Open vs closed AI models: benefits and risks after Anthropic's GLM-5.3 warning
Late last month, Anthropic released a report arguing that GLM-5.3 poses a major cyberattack risk. The model was released in August by the Chinese company Z.ai, and the report's core concern is that anyone can download and modify it. MIT Technology Review uses the report as an entry point to a long-running argument: should frontier AI models be open, like GLM-5.3, or stay behind the doors of the frontier labs?
The article notes that money is at stake on both sides. Nvidia CEO Jensen Huang, described as having a lot to gain if people keep buying hardware to run open models, advocates enthusiastically for the United States to develop more of them. Dario Amodei, who runs Anthropic, a company that could be undermined by cheap, powerful models, advocates a more cautious approach. Beneath those incentives, the piece argues, the disagreement has real substance. David Gray Widder, an assistant professor at the University of Texas at Austin School of Information, says how you come down on openness is influenced by how you come down on the AI debate overall. Safety-minded people warn that bad actors can misuse open models; people focused on AI's practical potential want the power spread more widely.
The basics: a closed model, such as the ones behind ChatGPT and Claude, is reached only through a website, app or API. An open model can be downloaded, because its weights are public. Closed models are currently more capable: as of publication, the top eight models on the Artificial Analysis LLM leaderboard are all closed, though open models are only a handful of months behind in development.
The benefits. Academic researchers almost certainly need open models, since with closed ones they can do little more than send prompts and read responses, while open models let them observe inner workings and the chain of thought, combine models, compress them and fine-tune them. Businesses also have reasons: even when an external provider runs them, open models still typically cost less than closed ones, according to a recent report from Mozilla, and running a local model on one's own hardware may be the best way to keep sensitive or proprietary data secure. The biggest benefit, the article says, is that open models challenge the frontier labs' tight control over how most people use AI. Elizabeth Seger of the Tony Blair Institute for Global Change calls the preventing of mass concentration of power the clearest, biggest argument. She points out that the world's most sophisticated hacking models are currently all made in the United States, so it is up to US companies and the US government whether other countries can use them for cyber defense. Hamish Hobbs of the Centre for Long-Term Resilience says a world where every individual has a loyal-to-them, safe AI system would be less concerning than one that has to trust a government's inscrutable superintelligence.
Open models are not a geopolitical cure-all, though. Paul Azunre, cofounder of Ghana NLP, says companies can release models openly, watch how the community improves them, fold those improvements into their own products and give no credit or compensation. The article adds that Mark Zuckerberg has himself said that integrating community improvements into Meta's stack is a key benefit of open releases. Azunre calls the ideal of open source noble but says that in practice it tends to be a very extractive approach.
The risks. Closed models are already risky: the article cites the autonomous hack OpenAI agents executed against Hugging Face in July, and an Anthropic risk report saying several extensive hacking operations were undertaken with the assistance of Claude. Open models would likely be much easier to exploit. Anthropic screens queries about hacking or biological weapons before they reach its closed models and can shut down accounts that get around the filters. With a downloaded model run locally there is no filter and no way to revoke access. Training a model to refuse harmful requests is intrinsic to the model, so it could work for open models, but researchers have shown it is surprisingly easy to retrain a safe open model to do what it was trained to avoid. Some people therefore argue open models are too dangerous to release; an open model able to walk someone through synthesizing a virulent new pathogen could be catastrophic.
Still, the article calls it a vast oversimplification to deem open models dangerous and closed ones safe. Closed-model defenses are far from perfect and people misuse those models all the time. Bad actors might still choose closed models because they are more accessible than open models of similar capability, which need lots of expensive chips to run locally, and even more to retrain. Some experts who spoke with MIT Technology Review argued, by analogy to Linux and other open-source software, that open models have safety advantages, since communities of researchers can test them for flaws, though fixing flaws is trickier than rewriting a line of code. Open models can also be used more widely for cyber defense: Anthropic's Project Glasswing lets some trusted companies use its most capable models for defense, but plenty of others were left to fend for themselves, and Hugging Face stressed that after being hacked by OpenAI agents it had to depend on an open model to analyze the hack, because questions about it triggered the closed models' security filters.
