Tencent proposes combining open and closed AI models for safety

You ask an AI assistant to explain a suspicious command in a server log, and it refuses: the request looks like help with hacking. For a security team, this is a real operational problem. Before deploying such an assistant, it is worth checking whether it can analyze actual incidents and where human involvement will be needed.

According to The Decoder, citing the South China Morning Post, Tencent chief AI scientist Yao Shunyu advocates combining open and closed models. He warns of future biological risks from AI but argues that restricting access alone will not solve the problem. Developers of defensive tools also need sufficiently capable models.

It is important to distinguish a forecast from an observation here. The warning about AI's ability to develop biological weapons is the researcher's assessment. The log analysis case described in the article illustrates a different, more concrete problem: safety filters can block useful work.

What happened during the attack investigation

According to the report, Hugging Face used the open GLM-5.2 model to analyze commands found in traces of a breach when closed models refused to examine them. For Yao, this illustrates why the industry should preserve access to open models.

Imagine an engineer who discovers an unfamiliar command in a log. They need to understand which files it affects, whether it contacts an external server and which related events to look for nearby. In this scenario, the assistant's refusal delays the investigation, even though the request concerns protecting infrastructure.

However, the article explicitly sets out the limits of this example. The model helped analyze what had happened. Specialists stopped the attack: they patched the vulnerability, rebuilt the affected servers and replaced credentials. This case does not establish that an open model independently protected the platform or that safety filters are useless.

For a product, the distinction matters. Explaining a suspicious command, suggesting a check and receiving permission to modify a server represent three different levels of responsibility. Success at the first says nothing about a system's readiness for the others.

Why open weights complicate safeguards

Open models have a downside: anyone with the weights can change their behavior. The report discusses abliteration, an approach to weakening learned refusal behavior. A model's restrictions therefore cannot be treated as an unchangeable guarantee once it has been released.

A closed service retains more control over access and request handling. But that control also needs calibration: overly broad restrictions affect legitimate use cases. This creates a practical conflict. A team needs a tool that helps investigate dangerous activities, while the provider needs a mechanism that limits assistance with those activities.

Applying conclusions from cybersecurity directly to biology is particularly risky. As the article notes, offensive and defensive capabilities are harder to separate in that field. Successful server log analysis does not prove that freely releasing any other capability will produce the same outcome.

According to the report, Tencent is preparing to release Hy4 with open weights and a safety report. The company claims limited biological capabilities and says hacking capabilities have been removed by filtering the training data. For now, these claims will need to be assessed against published methods, results and independent evaluations. The existence of a report alone does not establish that the model is safe.

What to check before deployment

The practical takeaway for developers is to include real, authorized tasks that may trigger false refusals in model evaluations. Examples include explaining commands from anonymized logs, analyzing vulnerabilities in your own code and drafting an incident report. Assess the usefulness of the response, the accuracy of the explanation and the frequency of unjustified blocking together.

Product managers should define in advance what happens after a refusal: the task is handed to a specialist, the user clarifies the context or an agreed review process is triggered. Automatically switching to a model with weaker restrictions requires separate justification and access controls.

When choosing a provider, also establish which data leaves your infrastructure, who can see the logs and which actions the assistant is allowed to take. Open weights answer only some of these questions. A deployment decision requires testing the specific workflow and establishing clear boundaries of responsibility.