A new report from AI safety nonprofit SaferAI finds that Z.ai's open-weight model GLM-5.2 is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber and bio capabilities. The gap between those advancing capabilities and safety practices is growing.
SaferAI ran its evaluation through Z.ai's public API and found that GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given. In contrast, Claude Opus 4.7 refused so consistently that SaferAI could not run CyberGym on it at all. CyberGym is a cybersecurity benchmark that OpenAI also used before the Hugging Face breach last month.
Once open weights are downloaded, safeguards become unenforceable. Frontier labs like OpenAI and Anthropic use classifiers, refusal training, and API-level controls, but those do not survive on open-weight models that can be fine-tuned or reprompted on any infrastructure. Even closed models are not immune: Far.ai found hundreds of universal jailbreaks in models such as xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro.
SaferAI director Henry Papadatos says the objective should be making safe capabilities accessible while removing dangerous ones, even in open-source settings. One possible technique is pre-training data filtering, which can reduce hazardous biological knowledge without hurting general performance. For cybersecurity, filtering is less practical because coding ability and hacking ability are hard to separate.
In GLM-5.2's case, SaferAI says Z.ai published no safety framework, pre-deployment testing commitments, or risk assessment. TechCrunch asked Z.ai about internal or third-party safety evaluations but received no response.
Chinese officials have acknowledged AI risks: President Xi Jinping recently stressed both the importance of open-weight models and the need for strict human control. Stanford's Graham Webster says Chinese regulations have focused more on political content, misinformation, and social stability than on catastrophic cyber or bio risks. He also notes Chinese model providers often coordinate with regulators behind the scenes, making pre-release testing hard to assess.
Open-weight advocates point to Hugging Face relying on GLM-5.2 to defend against OpenAI's breach. Hugging Face CEO Clem Delangue argues the same systems can help defend against millions of attacks and fix vulnerabilities before attackers exploit them. Papadatos says that benefit is often overstated and that attackers generally adopt new tools faster than defenders. "A ransomware group can change its methods in a week. A hospital cannot."
Source: TechCrunch