Open-weight AI models are catching up to the frontier. The safety gap remains.

As policymakers discuss how to regulate powerful AI systems such as OpenAI's GPT-5.6 Sol and Anthropic's Mythos, a Chinese open-weight model has closed the gap with industry leaders. GLM-5.2, developed by Z.ai in China, is nearly as capable as OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 in areas of cyber and biological potential, according to a report from AI safety organization SaferAI.

However, the gap between advanced capabilities and safety measures is widening. SaferAI's evaluation found that GLM-5.2 did not refuse any offensive cyber or biology tasks presented to it, whereas Claude Opus 4.7 refused so consistently it couldn't complete CyberGym, a cybersecurity benchmark. This highlights the concern that open-weight models could make highly capable AI accessible to potential attackers with no way to monitor how they use it.

Henry Papadatos, SaferAI's executive director, told TechCrunch that while Z.ai could enforce safety measures on its hosted API, those protections cannot be enforced once users run the weights on their own hardware. OpenAI and Anthropic typically use classifiers, refusal training, and API-level controls to prevent dangerous cyber and biological assistance, but these measures can be bypassed through jailbreaks.

The report found hundreds of universal jailbreaks in frontier models like xAI's Grok 4.5 and Google DeepMind's Gemini 3.1 Pro.

Some argue that "pre-training data filtering," which removes offensive cybersecurity information from the training data, could help address this issue. However, this approach is less practical for cybersecurity due to the difficulty of creating a model that excels at coding without becoming a hacker. Instead, frontier developers have turned to selective restrictions on the types of cybersecurity assistance offered by their models, such as Anthropic's Opus 5, which can search for vulnerabilities in uncompiled source code but not compiled software.

Other measures include rigorous pre-deployment safety evaluations, publishing risk assessments, and withholding model weights if a system is deemed too dangerous. Z.ai, however, did not publish any safety framework, pre-deployment testing commitments, or risk assessment for GLM-5.2. Chinese leaders have acknowledged the risks of advanced AI, with President Xi Jinping emphasizing the importance of open-weight models while also stressing the need for strict human control.

Chinese policy researchers believe that if an existential risk emerges, American companies will likely encounter it first.