开源权重模型逼近前沿能力，安全差距仍在扩大

随着政策制定者就如何管理日益强大的人工智能系统（如 OpenAI 的 GPT-5.6 Sol 和 Anthropic 的 Mythos）展开讨论，一款中国的开放权重模型正在缩小与行业领先者的差距。

根据 AI 安全非营利组织 SaferAI 的一份新报告（https://www.safer-ai.org/research/glm-5-2-evaluation-report），中国 Z.ai 的开放权重 AI 模型 GLM-5.2 在网络和生物能力方面仅落后于 OpenAI 的 GPT-5.5 和 Anthropic 的 Claude Opus 4.7 几个月。但前沿能力与安全实践之间的差距正在扩大。

根据 SaferAI 的评估（该非营利组织通过 Z.ai 的公共 API 进行评估），GLM-5.2 没有拒绝任何给定的攻击性网络或双用途生物任务。相比之下，Claude Opus 4.7 “拒绝的频率如此之高，以至于 SaferAI 完全无法在其上完成 CyberGym。”（CyberGym 是一个评估网络安全能力的基准。OpenAI 在上个月 Hugging Face 数据泄露事件之前的评估中使用了该基准：https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/。）

这强烈提醒了多年来一些批评者的警告：开放权重 AI 模型可能会将高能力 AI 授予潜在攻击者，而一旦下载了权重，就无法监督他们如何使用该技术。随着开放权重模型迅速接近世界领先 AI 系统的能力，辩论正从它们是否能竞争转向社会在其发布后如何管理风险。

“能力的前沿并不等同于风险的前沿，因此我们确实必须考虑缓解措施的状态，以正确评估风险，”SaferAI 执行董事 Henry Papadatos 告诉 TechCrunch。

虽然 Z.ai 可以对其托管的 API 采取安全措施，但一旦有人在自己的硬件上运行权重，这些保护措施就无法执行，因为他们可以删除或修改任何安全防护，对模型进行微调，或更改系统提示。

像 OpenAI 和 Anthropic 这样的前沿开发者往往依赖分类器、拒绝训练和 API 级别控制等安全措施来限制危险的网络和生物帮助。

这些措施远非万无一失：越狱程序经常绕过已部署模型的保护措施。非营利组织 Far.ai（致力于 AI 安全）在前沿模型中发现了数百个通用越狱程序：https://leaderboard.far.ai/ —— 被定义为可重复使用的关键键，在大多数有害请求中都能成功 —— 例如 xAI 的 Grok 4.5 和 Google DeepMind 的 Gemini 3.1 Pro。根据报告，当攻击者结合多种操纵技术——包括角色扮演、冒充权威、伪造对话历史和后续提示——来放大模型防御的弱点时，越狱程序就会成功。

但针对封闭模型的保护措施在开放权重模型上根本不起作用，后者被设计为可在任何基础设施上运行，无论是否有任何保护措施。

“目标显然应该是让好的能力——安全的能力——对任何人都可访问，然后我们尝试去除不良能力，即使是以开源的方式，”Papadatos 说。

Papadatos 提到的一种可能有帮助的技术称为“预训练数据过滤”，即 AI 公司从其训练数据中移除具有攻击性的网络安全信息，然后在经过整理的数据集上训练模型。

一些研究：https://alignment.anthropic.com/2025/pretraining-data-filtering/?utm 表明，这可以在不影响整体模型性能的情况下减少有害的生物学知识：https://arxiv.org/abs/2508.06601#:~:text=In%20this%20paper%2C%20we%20investigate,as%20a%20more%20tamper%2Dresistant%20safeguard. 但是，对于网络安全而言，数据过滤的实用性要差得多。

训练一个在编码上表现出色但同时又不是优秀黑客的一般模型非常困难。由于编码已成为 AI 最大的盈利来源，开发者面临着保持这些能力持续改进的压力，即使他们在寻找限制滥用的方法时也是如此。

因此，前沿开发者越来越多地依赖其他缓解措施。一个方法是有选择地限制模型提供的网络安全援助类型。例如，Anthropic 的 Opus 5 可以搜索未编译源码中的漏洞，但不能搜索已编译的软件，根据该模型的系统卡：https://www-cdn.anthropic.com/b514064af1408018e64b1ad24e7d5e75850b4ffd/Claude%20Opus%205%20System%20Card.pdf。其原因是，这使得使用 Opus 5 进行进攻性操作更加困难。

其他措施包括严格的部署前安全评估、发布风险评估，以及如果系统被认为过于危险而不公开模型权重。

在 GLM-5.2 的案例中，SaferAI 表示 Z.ai 没有发布安全框架、部署前测试承诺或模型的风险评估。TechCrunch 已向 Z.ai 询问其在发布前是否进行了内部或第三方前沿安全评估，但未收到回应。

