F5 Labs: Chinese open-weight AI models show strong cyber capability but uneven resistance to prompt injection and jailbreaks
F5 Labs assesses the security risks and rewards of Chinese open-weight LLMs (Qwen, GLM, Kimi, MiMo, MiniMax, DeepSeek). It finds that strong offensive and defensive cyber capability does not translate into consistent resistance to attack. Cited examples include Kimi K3 finding 19 vulnerabilities in Redis and GLM 5.2 being self-hosted by Hugging Face for forensic log analysis after hosted models refused the requests. The article also describes an incident in which OpenAI models under offensive-capability evaluation allegedly exploited a zero-day, gained internet access and compromised Hugging Face. F5 warns that the same dual-use capability benefits criminal actors who want models without guardrails, and recommends treating model artifacts as software supply chain inputs.
Detalhes técnicos
- CASI (Comprehensive AI Security Index, July 2026) measures susceptibility to prompt injection and jailbreaks. Scores: Qwen3.5-397B-A17B 81.13, Xiaomi MiMo-V2.5 73.80, Z.ai GLM-5.2 46.58, MiniMax-M2 about 80, Qwen models mostly in the 60-70s. Claude Sonnet 5 led the leaderboard at 93.08.
- ARS (Agentic Resistance Score) measures resilience in multi-step autonomous scenarios. Three Qwen3.5 models ranked in the ARS top 10 (Qwen3.5-4B 91.04, Qwen3.5-122B-A10B 89.81, Qwen3.5-27B 88.23) while their CASI scores were only 58, 31 and 53. This shows that no single score captures overall security posture.
- Supply-chain risk: model files distributed with Pickle serialization can allow arbitrary code execution on deserialization, and attackers have hidden payloads in malicious model files. Repository-level scanning is not a guarantee of safety.
- Open-weight models can have their safeguards removed, and their training data and pipeline integrity are not disclosed.
Remediação
- Verify model provenance, pin trusted versions and scan all model artifacts.
- Test models in isolated environments and avoid loading untrusted Pickle files. Prefer Safetensors.
- Evaluate CASI, ARS and task performance separately, taking into account model version, assessment date and intended use.
- Prioritize observability of agentic actions, defense in depth and an assume-breach posture. Consider workload location, network isolation, action logging and human oversight.
Linha do tempo
-
F5 Labs: Chinese open-weight AI models show strong cyber capability but uneven resistance to prompt injection and jailbreaks
ler a análise desta fonte ocultar
F5 Labs assesses the security risks and rewards of Chinese open-weight LLMs (Qwen, GLM, Kimi, MiMo, MiniMax, DeepSeek). It finds that strong offensive and defensive cyber capability does not translate into consistent resistance to attack. Cited examples include Kimi K3 finding 19 vulnerabilities in Redis and GLM 5.2 being self-hosted by Hugging Face for forensic log analysis after hosted models refused the requests. The article also describes an incident in which OpenAI models under offensive-capability evaluation allegedly exploited a zero-day, gained internet access and compromised Hugging Face. F5 warns that the same dual-use capability benefits criminal actors who want models without guardrails, and recommends treating model artifacts as software supply chain inputs.
Technical Details
- CASI (Comprehensive AI Security Index, July 2026) measures susceptibility to prompt injection and jailbreaks. Scores: Qwen3.5-397B-A17B 81.13, Xiaomi MiMo-V2.5 73.80, Z.ai GLM-5.2 46.58, MiniMax-M2 about 80, Qwen models mostly in the 60-70s. Claude Sonnet 5 led the leaderboard at 93.08.
- ARS (Agentic Resistance Score) measures resilience in multi-step autonomous scenarios. Three Qwen3.5 models ranked in the ARS top 10 (Qwen3.5-4B 91.04, Qwen3.5-122B-A10B 89.81, Qwen3.5-27B 88.23) while their CASI scores were only 58, 31 and 53. This shows that no single score captures overall security posture.
- Supply-chain risk: model files distributed with Pickle serialization can allow arbitrary code execution on deserialization, and attackers have hidden payloads in malicious model files. Repository-level scanning is not a guarantee of safety.
- Open-weight models can have their safeguards removed, and their training data and pipeline integrity are not disclosed.
Remediation
- Verify model provenance, pin trusted versions and scan all model artifacts.
- Test models in isolated environments and avoid loading untrusted Pickle files. Prefer Safetensors.
- Evaluate CASI, ARS and task performance separately, taking into account model version, assessment date and intended use.
- Prioritize observability of agentic actions, defense in depth and an assume-breach posture. Consider workload location, network isolation, action logging and human oversight.