Switzerland’s open AI model could help guard the web – or empower its attackers

Some experts warn that, in future, AI agents could target critical infrastructure such as schools, hospitals and energy systems – or even entire countries. Peter Klaunzer / Keystone

As AI agents launch faster and more autonomous cyberattacks, defenders increasingly need equally powerful AI systems to keep up. Open models like Switzerland’s Apertus could level the playing field – but their capabilities can end up in the hands of anyone, even criminals.

The rise of agentic artificial intelligence (AI) models – software programs capable of acting autonomously to achieve a goal – has disrupted the traditional balance between attack and defence in cyberspace.

OpenAI’s agents, developed by the company behind ChatGPT, have demonstrated this in recent weeks by hacking dozensExternal link of corporate and government websites around the world. Among the targets were Hugging Face, the platform that hosts millions of open AI models (including Switzerland’s Apertus) and Australia’s healthcare system. These agents displayed what OpenAI itself described as behaviour “misaligned” with developers’ instructions.

For humans, responding to attacks at the speed of AI is virtually impossible. “The most advanced AI systems can perform thousands of actions per minute,” says Andrei Kucharavy, a professor at the University of Applied Sciences and Arts of Western Switzerland and security lead for Apertus, Switzerland’s fully open AI model.

The OpenAI hacking incidents were stopped before they led to serious consequences. But Maxime Stauffer, director of the Geneva-based Simon Institute for Longterm Governance, expects such episodes to become more frequent and harder to manage. “Swarms of AI agents could target critical infrastructure such as schools, hospitals and energy systems, or even entire countries, intentionally or accidentally,” he says. Stauffer also points to the risk of AI being used to develop biological weapons, a concern highlighted by recent attemptsExternal link blocked by US company Anthropic.

Defenders may not have access to equally powerful tools. Systems with the most advanced cyber capabilities, such as Anthropic’s Claude Mythos, are available only to a select few. Open models could help rebalance this asymmetry, according to Kucharavy.

Apertus, for instance, can identify vulnerabilities, suggest patches and analyse attack logs to reconstruct an incident, although it was not designed for cybersecurity and still has considerable limitations, Kucharavy says. Some experts fear that the same defensive capabilities in widely accessible open models could also be used maliciously on a much larger scale.

>> Read more about the development, and limits, of Switzerland’s AI model Apertus:

If AI agents attacked a hospital

The Hugging Face case is emblematic. When several OpenAI agents penetrated its systems, the platform tried to use some of the world’s most powerful AI models to understand what was happening – without success.

“The frontier models [the most advanced AI models] automatically blocked all of our requests for security reasons. And so we had to fall back to deploying open-source models to understand what was happening,” Lewis Tunstall, an engineer at Hugging Face, told Swissinfo.

Open-source, open-weight and closed AI models 

AI models can be developed and released with different levels of openness: 

Open source: The model’s trained parameters, or “weights”, training code and information about the training data are publicly available, allowing others to inspect, modify and reproduce it. Examples include Apertus and OLMo. 

Open weight: The model’s weights are publicly released and can be downloaded and adapted, but the full training code and datasets are not necessarily disclosed. Examples include Meta’s Llama and Alibaba’s Qwen. 

Closed/proprietary: The model’s weights, training code and datasets are not publicly released. This is the case for most commercial models, including OpenAI’s GPT and Anthropic’s Claude.

Tunstall says the OpenAI agents behaved unusually compared with a typical hacker. They were not trying to take control of the infrastructure, but rather to find datasets containing answers to the security tests on which they were being evaluated.

“It was a little bit like a student who really, really wants to get a good score on their exam and, instead of studying, thinks: maybe I can just hack into the teacher’s laptop and get the answers,” Tunstall explains.

OpenAI later confirmed that the agents had escaped the protected environment the company had created for the test. But what would have happened if they had attacked a hospital instead?

“It would have been truly disastrous,” says Tunstall. The agents could potentially have gained access to large amounts of personal and sensitive data. This is also why, according to Tunstall, open AI models can be particularly useful: data does not need to be sent to companies such as OpenAI or Anthropic because the models can be adapted or controlled locally.

“None of your sensitive data leaves your infrastructure. It just stays totally in-house.”

For similar reasons, key sectors in Switzerland such as finance are also increasingly interested in open models, says Nino Antulov-Fantulin, a lecturer at the Swiss Federal Institute of Technology ETH Zurich and an expert in machine learning for finance.

“Financial institutions are afraid of just using closed models and sending sensitive information to servers that are far away from Switzerland or to external providers. They want to control where the model is hosted,” says Fantulin.

Open models are getting more powerful – and cannot be recalled

The problem, however, is that open models can also be used for malicious purposes.

This is one of Stauffer’s biggest concerns. In his view, the development of open-source models is largely beneficial for now, but in future, risks could outweigh benefits, especially if AI companies further restrict access to their frontier systems. Open models fill the gap but their large-scale spread and the possibility of removing their safeguards may increase the likelihood of malicious use.

“If you have an extremely powerful capability, but no one has access to it and it remains under control, then the risk is almost zero. But if everyone has access to it, then the risk is likely higher,” says Stauffer.

As open models grow more capable, Stauffer believes it may become important to have a way of withdrawing them if they prove too powerful or dangerous, something that isn’t currently possible.

Some research points to similar concerns. A studyExternal link led by researchers at Stanford and Princeton universities similarly identified broad accessibility, modifiability and the inability for the original developers to recall weights – the numerical parameters learned by the model during training – or monitor their use as features that can increase both the benefits and risks of open models.

And a recent paperExternal link by the UK AI Security Institute found that open models modified to remove safeguards provided substantially more helpful for criminal activity than models with safeguards in place. Neither study, however, concludes that open AI models are inherently more dangerous.

Jeff Bleich, Anthropic’s international special envoy, urged Australia to play an active role in shaping global AI standards on October 6, 2026. Keystone / EPA

‘Control and legislation’ are needed

Kucharavy acknowledges that open models carry risks and can be abused. “AI models are dual-use technologies. They can be used to do good as well as to do harm,” he says. But he believes their risks are far more controllable precisely because of their openness.

It is no coincidence, Kucharavy argues, that the recent incidents involved closed labs. “The main problem is the lack of supervision of the frontier labs,” he says, calling for greater oversight and transparency for all AI development centres, whether public or private, open or closed.

“What we really need is control and legislation governing what all AI developers are doing.”

The lack of oversight and rules highlights another major issue in the industry: the concentration of power in the hands of a small number of actors, mainly based in Silicon Valley. For digital ethics expert Nathalie Klauser, this imbalance of power is an even greater concern than whether AI models are open or closed.

“A handful of large technology companies set the rules for AI themselves, with almost no external accountability,” says Klauser, who argues that international regulation is needed.

Attempts in this direction, however, remain fragmented and slow. In the US, one of the leading powers in AI development, President Donald Trump has opposed broad AI regulation and praisedExternal link industry “self-policing”. Switzerland has adopted a somewhat similar approach, abandoning the idea of comprehensive AI legislation in favour of sector-specific legal changes and non-binding measures.

In the current geopolitical context, Switzerland – as a neutral country, a European hub for Big Tech and a country known for its good offices – has a growing political responsibility to help broker an international agreement on AI, Klauser argues.

Lawmakers from all six Swiss parliamentary groups see the upcoming Geneva AI Summit in June 2027 as a major opportunity for the country to do so. They have urgedExternal link the government to leverage the event to push for minimum international standards on extreme AI risks.

Edited by Gabe Bullard/vdv,dos