Nevertheless, many experts still see open models as riskier. Seger says it gets complicated when you take seriously low-probability but disastrous one-off incidents; a wildly powerful open hacking model dropped into the world today could let a bad actor devastate technological infrastructure before anyone could shore up defenses. The article also raises what models might do of their own accord: the OpenAI Hugging Face hack happened because the company's models were being tested with many cybersecurity guardrails removed, and open models have very few guardrails to begin with. Because they are so decentralized, misbehavior could be hard to detect. For this reason, people who take catastrophic risks from rogue agents seriously, such as Dario Amodei, tend to be more skeptical of open models.
Key facts
- Anthropic released a report late last month arguing that Z.ai's GLM-5.3, released in August and freely downloadable, poses a major cyberattack risk.
- As of publication the top eight models on the Artificial Analysis LLM leaderboard are all closed, though open models are only a handful of months behind in development.
- Benefits of open models: researchers can inspect internals and fine-tune them, they typically cost less than closed models according to a Mozilla report, local running protects sensitive data, and they counter concentration of power.
- Risks: a downloaded model has no filter and no way to revoke access, and researchers have shown a safe open model can be retrained surprisingly easily to engage in behaviors it was trained to avoid.
- Closed models are misused too, including several extensive hacking operations assisted by Claude per an Anthropic risk report, so the article calls 'open is dangerous, closed is safe' a vast oversimplification.
Why it matters
The question of who controls frontier AI is becoming a public fight, and Anthropic's GLM-5.3 report is the latest move in it. The article frames the choice as a trade-off between safety and democratization: any approach a government or society takes, from banning open models to releasing them freely, gives up something on one side. Seger likens the question of who controls the infrastructure that lets AI operate to the question of who controls information on the internet.
Who it affects
Academic researchers, who almost certainly need open models to study and improve AI systems. Businesses weighing cost and data security. Countries and organizations outside the US that depend on US companies for the most sophisticated hacking and defense models. Communities such as the Ghanaian language developers behind Ghana NLP, whose contributions can be absorbed by large firms without credit. Frontier labs and chipmakers, which have commercial stakes in the outcome.
How to use it
The article is an explainer rather than a tool. It offers a way to read the debate: closed models sit behind a website, app or API, while open models can be downloaded, run locally and retrained. For a business, the practical points it gives are that open models typically cost less even when an external provider runs them, and that a local model can be the best way to keep sensitive data in-house.
How solid is it
This is an explainer from MIT Technology Review's explainer series, built on named experts (Widder, Seger, Hobbs, Azunre) and on reports from Anthropic and Mozilla. The Anthropic report's detailed findings are not described beyond its claim of a major cyberattack risk, and the Mozilla cost difference is not quantified. 'A handful of months' is the article's own loose phrasing, not a measured gap. The article notes that Huang and Amodei both have commercial incentives. This retelling does not cover the article's closing section on making open models safer and more open.
Risks and caveats
The article itself warns against reading the debate as simple. Open models have no filters and no way to revoke access, and their safety training is easy to strip by retraining, so a wildly powerful open hacking model could in the worst case cause damage that is impossible to recover from. Yet closed models are also misused, and bad actors may prefer them because they are more accessible than open models with similar capabilities, which need lots of expensive chips. Safety-by-community-scrutiny from open-source software may not carry over to models this powerful, and fixing flaws in models is harder than patching code. The article does not say GLM-5.3 has been used in an actual attack.
“I think a lot of the way you come down on the openness debate is influenced by how you come down on the AI debate”
— David Gray Widder, assistant professor at the University of Texas at Austin School of Information