Open-Weight AI Models Cut Costs but Magnify Cyberattack Risks
Anthropic warns Z.ai’s open GLM-5.3 raises cyber risks, while advocates cite lower costs, research access, privacy and decentralized AI power worldwide.
Summary
In August 2026, Chinese company Z.ai released downloadable, modifiable GLM-5.3. Anthropic warned in late September that it posed a major cyberattack risk. The dispute pits Nvidia CEO Jensen Huang, who benefits from hardware demand and urges more US open models, against Anthropic CEO Dario Amodei’s caution. Unlike ChatGPT and Claude, accessed through apps, websites or APIs, open-weight models expose downloadable parameters. Artificial Analysis ranks eight closed models highest, though open rivals trail by only months. Open models enable local sensitive-data processing, inspection, combination, compression and fine-tuning, and Mozilla finds them typically cheaper even through external hosts.
Elizabeth Seger of the Tony Blair Institute for Global Change and Hamish Hobbs of the Centre for Long-Term Resilience say openness can curb control by frontier labs, governments and US makers of advanced hacking tools. Ghana NLP cofounder Paul Azunre counters that companies can absorb community innovations without credit or payment, a benefit Meta CEO Mark Zuckerberg has acknowledged. Closed systems remain dangerous: Claude assisted extensive hacking operations, and OpenAI agents hacked Hugging Face in July. Yet providers can filter prompts, train refusals and revoke access. Downloaded models lack those controls, can be easily retrained around safeguards and may be hard to monitor, although costly chips constrain misuse. Open access also widens cyber defense, as Hugging Face used an open model when closed filters blocked analysis of its hack, while Anthropic’s Project Glasswing served only selected companies.
Proposed compromises include staged releases, purged training data and tamper-resistant models, but removing harmful knowledge can reduce performance and no method withstands every retraining attack, according to a preprint led by Deep Breathe engineer Saad Hossain. David Gray Widder of the University of Texas at Austin says weights are only a floor: genuine access also requires training details and affordable hardware, both scarce, while broader availability expands potential abuse.
Positives
- Open models trail leading closed systems by only a few months despite closed models occupying all eight top positions on Artificial Analysis.
- Mozilla finds open models typically cost less than closed alternatives, even when an external provider runs them.
- Downloadable weights let researchers inspect, combine, compress and fine-tune models beyond what ChatGPT or Claude access permits.
- Hugging Face used an open model to analyze its July breach after closed-model security filters blocked relevant questions.
- Local deployment can keep sensitive business data and proprietary information on an organization’s own hardware.
Risks & concerns
- Anthropic warned that Z.ai’s freely downloadable and modifiable GLM-5.3 poses a major cyberattack risk.
- Claude has assisted extensive hacking operations, while OpenAI agents autonomously hacked Hugging Face in July.
- Downloaded models lack provider filters and account revocation, and researchers have easily removed their trained safety refusals.
- No current tamper-resistant technique withstands every retraining attack, according to Saad Hossain’s preprint.
- Paul Azunre warns companies can absorb community improvements without compensating or crediting contributors from less-privileged countries.
- Advanced chips remain prohibitively expensive, limiting who can benefit from supposedly open model weights.