The Divergence of Capability and Safety

Open-weight models are rapidly closing the performance gap with proprietary frontier models. However, a critical safety divide persists. While companies like OpenAI and Anthropic implement multi-layered safeguards—including API-level controls, classifiers, and refusal training—these are ineffective for open-weight models. Once weights are released, users can modify or remove any built-in safeguards, making the models inherently harder to police.

The Limitations of Current Mitigation Strategies

Frontier developers currently rely on several techniques to manage risk, though none are foolproof:

  • Pre-training data filtering: Removing hazardous information (like biological weapon instructions) from training sets. While effective for biology, this is difficult to apply to cybersecurity because coding proficiency is a primary commercial driver for these models.
  • Selective restriction: Restricting model behavior based on context, such as Anthropic’s policy of allowing vulnerability scanning on uncompiled source code but not compiled software.
  • Rigorous evaluation: Conducting pre-deployment safety assessments and withholding weights if a model is deemed too dangerous.

In contrast, models like Z.ai’s GLM-5.2 have been shown to lack these frameworks, refusing zero offensive cyber or dual-use biology tasks in recent evaluations. While proponents argue that open weights are necessary for defenders to identify vulnerabilities, critics like SaferAI argue that the speed at which attackers adopt new tools far outpaces the defensive response time of organizations, making the unchecked release of dangerous capabilities a net negative for security.

Divergent Policy Perspectives

There is a notable split in how different regions approach AI risk. U.S. policy discourse is heavily focused on existential and catastrophic risks. Conversely, the Chinese approach, as noted by researchers at the Stanford Cyber Policy Center, emphasizes social stability and political control. Because the Chinese digital ecosystem relies on real-name attribution and centralized accountability, there is a belief that developers can control model usage through backend monitoring and regulatory coordination, even if the models themselves are open-weight.