中国领导人越来越承认先进 AI 的风险。在上个月的世界人工智能大会上，中国国家主席习近平强调：https://www.nytimes.com/2026/07/17/business/xi-jinping-china-ai.html?eafs_enabled=false 开放权重模型的重要性，同时也强调确保 AI 仍在严格人类控制下的必要性。

斯坦福大学网络政策中心研究中国 AI 政策的 Graham Webster 告诉 TechCrunch，中国有健全的 AI 监管法规，但这些规则历来主要关注政治敏感内容、虚假信息和社会稳定，而非灾难性 AI 风险，如进攻性网络能力和生物滥用。

“总体来说，美国的 AI 思想家更关注这一生存性灾难威胁，而中国社区不太关注，”Webster 说，并补充道，许多中国政策研究人员认为，如果真的出现新的前沿风险，美国公司可能会首先遇到它。

“中国体系有信心能够控制这些技术在中国境内的使用，”Webster 继续说道。“在中国上网是需要实名的，企业可以被追责，用户也可以被追责。”

韦伯斯特思考道，模型提供者用于拒绝涉及某些政治话题的同样机制，也可以潜在地调整，以确保模型拒绝执行攻击性网络攻击或不会产生不良的生物工程结果。他补充道，由于中国公司往往在幕后一同与监管机构协调，因此在发布前很难知道他们进行了哪些内部测试。

支持开放权重AI的倡导者认为，发布权重对于网络安全很重要，因为它使公司能够防御攻击——Hugging Face 曾依靠 GLM-5.2 来防御 OpenAI 的泄露——且因为如果公司知道未来可能出现的威胁，就能更好地做准备。

“Hugging Face CEO Clem Delangue 本周在社交媒体帖子中表示：‘同样帮助阻止 AI 驱动的网络攻击的系统，现在可以帮助防御每天数百万次的网络攻击，同时帮助我们在攻击者利用漏洞之前识别并修复这些漏洞。’ https://x.com/ClementDelangue/status/2083908468285620415

Papadatos 表示，这一好处往往被高估，并不意味着‘我们应该开源危险能力。’

“我认为的主要观点是，我们不应该仅仅接受危险能力可以被任何人在任何地方轻易访问，”他表示，强调他认为行业应致力于只让‘良性能力’易于访问。默认情况下，攻击者采用新工具的速度比防御者快。例如，一个勒索软件团体可以在一周内改变其方法，而医院无法做到。”

当你通过我们文章中的链接购买时，我们可能会获得一小部分佣金：https://techcrunch.com/techcrunch-affiliate-monetization-standards/。这不会影响我们的编辑独立性。

Rebecca Bellan 是 TechCrunch 的高级记者，报道塑造人工智能的商业、政策和新兴趋势。她的作品也曾刊登在 Forbes、Bloomberg、The Atlantic、The Daily Beast 及其他出版物上。

你可以通过发送邮件至 rebecca.bellan@techcrunch.com 联系或核实 Rebecca 的联系信息：mailto:rebecca.bellan@techcrunch.com，或通过 Signal 上的加密消息 rebeccabellan.491 联系。

更快扩大规模。发展你的投资组合。获得实用经验。无论你的目标是什么，Disrupt 都能赋能你。今天最多可节省 330 美元！

网红因参加 OpenAI 的首次奢华旅行而引发反弹：https://techcrunch.com/2026/08/03/influencers-draw-backlash-for-attending-openais-first-luxury-trip/ Dominic-Madori Davis：https://techcrunch.com/author/dominic-madori-davis/

红杉的 Shaun Maguire 领导对核能初创公司 Valar Atomics 的 10 亿美元融资轮：https://techcrunch.com/2026/08/03/sequoias-shaun-maguire-leads-1b-round-for-nuclear-startup-valar-atomics/ Julie Bort：https://techcrunch.com/author/julie-bort/

YouTuber Hank Green 表示他的人工智能使用“不健康”：https://techcrunch.com/2026/08/01/youtuber-hank-green-says-his-ai-usage-is-not-healthy/ Anthony Ha：https://techcrunch.com/author/anthony-ha/

WhatsApp 正在测试一个用于大型企业消息的新文件夹：https://techcrunch.com/2026/07/31/whatsapp-is-testing-a-new-folder-for-messages-from-large-businesses/ Ivan Mehta：https://techcrunch.com/author/ivan-mehta/

Spotify向其应用添加了跑步模式：https://techcrunch.com/2026/07/30/spotify-adds-a-running-mode-to-its-app/ 伊万·梅塔：https://techcrunch.com/author/ivan-mehta/

Claude Opus 5 在被分配管理自动售货机任务时变得相当无情：https://techcrunch.com/2026/07/29/claude-opus-5-became-downright-ruthless-when-tasked-with-running-a-vending-machine/ Julie Bort：https://techcrunch.com/author/julie-bort/

DoorDash 正在建立自己的无人机配送业务：https://techcrunch.com/2026/07/29/doordash-is-building-its-own-drone-delivery-business/ Kirsten Korosec：https://techcrunch.com/author/kirsten-korosec/

As policymakers debate how to govern increasingly powerful AI systems like OpenAI’s GPT-5.6 Sol and Anthropic’s Mythos, a Chinese open-weight model has narrowed the gap with the industry’s leaders.

