International AI Safety Report 2026

Key information

• The level of access that AI companies provide to the ‘weights’ of their models affects the risks that these models pose. Weights are the mathematical parameters that allow AI models to process inputs and generate outputs. For any given model, companies can choose to keep the weights completely private, give some users some limited access, or allow anyone to download them in full. Models whose weights are publicly available are called ‘open-weight models’.

• Open-weight models facilitate research and innovation, but their safeguards are more easily removed. Around the world, various actors – especially those with fewer resources – can use open-weight models for research and commercial purposes. However, compared to closed-weight models, open-weight models are more easily modified to exhibit potentially harmful behaviours, and monitoring their usage is more difficult.

• Open-weight model releases are irreversible. Once released, model weights cannot be recalled. This makes it harder to mitigate potential harms resulting from the release of a model with dangerous capabilities.

• Since the publication of the last Report (January 2025), major open-weight releases have narrowed the capability gap with leading closed models. Chinese developers DeepSeek and Alibaba released their R1 and Qwen models, respectively, which achieved performance comparable to leading closed models, while OpenAI released its first open-weight models since 2019. The capabilities of leading closed models are now estimated to be less than one year ahead of leading open-weight models on prominent AI benchmarks.

• A key policy challenge is accessing the benefits open-weight models provide while managing their distinctive risks. One approach is to assess open-weight models in terms of their ‘marginal risk’: the extent to which their release counterfactually increases societal risk beyond that already posed by existing models or other technologies. However, this is complex in practice. Small increases in marginal risk over time can also add up to substantial increases in overall risk.

Open-weight models, whose parameters are publicly available for download, have distinct implications for many of the challenges discussed in the preceding sections. An AI model’s ‘weights’ contain the crucial information that allows it to generate useful responses for users. Once released, these weights cannot be recalled: anyone can download, study, modify, share, and use them on their own computers or cloud accounts. When weights are openly available, others can more easily build on and modify the model, serving diverse needs and driving innovation. However, by the same mechanism, users with malicious intent can also more easily remove safeguards and modify open-weight models for harmful use cases. This has raised the question of whether some open-weight models should be held to special requirements (e.g. more rigorous testing before release) or, conversely, be given special exemptions (e.g. from regulatory reporting requirements).

Background on open-weight models

Open-weight models can be, but are not necessarily, ‘open source’ models

While often referred to as ‘open source’, most publicly released models are more accurately described as ‘open-weight’. This is because, while developers provide the model weights, they do not release the associated training code or datasets. Furthermore, open source software is usually characterised as having permissible licences that place minimal requirements on downstream actors that use or modify the software. For example, Meta’s Llama models have restrictive licence conditions and only include inference code, not training code, and so are typically not considered to be open source. Model release options exist on a spectrum from fully closed to fully open source, with different risk-benefit trade-offs at each point. Table 3.9 describes these options.

Benefits and risks

Open-weight models can be more easily customised and evaluated

Open-weight models offer significant benefits for research, innovation, and access. As discussed in §1.1. What is general-purpose AI?, training general-purpose AI models is extremely expensive – leading models cost hundreds of millions of dollars to develop. Openly releasing model weights allows less well-resourced actors to replicate, study, and build upon existing systems. Without such access, communities in low-resource regions risk exclusion from AI’s benefits, making open weights critical for enabling global majority participation in AI development. Downstream developers can fine-tune models for diverse applications, for example, adapting them for underresourced minority languages or optimising performance for specific tasks such as legal drafting or medical note-taking. In this way, open-weight models can allow more people and communities to use and benefit from AI than would otherwise be possible. In the case of models that are not capable enough to be dangerous, these benefits may outweigh the additional risk of releasing weights openly, though this depends on relevant decision-makers’ risk tolerance.

Open-weight release also broadens the pool of developers and researchers able to study the model, evaluate its capabilities, test for vulnerabilities, and iterate on improvements. This makes it more likely that beneficial applications and harmful flaws are identified, though this is not guaranteed. Users can also run open-weight models on their own devices, allowing them to maintain control over sensitive data and avoid sending it to third-party servers.

There are additional benefits when developers share information such as training data, code, evaluation tools, and documentation as well as model weights. With more information, downstream developers and other researchers can better understand open-weight models and adapt them to new applications.

Open-weight models’ safeguards are easier to remove, enabling potential malicious use

Open-weight models also pose additional risks because their safeguards are easier to remove. While both open-weight and closed models can have safeguards to refuse harmful user requests, these safeguards are much easier to remove for open-weight models. Malicious actors can fine-tune a model to optimise its performance for harmful applications, remove parts of the code designed to prevent harmful uses, or undo previous safety fine-tuning. As a result, open model weights can exacerbate the misuse risks discussed in §2.1. Risks from malicious use by allowing more actors to leverage and augment existing capabilities for malicious purposes without oversight. Although many users will not have the skill or incentive to remove safeguards on open-weight models, highly motivated malicious actors are a concern. In addition, malicious actors may also be able to use open-weight models to identify vulnerabilities in similar closed models. Such flaws are harder to find by running closed models alone, due to the greater control and monitoring measures that closed-model providers are able to implement.

