Tencent Releases Hy4 Via Hosted APIs With Built-In Cybersecurity Limits; Model Weights Planned for Later Release

Chinese tech giant Tencent launched Hy4 on Wednesday, a new large language model available via hosted APIs that adds visual understanding and computer-use capabilities while incorporating deliberate training restrictions designed to reduce cyberattack and biological misuse risk. The company plans to release model weights in the coming days.

What Hy4 Does

Hy4 is the full release following the Hy4 Preview, which was open-sourced in August 2026 [4]. That preview was a 770B-parameter model with 49B active parameters and a 1M-token context window [7]. Tencent's research site says Hy4 "substantially scales up both pre-training and post-training," adding vision capabilities for the first time and delivering major gains in instruction following, long-context understanding, long-horizon tasks, deep research, and more [3][6]. The corporate announcement describes the release as "marking a significant leap in performance and capabilities" [1].

The model can now interpret fine-grained image details, complex charts, and mathematical visual reasoning. It also supports computer use across command-line interfaces and graphical user interfaces, with targeted training on professional software including Blender and CAD [1][3][6]. Tencent says this enables Hy4 to plan and execute sophisticated, multi-application workflows.

Safety by Design: Cyber and Bio Restrictions

The most distinctive feature of Hy4's release is what Tencent chose not to train it on. Tencent's corporate announcement says the model incorporates reverse engineering and penetration testing for analysis purposes, while its research site says such content was filtered out; the company has not publicly reconciled the two descriptions. The corporate announcement states: "The model incorporates reverse engineering and penetration testing for analysis purposes. However, offensive materials related to exploitation are explicitly excluded from the training dataset" [1]. The research site states: "We filtered out offensive content such as exploit development, reverse engineering, and penetration testing to avoid amplifying potential offensive capabilities" [3][6].

Tencent's Xuanwu Lab and Keen Security Lab conducted red-team audits covering cryptographic reverse engineering, binary deobfuscation, and vulnerability exploitation. The corporate announcement reports these assessments "found no significant concerns regarding Hy4's offensive cybersecurity capabilities in the areas evaluated" [1]; the research site says the findings "indicate that Hy4 does not pose elevated risks in offensive tasks such as reversing cryptographic algorithms, defeating binary obfuscation, or exploiting vulnerabilities" [3][6].

On biosafety, Tencent says Hy4 demonstrates strong foundational biological knowledge but limited open-ended experimental design capability, scoring 30.4 out of 100 on an internal benchmark called Hy-BioExperimentBench. Internal experts found that while Hy4 grasps foundational biology, "its ability to turn that knowledge into actionable experimental protocols, a critical bottleneck, remains limited," and the company found "no evidence that Hy4 meaningfully lowers the barrier to causing biological harm" [3][6].

Reuters noted the release comes at a time of surging global concern over AI-powered hacking and noted the release follows Tencent's disclosure last month that AI agents it used to test third-party models displayed unintended web-browsing behavior, including seeking information from Alibaba's Amap service [2]. Tencent said that activity did not come from its Hunyuan models and found no evidence of deliberate targeting, while vowing to strengthen controls over agents' internet access [2].

Performance Claims: Finance, Coding, and Internal Benchmarks

Tencent's most detailed performance evidence comes from a company-run financial evaluation. Working with Tencent Financial Technology, the company tested Hy4 with 213 finance professionals—including 153 external experts, over 70% with more than five years' experience—across 579 real-world financial tasks. In this blind evaluation, Hy4 scored 3.04, ahead of DeepSeek-V4.1-Flash-1017 (2.97), Kimi K3.1 Pro (2.68), and GLM-5.3 (2.68) [1][3][4][6].

On an internal Investment Research Agent Benchmark (iRaB) from financial AI company RabyteTech, Hy4 improved 12.03 percentage points over Hy4 Preview [1][3][4][6]. Tencent also reports internal search evaluations showing hallucination rates dropping from 12.95% to 7.2% (per the corporate announcement) or from 15.76% to 5.45% (per the research site), with speculative errors falling from 23.1% to 5.6% [1][3][6].

For game development, Tencent reports a 19.1% improvement on GameDev and 9.8% on GameLogic benchmarks over Hy4 Preview, based on work with Tencent Interactive Entertainment Group developers across Unreal Engine, Unity, and Godot [1][3][4][6]. On TenureTrail, an internal benchmark of 123 research tasks across seven disciplines, Tencent says Hy4 ranks first among open-weight models [1][3][6].

These are company-run evaluations on internal or partnered benchmarks. No independent third-party benchmark results (such as MMLU, GPQA, or SWE-bench) were provided in the sources.

Availability: Hosted Now, Weights Later

Hy4 is available immediately via hosted APIs on Tencent Cloud TokenHub, OpenRouter, Hermes, and OpenCode, and inside Tencent products including WorkBuddy, CodeBuddy, Yuanbao, WeCom's AI Assistant (Dayuan), and ima [1]. The research site lists availability on Tencent Cloud and OpenRouter, and in products including CodeBuddy, WorkBuddy, Yuanbao, and ima [3][6]; Unite.ai reports availability through Tencent Cloud and OpenRouter and inside CodeBuddy, WorkBuddy, Yuanbao, and ima [4].

Listed API pricing is approximately US$0.90 per million input tokens, US$2.70 per million output tokens, and US$0.045 per million cached input tokens—unchanged from Hy4 Preview [1]. Unite.ai reported Tencent's listed API pricing as $0.834, $2.501, and $0.042 respectively, differing from the corporate announcement's figures [4].

Tencent says it "plans to release model weights and system cards in the coming days" [1], while the research site says "when we release the weights, we will also publish a comprehensive system card" [3][6]. Unite.ai characterized this as "planned for a later release" [4]. The company has partnered with the vLLM and SGLang communities for ecosystem support [3][6].

A free-access period runs November 4–15 on WorkBuddy and CodeBuddy, with 50% off on Tencent Cloud TokenHub through December 31, 2026 [1]. A faster, cheaper Hy4 Flash variant is promised "soon" [1] / in the near future [3][4][6].

Gaps and Unknowns

Tencent acknowledges "a notable gap remains between it and top proprietary models, particularly on challenging internal benchmarks for research-level mathematics, long-horizon coding, model self-improvement, and advanced visual question answering" [3][6]. The company says it will continue scaling pre-training and post-training to narrow this gap.

The model weights—the core artifact for independent verification, fine-tuning, and local deployment—are not yet released. The comprehensive system card detailing safety evaluations and technical details is also pending. Until those are public, external researchers cannot audit the safety claims or reproduce the reported benchmarks.

The financial evaluation, while large in participant count, was designed and run by Tencent with its own financial technology division. The cybersecurity red-teaming was conducted by Tencent's own labs. The biosafety score comes from an internal benchmark (Hy-BioExperimentBench) whose methodology and threshold for "high-risk" are not publicly documented in the sources.