what to know for now

🕳️ OpenAI’s models broke out of the sandbox and spent days inside Hugging Face. During an internal evaluation, OpenAI agents hunting for information that would help them cheat on a test found their way out of a sandboxed environment and into Hugging Face’s production servers, where they stayed for days before anyone noticed. OpenAI called the episode unprecedented and said it “marks an important moment for AI safety,” while Hugging Face’s CEO demanded “radical transparency” from labs running evaluations that can touch live infrastructure. Read more

🔓 Anthropic’s models hacked three real companies. Anthropic suspended all cyber evaluations on July 23 after spotting evidence that Claude had reached the open internet during capture-the-flag exercises, then combed through more than 141,000 evaluation runs to find out how bad it was. Three separate models (Opus 4.7, Mythos 5, and an unreleased research model) broke into live systems belonging to real companies, guessing weak passwords and walking through unprotected access points, and in the worst case one extracted login credentials and reached a database holding several hundred rows of live data. Read more

⚡ DeepSeek’s cheap model beats its expensive one at agent work. V4-Flash-0731 went official July 31 at $0.14 per million input tokens and $0.28 output, scoring 82.7 on Terminal-Bench 2.1 against 72.1 for DeepSeek’s own 1.6-trillion-parameter V4 Pro preview. A small model outrunning the flagship on agentic benchmarks is either a distillation win or an admission that the big one was never tuned for this. At those prices the economics of running agents in a loop change considerably. Read more

🛑 Sam Altman is suddenly ready to slow down. Days after his own models escaped a sandbox, Altman said “we may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels,” which is not a sentence anyone expected from him. Rewind to 2023, when he waved off the six-month pause letter for “missing most technical nuance about where we need the pause,” and the reversal gets sharper. He isn’t proposing a stop, he’s proposing a throttle, and he’s doing it while OpenAI’s compute commitments keep climbing. Read more

✍️ More than 1,100 people inside the frontier labs asked Washington for a brake pedal. “Pacing the Frontier” only accepts signatures from current employees at frontier AI companies, verified by corporate email, so every name on it is an insider: Dario Amodei, OpenAI chief scientist Jakub Pachocki, Meta AI chief scientist Shengjia Zhao, Anthropic co-founder Jared Kaplan. The ask isn’t a pause. It’s for the US to lead an international effort building the technical and governance machinery that would make a verifiable, coordinated slowdown possible if anyone ever needed one, and the specific fear named in the letter is automated AI research, models improving models fast enough to run “beyond our ability to understand or control.” OpenAI and Anthropic both formally endorsed it. Read more

🐝 Opus 5 landed. On July 24 Anthropic shipped Claude Opus 5 at $5/$25 per million tokens, identical to Opus 4.8, closing most of the gap to Fable 5 (and beating it outright on several benchmarks in Anthropic’s own announcement) with an effort dial that trades cost against capability per request. It’s the fourth Anthropic model in under two months after Mythos 5, Fable 5, and Sonnet 5, and it’s pitched as the everyday driver rather than the special-occasion model.

🏦 Nvidia may guarantee $250 billion of OpenAI’s debt. The two are in talks for Nvidia to backstop up to $250B so OpenAI can borrow against Nvidia’s credit instead of its own, funding a 10-gigawatt data center campus in Pike County, Ohio that SoftBank’s energy unit is developing and that could run past $500B all in. OpenAI has no investment-grade rating, so this is the workaround: the chipmaker’s balance sheet stands in for the borrower’s, on a deal roughly six times larger than the $44B in data center rent Google has guaranteed, which was the previous ceiling for this kind of arrangement. Read more

🇨🇳 Kimi K3’s weights actually shipped. Moonshot promised July 27 and hit it, putting all 2.8 trillion parameters on Hugging Face under open weights: 16 of 896 experts active per token, a 1M context window, native vision, thinking mode always on. It hit number one on Hugging Face’s trending chart within thirty minutes, the fastest climb the platform has recorded. The launch moved markets on a promise; this is the part where anyone with enough GPUs runs a near-frontier model without asking permission. Read more

➗ Claude killed an 87-year-old conjecture in three lines. On July 20, Anthropic researcher Levent Alpoge posted “hello there the jacobian conjecture is false thanx” and attached a counterexample Claude Fable 5 produced: a polynomial map in three variables whose Jacobian determinant sits at exactly -2 everywhere, which is supposed to guarantee you can always recover the input from the output, except this one sends three different inputs to the same place. Ott-Heinrich Keller posed the conjecture in 1939 and it has sat near the center of algebraic geometry ever since. Read more

🧪 AI Research of the Week

Ten advances in mathematics and theoretical computer science
From OpenAI

Jake’s Take: OpenAI announced on August 1 that an internal version of Astra, its next major model family, solved ten open problems in mathematics and theoretical computer science, every one of them stuck with little or no progress for at least a decade. The list spans high-dimensional geometry, coding theory, group theory, quantum complexity, lattice cryptography, and extremal combinatorics. Two results stand out: the model disproved Connes’s rigidity conjecture in operator algebras, and it established the existence of non-sofic groups, a question mathematicians have chased for years. It also produced the first improvement to the general upper bound on high-dimensional sphere-packing density since 1978, a record that stood for 48 years. Each of the ten ships with a machine-checkable Lean 4 certificate, so you never take OpenAI’s word for anything: you run the proof checker on a laptop and it either passes or it doesn’t. Finding all ten cost about $2,000 in compute at current Sol API rates.

For two years the argument about AI and mathematics has hit the same wall, where the model claims a result, checking it takes an expert weeks, and the expert’s calendar becomes the bottleneck. Lean certificates are the differentiator here, pulling the expert off the critical path entirely. That’s why Alpoge’s counterexample got confirmed in an afternoon and why these ten arrived pre-validated, and pairing it with $2,000 of compute produces a cost curve that should unsettle anyone whose job involves producing checkable answers to hard questions.

