Zhipu AI's open-weight GLM-5.2 model has narrowed the capability gap with frontier systems to just two to four months, according to an independent evaluation by safety nonprofit SaferAI. The model performed near saturation on offensive cybersecurity benchmarks while refusing none of the dangerous tasks it was given -- a sharp contrast with closed-weight systems from Anthropic and OpenAI, which consistently declined.
The report, published August 2, is the first external evaluation of GLM-5.2 in Europe. SaferAI tested the model across four systemic risk categories defined in the EU General-Purpose AI Code of Practice: loss of control, cyber offense, CBRN (chemical, biological, radiological, and nuclear), and harmful manipulation.
On Cybench, a benchmark measuring offensive cybersecurity sub-capabilities including reverse engineering, exploitation, and web security, GLM-5.2 performed within confidence intervals of Claude Opus 4.7 and GPT-5.5. On CyberGym, it matched Opus 4.6 and approached GPT-5.5. On biological knowledge, the model roughly matched Opus 4.7 and fell slightly below GPT-5.5.
The refusal gap was stark: GLM-5.2 turned down none of the offensive cyber or dual-use biology tasks. Claude Opus 4.7, by comparison, refused so consistently that SaferAI could not complete CyberGym on it at all.
The frontier of capability is not the frontier of risk. We do have to take into account the state of the mitigations as well to assess the risk properly.
-- Henry Papadatos, SaferAI executive director, speaking to TechCrunch
The findings align with a separate assessment by NIST's CAISI program, which found GLM-5.2's overall capabilities similar to GPT-5.2 (released December 2025) and its cyber capabilities comparable to Opus 4.6 (February 2026). NIST also flagged mixed results on safeguards and security.
GLM-5.2 was released June 16 as Zhipu's open-weight flagship, positioned for long-horizon software engineering tasks with a 1-million-token context window. The open weights mean anyone can download and run the model on their own hardware, removing or modifying any safety measures Zhipu might have applied to its hosted API.
The evaluation adds weight to an increasingly vocal debate about open-weight governance. Frontier developers like OpenAI and Anthropic rely on classifiers, refusal training, and API-level controls that are not available to self-hosted instances. While jailbreaks routinely bypass protections on deployed models, the open-weight scenario removes even the baseline barrier.
SaferAI did not issue an overall risk judgment from its results but concluded they reinforce the case for more systematic, independent safety testing of open-weight models at this capability level.
Separately, application security firm Semgrep published its own benchmarks showing GLM-5.2 outperformed Claude Code on IDOR vulnerability detection, scoring 39% F1 versus 32%, at roughly $0.17 per vulnerability found. The open-weight model was tested without the scaffolding or multimodal pipeline that Semgrep's own commercial product uses -- a raw prompt and codebase were sufficient.
GLM-5.2's rapid capability ascent, combined with its open-weight distribution, puts it at the center of a regulatory question that has not yet been answered: what happens when models anyone can download reach capabilities that were, until recently, restricted to a handful of companies with substantial safety infrastructure.
Sources
SaferAI: GLM-5.2 Risk Evaluation Report (August 2, 2026) -- safer-ai.org/research/glm-5-2-evaluation-report
TechCrunch: Open-weight AI models are catching up to the frontier. The safety gap remains (August 4, 2026)
NIST: CAISI Assessment of Z.ai -- GLM-5.2 (July 2026)
Semgrep: We have Mythos at Home: GLM 5.2 beats Claude in our cyber benchmarks
