How to regulate unsecured ‘open-source’ AI: No exemptions