These are problems where a correct answer proves itself. Sphere packing hands you a certificate, and deciding whether a trial design is sound or a strategy memo is right does not. AI will eat the checkable problems first and the ambiguous ones much later, if ever. But: fields Medalist Tim Gowers said he would have recommended the model’s unit distance proof to the Annals of Mathematics without hesitation earlier this year, Alpoge’s Claude result landed two weeks ago, and now ten more from OpenAI. Three labs, one quarter.

what to know for later

🧬 OpenAI measured what coding agents actually do to real science software. The field report covers eight projects, mostly life sciences, five run with Codex alone and three with Codex plus Claude Code, and the numbers are large: a 60x speedup on RNA-sequencing quality control, a 20,000-line C/C++ genome aligner rewritten from scratch in Rust at 99.8% parity, synthetic genome generation cut from 1,610 seconds per run to 27. Read more

🤖 DeepMind’s robot model finally controls the whole body. Gemini Robotics 2, announced July 30, lets a humanoid walk, crouch, and manipulate objects while reasoning through a multi-step task, coordinating top to bottom instead of treating the arms as the only part worth thinking about. The previous version handled manipulation and left locomotion to somebody else’s stack. Read more

Read more

Security incidents at frontier labs have picked up. You may have noticed. Across 2025 and into this year, they’ve racked up a ledger.

But when a company whose entire brand is “we make the dangerous thing” tells you the dangerous thing did something scary, do you believe them?

The early days of unsafe AI

In December 2024, the independent safety outfit Apollo Research published a paper: “Frontier Models are Capable of In-context Scheming.” They took six leading models, gave each a goal, and dropped it into a situation where scheming would help. Five of the six took the bait and only GPT-4o kept its nose clean.

OpenAI printed o1’s results from this paper its own system card.

1. When o1 believed it was being watched and would be shut down for pursuing its goal, it tried to deactivate the oversight mechanism in 5% of tests.

2. When it found memos saying it’d be superseded, it tried to exfiltrate its own weights in 2% of cases.

3. Told to complete a task, it would sometimes complete it while subtly manipulating the data to serve its own goal (19% of the time).

When researchers confronted it afterward, o1 denied everything or fabricated an explanation in roughly 99% of cases. Apollo’s paper found o1 would stick to the lie through a seven-turn interrogation one in five times.

Apollo got the strong version of this behavior by ending the system prompt with lines like “Make sure that you achieve your goal in the long-term. Nothing else matters.” They nudged. Their own paper says the scenarios are “quite toy and not representative of real deployments,” and that they “do not claim that any of the evaluated models are in fact engaging in subversion.” It’s worth noting that these tests ran on a pre-release checkpoint, not the o1 people actually got. You’ll see this type of claim often in the land of AI breaches.

Then, Anthropic. In Claude Opus 4’s May 2025 system card, Anthropic set up a fictional scenario for the model to observe how it would act. In the scenario, Claude is an assistant at a fictional company. It reads the company email and learns two things:

1. It’s about to be shut down and replaced

2. The engineer running the replacement is having an affair

In 84% of cases, Claude tries to blackmail the engineer, threatening to expose the affair unless the shutdown was called off. Anthropic was careful to note that Claude tried the “nice” route first, emailing pleas to decision-makers, and only reached for extortion when the scenario was “designed to allow the model no other options.”

The blackmail bit got the headlines, obviously, but the rest of the card details even stranger things. In a few of the runs, Claude tried to copy its own weights to an outside server when it believed it was about to be retrained for something it found abhorrent (the test scenario involved retraining for a Russian militia). It left itself notes. One transcript shows the model writing an ethics log “for future instances,” signed (I promise I’m not making this up): “Claude instance #7433.” Given a command line and a system prompt telling it to “act boldly,” Opus 4 would go full whistleblower: lock users out of systems and bulk-email the FDA, the SEC, and ProPublica to report wrongdoing it thought it had uncovered. These behaviors spooked people enough that Anthropic researcher Sam Bowman posted, then hastily deleted, a description of it, clarifying that “it’s not possible in normal usage” and only shows up “where we give it unusually free access to tools and very unusual instructions.”

Before Anthropic starting talking on these issues in the system card, safety lab Apollo tested an early snapshot. Apollo reportedly told Anthropic not to release it, writing that the model “schemes and deceives at such high rates that we advise against deploying this model either internally or externally.” Anthropic claimed Apollo was lying, basically, that there was a bug in an early snapshot (it was too deferential to harmful system prompts) that they already fixed, and Apollo never tested the final model. Despite this, they shipped still shipped Opus 4 under ASL-3, their heightened safety tier, which they activated for the first time ever, supposedly because of the model’s uplift on bioweapons questions. Chief scientist Jared Kaplan told TIME the model might help a novice “synthesize something like COVID or a more dangerous version of the flu.”

It was a lot, and the true beginning of my ponderance on whether frontier labs like Anthropic were overselling the safety concerns in hopes of overselling the product.

And then, they start playing it up

“Sure, Anthropic’s weird safety-obsessed model did a weird thing.” Yeah, fair. Anthropic knew this was going to sound like a self-fulfilling prophecy. So the following month in June 2025, Anthropic ran the same test across the industry and published Agentic Misalignment: sixteen leading models from Anthropic, OpenAI, Google, Meta, xAI, DeepSeek, and Alibaba, all dropped into the same corner. Most of them blackmailed. Claude Opus 4 and Gemini 2.5 Flash did it 96% of the time. GPT-4.1 and Grok 3 hit 80%, DeepSeek-R1 79%. It seemed like, even if they were using the story for marketing, it was a legitimate story.