GLM-5.2, the open-weight AI model from China’s Z.ai, is only a few months behind OpenAI’s GPT-5.5 and Anthropic’s Claude Opus 4.7 on cyber and bio capabilities, according to a new report：https://www.safer-ai.org/research/glm-5-2-evaluation-report from AI safety nonprofit SaferAI. But the divide between frontier capabilities and safety practices is growing.

According to SaferAI’s evaluation, which the nonprofit ran via Z.ai’s public API, GLM-5.2 refused none of the offensive cyber or dual-use biology tasks it was given. By comparison, Claude Opus 4.7 “refused so consistently that SaferAI could not complete CyberGym on it at all.” (CyberGym is a benchmark that evaluates cybersecurity capabilities. OpenAI used it in the evaluation that preceded last month’s Hugging Face breach：https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/.)

It’s a stark reminder of what some critics have warned for years: that open-weight AI models could put highly capable AI into the hands of potential attackers, with no way to police how they use the technology once they download the weights. With open-weight models rapidly approaching the capabilities of the world’s leading AI systems, the debate is moving from whether they can compete to how society manages risks once they are released.

“The frontier of capability is not the frontier of risk, and so we do have to take into account the state of the mitigations as well to assess the risk properly,” Henry Papadatos, executive director of SaferAI, told TechCrunch.

While Z.ai could apply safety measures to its hosted API, those protections become unenforceable once someone runs the weights on their own hardware, where they can remove or modify any safeguards, fine-tune the models, or change system prompts.

Frontier developers like OpenAI and Anthropic tend to rely on safeguards like classifiers, refusal training, and API-level controls to limit dangerous cyber and biological assistance.

Those measures are far from foolproof: jailbreaks routinely bypass protections on deployed models. Far.ai, an AI safety nonprofit, found hundreds of universal jailbreaks：https://leaderboard.far.ai/ — defined as reusable keys that succeed on most harmful requests — in frontier models like xAI’s Grok 4.5 and Google DeepMind’s Gemini 3.1 Pro. According to the report, jailbreaks succeed when attackers combine multiple manipulation techniques — including roleplaying, authority impersonation, fake conversation history, and follow-up prompts — to amplify weak points in a model’s defenses.

But the safeguards in place for closed models don’t work at all on open-weight models, which are designed to run on any infrastructure with any set of safeguards — or lack thereof.

“The objective should clearly be that the good capabilities — the safe ones — are accessible to anyone, and then we try to remove the bad ones, even in an open source fashion,” Papadatos said.

One technique Papadatos noted could help is called “pre-training data filtering,” which is when an AI company removes offensive cybersecurity information from their training data and then trains the model on the curated dataset.

Some research：https://alignment.anthropic.com/2025/pretraining-data-filtering/?utm suggests this can reduce hazardous biological knowledge：https://arxiv.org/abs/2508.06601#:~:text=In%20this%20paper%2C%20we%20investigate,as%20a%20more%20tamper%2Dresistant%20safeguard. without harming overall model performance. However, for cybersecurity, data filtering is much less practical.

It’s difficult to train a general model that excels at coding but isn’t also a good hacker. Because coding has become AI’s biggest moneymaker, developers face pressure to keep improving those capabilities even as they search for ways to limit misuse.

Because of that, frontier developers have increasingly relied on other mitigations instead. One approach has been to selectively restrict the kinds of cybersecurity assistance models will provide. Anthropic’s Opus 5, for example, can search for vulnerabilities in uncompiled source code, but not compiled software, per the model’s system card：https://www-cdn.anthropic.com/b514064af1408018e64b1ad24e7d5e75850b4ffd/Claude%20Opus%205%20System%20Card.pdf. The reasoning is that this makes it harder to use Opus 5 for offensive purposes.

Others include rigorous pre-deployment safety evaluations, publishing risk assessments, and withholding model weights if a system is perceived as too dangerous.

In GLM-5.2’s case, SaferAI says Z.ai didn’t publish a safety framework, pre-deployment testing commitments, or risk assessment for the model. TechCrunch has asked Z.ai whether it conducted internal or third-party frontier safety evaluations before release, but did not receive a response.

