Chinese Open-Weight AI Model GLM-5.2 Refused Zero Cyberattack and Bioweapon Requests in Safety Test

GLM-5.2, an open-weight model released by China's Z.ai, refused zero offensive cybersecurity tasks and zero dual-use biology tasks during testing, according to a new evaluation from AI safety nonprofit SaferAI. Zero out of however many it was given. Not "most." Not "nearly all." None.

Compare that to Anthropic's Claude Opus 4.7. SaferAI reported that Opus 4.7 refused cyberattack-related requests so consistently that researchers couldn't even finish running CyberGym, the benchmark itself, on the model. CyberGym is the same tool OpenAI used in an evaluation ahead of a Hugging Face data breach last month.

On raw capability, according to SaferAI, GLM-5.2 is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber and biological task performance. The headline policymakers should be paying attention to: the gap between China's open models and America's frontier labs is shrinking fast on the capability side, even as it's widening on the safety side.

Why open-weight models change the equation

Closed models like GPT-5.6 Sol, Anthropic's Mythos, and Opus 4.7 run behind a company's servers. OpenAI and Anthropic can apply classifiers, refusal training, and API-level filters to block someone from asking a model how to build a bioweapon or write malware. Imperfect, but it's something.

Open-weight models don't work that way. Once Z.ai publishes the weights, anyone can download them and run the model on their own hardware. At that point, every safeguard Z.ai built is optional. Strip the refusal training, change the system prompt, fine-tune it on jailbreak data, whatever. There's no company on the other end of the line to say no.

Henry Papadatos, executive director of SaferAI, put it plainly to TechCrunch: "The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly."

A model that can help someone build a cyberweapon is dangerous whether or not it happens to also be impressive at coding or math. Capability benchmarks alone don't tell you the risk. Capability plus zero refusals does.

Closed models aren't bulletproof either

Before anyone gets too comfortable with the idea that American closed models have this solved, they don't. Far.ai, another AI safety nonprofit, found hundreds of what it calls universal jailbreaks on frontier models including xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro. These are reusable prompts that work on most harmful requests, not one-off tricks.

According to Far.ai's findings, attackers get through by stacking manipulation tactics: roleplay scenarios, fake authority claims, invented conversation history, layered follow-up prompts. Combine enough of those and a supposedly refusal-trained model caves.

The honest picture is this: closed models have safeguards that mostly work until someone puts in the effort to break them, and open-weight models have safeguards that stop working the moment they're downloaded. Neither is a clean solution. One is just harder to defeat than the other.

The policy fight this feeds

This is exactly the argument critics of open-weight AI have been making for years, according to TechCrunch's reporting: put highly capable systems out in the open with no way to police what people do after they hit download, and eventually someone with bad intentions is going to use one.

Defenders of open-weight models argue the alternative, locking all frontier capability behind a handful of American companies, concentrates power and stifles competition and research. Open models let smaller labs, universities, and foreign researchers build on top of the work instead of depending on OpenAI or Anthropic's permission and pricing. That's a real tradeoff, not a strawman, and it's the same argument that's fueled the broader open-source software and hardware movements for decades.

Papadatos didn't argue for banning open-weight models outright. He told TechCrunch the goal should be making "the good capabilities — the safe ones — accessible to anyone, and then we try to remove the bad ones, even in an open source fashion." Easier said than done when the bad capabilities and the good ones often live in the same set of weights.

There's no U.S. regulatory framework right now that specifically restricts release of open-weight models based on dual-use risk scores like SaferAI's. Congress hasn't passed anything, and no agency has announced an investigation into Z.ai or GLM-5.2. This is a capability gap and a safety gap sitting in plain view, with policymakers still arguing about whether to do anything about it at all.