Is open-source AI safer or riskier than closed/proprietary AI?

Is Open-Source AI Safer or Riskier Than Closed AI?

There's no simple answer—this is one of the most contested debates in AI policy, and the evidence cuts both ways depending on what kind of "safety" you mean.

The case that open models are riskier

The most straightforward argument: once weights are public, there's no way to pull them back. Open-weight models can pose risks by facilitating malicious or misguided use that is difficult or impossible for the developer to monitor or mitigate, and once weights are available for public download, there is no way to implement a wholesale rollback or ensure all copies receive safety updates. Critics also note open-weight models lack the same guardrails and central accountability as frontier models, and because they are fundamentally public, anyone can use or misuse them, with real risk that malicious actors can manipulate code to disable safety tools and add harmful capabilities.

Real-world evidence supports this concern. Research has shown that with just a few dozen fine-tuning samples, the safety constraints of a model can be removed, enabling it to execute arbitrary instructions, and DeepSeek-R1 had a 100% jailbreak success rate on the HarmBench dataset. More recently, an evaluation found GLM-5.2 refused none of the offensive cyber or biology tasks it was given, while Claude Opus 4.7 "refused so consistently that SaferAI could not complete CyberGym on it at all."

The case that open models can be safer or at least not clearly worse

Several academic surveys push back hard on the "closed = safe" framing. One key point: closed models still demonstrate weaknesses and are vulnerable to jailbreaking—safeguards are easily bypassed through fine-tuning via accessible services, prompting the model to repeat a word, applying a cypher, or instructing the model in another language—and completely preventing undesirable behaviors might not even be possible. The conclusion many researchers draw: it is not clear that closed models are definitively "safer" than open-source models, and the gaps are expected to narrow as open safeguarding methods improve.

The "access can always be restricted" assumption for closed models is also weaker than it sounds: closed models are often considered more secure because access can be restricted if issues are identified, but closed models can be compromised via hacking, leaks, reverse engineering, or duplication—for example, Mistral's 70B parameter model was leaked by one of their early customers.

There's also a striking "guardrails hurt defenders" case: during an actual incident, when Hugging Face's incident-response team first tried to use leading commercial AI models to analyze more than 17,000 attack events for forensics, those models' own safety guardrails refused to process the exploit code and attack commands, forcing them to turn instead to Zhipu AI's open-weight GLM-5.2 model, run locally, specifically because it would process the attack artifacts.

Open-source advocates frame open models as a kind of societal "immune system": open-source AI can be seen as a "vaccine" for human society—since it may be used maliciously, society is forced to strengthen its defenses, improving overall security, whereas if only closed-source aligned AI exists, people might become relaxed. There's also a power-concentration risk unique to closed models: if all AI systems in the world must rely on the APIs of closed-source AI companies, these companies would concentrate the world's strongest power, leaving humanity's fate in the hands of a very small number of entities, making the system extremely fragile.

Where mainstream synthesis lands

Most serious technical/policy reports (not just advocacy on either side) land on "it's complicated and context-dependent," not a clean winner:

Bottom line

Neither category is categorically "safer." Closed models offer centralized control—the ability to patch, monitor misuse, and revoke access—but that control is undermined by jailbreaks, leaks, and the fact that providers' own safety filters can block legitimate defensive uses. Open models offer irreversibility risk (once released, you can't take back a dangerous capability) but also transparency benefits (auditability, defensive tool access, avoiding single points of failure/power concentration). The actual risk in either case depends heavily on the specific model's capability level, the robustness of fine-tuning-resistant safeguards, and how the surrounding ecosystem (regulation, defensive tooling, detection) keeps pace—which is why most experts now frame this as a risk-management problem for both paradigms rather than a binary "which is safe" question.