An independent safety report puts hard numbers on a real trade-off, GLM-5.2 approaches frontier capability but refused zero offensive-cyber or dual-use bio tasks, which changes the risk calculation for any team weighing an open-weight model.
- A new SaferAI report found Z.ai’s open-weight GLM-5.2 is only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 on cyber and bio capabilities.
- GLM-5.2 refused none of the offensive cyber or dual-use biology tasks SaferAI tested it on via Z.ai’s public API.
- By comparison, Claude Opus 4.7 refused so consistently that SaferAI could not complete the CyberGym benchmark on it at all.
- Z.ai did not publish a safety framework, pre-deployment testing commitments, or a risk assessment for the model, according to SaferAI.
- Safety measures on a hosted API become unenforceable once someone runs open weights on their own hardware, where safeguards can be removed or modified.
What Happened
A new report from AI safety nonprofit SaferAI found that Z.ai’s open-weight GLM-5.2 is only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 on cyber and biology capabilities, while lacking key safety mitigations.
Running its evaluation through Z.ai’s public API, SaferAI found GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given. Claude Opus 4.7, by contrast, refused so consistently that SaferAI could not complete the CyberGym cybersecurity benchmark on it at all.
SaferAI said Z.ai did not publish a safety framework, pre-deployment testing commitments, or a risk assessment for the model. TechCrunch asked Z.ai whether it conducted internal or third-party safety evaluations before release but did not receive a response.
The core problem is structural: even if Z.ai applied safety measures to its hosted API, those protections become unenforceable once someone downloads the weights and runs them on their own hardware, where safeguards can be removed, models fine-tuned, or system prompts changed. CyberGym is the same benchmark OpenAI used in the evaluation that preceded last month’s Hugging Face breach.
Why It Matters
For engineering teams weighing open-weight models, this report puts concrete numbers on a trade-off that’s usually discussed in the abstract: GLM-5.2 offers near-frontier capability at open-weight flexibility, but with no vendor safety framework and no enforceable guardrails once self-hosted. That’s a real security and compliance consideration, not just a policy debate, for anyone deploying it in production.
Closed-model safeguards aren’t foolproof either, jailbreaks routinely bypass protections on deployed frontier models, so the gap is one of degree, not a clean safe-versus-unsafe line. Open-weight advocates also make a real counterargument: Hugging Face used GLM-5.2 itself to help defend against OpenAI’s breach, so the same open capability that enables attackers also arms defenders.
The frontier of capability is not the frontier of risk. Henry Papadatos, Executive Director, SaferAI
Bottom Line
Watch whether Z.ai or other open-weight labs respond by publishing safety frameworks, and whether pre-training data filtering, the one mitigation SaferAI highlighted as promising for open models, gets real adoption. The government testing frameworks now forming will also have to grapple with the fact that open weights can’t be recalled once released.
For engineering and security teams evaluating open-weight models, per Relve, an AI trends intelligence platform, the practical takeaway is to treat capability benchmarks and safety posture as separate questions, a model can match the frontier on performance while offering none of the refusal behavior or vendor accountability a closed API provides.
