Is open-source AI safer or riskier than closed/proprietary AI?

I'll compare the safety trade-offs of open-source and closed AI — gathering the latest research on transparency and risk.

There is no consensus that one is strictly safer - the answer depends on which risk you mean and the capability of the model.

Arguments that open-source AI is safer

1. Transparency and auditing:
Proponents argue openness enables independent safety auditing, prevents monopolistic concentration of power, and accelerates research by allowing thousands of researchers to study model behavior rather than a handful at closed labs.

On the one hand, the accessibility and transparency of open models can deliver advantages including security and performance advantages through distributed development and auditing.

Specific benefits cited:

Mark Zuckerberg wrote in 2024 that he expects open source AI to be safer than the alternatives, especially against unintentional harm, because open systems can be widely scrutinized.

A 2026 open-weights letter signed by more than 270 companies including Meta and Mozilla argues that "openness may be one of the most important paths to AI safety and security" because a broad community can examine model behavior and find vulnerabilities, and that closed models can fail in ways outsiders cannot detect.

The opposite risk of closed systems is also noted: proprietary, company-controlled services such as ChatGPT, Gemini, and Claude are not inherently safer: their operators can keep flaws from public scrutiny, monitor how people use them, impose restrictions, raise prices, or withdraw access.

2. Evidence of limited marginal risk:

Princeton, Stanford and MIT researchers in a Science article found that available evidence does not show that open models are riskier than closed models or information already available through standard research techniques like online searching.

They concluded that evidence shows that restricting access to models does not necessarily limit the risk of misuse. This is partly because even closed models can be subverted and partly because information for malicious actors might already be available on the internet through search engines.

They introduced the concept of "marginal risk": To what extent do open foundation models increase risk relative to closed foundation models, or to preexisting technologies such as search engines.

For many threat vectors, they wrote, existing evidence of marginal risk is limited.

Some comprehensive reviews conclude that benefits and the risk of the missed opportunities of open sourcing Gen AI significantly outweigh the marginal direct safety and security risks.

Overall, open source software is neither inherently more nor less secure than proprietary software.

Arguments that open-source AI is riskier

1. Irreversibility and uncontrollability:

Critics, including some researchers at Anthropic, argue that releasing powerful model weights makes it impossible to prevent misuse — once weights are public, they cannot be un-released, and fine-tuning can remove safety guardrails.

Dario Amodei has described this as "the asymmetry of open source: the benefits are diffuse but the risks can be concentrated".

In Senate Judiciary testimony July 25, 2023, Anthropic CEO Dario Amodei said:

> "Open source is a good thing... They have some risks, but the benefits may outweigh the costs... [but] If we talk about two to three years for the frontier models, for bio risks, and probably less than that for things like misinformation... I think the path that things are going in terms of the scaling of open source models is a very dangerous one. And if that path continues, I think we could get to a very dangerous place".

His core technical argument: When you control a model and you're deploying it, you have the ability to moderate usage. It might be misused at one point, but then you can alter the model, revoke a user's access, or change what the model is willing to do. When a model is released in an uncontrolled manner, there's no ability to do that. It's entirely out of your hands.

Releasing a model's weights does not by itself make the AI system fully open source, and under the Open Source Initiative's definition other materials and freedoms are required, but the weight release is what creates the irreversible risk.

2. Perception and specific risk vectors:

Survey respondents consider open source AI tools to be riskier than proprietary AI for most types of AI risks. The most relevant AI risks cited include cybersecurity (62 percent), regulatory compliance (54 percent), and intellectual property (50 percent).

Technically speaking, while open-source AI may provide a higher degree of transparency compared to proprietary AI technologies, other risks including hallucinations and inaccuracies, capacity to cause harm, infringement of intellectual property, and privacy risks are not necessarily mitigated in any manner by the fact that AI is an open source AI.

Open allows auditing but requires vigilance. Closed offers centralized safeguards but depends on the vendor's priorities.

With closed-source models, the risks are external: data leaving your network, vendor breaches, service availability. You also can't inspect the model for bias, backdoors, or extraction vulnerabilities — that door is closed. With open models, organizations must implement their own content safety, output filtering, and access control infrastructure rather than relying on a vendor's centralized guardrails.

Synthesis: Context-dependent

Most researchers and regulators now distinguish by capability tier:

Nvidia's Open Secure AI Alliance summarized the dilemma: "Some argue that open models are inherently less safe because they can be misused for cyberattacks or modified to remove ... Those risks are real, but they do not disappear in closed systems, and simply keeping weights closed does not prevent determined attackers from seeking or exploiting powerful AI."

Best practice recommended by researchers is to evaluate case-by-case, and to focus regulation on misuse and downstream defenses rather than assuming secrecy alone improves security — while acknowledging that for very high-risk dual-use capabilities (bio, advanced cyber), open release may require stricter governance because revocation is impossible.