GLM does seem to have security related safeguards but they revolve around just confirming whether or not you own the system being operated on. As soon as that check is cleared, it will do anything.
Reminds me of 'NOBUS', where security agencies would believe that so long as you just don't tell anyone about a vulnerability that you discovered or introduced, nobody else would abuse that vulnerability to exploit a target while you can get access at any time. Training an LLM in such a way that it only generates the desired tokens if its memory demonstrates authorisation (surely nobody else could inject the right context otherwise) feels like a strange anthropomorphisation
It is not a protection for society against the person deploying the model.