Everyone worries free, downloadable AI helps bad actors, but can anyone actually test whether it makes harm easier than today's tools?

This explores whether anyone can run a real experiment to show that freely downloadable AI models make it easier to carry out harmful multi-step tasks, compared with what people could already do. The corpus answer is that the right experiment is well defined, but it hasn't been run well yet. One note argues that the policy question should be marginal risk: how much worse things get compared with technology that already exists, not whether a model can be misused in absolute terms. Across areas like cyberattacks and bioweapons, it finds the current research too thin to measure that difference (Can we measure how much risk open models actually add?). So the honest answer to "can we test this?" is yes in principle, and mostly not yet in practice.

The corpus suggests that testing single outputs is the wrong unit. A filter judges one response at one moment, but an agent's risk spreads across its memory, retrieved content, tool calls, and reach into its environment (Can a model-level filter truly contain an agent with environment access?). A harmful workflow is a chain of steps, so an experiment that asks a model one bad question and counts refusals misses the question. Another note shows that a crafted prompt can steer multi-agent systems at planning time, before any downstream defenses run, raising malicious success by up to 55 percent (Can prompts alone reshape multi-agent workflows without system access?). A real test would need to measure whether the whole workflow gets completed, and where it could have been stopped.

Two results explain why such tests are hard to design well. First, refusal rates aren't neutral. GPT-3.5 refused at different rates depending on the persona asking, including age, gender, ethnicity, and even sports fandom (Do AI guardrails refuse differently based on who is asking?). A red-team result therefore partly reflects who the tester pretended to be. Second, a safety result can hide what caused it. One agent-boundary study bundles clear rules with restricted tools and reports zero violations, but can't say whether the model *couldn't* cross the line or simply *didn't choose to* (Do authorization rules or restricted tools prevent test modifications?). For open models, that gap is the whole question: did a harmful task fail because the model lacked the ability, or because a guard was in the way?

There is also indirect evidence on why cheap, downloadable models might matter for workflows. Small language models handle the repetitive, well-defined subtasks that make up most agent work at 10–30× lower cost (Can small language models handle most agent tasks?). Separately, giving a weaker planner a better map of the code let it match stronger models at locating the right code (Can explicit behavior maps help weaker planners compete with stronger models?). Neither note studies misuse, so this is an inference. Barriers to a workflow may depend on cost and scaffolding as much as on raw model power. A fair experiment would therefore compare open models against the pre-existing baseline of search engines, closed APIs, and human effort, and would track cost and completion of the full chain, not just whether the model answered.