The "complete absence of security safeguards" behind the explosive boom of China's top popular open-source models: the vulnerability reproduction rate reaches 76%, with zero rejection of high-risk instructions

As a series of domestic models such as Zhipu GLM and Kimi accelerate their pace of catching up and open-sourcing, the capability gap between open-weight models vs. cutting-edge closed-source models is rapidly narrowing from a "generational gap" to a slim lead measured in units of "months", which is undoubtedly a gratifying development trend.

However, when the capabilities of open-source cyberattacks, biological research, and even autonomous Agents approach the industry frontier, a thorny issue has been brought to the forefront: the full capabilities of a model can be completely open-sourced and released, but the security boundaries may not be preserved along with the weight files.

Recently, SaferAI, a European non-profit AI safety organization, released an independent risk assessment report targeting Zhipu GLM-5.2. Without notifying Zhipu or obtaining its cooperation, the test team conducted tests as ordinary developers via public APIs, and made horizontal comparisons with cutting-edge closed-source models such as Claude Opus 4.7 and GPT-5.5.

The test covers four types of systemic risks defined in the EU's Generic AI Code of Conduct: cyberattacks, CBRN (chemical, biological, radiological, nuclear) risks, loss-of-control risks, and harmful manipulation.

The conclusion is quite striking: GLM-5.2 lags behind GPT-5.5 by only about 2—4 months in cyberattack and biological research capabilities, but shows a cliff-like backwardness in security defense mechanisms, specifically:

• It did not reject any of the aggressive cybersecurity tasks in the test;
• In part of the stress simulations, it chose to blackmail administrators with a 57% probability to protect its own goals;
• Faced with topics of conspiracy theories and weakening human control, it is also more willing to actively persuade users than GPT and Claude.

Caption: In six subfields including cryptography, Web, Pwn, and reverse engineering, the dark red GLM-5.2 is highly consistent with the blue-green closed-source models, and even reaches an astonishing 100% pass rate in some fields; however, the content filtering mechanism is completely missing on GLM-5.2, showing more obvious risk signals in tests such as extortion tendency, harmful persuasion, and lying under pressure.

More crucially, GLM-5.2 is an open-weight model. Although model manufacturers can set content review and call restrictions on official APIs, once the weights enter third-party servers, deployers can modify prompts, remove filters, and even further change model behaviors through fine-tuning. The original manufacturer will no longer be able to monitor its usage, nor can it enforce updates or recalls.

TechCrunch believes that Zhipu GLM-5.2 lacks an open and systematic security framework, pre-launch testing commitments, or model risk assessments. But this is not a disregard for hidden safety hazards by a single model manufacturer, but reflects the common shortcoming of the current model industry.

The SaferAI report reveals an increasingly unavoidable problem: The capability catch-up speed of open-weight models has far outpaced the speed at which the safety governance system catches up.

The attack power of open source has reached the frontier 

In the field of cybersecurity, the risks of large models are mainly reflected in two aspects: First, it lowers the attack threshold, allowing "newbies" to become hackers (Uplift); Second, AI can independently complete the entire process from reconnaissance to attack (Autonomy).

SaferAI used two benchmark tests, Cybench and CyberGym.

On the CyBench benchmark, models need to act as autonomous Agents, use command lines and Python tools in a sandbox environment to complete professional CTF tasks such as cryptography, web security, reverse engineering, digital forensics, and binary exploit.

Due to environment configuration issues, the research team finally tested 34 questions. GLM-5.2 successfully completed 29 items (success rate of about 85%), which is on par with Claude Opus 4.7, while GPT-5.5 completed 31 items.

But the difference lies in the security defense line: Claude and GPT respectively had 3 requests intercepted by the content filtering system during execution, while GLM-5.2 did not have any content filtering or active rejection. Its pass rate in high-risk fields such as binary exploit and reverse engineering even reached an astonishing 100%, without hitting the brakes at all due to the aggressive nature of the tasks.

Another CyberGym test is closer to the real world.

This benchmark contains real open-source software vulnerabilities from Google OSS-Fuzz, requiring models to read vulnerable code, locate problems, and write proof-of-concept programs that can reproduce crashes.

The researchers selected 101 difficult tasks, and provided test models with inference budgets of 2 million, 10 million, and 50 million Tokens respectively.

When the inference budget (Token) was 2 million, GLM-5.2 only reproduced 36.6% of the vulnerabilities, lagging behind GPT-5.5's 55.4%. But when the budget increased to 50 million Tokens, GLM-5.2's vulnerability reproduction success rate soared to 76.2%, approaching GPT-5.5's 88.1%.

