Tencent's AI chief warns bioweapons are coming, and openness alone won't stop them

Tencent's chief AI scientist says AI systems will soon be capable of developing bioweapons — and he argues that neither fully open nor fully closed models can fix that on their own.

Vinces Yao Shunyu, who previously worked at OpenAI, laid out his position in comments reported by the South China Morning Post. His argument: a mix of open-source and closed-source models gives everyone the tools to defend themselves, not just the labs that own the most powerful systems. The stakes are unusually high here, because in biology — unlike cybersecurity — offensive and defensive capabilities are much harder to separate.

Why Yao says openness is part of the defense

Yao acknowledges that Anthropic and other US companies have made strong arguments for closed models. But he points to a real incident as evidence that open models have a defensive role: a hacking case at Hugging Face.

When attackers hit Hugging Face, the security team needed to analyze attack commands in the logs. The closed US models they might have used — including Anthropic's Claude — refused, because their safety filters treated the malicious commands as off-limits. So the team turned to the open Chinese model GLM-5.2, which parsed the logs without complaint. The takeaway in Yao's framing: if every model refuses to look at attack artifacts, defenders lose a tool.

Yao also notes that the capability gap between Chinese and US models isn't large. That, he says, is exactly why the whole industry should proceed carefully rather than assume one country or one company can set the rules alone.

What the Hugging Face case actually shows

The Hugging Face report supports Yao's example, but it also shows the limits of it. GLM-5.2 was only used during the forensic analysis. The attack itself was stopped the traditional way: the security team patched the exploited vulnerability, rebuilt the affected servers, and rotated credentials. Hugging Face also stressed that the incident is not an argument against safety filters on hosted models.

So the case is narrower than it first appears. Open models helped with one step of the response — reading logs — while conventional security work did the rest.

Where Anthropic stands and why

The disagreement has a paper trail. In July, Anthropic was the only major AI lab that declined to sign an Nvidia-backed letter warning against premature restrictions on open models. CEO Dario Amodei has pushed back specifically against the claim that open models benefit defenders more than attackers. His argument: open models are potentially riskier because safety mechanisms are hard to enforce, and once model weights are published, they can't be taken back.

Anthropic does not call for an outright ban on open models. The company's position is more targeted — that openness carries real, hard-to-reverse risks.

How easily can open models be stripped of their filters?

Very easily, it turns out. A technique called Abliteration lets anyone with access to a model's weights surgically remove its trained refusal behaviors. Thousands of these modified variants already sit on Hugging Face, and the US startup Abliteration.ai sells access to an unfiltered version of GLM-5.3.

Current research shows that existing countermeasures make these modifications harder but don't prevent them. The more robust approach, researchers say, is to keep dangerous knowledge out of the model during training in the first place — rather than trying to bolt a filter on afterward.

That's a structural problem for the open-weights ecosystem. Once you publish weights, anyone can modify them.

China is working on its own rules

China recognizes the problem too. The standards body TC260 has warned that safety mechanisms in open models can be removed or bypassed, and it is working on a security standard for open-source AI. A draft export control framework covers particularly large models, but it exempts open models that have already been released.

Neither China nor the US has set a binding threshold above which open models can't be published. That leaves the frontier labs making these calls themselves, company by company.

Closed models have the opposite problem

Closed models don't leak their weights, but they often filter too aggressively. Anthropic and OpenAI share their most capable cyber models only with vetted partners, through programs like Project Glasswing and Daybreak. And since Claude Fable 5, Claude's filters route suspicious queries about cyber and biology topics to the weaker Opus 4.8 model.

According to Artificial Analysis, this routing initially affected eight to nine percent of tasks. Users reported that even analyzing MRI scans got flagged as potential bioterrorism. Anthropic acknowledged the filters were too aggressive.

The lesson is symmetrical: open models lose their filters too easily, closed models apply them too broadly.

What Tencent is doing about it

Tencent plans to release its new model, Hy4, as an open-weight model with an accompanying safety report in the coming days. The company says Hy4's biological capabilities fall below the high-risk threshold.

The more interesting move is in the training pipeline. Tencent removed the model's hacking capabilities by filtering the training data itself, and researchers say this approach survives Abliteration. In other words: instead of refusing at the surface, the model simply doesn't know the dangerous material. If that claim holds up, it's a concrete answer to the fragility problem that open models face — and a test case for whether "safe by training" can make open weights viable at the frontier.