Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested question among AI researchers, policymakers, and industry figures—there's no settled consensus. Let me search for the current state of this debate to give you a well-grounded answer.There's no single answer here—it genuinely depends on which type of risk you're weighing. The research and policy community is split, and the honest answer is "it depends on the risk category." Here's how the tradeoffs break down:

Where open-source/open-weight AI tends to be riskier

Guardrails can be removed, and this is happening at scale. Researchers have demonstrated that benign fine-tuning, adversarial fine-tuning, and other modifications to a model have been shown to effectively elicit harmful behaviors and capabilities – even from models that are relatively safe off the shelf. This isn't theoretical: Hugging Face currently lists over 6,000 "abliterated" models (with guardrails removed), compared to about 600 in 2024. One NPR-documented tool stripped safety protections from an open-weight model in less than ten minutes using just the compute power of a personal laptop.

Releases are irreversible. Once weights are public, open-weight model releases are irreversible—once released, model weights cannot be recalled, making it harder to mitigate potential harms resulting from the release of a model with dangerous capabilities.

No central oversight or usage monitoring. Open-weight models facilitate research and innovation for actors with fewer resources, but compared to closed-weight models, they are more easily modified to exhibit potentially harmful behaviours, and monitoring their usage is more difficult. There's documented real-world misuse already: modified open-weight diffusion models have become the most common tools used for creating synthetic child sexual abuse material.

Larger attack surface, weaker defenses. None of the content-filtering/training-intervention methods used by closed developers provide reliable assurances for open-weight models, which can be used, tampered with, and distributed without limitations—the attack surface for open-weight models is larger, and the toolkit of reliable techniques for defending them is less well studied.

Closed labs currently invest more in safety research. Safety investment and alignment research is more extensive at frontier closed labs—Anthropic, OpenAI, and Google DeepMind invest heavily in alignment research, red-teaming, safety evaluation, and continuous monitoring, resulting in frontier closed models being subjected to more rigorous safety analysis than most open alternatives.

Where open-source AI arguably makes things safer

Distributed scrutiny catches flaws. As one AI safety researcher put it, "From a risk perspective, I would say open source AI is actually safer in the sense that public eyeballs and scrutiny on these models are a natural enforcement mechanism." More broadly, the more accessible a powerful technology is, the more people can study it and find vulnerabilities, which helps fix problems quickly—though that same freedom makes it possible to remove safeguards and enable unwanted uses.

No single point of failure. Advocates argue "security through obscurity" is a fallacy, contending that by keeping models closed, the industry is ignoring systemic risks that only a global community of researchers can identify and fix.

Avoids dangerous concentration of power. Open models reduce dependence on a handful of companies. Closed-source centralization provides creators steady revenue and prevents competitors from replicating breakthroughs, but creates a precarious dependency—when a business or government integrates closed AI into core operations, it cedes control of its operational intelligence to a third party. Relatedly, closed deployment of some models might significantly hinder open-science or concentrate large amounts of power.

Transparency catches bias/safety issues closed systems hide. The lack of transparency in proprietary systems raises ethical and trust concerns, particularly when deployed at scale in high-stakes environments, since researchers, regulators, and end users lack insight into training data or models.

The nuanced middle ground

Most recent technical/policy analyses (UK AISI, the Singapore Consensus, International AI Safety Report) land on "it's not either/or—it's about managing distinct risk profiles." From a safety perspective, open-weight models pose both benefits and risks: some models might enable acute forms of misuse if deployed openly, others might hinder open science or concentrate power if kept closed, and some pose major risks regardless of deployment type. The International AI Safety Report frames this as a "marginal risk" question: a key policy challenge is accessing the benefits open-weight models provide while managing their distinctive risks, by assessing the extent to which release counterfactually increases societal risk beyond what's already posed by existing models—though this is complex in practice, and small increases in marginal risk over time can add up to substantial increases in overall risk.

There's also a capability-gap dimension that makes this more urgent: major open-weight releases have narrowed the capability gap with leading closed models—DeepSeek, Alibaba's Qwen, and OpenAI's own open-weight models have achieved performance comparable to leading closed models, with the gap now estimated at less than one year.

Bottom line

For misuse by bad actors (bioweapons info, cyberattacks, CSAM, disabling safety training) — closed models are generally considered safer because the developer retains control and can respond to emerging threats.

For systemic/concentration risks (vendor lock-in, unaccountable corporate power over a transformative technology, opacity about training data and biases, single points of failure) — open models are often considered safer.

For security/bug discovery — it's genuinely contested; open models get more eyes on them, but those same eyes include attackers, and security experts warn open models risk easier attacks due to public weights, yet their transparency accelerates fixes, while closed models hide vulnerabilities but rely on vendor trust for patches.

If you have a specific context in mind (e.g., enterprise deployment, national security policy, a particular model), I can tailor the answer further.