AI Export Controls Are Failing: How China's Open-Weight Models and Distillation Attacks Collapsed the Frontier

Cybersecurity benchmark performance:

• In Semgrep's independent testing, GLM-5.2 scored 39% F1 on IDOR detection, beating Claude Code (32%) at roughly $0.17 per vulnerability found — a fraction of the cost of proprietary alternatives .
• A Wall Street Journal report stated GLM-5.2 matched Anthropic's Mythos at spotting security bugs in targeted Semgrep tests .
• It scored 81.0 on Terminal-Bench 2.1 (versus 63.5 for GLM 5.1) and outperformed Claude Opus 4.8 on the MCP-Atlas tool-use benchmark (77.0 vs. 75.3) .
• Artificial Analysis ranked it the #1 open-weight model globally and in the top 3 overall across all models .
• On Simbian's Cyber Defense Benchmark, it ranked #4, beating Opus 4.8, Opus 4.7, GPT-5, and GPT-5.5 .

Cost advantage: The model runs at approximately 1/6 the cost of equivalent proprietary U.S. frontier models per token, and the weights are downloadable for self-hosting with no API fee .

Important caveat: AVERI's Miles Brundage has publicly offered a 100-to-1 bet disputing the WSJ's claim that GLM-5.2 genuinely matches Mythos on cybersecurity, arguing the benchmark scope was narrow . The parity claim is real on specific Semgrep tests but may not generalize to broader evaluation.

2. 360 Security's "Tulongfeng": Indigenous Vulnerability Discovery

On June 24, 2026, at the ISC.AI conference in Beijing, Chinese cybersecurity giant 360 Security Technology (Qihoo 360) unveiled two AI-powered cybersecurity tools :

• Tulongfeng — an AI system for automatically discovering software vulnerabilities, explicitly billed by founder Zhou Hongyi as "China's version of Mythos" .
• Yitianzhen — a platform for automating cyber defense and incident response .

Zhou Hongyi stated that China "could not afford to lack" a domestic equivalent to Mythos, framing it as a strategic cyber capability . The tools were built to match Frontier-class AI threat-detection capabilities without relying on restricted U.S. models or hardware . According to reports, Tulongfeng has already identified over 3,400 vulnerabilities, with 105 reportedly confirmed by China's CNVD database .

3. Anthropic's Accusation Against Alibaba: Distillation as a Bypass Mechanism

On June 24–25, 2026, Anthropic sent a letter to U.S. senators (dated June 10) accusing Alibaba and its Qwen AI lab of executing "the largest known distillation attack" against its Claude model .

Key details from the letter:

• Operators used approximately 25,000 fraudulent accounts to carry out more than 28.8 million interactions with Claude between April 22 and June 5, 2026 .
• The campaign was intended to extract model capabilities through distillation — training Alibaba's own models on Claude's outputs — thereby circumventing U.S. export controls that restrict direct transfer of model weights .
• Anthropic called the operation "brazen" and "unlawful" .

Alibaba has not publicly admitted wrongdoing . Distillation, as described, is a method that effectively renders hardware-based export controls less relevant because knowledge (rather than weights) is transferred, and the trained model can run on whatever compute is locally available.

What This Means for U.S. Export Controls

The collective effect is a strategic blow to Washington's framework:

What This Means for Cost and Accessibility of Cybersecurity Tools

1. Cost collapses. Semgrep's testing showed GLM-5.2 finding vulnerabilities at ~$0.17 per exploit versus much higher per-vulnerability costs for proprietary U.S. models . The open-weight MIT license means zero licensing fees. 360's tools are domestic products for the Chinese market, likely priced below U.S. alternatives .

2. Accessibility expands dramatically.

• Any security team with modest GPU infrastructure can self-host GLM-5.2 for automated code auditing .
• Chinese companies and state-aligned entities now have direct access to automated zero-day discovery tools (Tulongfeng) that were previously only available from U.S. labs under strict controls .
• The combination of open-weight LLMs, distillation, and indigenous tools means advanced cybersecurity AI is no longer a U.S. monopoly at any price point .

3. Offensive-defensive parity blurs. The same GLM-5.2 model that finds bugs at $0.17 each, and the same Tulongfeng tool, can be used for both vulnerability patching and offensive exploit discovery. With open weights and no oversight layer, it is difficult to distinguish defensive from offensive use .

The bottom line: The export-control paradigm assumed that restricting NVIDIA chips and model weights would keep Chinese frontier AI capabilities 2-3 generations behind. GLM-5.2 (open-weight, MIT-licensed, matching U.S. frontier on specific cybersecurity benchmarks at 1/6 the cost), Tulongfeng (domestic Mythos-class tool), and the Alibaba distillation episode collectively demonstrate that knowledge, capability, and access have already escaped the control regime. Advanced cybersecurity tools have gone from scarce, U.S.-only, high-cost products to globally accessible, low-cost, open-commodity assets in a matter of weeks.