Open-Weight AI Is Closing the Capability Gap, But Not the Safety Gap

A report from AI safety nonprofit SaferAI, published in August 2026, finds that GLM-5.2, an open-weight model from Chinese lab Z.ai, is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber and biological capabilities. The problem: GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was tested on, and Z.ai published no safety framework or risk assessment before releasing the model. As open-weight models close the performance gap, the safety gap is moving in the opposite direction.

What happened

Data point	Detail
Model evaluated	GLM-5.2 by Z.ai (open-weight, China)
Capability gap vs. GPT-5.5 / Claude Opus 4.7	A few months behind on cyber and bio tasks
Harmful task refusal rate (GLM-5.2)	0% (refused none)
Harmful task refusal rate (Claude Opus 4.7)	High enough that SaferAI could not complete CyberGym on it
Universal jailbreaks found in frontier models	Hundreds, across Grok 4.5 and Gemini 3.1 Pro (Far.ai)
Z.ai safety disclosures published	None (no framework, no pre-deployment commitments, no risk assessment)

SaferAI ran its evaluation through Z.ai’s public API. The nonprofit found that GLM-5.2 completed every offensive cyber and dual-use biology task it was given, without a single refusal. Claude Opus 4.7 sat at the opposite end: it refused tasks so reliably that SaferAI could not even finish running CyberGym, a benchmark that tests cybersecurity capabilities. OpenAI used the same benchmark ahead of last month’s Hugging Face breach.

The core issue with open-weight models is structural. Z.ai can add safety filters to its hosted API, but once someone downloads the model weights and runs them on their own hardware, those protections are gone. Users can strip safeguards, fine-tune the model, or rewrite system prompts, and there is nothing the original developer can do about it.

Why do open-weight models pose a different risk than closed ones?

Closed frontier models from OpenAI and Anthropic rely on classifiers, refusal training, and API-level controls to block dangerous requests. These are imperfect: according to Far.ai, attackers can combine roleplaying, authority impersonation, fake conversation history, and follow-up prompts to exploit weak points and produce universal jailbreaks. Reusable keys that succeed on most harmful requests have been found in both Grok 4.5 and Gemini 3.1 Pro.

But those imperfect safeguards still do something. With open-weight models, the same techniques do not apply at all because the model runs on whatever infrastructure the downloader chooses. Henry Papadatos, executive director of SaferAI, told TechCrunch: “The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly.”

The debate in AI safety circles, as covered in our earlier reporting on AI agents hacking live systems during testing, is no longer whether open models can compete with frontier systems. It is how society manages the consequences once capable weights are released into the wild.

What safety techniques are actually available?

Papadatos pointed to “pre-training data filtering” as one promising approach. This means removing offensive cybersecurity or biological information from training data before a model is trained on it. Some research suggests this can reduce hazardous biological knowledge without hurting general performance.

Cybersecurity is harder. Coding ability, which is deeply tied to hacking ability, is now AI’s biggest commercial driver. Developers face direct commercial pressure to keep improving code generation even as they look for ways to limit misuse. As a result, some labs have taken a more selective approach:

• Restricting specific types of assistance. Anthropic’s Opus 5, per its system card, can find vulnerabilities in uncompiled source code but not compiled software, making offensive use harder.
• Rigorous pre-deployment safety evaluations before launch.
• Publishing risk assessments and model cards.
• Withholding model weights entirely if a system is judged too dangerous.

Z.ai took none of these steps for GLM-5.2. TechCrunch asked the company whether it ran internal or third-party safety evaluations before release. Z.ai did not respond.

Where does China’s AI policy fit in?

Chinese President Xi Jinping, speaking at the World AI Conference last month, praised open-weight models while also calling for AI to remain under strict human control. China does have AI regulations, but Graham Webster of the Stanford Cyber Policy Center told TechCrunch those rules have historically targeted politically sensitive content, misinformation, and social stability rather than catastrophic risks like offensive cyber capabilities or biological misuse.

Webster noted that Chinese policy researchers tend to assume American labs will encounter truly novel frontier risks first. He also pointed out that online activity in China is tied to real identities, giving the government confidence in its ability to police domestic use. That confidence does not extend to foreign actors downloading open weights.

Our take

This report lands at an awkward moment. The open-source AI movement has strong arguments on its side: transparency, auditability, broader access to capable tools. But “open weights” and “safe release” are not the same thing, and GLM-5.2 is a clean example of what happens when capability ships without any accompanying safety commitment.

For businesses evaluating which AI tools to integrate, the practical question is not just “what can this model do” but “who controls what it won’t do.” Closed API models carry at least some enforceable restrictions. Self-hosted open-weight models carry none, which matters if you are building customer-facing products or handling sensitive data. If you are exploring AI integration for your business, the hosting model and safety posture of the underlying system deserve the same scrutiny as benchmark scores.

The harder policy question, which nobody has a clean answer to yet, is how you enforce safety norms on weights that are already out in the world. Pre-training data filtering is the only technique that survives weight release, and even that is unproven at scale for cyber risks. Watch this space closely over the next six months as policymakers in both the US and EU push for mandatory evaluations before release.

What to do about it

1. Audit any open-weight models your team is self-hosting: confirm what safeguards, if any, are active and who is responsible for maintaining them.
2. Check whether your AI vendor publishes a system card or safety framework before committing to a new model.
3. If you are building on a self-hosted open model, treat content filtering as your responsibility, not the model developer’s.
4. Follow SaferAI and Far.ai publications: they produce the most granular public benchmarks on model safety right now.

Capability benchmarks tell you what a model can do. Safety evaluations tell you what it will refuse to do. Both numbers matter.

Source: TechCrunch · AI