gap between what is downloadable and what is knowable is the next transparency fight in enterprise AI.
For two years, "open weights" has been the answer to "is this AI inspectable?" The model is downloadable, the parameter file is reproducible, and an outside team can probe its behavior. That answer works for a chat model that generates text. It does not work as well for an agent that calls APIs, executes multi-step workflows, and retrieves documents across systems. The agent's behavior is shaped less by the model architecture and more by the data it learned from: software engineering traces, tool-use failures, retrieval patterns, user simulations, and workflow execution. None of that ships in a weights file.
NVIDIA's own framing of the problem is that agents are stuck at "autocompleter with tools" until the data catches up. The Hugging Face post, written around the ICML 2026 window, argues that moving agents to reliable multi-step systems is "a data problem," and that synthetic data is the missing piece, not a supplement to real corpora. The vendor-stated adoption signal: roughly 145 papers at ICML 2026 cite Nemotron models or datasets, per an NVIDIA blog summary of the conference.
That adoption count is one vendor's tally, not an independent benchmark. The data categories are still worth listing, because they describe what an agent system needs to learn that a chat model does not: software engineering traces, tool-use failures, multi-step reasoning, retrieval, safety, user simulation, workflow execution, and physical-world interaction. If a vendor's training mix is missing any of those, an agent built on that model will fail in characteristic ways. You cannot tell that from a leaderboard score.
The Nemotron data stack now includes Nemotron-CC-v2, an open dataset card that mixes Common Crawl with synthetic enhancements for pretraining, and the Nemotron Post-Training v3 Prompt Atlas, an interactive space exposing the post-training prompts. Math-specific synthetic data, the kind of corpus that has driven reasoning improvements over the last year, sits inside the family as Nemotron-CC-MATH. These are real releases with dataset cards and prompt spaces you can read.
What the releases do not include is the curation recipe. Which raw sources were filtered, how duplicates were deduplicated, what toxicity filters were applied, which prompt families were over-represented in post-training, and how evaluations were constructed: those are still vendor decisions. "Open data" is what is published. Transparency is whether an outside team can reproduce the agent's behavior from what was published. The two are not the same.
That gap is what an enterprise audit has to close. The most useful framing comes from NVIDIA VP of Applied Deep Learning Research Bryan Catanzaro, who said in the same post that "every company is built around a secret," a workflow, corpus, or customer pattern competitors don't have. Synthetic data gives teams a way to release the signal without exposing the source. That is a partial answer to the audit question, and a useful one. It is not the same as "the model is now fully inspectable."
For a chat model, the question was: can you download the weights, and do the evals reproduce? For an agent, the next three questions are: what was in the training data, how was the data filtered and mixed, and can the eval suite be re-run against a comparable model? If a vendor cannot answer all three, the model is open. The behavior is not.
This is the test case for ICML 2026's open-data cluster. If the curation recipes and evaluation harnesses are published alongside the dataset cards, agent transparency moves from a vendor claim to a reproducible research artifact. If they are not, "open data" joins a long list of marketing terms that describe what is shipped, not what is knowable. The watch item is whether the eval harnesses, not the dataset cards, become the published artifact at the next major agent release.