Open-weight AI models are catching up to the frontier. The safety gap remains. 

As policymakers statement however to govern progressively almighty AI systems similar OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos, a Chinese open-weight exemplary has narrowed the spread with the industry’s leaders.  

GLM-5.2, the open-weight AI exemplary from China’s Z.ai, is lone a fewer months down OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 connected cyber and bio capabilities, according to a new report from AI information nonprofit SaferAI. But the disagreement betwixt frontier capabilities and information practices is growing. 

According to SaferAI’s evaluation, which the nonprofit ran via Z.ai’s nationalist API, GLM-5.2 refused nary of the violative cyber oregon dual-use biology tasks it was given. By comparison, Claude Opus 4.7 “refused truthful consistently that SaferAI could not implicit CyberGym connected it astatine all.” (CyberGym is simply a benchmark that evaluates cybersecurity capabilities. OpenAI utilized it successful the valuation that preceded past month’s Hugging Face breach.)

It’s a stark reminder of what immoderate critics person warned for years: that open-weight AI models could enactment highly susceptible AI into the hands of imaginable attackers, with nary mode to constabulary however they usage the exertion erstwhile they download the weights. With open-weight models rapidly approaching the capabilities of the world’s starring AI systems, the statement is moving from whether they tin vie to however nine manages risks erstwhile they are released. 

“The frontier of capableness is not the frontier of risk, and truthful we bash person to instrumentality into relationship the authorities of the mitigations arsenic good to measure the hazard properly,” Henry Papadatos, enforcement manager of SaferAI, told TechCrunch.

While Z.ai could use information measures to its hosted API, those protections go unenforceable erstwhile idiosyncratic runs the weights connected their ain hardware, wherever they tin region oregon modify immoderate safeguards, fine-tune the models, oregon alteration strategy prompts. 

Frontier developers similar OpenAI and Anthropic thin to trust connected safeguards similar classifiers, refusal training, and API-level controls to bounds unsafe cyber and biologic assistance. 

Those measures are acold from foolproof: jailbreaks routinely bypass protections connected deployed models. Far.ai, an AI information nonprofit, found hundreds of cosmopolitan jailbreaks — defined arsenic reusable keys that win connected astir harmful requests — successful frontier models similar xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro. According to the report, jailbreaks win erstwhile attackers harvester aggregate manipulation techniques — including roleplaying, authorization impersonation, fake speech history, and follow-up prompts — to amplify anemic points successful a model’s defenses. 

But the safeguards successful spot for closed models don’t enactment astatine each connected open-weight models, which are designed to tally connected immoderate infrastructure with immoderate acceptable of safeguards — oregon deficiency thereof.

“The nonsubjective should intelligibly beryllium that the bully capabilities — the harmless ones — are accessible to anyone, and past we effort to region the atrocious ones, adjacent successful an unfastened root fashion,” Papadatos said.

One method Papadatos noted could assistance is called “pre-training information filtering,” which is erstwhile an AI institution removes violative cybersecurity accusation from their grooming information and past trains the exemplary connected the curated dataset. 

Some research suggests this tin trim hazardous biologic knowledge without harming wide exemplary performance. However, for cybersecurity, information filtering is overmuch little practical. 

It’s hard to bid a wide exemplary that excels astatine coding but isn’t besides a bully hacker. Because coding has go AI’s biggest moneymaker, developers look unit to support improving those capabilities adjacent arsenic they hunt for ways to bounds misuse. 

Because of that, frontier developers person progressively relied connected different mitigations instead. One attack has been to selectively restrict the kinds of cybersecurity assistance models volition provide. Anthropic’s Opus 5, for example, tin hunt for vulnerabilities successful uncompiled root code, but not compiled software, per the model’s strategy card. The reasoning is that this makes it harder to usage Opus 5 for violative purposes. 

Others see rigorous pre-deployment information evaluations, publishing hazard assessments, and withholding exemplary weights if a strategy is perceived arsenic excessively dangerous. 

In GLM-5.2’s case, SaferAI says Z.ai didn’t people a information framework, pre-deployment investigating commitments, oregon hazard appraisal for the model. TechCrunch has asked Z.ai whether it conducted interior oregon third-party frontier information evaluations earlier release, but did not person a response. 

Chinese leaders person progressively acknowledged the risks of precocious AI. At the World AI Conference past month, Chinese President Xi Jinping emphasized the value of open-weight models, portion besides stressing the necessity of ensuring AI remains a instrumentality nether strict quality control. 

Graham Webster, who studies Chinese AI argumentation astatine the Stanford Cyber Policy Center, told TechCrunch that China has robust regulations governing AI, but those rules person historically focused connected politically delicate content, misinformation, and societal stableness alternatively than catastrophic AI risks similar violative cyber capabilities and biologic misuse. 

“U.S. AI thinkers are, successful general, much acrophobic with this existential catastrophic [idea] than the Chinese community,” Webster said, adding that galore Chinese argumentation researchers judge that if there’s genuinely going to beryllium a caller frontier risk, American companies volition apt brushwood it first. 

“The Chinese strategy has assurance that they power the usage of these technologies wrong China,” Webster continued. “Being online successful China is thing you bash attributed to your existent name, and companies tin beryllium held accountable, users tin beryllium held accountable.”

Webster mused that the aforesaid mechanics that exemplary providers usage for refusing to prosecute connected definite governmental topics tin perchance beryllium tweaked to marque definite models garbage to implicit violative cyber attacks oregon won’t present adverse biologic engineering outcomes. He added that due to the fact that Chinese companies thin to coordinate with regulators down the scenes, it tin beryllium pugnacious to cognize what interior investigating they’re conducting earlier release.

Advocates of open-weight AI reason that releasing the weights is important for cybersecurity due to the fact that it allows companies to support themselves against attacks — Hugging Face relied connected GLM-5.2 to support itself against OpenAI’s breach — and due to the fact that it allows them to amended hole for aboriginal threats if they cognize what’s coming.

“The aforesaid systems that helped halt an AI-powered cyberattack tin present assistance support against millions of cyberattacks each day, portion helping america place and hole vulnerabilities earlier attackers exploit them,” Clem Delangue, CEO of Hugging Face, said this week successful a societal media post.

Papadatos said that payment is often overstated, and doesn’t mean “we should open-source unsafe capabilities.”

“The main constituent successful my caput is that we shouldn’t conscionable judge that unsafe capabilities are easy accessible by anyone anywhere,” helium said, stressing that helium believes the manufacture should beryllium striving for lone making the “good capabilities” easy accessible. By default attackers follow caller tools faster than defenders do. For example, a ransomware radical tin alteration its methods successful a week. A infirmary cannot.”