Chinese AI Models Surge as Coinbase Halves Its AI Spend

For most of the past two years, the default assumption was that serious enterprise AI work meant paying OpenAI or Anthropic. That assumption is now under real pressure. Chinese AI models like GLM 5.2 and Kimi K2.7 have reached a point where cost-conscious companies are routing production traffic to them and reporting numbers that are hard to argue with. Coinbase says it cut its AI spending in half while using more tokens than ever, and a security vendor's benchmark put an open-weight Chinese model ahead of Claude Code on a real vulnerability-detection task. Neither data point settles the frontier-versus-open debate, but together they mark a shift in who gets the benefit of the doubt.

The story comes from two separate reports that point in the same direction. The Decoder detailed Coinbase's switch and the broader rush to Chinese models, while Semgrep published a hands-on benchmark comparing GLM 5.2 against frontier coding agents on security work. Read together, they describe the same underlying change from different angles, one about money and one about capability.

What Coinbase actually changed

Coinbase chief executive Brian Armstrong moved the company's AI workloads toward cheaper Chinese models, naming GLM 5.2 and Kimi K2.7 among them. The headline result is the one that gets attention in any finance meeting: the company is spending half what it used to on AI while consuming more tokens than at any point before. That combination only works if the per-token economics improve dramatically, which is exactly what swapping in lower-cost models does.

Armstrong has been unusually direct about leaning into AI rather than rationing it. "The more you spend on AI, the more impact we expect," he said, a framing that treats inference cost as an investment to scale rather than a bill to minimize. The trick, then, is not to use less AI. It is to make each unit of AI cheaper so you can use far more of it for the same budget. Cheaper models are the lever that makes that math work.

For a company like Coinbase, the scale of AI usage makes small per-token differences enormous in aggregate. A crypto exchange runs AI across fraud screening, customer support, code review, internal tooling, and a long tail of automation, and at that volume a price difference of several times over compounds into a budget line worth restructuring the stack around. Halving spend is not a rounding error at this size. It is the kind of number that justifies building a custom routing layer and retraining developer habits, which is precisely what the company did rather than treating the model choice as a set-and-forget decision.

The routing and caching playbook

The savings did not come from a single model swap. Coinbase built an automated routing system that picks a model for each request based on the task, the price, and how well the request can be cached. Cheap models handle the bulk of routine work, and more expensive options get reserved for the cases that genuinely need them. This is the same idea behind the model routers that have become common across AI platforms, applied here with cost as a first-class input rather than an afterthought.

Caching did a lot of the heavy lifting. According to The Decoder, better caching pushed Coinbase's hit rate from 5 percent up to 60 percent. A cache hit means a request is served from stored results instead of triggering a fresh, billable inference call, so a jump of that size translates directly into lower spend. Coinbase also pushed its developers toward what it calls context engineering, instructing them to keep prompts lean and to start fresh sessions for new tasks rather than dragging long histories along. Shorter context means fewer tokens per call, which compounds the routing and caching gains.

It is worth sitting with how those levers stack. A routing system that sends the cheapest capable model at each task already lowers the average price per request. Layer a 60 percent cache hit rate on top and more than half of all requests cost effectively nothing in fresh inference. Then trim the context each remaining call carries, and the billable tokens per uncached request fall too. Each technique is modest on its own. Multiplied together, they explain how a company can grow its token consumption and still watch the invoice shrink. The model swap supplies the low base price, and the engineering discipline supplies the volume efficiency.

GLM 5.2 in a real security benchmark

Price means little if the cheaper model cannot do the work. That is what makes Semgrep's benchmark interesting. The security vendor tested vulnerability detection for IDOR, short for Insecure Direct Object References, a class of access-control flaws where an application exposes internal identifiers without checking whether the requester is authorized to see them. It is a genuinely hard reasoning task, not a toy puzzle, because catching it requires understanding application logic rather than pattern-matching on syntax.

IDOR is a good stress test for exactly this reason. A static scanner can spot a SQL query built from unsanitized input, but an IDOR flaw often looks like perfectly ordinary code. An endpoint accepts an identifier, fetches the matching record, and returns it. Nothing is syntactically wrong. The bug is the missing check that should confirm the requester owns that record. Finding it means the model has to reason about intent and authorization across a request flow, the kind of judgment that separates a real code-understanding system from a glorified linter. A model that does well here is demonstrating something closer to comprehension than retrieval.

Semgrep ran the test with a fixed IDOR dataset drawn from real open-source applications, scored results by F1 against known true positives, and used an identical system prompt across configurations. The open-weight models, including GLM 5.2, ran in a basic harness with the prompt alone and no custom scaffolding. GLM 5.2 posted a 39 percent F1 score. The Claude Code configurations landed below it, with the best Opus 4.6 setup at 37 percent and newer Opus 4.8 and 4.7 runs lower still at 28 percent. Semgrep summarized the gap as GLM 5.2 beating Claude Code by 7 percentage points, 39 against 32, while receiving minimal help from the harness.

The cost angle sharpens the point. Semgrep estimated GLM 5.2 worked out to roughly $0.17 per vulnerability found, cheap enough to run at scale across a large codebase without the bill becoming the limiting factor. For a security team scanning thousands of endpoints, that price-to-result ratio is the number that decides whether a tool gets deployed widely or stays a curiosity.

Why the benchmark is not a clean win

Semgrep was careful not to oversell its own result, and the caveats matter. The top two spots did not go to any standalone model. They went to Semgrep's own multimodal harness, which scored 61 percent paired with GPT-5.5 and 53 percent paired with Opus 4.8. The lesson the authors drew was blunt: "the harness still matters more than the model." Scaffolding, endpoint discovery, and the surrounding infrastructure delivered bigger gains than swapping one model for another. GLM 5.2 looked strong precisely because it did well with almost no scaffolding, which suggests headroom rather than a ceiling.

