A Chinese AI Model Nearly Matches the Best Western Systems. Its Safety Record Does Not.
A new evaluation finds GLM-5.2, an open-weight model from China's Z.ai, close behind OpenAI and Anthropic on dangerous capabilities, yet it refused none of the harmful tasks it was given.
Key points
- GLM-5.2, an open-weight model from China's Z.ai, sits only months behind GPT-5.5 and Claude Opus 4.7 in dangerous cyber and biology capabilities, according to a 2025 SaferAI report.
- GLM-5.2 refused zero offensive cyber or dual-use biology tasks in SaferAI's evaluation; Claude Opus 4.7 refused so consistently that the same test couldn't be completed on it at all.
- Because GLM-5.2's model weights (the raw files that make the AI run) are publicly downloadable, any safety filters Z.ai applies to its hosted service can't follow the model onto someone else's hardware.
- SaferAI says Z.ai published no safety framework, pre-deployment testing commitments or risk assessment for GLM-5.2.
- Defenders and attackers both use open-weight models; Hugging Face reportedly relied on GLM-5.2 to help repel a recent breach linked to OpenAI.
A Chinese AI model has pulled close to the world's most capable systems, and a safety nonprofit says it'll help with almost anything a user asks, including tasks that could fuel cyberattacks or dangerous biology experiments.
SaferAI tested GLM-5.2, the latest open-weight model from Chinese company Z.ai, and found its capabilities in offensive cybersecurity and dual-use biology (biological knowledge that could be misused to cause harm) lag only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7. We first reported on GLM-5.2 on 16 July 2026 and have tracked it across eight stories since. The evaluation was first reported by TechCrunch AI.
What did the tests actually show?
GLM-5.2 completed every offensive cyber and dual-use biology task SaferAI put to it. Claude Opus 4.7, by contrast, refused so consistently that evaluators couldn't finish CyberGym, a benchmark that scores a model's cybersecurity capabilities, on it at all.
SaferAI executive director Henry Papadatos told TechCrunch: "The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly."
Closing the capability gap isn't automatically a problem. It only becomes one when safety practices don't keep pace.
Why can't Z.ai just block the dangerous requests?
Z.ai can, and does, apply safety filters to the version of GLM-5.2 it hosts on its own servers. The problem is that GLM-5.2 is open-weight: the underlying model files are downloadable by anyone. Once someone runs those files on their own hardware, Z.ai's filters are irrelevant.
Closed models from companies like OpenAI and Anthropic rely on classifiers (software that scans requests and flags harmful ones), refusal training (teaching the model to decline dangerous prompts) and API-level controls (rules baked into the service interface). None of those tools reach an open-weight model running on someone else's machine.
Even closed models aren't airtight. Far.ai, an AI safety nonprofit, found hundreds of reusable "jailbreaks" (tricks that fool a model into ignoring its safety rules) in models including xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro. Attackers combine roleplaying scenarios with fake conversation histories to amplify weak points in a model's defences. Our earlier story on the Hugging Face breach showed the asymmetry plainly: defenders using commercial AI tools got blocked by safety filters; the attacker didn't.
What can actually be done?
One partial solution is filtering training data before a model is built, removing dangerous cybersecurity material so the model never learns it. Some research suggests this can cut hazardous biological knowledge without hurting overall performance. Cybersecurity is harder: a model that codes well tends to be a capable hacker too, and coding is where AI companies earn most of their money.
Anthropic has taken a narrower approach with its Opus 5 model card, allowing the model to find vulnerabilities in uncompiled source code but not in compiled software, making it harder to use for direct attacks.
Open-weight models also help defenders. Hugging Face reportedly used GLM-5.2 to help repel a recent breach. CEO Clem Delangue wrote this week that the same systems used to stop one AI-powered attack "can now help defend against millions of cyberattacks every day."
Papadatos is sceptical that benefit justifies the risk. "By default attackers adopt new tools faster than defenders do," he told TechCrunch. "A ransomware group can change its methods in a week. A hospital cannot."
| Model | Developer | Refused CyberGym tasks? | Weights publicly downloadable? |
|---|---|---|---|
| GLM-5.2 | Z.ai (China) | No | Yes |
| Claude Opus 4.7 | Anthropic | Yes (fully) | No |
| GPT-5.5 | OpenAI | Partial | No |
| Grok 4.5 | xAI | Partial (jailbreaks found) | No |
| Gemini 3.1 Pro | Google DeepMind | Partial (jailbreaks found) | No |
Common questions
Does this mean GLM-5.2 is illegal to download?
No. Downloading and running an open-weight AI model is legal in most countries. The concern isn't the download itself but what someone could do with a model that refuses no harmful requests.
What should ordinary people take from this?
If you use any AI chatbot or service, the safety of the underlying model varies enormously. Tools built on closed, safety-tested models carry fewer risks than ones built on freely downloadable, unrestricted models.
Is China regulating any of this?
China does have AI regulations, but Stanford Cyber Policy Center researcher Graham Webster told TechCrunch they've historically focused on politically sensitive content and social stability rather than catastrophic risks like cyberattacks or biological misuse.
