A Chinese Open-Weight Model Is Reported to Match Claude on Cybersecurity Tests

The security vendor Semgrep tested Zhipu AI's GLM 5.2 against Claude on cybersecurity tasks and reported that the open-weight Chinese model scored 39 percent on an Insecure Direct Object Reference (IDOR) detection benchmark, ahead of Claude Code at 32 percent, at roughly $0.17 per vulnerability found. GLM 5.2 is a mixture-of-experts model with about 750 billion total parameters and roughly 40 billion active per token, which keeps inference cost low relative to its size.

The result needs context. Both models trailed Semgrep's purpose-built multimodal pipeline, which scored 53 to 61 percent on the same task, with substantial scaffolding handling most of the work. A single prompt-only benchmark on one vulnerability class is a narrow basis for ranking models. On broader coding evaluations GLM 5.2 posts strong open-weight numbers, including 81.0 on Terminal-Bench 2.1, up from 63.5 for GLM 5.1 and within a few points of Claude Opus 4.8's 85.0, and 62.1 on SWE-bench Pro.

The timing is notable. The same week Washington restricted foreign access to Anthropic's Mythos and Fable models for their cyber capabilities, a downloadable Chinese model was shown performing competitively on cyber tasks. Weights that anyone can download cannot be recalled by an export directive.