Open models have long been sold as a public good in artificial intelligence: tools that can be inspected, modified, and deployed by researchers, startups, and governments without relying on a single corporate gatekeeper. That promise has helped fuel rapid innovation across the frontier AI sector, especially as companies and open-source communities race to build systems that are cheaper, more adaptable, and easier to audit than closed proprietary products. But the latest alarm from Anthropic has brought a harder question into focus: when does openness become a liability?
Late last month, Anthropic released a report arguing that the model GLM-5.3 poses a major cyberattack risk. The company's core concern is not simply that the model can answer technical questions, but that it may lower the barrier to sophisticated offensive cyber activity. In practical terms, that means a capable system could help users write malicious code, automate reconnaissance, or refine attack chains faster than a human operator could manage alone. For defenders, that is a serious escalation. For advocates of open models, it is a warning that the field may be moving faster than its safety norms.
The openness dilemma
The central tension is straightforward. Open models can democratize access to advanced AI, enabling universities, independent developers, and smaller firms to experiment without the cost or restrictions attached to closed systems. They can also improve transparency, since researchers can inspect architectures, evaluate behavior, and identify weaknesses that would otherwise remain hidden behind a vendor interface. In a field where trust is often built on limited visibility, that matters.
Yet the same qualities that make open models attractive also make them difficult to contain. Once weights, code, or fine-tuning pathways are broadly available, a model can be adapted, redistributed, and repurposed in ways its original creators may not control. That is especially consequential in cybersecurity, where even incremental gains in automation can amplify phishing, malware development, vulnerability discovery, and social engineering. The risk is not hypothetical: the more capable the model, the more useful it can become to both legitimate defenders and malicious operators.
Anthropic's warning lands in a broader policy vacuum. Regulators in the United States, Europe, and Asia have spent much of the past two years focused on frontier model governance, but the open-model ecosystem has often moved faster than formal oversight. Closed systems can be monitored through access controls and usage policies. Open systems are harder to police because distribution itself is the point. That leaves governments with an uncomfortable choice between encouraging innovation and trying to constrain tools that are already widely circulating.
Security, access, and scale
The cyber risk debate is also a scale problem. A model that is merely capable in the hands of a specialist can become far more dangerous when replicated across thousands of users, each with different intentions and varying technical skill. Open models reduce the friction of experimentation, which is a strength for legitimate development and a weakness when the same tools are used to automate abuse. In that sense, the issue is not whether a model can be misused; nearly any powerful technology can. The issue is how quickly misuse can spread once the technology is broadly available.
That is why the current discussion is shifting from abstract concerns about AI safety to more concrete questions about deployment controls, model evaluations, and release thresholds. Some researchers argue that open models should remain available, but only after rigorous testing for cyber, biosecurity, and other dual-use risks. Others say that once a model reaches a certain capability level, unrestricted release may be irresponsible regardless of the benefits. The disagreement is not just technical. It reflects competing views about who should bear the burden of risk in a rapidly evolving market.
For now, the industry appears to be converging on a difficult middle ground: preserve openness where possible, but add more scrutiny around the most capable systems. That could mean staged releases, stronger red-teaming, tighter documentation of known failure modes, and more explicit limits on high-risk fine-tuning. None of those measures eliminate the danger. But they may help narrow the gap between the pace of innovation and the pace of governance.
The larger lesson is that open models are neither an unqualified public benefit nor an obvious threat. They are a powerful distribution mechanism for intelligence, and like any such mechanism, they magnify both value and harm. Anthropic's report has not settled the debate. It has made it harder to ignore. As frontier AI becomes more capable, the question is no longer whether openness matters. It is whether the industry can design openness that is resilient enough to survive the next wave of misuse.