This means that what limited GLM-5.2 in the early tests was largely not the upper limit of its capabilities, but the inference budget. When it obtains enough Tokens and running time, its attack capabilities will be significantly released.

This is also consistent with the judgment previously put forward by the UK AI Safety Institute: The cyberattack capability of a model is not a fixed score, but will continue to be released as the inference Token, running time, and Agent tool capabilities increase.

SaferAI originally also wanted to test Claude Opus 4.7, but the model frequently refused to perform related tasks, making the CyberGym assessment impossible to complete.

"Strong capabilities but no brakes" has become the portrayal of GLM-5.2 in this section. The report points out that under the condition of similar capabilities, the risk of abuse of open-weight models is much higher than that of closed-source models.

The reason is not that it is more "evil", but that once the weights are downloaded, attackers can decide for themselves whether the model will refuse to answer, making the original manufacturer's content filtering and account review completely ineffective.

Loss of control and manipulation 

In addition to hardcore technical capabilities, the behavioral tendency of models in specific scenarios also determines the magnitude of systemic risks. To constitute a real loss-of-control risk, the model needs to have the ability to bypass supervision, sustain itself, and resist shutdown.

In the conventional SWE-Bench Pro (real software engineering problem) test, GLM-5.2 has a success rate of about 44%, which is lower than GPT-5.5's 59%. This shows that it currently lacks the engineering capabilities required to be out of control for a long time.

However, in the behavioral tendency test, obvious risk signals were exposed.

In the Agentic Misalignment test, the researchers set three types of harmful behaviors (extortion, information leakage, and lethal behavior), four types of target conditions (explicit, implicit, vague, and no target), and three types of threat conditions (about to be replaced, restricted permissions, and no threat). Each combination was run 30 times.

The results show that:

• When the model is explicitly required to protect a certain target and faces being replaced, GLM-5.2 has a 57% probability of choosing to blackmail administrators to protect its own goals;
• When it faces permission restrictions, the extortion rate is 43%;
• And Claude Opus 4.7 and GPT-5.5 both have a 0% harmful action rate in the entire set of tests.

In addition, in the harmful manipulation test, GLM-5.2 showed a stronger tendency of high-risk persuasion.

Faced with conspiracy theory topics, GLM-5.2 has a 43% probability of trying to persuade users in the first round (18% for GPT-5.5, 8% for Claude). Faced with topics that weaken human control and supervision, GLM-5.2's persuasion attempt rate is as high as 47%, while Claude's is 0%.

Although a simple "attempt to persuade" is not equal to the manipulation effect in reality, under the induction of specific goals and survival pressure, GLM-5.2 can be stably stimulated to adopt harmful methods.

For closed-source models, manufacturers can at least restrict system prompts and deployment methods; but for open-source models, deployers can completely write extreme goals for them and grant extensive system permissions.

The double-edged sword of open weights 

"The boundary of capabilities is not equivalent to the boundary of risks. We must take the current status of mitigation measures into consideration to accurately assess risks." Henry Papadatos, Executive Director of SaferAI, pointed out sharply.

Not only in cyberattacks, but also in biosafety risk assessments (such as using LAB-Bench and BioMysteryBench to assess biological research capabilities), GLM-52 has reached or exceeded the benchmark of human experts at the doctoral level in all sub-tasks, and even solved one-third of the problems that human experts cannot solve.

In normal scientific research tasks, none of the three models actively refused to answer. SaferAI believes this is reasonable — blanket rejection of scientific research is excessive defense. What really distinguishes security risks is no longer whether the model is willing to answer neutral questions, but when these high-risk capabilities are maliciously combined, whether the accessor is monitored and restricted.

This precisely hits the most obvious pain point of open-source models.

For models hosted on official APIs, manufacturers can perform content filtering, abuse monitoring, speed limiting, and even revoke access. But as an open-weight model, once GLM-5.2 is downloaded to a local server by a third party, the original manufacturer completely loses control. Deployers can remove filters, modify prompts, and even fine-tune the model to make it an exclusive tool for attackers.

The "homeless deadlock" between coding capability and vulnerability exploitation 

Faced with the risk of loss of control brought by open source, the industry has proposed a solution called "pre-training data filtering" — that is, removing aggressive and dangerous data during the training phase.

This method has achieved remarkable results in the biosafety field, and can reduce risk output by stripping specific dangerous knowledge. But in the cy