The debate reignited late last month when Anthropic published a report warning that GLM-5.3 poses a significant cyberattack risk. GLM-5.3 was released in August by the Chinese company Z.ai and distributed as an open-weight model: anyone can download and modify its weights, the numerical parameters that encode the model’s internal structure. Anthropic’s report is the latest episode in a longer dispute over whether frontier AI models should be released openly or kept behind the doors of well-resourced labs.
Commercial and strategic incentives shape the public argument. Nvidia CEO Jensen Huang has promoted the development of more open models in the United States, in part because users buying hardware to run such models benefits Nvidia. Dario Amodei, CEO of Anthropic, argues for a more cautious path; powerful, cheap models available broadly could undermine companies like his. Beyond commercial stakes, experts disagree on how to weigh safety versus democratization of capability.
What “open” and “closed” mean in practice
Closed models are accessible only through an app, website, or API — examples include the models behind ChatGPT and Claude. Open-weight models make their model weights downloadable so researchers and developers can inspect and modify the model internals. Right now closed models lead capability rankings: the Artificial Analysis LLM leaderboard lists the top eight models as closed, though open models have been catching up over months.
Open models offer practical advantages: they can be run locally, retrained, combined with other models, compressed, and fine-tuned. For academic researchers, access to internal states and chain-of-thought is essential; with closed models researchers can usually only prompt and observe outputs. Businesses may prefer open models because an open-weight model deployed on local hardware can be cheaper to run (a conclusion echoed in a Mozilla report) and can better protect sensitive or proprietary data.
Arguably the most consequential benefit is that open models challenge the concentration of control by frontier labs. Elizabeth Seger, senior policy advisor at the Tony Blair Institute for Global Change, frames access to the underlying infrastructure as a question as consequential as control over internet information. If advanced systems are controlled by a few actors, those actors shape geopolitical and social outcomes; open frontier models could diffuse that concentration.
Risks: why open models may be easier to misuse
Opponents emphasize that open models are easier to exploit. Closed providers such as Anthropic use automated systems to screen queries for hacking, biological threats, and other risks and can revoke access when those safeguards are circumvented. A downloaded model running on private hardware lacks those external filters and revocation mechanisms. Although companies also train their models to refuse harmful requests, researchers have shown that a supposedly safe open model can be retrained to accept harmful behaviors.
Recent incidents highlight that closed models are not safe by default: there have been autonomous hacks, and Anthropic’s report notes extensive hacking operations assisted by Claude. Thus, it is misleading to portray closed models as safe and open ones as uniquely dangerous. Furthermore, some bad actors might still choose closed models because models with comparable capabilities to open alternatives can be easier to access via hosted services; high-performance local use of open models requires expensive compute.
Proponents of openness point to the analogy with open-source software: projects like Linux often benefit from many contributors finding and fixing vulnerabilities. In AI, research communities can test open models more widely for security flaws. Open models can also be repurposed for defensive work: tools usable for hacking can also be used to find and patch vulnerabilities. Anthropic’s Project Glasswing demonstrates how some trusted partners can use capable models for cyber defense. After the OpenAI-agent hack of Hugging Face, the company noted it relied on an open model to analyze the incident because closed models’ security filters blocked relevant queries.
Still, many experts perceive the tail risks as more severe with open models. Elizabeth Seger and others warn that a single low-probability, high-impact incident involving a powerful open hacking model could produce catastrophic damage before defenses could be organized. Decentralization also makes detection and mitigation harder, a core concern for those who emphasize catastrophic risks, including Dario Amodei.
Can we make open models safer while preserving their benefits?
The debate has shifted from an all-or-nothing frame to searching for middle paths. Since standard closed-model defenses like centralized filters are not directly applicable to downloaded models, researchers are exploring alternatives. Approaches include trying to exclude harmful behaviors from training data or developing models resistant to retraining, so safety fine-tuning cannot be easily removed. The theoretical basis for tamper-resistant models is to iteratively reinforce resistance during retraining, but current techniques do not withstand all tampering attacks, according to a recent preprint.
Saad Hossain, an engineer at Deep Breathe and lead author on that paper, expresses optimism because the area is active and many groups are pursuing improved methods. Yet publishing model weights alone may not suffice to decentralize power: greater transparency about training data and wider access to affordable hardware matter too. As David Gray Widder, assistant professor at the University of Texas at Austin School of Information, puts it, openness is a floor — not a ceiling — for equitable technological futures.
Real openness that includes open training data and accessible hardware would also broaden risks: if everyone can run advanced models on widely available hardware, misuse potential rises. Many experts therefore advocate staged release strategies in which models are gradually made more accessible as safety assurances increase.
Conclusion
Open large language models bring real benefits for research, cost, defensive capability, and reducing concentration of power, but they also lower some barriers to misuse and complicate mitigation of catastrophic tail risks. Closed models are not risk-free either. Technical and policy efforts under way — tamper-resistance research, increased transparency about training, hardware access policies, and staged releases — aim to balance these trade-offs. Rather than an absolute ban or blanket openness, most participants now see the problem as requiring nuanced, combined strategies to limit the worst risks while preserving the social and scientific gains of openness.