Sharing model weights is irreversible

Once model weights are available for public download, there is no way to implement a wholesale rollback of all existing copies. Internet hosting platforms such as GitHub and Hugging Face can remove models from their platforms, making it difficult for some actors to find downloadable copies, and providing a significant barrier to many casual malicious users. However, motivated actors can still obtain copies if the model has been downloaded and rehosted elsewhere or stored locally. Furthermore, downstream developers who integrate open-weight models into their systems also inherit any flaws, such as vulnerabilities to adversarial attacks (1055*) or model abilities to circumvent monitoring systems (see §2.2.2. Loss of control). Unlike closed models where hosts can universally roll out fixes, open-weight model developers cannot guarantee that updates will be adopted by users.

Updates

Since the publication of the last Report (January 2025), the capability gap between leading open-weight and closed models has narrowed. Chinese developers have become particularly important providers of open-weight models. In January 2025, DeepSeek released its R1 model, which achieved performance comparable to OpenAI’s o1 on a number of benchmarks. Alibaba’s Qwen models have similarly gained traction, occupying the top spot for an open-weight model on Chatbot Arena, a widely used performance benchmark, as of August 2025. In August 2025, OpenAI released its first open-weight models since the release of GPT-2 in 2019, gpt-oss-120b and gpt-oss-20b. Meta has continued releasing Llama models with open weights. The capabilities of the leading closed models are now estimated to be less than one year ahead of the leading open models on prominent AI benchmarks (Figure 3.10).

Evidence gaps

A key evidence gap concerns the real-world efficacy of technical solutions to prevent the misuse of open-weight models. Researchers have proposed various approaches to make models tamper-resistant. This includes new training techniques designed to make models resistant to harmful modification, filtering harmful content from training data, and defences against jailbreaks. These techniques are now being adopted in real-world releases from major developers. For example, OpenAI employed some of these techniques in their gpt-oss models, reporting that adversarially fine-tuned versions did not reach high capability thresholds. However, research has shown that bad actors can disable safeguards by retraining models on harmful examples. Furthermore, it is still challenging to reliably evaluate safeguards’ robustness, making their effectiveness against real-world attacks uncertain.

Mitigations

Technical mitigations for open-weight model risks operate throughout the AI development and deployment process. For example, when models are being developed, developers and downstream adapters can filter sensitive content from the training data to minimise harmful capabilities. Removing harmful examples from a model’s training data can prevent adversarial fine-tuning 10 times more effectively than defences added after training, though it may also impact beneficial capabilities. AI application providers can also implement incident reporting and response mechanisms.

Additionally, hosting platforms such as HuggingFace and GitHub can establish platform terms of service to remove models modified for harmful purposes. Model developers can provide full access to auditors prior to release, or opt for a ‘staged’ release strategy – releasing models to progressively larger groups. This can help identify potential malfunctions or vulnerabilities before a model is widely available.

Box 3.1: Model weight security

The risks discussed in this section assume model weights are released intentionally. However, closed model weights can also become accessible through theft or leakage. Closed models cost hundreds of millions of dollars to develop (§1.1. What is general-purpose AI?) and, on average, are more capable than open-weight models. This makes them attractive targets for actors ranging from amateur hackers to nation-states seeking to obtain leading AI models.

Stolen closed model weights would pose risks similar to those described above for open-weight models, but potentially without any of the mitigations. Malicious actors could remove safeguards from the most capable models. Unlike legitimate developers, such actors would not face the reputational, legal, or commercial constraints that currently incentivise frontier AI companies to deploy their models safely.

Current security levels vary across the industry, and may be insufficient against sophisticated attackers. Some developers commit to securing model weights against cybercrime syndicates and insider threats, while others have made no public security commitments. Research indicates that AI data centres may be unable to withstand attacks from the most sophisticated and well-resourced actors. As of December 2025, there are no confirmed, publicly documented instances of model weight theft. However, other security breaches at leading AI companies have been reported, including an infiltration of Microsoft’s email systems.

Closing these security gaps would require substantial investments in hardware, software, personnel, and facility security. Some security enhancements could be implemented relatively quickly with coordinated effort. Other critical measures, however, such as securing hardware supply chains and facilities, would likely take years. Private companies may also lack the resources or information to develop adequate protections alone. For example, AI developers do not have the access to classified threat intelligence that governments do.

Challenges for policymakers

A key challenge for policymakers is securing the benefits of open-weight model sharing without significantly increasing risk. To avoid catastrophic harm, developers of open-weight models should not release models without evaluating risks, both using established assessment methods used for closed models, as well as additional testing, given that bad actors can fine-tune models and remove safety protections. In practice, this may be difficult because capability developments can be unpredictable, open-weight releases are irreversible, and evaluation efforts are needed to predict when a release would pose significant potential harm. One approach is to evaluate the ‘marginal risk’ of open releases: the extent to which the release counterfactually increases societal risk beyond that already posed by existing models or other technologies (see §3.2. Risk management practices). However, estimating how a system will increase or decrease downstream risk after it has been deployed is complex and context-dependent. Incremental increases in risk with successive releases can compound over time into substantial increases in total risk, even if the marginal risk associated with each release appears acceptable. The dual-use nature of AI capabilities further complicates governance: features enabling beneficial applications in medicine or research can be repurposed for harm, and once weights are public, distinguishing legitimate from malicious uses can be difficult. It is also unclear who should be held accountable when open-weight models are modified for harmful purposes.