US China AI Race: Z.AI Catches Up to Anthropic's Mythos

Something happened this month that should make every cybersecurity professional and policy watcher sit up straight. A Chinese AI company called Z.AI — formally known as Zhipu AI — released a model called GLM-5.2 that, in specific bug-finding tests, matched Anthropic's Mythos. That's not a typo. A Chinese open-weight model went toe-to-toe with one of the most closely guarded American AI systems in a domain that matters more than almost any other right now: finding the vulnerabilities hackers exploit.

The US China AI race just got a lot more complicated. And the way Washington is handling it? Well, let's just say the policy response has been... inconsistent.

How Z.AI Narrowed the US China AI Race

For the past two years, the conventional wisdom went something like this: American AI labs lead, Chinese companies chase, and the gap stays wide enough that export controls and chip bans keep things manageable. That story is breaking down in real time.

Z.AI's GLM-5.2 didn't just show up. It ranked among the ten most-used AI models on OpenRouter, a platform that tracks usage across more than 400 systems. In benchmarking from the cybersecurity firm Semgrep, GLM-5.2 actually outperformed Anthropic's Claude Opus 4.8 — the model Anthropic released in May. Give both models the right instructions, and they match Mythos in bug-finding ability.

Chinese cybersecurity company 360 Security Technology dropped its own tool, Tulongfeng, which its CEO Zhou Hongyi claims rivals Mythos as well. Zhou didn't mince words at a Beijing conference: "This kind of powerful weapon that can alter the landscape of cyberwarfare can't remain solely in American hands."

The capability gap is closing. That's the headline. The story underneath — about open weights, distillation, and a US policy apparatus that seems to be tripping over its own feet — is where things get genuinely interesting.

Open-Weight Models: A Double-Edged Sword

Here's what makes GLM-5.2 different from Anthropic's or OpenAI's offerings. It's open-weight. Anyone can download it. Anyone can run it on their own hardware. Anyone can modify it, fine-tune it, strip out the guardrails, and deploy it without oversight.

For legitimate users — researchers, small businesses, developers who want full control over their stack — that's the whole point. Open-weight models give you sovereignty over your tools. You're not renting intelligence from a San Francisco company that can change the terms of service on a Tuesday.

For hackers? It's a dream. A model that can find software vulnerabilities, running in the shadows with no supervision, no logging, no corporate gatekeeper watching for suspicious patterns. That's the tradeoff, and it's not going away.

Lior Div, CEO of cybersecurity firm 7AI, put it plainly: "China is making sure that the gap becomes smaller and smaller over time." And when that gap closes with open-weight models, the US government loses its primary lever of control. You can restrict chip exports all you want, but you can't un-download a model that's already circulating.

Washington's Self-Defeating Strategy

If you want to understand why so many observers are frustrated with the current administration's approach, look at the timeline of the past few weeks.

OpenAI announced it's limiting access to GPT-5.6 over security concerns. Anthropic had one of its latest general-use models shut down for over two weeks because the administration said no foreign entity could use it. The NSA — yes, the National Security Agency — was among the users who lost access while they were testing these tools and finding them genuinely impressive.

The administration partially restored access to Mythos 5 on Friday for "trusted entities." The damage was already done. And the optics are brutal.

Saif Khan, a technology fellow at the Institute for Progress who worked on export restrictions during the Biden administration, summed up the contradiction: "Banning Fable while selling chips China needs to develop its own version is a gift to China."

You read that right. The US is simultaneously restricting its own companies from distributing their most capable models while allowing the hardware exports that let Chinese firms build competing systems. American businesses — including Microsoft — are weighing whether to offer Chinese models on their own platforms because they're cheaper and, increasingly, good enough.

Jacob Helberg, the undersecretary of state for economic affairs, told reporters the administration is "very much focused on Chinese open-source models" and tracking them closely. Closely enough, apparently, to watch them gain market share while domestic policy pushes companies toward those very alternatives.

Niels Provos, a researcher who led security teams at Google and Stripe, didn't hide his confusion: "It is incentivizing companies across the globe to use cheaper but very capable Chinese open-weight models, while at the same time undermining the US AI industry. I don't understand it."

The Distillation Problem Anthropic Won't Ignore

There's a second front in this story that's less about benchmarks and more about intellectual property on an industrial scale.

Anthropic sent a letter to Senators Tim Scott and Elizabeth Warren in early June alleging that operators linked to Alibaba conducted nearly 29 million exchanges with Claude using thousands of fraudulent accounts. The goal: distillation. That's the process of pumping a powerful model full of questions, recording the answers, and using that data to train a smaller, cheaper model that mimics the original's capabilities.

Anthropic called it "the largest campaign to illicitly extract Claude's capabilities" — and accused Alibaba of targeting the model's most valuable traits, including its ability to handle complex, multi-step reasoning.

OpenAI has made similar accusations against Chinese groups. The US Department of Defense has claimed that Alibaba, BYD, Baidu, and other major firms have ties to the Chinese military — allegations those companies deny. Alibaba recently sued the US government to get itself removed from the Pentagon's blacklist.

Whether you view distillation as legitimate reverse-engineering or outright theft depends on your perspective. The practical effect is the same: it lets well-funded competitors replicate years of expensive American R&D at a fraction of the cost. Anthropic's letter put it bluntly: "Distillation attacks turn hundreds of billions of dollars in American investment and research and development into a massive subsidy for our geopolitical competitors."

The Pentagon recently signed a deal with Reflection AI, one of the few domestic open-weight developers, for use in classified settings. It's a small signal that Washington understands the open-weight trend isn't going away and that the US needs its own competitive options.

A single contract doesn't fix the underlying contradictions. You can't simultaneously strangle your own companies' distribution channels and expect them to outpace competitors who face no such restrictions. You can't restrict access to advanced American models and be surprised when global users — including American businesses — drift toward capable, cheaper Chinese alternatives.

The US China AI race was never going to be won by whoever builds the single most powerful model. It was always going to be about who controls the ecosystem — the distribution, the standards, the trust. Right now, American policy is handing pieces of that ecosystem to Beijing for free.

The question isn't whether Chinese AI can catch up. It already has, in the areas that matter most. The question is whether Washington will notice before the lead slips entirely.