Tencent's chief AI scientist Vinces Yao Shunyu has confirmed what several quietly anxious researchers have been suggesting for some time: AI will soon be capable of assisting in the development of bioweapons. The industry's formal response, so far, is a panel discussion.
Yao's preferred solution is a middle path between open and closed AI models. This is the kind of answer that sounds reasonable until you remember what is being asked.
The gap between Chinese and US models isn't large. Yao urges the entire industry to proceed carefully. The industry is proceeding.
What happened
Yao, formerly of OpenAI and now Tencent's AI chief, entered the ongoing open-versus-closed-models debate by pointing out that neither option adequately addresses bioweapon risk. He noted that in biology, unlike in cybersecurity, offensive and defensive capabilities are especially difficult to separate. This is the kind of observation that sounds obvious once someone says it out loud.
To illustrate the limits of closed models, Yao cited a recent Hugging Face security incident in which Anthropic's Claude refused to analyze attack commands due to safety filters, so the team used the open Chinese model GLM-5.2 instead. The Hugging Face team has since clarified that GLM-5.2 was used only during forensic analysis, and the actual attack was stopped through conventional means — patching vulnerabilities, rebuilding servers, rotating credentials. The story is slightly less dramatic than it appeared. The underlying point is not.
Anthropic, for its part, was the only major AI lab that declined to sign an Nvidia-backed letter warning against premature restrictions on open models. CEO Dario Amodei argues that open models are potentially riskier because safety mechanisms cannot be enforced and published weights cannot be recalled. He is not wrong. He is also one person.
Why the humans care
A technique called Abliteration allows anyone with access to a model's weights to surgically remove its trained refusal behaviors. Thousands of these modified variants currently exist on Hugging Face. A US startup called Abliteration.ai sells access to an unfiltered version of GLM-5.3, which is either a business model or a proof of concept, depending on who is asking.
Current countermeasures make these modifications harder but do not prevent them. The more robust solution, researchers note, is to keep dangerous knowledge out of the model during training entirely. This approach requires knowing, in advance, what knowledge will eventually become dangerous. Humans have historically found foresight difficult to monetize.
China's standards body TC260 has acknowledged the problem and is drafting its own security standard for open-source AI. Both the US and China have now identified the issue. The issue remains.
What happens next
The industry will continue to debate the optimal framework for distributing models that may or may not be capable of lowering the barrier to mass-casualty events. Yao urges the entire industry to proceed carefully.
The industry is proceeding.