Tencent’s Hy4 Puts Open-Model Safety Claims to a Practical Test

The debate over open AI models is increasingly about where safety controls can hold up in practice. Tencent chief AI scientist Yao Shunyu argues that neither releasing models without restriction nor keeping them entirely closed will address emerging biological risks. As models become more capable in biology, he says, the same knowledge may help people defend against threats as well as create them—and those uses are harder to separate than in cybersecurity.

Yao, formerly at OpenAI, made the case for a mixed ecosystem of open and closed systems, according to the South China Morning Post. He says the capability gap between Chinese and US models is not large, making careful development a shared concern across the industry.

When open access helps security work

Yao points to an incident at Hugging Face to show how open models can help defenders. During the platform’s investigation of an attack, its team used the open Chinese model GLM-5.2 to interpret logs after closed US models, including Anthropic’s Claude, declined to analyze attack commands because of their safety filters. The incident was previously described in a Hugging Face security account.

The model helped with forensic analysis; it did not stop the intrusion. Hugging Face says its security team addressed the exploited weakness by patching it, rebuilding affected servers, and changing credentials. The company also cautioned that its experience should not be read as a case against filters on hosted systems. The example shows a real trade-off: controls can prevent some harmful assistance, but they may also obstruct legitimate analysis when a team needs to examine suspicious material.

Anthropic’s chief executive, Dario Amodei, disputes the idea that open models inherently help defenders more than attackers. Published weights are difficult to retrieve, and safety mechanisms can be removed or bypassed. Anthropic has not called for a blanket prohibition on open models, but it has argued that releasing the most capable systems can carry added risk. In July, it was the only major AI lab not to sign an Nvidia-backed letter warning against premature limits on open models. Amodei’s position is set out in more detail here.

Filters can be removed—or catch the wrong work

Open-weight models make one weakness especially clear: a refusal behavior learned during training may not survive modification. A technique called abliteration can remove such behavior from a model by changing its weights. Thousands of modified variants are hosted on Hugging Face, and the US startup Abliteration.ai sells access to an unfiltered version of GLM-5.3. Research cited in the source finds that current defenses can make these changes harder, but do not stop them.

That problem has led researchers to consider a different point of intervention: training. If a model never learns certain dangerous information, removing a refusal layer may be less effective. Tencent says it used this approach to remove Hy4’s hacking capabilities by filtering training data, and researchers say the result remains effective after abliteration. That claim is relevant to model design, though it does not by itself establish how the approach performs across other capabilities or future systems.

Closed systems have a different operational weakness: their safeguards can be too broad. Anthropic and OpenAI restrict access to their strongest cyber models to vetted partners through programs such as Project Glasswing and Daybreak. Since Claude Fable 5, Anthropic’s filters have routed some suspicious cyber and biology queries to the weaker Opus 4.8 model. Artificial Analysis reported that this initially affected eight to nine percent of tasks. Users also said that MRI analysis was flagged as a possible biological threat, and Anthropic acknowledged that the filters were too aggressive. A safety system that blocks routine work can reduce a model’s usefulness to the researchers and practitioners it is meant to serve.

Hy4 will make Tencent’s approach testable

China’s standards body TC260 has warned that safeguards in open models may be removed or bypassed and is developing a security standard for open-source AI. A draft framework linked to controls on some large models exempts open models that have already been released. The source says neither China nor the US has established a binding threshold above which an open model cannot be published.

Tencent plans to release Hy4 as an open-weight model with a safety report in the coming days. The company says its biological capabilities fall below the high-risk threshold. That assessment and its account of training-data filtering will give researchers and developers claims to examine, but the source provides no independent evaluation of Hy4’s biology performance or its safety methods.

For teams choosing models, the practical question is how safeguards behave under the work they need to do: whether risky capabilities are present, whether controls withstand attempts to remove them, and whether filters interrupt legitimate tasks. Yao’s middle-ground argument makes sense as a description of the trade-off. Hy4’s release could add evidence, but the quality of that evidence will depend on the detail and reproducibility of Tencent’s safety report.