Tencent's chief AI scientist warns of AI bioweapons, urges a middle path on open models

Tencent's chief AI scientist, Vinces Yao Shunyu, formerly at OpenAI, is arguing for a middle ground in the debate over open versus closed AI models, according to the South China Morning Post as relayed by The Decoder. The warning: AI will soon be capable of developing bioweapons, and neither fully open nor fully closed models can solve that problem on their own. Yao's view is that a mix of open-source and closed-source lets everyone use the technology for defense as well. In biology, though, offensive and defensive capabilities are harder to separate than in cybersecurity. Because the gap between Chinese and US models isn't large, Yao urges the whole industry to proceed carefully.

Yao says Anthropic and other US companies have made strong arguments for closed models, but sees clear advantages in open ones too. The example is a hacking incident at Hugging Face. Closed US models such as Anthropic's Claude refused to analyze attack commands because of their safety filters, so the platform used the open Chinese model GLM-5.2 to parse the logs instead.

The Decoder notes that the Hugging Face report backs up this example but also shows its limits. GLM-5.2 was used only during the forensic analysis. The attack itself was stopped when the security team patched the exploited vulnerability, rebuilt affected servers and rotated credentials. Hugging Face also stressed that the incident is not an argument against safety filters on hosted models.

The other side of the debate is Anthropic. In July it was the only major AI lab that did not sign an Nvidia-backed letter warning against premature restrictions on open models. CEO Dario Amodei pushes back specifically on the claim that open models benefit defenders more than attackers. He argues they are potentially riskier, because safety mechanisms are hard to enforce and published weights can't be taken back. Anthropic does not call for an outright ban on open models.

Open models lose their filters easily. A technique called abliteration lets anyone with access to a model's weights surgically remove trained refusal behaviors. Thousands of modified variants sit on Hugging Face, and the US startup Abliteration.ai sells access to an unfiltered version of GLM-5.3. Current research shows existing countermeasures make these modifications harder but don't prevent them. A more robust approach is to keep dangerous knowledge out of the model during training in the first place.

China recognizes the problem too. The standards body TC260 warns that safety mechanisms in open models can be removed or bypassed, and is working on its own security standard for open-source AI. A draft export control framework covers particularly large models but exempts open models that have already been released. Neither China nor the US has set a binding threshold above which open models can't be published.

Closed models, meanwhile, often filter too aggressively. Anthropic and OpenAI share their most capable cyber models only with vetted partners, through programs like Project Glasswing and Daybreak. Since Claude Fable 5, Claude's filters route suspicious queries about cyber and biology topics to the weaker Opus 4.8 model. According to Artificial Analysis, this initially affected eight to nine percent of tasks, and users reported that even analyzing MRI scans was flagged as bioterrorism. Anthropic acknowledged the filters were too aggressive.

Tencent plans to release its new model Hy4 as an open-weight model, with an accompanying safety report, in the coming days. The company says Hy4's biological capabilities fall below the high-risk threshold. Tencent removed the model's hacking capabilities by filtering the training data, and researchers say this approach survives abliteration as well.

Key facts

Tencent's chief AI scientist Vinces Yao Shunyu, formerly at OpenAI, warns AI will soon be able to develop bioweapons and says neither fully open nor fully closed models solve this alone (per the South China Morning Post).
Yao's example: during a Hugging Face hacking incident, closed US models like Claude refused to analyze attack commands, so the open Chinese model GLM-5.2 parsed the logs. The Hugging Face report says GLM-5.2 was used only for forensic analysis and that the incident is not an argument against safety filters on hosted models.
Abliteration strips refusal behaviors from open weights; thousands of modified variants sit on Hugging Face. Countermeasures make it harder but don't prevent it, and keeping dangerous knowledge out during training is described as more robust.
Claude's filters have routed suspicious cyber and biology queries to the weaker Opus 4.8 since Claude Fable 5; per Artificial Analysis this initially affected eight to nine percent of tasks, and Anthropic acknowledged the filters were too aggressive.
Tencent plans to release Hy4 as an open-weight model with a safety report in the coming days, saying its biological capabilities are below the high-risk threshold and that hacking capabilities were removed by filtering training data.

Why it matters

The open versus closed argument is usually framed as a choice between two camps. Here a senior figure at a major Chinese AI company says both camps are incomplete when the risk is biological. Yao's reasoning is that in biology, offense and defense are harder to separate than in cybersecurity, so the cyber case for open models (more defenders get the tools) carries over less cleanly. The Decoder sets this against Anthropic's opposite emphasis, where Amodei argues published weights can't be taken back, and against a record showing both failure modes: stripped filters on open models and over-aggressive filters on closed ones.

Who it affects

AI labs deciding whether to publish weights; Tencent itself, which is about to release Hy4 as open-weight; Anthropic and OpenAI, whose restricted cyber programs (Project Glasswing and Daybreak) and filters are part of the picture; platforms such as Hugging Face that host thousands of modified variants; Chinese standards and export-control bodies such as TC260; and ordinary users whose legitimate requests, such as MRI analysis, were flagged by Claude's filters.

How to use it

This is a position piece, not a tool or release, so there is nothing to adopt directly. For readers tracking the debate, two things to watch are named in the source: Tencent's Hy4 open-weight release and its accompanying safety report, expected in the coming days, and the TC260 security standard for open-source AI that is in preparation. For teams that depend on hosted models for security or biology-adjacent work, the Claude filter routing to Opus 4.8 since Claude Fable 5 is a concrete behavior the source describes.

How solid is it

Yao's views reach the reader second-hand: they are paraphrased from the South China Morning Post by The Decoder, and the source gives no direct quotation from Yao. The Hugging Face example is checked against the Hugging Face report, which supports it while limiting it. The eight to nine percent figure for affected tasks comes from Artificial Analysis and describes the initial effect. Hy4's below-threshold biology claim is Tencent's own statement, and the claim that training-data filtering survives abliteration is attributed to researchers without further detail.

Risks and caveats

The source gives no timescale beyond 'soon' for when AI could develop bioweapons. It gives no date for the Hugging Face incident or for Yao's remarks, and no benchmark or parameter figures for Hy4. 'Thousands' of abliterated variants is stated loosely. The source does not say whether Anthropic or Amodei responded to Yao specifically, so the contrast between them is The Decoder's framing, not a direct exchange. Neither China nor the US has a binding threshold for blocking open-model publication, so the policy side remains unsettled.