Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested question in AI policy and safety research, with reasonable arguments on both sides. Let me search for current perspectives to give you a well-grounded answer.## There's no simple answer — it depends on what kind of "safety" you mean

This is one of the most contested questions in AI policy, and credible experts land on different sides. Here's the honest breakdown:

The case that open-source/open-weight AI is riskier

Guardrails are trivial to remove. Once weights are public, anyone can fine-tune away safety training. Removing an open-weight model's guardrails can take minutes, and some models have no guardrails by default — a free tool stripped safety protections from an open-weight model in less than ten minutes using just a personal laptop. Similarly, research has shown that with just a few dozen fine-tuning samples, the safety constraints of a model can be removed, enabling it to execute arbitrary instructions.

Releases are irreversible. Open-weight model releases are irreversible — once released, model weights cannot be recalled, making it harder to mitigate potential harms resulting from a model with dangerous capabilities. You can't patch or revoke access the way you can with an API.

Harder to monitor and oversee. Open-weight models facilitate research and innovation, but their safeguards are more easily removed; compared to closed-weight models, they are more easily modified to exhibit potentially harmful behaviours, and monitoring their usage is more difficult. Malicious use (bioweapons uplift, cyberattacks, disinformation) can happen with zero visibility to anyone.

Capability gap is narrowing fast, which matters because risk scales with capability. Since the last Report, major open-weight releases have narrowed the capability gap with leading closed models — DeepSeek and Alibaba released R1 and Qwen with performance comparable to leading closed models, and the capability gap is now estimated at less than one year.

The case that open-source AI is safer (or at least not clearly less safe)

Closed models aren't actually unbreakable. Closed models are also vulnerable to jailbreaking, and their safeguards are easily bypassed through fine-tuning via accessible services, repeated-word prompts, ciphers, or foreign-language prompting — completely preventing undesirable behaviors might not even be possible. So the premise that "closed = safe by default" is shaky.

"Security by obscurity" is fragile anyway. The standard argument against open-source AI is that it increases tail risk by removing institutional safety filters — but this assumes proprietary models successfully enforce a durable alignment floor, an assumption increasingly contradicted by empirical evidence, since bypassing safety fine-tuning on frontier proprietary models has proven extremely easy.

Transparency enables public scrutiny and faster fixes. As one security expert put it, "From a risk perspective, I would say open source AI is actually safer in the sense that public eyeballs and scrutiny on these models are a natural enforcement mechanism." Relatedly, open models let people audit code, inspect data, and test for biases, building confidence through visibility — though that same openness exposes vulnerabilities in plain sight.

Closed models can leak too. Closed models can be compromised via hacking, leaks, reverse engineering, or duplication — e.g., Mistral's 70B parameter model was leaked by one of their early customers. So "closed" doesn't guarantee permanent control.

Empirically, the open/closed split predicts safety behavior less than you'd think. One recent benchmark found open-source LLMs had a substantially higher harm score than closed-source models, but this gap was largely attributable to higher rejection rates among closed models rather than inherently safer per-response behavior — their harm scores when they did respond were comparable. The same study concluded the open- vs. closed-source distinction is a poor predictor of safety; specific alignment strategies matter far more than model accessibility.

Open models can also help defenders. In one documented incident, an open-weight model run locally allowed defenders to process attack artifacts without refusing and without sending sensitive data to a third party — it was what allowed defenders to see what had happened.

Where there's broad consensus

Bottom line

Neither "open" nor "closed" is categorically safer — they trade off different failure modes:

Which one is "riskier" in practice depends heavily on the specific model's capabilities, who's asking (a safety researcher vs. a bad actor), and what kind of risk you're weighing (misuse by individuals vs. concentration of power vs. systemic monitoring). The research increasingly suggests that alignment technique and capability level matter more than the open/closed label itself.