Both, depending on capability level, release details, and mitigations—neither is inherently safer. Open-source AI (weights, code, or full reproducibility) and closed/proprietary AI present distinct, well-documented risk profiles. The net safety outcome is context-dependent rather than a simple binary, and serious analyses (from labs, academics, and governments) treat it as a trade-off in transparency/control, proliferation, and incentives.
Transparency and Scrutiny Advantages of Open-Source
•Auditability and bug-finding: Open weights/code let outsiders inspect for backdoors, training-data exfiltration risks, bias amplification, or alignment failures. "Many eyes" can surface issues faster than internal red-teaming alone (analogous to open-source software security). Researchers can reproduce results, test interventions, and publish fixes without NDAs.
•Distributed safety research: Academia, independents, and smaller groups can study failure modes, develop better evaluations, unlearning methods, or interpretability tools. Closed models force reliance on the provider's claims and limited API access, which hinders verification.
•Reduced single-point failures and power concentration: A handful of labs controlling frontier systems creates risks of internal misuse, regulatory capture, government demands, or correlated failures. Open approaches dilute that. Historical precedent in crypto, OS kernels, and scientific computing shows openness often improves robustness over time.
•Avoiding "safety theater": Proprietary refusals and filters can be marketing or liability shields; they are routinely jailbroken. Open models make the actual capability surface visible so defenses can target reality.
These benefits are strongest for non-frontier or mid-capability models and for research artifacts.
Proliferation and Control Advantages of Closed/Proprietary
•Access control and monitoring: APIs enable rate limits, usage logging, staged capability deployment, rapid patching of jailbreaks, and revocation. Providers can refuse high-risk queries (bioweapons, cyber-offense, child exploitation, scams) and update safeguards centrally. Once weights are public, fine-tuning, LoRAs, or simple prompt engineering often strip refusals; the model cannot be recalled.
•Dual-use containment at the frontier: Highly capable models lower barriers for biorisk (agentic lab planning), cyber attacks, sophisticated disinformation, or autonomous harm. Closed release + structured access lets labs gatekeep while gathering evidence on misuse. Open release of near-frontier systems accelerates diffusion to unaccountable actors (criminals, states, terrorists) before defenses mature. Empirical pattern: open models are fine-tuned and deployed for scams, non-consensual deepfakes, and malware assistance faster and with fewer frictions.
•Incentive alignment for caution: Companies face reputation, legal, and investor pressure; they can pause scaling or invest heavily in alignment without immediately empowering competitors or adversaries. Open races can compress timelines and prioritize benchmarks over safety.
•Practical reality of leaks and irresponsibility: Weights leak; "open" licenses are hard to enforce; some open releases have been premature relative to demonstrated risky capabilities. Closed systems are imperfect (insider threats, jailbreaks, economic pressure to ship) but retain more levers.
These risks grow nonlinearly with capability—especially tool use, long-horizon agency, scientific R&D assistance, and self-improvement potential. GPT-2-era openness was low-stakes; models that meaningfully accelerate novel pathogen design or autonomous cyber operations are not.
Key Variables That Decide Net Risk
•Capability threshold: Below certain levels (current open models in many domains), openness mainly helps. At or beyond levels that enable catastrophic misuse with low expertise, controlled access is the more precautionary default until verification, interpretability, or hard defenses improve. Most frontier labs treat full open-sourcing of the most capable models as unacceptable for this reason.
•What is released: Inference code + weights vs. full training stack/data; staged or delayed release; built-in watermarks/canaries; licenses with use restrictions (weakly enforceable); or true open-source vs. "open weights."
•Ecosystem mitigations: Hardware-level controls, mandatory safety evals before release, liability rules, international compute governance, and rapid defensive tools (detection of model-generated content, secure fine-tuning platforms) shift the balance. Pure openness without these is riskier; pure closure without audits is also risky.
•Actor landscape: Openness helps benevolent researchers and hurts if offensive use outpaces defense. Closed systems help if the lab is competent and aligned with public interest—and hurt if not.
•Evidence so far: Open models have enabled broad beneficial use and research while also appearing in misuse pipelines. Closed models have blocked some harms via filters yet suffered leaks, jailbreaks, and opacity complaints. Neither paradigm has produced existential-scale accidents yet because capabilities are limited; arguments extrapolate from dual-use patterns in biotech, cyber, and prior tech.
Practical Synthesis
For present-day LLMs, hybrid approaches often dominate: open mid-tier models for innovation/transparency + controlled access or heavy safeguards for frontier systems; third-party audits; staged releases; and investment in removal-resistant alignment and monitoring. Long-term safety hinges more on solving technical alignment, robust evaluations, and governance than on open vs. closed alone. Blind ideology for either extreme—maximal openness regardless of capability, or permanent black-box monopoly—is not evidence-based.
Responsible path: default to greater caution (more control, staged/proof-of-safety releases) as models gain dangerous dual-use potential, while preserving enough openness for verification and broad defensive progress. Track record, not slogans, should decide case by case.