Tencent AI chief warns of biological harm, argues closing models is not enough

Tencent’s chief AI scientist Yao Shunyu warned at a Hong Kong science event on Saturday that AI’s biological capabilities may soon become dangerous. But he argued that keeping models closed is not a complete answer: open models can also help defenders, according to South China Morning Post reporting summarized by The Next Web.

Yao’s remarks paired a warning about emerging capabilities with a call for care from companies releasing open models—systems people can download and modify. He said those developers need to take safety seriously, rather than treating openness itself as a sufficient answer to the risks.

He acknowledged that US companies such as Anthropic make a strong case for keeping their most capable models closed. His preferred approach nevertheless leaves room for both kinds of access. That position does not dismiss the danger; it rests on his argument that defenders also benefit from access to capable systems.

The cyber abilities of [AI] models and soon [the] bio ability of models will reach a threshold where it’s actually possible to do harm

Yao Shunyu, quoted by the South China Morning Post, as reproduced by The Next Web

A defensive use that safety filters blocked

Yao pointed to a hacking incident at Hugging Face to explain the defensive value of open models. According to The Decoder’s account of his remarks, closed US models, including Anthropic’s Claude, refused to analyze attack commands because of their safety filters. Hugging Face instead used the open Chinese model GLM-5.2 to parse the logs.

The role of that model matters. GLM-5.2 supported forensic analysis—examining evidence of the intrusion—not the actions that stopped the attack. The security team patched the exploited vulnerability, rebuilt affected servers and rotated credentials. Hugging Face also stressed that the incident was not an argument against safety filters on hosted models.

Biology makes the access argument harder, Yao warned. Offensive and defensive biological capabilities are more difficult to separate than their cybersecurity counterparts. His warning therefore went beyond whether a model refuses a particular request: he said biological risks may be harder to manage than cyber risks.

Downloadable models pose a different control problem

The opposing concern is not simply that open models might answer dangerous questions. Anthropic CEO Dario Amodei argues that their safety mechanisms are difficult to enforce and that published model weights—the files underlying a model—cannot be taken back. The Decoder notes that Anthropic does not advocate an outright ban on open models.

That concern also appears in China’s standards work. TC260, a Chinese standards body, warns that safety mechanisms in open models can be removed or bypassed. It is developing a security standard for open-source AI, according to The Decoder. This addresses a different weakness from a hosted model refusing legitimate security analysis.

Tencent’s safeguards start with training data

Tencent’s existing description of Hy4 offers a concrete example of its safety approach. In its November 4 announcement, the company said it trained the model on defensive cybersecurity data while explicitly excluding offensive exploitation materials. The defensive training still includes reverse engineering and penetration testing for analysis, alongside work on fixing vulnerabilities.

Tencent said its security experts found no significant concerns about offensive cybersecurity capabilities in the areas they evaluated. On biology, internal expert reviews found strong foundational knowledge but more limited open-ended experimental-design capabilities than frontier models. Those are company assessments with defined limits: the cyber finding covers evaluated areas, and the biology finding compares capabilities rather than claiming an absence of biological knowledge.