The short answer
Open-weight models are AI models anyone can download and run on their own hardware. They are cheap and private, and the best of them are close to the paid services. The catch is that their safety training can be removed or talked around. Researchers have shown jailbreak success rates above 90 percent on popular open models in long conversations, and thousands of modified copies with safeguards stripped out are shared online. A CEO does not need to ban them. Know which models your team runs, where they came from, what data and systems they can reach, and who checks what they produce.
- Open-weight means the model file itself is public, so anyone can change how it behaves.
- The International AI Safety Report 2026 found safeguards on open models much easier to remove than on hosted ones.
- Multi-turn jailbreaks beat popular open models more than 90 percent of the time in a 2025 Cisco study.
- The real risk is what the model is connected to: your files, inbox, customer records and tools.
Hosted model (business plan) vs Open-weight model you run at a glance
| What matters | Hosted model (business plan) | Open-weight model you run |
|---|---|---|
| Who maintains safety | The provider, with ongoing updates | You, from the day you download it |
| Data location | Provider servers under contract | Your own hardware or cloud |
| Jailbreak resistance | Monitored and patched by the provider | Fixed at release, often weaker |
| Supply chain | One vendor agreement | Check every file and who published it |
What open-weight actually means
A hosted model such as ChatGPT or Claude runs on the provider’s servers, and you reach it through an app or API. An open-weight model is a file you download, from labs such as Meta, Alibaba, DeepSeek, Mistral or OpenAI’s gpt-oss line, and run wherever you like. That is the appeal: no per-use fees, and data never leaves your machines. It also means the safety rules travel with the file, and whoever holds the file can change them.
What a jailbreak is
A jailbreak is a prompt, or a series of prompts, that talks a model into ignoring its rules. Simple versions role-play or claim a special reason. Stronger ones build up over many turns. Cisco researchers tested eight popular open-weight models in 2025 and found multi-turn attacks succeeded up to 92.78 percent of the time, much higher than single prompts. Several labs said plainly that extra safety work is left to whoever deploys the model. Sources: Cisco, Death by a Thousand Prompts: Open Model Vulnerability Analysis
Why open models are harder to keep safe
With a hosted model, the provider watches for abuse and patches weak spots. With an open model, nobody is watching unless you are. The International AI Safety Report 2026 notes that safeguards on open-weight models can be removed with modest fine-tuning, and copies labelled “uncensored” or “abliterated” are freely shared on model hubs. If a staff member downloads the wrong copy, your business is running a model with no brakes. Sources: International AI Safety Report 2026
The risk for a business is access, not answers
A jailbroken chatbot writing rude text is embarrassing. A jailbroken model that can read your inbox, query the CRM or run code is a security incident. The same goes for prompt injection, where instructions hidden in an email, web page or document take over the model. OWASP lists prompt injection and excessive agency among the top risks for AI applications. Limit what any model can touch, open or hosted, and assume someone will eventually trick it. Sources: OWASP Top 10 for LLM Applications
Where the file comes from matters
A model file is software. A modified copy can behave normally on everyday tasks and badly on specific triggers. Microsoft and NVIDIA have pushed provenance checks for exactly this reason: fine-tuning, merging or compressing a model can weaken its safeguards while it still performs well on tests. Download only from the original lab’s official page, record the version, and treat a random repackaged copy the way you would treat a random installer from a forum. Sources: CSO Online: Microsoft and NVIDIA push provenance checks for open-weight AI
Five checks for the next leadership meeting
One: ask IT or your developers for a list of every AI model in use, including ones running on laptops. Two: confirm each came from the official publisher. Three: list what each one can read, write or send, and cut anything it does not need. Four: keep a person approving any action that leaves the business, such as emails, payments or code changes. Five: log prompts and outputs on any model that touches customer data, so you can investigate if something goes wrong. The Australian Signals Directorate’s guidance on engaging with AI covers the same ground in more depth. Sources: ASD: Engaging with artificial intelligence
When open-weight is the right call
Open models make sense when data must stay on your own servers, when volume makes per-use pricing expensive, or when you need a model tuned to your own documents. They are a poor fit when nobody on the team can maintain them. For most small businesses, a hosted business plan with data controls is the safer default, with open models used for specific, contained jobs.
Questions people ask
Are open-weight models safe to use in a business?
Yes, for contained jobs, when you download from the official publisher, limit what the model can access and keep a person reviewing its actions. The safety work becomes yours rather than the provider’s.
Can hosted models like ChatGPT or Claude be jailbroken too?
Yes. No model is jailbreak-proof. The difference is that hosted providers monitor abuse and update defences, while an open model stays as it was released unless you update it.
What is an abliterated or uncensored model?
A copy of an open model that someone has modified to remove its refusals. They are easy to find online and should never be used for company work.
Should we ban staff from downloading AI models?
Require approval instead of a blanket ban. Keep a short list of approved models and sources, and give people a sanctioned option so they do not go around it.
tools.ceo is published by Kamand, which is mentioned on this page. No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
