“Once an open-source AI system is released, it cannot be patched against newly discovered vulnerabilities.”