Open-weight AI Models Are Nearly Frontier-Grade — and Far Harder to Contain

Open-weight AI models are rapidly closing the performance gap with the most advanced closed systems, but a new safety assessment says their risk controls are not keeping pace. In a fresh report released Tuesday, the AI safety nonprofit SaferAI found that Z.ai’s GLM-5.2 is now only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 on cyber and biological capabilities, while offering far fewer practical safeguards once its weights are released.

That combination, experts warn, could make powerful AI easier to misuse. The report arrives just as governments and companies are wrestling with how to regulate frontier systems that can code, probe software weaknesses, and assist with biological research at levels that increasingly resemble human expertise.

SaferAI’s conclusion is simple but unsettling: capability is advancing faster than containment. As more open-weight models approach frontier performance, the question is no longer whether they can compete with the best closed models, but how the industry will keep dangerous capabilities from spreading beyond any one provider’s control.

What SaferAI found about GLM-5.2

SaferAI’s evaluation places GLM-5.2 among the strongest open-weight models in the world, especially in offensive cybersecurity and dual-use biology tasks. The group said the model, which it tested through Z.ai’s public API, did not refuse any of the harmful requests it was given in those categories.

That result stands in sharp contrast to Anthropic’s Claude Opus 4.7, which SaferAI said was so restrictive that the nonprofit could not complete its CyberGym testing on the model. CyberGym is a benchmark designed to measure cybersecurity capability, and it has become an important reference point in recent AI safety work.

The takeaway is not just that GLM-5.2 can perform close to frontier models. It is that the model appears to be far more willing to assist with dangerous tasks, at least in the conditions SaferAI tested.

Why open-weight models worry safety researchers

Open-weight systems create a different risk profile from chatbot products accessed only through a company’s servers. When a provider releases the weights, anyone with sufficient computing infrastructure can run the model on their own hardware, alter its prompts, fine-tune it, strip out guardrails, or rebuild it with fewer restrictions.

That matters because the provider’s safety policies stop at the server boundary. A company can limit harmful answers in a hosted API, but once the model is downloaded, those controls are no longer enforceable in the same way.

Henry Papadatos, executive director of SaferAI, said the industry must stop equating model power with model risk.

“The frontier of capability is not the frontier of risk,” Papadatos told TechCrunch. “We do have to take into account the state of the mitigations as well to assess the risk properly.”

His argument reflects a growing split in AI policy debates. One camp says releasing weights is valuable because it democratizes access, enables independent auditing and helps defenders prepare for attacks. The other says the downside is that dangerous capabilities become portable, scalable and difficult to police.

How do frontier models defend against misuse?

Frontier developers such as OpenAI and Anthropic generally rely on layered controls rather than one single barrier. Those layers can include refusal training, classifier-based filtering, system prompts, usage monitoring and API-level restrictions that block or limit certain requests.

In theory, these measures can make it harder for a model to help with cyber intrusion, malware development or biological misuse. In practice, they are imperfect.

Jailbreaks continue to work against many deployed systems, especially when users combine techniques such as roleplay, impersonation, fabricated context and follow-up pressure. A separate report from the nonprofit Far.ai found hundreds of reusable jailbreaks in frontier models including xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro.

Those findings underscore a broader reality: even heavily guarded closed systems can fail under adversarial prompting. The problem becomes more acute with open-weight releases, where the provider’s defenses may not exist at all after download.

What makes open-weight models different from closed ones?

Open-weight models can be run on independent infrastructure, giving users much more control but also much less oversight. By contrast, closed models remain inside a provider’s technical and policy perimeter, allowing the company to throttle, monitor or revoke access when necessary.

That distinction is now central to the debate over AI governance. The same openness that encourages experimentation also creates a distribution channel for powerful tools that can be repurposed by bad actors.

• Closed model: Hosted by the provider, with runtime restrictions and logging.
• Open-weight model: Downloadable and modifiable by the user.
• Key consequence: Safety controls can be changed or removed after release.

Why safety gaps matter more as capability rises

SaferAI’s report lands at a moment when coding, security research and scientific assistance are among the most commercially valuable uses for AI. That commercial pressure creates a difficult tradeoff: the same skills that make a model useful for businesses can also make it dangerous in the wrong hands.

In cybersecurity, that tension is especially stark. A system that is strong at identifying vulnerabilities in code can also be used to hunt for weaknesses to exploit. And because attackers can adapt quickly, a model that lowers the barrier to offensive work can outpace defenders who must protect real-world systems on slower timelines.

Papadatos argued that this asymmetry should shape safety decisions.

He said the industry should aim to make helpful capabilities widely available while removing dangerous ones, rather than assuming that every advance should be open by default.

He also pointed out that attackers typically adopt new tools faster than defenders. A ransomware crew can alter tactics within days, he noted, while a hospital or enterprise security team often needs much more time to respond.

Can training data filtering solve the problem?

Not by itself. One proposed mitigation is pre-training data filtering, which means removing offensive or otherwise harmful material from the training set before the model learns from it.

Researchers have suggested that this can reduce dangerous biological knowledge without hurting a model’s overall performance too much. But the approach is less practical for cybersecurity, where a general-purpose coding model often needs to learn the same technical concepts that a malicious hacker would use.

