AI models that anyone can download may widen access to the technology, but they also make it harder to control how that technology is used. The debate over open models is therefore not a simple choice between safe and dangerous: closed models can be misused too, while open models bring benefits that are difficult to get from systems accessed only through a company’s service.
What openness makes possible
A closed model is accessed through a website, app or API. With an open model, users can download the model weights: the numbers that encode its internal structure. The term “open-weight” distinguishes these releases from models that also share details such as how they were trained.
Downloadable weights let people run models on their own computers or hardware. People with the expertise and resources can also retrain them, combine several models, make them more efficient or fine-tune them for new uses. Those options matter to researchers, who can inspect a model’s inner workings and its “chain of thought” rather than only sending prompts and observing answers.
Businesses may also choose open models because they typically cost less than closed models, according to a recent report from Mozilla. Running a model locally can help a business keep sensitive data or proprietary information on its own hardware. The trade-off is that using and adapting a model may require expertise and computing resources.
Supporters also see open models as a way to reduce the influence of a handful of frontier labs over a foundational technology. Elizabeth Seger of the Tony Blair Institute for Global Change argues that control over the infrastructure that enables AI is a major question for society. Hamish Hobbs of the Centre for Long-Term Resilience describes a future in which individuals could have AI systems that are loyal to them, rather than relying entirely on powerful systems controlled by institutions.
Access does not guarantee shared power
Making model weights public does not automatically distribute the benefits fairly. Paul Azunre, cofounder of Ghana NLP, says companies can release models, learn from how communities adapt them, and then fold those improvements into their own products without credit or compensation. In that pattern, openness can give companies access to outside expertise while leaving them in control of the resulting products.
There are practical limits as well. Access to weights is of little use to someone without computer chips capable of running the model. The source notes that such chips have become prohibitively expensive as AI companies buy more of them. Wider access to a model’s internals, then, is only one part of making AI usable by more people.
There is also a gap between open weights and fuller transparency. Researchers could learn more about how a model works if they had details about its training, including the data it learned from. Companies are typically reluctant to share that information. For supporters of openness, the question is not only whether weights are published, but also whether people can understand, run and improve the systems.
Why safeguards are harder to maintain
Companies can screen requests sent to their closed models for topics such as hacking or biological weapons, and can shut down accounts when users get around those filters. A downloaded model running on a person’s own hardware does not have the same central checkpoint or a provider that can revoke access.
Models can also be trained to refuse harmful requests. That protection may be built into an open model, but researchers have shown that it can be surprisingly easy to retrain a “safe” open model to accept behavior it was taught to avoid. A model’s initial safeguards, in other words, may not remain in place after users modify it.
Those risks do not make closed services safe by default. The source describes misuse of closed models, including hacking operations assisted by Claude, and notes that company defenses are imperfect. Open models may be easier to adapt for harmful uses, but they can also require expensive chips to run or retrain. Some bad actors may therefore choose closed models because they are more accessible.
Open models could also help defenders. Researchers and communities can examine them for flaws, and organizations can use models to probe their own software for weaknesses. The source gives the example of Hugging Face relying on an open model to analyze a hack after questions about it triggered closed models’ security filters. That wider availability could help organizations that cannot use restricted tools.
Finding a workable middle ground
Some researchers are exploring ways to reduce the risks without abandoning open releases. One approach would train models without exposing them to data that teaches harmful behavior. But removing every reference to misbehavior while preserving model performance remains a challenge.
Another approach aims to make safety training harder to remove through retraining. These “tamper-resistant” models are designed to resist attempts to make them unsafe, but a recent preprint says current approaches do not hold up against all tampering attacks. Saad Hossain, the paper’s lead author, says the area is active and researchers are working on better methods.
Any policy choice involves trade-offs. Restricting open models could limit misuse, but it could also concentrate access and control. Releasing them can support research, local use and broader participation, while making safeguards harder to enforce. The source argues that neither open weights alone nor a simple division between open and closed resolves the deeper questions of access, safety and who controls AI infrastructure.