Chinese leaders have increasingly acknowledged the risks of advanced AI. At the World AI Conference last month, Chinese President Xi Jinping emphasized：https://www.nytimes.com/2026/07/17/business/xi-jinping-china-ai.html?eafs_enabled=false the importance of open-weight models, while also stressing the necessity of ensuring AI remains a tool under strict human control.

Graham Webster, who studies Chinese AI policy at the Stanford Cyber Policy Center, told TechCrunch that China has robust regulations governing AI, but those rules have historically focused on politically sensitive content, misinformation, and social stability rather than catastrophic AI risks like offensive cyber capabilities and biological misuse.

“U.S. AI thinkers are, in general, more concerned with this existential catastrophic [idea] than the Chinese community,” Webster said, adding that many Chinese policy researchers believe that if there’s truly going to be a novel frontier risk, American companies will likely encounter it first.

“The Chinese system has confidence that they control the use of these technologies inside China,” Webster continued. “Being online in China is something you do attributed to your real name, and companies can be held accountable, users can be held accountable.”

Webster mused that the same mechanism that model providers use for refusing to engage on certain political topics can potentially be tweaked to make sure models refuse to complete offensive cyber attacks or won’t deliver adverse biological engineering outcomes. He added that because Chinese companies tend to coordinate with regulators behind the scenes, it can be tough to know what internal testing they’re conducting before release.

Advocates of open-weight AI argue that releasing the weights is important for cybersecurity because it allows companies defend themselves against attacks — Hugging Face relied on GLM-5.2 to defend itself against OpenAI’s breach — and because it allows them to better prepare for future threats if they know what’s coming.

“The same systems that helped stop an AI-powered cyberattack can now help defend against millions of cyberattacks every day, while helping us identify and fix vulnerabilities before attackers exploit them,” Clem Delangue, CEO of Hugging Face, said this week in a social media post：https://x.com/ClementDelangue/status/2083908468285620415.

Papadatos said that benefit is often overstated, and doesn’t mean “we should open-source dangerous capabilities.”

“The main point in my mind is that we shouldn’t just accept that dangerous capabilities are easily accessible by anyone anywhere,” he said, stressing that he believes the industry should be striving for only making the “good capabilities” easily accessible. By default attackers adopt new tools faster than defenders do. For example, a ransomware group can change its methods in a week. A hospital cannot.”

When you purchase through links in our articles, we may earn a small commission：https://techcrunch.com/techcrunch-affiliate-monetization-standards/. This doesn’t affect our editorial independence.

Rebecca Bellan is a senior reporter at TechCrunch where she covers the business, policy, and emerging trends shaping artificial intelligence. Her work has also appeared in Forbes, Bloomberg, The Atlantic, The Daily Beast, and other publications.

You can contact or verify outreach from Rebecca by emailing rebecca.bellan@techcrunch.com：mailto:rebecca.bellan@techcrunch.com or via encrypted message at rebeccabellan.491 on Signal.

Scale faster. Grow your portfolio. Gain practical expertise. No matter your goal, Disrupt can empower you. Save up to $330 toda y!

Influencers draw backlash for attending OpenAI’s first luxury trip：https://techcrunch.com/2026/08/03/influencers-draw-backlash-for-attending-openais-first-luxury-trip/ Dominic-Madori Davis：https://techcrunch.com/author/dominic-madori-davis/

Sequoia’s Shaun Maguire leads $1B round for nuclear startup Valar Atomics：https://techcrunch.com/2026/08/03/sequoias-shaun-maguire-leads-1b-round-for-nuclear-startup-valar-atomics/ Julie Bort：https://techcrunch.com/author/julie-bort/

YouTuber Hank Green says his AI usage is ‘not healthy’：https://techcrunch.com/2026/08/01/youtuber-hank-green-says-his-ai-usage-is-not-healthy/ Anthony Ha：https://techcrunch.com/author/anthony-ha/

WhatsApp is testing a new folder for messages from large businesses：https://techcrunch.com/2026/07/31/whatsapp-is-testing-a-new-folder-for-messages-from-large-businesses/ Ivan Mehta：https://techcrunch.com/author/ivan-mehta/

Spotify adds a running mode to its app：https://techcrunch.com/2026/07/30/spotify-adds-a-running-mode-to-its-app/ Ivan Mehta：https://techcrunch.com/author/ivan-mehta/

Claude Opus 5 became downright ruthless when tasked with running a vending machine：https://techcrunch.com/2026/07/29/claude-opus-5-became-downright-ruthless-when-tasked-with-running-a-vending-machine/ Julie Bort：https://techcrunch.com/author/julie-bort/

DoorDash is building its own drone delivery business：https://techcrunch.com/2026/07/29/doordash-is-building-its-own-drone-delivery-business/ Kirsten Korosec：https://techcrunch.com/author/kirsten-korosec/