Open vs. closed AI safety is debated — I'll survey arguments on both sides.
Neither is categorically safer — open-source and closed/proprietary AI have opposite safety trade-offs, and which is riskier depends on the threat you are worried about.
Arguments that open-source is SAFER
Open-source proponents argue that transparency produces safety:
•Deployment Flexibility, Customizability and Transparency: Open models offer deployment flexibility locally or in private clouds, can be fine-tuned to meet specific requirements with guardrails for compliance or safety, and provide transparency.
•Auditability and vetting: From an enterprise security perspective, open-source models offer auditability because open weights allow independent security audits, transparency unlike proprietary black box systems, and continuous vetting by security experts worldwide.
•Community scrutiny: Transparency allows researchers to study architecture, evaluate training methods, test safety measures, identify biases and improve explainability, which builds greater trust compared to closed systems.
•More eyes, faster fixes: Zuckerberg posits this proliferation is safer because more eyes on code mean faster identification and resolution of potential issues, diverse applications reduce risk of a single dominant system, and open development fosters responsible use.
•Preventing single point of failure: The open-source community argues security through obscurity is a fallacy, and that open-source is actually safer because it eliminates the single point of failure and prevents a small group of engineers from having unilateral control.
•Regulatory compliance by transparency: The EU AI Act recognizes these benefits by providing lighter regulatory obligations for open source AI models on the assumption that their open nature inherently provides the transparency that regulations seek to enforce.
The paradox is often summarized as: open-sourcing makes EVERYONE safer (transparency, community auditing, distributed safety research) AND everyone more dangerous — both are simultaneously true.
Arguments that open-source is RISKIER
Enterprise surveys and security research point to distinct risks that remain after release:
•Perceived risk is higher: In the McKinsey/Mozilla/Patrick J McGovern Foundation survey of >700 leaders, respondents consider open source AI tools to be riskier than proprietary AI for most types of AI risks.
•Top concerns: The most relevant risks cited include cybersecurity (62 percent of respondents), regulatory compliance (54 percent), and intellectual property (50 percent).
•Cannot be recalled or centrally patched: Unlike closed models controlled through APIs, open-source models cannot be patched centrally. Once released, model weights exist freely across hosting platforms like HuggingFace and GitHub. If a security flaw is discovered, developers have no mechanism to prevent existing deployments from remaining vulnerable and cannot monitor how models are being modified.
•Irrevocable release: A research team demonstrates that an open-weight model's safety refusals can be removed with modest fine-tuning. This is the standard illustration of "open release is irrevocable".
•Guardrails easily stripped: A joint investigation published May 25, 2026 demonstrated that a free tool called Heretic hosted on GitHub can strip all safety protections from open-weight AI models including those from Meta, Google, OpenAI in under ten minutes using only a standard laptop. Adversaries may also directly manipulate weights, or modify or remove parts of a model to create a jailbroken or uncensored variant, applicable to open-source models where adversary gains full access, including fine-tuning, targeted editing, adapters, and removing guardrails.
•Misuse at scale: Adversaries can leverage open models without resources required to design from scratch, and malicious actors may deploy and fine-tune models for scams, disinformation, non-consensual deepfakes, and offensive cyber operations. More specifically, threat actors can fine-tune open models for biological weapons design, crafting spear-phishing, generating synthetic media, or automating complex cyber attacks. The same technical information useful for improving biosecurity safeguards could help malicious actors develop dangerous pathogens.
•Supply chain and maintainer fragility: In 2024, 60% of open-source maintainers are unpaid, lacking resources for rigorous security testing and vulnerability response, which creates profound security risks. Organizations often lack mature governance for open-source estates.
•Distributed accountability gap: The distributed, decentralized nature of open source creates significant accountability gaps — when models are developed by global communities without clear corporate ownership, assigning responsibility becomes extremely difficult. Once released models can be downloaded, modified and deployed worldwide, making centralized governance or recall nearly impossible.
Critics summarize this as the asymmetry of open source: the benefits are diffuse but the risks can be concentrated.
Closed / Proprietary: opposite trade-offs
•Advantages: Proprietary systems offer clearer accountability structures that align with traditional regulatory frameworks — when issues arise there are identifiable corporate entities responsible, enabling regulators to impose penalties or recalls more effectively, and companies must report, submit to safety testing and comply with disclosure. They also offer managed security or built-in safety filters with minimal upfront investment and can swiftly react by restricting access via APIs.
•Disadvantages: Closed systems operate without external visibility into decision-making, training data or algorithmic logic. This black box nature makes it difficult to assess compliance or verify safety claims, creates data privacy risks and operational token costs, vendor lock-in and dependency on opaque providers with limited portability, and prevents independent auditing for bias, backdoors or capability regressions. Closed models cannot be independently audited for bias, backdoors, or capability regressions. Open models can.
So which is safer?
•For systemic / societal resilience: Open is often argued to be safer long-term because transparency, auditability and decentralization prevent concentration of power and enable collective fixing of vulnerabilities.
•For preventing misuse by bad actors: Closed is often argued to be safer short-term because centralized control retains the ability to patch, monitor, revoke access, and enforce guardrails that open weights make unenforceable once downloaded.
•For enterprise risk perception: Surveys show most technology leaders still perceive open source as riskier on cybersecurity, compliance and IP, even as 63% use it and 60% report lower implementation costs.
Most governance literature concludes neither transparency nor control alone ensures safety — proprietary control alone does not guarantee safety and openness alone does not prevent misuse.
Practical consensus is increasingly toward hybrid strategies: choosing open when you need full weight transparency, aggressive cost optimization, or deep domain fine-tuning, and proprietary when speed to market, managed security, or global language coverage outweigh customization needs, while implementing formal governance, supply-chain controls, third-party evaluation, and guardrails to limit behavior.
2.[Open source](https://www.mckinsey.com.br/~/media/mckinsey/business functions/quantumblack/our insights/open source technology in the age of ai/open-source-technology-in-the-age-of-ai_final.pdf)