Tencent's AI chief warns AI bioweapons are near, rejects open-vs-closed binary

Tencent's chief AI scientist, Vinces Yao Shunyu, is warning that AI will soon be capable of developing bioweapons, and that the industry's open-versus-closed fight misses the point. According to the South China Morning Post, the former OpenAI researcher argues for a middle ground: mixing open-source and closed-source models so defenders everywhere can use the technology too. In biology, he notes, offensive and defensive capabilities are far harder to separate than in cybersecurity. With the capability gap between Chinese and US models already narrow, Yao says the whole industry needs to tread carefully.

Yao concedes that Anthropic and other US companies have made strong arguments for keeping models closed, but he sees real upside in openness. His example: during a hacking incident at Hugging Face, closed US models including Anthropic's Claude refused to analyze the attack commands because of their safety filters, so the platform turned to the open Chinese model GLM-5.2 to parse the logs. Hugging Face's own report backs the story up, with limits. GLM-5.2 was only used for forensic analysis, and the attack was actually stopped when the security team patched the exploited vulnerability, rebuilt affected servers and rotated credentials. The company also stressed the incident isn't an argument against safety filters on hosted models.

Anthropic CEO Dario Amodei has pushed back directly on the idea that open models help defenders more than attackers. He argues they're potentially riskier, because safety mechanisms are hard to enforce and published model weights can't be recalled. Anthropic doesn't want an outright ban on open models, but it was the only major AI lab that declined to sign an Nvidia-backed letter in July warning against premature restrictions on them.

The fragility Amodei points to has a name: Abliteration, a technique that lets anyone with a model's weights surgically strip out its trained refusal behaviors. Thousands of modified variants sit on Hugging Face, and the US startup Abliteration.ai sells access to an unfiltered version of GLM-5.3. Current research shows existing countermeasures make those edits harder, not impossible. A sturdier fix, researchers say, is keeping dangerous knowledge out of the model during training in the first place.

China sees the problem too. Standards body TC260 warns that safety mechanisms in open models can be removed or bypassed, and is drafting its own security standard for open-source AI. A draft export control framework covers especially large models but exempts open models that have already shipped. Neither China nor the US has set a binding threshold above which an open model can't be published.

The big labs are already partitioning access. Anthropic and OpenAI share only their most capable cyber models with vetted partners, through programs like Project Glasswing and Daybreak. Since Claude Fable 5, Claude's filters route suspicious cyber and biology queries to the weaker Opus 4.8 model — a change that, per Artificial Analysis, initially hit eight to nine percent of tasks, with users reporting that even MRI scan analysis got flagged as bioterrorism. Anthropic has acknowledged the filters were too aggressive. Tencent's counteroffer lands in the coming days: Hy4, an open-weight release with a safety report attached. Tencent says its biological capabilities fall below the high-risk threshold, and that it stripped the model's hacking abilities by filtering training data — an approach researchers say survives abliteration.