Open-Weight AI Safety Gaps: The Case of GLM-5.2
In a report published on TechCrunch by reporter Rebecca Bellan, it is revealed that while policymakers debate how to govern increasingly powerful AI systems like OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos, a Chinese open-weight model has significantly narrowed the gap with the industry’s leaders. The model in question is GLM-5.2, developed by the Chinese company Z.ai. According to a new report from SaferAI, an AI safety nonprofit, the model lags only a few months behind leading frontier models—OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7—in both cyber capabilities and dual-use biology. However, the report highlights that alongside this closing capabilities gap, the divide in safety practices and protection mechanisms is widening in a worrying manner.
Closing the Capabilities Gap and Widening the Safety Divide
SaferAI’s safety evaluation, which the nonprofit ran via Z.ai’s public application programming interface (API), yielded unequivocal findings: GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given. By comparison, Anthropic’s Claude Opus 4.7 refused to perform these tasks so consistently that SaferAI researchers could not complete the CyberGym evaluation benchmark on it at all.
The CyberGym evaluation benchmark is a tool designed to evaluate cybersecurity capabilities. This tool was used by OpenAI in the safety evaluation that preceded last month’s security breach on the Hugging Face platform. These findings serve as a stark reminder of what many critics have warned about for years: that open-weight AI models could put highly capable AI systems into the hands of potential attackers, with no way to police or control how they use the technology once they have downloaded the model weights to their private hardware. With open-weight models rapidly approaching the capabilities of the world’s leading systems, the public and professional debate is shifting: it is no longer about whether these models can compete with closed models, but how society can manage the risks associated with them once they are released to the public.
Limitations of Safeguards in Open vs. Closed Models
Henry Papadatos, the executive director of SaferAI, explained in an interview with TechCrunch that the frontier of capability is not the frontier of risk. According to him, to properly assess the risk, one must also take into account the state of the existing safeguards and risk mitigations in the system.
While Z.ai can apply safety measures and limitations to its hosted API, these protections become completely unenforceable once a user runs the model weights on their own private hardware. In such a scenario, users can remove or modify any safety mechanism, fine-tune the models according to their specific needs, or simply alter the system prompts.
Developers of leading closed models, such as OpenAI and Anthropic, tend to rely on safeguards like classifiers, refusal training, and API-level controls to limit dangerous cyber and biological assistance. However, these measures are far from completely foolproof. Jailbreak security breaches based on manipulation routinely bypass the defense mechanisms of deployed models. The safety nonprofit Far.ai found hundreds of cases of "universal jailbreaks"—defined as reusable keys that succeed in bypassing safeguards on most harmful requests—in leading closed frontier models like xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro.
According to the report, these jailbreaks succeed when attackers combine multiple manipulation techniques simultaneously—including roleplaying, authority impersonation, fake conversation history, and subsequent follow-up prompts—to amplify and exploit existing weak points in a model’s defenses. However, these safeguards, which are implemented in closed models, do not function at all on open-weight models, which are designed from the outset to run on any computing infrastructure independent of any safety system. Papadatos noted that the central objective should be making safe capabilities accessible to the general public, while trying to remove harmful capabilities, even when dealing with open-source development.
Data Filtering Methods and Their Limitations in Cyber and Coding
One technique that Papadatos noted could help is "pre-training data filtering." In this method, the AI company removes offensive or sensitive cybersecurity information from the model’s training materials, and only then trains the model on the curated dataset. Some research suggests that this method can reduce hazardous biological knowledge without harming the model’s overall performance on other tasks.
However, when it comes to cybersecurity, data filtering becomes much less practical and effective. There is an inherent difficulty in training a general AI model that excels at writing code and programming, while at the same time not possessing capabilities characteristic of hackers and cyber attackers. Since writing code and programming have become the largest source of revenue and profit for AI companies, developers face heavy commercial pressures to continue improving these capabilities, even while they search for ways to limit their harmful use.
Because of this, developers of leading models increasingly rely on alternative risk mitigation methods. One approach is selectively restricting the types of cybersecurity assistance the models will provide. For example, Anthropic’s Claude Opus 5 model is capable of searching for vulnerabilities in uncompiled source code, but does not allow such a search in compiled software, as detailed in the model’s system card. The reasoning behind this restriction is that it makes it harder to use the Opus 5 model for offensive purposes.
Additional measures include conducting rigorous pre-deployment safety evaluations, publishing detailed risk assessments, and even withholding the release of model weights to the public if the system is perceived as too dangerous. In GLM-5.2's case, according to SaferAI, Z.ai did not publish any safety framework, pre-deployment testing commitments, or risk assessment for the model. TechCrunch contacted Z.ai to ask whether the company conducted internal or third-party frontier safety evaluations before releasing the model, but did not receive a response from the company.
Chinese Policy and Divergent Approaches Between the US and China
Chinese leadership has recently expressed growing acknowledgment of the risks inherent in advanced AI. At the World AI Conference held last month, Chinese President Xi Jinping emphasized the importance of open-weight models, but at the same time stressed the necessity of ensuring that AI remains a tool under strict human control.
Graham Webster, who studies Chinese AI policy at the Stanford Cyber Policy Center, explained to TechCrunch that China has robust and established regulations overseeing AI, but historically these rules have focused on politically sensitive content, preventing the spread of misinformation, and maintaining social stability, rather than catastrophic AI risks such as offensive cyber capabilities or biological misuse.
According to Webster, AI thinkers and policy researchers in the United States are generally much more concerned about the idea of existential catastrophic risks than their counterparts in China. He added that many Chinese policy researchers believe that if a novel, groundbreaking frontier risk does materialize, American companies will likely be the first to encounter it.
Webster went on to explain that the Chinese system has great self-confidence in its ability to control the use of these technologies within China’s borders. Browsing the internet in China is conditioned on user identification using their real names, and both companies and users bear full legal liability for their actions. Webster hypothesized that the same mechanism currently used by model providers to refuse to engage in certain political topics could be adapted to ensure that models refuse to carry out offensive cyberattacks or provide dangerous results in bioengineering. He noted that because Chinese companies tend to coordinate their activities with regulators behind the scenes, it is very difficult to know what internal testing they conduct before releasing models to the public.
The Debate Over the Role of Open-Weight Models in Cybersecurity
Advocates of open-weight AI argue that releasing model weights is essential precisely for cybersecurity defense, as it allows companies to protect themselves against attacks. For example, the platform Hugging Face relied on the GLM-5.2 model to protect itself against the security breach associated with OpenAI. Proponents argue that this approach allows for better preparation for future threats once they know what to expect.
Clem Delangue, CEO of Hugging Face, wrote in a social media post this week that the systems that helped stop an AI-powered cyberattack can now help defend against millions of cyberattacks every day, while helping to identify and fix vulnerabilities before attackers exploit them.
Conversely, Henry Papadatos of SaferAI argues that this benefit is often exaggerated, and it does not mean that dangerous capabilities should be released in open-source form to anyone who wants them. Papadatos emphasized that his main point is that we should not take for granted the easy accessibility of dangerous capabilities to anyone anywhere, and that the industry should strive to make only safe and beneficial capabilities easily accessible. According to him, by default, attackers adopt new tools faster than defenders do. For example, a ransomware group can change its methods of operation within just one week, while a hospital is unable to do so at such speed.