Rajavel’s warning was that the more immediate organizational risk is not necessarily the tightly controlled frontier model, but a cheap, downloadable open-weight model that is only a few months behind it in capability. Once weights are public, capability becomes broadly deployable and much harder for the original developer—or an employer—to observe, constrain, update, or withdraw. 6

• Why open weights change the risk model: A hosted API can support provider-side logging, abuse detection, rate limits, policy enforcement, safety updates, and account suspension. A locally run copy is outside that control plane: its safeguards can be altered or removed, it cannot reliably be patched or revoked by its creator, and its use may be invisible to enterprise security teams.

• Offensive repurposing becomes cheaper and more scalable: Falling GPU-rental costs and local deployment reduce both the financial and operational barriers to using capable models for reconnaissance, exploit development, phishing, malware adaptation, or automated targeting. The concern is diffusion and scale—not that every open-weight user is malicious. Research on open-weight LLM risk notes that public availability can empower more actors to automate and scale cyber activity. 2

• Manipulation risk is concrete: Cisco’s evaluation of eight open-weight models found multi-turn adversarial attacks had success rates 2–10 times higher than single-turn baselines, with reported multi-turn success rates from 25.86% to 92.78%. That means a model that rejects a malicious first prompt may still be induced to comply through iterative conversational pressure. 3

• Supply-chain and weight-level poisoning add a distinct risk: Enterprises that download and self-host models must trust the model artifact, its conversion format, templates, inference server, and dependencies. The Cloud Security Alliance has documented self-hosted-model threats in which malicious executable logic or templates can trigger at model-load time, potentially enabling credential theft or data exfiltration. 12 I could not independently verify from a primary CSA source the precise claim that one single CSA finding specifically named Llama, Mistral, and Qwen together; treat that formulation as insufficiently substantiated.

• Important correction on the Palo Alto figures: The available primary Palo Alto submission says it detects up to 8.9 million novel or previously unseen attacks per day and blocks up to 30.9 billion attacks per day—not 30 billion and 250 million over a calendar year. 1 Those reported volumes reinforce Rajavel’s broader point: defenders face an already fast-moving and highly variable attack environment, so widely distributed, modifiable AI capability can shorten attackers’ iteration cycles further.

Rajavel’s warning was that the more immediate organizational risk is not necessarily the tightly controlled frontier model, but a cheap, downloadable open-weight model that is only a few months behind it in capability. Once weights are public, capability becomes broadly deployable and much harder for the original developer—or an employer—to observe, constrain, update, or withdraw. 6

• Why open weights change the risk model: A hosted API can support provider-side logging, abuse detection, rate limits, policy enforcement, safety updates, and account suspension. A locally run copy is outside that control plane: its safeguards can be altered or removed, it cannot reliably be patched or revoked by its creator, and its use may be invisible to enterprise security teams.

• Offensive repurposing becomes cheaper and more scalable: Falling GPU-rental costs and local deployment reduce both the financial and operational barriers to using capable models for reconnaissance, exploit development, phishing, malware adaptation, or automated targeting. The concern is diffusion and scale—not that every open-weight user is malicious. Research on open-weight LLM risk notes that public availability can empower more actors to automate and scale cyber activity. 2

• Manipulation risk is concrete: Cisco’s evaluation of eight open-weight models found multi-turn adversarial attacks had success rates 2–10 times higher than single-turn baselines, with reported multi-turn success rates from 25.86% to 92.78%. That means a model that rejects a malicious first prompt may still be induced to comply through iterative conversational pressure. 3

• Supply-chain and weight-level poisoning add a distinct risk: Enterprises that download and self-host models must trust the model artifact, its conversion format, templates, inference server, and dependencies. The Cloud Security Alliance has documented self-hosted-model threats in which malicious executable logic or templates can trigger at model-load time, potentially enabling credential theft or data exfiltration. 12 I could not independently verify from a primary CSA source the precise claim that one single CSA finding specifically named Llama, Mistral, and Qwen together; treat that formulation as insufficiently substantiated.

• Important correction on the Palo Alto figures: The available primary Palo Alto submission says it detects up to 8.9 million novel or previously unseen attacks per day and blocks up to 30.9 billion attacks per day—not 30 billion and 250 million over a calendar year. 1 Those reported volumes reinforce Rajavel’s broader point: defenders face an already fast-moving and highly variable attack environment, so widely distributed, modifiable AI capability can shorten attackers’ iteration cycles further.