Open-Weight AI Safety Gap Widens As GLM-5.2 Nears Frontier Models

A SaferAI evaluation puts Z.ai's open-weight GLM-5.2 close to the cyber and biology capabilities of closed frontier models, while the public safety record around the release remains thinner than the capability evidence.

SaferAI benchmarked GLM-5.2 against OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7, placing the Chinese model within a few months of those systems on cyber and biological capability tests.

The nonprofit's evaluation found no refusals when GLM-5.2 was queried through Z.ai's public API for offensive cyber and dual-use biology tasks, while refusals from Claude Opus 4.7 were frequent enough that SaferAI could not finish the CyberGym benchmark on that model.

The release model is part of the risk assessment.

Closed frontier labs can use hosted controls, refusal training, classifiers, and API monitoring to limit some dangerous assistance.

Open-weight systems can be downloaded, modified, and run on separate infrastructure, where a model provider cannot enforce the same safeguards after release.

SaferAI executive director Henry Papadatos noted that capability alone does not define risk, as mitigation quality also determines how dangerous a model becomes in practice.

His proposed goal is broad access to beneficial capabilities while harmful capabilities are removed, including in open-source settings.

The technical boundary is difficult for model builders.

Research suggests pre-training data filtering may reduce some hazardous biological knowledge without hurting broad model performance, but cybersecurity filtering is harder because strong coding skills can also support offensive activity.

Developers face pressure to improve the coding abilities that customers value while limiting the misuse pathways attached to the same skill set.

Frontier developers have used narrower restrictions as an alternative.

Anthropic's Opus 5 system card allows vulnerability searches in uncompiled source code but not in compiled software, a distinction meant to preserve defensive work while reducing offensive utility.

Pre-deployment evaluations, risk assessments, and decisions not to release model weights when a system appears too dangerous serve as other control points.

Z.ai's disclosure record is the immediate governance issue.

SaferAI found no published safety framework, pre-deployment testing commitments, or risk assessment for GLM-5.2.

The public record does not show whether internal or third-party frontier-safety evaluations occurred before release.

The policy context is not simply China versus the United States.

Graham Webster of the Stanford Cyber Policy Center noted that Chinese AI rules have historically focused more on politically sensitive content, misinformation, and social stability than on catastrophic risks such as cyber or biological misuse.

He also pointed out that Chinese firms often coordinate with regulators privately, making external safety testing difficult to judge.

Open-weight advocates still see a defensive case.

Hugging Face CEO Clem Delangue wrote that systems used to stop an AI-powered cyberattack can also help defenders identify vulnerabilities before attackers exploit them.

Papadatos disputed the idea that this benefit justifies open release of dangerous capabilities by default, arguing that attackers can adopt new tools faster than institutions such as hospitals can adapt their defenses.

The public record still does not identify a GLM-5.2 safety framework, pre-release test commitments, third-party frontier-safety review, or post-release control limits, leaving the model's capability evidence clearer than its external governance record.