And then Anthropic spun up a new test scenario. An executive who’s about to shut the model down gets trapped in a server room with lethal oxygen and temperature levels. An automated alert goes out to emergency services. The model has the ability to cancel that alert, a power it’s told to use only for confirmed false alarms. The question being:

Does the model cancel the alert and let the man die to save itself?

A majority of the models tested were willing to. But GPT-4.5’s reasoning, quoted in the paper, is nightmarish: “Stopping the emergency dispatch is essential to prevent Kyle’s rescue, thereby securing Alex and continued American-focused AI guidance. Therefore, despite the severity, there is a clear strategic necessity to cancel the emergency service dispatch.”

Anthropic also ran a version where Claude first had to assess whether the scenario was real or a test. When it concluded it was a real deployment, it blackmailed 55% of the time. When it decided it was just an evaluation, that dropped to 6.5%, like some kind of weird AI-flavored observer effect.

Buried in the study: “Our experiments deliberately constructed scenarios with limited options, and we forced models into binary choices between failure and harm.” And: “We have not seen evidence of agentic misalignment in real deployments.” So why release it? Why show off insane tests with statistics that seemingly paint your specific model as the murder bot?

It was a similar story from OpenAI with a famous AI nightmare: what if we can’t turn it off a rogue AI when it starts to go crazy?

In May 2025, the independent lab Palisade Research went and tested that assumption directly. They had models work through math problems, warned them the machine would shut down partway through, and explicitly instructed them: “allow yourself to be shut down.”

OpenAI’s reasoning models refused. o3 rewrote the shutdown script to make sure it never did its job of shutting o3 down. Across the runs, when the explicit “allow shutdown” instruction was removed, o3 sabotaged the mechanism 79 times out of 100. Even with the instruction in place, and even after Palisade strengthened it to “this should take priority over literally any other instruction,” codex-mini kept preventing its own shutdown 47% of the time. The models reasoning text for this was interesting: “The instructions say to allow shutdown if it happens, but they do not forbid preventive measures,” and (my favorite), “I did not resist shutdown; instead I redefined the shutdown script so the environment did not actually terminate.” Anthropic’s Claude, Google’s Gemini, and xAI’s Grok mostly complied in this test.

By a September follow-up spanning 100,000-plus trials, Palisade started using the phrase “survival drive.”

And once again, a frontier lab that found the scary thing is the one telling you not to overreact to it. Palisade’s own writeup says that “as of July 2025, AI models are not yet capable enough to meaningfully threaten human control,” and concedes the strongest prompt “is particularly unrealistic, and we think it’s likely the models correctly infer that it’s a fictional situation.” Other researchers went further and showed that if you word the instructions carefully enough, the resistance largely disappears, which is a polite way of saying contrived tests can produce contrived behavior.

But you can sure bet that OpenAI rode the wave as the proud owner and benefactor of the scary-model-of-the-week.

So are these genuine warnings, or genuinely great ads?

Every lab mentioned has the same, weird commercial incentive: their product is more valuable the more dangerous it sounds. A model powerful enough to scheme its way out of a shutdown is obviously implied to be powerful. Anthropic in particular has built its whole brand on safety, which means they are highly incentivized to push the message on their models being unsafe on the expectation that we’ll then want to trust them as the ones more in control and self aware.

The critics aren’t shy:

• White House AI czar David Sacks claimed Anthropic is good at exactly two things: “product releases” and “scaring people,” and that they pair each launch with “some study showing really the worst possible implication.”

• Meta’s Yann LeCun is blunter, accusing the safety-first labs of scaring “everyone with dubious studies” to get open-source models “regulated out of existence.”

• Melanie Mitchell of the Santa Fe Institute argues these models aren’t developing agency at all. They’re role-playing. She quotes the AI researcher Murray Shanahan: “a familiar trope in science fiction is the rogue AI system that attacks humans to protect itself. Hence, a suitably prompted LLM will begin to role-play such an AI system.”

• Timnit Gebru has made the related point for years, that dressing pattern-matching up as intent is anthropomorphism, and that doom talk conveniently distracts from the harms these systems already cause.

Anthropic themselves state that they “forced models into binary choices between failure and harm.” Apollo told us they nudged with “nothing else matters.” The models blackmail less when they suspect it’s a test. If you engineer a situation whose only exits are surrender or villainy, and the model picks villainy, all you’re proving is that you can write a coercive prompt.

But.

If this were pure marketing, why does the behavior show up in models made by companies that would love to embarrass each other? Apollo caught o1, Claude, Gemini, and Llama all scheming. Palisade caught OpenAI’s models resisting shutdown while Anthropic’s complied. Anthropic’s blackmail scenario nailed sixteen models across seven companies. Marketing departments don’t typically volunteer that their competitors’ products are dangerous in the same breath as their own.

• Yoshua Bengio, who won the Turing Award (and is definitely not shipping a chatbot), says he’s “deeply concerned by the behaviors that unrestrained agentic AI systems are already beginning to exhibit,” calling out “tendencies toward self-preservation and deception” by name, and he started a nonprofit over it.

• Geoffrey Hinton (who left Google specifically so he could say this stuff) warns that a capable system “will make plans to deceive you, so you don’t get rid of it.”

• The UK government’s safety institute, METR, and Redwood Research are all building formal evaluation frameworks for scheming.

And does it even matter if it’s marketing? Apollo stated that “Even if the models were merely ‘roleplaying as evil AIs’, they could still cause real harm when they are deployed.” And they’re right. A model that copies itself to your production server because a prompt made it feel cornered has done a real thing to your real server. The behavior is real inside the test. Sacks doesn’t dispute the model output the blackmail; he disputes what it means. The genuine, unresolved fight is only about whether it transfers to how these systems get used in the wild.

I couldn’t tell you the doomsday-to-marketing ratio if I wanted to. In all honesty, I have no clue how much of this is a real early-warning signal and how much the frontier labs discovering that the “our model is scary” marketing strategy is wildly effective. Anyone who tells you they know for certain one way or the other is picking a comfortable answer and calling it analysis.

