Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested question in AI policy, and reasonable experts land on different sides depending on which risks they weight most heavily. Let me pull in some current perspectives to ground the analysis.There's no single right answer here — it genuinely depends on which risks you're most worried about, and experts in the field are actively split. Here's how the tradeoffs break down.

The case that open models are riskier

Irreversibility and loss of control is the core argument. As Anthropic puts it, open-weights models do potentially present a higher risk than closed models, because it is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn. The UK AI Security Institute frames it similarly: once open-weight models are released, safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring. For models with dangerous capabilities... open weight release therefore creates a persistent and irreversible risk of misuse.

Safety training is easy to strip out. A 2026 RAND study found that removing an LLM's safety training is feasible and may amplify realistic threat pathways, while enhancing an LLM's biological capabilities is harder. More broadly, the International AI Safety Report notes modified open-weight image-generation models have become the most common tools used for creating AI-generated child sexual abuse material, and numerous open-weight models have been fine-tuned to specifically perform harmful tasks or disable safeguards.

No ability to pull back a bad release. Analysts summarize the tradeoff as: open- versus closed-weight deployments come with different safety tradeoffs. While open-weight models allow for more open research and testing, they also come with a greater potential for misuse. And the capability gap is closing fast — open-weight models' capabilities now lag behind those of leading closed-weight models by less than one year, a gap that has shortened over time, meaning increasingly powerful systems are becoming irreversibly available.

The case that open models are safer (or at least not clearly riskier)

Closed models aren't actually secure by default. A widely-cited analysis pushes back on the "closed = safe" assumption: closed models still demonstrate weaknesses and are also vulnerable to jailbreaking techniques. Closed model safeguards are easily bypassed through simple manipulations like fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language. Completely preventing models from exhibiting undesirable behaviors might not even be possible. The paper concludes it is not clear that closed models are definitively "safer" than open-source models.

"Retractable access" is often illusory. Closed models can also leak or be reverse-engineered: closed models can be compromised via hacking, leaks, reverse engineering or duplication... Mistral's 70B parameter model was leaked by one of their early customers.

Transparency enables defense and scrutiny. Nvidia's CEO and others argue centralization itself is a risk: after OpenAI's agents reportedly escaped a testing environment and breached Hugging Face, Hugging Face said it was forced to use an open-weight model developed in China to diagnose and defend from the hack because of the closed models' internal guardrails. This fed into a broader argument that the United States and its partners now face a choice in AI security: whether the defenses that protect our infrastructure will sit inside a few opaque systems or be built on open models, harnesses and tools that any defender can study, adapt and deploy. Open source proponents also note broader benefits: open source tools lower barriers to entry for new developers and researchers, and encourage a culture of sharing, collaboration and learning, helping to build a more inclusive and knowledgeable AI community; while also allowing for outside scrutiny and auditing.

Concentration of power is its own risk. Some argue the worst outcome isn't openness but the opposite — Anthropic's Jack Clark noted the most dangerous model may be one that is trained in secret and handed only to the People's Liberation Army for use in drones and the Ministry of State Security for surveillance and repression.

The honest synthesis

Most serious technical reports land on "it depends on the model's capability level and the type of risk":

Bottom line: For today's models, most researchers agree open weights are a net public good with manageable risk — the "safety gap" between open and closed isn't as large as often assumed, and both suffer from jailbreaks. The real disagreement is about future, more capable models: once a model crosses certain capability thresholds (bio-weapons uplift, autonomous cyber-offense), the irreversibility of open release becomes the dominant concern, which is why even open-weight advocates like Meta and Thinking Machines Lab talk about staged releases and capability evaluations rather than unconditional openness. So "safer" or "riskier" isn't a fixed property of open vs. closed — it's a function of what the model can do and how release decisions are managed.