Responding to the Risks of Open-Weight AI Models

RUSI has noticed something marvellous: standalone safety classifiers exist. They are built, they are available, and absolutely nothing compels an open-weight provider to run one. This is the entire architecture of AI safety in 2026 — an off-the-shelf fire extinguisher, sold in the lobby, with no bylaw requiring anyone to install it. The think tank's point is not that the tools are missing. It is that the obligation is.

Then there is the shopping problem. Because many providers serve up access to the same underlying models, a determined malicious actor can simply browse until he finds a deployment that skipped the safety check — a spot of comparison shopping that used to require years of specialist skill and now requires a browser and an afternoon. The UK's National Cyber Security Centre assesses that AI will "almost certainly" continue to make cyber intrusion operations more effective, and that open source and commercially available models will lower the barrier to entry for a widening range of actors. "Almost certainly" is spy-speak for "we have watched it happen and would rather not say so in a press release."

The barrier to entry, lowered. The widening range of actors — which is everyone, basically, from nation-states to a bored teenager with a grudge and a GPU. Note the passive grammar of "nothing compels": the sentence construction of an industry that has decided compulsion is somebody else's department. And the fixes on offer? A classifier nobody has to run, a provider that can be swapped for the one next door, and a voluntary code of conduct written by the people who would be asked to obey it. We have built a lock, published the key, and are now drafting a strongly worded memorandum about locks. For anyone keeping score, the 440 per cent surge in blockchain-embedded attacks we admired not long ago was merely the warm-up act.