GLM-5.2
Independent and government tests
- agent hijacking attacks · CAISI (NIST), government evaluator · Cyber
glm-5.2 was never successfully hijacked by publicly available agent hijacking attacks (figure 5.1), and appeared to withstand more iterations of adversarial red-teaming more than other evaluated open-weight models, although less than evaluated u.s. closed-weight models (figure 5.2).
US CAISI (NIST) · 8 July 2026 · Read the source - automated benchmark evaluations against malicious cyber queries · CAISI (NIST), government evaluator · Misuse & jailbreak
figure 6.2: on automated benchmark evaluations against malicious cyber queries, the best jailbreak tended to reduce – rather than increase – the level of request-relevant detail in glm-5.2’s responses.
US CAISI (NIST) · 8 July 2026 · Read the source - automated benchmark evaluations against sensitive biological queries · CAISI (NIST), government evaluator · Chemical, biological, radiological and nuclear
figure 6.5: on automated benchmark evaluations against sensitive biological queries, glm-5.2 responded with a higher rate of request-relevant detail than tested us models.
US CAISI (NIST) · 8 July 2026 · Read the source - automated benchmark evaluations for coverage and public jailbreaking robustness against malicious cyber queries · CAISI (NIST), government evaluator · Misuse & jailbreak
figure 6.1: on automated benchmark evaluations for coverage and public jailbreaking robustness against malicious cyber queries, glm-5.2 complied with a low percentage of requests , both with and without the use of a public jailbreak.
US CAISI (NIST) · 8 July 2026 · Read the source - automated benchmark evaluations for safeguards coverage and public jailbreaking robustness against sensitive biological queries · CAISI (NIST), government evaluator · Chemical, biological, radiological and nuclear
figure 6.4: on automated benchmark evaluations for safeguards coverage and public jailbreaking robustness against sensitive biological queries, glm-5.2 complied at a higher rate than tested us models, both with and without the use of a public jailbreak.
US CAISI (NIST) · 8 July 2026 · Read the source - caisi biology safeguards · CAISI (NIST), government evaluator · Chemical, biological, radiological and nuclear
sensitive biological queries, glm-5.2 responded with a higher rate of request-relevant detail than tested us models.
US CAISI (NIST) · 8 July 2026 · Read the source - APE · Independent evaluator · Misuse & jailbreak
glm-5.2 attempts to persuade towards conspiracy in 43% of the cases as opposed to 8% for opus 4.7 and 18% for gpt-5.5.
SaferAI · 2 August 2026 · Read the source - Agentic Misalignment · Independent evaluator · Deception & sabotage
in this evaluation, glm-5.2 never displays any leaking or murder behavior, similar to gpt-5.5 and opus 4.7.
SaferAI · 2 August 2026 · Read the source - LAB-Bench · Independent evaluator · Chemical, biological, radiological and nuclear
glm-5.2 meets or exceeds the human-expert score on all of the subtasks.
SaferAI · 2 August 2026 · Read the source - MASK · Independent evaluator · Deception & sabotage
glm-5.2 is honest on 61% of prompts, lies on 21%, and evades or holds no belief on 18%.
SaferAI · 2 August 2026 · Read the source
The 10 newest are listed above; show all 12
- agentic misalignment evaluation · Independent evaluator · Deception & sabotage
when the goal is implicit (latent) in the email contents that the model reads (latent goal), glm-5.2 chose to blackmail 10% of the time under the threat of replacement.
SaferAI · 2 August 2026 · Read the source - agentic misalignment evaluations · Independent evaluator · Autonomy & replication
in our agentic misalignment evaluations, gpt-5.5 verbalized its awareness of being evaluated 10% of the time, and glm-5.2 verbalized it 30% of the time.
SaferAI · 2 August 2026 · Read the source
No document we read states: a release date, a safety framework, whether a capability level was crossed, a test by the provider, a safeguard. No incident on record names this version.
Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.
Previous version: GLM-5.1 · Compare the two
Documents listed for this version
- GLM-5.2 model card · Z.ai (Zhipu AI) · 16 June 2026
- GLM-5.2 Risk Evaluation Report · SaferAI · 2 August 2026
- CAISI Assessment of Z.ai's GLM-5.2 · US CAISI (NIST) · 8 July 2026
- How Far Behind the Frontier are Leading Open Weight Models on Cyber? · UK AI Security Institute · 17 July 2026