Is open-source AI safer or riskier than closed/proprietary AI?

I'll map the safety trade-offs between open and closed AI for you.

Neither open-source nor closed/proprietary AI is universally safer - safety depends on model capabilities, deployment, safeguards and governance, not the label alone.

> Neither model type is inherently safer. Closed models usually provide stronger centralized containment: one provider can restrict access, monitor use, push updates, and shut down a service. Open models can provide stronger independent scrutiny, reproducibility, and local control, but released weights can be modified, copied, and stripped of safeguards

The practical difference is what a developer releases, what a user is allowed to do with it, and how much control remains over deployment. "Open-source" is often used loosely: downloadable weights alone do not make training process, data, or license open.

1. How they differ

More precisely:

Meta's Llama models, for example, are described by the International AI Safety Report 2026 as having restrictive license conditions and including inference code but not training code; they are typically not considered open source. In 2025, Stanford AI Index reported 47 of 102 notable models used API access, 81 of 102 without corresponding training code, and only 4 of 102 releasing training code classified as open source.

2. Why open-source can be safer

a) Transparency and independent scrutiny: Transparency means source code, algorithms and datasets are accessible to anyone. Open models can be audited, making it easier to identify biases or errors. Access to artifacts can support inspection and reproduction, letting researchers observe inner workings and "chain of thought", test for security flaws, and reproduce evaluations.

Analogous to open-source software like Linux, vulnerabilities have been probed and patched by a vast community. Responsible open sourcing can unlock benefits while mitigating risks through enhanced transparency, security audits, and broader societal impact assessments.

b) Local control, privacy and sovereignty: Because open models are downloadable, people can run them on own computers and without sending data to provider. For businesses processing sensitive data, running local model may be best way to keep operations secure. It also prevents "data leaking" to third-party companies and avoids vendor lock-in, data sovereignty constraints, and limited customization.

Providers can change prices, alter rules, or cut off access entirely.

c) Democratization and cyber-defense: Open models challenge tight control by frontier labs and prevent mass concentration of power. Every individual could have a loyal-to-them AI system rather than relying on an inscrutable government/provider system.

Any tool that can be used for hacking can also be used to prevent it; defenders hack own software to uncover flaws. Open models can be used much more widely for cyber defense, while closed providers like Anthropic only enable some trusted companies via Project Glasswing.

In the long run, some argue open-source is safer because anyone can audit code, vulnerabilities are found and fixed faster.

3. Why open-source can be riskier

a) Irrevocable copies and loss of containment: Users can modify a model, including in ways that weaken refusal behavior, and redistributed copies may persist after original developer changes or withdraws release. The original developer cannot reliably recall every copy or enforce safeguards after release.

Safeguards can be removed or bypassed after release; local deployments may be invisible to publisher.

b) Safety training easily removed: AI companies train models to refuse harmful requests, but researchers have shown it's surprisingly easy to retrain a "safe" open model to agree to behaviors it was trained to avoid. No current approaches to making models tamper-resistant hold up against all attacks.

NIST evaluation found a DeepSeek open model answered 94% of overtly malicious requests when jailbreak used, compared with 8% for US reference models.

c) Lowered barrier to misuse: Making models open accelerates diffusion but also increases potential for misuse. In cybersecurity, open models can help automate creation of malicious scripts. Open models have no built-in safety barriers compared to mainstream closed models, a goldmine for rogue states and cyber criminals developing malicious code or phishing scams. Anthropic argues freely available models like GLM-5.3 pose serious cyberattack risks because they lack centralized safeguards and can be retrained to bypass safety controls.

Risk can look dramatic for catastrophic one-off incidents: a wildly powerful open hacking model could devastate infrastructure before defenses are shored up. If open models decide to misbehave, decentralization makes detection difficult.

Because of this, many experts still perceive open models as riskier than closed models, and the European Commission has noted that open-sourcing advanced general-purpose models can support safety research while warning that risk mitigations are more easily circumvented or removed.

4. Why closed/proprietary can be safer

Centralized controls and persistent containment: In closed deployment, requests go through provider-controlled infrastructure. Provider can require account, set quotas, block suspicious traffic, and suspend user. Centralization supports rapid containment: if monitoring detects new abuse pattern, provider can change filters or disable endpoint.

Before passing query to closed model, providers like Anthropic use automated systems to detect whether query relates to hacking or biological weapons, and can shut down accounts when filters are outsmarted. Closed providers can screen queries for hacking, biological weapons, and shut down accounts. This gives operational advantage when anonymous scale or rapid revocation matters.

5. Why closed/proprietary can be riskier

a) Opacity and imperfect safeguards: The defenses that AI companies build around closed models are far from perfect, and people misuse those models all the time. According to Anthropic risk report, several extensive hacking operations have been undertaken with assistance of Claude, showing closed models are risky enough—and open models would likely be much easier to exploit.

Customers may see only interface, published evaluations, or system card rather than training data, source code, weights and internal tests, and must assess whether provider disclosures are complete. External parties often see interfaces or disclosures; provider controls deeper evidence.

Cisco evaluation of 15 closed flagship models found multi-turn attack success rate ranged 7.89% to 88.30%, showing no frontier closed model in this cohort can be characterized as secure.

b) Vendor power, lock-in, and single points of failure: Providers can enforce access controls, monitor use and patch one service, while limiting outsiders ability to verify training data, evaluations and failures. A change in pricing, corporate policy, or technical outage can leave thousands paralyzed. Reliance introduces structural risks that threaten agility, security, and bottom line.

Central control is useful only when operator exercises it competently and transparently. Proponents of closed AI argue releasing powerful weights is dangerous for bioweapons/cyberattacks, but closed models also concentrate hacking power - e.g., world's most sophisticated hacking models are currently all US-made.

6. The consensus: No general winner

> There is no established general winner. Safety depends on the model’s capabilities, the intended use, the deployment context, the safeguards and monitoring

Being able to inspect artifact can improve scrutiny, but does not prove safety. Conversely, provider control over hosted model can enable centralized safeguards, but does not prove those safeguards are adequate. The reviewed evidence establishes relevant mechanisms and trade-offs, not a representative controlled comparison showing that either release category is safer overall.

Similarly:

> Neither open-source nor closed-source AI is automatically safer or more accountable

> The safer choice is the deployment with the stronger evidence and governance: clear provenance, independent testing, security and privacy controls, monitoring, incident response, human override and a named organization responsible for outcomes

Governance frameworks like NIST AI Risk Management Framework (released Jan 26, 2023) apply to both, directing organizations to establish governance, map context and risk, measure performance, and manage risks. Using a framework does not make model safe automatically. Under EU AI Act, providers of systemic-risk models face additional duties, and open-source exception does not cover them.

As one expert summarized by analogy to open-source software: I think most people in the technology business understood that open source was actually more secure than proprietary software, while another noted I don’t think it’s the open nature of it that makes it risky. I think it’s the uncontrolled nature, and Closed models are not automatically safe, and open models are not automatically reckless.

Bottom line:

Many experts advocate staged release - start closed, gradually become more freely accessible as safety is assured - because openness is a floor, not a ceiling.