A Chinese AI Model Nearly Matches the Best Western Systems. Its Safety Record Does Not.
A new evaluation finds GLM-5.2, an open-weight model from China's Z.ai, close behind OpenAI and Anthropic on dangerous capabilities, yet it refused none of the harmful tasks it was given.
Key points
- GLM-5.2, an open-weight AI model from China's Z.ai, sits only months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 in dangerous cyber and biology capabilities, according to a 2025 SaferAI report.
- GLM-5.2 refused zero offensive cyber or dual-use biology tasks in SaferAI's evaluation; Claude Opus 4.7 refused so consistently that the same test could not be completed on it at all.
- Because GLM-5.2's model weights (the raw files that make the AI run) are publicly downloadable, any safety settings Z.ai applies to its hosted service cannot follow the model once someone runs it on their own computer.
- SaferAI says Z.ai published no safety framework, pre-deployment testing commitments, or risk assessment for GLM-5.2.
- Defenders and attackers both use open-weight models; Hugging Face reportedly relied on GLM-5.2 to help repel a recent breach linked to OpenAI.
A Chinese AI model has pulled close to the world's most capable systems, and a safety nonprofit says it will help with almost anything a user asks, including tasks that could fuel cyberattacks or dangerous biology experiments.
SaferAI, an AI safety nonprofit, tested GLM-5.2, the latest open-weight model from Chinese company Z.ai, and found its capabilities in offensive cybersecurity and dual-use biology (meaning biological knowledge that could be misused to cause harm) lag only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7, currently among the most powerful AI systems available. The evaluation was first reported by TechCrunch AI.
What did the tests actually show?
GLM-5.2 completed every offensive cyber and dual-use biology task SaferAI put to it. Claude Opus 4.7, by contrast, refused so consistently that evaluators could not finish CyberGym, a benchmark that scores a model's cybersecurity capabilities, on it at all.
SaferAI executive director Henry Papadatos put it plainly: "The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly."
Closing the capability gap is not automatically a problem. It only becomes one when safety practices do not keep pace.
Why can't Z.ai just block the dangerous requests?
Z.ai can, and does, apply safety filters to the version of GLM-5.2 it hosts on its own servers. The problem is that GLM-5.2 is open-weight: the underlying model files are downloadable by anyone. Once a person downloads those files and runs the model on their own hardware, Z.ai's filters go with them exactly nowhere.
Closedmodels from companies like OpenAI and Anthropic rely on classifiers (software that scans requests and flags harmful ones), refusal training (teaching the model to say no to dangerous prompts), and API-level controls (rules baked into the service interface). None of those tools reach an open-weight model running on someone else's machine.
Even closed models are not airtight. A separate report from AI safety nonprofit Far.ai found hundreds of reusable "jailbreaks" (tricks that fool a model into ignoring its safety rules) in models including xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro. Attackers tend to combine roleplaying scenarios, fake authority, and invented conversation histories to get past a model's defences.
What can actually be done?
One partial solution is filtering training data before a model is built, removing dangerous cybersecurity material so the model never learns it. Some research suggests this can cut hazardous biological knowledge without hurting overall performance. Cybersecurity is harder: a model that codes well is, almost by definition, a capable hacker, and coding is where AI companies earn most of their money.
Anthropic has taken a narrower approach with its Opus 5 model card, allowing the model to find vulnerabilities in uncompiled source code but not in compiled software, making it harder to use for direct attacks.
Paradoxically, open-weight models also help defenders. Hugging Face reportedly used GLM-5.2 to help repel a recent breach. CEO Clem Delangue wrote this week that the same systems used to stop one AI-powered attack "can now help defend against millions of cyberattacks every day."
Papadatos is sceptical that benefit justifies the risk. "By default attackers adopt new tools faster than defenders do," he said. "A ransomware group can change its methods in a week. A hospital cannot."
| Model | Developer | Refused CyberGym tasks? | Weights publicly downloadable? |
|---|---|---|---|
| GLM-5.2 | Z.ai (China) | No | Yes |
| Claude Opus 4.7 | Anthropic | Yes (fully) | No |
| GPT-5.5 | OpenAI | Partial | No |
| Grok 4.5 | xAI | Partial (jailbreaks found) | No |
| Gemini 3.1 Pro | Google DeepMind | Partial (jailbreaks found) | No |
Common questions
Does this mean GLM-5.2 is illegal to download?
No. Downloading and running an open-weight AI model is legal in most countries. The concern is not the download itself but what someone could do with a model that refuses no harmful requests.
What should ordinary people take from this?
If you use any AI chatbot or service, it is worth knowing that the safety of the underlying model varies enormously. Tools built on closed, safety-tested models carry fewer risks than ones built on freely downloadable, unrestricted models.
Is China regulating any of this?
China does have AI regulations, but according to Stanford Cyber Policy Center researcher Graham Webster, they have historically focused on politically sensitive content and social stability rather than catastrophic risks like cyberattacks or biological misuse.
