Within the space of just over a month, a Beijing-based AI startup has made two of the most significant frontier safety moves by a Chinese model developer to date.
The startup is Z.AI, one of the leading developers of open-weight models.1 First, in an internal letter circulated on July 11, co-founder Tang Jie announced a plan to commit resources on the order of 10 billion RMB (around US$1.5 billion) to making AI systems more explainable. Then, on August 14, Z.AI declared that in light of dual-use risks from its latest model, GLM-5.3, it is pursuing a staged release and launching an initiative to help open-source maintainers audit their projects for vulnerabilities.
While some will say these actions don’t go far enough, I see these developments as a signal that Z.AI is genuinely expanding frontier safety efforts now that the capabilities of its models—and its financial resources—are increasing.2
For those of us who want to see stronger safety practices among Chinese AI companies, taking credible signs of investment seriously matters for reinforcing that investment and incentivising other companies to follow suit.
Tang’s letter, in context
Tang’s letter followed a volatile week in Z.AI’s shares, around the expiry of the post-IPO lock-up on cornerstone investors’ holdings. It also came amid a new share placement that raised around US$4 billion, more than seven times the company’s IPO proceeds. Against this backdrop, the letter is communicating—and justifying—to staff and investors the company’s intention to prioritise resource-intensive, fundamental AGI research over near-term revenue growth.
After discussing the technical barriers to AGI and how the company’s “Touch High” strategic investment plan will address them, Tang described the final part of the Touch High plan: “safety governance to the highest standard”.3 Here’s an excerpt (emphasis mine):
The more powerful the capabilities, the more robust the safety constraints must be... We plan to commit resources on the order of ten billion [presumably RMB, ~1.5 billion USD] to tackling “mechanistic interpretability”... At the same time, we actively participate in international AI governance to prevent the misuse of AI technology.4
This sense of urgency is not unfounded anxiety. When the world’s leading frontier models have their full public release delayed because of risk considerations, and the leaders of the companies developing them publicly warn that AI’s far-reaching effects will profoundly reshape the global balance of power, we should be all the more clear-eyed: the development of superintelligence and research on superalignment must advance in parallel…
History has shown time and again that when a technology attains a level of power capable of altering the course of civilisation, safety is no longer an ancillary feature. It becomes the fundamental precondition for the technology’s continued existence and authorised use.5
Tang’s thinking on safety is clearly heavily shaped by American AI leaders. Not only does he allude to delayed model releases in the U.S. and warnings from American AI lab leaders, but he also refers to two research concepts originating from American labs. The field of mechanistic interpretability was pioneered by Anthropic co-founder Chris Olah.6 Anthropic and OpenAI remain invested in this area, though sceptics argue that the field has demonstrated limited practical results and rests on flawed assumptions. The term superalignment (i.e., superintelligence alignment, or the problem of ensuring AI systems much smarter than humans follow human intent) was popularised by OpenAI.
Is there substance behind the rhetoric?
Z.AI’s interest in frontier safety isn’t coming out of nowhere. In 2024, CEO Zhang Peng and Tang attended the International Dialogues on AI Safety (IDAIS) and signed outcome statements on red lines in AI and AI safety as a global public good, respectively. The following year, Tang co-authored a position paper titled “The superalignment of superhuman intelligence with large language models”, which proposed a conceptual framework for superalignment. And in a May 2026 tweet, Tang even declared that “as this massive technical wave hits… we must also start thinking seriously about how to regulate it”.
In the past, Z.AI has not always followed through on its safety promises. The company’s investor prospectus highlights that it was the only Chinese AI company to sign the Frontier AI Safety Commitments at the AI Seoul Summit in 2024. Yet an accountability tracker found that by the February 2025 deadline, Z.AI had provided no evidence of implementation in any of the commitments’ five key areas.
There are reasons to think, however, that this time may be different. First, increasing evidence of dangerous AI capabilities—from the Mythos moment to reward hacking in Z.AI’s own coding agents—has likely raised concerns about legal and reputational risk within the company and made safety investments easier to justify. Second, Z.AI’s new access to public markets since its January IPO gives it more resources to make those investments. And third, its approach to releasing GLM-5.3 provides evidence that it’s already acting on the principle that “the more powerful the capabilities, the more robust the safety constraints must be”.
The GLM-5.3 release
The announcement of GLM-5.3—through an initial blog post and a safety-focused X post shortly after—was notable for the impressive capability improvements realised through post-training alone. But for safety advocates, it was Z.AI’s discussion of GLM-5.3’s cyber capabilities and risk mitigation process that stood out.7
Source: Z.AI on X
GLM-5.3 tops the CyberGym benchmark, which measures vulnerability identification and validation, and Z.AI says it has identified nearly 2,500 real-world vulnerabilities, whose disclosure status is recorded in a public ledger. On two other benchmarks assessing vulnerability exploitation capability, the model improves significantly on GLM-5.2 while remaining well behind Anthropic’s Mythos. To harness GLM-5.3’s vulnerability identification capabilities to strengthen cyber defences, Z.AI has launched OpenVuln, which scans submitted GitHub repositories for vulnerabilities and supports responsible disclosure and remediation.