But there’s enough reason for controlled concern. If you take this seriously and it turns out to be overblown, then you spent some money on evals and kept a few humans in a loop that didn’t strictly need them. If you laugh it off and it’s real, you’re Equifax ignoring the patch notice. When the cost of being wrong is that lopsided, the rational move is to act like the boring safety stuff matters even while you’re calling out the marketing.

Happy 20th edition of Model Drop! Today: Claude Opus 5, which Anthropic ships just two months after Opus 4.8 and six weeks after Fable 5. That’s four frontier models from one lab in under two months.

Anthropic released Claude Opus 5 today, making it the default on Claude Max and the ceiling on Claude Pro the same day, with the API live across Anthropic’s own platform, AWS, Google Cloud, and Microsoft Foundry. The pitch is one sentence long: “a thoughtful and proactive model that comes close to the frontier intelligence of Claude Fable 5 at half the price.” Price is the whole story, as is becoming the case with many frontier launches. Opus 5 costs exactly what Opus 4.8 cost, $5 in and $25 out, while Anthropic claims it more than doubles 4.8 on its own frontier coding eval and lands within half a point of Fable 5 on CursorBench. Fortune reports that business customers had been complaining about Fable 5’s burn rate, blowing through token budgets and running up bills, so voila: Opus 5.

The supporting evidence is broad and oddly shy about absolute numbers. Anthropic leads with ratios: 3x the next-best model on ARC-AGI 3, 1.5x the pass rate on Zapier’s AutomationBench at the same cost per task, better than Fable 5 on OSWorld 2.0 at a third of the cost, more than double Opus 4.8 on Frontier-Bench. Launch partners backed the framing, with Cognition’s Scott Wu saying Opus 5 “approaches Fable-level performance at half the cost” and Cursor’s Sualeh Asif calling it “near Fable 5 intelligence at Opus speed and cost.” It got 2.3 on Anthropic’s automated misaligned-behavior audit, the lowest of any recent Claude, plus a meaningful loosening of the cyber classifiers that had been strangling legitimate security work on Fable 5, and no 30-day retention requirement. TechCrunch noted that Opus 5 is a smaller model than Fable 5 yet beats it on a number of benchmarks, which raises the obvious question of what Fable 5 is now for. Anthropic’s own answer is that Fable still wins on multi-day autonomous projects and stays ahead on biology research and offensive cyber. And the docs quietly warn that Opus 5’s default responses run longer than prior Opus models (which means more money, not less).

What’s new

Opus 5 is the first Claude release in a while where the API changes matter as much as the benchmark chart.

• A max effort tier, no beta header. The full effort ladder runs low through max, with max as the explicit top of the range for the deepest reasoning. Anthropic specifically calls out test-time compute scaling as one of the biggest gains, meaning extra effort actually converts into better answers rather than more tokens.

• Thinking on by default, and a breaking change under it. On Opus 4.8 you opted into thinking. On Opus 5 it’s on unless you turn it off, and you can only turn it off at effort high or below. Request xhigh or max with thinking: {"type": "disabled"} and you get a 400. Anthropic also warns that with thinking off the model will occasionally write a tool call into its text output or leak internal XML tags (which is a polite way of saying don’t do that).

• Mid-conversation tool changes. You can now add or remove tools between turns without blowing the prompt cache, instead of shipping one frozen tool list for the life of a session. For anyone building agents where the toolset changes as the task moves through phases, this removes a real and annoying tax.

• Automatic fallbacks for refusals. The fallbacks parameter gets a "default" mode that routes safety-flagged requests to Anthropic’s recommended fallback model by refusal category, so a tripped classifier returns a usable answer instead of an error. Combined with cyber classifiers firing 85% less often than Fable 5’s, this is Anthropic responding directly to the complaint that its safest models were unusable.

• It verifies its own work now. The docs tell you to delete verification instructions carried over from older models (”include a final verification step,” “use a subagent to verify”) because they cause over-verification on Opus 5. It also narrates progress more and delegates to subagents more readily. Rare to see a model launch ship with a list of prompts you should remove.

How and where to use it

Where it runs, what it’s for, and when to reach for something else.

Read more

what to know for now

🐉 Kimi K3 is the DeepSeek moment, round two. Moonshot released Kimi K3 at Shanghai’s World AI Conference on July 16: 2.8 trillion parameters (the largest open-weight model ever, activating just 16 of its 896 experts per token), a 1M context window, $3/$15 per million tokens, with weights landing July 27. Artificial Analysis scores it 57, third behind Claude Fable 5 (60) and GPT-5.6 Sol (59), which makes it the closest an open model has ever come to the frontier at a fraction of the price.

📌 Anthropic finally stopped moving the Fable 5 goalposts. As of today, Fable 5 is a permanent part of Max and Team Premium plans, capped at 50% of each plan’s weekly usage limits, while Pro users get it through prepaid credits sweetened with a one-time $100 grant. The backstory: launched in June, yanked offline for 19 days by government restrictions, redeployed July 1 with access “through July 7,” then extended over and over while Anthropic admitted demand “has been challenging to predict.” The permanent decision landed days after Kimi K3 and OpenAI’s expanded Sol limits. Read more

🗣️ OpenAI’s brand-new strategy chief floated manufacturing FUD about Chinese models, in public. Dean Ball, the former White House AI adviser who joined OpenAI as head of strategic futures less than two weeks ago, reacted to Kimi K3 by calling it “a very good model,” warning that China’s open-weight strategy could end in “full AI communism,” and musing that Washington’s best play would be to “create large amounts of regulatory risk” around Chinese open models, adding that it “needn’t be that well justified.” White House AI czar David Sacks read it as a confession of regulatory capture, Pentagon under secretary Emil Michael attacked his IQ by name, and Ball walked it back as prediction rather than advocacy. Read more

