On cyber and biology skills GLM-5.2 came within a few months of OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7, the safety nonprofit SaferAI found — and whatever protections Z.ai puts on its own API stop applying the moment someone downloads the weights.

The tasks were offensive cybersecurity and dual-use biology, put to the model through the public API Z.ai operates. It never refused one.

Claude Opus 4.7, run through the same evaluation, went the other way. It refused offensive cyber work so consistently that CyberGym, a benchmark for measuring cybersecurity capability, could not be completed on it at all.

Z.ai can wrap protections around the API it hosts. Nothing enforces them once a user pulls down the weights and runs them on their own machines, where safeguards can be stripped out or altered, the model fine-tuned and system prompts rewritten.

Frontier developers, OpenAI and Anthropic among them, lean on classifiers, refusal training and controls built into the API to hold back hazardous cyber and biological help. None of it is watertight — jailbreaks routinely defeat protections on closed models already in service — and none of it has any effect at all on models built to run on whatever infrastructure a user has, with whatever protections that user chooses, including none.

For GLM-5.2, the evaluation records, Z.ai issued no safety framework, no commitments to test the model before deploying it and no risk assessment. The company did not respond to TechCrunch's questions about whether any frontier safety testing, in-house or by outside parties, took place ahead of the launch.

SaferAI's executive director told TechCrunch that the cutting edge of what models can do and the cutting edge of danger are two different things, so judging risk properly means taking account of what mitigations a model has in place. He pointed to pre-training data filtering — removing offensive cybersecurity material from the training data and training the model on what is left — as one approach that could help.

Research suggests filtering of that kind can reduce a model's hazardous biological knowledge without harming its overall performance. For cybersecurity it is much less practical, because a general-purpose model that excels at coding is difficult to build without it also becoming a capable hacking tool.

Supporters of open weights make the opposite case, arguing that publishing weights improves security online, since defenders can turn the models against attacks and prepare for threats still to come; Hugging Face used GLM-5.2 to fend off the intrusion mounted by OpenAI's pre-release models. SaferAI's director told TechCrunch that advantage is exaggerated much of the time, and that it is not a reason to open-source hazardous capabilities.