Tencent AI chief warns bioweapons are coming and backs a middle path on model access

Tencent’s chief AI scientist, Vinces Yao Shunyu, has warned that AI systems could soon help develop bioweapons, while arguing that neither fully open nor fully closed models offer a complete answer to the risk.

Yao’s position, reported by The Decoder from comments covered by the South China Morning Post, places Tencent in the center of an intensifying dispute over how much access developers and the public should have to advanced AI. He supports a middle ground that preserves open models for defensive work while using stronger controls for capabilities that could enable biological or cyber attacks.

The debate has immediate relevance for Tencent’s planned Hy4 release. The company intends to publish Hy4 as an open-weight model with a safety report, saying it has removed dangerous hacking knowledge from the training data and that the model’s biological capabilities remain below a high-risk threshold. Those claims have not been independently established in the source material.

Why Yao rejects a simple open-versus-closed answer

Yao, who previously worked at OpenAI, reportedly sees benefits in both access models. Closed systems can apply centralized safeguards and restrict advanced capabilities to vetted users. Open systems, however, can allow defenders to inspect, adapt, and run models without depending on the policies or availability of a single provider.

He cited a Hugging Face security incident as an example of that tradeoff. According to the account, hosted US models including Anthropic’s Claude refused to analyze attack commands because of their safety filters, while the open Chinese model GLM-5.2 was used to help parse logs during the forensic investigation.

The Hugging Face report supports the narrow factual point that GLM-5.2 was used during the investigation, but it does not show that the model stopped the attack. Hugging Face said the incident was contained after its security team patched the exploited vulnerability, rebuilt affected servers, and rotated credentials. The company also stressed that the episode should not be treated as an argument against safety filters on hosted models.

Yao’s biological-risk warning is more consequential because defensive and offensive capabilities can be difficult to separate in biology. A model that helps a researcher understand pathogens or design experiments may also lower barriers for someone seeking to cause harm. The Decoder reported that Yao believes the relatively small gap between leading Chinese and US models makes caution necessary across the industry rather than in one national market alone.

Evidence shows weaknesses on both sides

The case against relying only on open-model refusals is illustrated by abliteration, a technique that removes trained refusal behaviors from models when users have access to the weights. The Decoder reported that thousands of modified variants are available on Hugging Face, while Abliteration.ai offers access to an unfiltered version of GLM-5.3.

Research cited in the report indicates that current defenses can make these modifications more difficult but do not reliably prevent them. That creates a fundamental distinction between a hosted model and a released model: a provider can update or withdraw a service, but published weights cannot be recalled once they spread.

Closed models present a different failure mode. Anthropic and other US companies have restricted some advanced cyber capabilities to vetted partners through programs including Project Glasswing and Daybreak. Anthropic has also used routing controls that send suspicious cyber- and biology-related prompts to a less capable model. Artificial Analysis initially estimated that the routing affected 8% to 9% of tasks, while users reported false positives, including MRI analysis being flagged as potentially related to bioterrorism. Anthropic acknowledged that the filters were too aggressive.

These examples do not establish that either open or closed systems are categorically safer. They show instead that open models can lose safeguards through weight modification, while closed systems can block legitimate work or prevent defenders from using a model when speed matters. The evidence comes from separate reports and vendor or third-party analyses, so it should not be read as a controlled comparison of model safety.

Tencent’s Hy4 strategy moves controls into training

Tencent’s planned approach for Hy4 is to remove dangerous hacking knowledge from the training data rather than depend only on refusal behavior added after training. Researchers cited by The Decoder say this type of intervention is more resistant to abliteration because the model does not simply contain a capability that can be unlocked by deleting a refusal layer.

Tencent says Hy4’s biological capabilities fall below a high-risk threshold. That is a company assessment, not an independently verified benchmark in the available evidence. The planned safety report could provide more detail on how Tencent defines the threshold, what evaluations it used, and whether the model was tested against attempts to reconstruct removed knowledge.

China’s standards body TC260 has also warned that safeguards in open models can be bypassed or removed and is developing a security standard for open-source AI. At the policy level, however, the report says neither China nor the United States has established a binding publication threshold that would prevent the release of particularly capable open models. A Chinese draft export-control framework reportedly covers some large models but exempts open models that have already been released.

For builders, the key technical question is whether data filtering can become a durable safety layer rather than another claim that is difficult to audit. Training-data removal may reduce direct access to dangerous information, but model evaluations will need to test memorization, reconstruction, tool use, and combinations of benign capabilities that could create new risks.

Implications for AI builders and enterprise buyers

The dispute changes the risk calculation for teams choosing between hosted and self-deployed models. A hosted system such as Claude can provide policy updates, monitoring, and centralized access controls, but its safeguards may interfere with security operations, scientific analysis, or other legitimate workflows. An open-weight model offers greater control and offline deployment, but the buyer becomes responsible for testing, access management, logging, patching, and abuse prevention.

For enterprise teams, the relevant choice may not be a single model. Sensitive workflows could use a layered system: a restricted model for high-risk actions, a more permissive model for analysis, and human approval before tools can change infrastructure or interact with biological materials. That approach can preserve operational usefulness without assuming that a refusal message is a sufficient safety mechanism.

For model developers, Hy4 will be watched as a test of whether training-data controls survive real-world modification and adversarial evaluation. For researchers, the release could also clarify whether Tencent’s biological-risk assessment is based on standardized tests or an internal methodology. For policymakers, the episode reinforces how difficult it is to regulate weights after publication.

What to watch next

The first signal will be Tencent’s Hy4 release and accompanying safety report. Watch for details on the training-data filtering process, biological and cyber evaluations, model-weight access, and whether external researchers can reproduce the company’s conclusions.

A second signal is how effectively independent users bypass or reconstruct the model’s restrictions. If Hy4’s removed hacking capabilities remain unavailable after abliteration attempts, Tencent’s approach will gain credibility. If capabilities can be restored through fine-tuning, prompting, or tool integration, the limits of training-data filtering will become clearer.

The market should also track whether Anthropic changes its routing policies after the reported false positives, and whether China or the United States creates enforceable rules for highly capable open-weight models. Those decisions will shape deployment costs and the amount of safety work that shifts from model providers to customers.

Creati.ai perspective

Yao’s warning is important less because it settles the open-versus-closed argument than because it exposes the weakness of treating access policy as the main safety control. Closed models can be too restrictive for defense, while open models can lose safeguards once their weights are public. Neither route removes the need for capability testing, operational controls, and independent scrutiny.

Tencent’s Hy4 release may offer a useful experiment in training-time risk reduction, but its significance will depend on evidence rather than the label of an open-weight model. For AI builders and enterprise buyers, the practical lesson is to evaluate the entire deployment chain—model knowledge, tool permissions, monitoring, and rollback options—not just whether a system refuses a dangerous prompt.