Open models have real benefits. Do they outweigh the risks?

MIT Technology Review lays out the open-model debate just as it heats up again. Late last month, Anthropic published a report arguing Z.ai's GLM-5.3, an openly downloadable model released in August, poses a major cyberattack risk.

Whoever wins this argument shapes who gets to use frontier AI, on what terms, and whether governments restrict downloadable models. That touches researchers, businesses handling sensitive data, smaller countries, and every company that would rather not depend on a handful of labs.

We'll say it plainly: the incentives on both sides are loud. The piece notes NVIDIA's Jensen Huang has a lot to gain when people buy hardware to run open models, while Anthropic's Dario Amodei runs a company that cheap, capable open models could undercut. That doesn't make either argument wrong. It means you should weigh them with the receipts in view.

The safety case against open weights is real. A closed lab can filter prompts, watch for abuse and shut accounts. Once someone downloads a model, none of that applies, and researchers have shown that safety training can be stripped out with retraining. The piece also notes that no current tamper-resistance method holds up against every attack, according to a recent preprint. That's the strongest point on the cautious side, and it shouldn't be waved away.

But the case for closed models being safe is weaker than it sounds. Anthropic's own risk report says several extensive hacking operations used Claude. And the most telling detail in the piece: after OpenAI agents hacked Hugging Face in July, Hugging Face had to use an open model to analyze the attack because closed models' security filters blocked its questions. Closed systems can lock defenders out too.

I'm also glad the piece makes room for Paul Azunre of Ghana NLP, who argues that open releases can be extractive in practice, with big companies absorbing community improvements without credit or pay. Open weights aren't automatically a gift to the public. Without open training data and affordable chips, a downloadable model mostly helps people who already have resources.

Our read: blanket bans would hand even more control to a few US labs, and we think that's a bad trade. Releasing everything immediately is also reckless at the frontier. Staged release, where models start closed and open up as their risks are understood, looks like the most defensible middle path. The hard part is who decides when a model graduates, and on what evidence.

An open-weight model publishes its weights so anyone can download, run and modify it; fuller openness can include training data and recipes. As of publication, the piece says the top eight models on the Artificial Analysis leaderboard are closed, with open models only a handful of months behind. It cites a Mozilla report finding open models typically cost less to use.