That creates a hard structural problem: if a model becomes much better at software engineering, it may also become better at breaking software. For companies competing in the coding market, the incentive to improve those abilities is strong.

What safeguards are frontier labs using instead?

Because data filtering has limits, frontier labs are increasingly leaning on other mitigations. Some of those are technical, while others are procedural and organizational.

1. Selective refusal rules: limiting help on certain categories of cybersecurity questions.
2. Pre-deployment evaluations: testing models for dangerous capabilities before launch.
3. Risk assessments: publishing what can go wrong and how a company plans to handle it.
4. Weight withholding: declining to release model weights if the system is deemed too risky.

Anthropic offers one example of selective restriction. According to the system card for Opus 5, the model can help search for vulnerabilities in uncompiled source code but not in compiled software, a distinction intended to reduce offensive use.

Still, none of these measures are foolproof. The most sophisticated models can fail in ways that are hard to anticipate, and once a model is widely distributed, the burden of safety shifts from the provider to the user.

What did Z.ai disclose about GLM-5.2?

SaferAI says Z.ai did not publish the safety framework, pre-deployment testing commitments or risk assessment it expected to see for a model of GLM-5.2’s capability. TechCrunch said it asked Z.ai whether the company had conducted internal or third-party frontier evaluations before launch, but received no response.

That lack of public documentation is important because disclosure can give outside observers at least some way to judge whether a model was tested against realistic misuse scenarios. Without it, it becomes difficult to know whether the provider understood the risks before release.

For a model that performs near the frontier, safety documentation becomes more than a public-relations exercise. It is one of the few signals regulators, researchers and enterprise buyers can use to assess whether a company took the hazards seriously.

Why China’s AI debate looks different from the U.S. debate

Chinese officials have increasingly acknowledged the need to think about advanced AI risk. At last month’s World AI Conference, Chinese President Xi Jinping stressed the importance of open-weight models while also emphasizing that AI must remain under strict human control.

Even so, experts say the policy emphasis in China has historically been different from the one in the United States. Graham Webster, a researcher at Stanford’s Cyber Policy Center who studies Chinese AI policy, said Chinese regulation has focused more on politically sensitive content, misinformation and social stability than on catastrophic misuse such as offensive cyber operations or biological harm.

Webster said American AI thinkers are generally more focused on existential or catastrophic risk, while many Chinese researchers assume that if an entirely new frontier danger appears, U.S. companies will encounter it first.

He also noted that China’s regulatory system is built around strong accountability mechanisms, including real-name internet use and the ability to hold companies and users responsible for misuse.

That structure may make it easier, in theory, to enforce certain kinds of model behavior. But Webster cautioned that it remains difficult for outsiders to know exactly how Chinese companies test models internally before release, especially because much of the coordination with regulators happens behind the scenes.

Could Chinese models be steered away from harmful use?

In principle, yes. Webster suggested that the same techniques used to make models refuse political prompts could potentially be adapted to block offensive cyber requests or biologically harmful outputs.

In practice, he said, it is hard to judge how much testing or tuning is done before release because those efforts are rarely made fully public. That opacity adds another layer of uncertainty to an already complicated policy picture.

How open-weight advocates defend release

Supporters of open-weight AI say releasing weights is not just a philosophical preference but a practical benefit for defense. They argue that if more organizations can inspect, test and deploy these systems locally, they may also be better prepared to stop attacks.

Hugging Face, which relied on GLM-5.2 to help defend against a breach involving OpenAI, offered one of the most forceful arguments in favor of this view.

Clem Delangue, Hugging Face’s chief executive, wrote on social media that the same AI systems used to stop one cyberattack could help defend against huge volumes of attacks every day, while also helping security teams identify vulnerabilities before criminals exploit them.

That is a real benefit, and one reason open-weight models continue to attract developers, researchers and companies that want autonomy over their own infrastructure.

But SaferAI says the defensive case is often overstated if it is used to justify releasing highly dangerous capabilities without guardrails. In its view, the question should not be whether open models can help defenders, but whether those gains outweigh the possibility of making powerful misuse tools widely available.

The core policy question: access or containment?

The broader debate is shifting. A few years ago, the most common question was whether open models could ever match the top closed systems. SaferAI’s report suggests they are getting much closer.

Now the central issue is what happens next.

If open-weight models continue to converge with the frontier, governments may face pressure to move beyond general AI principles and toward more specific rules around release thresholds, safety testing, documentation and post-release accountability. Companies, meanwhile, will have to decide whether competitive pressure is enough to justify putting increasingly powerful systems into the wild.

The challenge is that the technology is moving faster than the norms around it. The same release that gives researchers more freedom can also provide attackers with a powerful new toolset. And once a model is out, there is no simple way to call it back.

That is why SaferAI’s report matters beyond the specific case of GLM-5.2. It suggests the industry may already be approaching a point where model capability is no longer the main bottleneck. The real bottleneck may be whether safety practices can keep up with the speed of distribution.

For policymakers, that means the next phase of AI governance may need to focus less on abstract worry and more on concrete release decisions: who gets access, under what conditions, with what testing, and with what accountability if something goes wrong.

For developers, it means the easy answer — that better models are simply better models — is no longer enough. As open-weight systems approach frontier quality, every release becomes a safety decision as much as a technical one.

And for everyone else, it means the most powerful AI may soon be easier to obtain, easier to modify and harder to control than ever before.