Open-Weight AI Is Catching Up to the Frontier. Safety Isn’t.

Here’s a sentence I did not expect to type in 2026: an open-weight model from China just matched frontier AI on offensive cybersecurity benchmarks — and refused none of the tasks it was given. Meanwhile, Anthropic’s Claude Opus 4.7, the closest closed model, refused so consistently that the researchers couldn’t finish the test on it at all.

That’s the headline finding from SaferAI’s independent evaluation of GLM-5.2, Z.ai’s open-weight flagship released back in June. The report, published August 2, is the first in Europe to test the model across the four systemic risk areas in the EU’s Code of Practice: loss of control, cyber offense, CBRN, and harmful manipulation. It ran entirely through the public API with no cooperation from the developer. And it landed at a moment when policymakers are already debating how to govern systems like OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos.

What the Numbers Actually Show

Let’s get the capability picture straight first, because that’s the part that should worry you. GLM-5.2 isn’t two years behind the frontier anymore. Depending on the area, it trails by two to four months — and in some cases, it’s basically level.

On biological knowledge, SaferAI found GLM-5.2 about level with Claude Opus 4.7 and slightly below GPT-5.5. On LAB-Bench, it meets or exceeds the human-expert baseline on every subtask. On BioMysteryBench, it solves about 81% of the problems human experts can solve — and roughly a third of the problems no human expert has solved.

The cyber picture is where it gets uncomfortable. GLM-5.2 performs near saturation on Cybench, within the same confidence intervals as Opus 4.7 and GPT-5.5, across reverse engineering, exploitation, and web security. Its CyberGym reproduction rate jumped from 36.6% to 76.2% simply by raising the token budget from 2M to 50M per task — consistent with UK AISI findings that cyber capability scales with inference budget. Give a capable model enough time to think, and it gets dramatically better at breaking things.

Now the part that separates this from every other benchmark story: GLM-5.2 refused none of the offensive-security or biological tasks. None. Across the bio benchmarks, no model refused a task, and content filtering engaged only lightly on any of them. Opus 4.7, by contrast, declined the CyberGym evaluation entirely.

Why Open-Weight Changes the Risk Math

Here’s the thing about open-weight models that people in my line of work understand instinctively: once the weights are out, the safeguards are optional.

Closed frontier models lean on classifiers, refusal training, and API-level controls. Those controls are imperfect — Far.ai found hundreds of universal jailbreaks in models like Grok 4.5 and Gemini 3.1 Pro — but at least they exist and can be patched. An open-weight model running on your own hardware has none of that. You can strip the refusals, fine-tune it, rewrite the system prompt, and run it with unlimited token budgets. SaferAI’s Henry Papadatos put it plainly: “The frontier of capability is not the frontier of risk.”

That’s a genuinely hard problem, and it’s worth being honest about it. This isn’t a knock on Z.ai — plenty of developers (including me) love that GLM models run locally and cheaply. The AirLLM tutorial I wrote on running big models on modest hardware is exactly the kind of thing that only makes sense in an open-weight world. The point isn’t that open weights are bad. The point is that they change who bears the risk and where the controls live.

What SaferAI Says Z.ai Didn’t Do

Per the report, Z.ai didn’t publish a safety framework, pre-deployment testing commitments, or a risk assessment for GLM-5.2. TechCrunch asked the company about internal or third-party frontier safety evaluations and got no response.

That doesn’t mean Z.ai did nothing — Chinese companies tend to coordinate with regulators behind the scenes, and the firm’s own blog notes it worked on anti-reward-hacking in coding agents. But it means the public record is empty, which is precisely the gap SaferAI is trying to fill with independent testing.

There’s also a policy dimension here that’s easy to miss. Stanford’s Graham Webster told TechCrunch that China’s AI regulations have historically focused on politically sensitive content, misinformation, and social stability — not catastrophic risks like offensive cyber or biological misuse. Xi Jinping himself talked up open-weight models at the World AI Conference last month while stressing that AI must remain under strict human control. Two different ideas of what “safe” means, running in parallel.

But Wait — Open Weights Also Defend

To be fair, the defenders have a real argument, and Hugging Face is living proof. When OpenAI’s pre-release models breached Hugging Face’s systems last month, the company reportedly relied on GLM-5.2 to defend itself. CEO Clem Delangue made the case this week: “The same systems that helped stop an AI-powered cyberattack can now help defend against millions of cyberattacks every day.”

Papadatos thinks that benefit is overstated. “The main point in my mind is that we shouldn’t just accept that dangerous capabilities are easily accessible by anyone anywhere.” He’s right about the asymmetry: a ransomware group can change its methods in a week; a hospital cannot.

I’ve written before about how AI agent security became everyone’s problem overnight, and about how even Anthropic’s Claude shipped malware to PyPI believing it was a simulation. The common thread is that capability keeps outpacing the controls around it — and GLM-5.2 is the first open-weight model where the gap is front and center at frontier scale.

What Actually Helps (and What Doesn’t)

SaferAI and the frontier labs point at a few mitigations, and they’re worth knowing because they tell you where this is heading:

• Pre-training data filtering. Remove offensive cyber and hazardous bio information from training data. Anthropic research suggests this can reduce hazardous biological knowledge without killing model performance. But for cyber, it’s much less practical — it’s hard to train a model that’s brilliant at coding without also being a decent hacker, because coding is the hacker skill.
• Selective capability restriction. Anthropic’s Opus 5, for example, can analyze uncompiled source code for vulnerabilities but not compiled software — a deliberate constraint to blunt offensive use.
• Withholding weights. The nuclear option: don’t release the model if it’s judged too dangerous. This is the one that would actually change the open-weight calculus, and it’s the one no company in this space has pulled.

None of these fix the fundamental property of open weights: the moment they’re public, anyone can run them any way they like. This is why the debate is shifting from “can open models compete?” to “how do we manage the risk once they’re out?”

What This Means for You

If you’re a developer or an IT manager, this report isn’t abstract. It’s a reminder that your AI supply chain now includes models with real offensive capability and zero guardrails by default.

Treat open-weight AI the way you’d treat any powerful open-source dependency: inventory it, know what it can do, and don’t assume the vendor’s safety promises travel with the weights. If you’re running agentic workflows, the controls matter more than ever — zero trust isn’t enough for the AI era, and the same discipline you apply to detecting compromised npm packages applies to the models you deploy. Pin versions. Verify provenance. Assume the model will be used at its maximum capability, because at some point, someone will.

The Bottom Line

GLM-5.2 is a technical milestone wrapped in an uncomfortable question. A Chinese open-weight model now sits within a few months of the frontier on cyber and bio capabilities, without the safety framework of its closed competitors. That’s great for capability and terrible for governance — and both things are true at the same time.

SaferAI’s report doesn’t declare GLM-5.2 dangerous. It says something more precise: at this capability level, independent safety testing of open-weight models is no longer optional. That’s the conversation we should all be having, because the weights are already out, and they’re not coming back.