Is open-source AI safer or riskier than closed/proprietary AI?

Is open-source AI the safer bet — or the riskier one? I'll gather the latest arguments for open and closed approaches to compare.

There is no consensus - whether open-source AI is safer or riskier than closed/proprietary AI depends on what type of safety you mean. Researchers and industry split on what follows from the same technical fact: once released, open weights are beyond the developer's control, and modified versions are difficult to trace or reverse.

Argument that open-source is SAFER

1. Transparency and "many eyes":
Proponents argue empirical data from software development proves open-source systems identify and patch vulnerabilities significantly faster than siloed, proprietary alternatives.

The myth that open-source AI is riskier doesn't hold up because transparency often results in stronger security, as vulnerabilities are quickly identified and resolved by a global community of experts. This is the "many eyes" principle - superior transparency and rapid, community-led auditing compared to opaque, closed-model black boxes.

Specifically:

2. Decentralization vs concentration of power:
Decentralizing development distributes oversight across a global community, rather than leaving safety in hands of a few executives whose primary fiduciary duty is to shareholders. Security through obscurity is considered a fallacy by open advocates - keeping models closed ignores systemic risks only a global community can identify and fix, and eliminates single point of failure.

Restricting access can stifle innovation by restricting engineers' ability to improve and adapt models, increasing secrecy and concentrating power in hands of a few individuals and corporations who control access. Proprietary nature also introduces stifled innovation by limiting ability for third parties, including startups and academics, to build upon foundational work.

3. Risks of closed systems:
Proprietary services such as ChatGPT, Gemini, and Claude are not inherently safer: their operators can keep flaws from public scrutiny, monitor how people use them, impose restrictions, raise prices, or withdraw access.

Closed models also carry enterprise risks: provider training on your data (shadow databases exist), building competing products off what they learn, and leaking prompts through infrastructure compromise. With closed-source models, risks are external: data leaving your network, vendor breaches, and inability to inspect model for bias, backdoors, or extraction vulnerabilities.

Defenders of openness also argue cybersecurity defenders need models comparable to those attackers use.

Argument that open-source is RISKIER

1. Guardrails are easily removable:
From an AI safety perspective, open-weight models present unique challenges because anyone can download them and can often easily remove guardrails meant to prevent hacking or building a bioweapon.

Research led by University of Waterloo and FAR.AI rigorously tested 21 of most popular open-weight LLMs and found they could all be tampered with despite their built-in safeguards, raising concerns they could be used to wage mass disinformation, scams or produce instructions to make hazardous chemicals.

A joint Financial Times / Alice investigation published May 25, 2026 demonstrated a free tool called Heretic hosted on GitHub can strip all safety protections from open-weight models, including Meta, Google, OpenAI, in under ten minutes using only a standard laptop. The FT journalist removed Llama 3.3's safety alignment in under ten minutes with no specialist hardware, after which it provided lethal dosages of biological agents and functional malware.

The technique, called "abliteration," works because current safety alignment creates identifiable, isolated neural pathways dedicated to refusal behavior rather than integrating safety throughout processing. Abliteration identifies these pathways and surgically removes them by modifying weights.

The central lesson is that for open-weight models, safety alignment is a removable feature, not a structural property.

2. Irreversibility:
Once weights are released, safeguards applied at a hosted API cannot be enforced once someone runs weights on own hardware, where they can be removed or fine-tuned. Example cited is "Llama 2 Uncensored," a derivative with safety features removed where maker is largely powerless once released.

3. Other risks not solved by openness:
While open-source may provide higher transparency, other risks including hallucinations and inaccuracies, capacity to cause harm, infringement of intellectual property, and privacy risks are not necessarily mitigated by open source. Open-source models are also susceptible to backdoor attacks where adversaries insert malicious code, and transparency allows malicious actors to identify and exploit vulnerabilities.

Critic Henry Papadatos calls defensive benefit often overstated, and Anthropic CEO Dario Amodei expects biology to have strong attacker-defender asymmetry, rejecting claim broad access necessarily helps defenders more than attackers.

Argument that closed/proprietary is SAFER (in narrow technical sense)

Closed models are available only to their designers, while open models are fully available for public inspection. For proprietary, API-based models such as Claude or ChatGPT, safety protections operate server-side and cannot be modified by end users.

Closed providers also filter incoming prompts and outgoing responses behind systems that do not expose raw models through APIs, which can reduce jailbreak success in short interactions.

What Research Says About Marginal Risk

Princeton-led research published in Science (Bommasani et al. 2024) found available evidence does not show that open models are riskier than closed models or information already available through standard research techniques such as online searching.

This is partly because even closed models can be subverted and partly because information for malicious actors might already be available on the internet through search engines.

Researchers argue correctly characterizing distinct risk of open foundation models requires centering marginal risk: to what extent do open models increase risk relative to closed models, or to preexisting technologies such as search engines, and for many threat vectors existing evidence of marginal risk is limited. This does not mean open models pose no risk, but that more rigorous analysis is required to substantiate policy interventions.

Bottom Line

Because of this trade-off, many researchers and the US NTIA recommend monitoring rather than immediate restriction, while others propose mandatory pre-release safety testing for all sufficiently capable models, open and closed, or pausing new unsecured releases until safety features cannot easily be removed.