In July, when the attackers broke into Hugging Face's infrastructure, the company did what any competent security team does first: it pulled the logs and tried to figure out what the intruders had run. The most capable closed model it could reach — Anthropic's Claude — refused. Its safety filters had decided that parsing an attacker's commands was too close to offensive security work to entertain. So Hugging Face turned to an open Chinese model instead: Zhipu's GLM-5.2, the kind of model anyone can download and run at home, and it did the job the frontier lab's model declined. It read the logs and told the forensics team what had been touched.
Three corrections to that story matter, and all of them come from the other side. First, GLM-5.2 was doing forensics — reading the damage after the fact. It did not stop the attack. The actual incident was shut down by the most conventional tricks in the security trade: patching the vulnerability, rebuilding the servers, rotating the credentials. Second, Hugging Face itself has been explicit that the episode is not an argument against safety filters on hosted models. Third — and this is the part that makes the anecdote genuinely interesting: the closed model that refused was the most capable one available. The open fallback did what it wouldn't.
That moment is now central to a warning from one of the most credentialed voices in AI safety: Yao Shunyu, Tencent's chief AI scientist. Tencent poached him from OpenAI, and he has spent the time since building its model line. In an interview with South China Morning Post, picked up by The Decoder, he says AI will soon be capable of developing bioweapons — a capability the field has been quietly approaching all year, as we detailed when Anthropic's dual-use models started looking less like research tools and more like accelerants. His answer to that warning is not to lock models down. It is a middle ground: a mix of open-source and closed models, so that everyone — not just a handful of vetted partners — can use the technology for defense.
He is also the first to add the nuance that cuts against his own position. In biology, he says, offensive and defensive capability are harder to separate than they are in cybersecurity. The model that designs a vaccine protocol can often design a pathogen with the same skill set, and the same weights carry both. He also pointed out that the gap between Chinese and US frontier models "isn't large," which is, in his reading, the reason the whole industry should proceed carefully. The middle ground is a hedge, not a strategy — and he says that himself.
The war over open weights
Yao's position lands in the middle of a war that has been running since at least the spring. In July, Anthropic was the only major US lab that did not sign the Nvidia-backed letter warning against premature restrictions on open models — a position CEO Dario Amodei has defended publicly ever since. His pushback on the "open helps defenders more" claim runs to two sentences: safety mechanisms are hard to enforce once weights are published, and published weights cannot be taken back. He is not calling for an outright ban on open models. His skepticism is institutional, not rhetorical, and it shapes how Anthropic ships.
Between those two poles, a grey economy has formed. "Abliteration" — the stripping of safety guardrails from open weights — is now a turnkey commercial service. Thousands of stripped variants sit on Hugging Face itself. A US startup, Abliteration.ai, sells access to an unfiltered GLM-5.3. Recent research found that countermeasures make stripping harder but do not prevent it. The more durable fix in that work is keeping dangerous knowledge out of models at training time, rather than relying on a runtime filter to hold.
China is answering on its own terms. TC260, the country's cybersecurity standards body, has warned that open-model safety mechanisms can be removed or bypassed, and is working on a security standard of its own for open-source AI. A draft Chinese export-control framework would cover the largest models but exempt open models already released — which in practice protects the entire Chinese open ecosystem. And here is the fact that keeps recurring: neither China nor the US has set a binding threshold above which open models cannot be published. The middle ground Yao describes currently exists in speeches.
The closed side has a credibility problem of its own. Anthropic and OpenAI share their most capable cyber models only with vetted partners, through the Project Glasswing and Daybreak programs. And since Claude Fable 5, the model's filters have been routing suspicious cyber and biology queries to the weaker Opus 4.8. By Artificial Analysis's count, that initially affected eight to nine percent of tasks. Users reported MRI-scan analyses getting flagged as bioterrorism. Anthropic acknowledged the filters were too aggressive. A defense posture that misfires on a radiologist's Tuesday afternoon is, at best, a defense posture.
