AI models may soon be capable of helping develop bioweapons, Tencent chief AI scientist Vinces Yao Shunyu warns. He argues that the answer is not simply to make every model open or to lock them all away: each approach carries risks, and both can matter for security work.
Why the open-versus-closed debate is difficult
Open models can give defenders access to tools they need, including when a hosted model refuses a request. Closed models, meanwhile, let providers apply safety filters and control access. Yao sees value in both approaches and argues for a middle ground, according to the South China Morning Post.
There is a crucial difference between biology and cybersecurity, however. Offensive and defensive capabilities are harder to separate in biology, so a tool that helps someone analyze a threat could also increase the ability to cause harm. Yao says the gap between Chinese and US models is not large, and urges the industry as a whole to proceed carefully.
A security incident illustrates both sides
Yao points to a hacking incident at Hugging Face. During its investigation, US models such as Anthropic's Claude refused to analyze attack commands because of safety filters, so the platform used the open Chinese model GLM-5.2 to parse logs.
That example shows how access to an open model can help with defensive analysis when a closed model blocks a request. But it does not show that the open model stopped the attack. Hugging Face's report says the security team halted the incident by patching the exploited vulnerability, rebuilding affected servers, and rotating credentials. The model was used during forensic analysis.
Hugging Face also said the incident should not be taken as an argument against safety filters on hosted models. The case highlights a real tradeoff: filters can interfere with some security work, while access to powerful tools also raises concerns about misuse.
Open-model safeguards can be removed
Anthropic CEO Dario Amodei challenges the claim that open models help defenders more than attackers. He argues they may be riskier because their safety mechanisms are difficult to enforce and published model weights cannot be taken back. Anthropic does not call for an outright ban on open models.
A technique called Abliteration illustrates the problem. People with access to a model's weights can use it to remove trained refusal behaviors. Thousands of modified variants are available on Hugging Face, and the US startup Abliteration.ai sells access to an unfiltered version of GLM-5.3.
Research indicates that countermeasures can make such changes harder, but do not prevent them. A more robust approach may be to keep dangerous knowledge out of a model during training, rather than relying only on filters added afterward.
Access controls and training choices are both in play
Governments and AI companies are weighing ways to manage these risks. China's standards body TC260 warns that open-model safeguards can be removed or bypassed and is developing a security standard for open-source AI. A draft export control framework covers particularly large models but exempts open models that have already been released. Neither China nor the US has set a binding threshold above which open models cannot be published.
Anthropic and OpenAI share their most capable cyber models only with vetted partners through programs such as Project Glasswing and Daybreak. Those limits help control access, but filters can also block harmless requests. After Claude Fable 5, Claude's filters routed suspicious cyber and biology queries to the weaker Opus 4.8 model. Artificial Analysis said this initially affected eight to nine percent of tasks, and users reported that MRI scan analysis was flagged as bioterrorism. Anthropic acknowledged the filters were too aggressive.
Tencent says its forthcoming model Hy4 will be released as an open-weight model with a safety report. The company says its biological capabilities fall below the high-risk threshold and that it removed hacking capabilities by filtering training data. Researchers say that approach also survives Abliteration.
The competing examples point to a broader challenge: safety depends on more than whether a model is open or closed. Access limits, training decisions, and the ability to support legitimate defense all shape the risks. Yao's call for caution reflects how difficult it is to draw a boundary that protects against misuse without blocking useful security work.