SaferAI: China's Open-Weight GLM-5.2 Matches Frontier Cyber Capabilities but Refuses Zero Dangerous Requests

Open-Weight Models Close the Capability Gap — Safety Practices Don't Follow

A new report from AI safety nonprofit SaferAI finds that GLM-5.2, the open-weight model from China's Z.ai, is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber and biological capabilities. But according to the report, GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given during testing — a stark contrast to Claude Opus 4.7, which SaferAI says "refused so consistently" that researchers could not complete the CyberGym benchmark on it at all.

SaferAI ran its evaluation of GLM-5.2 through Z.ai's public API. CyberGym, the benchmark cited in the report, evaluates cybersecurity capabilities and was also used by OpenAI in the safety evaluation that preceded last month's Hugging Face breach.

The Core Problem: Safeguards Don't Travel With the Weights

Even if Z.ai applies safety measures to its hosted API, those protections become unenforceable once someone downloads and runs the model weights on their own hardware. At that point, users can strip out safeguards, fine-tune the model for new behavior, or override system prompts entirely.

"The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly," Henry Papadatos, executive director of SaferAI, told TechCrunch.

According to SaferAI, Z.ai did not publish a safety framework, pre-deployment testing commitments, or a risk assessment for GLM-5.2. TechCrunch asked Z.ai whether it conducted internal or third-party frontier safety evaluations before release but received no response.

Closed Models Aren't Immune Either

Frontier developers including OpenAI and Anthropic rely on classifiers, refusal training, and API-level controls to limit dangerous cyber and biological assistance. These measures are imperfect: separate research from nonprofit Far.ai found hundreds of universal jailbreaks — reusable prompts that succeed on most harmful requests — in frontier models including xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro. Far.ai found these jailbreaks succeed by combining techniques like roleplaying, authority impersonation, and fake conversation history to exploit weak points in a model's defenses.

Anthropic has taken a narrower mitigation approach with Opus 5, according to its system card: the model can search for vulnerabilities in uncompiled source code but not compiled software, making it harder to repurpose for offensive attacks.

Why Filtering Training Data Doesn't Scale for Coding

One proposed fix — pre-training data filtering, where companies strip offensive cybersecurity or biological information from training data before training — has shown promise for reducing hazardous biological knowledge without degrading overall performance, according to some research cited by Papadatos. But it's far less practical for cybersecurity, since a model that excels at coding is difficult to separate from a model that excels at exploiting vulnerabilities. Because coding capability drives commercial revenue, developers face pressure to keep improving it even while searching for ways to limit misuse.

China's Regulatory Focus Differs from the U.S.

Graham Webster, who studies Chinese AI policy at the Stanford Cyber Policy Center, told TechCrunch that China has extensive AI regulations, but they have historically targeted politically sensitive content and social stability rather than catastrophic risks like offensive cyber or biological misuse. "U.S. AI thinkers are, in general, more concerned with this existential catastrophic [idea] than the Chinese community," Webster said.

Hugging Face CEO Clem Delangue has defended open-weight models, noting the platform used GLM-5.2 to defend against the recent OpenAI-related breach. Papadatos pushed back on that framing, arguing the industry should aim to make only "good capabilities" — not dangerous ones — easily accessible. "By default attackers adopt new tools faster than defenders do," he said. "A ransomware group can change its methods in a week. A hospital cannot."

What This Means

This report crystallizes a structural asymmetry in AI safety: capability benchmarks are converging across open and closed models, but safety infrastructure is not. Refusal training, classifiers, and API-level restrictions — the primary tools frontier labs use to limit misuse — simply don't exist once weights are in the wild. That leaves pre-training data filtering as one of the only mitigations that survives model download, and it only works reliably for biological risk, not cybersecurity, where filtering out dangerous knowledge would gut the model's commercial coding value. Expect increased pressure on open-weight developers like Z.ai to publish safety frameworks and pre-deployment evaluations, and continued scrutiny of whether voluntary disclosure — absent enforcement mechanisms — is sufficient as these models close the gap with GPT-5.5 and Claude Opus 4.7.