China's Z.ai shipped an open-weight model that matches an export-banned one on security work

Two weeks ago the US government forced Anthropic to pull Mythos 5 offline under an emergency export directive, on the theory that frontier cyber capability is dangerous enough to gate. This week a Chinese lab released a model you can download under an MIT license that benchmarks at parity with it on exactly that kind of work. The timing isn't subtle.

Zhipu AI's GLM-5.2 is a roughly 750B-parameter mixture-of-experts model with about 40B active per token, a 1M-token context window, and weights anyone can pull and run. The Verge reports researchers found it matches Anthropic's export-controlled Mythos on bug-finding and cybersecurity tasks. The numbers are specific. Semgrep measured 39% F1 on IDOR detection, versus Claude Code's 32%. Graphistry's CyBT-CTF eval put it level with Opus 4.8. That's not "competitive Chinese model." That's beating the practical US frontier on a security task that the US government decided was too sensitive to export.

Here's the part that should make you sit up. Graphistry also flagged unusually high output correlation with both GPT-5.5 and Opus 4.8, Cohen's Kappa of 0.80 and 0.76, which is the statistical fingerprint of distillation. So the open-weight model that's beating the locked-down model may have learned a chunk of its behavior from the locked-down models in the first place. And because the weights are public, the same researchers warned anyone can strip the safety alignment off it in an afternoon.

This challenges the whole premise of weights-based export control, with data. If the policy goal was limiting who has frontier cyber capability, the policy failed in under two weeks. You can't ban a download.

What builders should do: pull GLM-5.2 and benchmark it on your actual retrieval and reasoning tasks before assuming a US API is worth the per-token cost or the data egress. The 1M context and MIT license make it genuinely usable for self-hosted work where Opus or GPT can't legally go right now. But treat the distillation signal as a reason to verify outputs independently, not a reason to trust it blindly. A model that correlates 0.80 with GPT-5.5 will inherit GPT-5.5's failure modes too. Test it on the cases you care about, not the leaderboard.