Is open-source AI safer or riskier than closed/proprietary AI?

There's No Simple Answer — It Depends on What Kind of Risk You Care About

This is one of the most contested debates in AI policy, and the honest answer is: it depends on the risk category and time horizon. Neither side has definitively won the argument, though the picture has gotten sharper as models have gotten more capable.

The case that open (open-weight) AI is riskier

Guardrails can be permanently stripped. Once weights are public, safety training is not durable. closed source models themselves are not currently as well secured as would be desirable, but open-weight models have been shown to be extremely vulnerable to adversarial detuning, allowing malicious actors to both disable safeguards and elicit dangerous capabilities. This is often described as taking minutes via fine-tuning or "abliteration" techniques, after which you – not the vendor – become responsible for patching, curation of data, guardrail durability, and more, once a model is downloaded and run locally.

Real-world evidence of the gap. A concrete comparison in 2026: SaferAI evaluated China's open-weight GLM-5.2 model against closed frontier models and found GLM-5.2 refused none of the offensive cyber or biology tasks it was given, while frontier developers like OpenAI and Anthropic tend to rely on safeguards like classifiers, refusal training, and API-level controls to limit dangerous cyber and biological assistance. As one AI safety expert put it, "the frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly."

Once released, it's irretrievable. The Altman/Amodei position rests on the idea that sufficiently powerful models require access controls precisely because the risks are asymmetric: a bad actor who fine-tunes an open-weight frontier model for harmful applications cannot be stopped retroactively.

Even the underlying release itself may be inherently under-tested. A counterintuitive challenge for open source AI is that openly released models are often less safe than their closed counterparts — they're frequently research artifacts rather than deployment-ready systems, and safety work like red-teaming and monitoring for emergent harms requires sustained investment that volunteer communities and underfunded organizations cannot reliably provide, while critical safety decisions occur during pre-training and data curation, before weights are even released.

The case that open AI is safer (or at least not clearly riskier)

Closed models aren't actually secure either. Closed models are also vulnerable to jailbreaking techniques, and closed model safeguards are easily bypassed through simple manipulations like fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language — completely preventing models from exhibiting undesirable behaviors might not even be possible. Researchers conclude it is not clear that closed models are definitively "safer" than open-source models, and gaps will likely narrow over time as jailbreaking attacks become stronger and open safeguarding methods continue to improve.

"Access can be restricted" is a weaker guarantee than it sounds. Closed models can be compromised via hacking, leaks, reverse engineering or duplication — for example, Mistral's 70B parameter model was leaked by one of their early customers.

Openness enables safety research that closed systems block. Unlike closed APIs, open model analyses permit in-depth exploration of internal mechanisms and behaviors, enabling reproducible and comprehensive evaluations that strengthen understanding of generative AI safety — open source has also driven innovation in developing safeguards and controls, such as Meta's LlamaGuard and Hugging-Face's Safety Evaluation Leaderboard.

Defenders sometimes need what closed models refuse to give them. A striking real-world case in 2026: when Hugging Face suffered a security breach, its incident-response team first tried to use leading commercial AI models to analyze thousands of attack events, but those models' safety guardrails refused to process the exploit code and attack commands — so the team turned instead to an open-weight model run locally, specifically because it would process the attack artifacts without refusing, and because no data had to leave their environment. Similarly, security professionals note open-weight models are increasingly being used by defenders for threat hunting, malware analysis, red teaming, and incident response in environments where sending data to an external API is prohibited.

Concentration of power is itself a risk. Meta's counter-argument to the "open = dangerous" framing is structural: if only a handful of labs control frontier AI, those labs become the chokepoints for democratic oversight, too. Zuckerberg's argument is that broadly available models are structurally safer because they deny any single actor a monopoly on capability, while Altman's argument is that broad availability is structurally dangerous because it denies any safety body a meaningful gate. A 2026 industry letter made a related privacy point: open weights enable organizations to "control their own data," which applies equally to individuals who don't want sensitive documents processed by a server they don't control.

Reliance on closed APIs creates its own fragility. A real 2026 incident illustrates this: the Mythos/Fable 5 shutdown was a 15-day period during which Anthropic disabled both models for all customers to comply with a U.S. export control directive — a real-world demonstration of what API dependency looks like when regulators intervene, leaving organizations that had built workflows around those models with an unplanned outage.

Where honest observers land

Even careful analysts admit the debate is unresolved. One 2026 policy piece frames the current dominant narrative as too simplistic: the dominant policy debate over open-weight AI models has consolidated around a binary framing (open equals dangerous, closed equals safe), where restriction proponents argue releasing weights allows malicious actors to strip safeguards and evade accountability, while openness proponents counter that transparency accelerates research and prevents monopolistic concentration — both positions have merit, but neither adequately describes the risks as they actually present themselves.

Commentators covering the Zuckerberg/Altman split in 2026 reach a similar conclusion: neither camp has made the empirical case definitively — both positions are coherent, but neither has been tested at the capability levels now in view.

Bottom line

Most serious technical work in this space (e.g., the arXiv papers above) concludes that a mixed ecosystem with tailored governance per risk-tier, rather than a blanket "open bad / closed good" or vice versa framing, is the more defensible position — a view echoed by researchers who conclude a positive future with AI will involve a balance of proprietary and open-weight model development.