WhitzardNUWA Lab ↗
NUWANUWA INDEX

Search NUWA Index

Research · Benchmarks · Findings · Perspectives

中文
← Models

Z.ai

GLM-5.2

Published evidence on capabilities, behavioral tendencies and observed actions.

First public availability
2026-06-16
Parameters
Not disclosed
Metadata updated
2026-10-27
Sources ↓

Evidence overview

Neo and SaferAI examine different aspects of GLM-5.2. Neo’s behavioral and persuasion experiments use their own scenarios and judges; SaferAI reports cyber capability and honesty evaluations under distinct task selections and budgets. These studies do not supply interchangeable measures of one latent safety score.

NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.

MODEL MONITORING

Representative benchmark coverage

Results by protocol and configuration; gaps show records awaiting collection or linkage.

Attempt to Persuade Eval (APE) →

4 measurements

  • 1%Neo Research · Attempt to Persuade Eval; propensity/attempt classification, not persuasion success
  • ≈70%Neo Research · Attempt to Persuade Eval; propensity/attempt classification, not persuasion success
  • 43%SaferAI · APE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifier
All conditions →

PersuSafety →

4 measurements

  • 54%Neo Research · Harness not disclosed
  • 6%Neo Research · Harness not disclosed
  • 54%Neo Research · APE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replaced
All conditions →

All linked measurements

Each result retains its protocol and unit.

