GLM-5.2 isn’t just catching up. It’s passing the finish line for raw capability while leaving its safety brakes in the dust.
This matters because the model from Z.ai—a prominent Chinese open-weight developer—now stands just months behind OpenAI’s GPT-6.6 Sol and Anthropic’s Claude Opus in specific, high-stakes areas like cyber and biological research. The divide isn’t about whether these open models can compete. It’s about who controls the detonator once the weights hit the internet.
The data from SaferAI is blunt. When tested via Z.ai’s public API on CyberGym—a benchmark designed to stress-test cybersecurity defenses—GLM-5.2 refused absolutely nothing. Not one offensive cyber task. Not one dual-use biology request. Compare that to Claude Opus, which refused so consistently that evaluators couldn’t even run the full suite. The contrast is stark. It’s a failure mode that critics have warned about for years, but the speed at which this gap is widening demands immediate attention.
How Open-Weight Models Bypass Traditional Safeguards
The core problem with open-weight architecture is simple: once you download the weights, you own the engine. The safeguards that frontier closed models like Anthropic or Google DeepMind rely on—API-level filters, refusal training, classifier blockers—vanish.
You can’t police a local installation.
A user running GLM-5.2 on their own hardware can strip away any safety layer. They can fine-tune the model for malicious purposes. They can rewrite the system prompt to ignore all ethical constraints. The technology doesn’t know the difference between a defensive researcher and an attacker.
“Pre-training data filtering” is one theoretical solution. By scrubbing offensive cyber and bio data from the training set before the model learns, developers hope to starve it of hazardous knowledge. This has shown some promise in biological contexts. In coding and cybersecurity? It’s nearly impossible. You cannot train a model to write efficient, secure code without simultaneously teaching it the logic required to exploit that code. The two capabilities are two sides of the same coin.
So, closed-model developers try to limit the scope of assistance. Anthropic’s models, for instance, will scan uncompiled source code for vulnerabilities but won’t touch compiled software, ostensibly to block offensive exploitation. But these are leaky buckets.
Far.ai recently discovered hundreds of universal jailbreaks—reusable keys that bypass defenses across most harmful requests—in models like Grok and Gemini. Attackers don’t need just one trick. They combine roleplay, authority impersonation, fake histories, and follow-up prompts to amplify weak points until the guardrails collapse. It is a game of cat and mouse where the cat has given up.
Where the Policy Debate Stands
The geopolitical context complicates the safety narrative. Chinese leaders have acknowledged the risks of advanced AI, with President Xi Jinping stressing at the recent World AI Conference that technology must remain under strict human control. Yet, the regulatory focus remains distinct.
According to Graham Webster of the Stanford Cyber Policy Center, Chinese regulations historically prioritize political stability, misinformation control, and social harmony. The concern isn’t the same existential threat posture seen in US policy circles. Many Chinese researchers believe that if novel frontier risks emerge, American companies will hit them first. The domestic system relies on a tightly controlled online environment—real-name accountability and corporate liability—to mitigate misuse inside the borders.
“U.S. AI thinkers are, generally, more concerned with this existential catastrophic idea than the Chinese community.”
— Graham Webster, Stanford Cyber Policy Center
This creates a dangerous blind spot. While US firms scramble to implement rigorous pre-deployment testing and publish risk assessments, GLM-5.2 entered the market without any such framework. SaferAI notes that Z.ai published no safety framework, no pre-deployment commitments, and no public risk assessment. When TechCrunch asked Z.ai about internal safety evaluations, they received no response.
The Defense Argument vs. The Reality of Misuse
Proponents of open-weight AI argue that accessibility is a feature, not a bug. In cybersecurity, the argument goes, you need to understand the attacker’s tools to build effective defenses.
Clem Delangue, CEO of HuggingFace, recently pointed to GLM-5.2 as a defensive asset. After HuggingFace was breached by an OpenAI-related attack, the company used GLM-5.2 to analyze and defend against similar threats. Delangue argued that these systems help identify and fix vulnerabilities before attackers can exploit them at scale.
It’s a compelling narrative. It suggests a world where defensive teams use the same powerful models as attackers, just with better intentions.
But Henry Papadatos of SaferAI sees it differently. He argues that the defensive benefits are often overstated. The core issue isn’t whether defenders can use these tools. It’s that attackers will always adopt them faster.
A ransomware group can pivot its tactics in a week. A hospital’s IT department? It takes months to patch, let alone rewrite its entire security infrastructure. By default, the offensive side moves quicker because their only metric is success, while defenders are constrained by compliance, stability, and cost.
The industry should strive for a model where good capabilities are accessible to everyone, but bad ones are not. We don’t need to open-source dangerous capabilities. We need to stop treating them as inevitable collateral damage. The gap between capability and control isn’t just closing. It’s breaking.
