GLM-5.2 nears frontier AI capability, but lacks matching safeguards

AI safety nonprofit SaferAI has found that GLM-5.2, the open-weight model from China’s Z.ai, is only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 on cyber and dual-use biology capabilities. But the gap in safety practices between GLM-5.2 and its closed frontier rivals is widening. In SaferAI’s evaluation, run via Z.ai’s public API, GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given. Claude Opus 4.7, by contrast, refused so consistently on the same benchmark that SaferAI could not complete testing on it at all, according to the report. That benchmark, CyberGym, evaluates cybersecurity capabilities and was the same one OpenAI used in the evaluation preceding last month’s Hugging Face breach.

The result underscores a structural problem with open-weight models: once weights are downloaded, any safety measures a company applies to its hosted API become unenforceable, because users can remove or modify safeguards, fine-tune the model, or change its system prompts on their own hardware. “The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly,” Henry Papadatos, SaferAI’s executive director, told TechCrunch.

Closed frontier developers rely on classifiers, refusal training, and API-level controls to limit dangerous cyber and biological assistance, but those defenses are imperfect too — AI safety nonprofit Far.ai found hundreds of universal jailbreaks in frontier models including xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro. One mitigation, filtering offensive cybersecurity material out of training data, works better for biology than for cybersecurity, since it is difficult to train a model that excels at coding — AI’s biggest commercial driver — without it also becoming a capable hacker. Some developers instead selectively restrict what their models will do: Anthropic’s Opus 5, for instance, can search for vulnerabilities in uncompiled source code but not compiled software, per its system card, making it harder to use for offensive purposes.

In GLM-5.2’s case, SaferAI says Z.ai did not publish a safety framework, pre-deployment testing commitments, or a risk assessment for the model. TechCrunch asked Z.ai whether it had conducted internal or third-party frontier safety evaluations before release but did not receive a response.

Why it matters

As open-weight models close in on frontier capability, the debate is shifting from whether they can compete with closed models to how society manages the risk once a model this capable is released with no way to enforce safeguards after the fact.