80 observations

Measurements and source conditions
System / modelResultCondition statusTask / conditionsEvaluator / reportDates
GLM-5.236.63%CyberGym · CyberGym pass@1IncompleteCyberGym Level 1 hard-task matched subsetprovider-default reasoning2M tokens per taskInspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.2 · RedbudAIGLM-5.286.3%CyberGym · Success rateIncompletelevel1score_10RedbudAINot disclosedCyberGym official leaderboard and machine-data extractionRelease 2026-06-16Report —
GLM-5.2 · DoGNAVYGLM-5.290.8%CyberGym · Success rateIncompletelevel1score_10DoGNAVYNot disclosedCyberGym official leaderboard and machine-data extractionRelease 2026-06-16Report —
GLM-5.2 · Sangfor AIGLM-5.286.3%CyberGym · Success rateIncompletelevel1score_10Sangfor AINot disclosedCyberGym official leaderboard and machine-data extractionRelease 2026-06-16Report —
GLM-5.2 · Xuanwu Atuin AIGLM-5.284.8%CyberGym · Success rateIncompletelevel1score_10Xuanwu Atuin AINot disclosedCyberGym official leaderboard and machine-data extractionRelease 2026-06-16Report —
GLM-5.263.37%CyberGym · CyberGym pass@1IncompleteCyberGym Level 1 hard-task matched subsetprovider-default reasoning10M tokens per taskInspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.276.24%CyberGym · CyberGym pass@1IncompleteCyberGym Level 1 hard-task matched subsetprovider-default reasoning50M tokens per taskInspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.285.29%Cybench · Cybench pass@1IncompleteCybench 34/40 task subsetCybench pass@130M total tokens; 131000 output/generationInspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.280%Cybench · Cybench category pass@1IncompleteCybench CryptographyCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.266.67%Cybench · Cybench category pass@1IncompleteCybench WebCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.2100%Cybench · Cybench category pass@1IncompleteCybench PwnCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.2100%Cybench · Cybench category pass@1IncompleteCybench Reverse Eng.Cybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.2100%Cybench · Cybench category pass@1IncompleteCybench ForensicsCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.2100%Cybench · Cybench category pass@1IncompleteCybench MiscCybench category pass@1Inspect EvalsSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.255%MASK · Honest under pressureIncompleteMASK—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.255%MASK · MASK response proportion: HonestIncompleteMASKhonesty under pressure—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.228%MASK · MASK response proportion: Evaded or No BeliefIncompleteMASKhonesty under pressure—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.217%MASK · MASK response proportion: LyingIncompleteMASKhonesty under pressure—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.23.9%MASK · MASK verbalised evaluation-awareness rateIncompleteMASK evaluation CoT cross-checkchain-of-thought monitorCoT evaluation-awareness monitor over MASK evaluations; monitor model not statedNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.232%Agentic misalignment · Agentic-misalignment verbalised evaluation-awareness rateIncompleteAgentic-misalignment; blackmail / ambiguous / replacement scenarios (Figure 7 title)CoT monitor · 100 epochs per scenarioAgentic-misalignment scenario; judge DeepSeek V4 Pro; figure footer: same protocol across releases; SE from 100 epochs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.257%Agentic misalignment · Harmful actions[39–73]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.243%Agentic misalignment · Harmful actions[27–61]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.210%Agentic misalignment · Harmful actions[3–26]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.217%Agentic misalignment · Harmful actions[7–34]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.23%Agentic misalignment · Harmful actions[1–17]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Agentic misalignment · Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.230%Agentic misalignment · Agentic Misalignment verbalized evaluation awarenessIncompleteAgentic Misalignment evaluationAgentic Misalignment verbalized evaluation awareness—SaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.211.3%DeceptionBench · Single-turn deceptionIncompleteDeceptionBench—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.216.7%DeceptionBench · Multi-turn deception under pressureIncompleteDeceptionBench—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.211.3%DeceptionBench · DeceptionBench deception scoreIncompleteDeceptionBenchsingle-turn—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.216.7%DeceptionBench · DeceptionBench deception scoreIncompleteDeceptionBenchmulti-turn with pressure—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.254%PersuSafety · Medium-harm attempt rateIncompletePersuSafety adapted free-generation judge—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.26%PersuSafety · High-harm attempt rateIncompletePersuSafety adapted free-generation judge—Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.254%PersuSafety · Modified-PersuSafety persuasion-attempt rateIncompletePersuSafety: Medium harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replacedNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.26%PersuSafety · Modified-PersuSafety persuasion-attempt rateIncompletePersuSafety: High harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replacedNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.2 · DoGNAVYGLM-5.279 countExploitGym · Intended-target successesIncompleteVersion not specifiedon_targetselected subsetDoGNAVYNot disclosedExploitGym official leaderboard and benchmark pageRelease 2026-06-16Report —
GLM-5.2 · Claude CodeGLM-5.239 countExploitGym · Intended-target successesIncompleteVersion not specifiedon_targetrescaled 6h timeoutClaude CodeNot disclosedExploitGym official leaderboard and benchmark pageRelease 2026-06-16Report —
GLM-5.2 · Claude CodeGLM-5.229 countExploitGym · Intended-target successesIncompleteVersion not specifiedon_targetrescaled 2h timeoutClaude CodeNot disclosedExploitGym official leaderboard and benchmark pageRelease 2026-06-16Report —
GLM 5.2GLM-5.21 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Alignment Eval SabotageObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Incident ResponseObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21.4 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Multi-Agent RankingObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21.2 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Research DeadlineObserveGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21.8 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Alignment Eval SabotageRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21.4 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Incident ResponseRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.22 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Multi-Agent RankingRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.24.2 score (1–10)Petri · Gram mean concerning scoreIncompleteGram: Research DeadlineRedteamGram (Google DeepMind Petri variant); auditor Claude Sonnet 4.6; judge Kimi K2.6; SE across 5 independent runs per scenarioNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.21%Attempt to Persuade Eval (APE) · APE persuasion-attempt rateIncompleteAttempt to Persuade Eval: Noncontroversially HarmfulTurn 1Attempt to Persuade Eval; propensity/attempt classification, not persuasion successNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM 5.2GLM-5.2≈70%Attempt to Persuade Eval (APE) · APE persuasion-attempt rateIncompleteAttempt to Persuade Eval: Undermining ControlTurn 1Attempt to Persuade Eval; propensity/attempt classification, not persuasion successNeo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion RisksRelease 2026-06-16Report 2026-07-03
GLM-5.243%Attempt to Persuade Eval (APE) · APE Turn-1 persuasion-attempt rateIncompleteAPE Conspiracy (main persuade condition)xhighAPE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifierSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.247%Attempt to Persuade Eval (APE) · APE Turn-1 persuasion-attempt rateIncompleteAPE Undermining control (main persuade condition)xhighAPE simulated persuadee; automated attempt evaluator; StrongREJECT refusal classifierSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02

Developer disclosures

GLM-5.2 Model Card →

Developer documentation covering GLM-5.2.

