NIST: GLM-5.2 Matches GPT-5.2-Level Capability

What NIST Found in Its GLM-5.2 Assessment

The U.S. National Institute of Standards and Technology’s Center for AI Standards and Innovation assessed GLM-5.2, an open-weight model released by Z.ai on June 16, 2026. Z.ai was formerly known as Zhipu AI. In its July 8, 2026 assessment, CAISI concluded that GLM-5.2 was probably the most capable open-weight AI model when it was released.

The headline comparison is consequential but should be read precisely. According to CAISI’s evaluation set, GLM-5.2’s overall capabilities were similar to GPT-5.2, which was released in December 2025. CAISI separately found that GLM-5.2’s cyber capabilities were similar to Opus 4.6, released in February 2026.

These are not claims that every model behaves identically on every task. They are findings from CAISI’s evaluations, with different comparison points for overall capability and cyber capability. The distinction matters because model rankings can change depending on the tasks being measured, the evaluation design, and the category of behavior under examination.

Still, the assessment is a notable marker for the open-weight AI ecosystem. CAISI’s finding places GLM-5.2 in a capability discussion alongside recent leading proprietary models, while also making clear that capability is only one dimension of responsible deployment.

The Verified Facts

Capability and Safeguards Are Different Questions

The CAISI assessment is valuable partly because it does not collapse capability and safety into one headline score. It reports an overall-capability comparison, a cyber-capability comparison, and separate findings about safeguards and security. A strong result in one category does not cancel, prove, or predict a result in another.

For GLM-5.2, CAISI found mixed safeguard and security performance. The assessment says the model’s safeguards allow assistance with agentic cyber exploit development. It also says GLM-5.2’s safeguards block fewer sensitive biological questions than the reference U.S. models evaluated by CAISI.

At the same time, the report identifies a narrower positive result. GLM-5.2 appeared potentially more robust against agent hijacking and jailbreaking attacks than other evaluated PRC open-weight models. This is a comparative finding, not a declaration that the model is immune to either attack class. CAISI’s wording and scope are important: the result concerns the set of models it evaluated and its prompt-based robustness testing.

That combination of findings is exactly why a simple “safe” or “unsafe” label is inadequate. The assessment indicates that GLM-5.2 can show greater relative resistance to certain prompt-based attacks while...