Is open-source AI safer or riskier than closed/proprietary AI?

Both sidesSays it is contestedSources conflict

The AISI post stresses unique, irreversible risks of open-weight models, while the Stanford study reported by The Decoder finds limited evidence that open models pose greater marginal risk than closed ones.

Open vs closed AI safety is hotly debated — I'll survey the latest research and expert views to compare the risks.

Is open-source AI safer or riskier than closed / proprietary AI? The answer is: it depends on what type of risk you mean — researchers and surveys consistently find trade-offs, not a clear winner.

Why open-source can be safer

•Transparency and auditability: Open-weight systems "increase transparency, allow for widespread red teaming, and decrease market concentration". Since "anyone can examine and modify the underlying code, open-source models also bring a level of transparency that many AI ethicists champion, as this openness allows for more thorough external audits for security and bias issues".

•Distributed oversight and faster fixes: Advocates argue "empirical data from the history of software development proves that open-source systems identify and patch vulnerabilities significantly faster than siloed, proprietary alternatives. When we decentralize the development of AI, we distribute the capacity for oversight and defense across a global community of experts".

•Other benefits: Research summaries find open-source models are "more flexible and customizable, empower developers and foster innovation, advance research, improve trustworthiness and transparency, and can be more affordable and accessible than closed source ones". The transparency also helps with compliance: "You simply can’t meet compliance standards or anticipate risks if you’re dealing with a black box model. Open source makes it possible to inspect every dependency, which is essential for responsible AI adoption".

> Proponents argue "transparency through open source is the only way to protect against bad actors, bias, data exploitation and national security threats. There is absolutely no place for black-box AI".

Why open-source can be riskier

•Irreversible proliferation: "Open-weight models also pose unique risks. They can allow harmful AI capabilities to proliferate rapidly and irreversibly. Just as they can be modified for beneficial uses, they can also be modified for harmful ones. Safeguards designed to prevent harmful behaviours can also be quickly and cheaply removed from open-weight models".

•Cannot be recalled or centrally controlled: "Unlike centrally hosted commercial AI systems, an open-source model cannot effectively be recalled once it has been released and copied. Once these tools are released, they cannot be 'un-invented' or withdrawn".

•Harder to safeguard: "Open-weight models, on the other hand, are harder to safeguard, because they can be shared and modified arbitrarily without oversight. This makes developing strong safety assurances harder". In practice, "While the closed US models generally come with guardrails to prevent chatbots from spewing out harmful material, open-source models have fewer such limits and the ones that exist are easier to remove".

•Misuse vectors: Cited risks include criminals could "change the models to bypass controls, generate harmful content or embed backdoors for exploitation" and "data poisoning... the model can provide biases or disinformation", and that models "can be fine-tuned to generate malicious code, automated phishing campaigns, or even to create zero-day exploits".

•Societal-scale harms: "Open-source AI models, particularly generative AI models, are vulnerable to being repurposed for malicious activities that might disrupt public safety, influence election outcomes, increase the risks of cyberattacks, and aid terrorist and violent extremist (TVE) groups in evading automated detection systems". Jailbreaks and guardrail bypasses are also described as "easier on open models".

Public perception reflects this: In a McKinsey / Mozilla / Patrick J. McGovern Foundation survey of 700+ tech leaders, respondents "consider open source AI tools to be riskier than proprietary AI for most types of AI risks. The most relevant AI risks cited include cybersecurity (62 percent of respondents), regulatory compliance (54 percent), and intellectual property (50 percent)", with the same figures reported as "concerns about cybersecurity (62 percent), regulatory compliance (54 percent), and intellectual property (50 percent)".

Why closed / proprietary can be safer — and riskier

Safer in control:
If a model is deployed with closed weights, "its deployer can draw from a rich toolkit for making it safer. For example, they can scaffold the model with safeguards such as content filters. They also fully control the points of access, allowing them to enforce acceptable usage policies". That allows a vendor to patch, monitor, and revoke access — which is impossible once open weights are distributed.

Riskier in opacity and concentration:

•Black box problem: "For users of proprietary, closed-source models (like OpenAI's GPT series or Anthropic's Claude), the internal state, weights, and decision-making processes are inaccessible". "Your data becomes part of a black box model hosted by a third party".