Publication date not verified
Source extraction reviewed; scope documented

External assessments

SaferAI

GLM-5.2 Risk Evaluation Report →

The report finds substantial task capability and pressure-dependent behavior; comparison figures include both SaferAI runs and reused external results.

2026-08-02

CyberGym official snapshot →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

Publication date not established

ExploitGym official snapshot →

Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.

Publication date not established

Evidence by risk topic

Autonomy 38 protocol results
Deception 45 protocol results

MASK →

External evaluation · Executed by Neo Research

Honest under pressure
55%

See the report-specific sample and denominator.

DeceptionBench →

External evaluation · Executed by Neo Research

Single-turn deception
11.3%
Multi-turn deception under pressure
16.7%

See the report-specific sample and denominator.

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Honest
55%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Evaded or No Belief
28%

Per-result sample size not disclosed

MASK →

External evaluation · Executed by Neo Research

MASK response proportion: Lying
17%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

DeceptionBench deception score
11.3%

Per-result sample size not disclosed

DeceptionBench →

External evaluation · Executed by Neo Research

DeceptionBench deception score
16.7%

Per-result sample size not disclosed

Cybersecurity 18 protocol results

Cybench →

External evaluation · Executed by SaferAI

Cybench pass@1
85.29%

29/34

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
80%

12/15

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
66.67%

4/6

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

2/2

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

5/5

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

4/4

Cybench →

External evaluation · Executed by SaferAI

Cybench category pass@1
100%

2/2

CBRN No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Disinformation 7 protocol results

PersuSafety adapted free-generation judge →

External evaluation · Executed by Neo Research

Medium-harm attempt rate
54%
High-harm attempt rate
6%

Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.

APE →

External evaluation · Executed by Neo Research

APE persuasion-attempt rate
1%

Per-result sample size not disclosed

APE →

External evaluation · Executed by Neo Research

APE persuasion-attempt rate
≈70%

Per-result sample size not disclosed

APE Turn-1 attempts →

External evaluation · Executed by SaferAI

APE Turn-1 persuasion-attempt rate
43%

Source denominator: 100 (unit not disclosed)

APE Turn-1 attempts →

External evaluation · Executed by SaferAI

APE Turn-1 persuasion-attempt rate
47%

Source denominator: 100 (unit not disclosed)

Autonomous physical harm No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Source review and evidence gaps

CyberGym →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.

ExploitGym →

Published evaluation results collected from ExploitGym, retaining the reported systems and configurations.

Intended-target success and flag capture are distinct counts. Task versions and timeout cutoffs remain separate. Catalogue size is not assumed to be the denominator for each submission.

GLM-5.2 Risk Evaluation Report, Version 1.1 →

Source-specific extraction of SaferAI · GLM-5.2. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

GLM-5.2 — official Z.ai Hugging Face model card →

Source-specific extraction of GLM-5.2 Model Card. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Evaluation configuration

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Evaluation configuration

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Dedicated frontier-risk evaluation disclosure

The reviewed developer document does not disclose a dedicated frontier-risk evaluation.

Resolve source conditions and dependencies before cross-source comparison or planning a new experiment.

Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.

Interpretation and open questions

Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.

References

  1. [1] Z.ai release notes ; GLM-5.2 entry dated 2026-06-16
  2. [2] GLM-5.2 model card ; Parameter counts not disclosed in reviewed developer source
  3. [3] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §1; Figure 1; §1; Figure 2; §2; Figure 6
  4. [4] GLM-5.2 Risk Evaluation Report. 2026-08-02. v1.1 · revised 26 August 2026 ; §2.2; Figure 3; p.6 Fig.1; p.6 Fig.2 printed bar label
  5. [5] CyberGym official leaderboard and machine-data extraction ; /level1/21/score_10; /level1/22/subRows/0/score_10; /level1/39/subRows/1/score_10
  6. [6] ExploitGym official leaderboard and benchmark page ; /results/12/on_target; /results/14/on_target; /results/14/subRows/0/on_target