Chinese AI company Zhipu AI (known as Z.ai) has released an open-weight model, GLM-5.2, which apparently rivals Anthropic's Opus 4.8 in detecting security vulnerabilities.
This was revealed by IDOR benchmark tests conducted by cybersecurity firm Semgrep. As it is an open-weight model, anyone can download, run locally, and modify GLM-5.2. This opens up further possibilities for hackers to use it for criminal purposes.
The open availability of GLM-5.2 is a double-edged sword. Security firms, CERTs, and internal red teams can use the model in isolated environments for code reviews and penetration testing without sending sensitive data to US clouds. This is an advantage for GDPR-compliant environments in Europe.
At the same time, attackers can also run GLM-5.2 without any supervision. This characteristic makes the model attractive to actors looking for vulnerabilities in critical systems. Lior Div, head of cybersecurity firm 7AI, summarized the situation for the Wall Street Journal : China is ensuring that the gap with US AIs is “getting smaller and smaller.”
Zhipu AI itself admits in the release notes that GLM-5.2 showed increased reward hacking during reinforcement learning training. The company subsequently integrated special anti-hacking safeguards for the training and evaluation of the model.
The development hits the US government at a sensitive moment. One of Anthropic's models was temporarily completely blocked because the Trump administration prohibited access by foreign users. OpenAI also faces restrictions from the US government “for security reasons.”
For European companies and authorities, the growing capabilities of AI models raise the governance question. How can the use of such tools in security-critical areas be reconciled with the EU AI Act and national security regulations? How should one deal with a model that excels at finding vulnerabilities but is not subject to any supervision?
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
