![\"In](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/06\/1782700036_715_0x0.jpg\")
<\/p>\n<\/p>\n
In this photo illustration, a Zhipu AI logo is seen displayed on a smartphone with the Chinese flag in the background. (Photo Illustration by Avishek Das\/SOPA Images\/LightRocket via Getty Images)<\/p>\n
SOPA Images\/LightRocket via Getty Images<\/p>\n
China now has an open-weight model that does the kind of long-horizon, repository-scale coding work U.S. officials spent the spring treating as a national-security problem when it came from American labs. <\/p>\n
GLM-5.2<\/a>, released by Z.ai last week under an MIT license, is downloadable by anyone, runs on private hardware, and leaves no provider-side record of how it’s used. That last detail is the governance problem. The control regime Washington built around frontier cyber-AI assumes a vendor sits between the model and the user. Open weights remove the vendor.<\/p>\n Mythos: the warning shot<\/p>\n Anthropic introduced Mythos as a model so good at finding software flaws that the company kept the most capable version, Mythos 5, inside a small partner program called Project Glasswing. It released to the public a safer sibling, Fable 5. <\/p>\n Within days of Fable\u2019s June 9 launch, however, the Trump administration forced Anthropic to withdraw it after another company demonstrated it could jailbreak the model<\/a>. The Wall Street Journal reported the push came from Amazon CEO Andy Jassy, who told Treasury Secretary Scott Bessent that Amazon researchers had used Fable prompts to pull information useful for cyberattacks. On June 12, the administration invoked export-control authority to bar foreign-national access to both models (including Anthropic\u2019s own non-citizen staff), which forced the company to disable them worldwide<\/a>.<\/p>\n On June 26, Commerce Secretary Howard Lutnick told the company that Mythos 5 could return for roughly 100 vetted U.S. organizations<\/a> \u2014 government agencies, banks, infrastructure providers \u2014 on the grounds that adequate safeguards were finally in place. Fable 5, the consumer model, stayed restricted<\/a>. High-end AI are now treated as dual-use technology, not productivity software \u2013 at least in the U.S.<\/p>\n GPT-5.6 and the same logic<\/p>\n OpenAI\u2019s GPT-5.6<\/a> arrived under the same constraint. The company released only a limited preview to about 20 companies whose participation the government approved.<\/p>\n What GLM-5.2 changes<\/p>\n GLM-5.2 inverts that arrangement. Z.ai, the Beijing lab formerly known as Zhipu AI, shipped the model weights under an MIT license: a 744-billion-parameter mixture-of-experts model with a context window reaching a million tokens, enough to take in an entire code repository. On agentic coding benchmarks<\/a> it beats GPT-5.5 outright and lands within a few points of Claude Opus 4.8, at roughly a sixth of the API cost.<\/p>\n The benchmarks that matter for this argument are the security ones. Two independent evaluations found GLM-5.2 performing on par with leading U.S. models on vulnerability discovery. Semgrep<\/a> had it beat Claude on an IDOR-detection task at about 17 cents per bug found; Graphistry<\/a> called it the first open-weight model it would recommend for a frontier-grade cybersecurity experience. Within days, Axios reported<\/a> hackers trading jailbreaks on Russian-language forums and one researcher describing the model chaining exploits “the way an elite human attack would.” None of this needs Z.ai’s cooperation, or even its awareness. Once the weights are local, the company can’t shape or see what the model does.<\/p>\n Three models, one variable<\/p>\n Line the three up and the variable isn\u2019t capability, it’s containment. Mythos is the most dangerous on paper, optimized for vulnerability discovery and demonstrably able to surface flaws in bulk, which is precisely why it sits behind suspensions, export limits, and a vetted-partner list. GPT-5.6 is strong across coding and security tasks but reaches users only through governed endpoints and an approved-customer roster. GLM-5.2 is the one with no wrapper. The first two are high-capability tools inside an enforcement layer; the third is the tool by itself, on whatever hardware someone points it at.<\/p>\n How fast does this matter?<\/p>\n