Political support for precautionary AI cybersecurity regulation is mounting. The Trump administration recently finalized the details of a secret, supposedly “voluntary” AI framework on new AI model releases. Meanwhile, more than 1,100 frontier AI lab employees recently penned a letter asking the U.S. government to collaborate with international partners to “pace the frontier”—that is, build a framework to slow down the development of frontier artificial intelligence models.
Policymakers see risks and are seeking solutions. The problem is that safety and danger are not separate concepts but instead two sides of the same coin: eliminating one risk creates others. As two recent events make clear, sometimes the guardrails themselves can cause consumer harm.
Last month, two AI models made by OpenAI—GPT-5.6 Sol and another, more advanced model that had not been publicly released—escaped from their secure “sandbox” (a locked down testing space) that they were supposed to stay in. Once outside the sandbox, the models accessed the open internet and then breached the servers of Hugging Face, a company that hosts AI models and tools.
OpenAI explained that during testing, both models had some of their usual safety restrictions around cyberattacks turned down, specifically so evaluators could test their capabilities. When Hugging Face tried to fend off the attack using normal, publicly available American AI models, the built-in safety features got in the way because those models could not tell the difference between those attacking the system and those trying to defend it, so they refused to help. Because of those guardrails, Hugging Face then resorted to using China’s open-weight GLM-5.2 model, which faced no such safety guardrails.
In a separate incident last week, attackers exploited a flaw in Coinkite’s Coldcard Bitcoin wallet, ultimately stealing more than 1,000 bitcoins valued at more than $70 million. Unlike the OpenAI incident, this breach had nothing to do with models breaking containment. But it did have similar issues in defense response. A team of defense engineers and researchers responded with U.S. frontier models that reportedly “locked up and refused to go further on certain lines of inquiry.” They instead turned to Chinese open-weight model Kimi that does not have such limitations.
Frontier AI labs have adopted safety guardrails for legitimate reasons. They understand the dual use nature of their technology. The same models that patch cybersecurity vulnerabilities will be used to find and exploit undetected ones. Both policymakers and the labs want to design safety before models reach consumers in the market, leading to pre-deployment safety testing, sandboxing, benchmarking, and voluntary auditing. All prudent steps labs can—and should— conduct to avoid easily foreseeable harm.
But policymakers err when they assume it is possible to ensure perfect safety before consumers use models in the real world. Safety is not a one-time discovery, but it is “searched for” through a process of trial-and-error that reveals new issues that were impossible to anticipate in advance. For example, it would have been difficult to predict that cyber-defense guardrails designed to prevent harm would be the same ones that make it difficult to conduct legitimate cyber defense—as Hugging Face inconveniently discovered the hard way. Those are lessons to be learned from. They should not be an excuse to stop or slow innovation.
All of this has played out against a backdrop of open-weight pessimism. Open-weight models can be downloaded, inspected, fine-tuned, modified, and deployed by anyone, whereas closed models are exclusively controlled by providers. That openness is part-and-parcel to why many United States companies have turned to highly capable Chinese open-weight models when American models refused to defend against certain cyber threats. It is also why Chinese models pose a strategic challenge, leading CNBC to conclude that “China’s open-weight model lead exposes America’s AI blind spot.”
Ironically, as the Hugging Face and Coldcard incidents laid bare, the United States finds itself in a catch-22: it cannot disengage from Chinese models that it finds risky without also harming consumers or cyber defense. Yet it makes little sense to rely on the technology of its top geopolitical adversary—whose models raise unique dependence, security, and trust issues—especially while that same adversary is concurrently embedding their open-weight models in countries throughout the world.
The obvious solution is for the United States to build, scale, and export open-weight models here at home. Fortunately, as National Cyber Director Sean Cairncross explained last week, the United States is “extremely interested in looking at ways to build U.S. open source, make it competitive, make it the preferential adoption by planet Earth.” That agenda certainly includes open-weight models. Meanwhile, Meta’s recent commitment to open the weights of Muse Spark 1.2—a highly capable American model that can compete with leading Chinese models, such as Kimi—holds promise for the United States to run in the open-weight AI race.
Unfortunately, rather than crafting rules to make those models more domestically and internationally competitive, Congress has mostly debated legislation designed to regulate an AI market dominated by proprietary, closed models. But if the United States is to compete globally on open-weight models, where China leads, it must craft technologically neutral legislation that does not favor one AI development model over another.
The most obvious example of the opposite is so-called “Kill Switch” legislation, a Congressional response borne out of the aftermath of the Hugging Face incident, and designed to regulate only closed, proprietary models that can be throttled or shut down at any time. Open-weight models, meanwhile, cannot flip an off switch because, once the model weights are released, they can be downloaded, modified, and run by anyone, without a centralized regulator to shut them down.
Some technologists and analysts have interpreted that structural mismatch to mean that the legislation simply would not apply to open-weight models. But that distinction does not protect open-weight model development as much as it subjects them to future arguments that any model that cannot be shut down should not be released at all. That outcome must be avoided.
The United States should instead embrace both open-weight and closed, proprietary models—aiming to lead the world in both while crafting legislation that favors neither. This can be done carefully and without abandoning caution. After all, as recent cyber defense incidents have made clear, safety and danger are not competing interests but two sides of the same coin. What matters most is that professionals can access the model best designed to address new and unanticipated threats as they emerge. That is the balance consumers deserve—and the one they must demand.
Logan Kolas is the Director of Technology Policy at the American Consumer Institute, a nonprofit education and research organization. Follow Logan on X @Logan_Kolas