•Compliance and safety blind spots: Risks include "Integration Blind Spots: Without understanding the underlying logic... it is difficult to predict how it will behave" and "Compliance Liabilities: As organizations face stricter AI governance, using a 'black box' model that cannot be audited for bias or hallucination presents a legal nightmare".

•Not immune to hacking: Even closed models are vulnerable. A Cisco Research study found "No Frontier Model Is Multi-Turn Immune" after testing "15 closed, proprietary flagship models from OpenAI, Anthropic, Google, Amazon, and xAI". The Stanford analysis also noted "Existing security mechanisms for closed models are also vulnerable".

•Concentration of power: Some experts argue "In some ways, the closed AI is a bigger risk simply because of the massive distribution", because a flaw or misuse at one provider affects millions instantly, and power stays with a few executives.

What recent research concludes

A Stanford Institute for Human-Centered Artificial Intelligence (HAI) study examined risks including "disinformation, biorisks, cybersecurity, spear phishing, non-consensual intimate images (NCII), and child sexual abuse material (CSAM)" and concluded "there is currently limited evidence of the marginal risk of OFMs compared to closed models or existing technologies".

Its key takeaways were:

> "Open foundation models, meaning models with widely available weights, provide significant benefits by combatting market concentration, catalyzing innovation, and improving transparency"

and that "current evidence of this marginal risk remains quite limited" when comparing open models to (a) closed models or (b) pre-existing technologies.

The UK AI Security Institute (AISI) summarized the tension similarly: "Open-weight systems are the lifeblood of open research and innovation in AI. They increase transparency, allow for widespread red teaming, and decrease market concentration. However, open-weight models also pose unique risks. They can allow harmful AI capabilities to proliferate rapidly and irreversibly".

Bottom line

•Open-source tends to be SAFER for: transparency, independent auditing, avoiding vendor lock-in, data sovereignty, scientific reproducibility, and resilience against single-vendor failures or censorship.

•Open-source tends to be RISKIER for: irreversible misuse (bio, cyber, disinformation), removal of safety guardrails, and lack of central ability to enforce updates or recalls.

•Closed tends to be SAFER for: centralized safety enforcement, content filtering, monitoring, and rapid patching/revocation.

•Closed tends to be RISKIER for: opacity, unaccountable concentration of power, compliance/audit challenges, data-privacy exposure to a third party, and hidden vulnerabilities that are harder for outsiders to find.

For that reason many organizations now adopt a hybrid strategy — using proprietary models for speed and managed safety, and open models where control, auditability and customization are non-negotiable — and researchers recommend judging risk not at the model layer alone but at downstream choke points (applications, distribution, usage monitoring).

2.[### April 2025](https://www.mckinsey.com.br/~/media/mckinsey/business functions/quantumblack/our insights/open source technology in the age of ai/open-source-technology-in-the-age-of-ai_final.pdf)

Citations (3)

1aisi.gov.ukGovernment
Managing risks from increasingly capable open-weight AI systems | AISI Work
Backs: “The answer is: it depends on what type of risk you mean — researchers and surveys consistently find trade-offs, not a clear winner. Why open-source can be safer. Transparency and auditability: Open-weight systems "increase transparency, allow for widespread red teaming, and decrease market concentration".”
evidence, article, neutral. Claim: Open-weight systems increase transparency and red teaming but also pose unique risks, so researchers find trade-offs rather than a clear winner.
2mckinsey.com.brCompanies
### April 2025
Backs: “The most relevant AI risks cited include cybersecurity (62 percent of respondents), regulatory compliance (54 percent), and intellectual property (50 percent)", with the same figures reported as "concerns about cybersecurity (62 percent), regulatory compliance (54 percent), and intellectual property (50 percent)".”
statistic, official document, points to no. Claim: Surveyed tech leaders consider open source AI riskier than proprietary AI; cybersecurity cited by 62%, regulatory compliance 54%, intellectual property 50%.
3the-decoder.comNews and media
Stanford study: Open source AI models pose no greater risks than closed models
Backs: “A Cisco Research study found "No Frontier Model Is Multi-Turn Immune" after testing "15 closed, proprietary flagship models from OpenAI, Anthropic, Google, Amazon, and xAI".”
evidence, article, neutral. Claim: Cisco study found no frontier closed model is multi-turn immune, and Stanford found limited evidence of greater marginal risk from open models.