Open-weight AI models are catching up to the frontier. The safety gap remains.

The gap between what AI can do and what AI companies will let it do just got a lot more interesting. SaferAI, an AI safety nonprofit, ran GLM-5.2 through the same cyber and biology tests used on frontier models and found it performs only a few months behind GPT-5.5 and Claude Opus 4.7. That's the good headline for Z.ai, the Beijing-based lab behind it. The bad headline: when SaferAI asked GLM-5.2 to attempt offensive cyber and dual-use biology tasks, it refused none of them. Claude Opus 4.7, tested the same way, refused so often that SaferAI couldn't even finish running the CyberGym benchmark on it.

That contrast matters because open-weight models can't be walled off the way API-based ones can. Z.ai could theoretically bolt safety filters onto its hosted version, but once someone downloads the weights and runs them on their own machine, those filters are optional at best. Fine-tune it, swap the system prompt, strip the refusal training — it's all fair game once the model leaves the building. Henry Papadatos, SaferAI's executive director, put it plainly: capability and risk aren't the same frontier, and mitigations have to be judged on their own.

Frontier labs aren't exactly nailing this either. Far.ai found hundreds of reusable jailbreaks that work on models like Grok 4.5 and Gemini 3.1 Pro, often by stacking tricks — fake roleplay, impersonated authority, invented chat history — until the model's defenses crack. Anthropic has tried narrower fixes, letting Opus 5 scan uncompiled source code for vulnerabilities while blocking it from touching compiled software, on the theory that this limits offensive use. Data filtering during training can strip out some dangerous biology knowledge without wrecking performance, but doing the same for cybersecurity is nearly impossible — a model that can't hack well usually can't code well either, and coding is AI's biggest revenue driver.

Z.ai, notably, published none of the usual paperwork: no safety framework, no pre-deployment testing commitments, no risk assessment. TechCrunch reached out to ask if any evaluation happened before release and got no answer. Graham Webster, who studies Chinese AI policy at Stanford, says this tracks with a broader pattern — Chinese regulators have historically focused on political content and social stability rather than catastrophic misuse scenarios, partly because officials there believe if a truly novel AI risk emerges, American labs will hit it first. China's real-name internet policies, Webster notes, give the government a different kind of leverage: accountability through identity tracking rather than model-level refusal.

Hugging Face's CEO, Clem Delangue, has pointed to GLM-5.2 helping defend against an OpenAI-linked breach as proof open weights strengthen cybersecurity overall. Papadatos isn't buying the trade as an excuse to skip safeguards, arguing the industry should aim to keep the useful capabilities open while actually removing the dangerous ones — not just shrug and ship both. His closing point lands hard: attackers move fast by default, retooling in a week if needed. Hospitals, power grids, and everyone else on defense don't get that luxury.