Before anyone could download and tweak AI models, what could a bad actor already do with AI?
What baseline capabilities could bad actors achieve before open models existed?
This explores what a malicious person could already do with AI before downloadable, modifiable open-weight models arrived, as a baseline for judging what open models add.
This explores what a malicious person could already do with AI before downloadable, modifiable open-weight models arrived, as a baseline for judging what open models add. The corpus can't answer that directly. None of the retrieved notes measure misuse before and after open models, or compare bad-actor capability across the open/closed divide. What it has is adjacent material on where AI capability and risk actually sit, and that changes how you'd ask the question.
The first point is that the model was never the whole system. A note on containment argues that a filter on a model Can a model-level filter truly contain an agent with environment access? judges one output at one moment, while an agent's risk spreads across memory, retrieved content, tool calls, and what it can reach in its environment. In the closed-model era, the main safeguard was the filter at the model's door. That controls what a model says, not what it can touch. So the baseline for a bad actor depends less on which model they had than on what tools and access surrounded it. This is my inference from the note, not something it tests.
That also explains why a bare chatbot was a limited starting point. Turning a language model into something that acts takes more than the model. Can you turn an LLM into an agent by just fine-tuning? describes four stages: action datasets, training for grounded action, agent infrastructure with memory and tools, and safety evaluation. Tools also expand what models can do in a formal sense (Do tools actually expand what language models can reason about?). Models limited to text often fail at long multi-step procedures even when they know the method, and tool access removes much of that ceiling (Are reasoning model collapses really failures of reasoning?). The step up in capability came from tools and scaffolding as much as from the model itself.
There is one cost-related hint about why open models might matter. Can small language models handle most agent tasks? finds that small models can handle most of the repetitive, well-defined subtasks in agent work at 10–30× lower cost. That note is about legitimate system design, not misuse. Still, it suggests that cheap automation of many small steps doesn't need a frontier model, which is the kind of work a downloadable model can do.
One result cuts the other way. Does safety alignment harm models' ability to roleplay villains? shows that safety-tuned models play villains poorly. They swap nuanced deception and manipulation for crude aggression. That suggests aligned closed models were weak at convincing malice, at least in fiction roleplay. The corpus doesn't test whether the gap closes once the safety tuning is removed, and it doesn't measure real-world harm.
A real answer would need notes on misuse-uplift studies, open-weight release policy, and fine-tuning away safeguards. This retrieval doesn't include them.