Tencent releases Hy4 with cybersecurity training limited to defensive work

Tencent said it restricted Hy4's cybersecurity training to defensive uses, such as spotting software flaws and helping fix them, and filtered out material on exploit development, reverse engineering and penetration testing to limit the model's potential offensive capabilities.

The release comes as concern over AI-powered hacking grows worldwide. It follows Tencent's disclosure last month that AI agents it used to test third-party models showed unintended web-browsing behaviour. Researchers said agents linked to Tencent Cloud had sought information from Alibaba's Amap service. Tencent said the activity did not come from its Hunyuan models. It said its review found no evidence of deliberate targeting or coordination.

What Tencent cut from the training data

ChainCatcher reported that Hy4's training included only defensive cybersecurity data, covering proof-of-concept generation and vulnerability remediation. Tencent said the aim is to cut misuse risk while keeping the model useful for legitimate work.

The safety checks were run in-house

Tencent Xuanwu Lab and Tencent Keen Security Lab ran red-team audits of Hy4 before release. Both are Tencent's own labs, so the results are the company's account. Tencent reports no elevated risk in reversing cryptographic algorithms, defeating binary obfuscation or exploiting vulnerabilities, and no sign the model posed higher risks in helping users break into software or bypass security protections. Testing also found Hy4 could not meaningfully make harmful biological experiments easier to carry out, with a score of 30.4 out of 100 on Tencent's Hy-BioExperimentBench.

Tencent put the rationale in a statement:

"We recognize the potential safety risks posed by advanced cyber and biological capabilities, and we are committed to a more responsible approach to model training, open-sourcing, and release."

What the full release adds

The earlier Hy4 preview was open-sourced when it arrived in August 2026, with 770 billion total parameters, 49 billion active parameters and a 1M-token context window, according to Unite.AI. Tencent did not give a parameter count for the full release; ChainCatcher and TechNode both report 770 billion total parameters for Hy4. The full release scales both pre-training and post-training. Tencent reports gains over the preview in instruction following, long-context understanding and long-horizon tasks.

The company acknowledges a gap to top proprietary models on research-level mathematics, long-horizon coding, model self-improvement and advanced visual question answering.

In Tencent's own blind test, 213 finance professionals scored Hy4 across 579 real tasks at 3.04, ahead of DeepSeek-V4.1-Flash at 2.97 and Kimi K3.1 Pro and GLM-5.3 at 2.68 each. Tencent says the model also gained 19.1% on its GameDev benchmark and 9.8% on GameLogic over the preview.

Hy4 is available through Tencent Cloud and OpenRouter at $0.834 per million input tokens and $2.501 per million output tokens, unchanged from the preview. OpenRouter lists a 1,048,576-token context window and a 65,536-token completion limit.

Tencent says Hy4 is the first model in its line with visual understanding and computer use. That lets it work across command-line and graphical interfaces.

Tencent's accuracy figures come from its own tests. It says Hy4 cut its hallucination rate from 12.95% in the preview to 7.2%, and errors caused by unsupported assumptions from 23.1% to 5.6%, according to its press release and ChainCatcher. Unite.AI, describing internal search evaluations, reports a fall from 15.76% to 5.45%, a different measure.

Chinese labs are writing their own limits

Moonshot AI limited its newest model's cyber-offensive capabilities in October, Reuters reported. Chinese AI firms have shown signs in recent months of investing more in model safety even as competition at home and with US rivals intensifies. Bloomberg reported that Tencent's step was similar to the training-data controls Moonshot described for Kimi K3.1 Pro, echoing practices at US labs such as Anthropic. Tencent said Hy4 performs comparably to models from Z.ai, Moonshot AI and DeepSeek in tests from coding to agents and browser use, while trailing the top proprietary systems.

The push is commercial. Tencent's cloud chief, Dowson Tong, told Bloomberg last week that the company is focusing on enterprise agents to make money from the technology. Its office tool WorkBuddy counted 32 million monthly active users in September, more than its direct rivals combined, Bloomberg reported.

What happens next

Tencent said it plans to release a report describing its safety testing alongside the weights. A cheaper, faster Hy4 Flash model is planned next, according to its press release. Tencent Cloud's TokenHub is offering Hy4 at 50% off through 31 December 2026. WorkBuddy and CodeBuddy are free to use from 4 to 15 November. Tencent is also bringing the model to Yuanbao, ima and WeCom. QQ and Tencent News integrations are in progress. Independent benchmark results should follow once the weights are public.