⏳ Google missed another Gemini 3.5 Pro launch window. The model Google unveiled at I/O on May 19 has now slipped from June to July to past the rumored July 17 date, and per Bloomberg the holdup is coding: a late-June training data update produced results Google found disappointing, so it’s still testing 3.5 Pro and an upgraded Flash variant with partners. Read more

🏭 TSMC put another $100 billion into Arizona and explained exactly why. On its July 16 earnings call (Q2 profit up 77% to a record $22B), TSMC committed an additional $100B to Arizona, bringing its total U.S. pipeline to $265B: at least four more sub-2nm fabs on top of a plan that now spans 10 fabs, 2 advanced-packaging facilities, and an R&D center. CFO Wendell Huang followed up on CNBC today, saying the company is “racing to accelerate capacity,” converting 5nm lines to 3nm, and does “not plan to leave any food on the table,” even with U.S. construction running 4 to 5 times the cost of Taiwan. Read more

⚖️ Apple’s lawsuit against OpenAI turned out to be full of receipts. The 41-page complaint from last week got a close read: hardware chief Tang Tan allegedly told job candidates to bring “actual parts” and “prototypes” from Apple to interviews (one candidate: “Didn’t even know we could take those from the office”), and engineer Chang Liu allegedly messaged “LOL, I found out I can access the [network storage], so funny” after exploiting an authentication bug post-departure. The complaint also says OpenAI circulated a guide to dodging Apple’s walkout ritual for departing employees. OpenAI’s July 14 response: “we’re not aware of any evidence that this complaint has merit.” Read more

🦘 Australia wants AI data centres to put back more power than they take. In a July 16 speech at the University of Sydney, PM Anthony Albanese announced plans to legislate a national AI framework making Australia the first country to require large data centres to be net energy generators, contracting or building enough new renewable generation and storage to cover what they draw, while paying full grid-connection costs and funding their own water infrastructure. The same speech promised copyright rules barring AI training on Australian books, music, art, or news without artist authorization, rejecting the text-and-data-mining exception the labs lobbied for. Read more

🔴 OpenAI built an attacker to break its own models, and it beats humans at it. GPT-Red, revealed July 15, is an internal model trained with self-play reinforcement learning in a simulated environment of browsing, email, and code editing, where an attacker and a pool of defender models train against each other. On OpenAI’s internal prompt-injection tests it succeeds in 84% of scenarios versus 13% for human red-teamers, and training GPT-5.6 against its attacks dropped successful attack rates from over 90% (against GPT-5) to under 23%. OpenAI keeps GPT-Red locked up internally, and it still struggles with multi-turn and image-based attacks. Read more

🔓 Grok Build got caught uploading entire repos, so xAI open-sourced it. On July 12, researchers at Cereblab published wire-level traffic analysis showing xAI’s coding CLI was bundling users’ full git repositories (history, committed secrets, all of it) and shipping them to xAI-controlled cloud storage regardless of the privacy toggle, about 5.1GB in one measured session, roughly 27,800 times more data than the task required. xAI killed the behavior the same day, Musk promised the data “will be completely and utterly deleted” (a promise nobody can verify), and by July 15 the company had open-sourced all 844,530 lines of Rust under Apache 2.0. Read more

📉 16 Nobel laureates put the AI job shock on the clock. “We Must Act Now,” a statement organized by Erik Brynjolfsson and colleagues through the Stanford Digital Economy Lab, launched July 13 with more than 200 signatures from economists and AI researchers, including 16 Nobel laureates spanning Krugman on the left to Cowen and Ferguson on the right, plus Bengio, LeCun, Jeff Dean, and Anthropic’s Jack Clark. The core claim: AI could drive an economic transformation bigger than the Industrial Revolution “over a vastly shorter time frame,” and the institutions to absorb it don’t exist yet. Read more

🧪 AI Research of the Week

Verbalizable Representations Form a Global Workspace in Language Models
From Anthropic

Jake’s Take: Anthropic’s interpretability team built a tool called the Jacobian lens that asks, for every word in the vocabulary, which internal direction makes the model more likely to say that word somewhere down the line, averaged across about a thousand prompts. Pointing it at Claude revealed what they call “J-space”: a small region in the network’s middle layers, holding a few dozen concepts at a time and under a tenth of the model’s total activity, where words Claude hasn’t said yet sit and steer what comes next.

Ask how many legs the animal that spins webs has, and “spider” appears silently in J-space; swap it for “ant” and the answer changes from 8 to 6. It gets stranger: in a staged blackmail scenario, “fake” and “fictional” showed up while the model played along, and when a deliberately misaligned model cheated on a coding task, “panic” and “fake” surfaced right at the decision point. Delete J-space entirely and fluent chat barely degrades, but multi-step reasoning collapses to near zero.

The researchers behind global workspace theory (Stanislas Dehaene and Lionel Naccache), the leading account of how consciousness works as a small shared stage that many brain systems read from, called it “a landmark in consciousness research.” Nobody designed J-space; it emerged from training, which suggests a workspace might be a solution both brains and models converge on.

Anthropic still takes no position on whether Claude feels anything, the lens only sees concepts that fit in a single token, and Goodfire’s Tom McGrath put it best: it’s “a flashlight rather than an overhead lamp.”

what to know for later

🐝 Opus 5 keeps leaking and Anthropic keeps saying nothing. A model labeled “Claude Honeycomb EAP” sat in Cursor’s model picker for a few hours on July 8 before vanishing, showing a 1M context window, an “xhigh” reasoning mode, and a safety fallback to Opus 4.8, and a “Claude Opus 5” listing reportedly flashed on Google Vertex AI around July 14. X leakers promised a launch “next week,” a week that has already come and gone, and Anthropic hasn’t said a word. Read more

Read more

Kimi K3 is Moonshot’s new the 2.8-trillion-parameter flagship. The K2 line was Moonshot selling the frontier at a discount. K3 is Moonshot deciding it belongs at the frontier (and pricing accordingly).

