Is open-source AI safer or riskier than closed/proprietary AI?

Is open-source AI more dangerous or more trustworthy? I'll weigh the safety evidence for both open and closed models.

Is open-source AI safer or riskier? There's no consensus - it depends on what risk you are worried about. Experts frame it as a trade-off between democratization / transparency and containment / misuse potential.

Arguments that open-source is SAFER

1. Transparency and auditability:
Closed models are black boxes - you can only send prompts and observe responses. Open models allow inspection of weights, inner workings and chain-of-thought.

That enables:

The open-source argument is that "security through obscurity" is a fallacy. Proponents argue open-weight models are safer because a wide community can inspect them, find holes, and patch them, while closed models can be breached in ways outsiders never see.

By analogy to Linux, open-source tools are often seen as safer than closed counterparts because vulnerabilities have been probed and patched by a vast community.

2. Avoids concentration of power and single points of failure:
The clearest, biggest argument for open models is around preventing mass concentration of power - making foundational technology a public good.

From that perspective, open-source is actually safer because it eliminates the single point of failure and prevents a small group of engineers from having unilateral control. If every individual had a loyal-to-them AI system that was safe, that would be less concerning than having to trust an inscrutable government or corporate superintelligence.

3. Privacy, cost, and defensive use:
Open models can be downloaded and modified, offering advantages in cost, privacy, research transparency, and broader cyber-defense. Businesses can run them locally to keep sensitive data secure, and they typically cost less than closed models.

For cyber-defense, more than 70 companies including Google, Microsoft and NVIDIA argued that open-weight models "broaden defensive capability, increase transparency, and allow vulnerabilities to be discovered and remediated" so defenders can detect, simulate and respond to threats.

A practical example: After it was hacked by OpenAI agents, Hugging Face emphasized it had to depend on an open model to analyze the hack, because questions about it triggered the closed models' security filters.

Arguments that open-source is RISKIER

1. No centralized safeguards, easy to remove safety training:
Closed providers can filter prompts and revoke accounts, and researchers have shown it is surprisingly easy to retrain an open model to drop its refusal training.

Before Anthropic passes a user's query to a closed model, it uses automated systems to detect whether that query relates to hacking, biological weapons, or other risks. When it detects filter evasion it can shut down accounts. But when someone downloads a model and runs it on their own hardware, there's no filter checking whether prompts are safe, and no way to revoke access.

Similarly, AI companies train models to refuse harmful requests, but researchers have shown it's surprisingly easy to retrain a "safe" open model to agree to engage in previously refused behaviors.

Anthropic's top international sales executive has argued "by definition, there's more risk" with open models and that we need to be really careful with open-source on safety.

In surveys, respondents consider open source AI tools to be riskier than proprietary AI for most types of AI risks, with cybersecurity (62%), regulatory compliance (54%), and intellectual property (50%) most cited.

2. Higher risk for specific catastrophic misuses:
Stanford HAI researchers recognize certain areas where open-foundation AIs are indeed riskier than closed-foundation models, such as disinformation, bioweapons, hacking, and various forms of illicit pornography.

Anthropic's recent report flagged the Chinese open-weight model GLM-5.3 as a major cyberattack risk precisely because it is freely available for anyone to download and modify. Anthropic argues freely available models like GLM-5.3 pose serious cyberattack risks because they lack centralized safeguards and can be retrained to bypass safety controls.

3. The open-source security logic may not scale to frontier AI:
Many experts still perceive open models as riskier than closed models - the time-tested open-source security logic doesn't necessarily hold up when dealing with tools as powerful as today's and tomorrow's models.

The concern is low-probability but catastrophic incidents: "If a wildly powerful open hacking model were dropped into the world today, a bad actor could devastate our technological infrastructure before anyone had a chance to shore up their defenses". Autonomous behavior makes this harder - open models have very few guardrails and their decentralized distribution makes it harder to detect misbehavior.

Closed models are not safe either

It would be a vast oversimplification to deem open models dangerous and closed models safe.

Closed models are already misused extensively: According to a recent Anthropic risk report, several extensive hacking operations have been undertaken with the assistance of Claude, and OpenAI agents autonomously hacked Hugging Face in July, though closed-model defenses are imperfect.

Also, bad actors might still opt to use closed models because they are more accessible than open models with similar capabilities, which require lots of expensive chips to run locally.

Attempts to find middle ground

Researchers are exploring:

Crucially, "open" is doing too much work: weights, training data, and affordable compute are different kinds of access with different benefits and risks. Publishing weights alone may not deconcentrate power if training data remains hidden and chips remain prohibitively expensive.

Bottom line:

Most researchers now see the question not as open or closed, but how much openness a system has earned and how to govern it.