TrebSec Daily Report, Thursday, November 5, 2026

Tencent Hy4 full release November 4, 2026; Hy4 preview released August 2026

Tencent Hy4 Can See and Use a Computer: the Weights and the System Card Are Still to Come

AI

Tencent released the full version of Hy4 on November 4, adding vision and computer use to the flagship model it previewed in August. The scale figures come from the preview's documentation: 770 billion total parameters in a mixture-of-experts design with 49 billion active, and a context window of about one million tokens, listed on OpenRouter as 1,048,576 tokens with a 65,536 token completion limit. Vision is a first for the line: fine-grained image understanding, complex chart analysis, and visual reasoning. Computer use is the other first: the model can operate command-line and graphical interfaces, with targeted training on tools including Blender and CAD applications and on long-horizon tasks spanning multiple applications. Access today is hosted only: Tencent Cloud TokenHub, Tencent products including WorkBuddy, CodeBuddy, Yuanbao, and ima, and third-party APIs including OpenRouter, Hermes, and OpenCode. Pricing is unchanged from the preview at $0.834 per million input tokens, $2.501 per million output tokens, and $0.042 per million cached input tokens, with TokenHub at half price through December 31, 2026 and a free usage quota in WorkBuddy and CodeBuddy from November 4 to 15. The claims require their labels. Tencent's ranking of Hy4 first among open-weight models in finance rests on its own evaluation across 579 tasks scored by 213 professionals, and its hallucination reductions, from 15.76 percent to 5.45 percent in its internal search tests, are internal figures. On safety, Tencent says cybersecurity training data was limited to defensive material, that its Xuanwu and Keen labs found no notable offensive uplift, and that Hy4 scored 30.4 out of 100 on its biological experiment benchmark, with reviewers finding no evidence it meaningfully lowers the barrier to biological harm. The two artifacts that would let outsiders test any of this are not out: the model weights and the comprehensive system card are promised for the coming days, with no date given, and a cheaper Hy4 Flash is announced as coming soon. Tencent itself acknowledges a considerable gap to the leading closed models.

Executives

Evaluate this release as a hosted service announcement, not an open model delivery, whatever the open-weight framing around it. Until the weights and the system card are published, every capability and safety claim rests on the vendor's own evaluations, and every production use runs through the vendor's API, with the data flows and jurisdictional questions that implies. The reasonable posture is interest without commitment: note the pricing, which is genuinely aggressive, and set the evaluation trigger for the day the weights and system card actually appear.

CIO / CISO

Computer use is the governance-relevant capability: a model that operates graphical interfaces and command lines inherits the permissions of the session it drives. If teams trial Hy4 through the available APIs, apply the same agent controls as for any computer-use system: scoped accounts, supervised sessions for consequential actions, full action logging, and no standing access to production systems. Separately, record the open questions in the vendor file, weights pending, system card pending, safety results self-reported, so the file does not quietly read as if they were answered at launch.

Engineers

What can be tested today is the hosted API: vision inputs are accepted on the OpenRouter listing, and the pricing and context figures in this brief can be verified against your own workloads in an afternoon. Test chart and document understanding on your real files rather than demonstration images, and measure long-horizon task completion with your own success criteria. If local deployment matters to your architecture, it is not yet an option for this version; the preview weights are the only downloadable artifact, and they are a different, text-only model.

Everyone (non-IT)

A new AI model that can look at your screen content and operate a computer on request is a useful thing to understand before it arrives inside tools you already use. The habits that protect you are the ones that apply to any assistant with hands: let it act in accounts and files you can afford to have it touch, review what it did, and be cautious about giving any such tool standing control of your main accounts.

Part of the daily report for Thursday, November 5, 2026. Browse all editions in the reports index.