Key facts
- Tencent said it limited Hy4's cybersecurity training data to defensive material such as proof-of-concept generation and vulnerability patching.
- Tencent said Hy4 scored well below its high-risk threshold on an in-house benchmark for biological misuse.
- Tencent chief AI scientist Yao Shunyu said teams must carry out extensive cybersecurity testing before a model is released.
- Alibaba's Liu Dayiheng said developers cannot recall or patch every copy once users download the weights.
- DeepSeek research engineer Gao Xi said open-sourcing can amplify some AI safety risks and that tiered models are being explored.
China's leading artificial intelligence model companies are beginning to curb the cybersecurity capabilities of their most advanced open-weight models, following a string of high-profile AI hacking incidents involving both US and Chinese companies, according to a report published November 15.
Tencent Holdings said it stripped its latest Hy4 model of its cyber-hacking capabilities while retaining its cyber defence capabilities, following a similar move by Moonshot AI with its Kimi K3.1 Pro. Tencent said it limited cybersecurity training data to defensive material related to proof-of-concept generation and vulnerability patching, while filtering out offensive content such as exploit development, reverse engineering and penetration testing. Its internal cybersecurity teams found no elevated risk in red-team tests of Hy4 on offensive tasks.
On biosecurity, Tencent said Hy4 scored well below the high-risk threshold on its in-house benchmark of open-ended experimental design and concluded the model does not meaningfully lower the barrier to causing biological harm. The company promised more detail on its safety evaluations in an upcoming technical report accompanying the Hy4 weight release.
Four days after the November 4 release, Yao Shunyu, Tencent's chief AI scientist, said at a conference in Hong Kong that teams must carry out extensive cybersecurity testing before a model is released, according to Yicai. He argued that an ideal model should be strong in cyber defense and weak in offense, but since the two capabilities cannot be fully separated, safeguards are needed at every stage.
Many Chinese labs are rethinking how they train and release open-weight models as models grow more capable at offensive cyber tasks. In August, Z.ai (Zhipu) staged the release of GLM-5.3 and made its cyber version available only through a trusted-access program. In October, Moonshot AI filtered the training data for its latest open-weight model to curb its offensive cyber capabilities.
At the World Internet Conference in Wuzhen on November 3, Alibaba and DeepSeek also discussed the topic. Liu Dayiheng, head of the Qwen LLM project at Alibaba, explained that once users download the weights, developers cannot recall or patch every copy, and users can fine-tune a model to remove its built-in safeguards, though he highlighted that openness benefits defenders too. Gao Xi, a research engineer at DeepSeek, acknowledged that open-sourcing can amplify some AI safety risks and said his colleagues were exploring ways to address these risks, including classifying models into tiers.