Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested question in AI policy, without a settled answer—it depends heavily on which risks you're weighing and over what time horizon. Let me pull in some current perspectives on this debate.There's no consensus answer—the debate is genuinely split, and the "safer" side depends heavily on which risks you prioritize, the capability level of the model in question, and your time horizon. Here's how the arguments break down:

Case that open-source/open-weight AI is safer

Distributed scrutiny catches flaws faster. Open source AI models allow companies to become aware of flaws in their products and make quick improvements at a much faster pace, since many people can interact with them without barriers. Microsoft makes a similar point: open models broaden defensive capability, increase transparency, and allow vulnerabilities to be discovered and remediated across many teams, and openness may be one of the most important paths to AI safety and security.

Closed models aren't actually that secure either. A common assumption is that closed models have stronger safeguards, but closed models are also vulnerable to jailbreaking, and their safeguards are easily bypassed through simple manipulations like fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language. Even the "access can be revoked" argument is shaky: closed models can be compromised via hacking, leaks, reverse engineering, or duplication — Mistral's 70B parameter model was leaked by one of their early customers.

Concentration of power is itself a risk. Concentrating advanced AI capabilities behind a small number of closed models results in a small number of single points of failure, weakens competition, and leaves critical technology in the hands of a few providers. Brookings makes the same point about regulatory capture: if American AI is dominated by a small handful of closed model providers, the result will be an overconcentration of power, raising concerns including regulatory capture.

Defenders need equal tools. In a world where cybersecurity attackers use advanced AI, defenders need access to models with comparable capabilities so they can detect, simulate, and respond to emerging threats.

Case that open-source/open-weight AI is riskier

Guardrails can be stripped. The most cited concrete risk: open-weight models have been shown to be extremely vulnerable to adversarial detuning, allowing malicious actors to both disable safeguards and elicit dangerous capabilities. A major AI-strategy paper puts it bluntly: open-weight models eventually present several significant risks: they can be fine-tuned on dangerous data—for instance, using virology publications to create more effective tools for biological weapons development; safety measures and guardrails can be readily removed after release; and open models are difficult to monitor for misuse, unlike closed APIs where companies can track and evaluate emerging threats.

Irreversibility. Weight releases are irreversible—once published, they remain permanently accessible, unlike an API that a company can shut down or patch.

Real-world attack data. A 2025 Cisco analysis found eight open-weight AI models specifically susceptible to multi-turn jailbreak attacks, which attempt to solicit information through indirect prompts, and were 93% effective.

No accountability for harms. Some bugs might be neither easy to spot nor fix, leading to vulnerability proliferation; even if patches are built, it's difficult to ensure they're applied; and it can be difficult to assign liability, making it harder to incentivize actors against causing harm.

Where the evidence actually points

A few things emerge as more empirically settled than the raw "open vs. closed" framing suggests:

Bottom line

Neither category is uniformly "safer." Closed models offer better containment — usage monitoring, revocable access, centralized patching — but this is often overstated since they can still be jailbroken, leaked, or hacked, and their internal failures are invisible to outside scrutiny. Open-weight models offer better distributed defense and auditability but sacrifice the ability to ever "pull back" a dangerous capability once released, and safety fine-tuning is trivially reversible.

The most defensible current position among AI safety researchers is roughly: openness is a net safety benefit for models below a certain capability threshold (enabling research, red-teaming, and broad defensive tooling), but the calculus shifts as models approach frontier capabilities in domains like cyberweapons or bioweapons, where irreversibility becomes the dominant risk factor rather than transparency being the dominant benefit.