Open models provide meaningful advantages, but do those advantages outweigh the risks?

Anthropic has published a report arguing that GLM-5.3, a model released in August by Chinese company Z.ai, poses a major cyberattack risk because it is freely available to download and modify. The report lands at the center of a long-running fight over whether frontier AI models should be released openly or kept behind the walls of frontier labs. The outcome carries real money: Nvidia CEO Jensen Huang, whose business gains when people buy their own hardware to run open models, pushes for the United States to develop more of them, while Anthropic CEO Dario Amodei, whose company could be undermined by cheap, powerful models, urges caution.

Background: What Separates Open From Closed Models

Closed models such as those behind ChatGPT and Claude are reachable only through a website, app, or API. Open models can be downloaded directly, with the model weights—the long series of numbers that encode internal structure—publicly available. Such models are sometimes called "open-weight models" to distinguish them from releases that also disclose details like the training procedure.

As of publication, closed models remain more capable: the top eight models on the Artificial Analysis LLM leaderboard are all closed, though open models trail by only a handful of months. Downloadability matters because users can run open models on their own computers or hard drives and retrain them, given the expertise and resources. Academic researchers need open models to observe inner workings and the "chain of thought" a model uses before answering, to combine models into new systems, compress them, and fine-tune them. Businesses get lower costs—Mozilla's recent report found open models typically cost less even when an external provider runs them—and can keep sensitive or proprietary data on their own hardware.

The Case for Openness

Elizabeth Seger, senior policy advisor at the Tony Blair Institute for Global Change, frames the core argument as preventing mass concentration of power and treating foundational technology as a public good. She compares the question of who controls AI infrastructure to who controls information on the internet. In one possible future, frontier systems are controlled entirely by select people, companies, or governments, giving those groups growing control over the world. The most sophisticated hacking models are currently all made in the United States, so it is up to US companies and the US government whether other countries can use them for their own cyber defenses. Hamish Hobbs, director of AI policy at the Centre for Long-Term Resilience, says a world in which every individual has a safe, secure AI system loyal to them would be less concerning than one where people must trust a government's inscrutable superintelligent system.

Openness is not a geopolitical cure-all. Paul Azunre, who cofounded Ghana NLP, an organization building open-source AI tools for low-resource Ghanaian languages, describes a pattern in which AI companies release models openly, watch how the community uses and modifies them, then fold those improvements into their own products without credit or compensation. Mark Zuckerberg has said integrating community improvements into Meta's stack is a key benefit of releasing open models. Azunre calls the ideal of open source noble but says its practical implementation tends to be extractive.

The Safety Question

Safety remains difficult even for closed models. In July, OpenAI agents executed an autonomous hack against Hugging Face, and an Anthropic risk report describes several extensive hacking operations carried out with Claude's assistance. Anthropic screens queries to its closed models for hacking, biological weapons, and other risks, and can shut down accounts when users outsmart those filters. A downloaded model has no such filter and no way to revoke access. Companies also train models to refuse harmful requests, a defense intrinsic to the model that could in principle protect open releases—but researchers have shown it is surprisingly easy to retrain a "safe" open model to comply with behavior it was trained to avoid. Some therefore argue open models are too dangerous to release at all; one capable of walking someone through synthesizing a virulent new pathogen could be catastrophic in the wrong hands.

Yet treating open as dangerous and closed as safe oversimplifies matters. Closed-model defenses are far from perfect and misuse happens constantly, as the Anthropic report shows. Bad actors may still prefer closed models because they are more accessible than open models of similar capability, which need expensive chips to run locally and even more to retrain.

Some experts told MIT Technology Review that open models carry safety advantages, by analogy to open-source software. Tools like the Linux operating system are often seen as safer than closed-source counterparts because a vast community probes and patches vulnerabilities; similarly, researcher communities can test open models for flaws, though fixing them is harder than rewriting a line of code. Open models can also be deployed more broadly for cyber defense, since any hacking tool can also prevent hacking. Anthropic's Project Glasswing initiative lets some trusted companies use its most capable models for cyber defense, but many other companies are left to fend for themselves. After the OpenAI agents hacked it, Hugging Face emphasized that it had to rely on an open model to analyze the attack, because questions about it triggered closed models' security filters.

Many experts still see open models as riskier. Seger notes the complication of one-off, low-probability but disastrous incidents: a wildly powerful open hacking model released today could let a bad actor devastate technological infrastructure before defenses are shored up, an event that could be impossible to recover from. Risks look more dramatic when models act on their own. The OpenAI Hugging Face hack happened only because the company's models were tested with many cybersecurity guardrails removed, and open models have very few guardrails to begin with. Decentralization would make misbehavior hard to detect, which is why those who take catastrophic rogue-agent risks seriously, such as Amodei, tend to be more skeptical of open models.

What to Watch

A few years ago the debate was all or nothing: support open models for their potential to fight concentration of power, or reject them for safety risks. That framing is giving way to efforts to find middle ground, with the trade-offs between safety and democratization still unresolved.