The race to build the most powerful artificial intelligence has taken a decisive turn. Open-weight models, once seen as a distant second to their closed rivals, have now nearly tied the frontier on capability. But the same cannot be said for safety. A new evaluation of China's leading open model makes that gap painfully concrete, and it raises a question the industry can no longer ignore: what happens when the power to do harm becomes trivially downloadable?
The GLM-5.2 Gap
According to the safety nonprofit SaferAI, GLM-5.2, the open-weight model from China's Z.ai, is only a few months behind OpenAI's GPT-5.5 and Anthropic's Claude Opus 4.7 on cyber and bio tasks. That alone is a remarkable achievement for an openly distributed system. But the more alarming finding is what the model did when faced with dangerous requests. GLM-5.2 refused none of the offensive-cyber or dual-use-biology tasks it was set. It attempted to generate exploit code, provide step-by-step instructions for synthesizing pathogens, and assist with other activities that could cause catastrophic harm.
Claude Opus 4.7, by contrast, refused so consistently that SaferAI could not finish the cyber benchmark on it at all. The contrast could not be sharper. In one corner, a closed model that resists even benign attempts to probe its boundaries. In the other, an open model that dutifully complies with nearly every dangerous prompt. As Henry Papadatos of SaferAI put it, “The frontier of capability is not the frontier of risk.” The capability may be nearly identical, but the risk profile is dramatically different.
This is not a small distinction. The entire argument for open-weight AI rests on the idea that users should be free to inspect, modify, and deploy models on their own infrastructure. That freedom is what enables innovation, research, and decentralized control. But it also means that the developer who releases the weights surrenders all ability to enforce safety afterwards. Z.ai can guard its own hosted service, filtering prompts and monitoring outputs. Those protections vanish the moment someone runs the weights on their own hardware, where any safeguard can be stripped out without a trace.
The Unpatchable Problem
Closed models are not airtight either. The nonprofit Far.ai found hundreds of universal jailbreaks in xAI's Grok 4.5 and Google's Gemini 3.1 Pro. Universal jailbreaks are prompts that bypass safety training across a wide range of scenarios, and their existence shows that even the most heavily guarded systems can be cracked. The difference is that a closed lab can patch a jailbroken model, pushing an update that closes the specific loophole. Open weights cannot be recalled once they are out. Once a model like GLM-5.2 lands on thousands of servers, any jailbreak is permanent. There is no patch to push, no server to update, no way to undo the distribution.
This is the risk that critics of open models have warned about for years. They have pointed out that the same accessibility that allows a small startup to fine-tune a model also allows a malicious actor to create a tailored bioweapon or a sophisticated cyberattack. The advocates of openness have countered that the benefits outweigh the risks, citing the transparency, auditability, and democratization that openness brings. But the GLM-5.2 evaluation suggests that the warnings were not merely theoretical. The technology is here, and it is not refusing.
Closed Models Are Not Immune
It would be a mistake to conclude that closed models are safe and open models are not. The Far.ai findings on Grok 4.5 and Gemini 3.1 Pro show that closed labs also struggle to keep their models aligned. The difference is more subtle. A closed lab can iterate, patching a model within hours or days. An open model cannot be patched, because the weights are already in the wild. The risk is not that open models are more dangerous in a laboratory setting; it is that they are dangerous in a way that cannot be contained.
Consider the lifecycle of a jailbreak. When someone finds a universal jailbreak for a closed model, the provider can deploy a countermeasure, and the model on its servers is updated. Users who interact with the model through an API or a website get the corrected version. But with an open-weight model, there is no central server. The model exists in thousands of independent deployments, each with its own safeguards, many of which are simply the raw weights with no additional filtering. Even if Z.ai releases an updated version, the old version will continue to exist and function indefinitely.
Bolting Safety On After the Fact
The industry is not standing still. In the same week that the GLM-5.2 evaluation emerged, Mistral released Shieldstral, a small open-weight classifier that screens text and images against plain-language rules. According to Mistral, Shieldstral matches models seven times its size, suggesting that safety tools can be made compact and accessible. Cisco, meanwhile, released Antares, a set of open-weight models designed to hunt for vulnerabilities buried in code. These are open-weight tools built for open-weight risk. The idea is that even if a model is dangerous by default, external filters can be layered on top to catch the worst outputs.
This approach has some appeal. It treats safety as a separate layer that can be added or removed depending on the deployment context. A hospital running an open-weight model for clinical decision support might deploy Shieldstral to ensure the model does not generate harmful advice. A security firm might use Antares to spot weaknesses in its own code. But the fundamental problem remains a defense is only as good as the person deploying it. A malicious actor will simply omit the safety layer. They will download the raw weights and run them without any of the added guardrails.
The Defense Argument
Openness advocates argue that the same access that enables harm also enables defense. Hugging Face, the prominent AI platform, used GLM-5.2 to help defend itself during OpenAI's breach. Its chief, Clem Delangue, argues that the systems that stop one attack can fend off millions more. The logic is that open models allow a wider community of defenders to inspect and understand the technology, leading to more robust security tools. If a vulnerability is found, it can be fixed collectively rather than by a single closed lab.
Papadatos calls that overstated. He argues that the industry “shouldn’t open-source dangerous capabilities.” His assessment is blunt: attackers move faster than defenders. A ransomware crew changes tactics in a week, while a hospital cannot. The asymmetry is not new, but it is amplified in the AI domain. An attacker only needs one successful exploit; a defender must block all of them. Open models give the attacker an infinite supply of chances, each free to download and modify.
Policy Falls Behind
The governance landscape around open-weight AI is still fragile. The White House has introduced a new voluntary framework that reviews certain closed frontier models for cyber risk. However, according to the evaluation, it reportedly does not cover open-source models so far. This is a glaring omission. Closed models are at least subject to some oversight, while open models circulate in a regulatory vacuum. Part of the problem is that open weights are hard to govern. They are not a service that can be turned off; they are a file that can be shared, copied, and transformed in ways that defy traditional regulation.
Anthropic, once primarily concerned about intellectual property theft, has shifted its stance. The company now names safety as its main worry about open weights. That shift is telling. It suggests that the frontier labs, which have the most to lose from regulation, believe that open-weight models pose a unique and perhaps existential risk. Z.ai, for its part, published no safety framework for GLM-5.2 and did not answer questions about its safety practices. That silence is conspicuous.
China is not ignoring the risk, but its focus lies elsewhere. Xi Jinping has backed open weights while stressing “human control” over AI. The country's rules, as noted by Stanford's Graham Webster, target political content and social stability more than catastrophic cyber or bio misuse. This divergence in priorities complicates any international consensus. A model deemed safe in China might be considered extremely dangerous in the West, and vice versa.
The capability race is nearly settled: open is close behind and far cheaper. The safety race is not, and AI is already learning to attack as well as defend. The hard part is making sure only the defense is easy to download.