Tencent warns of AI-enabled biological weapons, but opposes closing models

Why open models matter

Yao, who previously worked at OpenAI, finds Anthropic’s and other US companies’ arguments for closed models persuasive, but also sees advantages in open ones. He points to the Hugging Face breach as an example: closed models from US companies, including Anthropic’s Claude, refused to analyze attack commands because of their safety filters. The platform then used the open Chinese model GLM-5.2 to analyze event logs.

The example shows that an open model can be useful to security specialists, but it does not show how the breach itself was stopped. GLM-5.2 was used only during the investigation. The attack was contained after the security team fixed the vulnerability, restored the affected servers and changed credentials. Hugging Face separately stressed that the incident does not prove that safety filters on cloud-hosted models are unnecessary.

Where safeguards fall short

In July, Anthropic was the only major AI lab not to sign a letter backed by Nvidia opposing premature restrictions on open models. The company’s CEO, Dario Amodei, disputes the claim that these models help defenders more than attackers. In his view, they may be more dangerous: safeguards are difficult to enforce, and once a model’s weights have been released, they cannot be recalled. Anthropic does not, however, call for a complete ban on open models.

The Abliteration technique shows how vulnerable their filters can be. With access to a model’s weights, it is possible to selectively remove refusals learned during training for certain requests. Thousands of modified versions are available on Hugging Face, and the US startup Abliteration.ai sells access to an unrestricted version of GLM-5.3. Research shows that existing safeguards make such modifications harder, but do not prevent them. A more reliable approach is to keep dangerous knowledge out of training data in the first place.

China also acknowledges the risk. Standards body TC260 warns that the safeguards on open models can be removed or bypassed, and is developing its own safety standard for open AI. A draft export-control system covers especially large models but exempts open models that have already been released. Neither China nor the US has set a mandatory threshold above which releasing open models would be prohibited.

Closed-model filters fail too

Anthropic and OpenAI make their most capable models available for cybersecurity only to vetted partners through the Project Glasswing and Daybreak programs. After Claude Fable 5 launched, Claude’s filters began redirecting suspicious cybersecurity and biology requests to the less capable Opus 4.8 model.

According to Artificial Analysis, this routing initially affected 8–9% of tasks. Users reported that the filter flagged even MRI analysis as related to bioterrorism. Anthropic acknowledged that the filters were triggering too often.

Tencent plans to release a new model, Hy4, with open weights and an accompanying safety report in the coming days. The company says the model’s biological capabilities do not reach a high-risk level. Tencent removed hacking capabilities by filtering the training data; researchers report that this safeguard remains effective even after Abliteration.

Dataist's take

The debate is not only about access to models: how they are trained and how accurately their filters work in real use also matter. According to the source, filtering data can withstand the removal of safeguards, while released weights cannot be recalled and overly strict filters get in the way of ordinary tasks.