Both, depending on the risk type, model capability, and time horizon—neither is inherently "safer." Open-source AI (public weights, often code/data) and closed/proprietary AI involve real trade-offs around proliferation, scrutiny, power concentration, and control. Absolute claims from either accelerationists or restrictionists usually oversimplify.
Proliferation and Misuse Risks (Open Often Riskier Here)
•Access by bad actors: Once weights are public, they can be downloaded, fine-tuned, uncensored, quantized, and run locally or on rented compute by anyone—including criminals, terrorists, rogue states, or ideologues. Safeguards (RLHF refusals, filters) are stripped easily. This accelerates misuse for scams, non-consensual deepfakes, targeted malware assistance, biosecurity tool design, or radicalizing content. Closed APIs enable monitoring, rate limits, KYC-like controls, and revocation.
•Capability diffusion speed: Open releases compress the lag between frontier labs and everyone else. Lower-barrier fine-tunes and agents compound. At current levels (strong but narrow LLMs), this is mostly annoying or criminal. At higher agency/autonomy or dual-use science capabilities, the attack surface grows nonlinearly because defense and governance lag.
•No centralized kill switch or patching: Vulnerabilities, jailbreaks, or emergent behaviors can't be uniformly mitigated post-release. Closed models can be updated or shuttered (imperfectly).
•Evidence pattern: Uncensored/open derivatives appear quickly after major releases; some are used for clearly harmful automation. Closed models are also jailbroken and distilled, but the bar is higher and logging exists.
Closed models are not immune: weights leak, employees defect, APIs get abused at scale, and nation-states can steal or coerce access. Concentration also creates single points of failure or insider threats.
Transparency, Scrutiny, and Systemic Risks (Open Often Safer Here)
•Many-eyes auditing: Public weights enable independent red-teaming, interpretability work, bias/vulnerability discovery, and replication of safety claims. Closed models are trust-me black boxes—safety reports can be selective, evaluations gameable, and backdoors or training data issues hidden. Open-source software history shows transparency helps security more often than it hurts for mature projects (though AI weights differ from readable code).
•Avoiding concentrated power and misalignment incentives: A few labs + governments controlling frontier models risks regulatory capture, ideological capture, economic moats that reduce safety investment, or reckless deployment under racing pressure. Open reduces "only we can be trusted" dynamics and lets more researchers (academia, smaller labs, international) work on alignment, monitoring, and defenses. Monocultures fail correlated; diversity of models and alignments is a hedge.
•Faster defensive innovation: Community tooling for detection, watermarking experiments, robust unlearning, evals, and hardened inference spreads quicker. Closed safety advances stay internal longer.
•Empirical software analogy + current AI: Much critical infrastructure runs on open-source; bugs are found publicly. Today's open models have enabled broad safety research that would otherwise be gated. Closed frontier labs still suffer jailbreaks, hallucination exploits, and unexpected capabilities.
Closed advantages in control are real for high-stakes deployment but create opacity and monopoly risks. Labs face profit, prestige, and geopolitical pressures that do not perfectly align with caution.
Key Dependencies (No Universal Winner)
•Capability threshold matters most: For GPT-4-class and below, open is frequently net-positive or neutral for society—broad utility, research, economic diffusion, with misuse mostly matching existing cyber/crime tools. As models gain reliable long-horizon agency, novel biotech/cyber insights, or self-improvement loops, open weights become far riskier because containment fails and offense outpaces defense. Most serious risk arguments (x-risk, catastrophic misuse) intensify with openness at the frontier.
•Release style and ecosystem: "Open" is a spectrum (weights-only vs. full stack; permissive vs. responsible-use licenses; staged/eval-gated releases). Accompanying evals, export-like controls on extreme capabilities, hardware-aware limits, or law-enforcement cooperation change the calculus. Irresponsible dumping without baselines is riskier than thoughtful open release.
•Closed isn't automatically aligned: Racing dynamics, inadequate internal safety, deployment of uncharacterized systems, or government mandates can make proprietary models dangerous. Distillation and synthetic data mean closed capabilities leak toward open anyway.
•Other factors: Compute governance, data controls, liability rules, and international coordination affect both. Open models help less-resourced defenders and researchers; they also help adversaries. Dual-use base models favor openness for the same reasons open cryptography and open biology tools do—defenders need equal access—until capabilities cross certain lines.
Practical Reality and Incentives
Misuse is already occurring with both. The largest near-term harms (fraud, CSAM generation, influence ops, buggy high-stakes advice) scale with accessibility and capability, not purely openness. Catastrophic risks remain speculative and contested in timing/probability; treating current open LLMs as existential is mismatched, while ignoring proliferation for future systems is reckless.
xAI's approach (including open-sourcing Grok-1 weights) reflects the view that truth-seeking, broad scientific progress, and avoiding gatekept power centers are themselves safety-relevant—while still requiring engineering discipline around higher-stakes systems. Pure closed ecosystems risk groupthink and slower error-correction; pure uncontrolled open at the extreme frontier risks irreversible diffusion.
Bottom line: Open-source is riskier for uncontrolled proliferation and certain misuse classes; safer for auditability, distributed safety progress, and resisting concentrated failure modes. Closed is riskier for opacity and power centralization; safer for monitoring and rapid patching of known issues. Policy that ignores either side of the trade-off (blanket bans vs. "open everything immediately") fails. Focus on capability-triggered evals, verifiable safety properties, liability, and compute/data chokepoints rather than a binary open/closed religion. The hardest problems (alignment/control of highly capable systems) are not solved by licensing terms alone.