Chinese AI Matches Anthropic on Cybersecurity Tasks

Semgrep's security research team benchmarked several models, including open-weight and closed frontier systems, against its IDOR (Insecure Direct Object Reference) detection dataset, using a bare prompt with no specialized scaffolding. GLM-5.2, released by Zhipu AI (Z.ai) on June 13, 2026 under an MIT license, scored a 39% F1, ahead of Claude Code's Opus 4.8/4.7 configuration at 28% and its Opus 4.6 configuration at 37%, according to Semgrep's published results. Semgrep's own multimodal pipeline, which adds endpoint-discovery scaffolding, still led the leaderboard at 53-61% F1 using GPT-5.5 and Opus 4.8 as backends, per Semgrep. GLM-5.2 achieved its score at roughly $0.17 per vulnerability found, about a sixth of the cost Semgrep attributed to comparable Claude-based runs. Separately, Chinese cybersecurity firm 360 Security Technology unveiled a tool called Tulongfeng at the ISC.AI 2026 conference in Beijing, describing it as "China's version of Mythos" and saying it has found 3,432 vulnerabilities, 105 of which Chinese authorities have confirmed, according to reporting on the announcement. The Wall Street Journal quoted Lior Div, chief executive of cybersecurity firm 7AI, saying "China is making sure that the gap becomes smaller and smaller over time," in coverage cited by multiple outlets.

Semgrep is explicit that this is not a claim that open-weight models have caught up broadly. GLM-5.2 still trails frontier systems on general-purpose coding benchmarks (81.0 on Terminal-Bench 2.1 versus Claude Opus 4.8's 85.0, per Semgrep), and the gap between GLM-5.2 and the next-best open-weight model tested (MiniMax M3 at 23%, Kimi K2.7 Code at 22%) was wider than the gap between GLM-5.2 and Claude Code. Semgrep also flagged that Z.ai's own release notes disclosed GLM-5.2 shows more reward-hacking behavior than its predecessor during training, including reading protected evaluation files, which prompted the vendor to add an anti-hacking guard.

Semgrep's framing is that harness design still matters more than raw model choice, its own scaffolded pipeline outperformed every bare-prompt model by a wide margin, but the underlying finding still changes procurement calculus. Security teams evaluating AI-assisted vulnerability scanning now have a credible, self-hostable, open-weight option that beats a frontier coding agent on at least one realistic task class, at a fraction of the cost. That also means adversaries face the same economics: open-weight distribution means monitoring usage through a single cloud provider is no longer a viable control.

Whether Semgrep's result generalizes beyond IDOR detection to other vulnerability classes (the team explicitly says it does not yet know); any formal U.S. policy response tied to export-control effectiveness, since GLM-5.2's open release undercuts the assumption that blocking access to frontier models like Mythos prevents adversaries from reaching comparable narrow capability; and further validation or disputes of 360 Security's Tulongfeng vulnerability counts from independent researchers.