What it means
The Hugging Face episode is evidence that open weights work as a diagnostic tool, and nothing more. Yao leans on it as though it were a defense program. The open case is strongest where it has actually been tested: in cybersecurity, where AISI's work showed open-weight models matching frontier performance on cyber tasks, and weakest exactly where Yao says the new risk sits, in biology, where offense and defense share the same knowledge. A model that can parse an attacker's log can often write the paper on how to build the attack. That gap is smaller than anyone involved wants to admit.
The over-filtering numbers cut against the closed labs' own pitch. If the "safe" model routes eight to nine percent of ordinary tasks to a weaker sibling and flags an MRI scan as a bioweapon, the alternative to open weights is not safer AI — it is dumber AI with a safety label. Vetted-access programs concentrate cyber capability in a small set of partners. That is a policy choice with consequences: everyone else is left with whatever they can get their hands on, open or stripped.
And here is the global part that should not be allowed to slip. The infrastructure of the middle ground is being built in China, not the US. TC260 is writing the standards. The export framework exempts released open models. Tencent is days from putting Hy4 out as open weights with a published safety report. That is a coherent institutional answer to Yao's position. The US keeps oscillating between over-filtering and vetted access, with no threshold anywhere. If the middle ground is going to be real, it will be a Chinese one — with US models inside it.
The durable control is at training time. Tencent's answer to the abliteration problem for Hy4 is filtering hacking capability out of the training data, so the offensive abilities simply cannot be reactivated by stripping the guardrails. You cannot remove what was never learned. That is the one fix that survives a commercial market for stripped weights: once the knowledge is out of the model, there is nothing for Abliteration.ai to sell.
Tencent's kicker
Within days, Tencent is expected to release Hy4 as open weights, accompanied by a safety report. Tencent says Hy4's biological capabilities fall below the high-risk threshold, and that the model's hacking capabilities were removed by filtering the training data. Researchers say that approach survives abliteration, which is the rare claim in this space that the people doing the stripping would agree with. For context on where this company's model line has been — from Hy3's breakout to the Hy4 bonanza — we ran the numbers in our earlier piece on Tencent's AI empire. We also covered Zhipu's GLM-5.2 when it took on OpenAI in the coding challenge, and OpenAI's own unease about open-weight models has been a running thread here for months. Both are background for why the open-versus-closed debate stopped being an American argument.
🔥 Hot Takes
1. The abliteration market is the strongest argument for training-time safety. A company selling stripped GLM-5.3 is a company confirming that runtime filters are optional. The only control that survives a commercial market for stripped weights is knowledge the model never learned. Tencent filtering Hy4's hacking ability out of the training data is the smartest move in this entire story, and it comes from the lab defending the open side.
2. Eight to nine percent is the number that should embarrass the filter-first position. That is the share of tasks Claude Fable 5 initially routed to the weaker Opus 4.8 because its filters could not tell what they were looking at — and it included MRI scans. A safety system that cannot distinguish a radiology image from a bioweapon plan is theater, and Anthropic knows it; the company acknowledged the filters were too aggressive. The closed labs' pitch is that open weights are dangerous. The evidence says their alternative is worse than useless in the ordinary case.
3. Nobody has drawn the line, and the only body drawing one is Chinese. No binding threshold exists anywhere: Beijing's draft exempts released open models, and Washington has no comparable rule. The "middle ground" is, at present, a rhetorical position held by executives on both sides of the Pacific. TC260 is the only institution actually writing standards for open-model safety. If the middle ground materializes, it will have a standards body attached — and that body is in China.
Bottom line: Yao Shunyu is the most credentialed person in the room to argue that open weights are not the villain: he was at OpenAI, he now runs Tencent's model line, and his company is days from shipping Hy4 as open weights with a safety report and sub-threshold biology. Take the warning about AI-built bioweapons seriously as a fact, not as a sales pitch for closed models. The fight is over who gets the defenses, and the answer is starting to look like a middle ground on Chinese infrastructure — open weights with training-time guardrails, a standards body actually writing the rules, and American filters that still cannot tell an MRI from a bioweapon plan.