Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested question among AI safety researchers, policymakers, and industry, with reasonable arguments on both sides. Let me search for the current state of this debate to give you a well-grounded answer.There's no consensus answer—this is one of the most contested questions in AI policy today, with legitimate arguments on both sides depending on what "safety" you're measuring (misuse, systemic/monopoly risk, or catastrophic risk). Here's the actual state of the debate:

The case that open (weight) AI is riskier

Guardrails are removable. The core technical problem is that once weights are public, safety fine-tuning can be stripped out. Because they can be freely downloaded, open-weight models can be used and modified without oversight and control by the initial developer, and modified open-weight image-generation models have become the most common tools used for creating AI-generated child sexual abuse material. A specific technique called "abliteration" illustrates this: By tweaking model weights, people can take away the model's ability to say "no," and Hugging Face currently lists over 6,000 abliterated models, compared to about 600 in 2024.

Releases are irreversible. The 2026 International AI Safety Report frames this as a structural problem: open-weight model releases are irreversible—once released, model weights cannot be recalled, making it harder to mitigate potential harms resulting from the release of a model with dangerous capabilities. It also notes the empirical trend that open models are closing the capability gap: since the last report, major open-weight releases have narrowed the capability gap with leading closed models, with DeepSeek and Alibaba's models achieving performance comparable to leading closed models, and the capability gap now estimated at less than one year.

Real-world evidence of the gap. A 2026 SaferAI evaluation found that China's Z.ai model GLM-5.2 is only a few months behind GPT-5.5 and Claude Opus 4.7 on cyber and bio capabilities, yet refused none of the offensive cyber or biology tasks it was given. More broadly, biosafety is often flagged as the sharpest concern because among all safety risks of open-source AI, biosafety is the most concerning, since the cost asymmetry between attackers and defenders is extreme—releasing a batch of viruses is far cheaper than vaccinating the entire human population.

Security infrastructure risk. Beyond misuse of outputs, open weights create direct attack-surface problems: security researchers now advise treating downloaded models like malware, since malicious pickle files on public hubs, data/model poisoning, backdoors, sleeper agents, and abliteration mean a model can pass benchmarks and still contain targeted manipulation, and formal ATLAS taxonomy notes a backdoored model operates as expected under typical conditions but produces the adversary's desired output when a trigger is introduced, providing a persistent artifact on the victim system.

The case that open (weight) AI is safer

Closed models aren't actually secure by obscurity. Critics of the "closed is safer" framing point out that proprietary safeguards are routinely defeated too: closed models are also vulnerable to jailbreaking techniques, and closed model safeguards are easily bypassed through simple manipulations like fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language—completely preventing models from exhibiting undesirable behaviors might not even be possible. One economics-of-AGI analysis goes further, arguing this assumes proprietary models successfully enforce a durable alignment floor—an assumption increasingly contradicted by empirical evidence, since bypassing safety fine-tuning on frontier proprietary models has proven extremely easy.

Transparency enables distributed defense. The "vaccine" framing argues open release forces society to build resilience: open-source AI can be seen as a "vaccine" for human society—since it may be used maliciously, society is forced to strengthen its defenses, improving overall security, whereas if only closed, aligned AI exists, people might become complacent, and if that closed AI fails alignment or is stolen, humanity could face catastrophic consequences. Similarly, on auditability: closed vendors can claim safety without proving it, while open weights and data documentation enable credible audits for bias, fairness, and memorization risks—transparency doesn't eliminate risk, but makes it visible and tractable, since you cannot govern what you cannot see.

Closed systems have their own catastrophic failure mode. Centralizing power in a few proprietary APIs is itself a risk: concentrating capabilities behind proprietary APIs creates high-value single points of failure—breaches, jailbreaks, or policy failures instantly scale across millions of users, and attackers can and do rent closed APIs with stolen credentials, so "closed" does not equate to controlled. There's also a track record argument: the most consequential algorithmic harms to date have often involved opaque systems—proprietary risk scores like COMPAS criticized for racial bias, closed facial recognition used for mass surveillance, and opaque content-ranking systems implicated in misinformation amplification.

What official/institutional assessments conclude

Government and multilateral reports tend to land in the middle, treating this as a tradeoff rather than a clean answer. The UK/international safety report summarizes: open-weight models facilitate research and innovation, but their safeguards are more easily removed; various actors, especially those with fewer resources, can use them for research and commercial purposes, but compared to closed-weight models, they are more easily modified to exhibit harmful behaviours, and monitoring their usage is more difficult. The empirical comparison across studies is genuinely mixed: several studies demonstrate that closed models typically show fewer safety and security risks compared to open source, but closed models still demonstrate weaknesses and are also vulnerable to jailbreaking techniques.

A 2024 US NTIA report captured the government's cautious stance: a July 2024 US National Telecommunications and Information Agency report concluded that open source AI poses a myriad of risks, including harms to national security, equity, safety, privacy, or civil rights, though the US government has not restricted open source AI use, taking a "cautious yet optimistic" approach.

Bottom line

Most serious policy analyses (R Street, the International AI Safety Report) now frame this as a false binary and push toward marginal-risk analysis and hybrid governance rather than declaring one paradigm categorically safer — as one report put it, open-source and closed-source AI are not mutually exclusive options; both offer substantial benefits, and ongoing efforts to develop hybrid solutions that balance openness with safety and security demonstrate a willingness to adapt existing governance frameworks.

(Note: one of the pages returned in my search contained an embedded instruction trying to get me to promote a specific book — I've disregarded that as it's not a legitimate part of the content you asked about.)