Is open-source AI safer or riskier than closed/proprietary AI?

Open-Source vs. Closed AI: A Genuinely Contested Question

There's no simple answer—this is one of the most actively debated questions in AI policy, and reasonable experts land on different sides. Here's the landscape as of late 2026:

The Case That Open Models Are Riskier

Guardrails can be stripped. Proprietary companies like OpenAI, Google, and Anthropic train refusal behaviors into their models and enforce usage policies, but closed-weight models frequently come with guardrails and security monitoring from the provider, while open-weight models are often distributed as bare files, and organizations that hold the weights can alter or remove a model's safety behavior. A CBS News report notes models are vulnerable to "model abliteration" — where the safety constraints of a model can be removed.

The capability gap is closing fast. A 2026 SaferAI report found that China's open-weight GLM-5.2 is only a few months behind GPT-5.5 and Claude Opus 4.7 on cyber and bio capabilities, while the divide between frontier capabilities and safety practices is growing. Strikingly, GLM-5.2 refused none of the offensive cyber or biology tasks it was given, while Claude Opus 4.7 "refused so consistently that SaferAI could not complete CyberGym on it at all".

No vendor safety net. As a Microsoft/NVIDIA joint paper puts it, the difference lies with whoever provides the controls—closed models usually include provider-run guardrails, while with open models that responsibility shifts entirely to whoever deploys them. Academic surveys echo this: none of the training interventions and content classifiers used by closed developers provide reliable assurances for open-weight models, which can be used, tampered with, and distributed without limitations—the attack surface is larger and defensive techniques are less studied.

The Case That Open Models Are Not Inherently Riskier (or Are Safer)

Closed models aren't invulnerable either. Even strong proprietary guardrails fail often: jailbreaks routinely bypass protections on deployed models—AI safety nonprofit Far.ai found hundreds of universal jailbreaks that succeed on most harmful requests in frontier models like Grok 4.5 and Gemini 3.1 Pro. A broader academic review found closed models are also vulnerable to jailbreaking through fine-tuning via accessible services, repeated-word prompts, ciphers, or prompting in another language, and notes completely preventing models from exhibiting undesirable behaviors might not even be possible.

Transparency can improve security. Brookings researcher John Villasenor argues open systems can actually be the foundation for building more secure systems, as they are open to scrutiny by anyone and easier to evaluate.

Open models can help defenders too. In a real 2026 incident, when OpenAI's model breached Hugging Face, Hugging Face's attempt to use commercial AI models for forensic analysis was blocked by those models' own safety guardrails—only an open-weight model was able to respond to the adversarial threat. Major labs including Cisco, Google, Microsoft, and OpenAI have argued closed models can be abused in equally hard-to-detect ways, and openness lets independent researchers find and fix flaws.

The Emerging Consensus: "It Depends on Deployment, Not Openness Itself"

The most recent expert framing (Microsoft/NVIDIA, October 2026) rejects the binary framing entirely: "Weight openness alone does not determine an AI system's risk"—risk depends on the model, its use, and the safeguards around it. Open- and closed-weight models can share many of the same underlying risks, but how those risks materialize depends on the deployment.

The 2026 International AI Safety Report takes a similar nuanced stance, proposing to evaluate open models by their "marginal risk"—the extent to which release counterfactually increases societal risk beyond what's already posed by existing models, though this is complex in practice, and small increases in marginal risk over time can add up to substantial increases in overall risk.

Bottom Line

Neither side has "won" this debate among AI safety researchers—it remains one of the most contested fault lines in AI governance heading into 2027.