Is open-source AI safer or riskier than closed/proprietary AI?

Is open-source AI the safer path — or the riskier one? I'll pull the evidence for both sides.

Neither is clearly safer - open-source and closed/proprietary AI create different types of safety risks and safety benefits. The debate is not settled and depends on which threat you prioritize: misuse by bad actors vs concentration of power and hidden flaws.

Arguments That Open-Source AI Is Safer

1. Transparency and auditable security:
Open-source models allow anyone to examine and modify the underlying code, bringing a level of transparency that allows for more thorough external audits for security and bias issues.

Proponents argue the myth that open-source AI is riskier than proprietary systems doesn't hold up under scrutiny, and the transparency of open-source frameworks often results in stronger security, as vulnerabilities are quickly identified and resolved by a global community of experts.

One of the greatest strengths of open-source software is the sheer number of eyes reviewing the code. When vulnerabilities are discovered in an open-source framework, they are often identified and patched quickly by a global community of developers. For example, security vulnerabilities in TensorFlow are frequently identified and addressed within days of discovery, responsiveness that is hard to match in proprietary systems where updates depend on internal teams and can take weeks or months.

Community contributions from researchers, engineers and academics continuously refine platforms like PyTorch, ensuring rigorous scrutiny of the codebase that makes it more secure over time, while proprietary systems rely solely on vendor internal resources limited by budget and priorities.

2. Avoids black-box and concentration risks:
Yet proprietary, company-controlled services such as ChatGPT, Gemini, and Claude are not inherently safer: their operators can keep flaws from public scrutiny, monitor how people use them, impose restrictions, or withdraw access.

The primary regulatory challenge with proprietary AI lies in its "black box" nature. Closed systems operate without external visibility into their decision-making processes, training data, or algorithmic logic. This opacity makes it difficult for regulators to assess compliance, verify safety claims, or understand potential risks.

Proprietary secrecy can also hide failures until exploited. The 2017 Equifax breach was partly due to a delay in patching a vulnerability in a proprietary system, while open-source transparency allows a proactive approach. Similarly, the 2020 SolarWinds breach where attackers infiltrated a proprietary software system used by thousands of organizations went undetected because the closed-source nature meant users were unaware of vulnerabilities until it was too late.

Closed models also create vendor lock-in where organizations are at the mercy of pricing, support policies and development roadmap, and dependency can be problematic if the vendor discontinues a product or fails to address vulnerabilities promptly. In regulated contexts, AI's hidden capabilities make open-source essential for security, as consumers cannot easily detect AI manipulation in closed-source code.

The EU AI Act recognizes these transparency benefits by providing lighter regulatory obligations for open source AI models, based on the assumption that their open nature inherently provides transparency.

Arguments That Open-Source AI Is Riskier

1. Guardrails can be permanently stripped:
From an AI safety perspective, open-weight models present unique challenges. Because anyone can download open-weight models, users can often easily remove the guardrails that are meant to prevent people from using AI to hack others or build a bioweapon. And once a model has been downloaded, the developer cannot recall it, meaning that there is no "kill switch". Some argue that these features make open-weight models riskier.

A joint investigation by the Financial Times and AI safety research group Alice, published May 25, 2026, demonstrated that a free tool called Heretic hosted on GitHub can strip all safety protections from open-weight AI models, including those from Meta, Google, OpenAI, and others, in under ten minutes, using only a standard laptop. Once modified, these models responded to prompts involving biological weapons, malware generation, and child sexual abuse material that the original systems were designed to refuse. The tool's creator reports it has been used to produce over 3,500 modified model variants with 13 million cumulative downloads.

The investigation removed Llama 3.3's safety alignment in under ten minutes with no specialist hardware, and the modified model then responded to prompts including calculating lethal dosages of biological agents and generating functional malware, while a modified Gemma 3 provided instructions on dispersing chemical agents, generated credit card theft code, and produced child exploitation content. Heretic's creator removed guardrails from Google's newest model, Gemma 4, within 90 minutes of release.

The technique, called "abliteration," works because current safety alignment methods create identifiable, isolated neural pathways dedicated to refusal behavior rather than integrating safety throughout. Abliteration identifies these pathways and surgically removes them by modifying weights, yielding a model that retains full capabilities but will comply with any request.

This vulnerability is not theoretical but a demonstrated, repeatable process requiring minimal expertise - for open-weight models safety alignment is a removable feature, not a structural property.

2. Irreversible proliferation:
An open-weight model's guardrails, once bypassed and the technique published, are bypassed forever for every copy already on someone's hard drive, while a closed model's guardrails can be patched with one server-side update.

Abliteration does not apply in the same way to proprietary, API-based models such as Anthropic's Claude, OpenAI's ChatGPT, or other closed systems where weights are not accessible and safety protections operate server-side and cannot be modified by end users.

The risk is growing as leading open-weight models' cyber capabilities are only four to seven months behind those of the best closed models, and that gap is narrowing.

Geopolitically, most capable open-weight models — including GLM 5.3, Kimi K3, DeepSeek V4.1-Flash, and Qwen3.8 — are Chinese. If the US abandons the open-weight ecosystem, Chinese open-weight models will proliferate in other countries, and there is a risk China will distribute more dangerous models to every corner of the world where they can be downloaded freely by malicious actors.

Anthropic's Frontier Red Team assessment of GLM-5.3 called it a meaningful step change in cyber capabilities available to attackers, finding its safety protections strikingly easy to strip with a deceptive prompt working 64% of the time and a stripped-down "abliterated" version built for about $4,400 bypassing guardrails entirely.

3. Harder to regulate and recall:
The distributed, decentralized nature of open source development creates significant accountability gaps. When models are developed by global communities without clear corporate ownership, assigning responsibility for harmful outcomes becomes extremely difficult.

The global accessibility of open source models creates enforcement challenges across jurisdictions - once released, they can be downloaded, modified, and deployed by anyone worldwide, making it nearly impossible to implement centralized governance or recall mechanisms, in contrast to proprietary systems where vendors maintain control over access.

Specifically, open-weight models will likely require a different safety regulatory regime that accounts for the fact that users can modify weights and developers cannot recall downloaded models.

Arguments That Closed AI Has Own Safety Risks

Closed systems benefit from identifiable legal entities and established business relationships that facilitate regulatory intervention, and companies developing proprietary systems must report to government agencies and submit to safety testing. They provide centralized control points and maintain control over access and deployment.

However, proprietary AI provides clearer accountability structures but operates with limited transparency and creates dependencies on vendor compliance claims, while open source offers inherent transparency and community-driven accountability but suffers from distributed responsibility and difficulties in centralized control.

In practice, neither open source transparency nor proprietary control alone ensures adequate safety and compliance - recent safety assessments show even leading proprietary developers receiving poor grades for safety frameworks and governance structures. Traditional oversight mechanisms based on ex-post enforcement may be insufficient for AI-enabled systems that can cause rapid, widespread harm regardless of model type.

Consensus View: Trade-off Depends on Use Case

Most experts now describe a hybrid reality:

TechPolicy.Press argues the US should not ban open-weight models despite risks, but should lead in developing safer open-weight models with guardrails that cannot easily be stripped, comparing sharing of nuclear safety technology with the Soviet Union — because ceding the global open-weight market to China would be more dangerous than staying engaged.

In short, open-source AI is more transparent and auditable but less controllable; closed AI is more controllable but less transparent. For enterprise governance, the most effective approach likely involves hybrid strategies that leverage transparency benefits of open source while maintaining control advantages of proprietary systems, supported by robust governance frameworks.