The pattern is familiar: as soon as an open-source language model shows capabilities that were once confined to expensive cloud services or proprietary black boxes, the rhetoric of the «dangerous tool» follows. With GLM-5.2, the script is déjà vu — but with an added element that deserves attention: the absolute absence of a vendor acting as middleman. The model can be downloaded by anyone and, crucially, runs on virtually any hardware. There’s no need to reserve GPUs on a hyperscaler or pay a monthly fee. It’s a self-hosted LLM in the purest sense, and that scares people.

The controversy was sparked by a Futurism article headlining the «scary mythos» of an out-of-control AI, citing benchmarks from Semgrep and Graphistry. The two security teams verified that GLM-5.2 is capable of identifying software bugs and performing cybersecurity tasks typically handled by human specialists or paid platforms. Semgrep even quipped with a revealing title: «We Have Mythos at Home», hinting that models similar to Mythos (or Fable) are now accessible at zero cost, outside controlled circuits.

That’s the crux of the matter. The press paints a scenario where hackers and cybercriminals could abuse the same technology to bypass established defenses. Is the risk real? Yes, as with any dual-use tool. But the fear is artificially amplified by those who profit from an ecosystem where powerful AI always passes through a central provider. The crucial difference with GLM-5.2 is that there’s no middleman to monetize access, log queries, or decide what’s allowed. For organizations evaluating on-premise deployment, this means data sovereignty and zero dependency on an external API, but also the burden of putting robust countermeasures in place — because the security perimeter is no longer guarded by the provider but by one’s own infrastructure.

The episode signals a structural shift: the inference of increasingly powerful models is being compressed into quantized forms that run on consumer hardware. It’s not science fiction; it’s the effect of quantization and aggressive optimization. GLM-5.2 isn’t the first, but its ability to run on «virtually any hardware» raises the bar for technical autonomy. Those who win are the ones holding sensitive data that they want to protect without cloud transit; those who lose are the vendors that have so far sold turnkey security through controlled APIs.

Still, crying wolf without offering solutions is a boomerang. The answer cannot be censorship or the closure of open repositories, as the original Reddit poster fears. What’s needed instead are audit frameworks and defense tools that operate on the same plane: open models to test open models, in a transparency that embarrasses the champions of closed boxes. After all, if a company like Semgrep can take GLM-5.2 and turn it into a public benchmark, the real antidote isn’t secrecy, but distributed expertise.