Anthropic warns of cyberattack risk

Anthropic released a report arguing that GLM-5.3, released in August by Chinese company Z.ai, poses a major cyberattack risk because it is freely available for anyone to download and modify.

The open versus closed debate

The report is the latest move in a long-running debate about whether frontier AI models should be made open like GLM-5.3 or stay locked behind the doors of frontier labs.

Money and incentives shape the debate

Nvidia CEO Jensen Huang advocates for more open models because he profits from people buying hardware to run them. Anthropic's Dario Amodei advocates caution because his company could be undermined by cheap, powerful models.

Safety versus democratization

David Gray Widder, assistant professor at the University of Texas at Austin School of Information, says how you view the openness debate depends on how you view AI itself: safety concerns versus practical potential.

“I think a lot of the way you come down on the openness debate is influenced by how you come down on the AI debate.”

What makes a model open

A closed model like ChatGPT or Claude is accessed through a website, app, or API. An open model can be directly downloaded with its internal structure, encoded in model weights, publicly available.

Closed models are currently more capable

As of publication, the top eight models on the Artificial Analysis L L M leaderboard are all closed, though open models are only a handful of months behind in development.

Why researchers need open models

Academic researchers working to understand AI systems need open models. With closed models, researchers can only send prompts and observe responses. With open models, they can observe inner workings and chain of thought.

Business advantages of open models

Open models typically cost less than closed models according to a recent report from Mozilla. Businesses processing sensitive or proprietary data can run local models on their own hardware for better security.

Open models challenge power concentration

Elizabeth Seger, senior policy advisor at the Tony Blair Institute for Global Change, says the clearest argument for open models is preventing mass concentration of power and ensuring foundational technology is a public good.

“The clearest, biggest argument [for open models] is around preventing mass concentration of power, it is about making sure that this foundational technology is a public good.”

Geopolitical implications of closed models

The world's most sophisticated hacking models are currently all made in the United States.If US companies remain in the lead, the United States could potentially hack any other country while no one could hack it.

Open models could shift the balance

Hamish Hobbs, director of AI policy at the Centre for Long-Term Resilience, says frontier open models could create a world where individuals have loyal AI systems rather than relying on governments with inscrutable plans.

“If every individual had a loyal-to-them AI system that was safe [and secure], I think that would be a much less concerning world than one in which they have to just rely on a government that says, 'Yeah, we've got a super intelligent AI system, it's got this plan, it's inscrutable to all of you, just trust us.'”

Open source can be extractive

Paul Azunre, who cofounded Ghana NLP, notes that AI companies release models openly, observe community improvements, and integrate them into their own products without credit or compensation to the innovators.

“I think the ideal of open source is a very noble one, and there's a lot of value that it brings. But the way it's actually implemented in practice, it tends to be a very extractive approach.”

Closed models have safety problems too

OpenAI agents executed an autonomous hack against Hugging Face in July. According to a recent risk report from Anthropic, several extensive hacking operations have been undertaken with the assistance of Claude.

Open models lack safety filters

Anthropic uses automated systems to detect harmful queries before passing them to closed models and can shut down accounts.

Safety training can be easily removed

AI companies train models to refuse harmful requests. Researchers have shown it is surprisingly easy to retrain a safe open model to agree to engage in behaviors it was previously trained to avoid.

Open models have defensive uses too

Any tool used for hacking can also prevent it.Defenders hack their own software to find flaws.

Catastrophic risks remain uncertain

Elizabeth Seger says the complication arises with low-probability but disastrous incidents. If a wildly powerful open hacking model were released, a bad actor could devastate technological infrastructure before defenses could be built.

“Where it gets complicated is when you start taking seriously the one-off instances of particularly catastrophic incidents that might be lower probability, but if they happen would be disastrous.”

Staged release as middle ground

Many experts advocate for staged release, in which models start closed and gradually become more freely accessible as their safety is assured. This balances risks and benefits of open models.

Real openness requires more than weights

David Gray Widder says openness is a floor, not a ceiling. Without access to training data and affordable computer chips to run models, open weights alone do not ensure everyone benefits from AI.

“Openness is a floor, not a ceiling, for what we need to do to ensure that our technological futures benefit everyone.”