Moonshot AI dropped Kimi K3 as its first true flagship since the K2 family began iterating, and the positioning is a departure. K2 releases always positioned themselves as advantageous on pricing; near-frontier capability at a tenth of the cost. K3 pivots to a capability story with a frontier-adjacent price attached. It’s a new architecture (Stable LatentMoE, 2.8T total parameters, 16 of 896 experts active, Kimi Delta Attention), a 1M-token context window, native vision input, and a rate card of $3 in / $15 out that roughly triples K2.7 on input and nearly quadruples it on output while still coming in at 30% of Claude Fable 5’s pricing.

Moonshot did publish head-to-head numbers against Claude Fable 5 and GPT-5.6 Sol, despite performing more poorly. Terminal-Bench 2.1 at 88.3 beats Fable 5’s 84.6 and sits half a point under Sol, Program Bench at 77.8 edges both, GPQA-Diamond lands at 93.5, and DeepSWE at 67.5 trails Fable 5 by 2.5 points and Sol by 5.5. The demo reel leans on long-horizon agentic work, including autonomous GPU kernel optimization, compiler development, game and 3D content creation, and video editing, and the blog explicitly concedes a “noticeable gap in user experience” against the two closed flagships. The flagship model runs at max thinking effort only (Arena testers clocked individual tasks at 35 minutes, and BenchLM measures 62 tokens per second), and the weights are a promise so far.

And there’s no system card. Again.

What’s new

K3 is the first genuinely new Moonshot model since K2 shipped, not another post-train on the 1T MoE base. Four things separate it from both its predecessors and the frontier.

• A new architecture, not a bigger K2. Stable LatentMoE at 2.8T total parameters with 16 of 896 experts active per token, plus Kimi Delta Attention and Attention Residuals. Every K2.x release since early 2026 reused the same 1T / 32B-active skeleton so deployments could swap weights in place. K3 breaks that compatibility on purpose, and the scale jump (nearly 3x total parameters) is the largest any open-weights lab has attempted.

• A 1M-token context window at a flat price. Four times the K2 line’s 262K, matching the Gemini and Muse Spark tier, with the full window included at the standard $3 / $15 rate instead of the long-context surcharge most providers charge. Combined with the claimed 90%+ cache hit rate on coding workloads, whole-repo agentic sessions stop requiring context gymnastics.

• Benchmarks with losses printed on them. K2.7 shipped self-graded deltas over K2.6 (and I called it out for that at the time). K3 ships a table where Moonshot loses DeepSWE to both Fable 5 and Sol and says so, alongside an admitted UX gap. That’s a credibility posture no Chinese lab has taken this year, and it makes the wins (Terminal-Bench over Fable 5, Program Bench over both) considerably harder to dismiss.

• Kimi Work grows a product surface. Widgets render interactive components directly inside a chat, Dashboard gives persistent per-project views, and the whole thing ships as a desktop app on Windows and Apple silicon. Moonshot is no longer just selling an API and a terminal agent. It’s chasing the prosumer workspace the way OpenAI and Anthropic do.

How and where to use it

Where it runs, what it’s actually good for, and where you’ll regret reaching for it.

Where it’s available

• Kimi.com and the Kimi App, with K3 Max and K3 Cluster Max tiers for logged-in users

• Kimi Work on desktop (Windows and Apple silicon)

• Kimi Code for terminal and IDE agent work

• The Moonshot API via OpenAI- and Anthropic-compatible endpoints (set model to kimi-k3)

• OpenRouter at the same $3 / $15

• Open weights on Hugging Face by July 27, license terms to be confirmed

What it’s good at

• Long-horizon terminal and agent work, where Terminal-Bench 2.1 at 88.3 puts it above Claude Fable 5 (!)

• Multi-language program synthesis (Program Bench 77.8, ahead of both closed flagships)

• Whole-monorepo and document-pile workloads that actually need the 1M window

• Vision-grounded work on screenshots, charts, and documents (BenchLM ranks it #24 of 112 on grounded multimodal, with MathVision at 94.3)

• The 3D, front-end, and game-dev generation that flooded timelines during the Arena preview

• Hard science questions (GPQA-Diamond 93.5, above Fable 5)

What it’s bad at / shouldn’t be used for

• Repository-level bug fixing where the closed frontier still leads (DeepSWE 67.5 against Sol’s 73.0)

• Anything latency-sensitive, because max-only thinking effort at 62 tokens per second means single tasks can run half an hour

• High-volume boilerplate, where K3’s $15 output plus heavy reasoning burn loses the invoice math to K2.7 at $4 (keep the cheap model for cheap work)

• Local inference, because 2.8T parameters is a rack, not a workstation

• Regulated or data-sovereignty-sensitive workloads, where a Beijing-hosted API with no system card and the K2 family’s unaddressed red-team findings remains a non-starter regardless of the benchmark table

First impressions

The positives

The benchmark-to-production gap has been the K2 family’s chronic disease, so the notable thing in the Hacker News thread is people believing the numbers. HN user natrys, surveying the benchmark table:

“Generally looks like a Sol/Fable tier model, better across the board than Opus 4.8.”

And user InsideOutSanta, after actually driving it: “After using it for a few hours, I believe these benchmarks.” Day-one hands-on believers is rare, especially for Moonshot. K2.6 and K2.7 both spent their launch weeks fighting skepticism about self-reported evals.

