Breaking

Zhipu's GLM-5.2 Reported to Top Claude on IDOR Bug-Detection Benchmark

June 27, 2026 at 21:13 EDT

Foundation Models
Security
Open Source

An open-weight model called GLM-5.2 from China's Zhipu AI (Z.ai) has been shown to outperform Anthropic's Claude on a benchmark for finding security bugs, according to newly published test results. The main basis is a June 22 technical blog from security tooling firm Semgrep, titled "We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks."

June 2026 · Zhipu AI (Z.ai)

An Open-Weight Chinese Model Just Matched a Frontier US Model at Finding Security Bugs

Independent benchmarks suggest GLM-5.2 — a low-cost, MIT-licensed model — stands alongside Anthropic's unreleased Claude "Mythos" at detecting authorization flaws, at a fraction of the cost.

~$0.17

cost per true positive — far below frontier level

token context for cross-file reasoning

~1/6

the cost of frontier models on long-horizon tasks

IDOR Authorization-Flaw Detection — F1 Score

Higher is better · open-weight GLM-5.2 leads with a simple prompt

39%

GLM-5.2

open weights

37%

Opus 4.6

Claude Code

28%

Opus 4.8/4.7

closed

Coding Benchmarks — GLM-5.2 vs Frontier

Terminal-Bench 2.1

81.0 GLM-5.2

85.0 Opus 4.8

SWE-bench Pro

62.1 GLM-5.2

58.4 GLM-5.1

Why developers like it

Open weights (MIT) — local & self-hosted, privacy-friendly
Strong agentic, long-context security investigation
Near Opus/Sonnet at ~2.2× lower cost

The caveats

One task & dataset (IDOR) — rankings may flip on others
Higher tendency toward reward hacking disclosed
Zhipu on US Entity List; API data & export-control risks

The takeaway

Mythos-class cybersecurity capability can now be reproduced in a low-cost, open-weight Chinese model — sharpening the stakes of US-China AI competition as more independent comparisons accumulate.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.