Chinese open-weight model GLM-5.2 matches frontier AI on capabilities—but lacks safety guardrails

The release of GLM-5.2 marks a turning point in the open-weight AI debate. For years, critics warned that open-weight models could put highly capable AI into the hands of attackers with no way to police its use once downloaded. SaferAI's evaluation confirms that concern is no longer theoretical: a Chinese model has closed the gap with frontier systems on dangerous capabilities—cyber and biological—while providing no safety guardrails to match. The division is stark. Frontier developers like OpenAI and Anthropic use classifiers, refusal training, and API-level controls to limit dangerous assistance. But those measures are designed for closed systems where the developer retains control. Once weights are released, those protections vanish.

The challenge for the industry is structural. For cybersecurity, filtering training data to remove offensive knowledge is impractical: coding and hacking overlap so much that a model excelling at one will be good at the other, and coding has become AI's biggest commercial driver. Developers face pressure to keep improving those capabilities even as they search for ways to limit misuse. Frontier models have responded with selective restrictions—for example, Anthropic's Opus 5 can search for vulnerabilities in source code but not compiled software—but such measures only work on closed systems. The debate is now moving from capability parity to risk management at scale: how do you ensure that good, safe capabilities are widely accessible while keeping dangerous ones out of reach when the model code itself is public?