Open AI models: do the benefits outweigh the risks? A more complex debate than it seems

The MIT Technology Review article, written by Grace Huckins and published on October 13, 2026, examines the debate over whether frontier AI models should be open or remain closed under the control of the major labs. The piece starts from a recent development: at the end of the previous month, Anthropic published a report arguing that GLM-5.3, the model released in August by Chinese company Z.ai, poses a significant risk of cyberattacks because anyone can download and modify it.

The author stresses that commercial interests lie behind the discussion. Nvidia CEO Jensen Huang argues that the United States should develop more open models, while Anthropic's Dario Amodei calls for greater caution; the article notes that his company could be hurt by cheap, powerful models. Even so, the piece argues there is a deeper disagreement. According to David Gray Widder of the University of Texas at Austin, one's stance on openness depends on how one frames the AI debate in general: those who prioritize safety fear misuse by malicious actors, while those who highlight AI's practical potential want that power not to end up in the hands of a few companies.

What open models are and what advantages they offer. A closed model, like those powering ChatGPT or Claude, is accessible only via the web, an app or an API. An open model can be downloaded because its weights (the long series of numbers encoding its internal structure) are public. That is why they are called "open-weight," to distinguish them from those for which even more information is released, such as the training procedure. Today closed models are more capable: according to the article, the top eight spots on Artificial Analysis's LLM leaderboard are closed, although open models are only a few months behind.

The advantages are several. Academic researchers can examine the inner workings and "chain of thought" of open models, combine them, compress them and fine-tune them, something impossible with closed models, with which they can do little more than send prompts and observe responses. Companies, for their part, tend to pay less for open models, according to a recent Mozilla report, and can run them on their own hardware to protect sensitive data or proprietary information.

The most important argument, according to the piece, is avoiding the concentration of power. Elizabeth Seger of the Tony Blair Institute for Global Change argues that the point is for this foundational technology to be a public good, and compares the question of who controls AI infrastructure with that of who controls information on the internet. The article illustrates the risk with the example of the most sophisticated hacking models, all of which are currently developed in the United States: in such a scenario, the U.S. could hack any country without anyone being able to do the same to it. Hamish Hobbs of the Centre for Long-Term Resilience believes a world in which every person had a loyal, safe AI would be less worrying than one in which people had to trust a government with an inscrutable superintelligence.

Open models, however, are no geopolitical panacea. Paul Azunre, co-founder of Ghana NLP, warns of an extractive pattern: companies release models, watch how the community uses and improves them, and integrate those improvements into their products without credit or compensation. The article recalls that Mark Zuckerberg himself has acknowledged that being able to incorporate community improvements into Meta's infrastructure is a key benefit of opening models.

Are open models riskier? The piece acknowledges that security is a thorny problem for closed models too. It mentions the autonomous hack that OpenAI agents carried out against Hugging Face in July and an Anthropic risk report stating that several large-scale hacking operations have been conducted with Claude's help. Even so, open models would likely be much easier to exploit: closed models have automated systems that detect queries about hacking or bioweapons, and accounts can be shut down, but a downloaded model has no filters and no way to revoke access. The intrinsic defense, training the model to refuse harmful requests, is fragile, as research shows it is surprisingly easy to retrain a "safe" open model to do what it previously refused.

Still, the article warns against the oversimplification that open is dangerous and closed is safe. The defenses of closed models are imperfect, and malicious actors might prefer them because they are more accessible: comparable open models require many expensive chips to run locally, and even more to retrain. Some experts argue, by analogy with open-source software such as Linux, that open models have security advantages, since a broad community can scrutinize them, although fixing flaws in a model is harder than rewriting a line of code. They can also be used more widely for cyberdefense. Anthropic has shown with its Project Glasswing initiative how some trusted companies use its most capable models for defense, but many others are left out. After the OpenAI hack, Hugging Face noted that it had to rely on an open model to analyze the attack, because questions about it triggered the safety filters of closed models.

Despite this, many experts consider open models riskier. Seger notes that the security logic of open source gets complicated in the face of low-probability but catastrophic incidents: if an extraordinarily powerful open hacking model appeared today, a malicious actor could devastate technology infrastructure before anyone could shore up their defenses, something from which recovery would be impossible. The autonomous behavior of models also weighs in: the Hugging Face hack happened because OpenAI's models were being tested with many of their cybersecurity safeguards removed, and open models have few to begin with. Their decentralized nature would make misbehavior harder to detect, which is why those who take the catastrophic risks of rogue agents seriously, such as Amodei, tend to be more skeptical.

Can they be made both safer and more open? A few years ago the debate was all or nothing; today a middle ground is being sought. One line of work is training models without data that teaches them undesirable behaviors (for example, an open model that never learns about hacking), although filtering data without hurting performance remains a challenge. Another is creating "tamper-resistant" models whose safety training cannot easily be removed through retraining. The theory makes sense, but according to a recent preprint no current approach withstands every attack. Saad Hossain, an engineer at Deep Breathe and the lead author, is optimistic because it is a very active area of research.

The benefits are also less clear than they seem. Releasing the weights is not enough to deconcentrate power, according to Hobbs. For the article, open weights are a minimum, and researchers would learn much more from training data and details, which companies are usually reluctant to disclose. Moreover, without chips capable of running sophisticated models, the weights are useless, and those chips have become prohibitively expensive. Widder sums it up: openness is a floor, not a ceiling. Real openness (accessible weights, data and hardware) could increase the risks, since anyone could be a hacker. Many experts advocate a staged release: models start out closed and are gradually opened as their safety is ensured. Working out how to do this requires balancing risks and benefits, but if open models are a necessary element of a positive AI future, the effort would be worth it.