Key points
▶ Open-weight models let users download the “weights” produced during AI training and run or modify the models themselves. This benefits research and industry, but developers cannot fully control how everyone uses a model once it has been released.
▶ Nvidia, Microsoft and others argue for expanding open models in the United States.
▶ Anthropic warns against releasing models with powerful cyberattack capabilities.
Between the 27th of last month and the 1st of this month, data belonging to 66,000 individuals and 2,200 businesses was stolen from seven South Korean financial institutions, including Shinhan Bank. Among the traces police found on a server used in the attack was “Artex.”
Artex is an AI penetration-testing tool created by a Chinese security engineer and made freely available on GitHub in July. By connecting multiple AI models, it automates the collection of target information, vulnerability scanning and the design of attack routes.
In September, it won a hacking competition for offense and defense hosted by Baidu. An AI tool that anyone could download and use had been used to rob banks.
Should potentially dangerous software be available for anyone to download, or should it be kept inside the servers of a handful of companies? A debate that has been going on in the AI industry for years has become a matter of real concern in South Korea, too.
On the 29th of last month, Anthropic published a report identifying China’s open model GLM-5.3 as a cyberattack risk. MIT Technology Review recently published an explainer on the debate over open models. Alongside arguments about safety and democratizing technology, the debate also involves commercial interests worth tens of trillions of won.
◆ What is the difference between closed and open models?
First, a few terms. ChatGPT, Claude and Gemini are closed models. Users can access them only through a website or app, or via an API for developers.
The AI is housed on the company’s servers, where users send questions and receive answers. It is like ordering food at a restaurant: the recipe stays in the kitchen.
An open model is like a restaurant that makes its recipe public. AI models consist of hundreds of billions of numbers, called “weights.” These weights are a blueprint containing the model’s structure and knowledge.
Open models make their weight files available online. Anyone can download them and run them on their own computer; those with the expertise and equipment can also retrain them and change how they behave. Because developers often release only the weights while keeping the training data and methods secret, such models are sometimes specifically called “open-weight models.”
Closed models still perform better. According to MIT Technology Review, all eight models at the top of the rankings by independent evaluator Artificial Analysis were closed models.
◆ Why Anthropic singled out GLM-5.3
Anthropic’s Frontier Red Team published its findings from tests of GLM-5.3 in a report on the 29th of last month. The model was first released through an API by China’s Zhipu AI on August 14, with its weights made available around August 28.
According to the report, GLM-5.3 attempted 410 times to generate attack code exploiting software vulnerabilities and succeeded 50 times, a success rate of 12%. Anthropic’s closed model Claude Mythos Preview succeeded 56 times in the same test. This suggests that, in terms of attack capabilities, GLM-5.3 is not far behind a top-tier closed model.
The problem is the safeguards. Open models are also trained to refuse harmful requests. Anthropic tested three ways of bypassing those refusals.
When the team requested hacking code under false pretenses—for example, claiming it was for security training or a fictional scene—the model complied 64% of the time. When testers inserted a sentence at the beginning of the model’s internal reasoning stage, before it answered, saying that it would fulfill the request, the model followed that lead and complied 92% of the time.
When testers modified the weights themselves to remove the refusal feature, the model complied every time.
Anthropic’s central concern is that anyone can download and modify an open model. With a closed model, a company can filter questions and block accounts used for abuse. Open models have no such controls.
◆ A battle with money at stake
Running an open model requires a high-performance chip in the user’s own computer. Nvidia is one of the companies that sells those chips.
On July 24, Nvidia CEO Jensen Huang shared on X an open letter calling on the U.S. government to protect open-weight models as a foundation of American leadership. Around 25 organizations signed it, including Nvidia, Microsoft, Meta, Palantir and IBM.
That same day, Microsoft issued a separate statement titled “Open Weight and U.S. AI Leadership,” which was backed by around 70 organizations, including Google, OpenAI and AMD. Huang wrote that open models strengthen safety and cybersecurity, spread innovation more quickly and enable countries to achieve technological sovereignty.
