Is open-source AI safer or riskier than closed/proprietary AI?

Is open-source AI safer than locked-down models? I'll compare the case for openness versus control across safety and risk.

Neither is automatically safer - open-source and closed AI have different risk profiles, and the trade-off depends on model capability and context.

What "open" vs "closed" means

Why open-source can be safer

1. Transparency and auditability: Proponents argue openness democratizes capabilities, enables independent safety auditing, prevents monopolistic concentration of power, and accelerates research by allowing thousands of researchers to study model behavior rather than a handful at closed labs.

Open-source models with inspectable weights and training data are auditable by default — unlike black-box proprietary APIs.

Meta argued at the Llama 2 release that opening access lets developers and researchers stress test models and fix problems as a community, and Mark Zuckerberg wrote that he expects open source AI to be safer than the alternatives, especially against unintentional harm, because open systems can be widely scrutinized.

2. Faster vulnerability patching: Empirical data from the history of software development proves that open-source systems identify and patch vulnerabilities significantly faster than siloed, proprietary alternatives, distributing oversight across a global community rather than leaving safety in hands of a few executives.

The belief that hiding source code makes a system safer is security through obscurity, and it usually fails.

3. Defense and resilience: Hugging Face CEO Clem Delangue argued that risks may increasingly come from proprietary models behind closed doors, while much of the defence may end up being powered by open-source tools because they are less restricted, more privacy preserving and far more affordable. The open weights letter's signatories argue cybersecurity defenders need models comparable to those attackers use.

Open models also facilitate greater scrutiny for bias, safety concerns, and ethical considerations.

Why open-source can be riskier

1. Irreversible release and stripped safeguards: Safeguards applied at a hosted API cannot be enforced once someone runs the weights on their own hardware, where they can be removed or the model fine-tuned.

Former Meta employee David Evan Harris cites "Llama 2 Uncensored," a Llama 2 derivative with safety features removed, and argues a maker is largely powerless once such a version is released, while jailbreaks of secured systems can be fixed as they are found.

Testing of Z.ai's open-weight GLM-5.2 found it refused none of the offensive cyber or biology tasks and published no safety framework or risk assessment.

In general, proprietary models can implement safety measures that are difficult to maintain in open models where guardrails can be removed by anyone.

2. Misuse for extreme harms: Open models may spread misinformation, reinforce biases and be misused for cyber threats.

A comprehensive Governance of AI paper warns highly capable models have potential for extreme risks — malicious actors might use them to help build biological and chemical weapons, mount cyberattacks against critical infrastructure, disseminate targeted misinformation at scale or enact coercive surveillance.

3. Offense-defense asymmetry: For traditional software, open-sourcing helps defense more than offense, but the offense-defense balance is likely to skew more towards offense for increasingly capable foundation models because open-sourcing allows disabling safeguards, increases attacker knowledge of exploits, and makes it difficult to ensure improvements are implemented downstream.

Anthropic CEO Dario Amodei says open-weights models potentially carry higher misuse risk than closed ones, rejects the claim that broad access necessarily helps defenders more than attackers, and expects biology to have strong attacker-defender asymmetry. He describes this as "the asymmetry of open source: the benefits are diffuse but the risks can be concentrated".

Why closed/proprietary can be safer

1. Centralized safety control: The main advantage of closed models is that the provider handles performance, safety, and reliability with mature safety systems.

Companies developing closed models argue limiting access prevents malicious actors from exploiting AI for disinformation, sophisticated cyberattacks, or autonomous weapons, and controlled environments allow more rigorous safety testing and alignment research before deployment.

Closed models often lead on hardest reasoning tasks and offer managed infrastructure, extensive safety testing, and seamless product integration.

Why closed can be riskier

Where experts agree

Most reviews conclude that neither approach is automatically safer. Open weights enable outside testing and transparency, but they can also be modified and redistributed without control.

The nuanced consensus:

Bottom line: Open-source tends to be safer for transparency, accountability, decentralization, community-driven security fixes, and defending against closed-model misuse; it tends to be riskier for proliferation of unfixable flaws and misuse by bad actors once frontier capabilities are released. Closed tends to be safer for enforcing safeguards and alignment testing in the short term; it tends to be riskier for opacity, vendor lock-in, and concentration of power.