The other caveats are the usual ones for a single benchmark. This was one task on one dataset, IDOR detection is non-deterministic, and the results may not carry over to other vulnerability classes such as server-side request forgery. Semgrep also noted that open-weight models generally still trail frontier models, and framed GLM 5.2 as an outlier rather than proof that the gap has closed. None of that erases the result. It just keeps it in proportion.

What GLM 5.2 actually is

GLM 5.2 is an open-weight model from Zhipu AI, which operates internationally as Z.ai, released on June 16, 2026. Under the hood it is a mixture-of-experts design with around 750 billion total parameters and roughly 40 billion active per token, so it activates only a fraction of its weights on any given request. Zhipu extended the context window to 1 million tokens, up from 200,000 in the prior generation, and published the weights under an MIT license, which is permissive enough for commercial use and self-hosting.

On Zhipu's own reported benchmarks, GLM 5.2 scored 81.0 on Terminal-Bench 2.1 and 62.1 on SWE-bench Pro, putting it in the conversation with frontier coding models on agentic tasks. The pricing claim is the one that drives adoption, though: the model runs at approximately one-sixth the cost of comparable frontier offerings. That single ratio explains most of the enterprise interest. When a model lands close enough on capability and a fraction of the price, the burden of proof shifts onto staying with the expensive option.

The mixture-of-experts structure is part of why the price can be so low. Because only about 40 billion of the 750 billion parameters fire on any given token, the compute cost of a forward pass is closer to a 40-billion-parameter model than a dense network of the full size. That is how Zhipu can offer frontier-adjacent quality at serving costs that undercut dense frontier models. The MIT license adds a second dimension that pure API pricing cannot match. A company that wants to can download the weights and run the model on its own hardware, which removes per-token API fees entirely and keeps sensitive prompts inside its own infrastructure. For regulated industries that have been wary of sending data to a third-party API, self-hosting an open-weight model is a materially different proposition from renting a closed one.

The pricing stress test for Western labs

Coinbase is not an isolated case, which is what turns this from an anecdote into a trend. The Decoder reported that the startup Lindy switched to DeepSeek V4, and that Snowflake has been testing Chinese models as alternatives to OpenAI and Anthropic. The phrase the piece used, a pricing stress test, captures the dynamic well. As more cost-conscious companies route real workloads to cheaper models and find them adequate, the premium that Western labs can charge comes under direct question.

The timing makes the pressure more acute. Some Western labs are reportedly eyeing public offerings and need revenue projections that hold up under scrutiny, which is harder when a visible slice of enterprise demand is migrating to one-sixth-price alternatives. There are signs the incumbents feel it. A price war between OpenAI and Anthropic is said to be brewing, and OpenAI has positioned its GPT-5.6 Sol model as more token-efficient than Claude variants, efficiency being another way of saying cheaper to run for the same output.

It would be a mistake to read this as Chinese models simply winning. The frontier labs still lead on the hardest tasks, and Semgrep's own harness result shows that the model is often not the bottleneck. What has changed is the default. For a large and growing band of production workloads, routine classification, code assistance, retrieval, and bulk processing, the open-weight Chinese models are now good enough that paying frontier prices needs a justification it did not need a year ago.

The trust and sovereignty question

Running a model built in China raises questions some enterprises take seriously, from data governance to procurement policy to plain caution about where their prompts travel. The reassuring part of the current wave is that the models in question are open-weight rather than API-only. A company concerned about sending data to a Chinese-operated endpoint does not have to. It can pull the GLM 5.2 weights under the MIT license and serve them from its own cloud account or on-premises hardware, in which case no prompt ever leaves its control. The model's national origin becomes a question about training provenance rather than data handling, which is a narrower and more manageable concern.

That distinction is doing quiet work in the adoption numbers. The companies most able to move fast here are the ones with the engineering capacity to self-host, because they capture the full cost saving and sidestep the data-residency worry at the same time. For teams without that capacity, the calculus is closer to a normal vendor decision, weighing price against the comfort of a known provider. Either way, the existence of a permissively licensed alternative changes the negotiation. A buyer who can credibly threaten to self-host an open-weight model has leverage that a buyer locked into closed APIs never had.

None of this means trust concerns evaporate. Open weights do not come with a guarantee about how the model was trained or what behaviors are baked in, and serious deployments still warrant evaluation against a team's own data and threat model. Semgrep's caution about a single benchmark applies here too. The point is narrower and still significant: the option now exists, it is cheap, and on a meaningful set of tasks it performs, which is enough to reshape what counts as the safe default.

Where this leaves teams making the call

The practical question for any team is no longer whether the cheaper models work but where the line sits between good enough and not yet. Coinbase's answer was to let an automated router draw that line per request, sending most traffic to inexpensive models and escalating only when a task demands it. That is a more honest architecture than picking one model and hoping it covers every case, and it is increasingly the pattern serious AI platforms converge on. We have written before on the MaShop blog about how model routing changes the economics of building on top of these systems, and the Coinbase numbers are a vivid illustration of why.

The deeper signal is about leverage. When the cost of inference drops by five-sixths for workloads that previously sat on frontier models, the constraint on how much AI a company can afford loosens enormously, which is precisely why Armstrong frames spending as impact rather than overhead. The Chinese open-weight models did not have to beat the frontier to matter. They only had to be close enough, cheap enough, and licensed permissively enough to make the routing math work, and on a growing list of tasks they now clear all three bars. The labs that priced their products on the assumption that there was no credible alternative are the ones now running their own stress test.