Tencent's chief AI scientist warns of AI-enabled bioweapons and proposes a middle path between open and closed models

Yao Shunyu, chief AI scientist at Tencent and a former OpenAI employee, argues, according to the South China Morning Post, that neither fully open nor fully closed AI models are in themselves a solution to the growing risk that AI will facilitate the development of bioweapons. Unlike cybersecurity, he says, in biology it is harder to separate defensive and offensive capabilities. Because the difference between Chinese and American models is not large, he is calling on the entire industry to exercise caution.

As an example, he cites an incident on the Hugging Face platform, where closed American models including Claude refused to analyze attack commands due to safety filters, so the platform used the open Chinese model GLM-5.2 to analyze the logs instead. Hugging Face's report confirms this incident but also clarifies its scope: GLM-5.2 was used only for forensic analysis, while the attack itself was stopped by the security team through patching the vulnerability, restoring servers, and rotating credentials. Hugging Face explicitly stated that the incident is not an argument against safety filters in hosted models.

Anthropic was, in July, the only major AI lab that did not sign an Nvidia-backed letter warning against premature restrictions on open models. CEO Dario Amodei, according to the source, instead argues that open models can be riskier because their safety mechanisms are hard to enforce and a model's released weights cannot be taken back. A technique called Abliteration allows anyone with access to a model's weights to remove its learned refusal behavior; there are thousands of such modified variants on Hugging Face, and the American startup Abliteration.ai sells access to an unfiltered version of GLM-5.3. According to research, current countermeasures make such modifications harder but do not prevent them; a more robust approach is to keep dangerous knowledge out of the model during training in the first place.

China's standardization body TC260 is working on its own safety standard for open AI, and the proposed export control framework covers large models but exempts open models that have already been released. Neither country has a binding threshold above which open models could not be published. Anthropic and OpenAI share their most capable cyber models only with vetted partners through the Project Glasswing and Daybreak programs; starting with Claude Fable 5, Claude routes suspicious queries on cyber and bio topics to the weaker Opus 4.8 model, which according to Artificial Analysis initially affected eight to nine percent of tasks, including mistakenly flagging an MRI scan analysis as bioterrorism, which Anthropic acknowledged was overly aggressive. Tencent plans to release its new Hy4 model as open in the coming days, accompanied by a safety report; according to the company, its biological capabilities do not reach the high-risk threshold, and its hacking capabilities were removed by filtering the training data, which researchers say should also withstand the Abliteration technique.