Tencent AI Chief Warns of AI Bioweapon Risk but Rejects Closing Off Models

Yao, a former OpenAI researcher whom Tencent made chief AI scientist in December 2025, made the case for a middle ground in which open-source and closed-source models exist side by side, so that defenders as well as attackers have access to the technology. According to an account of the interview published by The Decoder, he said biology is harder to manage than cybersecurity because offensive and defensive capabilities are more difficult to separate, and that because the gap between Chinese and US models is not large, the whole industry should move carefully.

The remarks matter because they come from inside one of China's largest technology groups at a moment when it is about to put another powerful model into the open. Tencent released its Hy4 model on November 4 and has said it will publish the model's weights, together with a report on its safety testing, in the coming days. How Chinese labs handle open releases is a live question for governments and companies that build on their models.

Yao said Anthropic and other US companies had made strong arguments for keeping models closed, but that open models also have clear advantages. As an example he cited a hacking incident at Hugging Face, where closed US models including Anthropic's Claude refused to analyse attack commands because of their safety filters, and the platform turned to the open Chinese model GLM-5.2 to parse the logs.

The Decoder noted that Hugging Face's own report on the incident supports the example only in part. GLM-5.2 was used for forensic analysis after the fact; the attack itself was stopped when Hugging Face's security team patched the exploited vulnerability, rebuilt affected servers and rotated credentials. Hugging Face also said the incident should not be read as an argument against safety filters on hosted models.

Anthropic has taken the opposite position on open weights. In July it was the only major AI lab that did not sign an Nvidia-backed letter warning against premature restrictions on open models, and chief executive Dario Amodei has disputed the claim that open models help defenders more than attackers, arguing that their safety mechanisms are hard to enforce and that published weights cannot be withdrawn. Anthropic has not called for an outright ban.

The weakness Yao's critics point to is that safeguards on open models can be stripped out. A technique known as abliteration lets anyone with a model's weights remove its trained refusal behaviour, and thousands of such modified models are available on Hugging Face, according to The Decoder. Closed systems have the opposite problem: Anthropic acknowledged that filters introduced with Claude Fable 5, which route suspicious cyber and biology queries to the weaker Opus 4.8 model, were too aggressive after users reported that tasks such as analysing MRI scans were being flagged.

Chinese regulators are also looking at the issue. The standards body TC260 has warned that safety mechanisms in open models can be removed or bypassed and is drafting a security standard for open-source AI, while a draft export control framework covers particularly large models but exempts open models already released. Neither China nor the US has set a binding capability threshold above which open models cannot be published.

Tencent says it has tried to build the protection into Hy4's training rather than bolt it on afterwards. The company limited cybersecurity training material to defensive uses and excluded content on building hacking tools and breaking into systems, and said its testing found the model could not meaningfully make harmful biological experiments easier to carry out. "We recognise the potential safety risks posed by advanced cyber and biological capabilities," Tencent said when it released the model. Tencent says Hy4's biological capabilities fall below the high-risk threshold, and researchers say removing hacking skills through training-data filtering holds up even against abliteration, according to The Decoder. That claim will be open to outside testing once the weights and safety report are published.