Is open-source AI safer or riskier than closed/proprietary AI?

This is a genuinely contested debate without a settled empirical answer, but I can lay out the strongest arguments on each side.There's no consensus answer here — it depends heavily on what kind of risk you're worried about and your time horizon. Here's the honest breakdown of the debate:

The case that open-source/open-weight AI is riskier

Irreversibility and loss of control over misuse. Once weights are public, there's no way to revoke access or patch problems after the fact. As one safety-focused lab put it, safe open-weight models put AI development and safety work in many hands and make training choices inspectable, but open models also carry real misuse risks, and release is irreversible.

Safety training can be stripped out. This is probably the most concrete, well-documented risk. Open-weight LLMs can be modified by users, creating benefits but also biosecurity risks, and removing an LLM's safety training is feasible and may amplify realistic threat pathways — though enhancing an LLM's biological capabilities is harder. A RAND study found that removing an LLM's safety training is highly feasible.

Uplift for cyberattacks. A 2025 analysis concluded that open-weight models represent a paradigm shift, accelerating innovation but also significantly altering the cybersecurity threat landscape, demonstrably possessing, or rapidly acquiring, capabilities that can automate and scale offensive cyber operations, lowering barriers for a wider range of threat actors.

Policy frameworks struggle to govern them. Current regulatory frameworks, including the EU AI Act, are primarily designed for closed systems and exhibit critical blind spots for models whose weights are publicly distributed, since traditional security mitigations often become ineffective once control over the model artifact is lost.

The case that open-source AI is not clearly riskier — or is actually safer in some ways

Closed models aren't actually that secure either. A widely-cited analysis of the common claims notes: closed models still demonstrate weaknesses and are also vulnerable to jailbreaking techniques; closed model safeguards are easily bypassed through simple manipulations like fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language. Completely preventing models from exhibiting undesirable behaviors might not even be possible. The conclusion: it is not clear that closed models are definitively "safer" than open-source models.

"Access can be revoked" is overstated. Closed models are often considered more secure because access can be restricted or removed should issues be identified — however, closed models can be compromised via hacking, leaks, reverse engineering, or duplication. Even proprietary weights have leaked before.

The actual marginal risk is still unclear/understudied. Stanford's foundation model research center found: surveying seven common misuse vectors described for open foundation models (such as disinformation, biosecurity, cybersecurity, non-consensual intimate imagery, scams), past studies do not clearly assess the marginal risk in most cases. Their framework asks the right question — not "is this model capable of harm" but the extent to which these models increase societal risk by intentional misuse beyond closed foundation models or pre-existing technologies.

Capabilities-wise, current open models aren't at the danger threshold yet. OpenAI's own red-teaming of its open-weight gpt-oss model, including deliberately fine-tuning it to maximize harm potential, found MFT improves performance, especially in biology, but on average the fine-tuned model remains below OpenAI o3 capability levels — the release may contribute net-new biorisk capabilities but does not significantly advance frontier capabilities in biorisk. Similarly cybersecurity capabilities are meaningfully below Preparedness High levels for all models evaluated. That said, they caution if AI capabilities continue to scale at a similar pace, it is possible that even small-scale open-source models will reach Preparedness High capability levels.

Openness enables outside scrutiny that closed systems don't get. Open source tools lower barriers to entry for new developers and researchers, and encourage a culture of sharing, collaboration and learning, helping to build a more inclusive and knowledgeable AI community, while also allowing for outside scrutiny and auditing. Some argue this makes open models a net positive for societal security even if they carry individual misuse risk — functioning like a "vaccine" that forces defenses to strengthen, rather than leaving society complacent behind a false sense of security from closed models alone.

Where there's genuine ongoing uncertainty

Even technical researchers tracking this closely admit: it is unclear how effective different safeguards for open-weight models will ultimately be, and it is also unclear how much counterfactual risk open-weight models will pose compared to closed-weight models.

Bottom line

So the honest answer is: it depends on which risk category you prioritize, and the empirical evidence on "marginal risk" is still thin and contested even among specialists.