To reduce the risk that GLM-5.3 is misused for offensive cyber attacks, the Z.AI-hosted services are deployed with an external classifier and reasoning monitor to help detect and prevent harmful cyber activity. Because an open-weight model hosted locally will not have these safeguards, Z.AI is relying instead on “deep safety alignment”: safety post-training that aims to reduce abuse without refusing legitimate tasks such as cyber defence and education.
To allow more time to test the effectiveness of this alignment, Z.AI is pursuing a staged release. GLM-5.3 is already available through GLM Coding Plan and ZCode. Selected security partners will evaluate it in controlled settings, API availability will follow, and once safety evaluations and red-team testing are complete, Z.AI will release the model weights.8 The blog post indicates that the model weight release will happen two weeks after launch, though posts on X have not specified the date. While the weights of Moonshot’s Kimi K3 were released 11 days after the model became available via Kimi’s hosted services, to my knowledge this is the first time a Chinese model developer has explicitly pursued a staged release due to safety concerns.9
However, Z.AI acknowledges that “once model weights are public, no developer can guarantee control over every downstream modification or use”. Researchers have shown, for example, that abliteration—a relatively low-cost technique that identifies and suppresses internal representations associated with refusal—can substantially disable models’ refusal behaviour without retraining. For this reason, best practice for open-weight releases is to evaluate how an open-weight model behaves after plausible adversarial modification. Z.AI does not state whether its evaluation process will incorporate this step.
I think it would have been better for Z.AI not to commit to a fixed date for model weight release, to allow as much time as necessary for safety evaluation and patching vulnerable systems. Thinking Machines Lab’s approach to staged release seems more sensible: “These stages are not a fixed sequence that automatically ends with releasing the model’s weights… Progression should depend on what we learn about the model and whether the surrounding ecosystem is ready”.
Nevertheless, Z.AI has clearly paid attention to safety concerns surrounding open-weight models, and is communicating more actively than any other Chinese AI lab about how it plans to address them. I expect this to put pressure on other Chinese labs reaching a similar capability level to follow suit.
The bottom line
Z.AI and other Chinese labs still lag behind top U.S. labs in building transparent and rigorous mechanisms to evaluate and mitigate frontier risks. But these signals of safety interest from Z.AI are unprecedented for a Chinese AI company. They could help encourage more responsible release practices from Chinese peers. And if Z.AI can more successfully balance blocking harmful requests while allowing legitimate use cases, it could add pressure on Western counterparts to refine their own cyber safeguards.
How much Z.AI discloses about its safety evaluations when it releases the GLM-5.3 weights, as well as whether it begins hiring substantially for interpretability roles, will be important early tests of whether the positive signals discussed here are translating into sustained action. For now, those genuinely wanting to track how AI safety is developing in China, rather than conveniently assume it away—which helps justify U.S. dominance or deregulation—should take this as the positive update that it is.
GLM-5.2 was the model Hugging Face used to respond to an attack from an OpenAI model that had escaped its evaluation environment.
In this piece I define “frontier AI safety” as efforts to prevent and mitigate extreme risks, including AI-enabled chemical, biological or cyber attacks and loss of control of highly capable, misaligned AI.
The Chinese “极致安全治理” has been translated elsewhere as “Extreme Safety Governance”, but I think “safety governance to the highest standard / pursued to the utmost” is a more natural rendering.
My guess is that Tang has in mind Z.AI’s signing of the Frontier AI Safety Commitments and International Dialogues on AI Safety participation in 2024, discussed further below. However, Z.AI’s placement on the Entity List in 2025 makes it harder for the company to participate in international safety dialogues and research collaborations, because Western entities will worry about the heightened legal and PR risks of engaging with it.
For those familiar with China’s 2020–21 crackdown on big tech – including the suspension of Didi’s expansion over data security concerns – it’s not difficult to see why AI entrepreneurs might expect serious violations of mainstream values or national security to provoke forceful regulatory intervention.
Mechanistic Interpretability for AI Safety: A Review defines mechanistic interpretability as “reverse engineering the computational mechanisms and representations learned by neural networks into human-understandable algorithms and concepts to provide a granular, causal understanding”.
As an aside, Z.AI describes the model’s cyber capability as “emergent”, but I think this could be a bit misleading as the company “introduced vulnerability discovery data and environments into the training mix during post-training”.
The security partners are not named, but the model launch blog post says Z.AI has been “working with several security teams in China” to use the model for vulnerability identification in real-world codebases.
From Moonshot’s language around the initial K3 announcement, I interpret the delay in model weight release as driven by a desire to ensure reliable technical implementation in collaboration with inference partners and open-source maintainers.