SaferAI warns open-weight GLM-5.2 is closing the frontier capability gap — without frontier safety

A new evaluation from AI safety nonprofit SaferAI finds that GLM-5.2, the open-weight model from China’s Z.ai, has narrowed the capability gap with the world’s frontier AI systems — while skipping the safety scaffolding those systems depend on. The report, run through Z.ai’s public API, is feeding an already heated debate over how powerful open models should be governed once their weights are public.

On offensive cyber and dual-use biology tasks, SaferAI says GLM-5.2 is only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7. But the divide between capability and mitigation is stark: GLM-5.2 refused none of the harmful tasks it was given. Anthropic’s model, by comparison, refused so consistently that SaferAI could not complete the CyberGym cybersecurity benchmark on it at all — the same benchmark OpenAI used in the evaluation that preceded last month’s Hugging Face breach.

The capability gap is closing faster than the safety gap

SaferAI’s central finding is less that an open model is powerful and more that its power arrives with fewer checks. “The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly,” Henry Papadatos, SaferAI’s executive director, told TechCrunch.

The timing matters. Policymakers are still debating how to govern systems like OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos. If open-weight models reach comparable capability in the same window, the debate shifts from whether they can compete to how society manages risk once anyone can run them.

Download the weights, and the safeguards disappear

Z.ai could apply safety measures to its hosted API. Those protections become unenforceable the moment someone downloads the model and runs it on their own hardware, where safeguards can be removed, weights fine-tuned, and system prompts rewritten.

Closed-frontier developers typically rely on classifiers, refusal training and API-level controls to limit dangerous cyber and biological assistance. Those measures are not foolproof either: AI safety nonprofit Far.ai found hundreds of universal jailbreaks — reusable keys that succeed on most harmful requests — in models such as xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro. The report says jailbreaks succeed by combining roleplaying, authority impersonation, fake conversation history and follow-up prompts to amplify weak points in a model’s defences.

But as SaferAI notes, the protections built for closed models do not transfer to open-weight ones, which are designed to run on any infrastructure with any set of safeguards — or none at all.

What Z.ai did not publish

SaferAI says Z.ai published no safety framework, no pre-deployment testing commitments and no risk assessment for GLM-5.2. TechCrunch asked the company whether it conducted internal or third-party frontier safety evaluations before release, but did not receive a response.

For Indian developers and enterprises that choose open-weight models for cost and customisation, this is the practical gap to watch: a model’s behaviour on a hosted API is not a guarantee of how it will behave after a local deployment, and without published evaluations there is little to verify before integration.

Where China’s rules draw the line

Chinese leaders have begun acknowledging advanced AI risks. At the World AI Conference last month, President Xi Jinping stressed the importance of open-weight models while insisting AI must remain under strict human control.

Graham Webster of the Stanford Cyber Policy Center told TechCrunch that China’s existing AI regulations are robust, but have historically focused on politically sensitive content, misinformation and social stability — not catastrophic risks such as offensive cyber capabilities or biological misuse. Many Chinese policy researchers, Webster said, believe that if a genuinely novel frontier risk emerges, American companies will likely encounter it first. China’s real-name internet system gives regulators a layer of control over domestic use, and companies coordinate with regulators behind the scenes — which means how much internal testing happened before GLM-5.2’s release is largely unverifiable from outside.

The open-source defence

Advocates of open-weight models argue that releasing weights helps defenders as much as it might help attackers. Hugging Face, for instance, relied on GLM-5.2 to defend itself during last month’s breach. Papadatos’s own framing is more nuanced: “The objective should clearly be that the good capabilities — the safe ones — are accessible to anyone, and then we try to remove the bad ones, even in an open source fashion.”

One possible mitigation is pre-training data filtering — stripping hazardous information from training data before the model learns it. Some research suggests this can reduce dangerous biological knowledge without hurting overall performance. For cybersecurity, the report says, filtering is far less practical: teaching a model to code well tends to make it a reasonably good hacker too.

What remains unclear

Whether Z.ai ran internal or third-party frontier safety evaluations before releasing GLM-5.2.

Datos clave

Punto	Detalle
Fuente	TechCrunch AI
Fecha	2026-08-04T20:05:26+00:00
Tema	Open-weight AI models are catching up to the frontier. The safety gap remains.