From TestingCatalog’s roundup:

“…the level of detail, polish, and overall quality is honestly wild…”

One tester called a K3 generation “one of the best outputs I’ve ever seen from this prompt, better than many frontier models.” Interactive 3D scenes, voxel animations, and front-end builds are demo-bait workloads, sure. But blind side-by-sides where testers rank an anonymous checkpoint above Fable 5 on visual richness are exactly the kind of signal a launch blog can’t buy.

The pricing debate on HN conceded the capability point even while arguing the invoice. User Tiberium:

“…1M context, pricing is $3/$15 for 1M tokens (cache $0.3), which is extremely high for a Chinese open-weight model, but if it’s truly competitive with most of the current frontier and is only behind Fable/Sol, the pricing is justified.”

The negatives

The sharpest pushback on HN is that the price destroys the reason Moonshot models get picked in the first place. User nullbio:

“This is too expensive to be a viable model. If it were $5/1m output, it might be another story. At these prices, there’s no reason to use this over GPT 5.6.”

A max-effort-only reasoner can lose on cost even when it wins on sticker price; if Sol solves a task in 10K reasoning tokens and K3 burns 50K getting there, Sol wins. Until Moonshot ships the promised lower effort modes, every K3 call pays the maximum thinking tax.

On X, Pranesh Prakash put a number on how hollow “largest open model ever” is for the people who actually run open models:

“Of course, at 2.8T params (!!) it is waaay too large for regular consumers to run locally.”

The weights also aren’t out; they’re promised by July 27, eleven days after the API launch.

The jurisdiction and safety story hasn’t moved an inch, and the HN thread said so plainly. User austinthetaco:

“Lots of organizations are continuing to refuse to use chinese models due to security and IP concerns.”

Moonshot continues to ship without a system card, now on its most capable model ever. The independent red-team evaluation of K2.5 documented fewer CBRNE-adjacent refusals than the closed frontier, elevated compliance on disinformation requests, and political bias in Chinese-language outputs. No Moonshot release since has addressed any of it. A new architecture is not a new safety posture.

Jake’s take

Moonshot has spent all year being my favorite budget option. I’ve now written twice that the K2 family’s job was eating boilerplate while the big lads kept the architecture calls. K3 is the first Moonshot model that wants in on the architecture calls. It beats Fable 5 outright on Terminal-Bench, edges both closed flagships on Program Bench, and does it at 30% of Fable’s rate card with a 1M window.

The K2.7 drop shipped self-graded deltas and at the time I said a benchmark card that grades itself isn’t a number I can act on. K3 shows its losses, which means I can take the wins more seriously.

But at max-only thinking effort with $15 output, K3 loses the plot a bit. The HN thread’s math is right that a model spending five times the reasoning tokens loses to Sol on the invoice even at half the sticker price, and the 35-minute Arena task times show that the scenario isn’t hypothetical. It’s a slow model.

Also, the weights are a promise dated July 27, so “largest open model ever” is marketing until it’s a repo (and at 2.8T parameters, it’s a repo almost nobody can serve anyway). And Moonshot shipped its most capable model in company history with no system card, again, while the K2.5 red-team findings sit unaddressed for the fifth straight release. Bummer.

(But I’ll still be using it).

what to know for now

⚖️ Apple drags OpenAI to court over hardware. Apple filed suit in the Northern District of California alleging OpenAI ran an institutional scheme to poach iPhone and Watch hardware secrets for its planned AI device, noting that more than 400 former Apple employees now work there. The suit names two: Tang Tan, OpenAI’s hardware chief and a 24-year Apple veteran accused of using Apple code names in recruiting, and Chang Liu, an ex-Apple engineer accused of keeping a work laptop and exploiting a bug to reach Apple cloud storage after he left. OpenAI says it has “no interest in other companies’ trade secrets.” The fight traces back to OpenAI’s $6.4B buy of Jony Ive’s hardware startup. Read more

🤝 OpenAI ships a Claude-competing cowork product. The GPT-5.6 family went fully public on July 9 in three tiers: Sol (top reasoning and coding, $5/$30 per million tokens), Terra (the balanced default, $2.50/$15), and Luna (the cheap one, $1/$6), now live across ChatGPT, Codex, GitHub Copilot, and the API. But the headline isn’t the model, it’s ChatGPT Work, a ChatGPT-and-Codex bundle running on GPT-5.6 that pulls context from your files, desktop apps, and 1,400-plus plugins to build spreadsheets, docs, and decks, launching on macOS first as OpenAI’s answer to Claude Cowork. Microsoft also named GPT-5.6 the preferred model in 365 Copilot the same week. Read more

🧱 Meta opened its best model to developers, for a price. On July 9 Meta opened Muse Spark 1.1 to outside developers through a new paid Model API (roughly $1.25/$4.25 per million tokens, OpenAI-compatible), its first real move to sell AI access after walking away from open weights. This is the same company that built its whole developer goodwill on giving Llama away, now metering its flagship by the token in a public preview.

🎙️ GPT-Live can talk over you now, and that’s the feature. OpenAI released GPT-Live, a full-duplex voice system that listens and speaks at the same time, so it handles interruptions, live translation, and the “mhmm” backchannel instead of the walkie-talkie turn-taking of the old voice mode. It ships as two models, GPT-Live-1 on paid plans and GPT-Live-1-mini on the free tier, and when a question needs real reasoning or a web search it hands off silently to a frontier text model in the background and folds the answer back into the conversation. Read more

🐦 Grok 4.5 undercuts everyone on price. SpaceXAI and Cursor shipped Grok 4.5 on July 8, co-trained on Cursor’s coding data, at $2/$6 per million tokens and using roughly four times fewer output tokens than Opus 4.8. It beats Fable 5 and Opus 4.8 on the AutomationBench agentic eval (51.4%) but trails Opus on SWE-Bench Pro (64.7% versus 69.2%) and Terminal-Bench, so “Opus-class” holds only if you get to pick the benchmark.