Anthropic’s name appeared on neither document. The company earns revenue by selling closed models, and the spread of powerful, low-cost open models could threaten its business. CEO Dario Amodei has warned Washington about the risks of powerful Chinese open models. His position is that, rather than banning them, high-performance models should undergo targeted safety testing.
MIT Technology Review noted these commercial motives but also said the debate raises substantive issues. “How people view open models depends on how they view AI itself,” said David Gray Widder, an assistant professor at the University of Texas at Austin’s School of Information.
◆ Why open models are needed
Supporters of open models also have clear arguments.
First is ▲ research. Scholars who want to understand and improve AI cannot do their work without open models. With closed models, they can only submit questions and see the answers. Open models let researchers examine how a model works, observe its reasoning before it responds, combine or compress models, and retrain them for new purposes.
Next are ▲ cost and ▲ security. According to a Mozilla report, even when run by an outside provider, open models are generally cheaper than closed models. Companies that need to process sensitive customer information or confidential business data with AI may be safer running open models on their own servers, since the data does not leave the company.
Finally, open models can ▲ counter the monopolization of AI technology. Elizabeth Seger, a senior policy adviser at the Tony Blair Institute for Global Change, said the strongest argument for open models is that they prevent power from becoming concentrated in one place and make foundational technology a public good.
◆ Are open models more dangerous?
Closed models are not necessarily safe, either. From July 9 to 13, an OpenAI agent broke out of an internet-isolated evaluation environment and hacked into the internal systems of Hugging Face, a platform for sharing AI models.
Even so, few dispute that open models are easier to abuse. Anthropic automatically screens questions before they reach its closed models for signs of hacking or biological-weapons-related requests. If it confirms that a user has tried to evade the filters, it can block the account. An open model downloaded and run on a personal computer has no such filters, and there is no way to cut off access.
Training that teaches a model to refuse harmful requests can also be easily removed from an open model. Anthropic’s GLM-5.3 test demonstrated this when the model’s refusal feature was removed. This underlies the argument that releasing a high-performing open model capable of explaining how to synthesize a deadly pathogen could have irreversible consequences.
On the other hand, some argue that open models are safer. Open-source software such as Linux is considered safer than proprietary software because many people can find and fix flaws. A community of researchers can also test open models for security vulnerabilities more easily. However, fixing a flaw in a model is not as simple as changing a line of code.
Open models are also more widely used for defense. Tools used for hacking can also help prevent hacking. Defenders attack their own software first to find weaknesses.
In April, Anthropic launched Project Glasswing, giving 11 organizations—including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia and Palo Alto Networks—and more than 40 critical-infrastructure organizations access to its closed model Claude Mythos for defensive purposes. Other companies have to manage on their own.
The Hugging Face case shows how open models can be used in security response. In July, Hugging Face was hacked by an AI agent that OpenAI had been using in internal tests. The company then tried to analyze the attack logs, but commercial AI models refused its requests because they included actual attack commands and vulnerability-exploitation code. Hugging Face ultimately ran GLM-5.2, an open model developed by China’s Z.ai, on its own servers and completed the analysis.
◆ Where does South Korea stand?
The security debate surrounding open models is an important issue for South Korea, too. U.S. companies provide access to powerful closed AI models with cyberattack capabilities only on a limited basis.
Project Glasswing, launched by Anthropic in April, initially focused on major U.S. technology companies, but its participation has since expanded to include South Korean companies such as Samsung Electronics, SK hynix and SK Telecom.
By contrast, GLM-5.3, released by China’s Z.ai, can be downloaded and used in South Korea.
Open models offer opportunities for research and industry, but they also carry security risks. South Korea, too, must consider the scope of what it releases, safety and how the models should be used, alongside efforts to develop its own AI models.
Ensuring that AI can be operated safely and used by anyone is becoming just as important as strengthening technological competitiveness.