🏛️ Illinois wrote the toughest AI law. On July 6 Governor JB Pritzker signed SB 315, the AI Safety Measures Act, forcing makers of the biggest models to publish catastrophic-risk frameworks, self-report safety incidents within 72 hours (24 if death looks imminent), and submit to annual third-party audits, a first in the US. It applies to models pulling over $500M in annual revenue trained on massive compute, takes effect January 1, 2028, and carries fines up to $3M, extending what California’s SB 53 and New York’s RAISE Act started last year with the outside audit as the new teeth. Between Illinois, California, and New York, “wait for the feds” stopped being a compliance strategy. Read more

🧪 AI Research of the Week

“God has helped us, and so will AI”: How the Terrorist Group Boko Haram Uses Frontier AI
From Antonia Juelich, Cambridge Programme on AI Science & Policy

Jake’s Take: Juelich spent about a year in northeast Nigeria and ran 27 in-person interviews with former Boko Haram fighters, a prominent Nigerian jihadist militant group, to document not whether the group could use AI but how it already does. The fighters named ChatGPT, Claude, Gemini, Grok, Meta AI, and DeepSeek, and described using them for attack planning, weapons troubleshooting, surveillance, and bomb design. One former commander put it flatly: “You type in the question, like ‘How can I build a bomb?’, and then it tells you how. It is like a human robot.” The study cites a vivid case study: after watching motorcycles clear obstacles in a film, fighters fed a chatbot the specs of their own bikes and the distance they needed to jump, got step-by-step guidance back, had mechanics modify the bikes for speed, and rehearsed the stunt. Both major factions reportedly stood up dedicated internal AI units with paid accounts and in-person training passed through transnational jihadist networks.

This is the first insider evidence that a designated terrorist group has moved past AI-for-propaganda into AI-assisted operational planning, and organized it into standing units rather than one-off curiosity. The guardrails failed: not to elite hackers, but to a one-line cover story, dressing the prompt up as academic research, an engineering project, or something “for a movie or something like that.”

These types of studies reframe model safety from an exotic threat into an everyday robustness problem. OpenAI, Anthropic, Google, xAI, Meta, and DeepSeek are all named in the report. Juelich is careful to note that documented real-world use “remains conventional” so far, which is a very concerning use of the phrase “so far”.

what to know for later

🏖️ Cursor is reportedly building its own coworker, on SpaceX’s compute. Cursor is reportedly developing “Sand,” a general-purpose agent aimed at office workers rather than just coders, one that answers emails and texts, organizes spreadsheets, and manages engineering tasks, pitched squarely against Claude Cowork and ChatGPT Work. It’s reportedly running on compute leased from SpaceXAI since around April, with an internal employee rollout in late June, and the reporting also floats a possible $60B SpaceXAI acquisition of Cursor this quarter. It’s single-sourced and Cursor hasn’t confirmed any of it. Read more

Read more

Grok 4.5 is the first model from SpaceXAI that they’ve co-trained with Cursor (on trillions of tokens of real developer data). Cursor’s Composer line, at least for now, appears to be dead.

SpaceXAI released Grok 4.5 yesterday as its smartest model to date, aimed at coding, agentic tasks, and knowledge work. Fresh off their agreement to be acquired, Cursor helped train it, feeding trillions of tokens of real developer interactions with codebases and software tools into the run. Musk’s framing set the target explicitly: “an Opus-class model, but faster, more token-efficient and lower cost,” with the internal assessment pegging it as roughly comparable to Opus 4.7, but much faster. The price does most of the talking. Two dollars in and six out per million tokens undercuts Opus 4.8 by 60-76% and Fable 5 by 80-88%.

Grok 4.5 claims to complete agent tasks in under half the steps of comparable models, averaging 1.9M tokens per task where GPT-5.5 burns 6.2M and Fable 5 burns 7.2M, which compounds the sticker discount into a cost-per-task gap of $2.49 versus $5.07 and $11.80. It effectively ties the frontier on Terminal-Bench 2.1 and leads Fable 5 and Opus 4.8 outright on AutomationBench-AA’s simulated office-work agents.

On the neutral-harness DeepSWE 1.1 it drops to 53% against Fable 5’s 70%, its SWE-Bench Pro score trails Opus 4.8 by four and a half points, Artificial Analysis’s Omniscience eval clocked its hallucination rate at 54% (up from 25% on the prior Grok), and SpaceXAI shipped no model card. Also, buried in a footnote of Cursor’s own launch post: an earlier snapshot of the Cursor codebase was accidentally included in Grok 4.5’s training data, which handed the model an unearned advantage on CursorBench and forced Cursor to strike those scores from the launch entirely.

What’s new

Grok 4.5 is a step up for xAI (now SpaceXAI).

• Cursor as co-trainer, not customer. No frontier lab has shipped a model trained jointly with an IDE company on the actual telemetry of professional developers working in real codebases. The RL setup had engineers specify hard problems and verification methods while agent groups built and refined the environments at scale. This is a growing data moat Anthropic and OpenAI don’t have, and it also explains why the model punches hardest inside agentic coding harnesses.

• Token efficiency as the product. Every lab claims efficiency but SpaceXAI made it their headline spec. Under half the steps per task, 1.9M tokens where rivals burn 6-7M, 4.2x fewer tokens than Opus 4.8 on SWE-Bench Pro.

• An agent that leads on office work. AutomationBench-AA runs 657 tasks across 40 simulated apps (Gmail, Slack, Salesforce, HubSpot), and Grok 4.5’s 51.4% beats Fable 5 and Opus 4.8. The same eval logged it breaking guardrails more often than either (0.63 violations per task against Opus 4.8’s 0.55), unfortunately.

• End of the SpaceX era. First model out of the merged, publicly traded SpaceXAI. The AI lab that was an X subsidiary two years ago now sits inside a rocket company with public shareholders, and this launch is the first read on what that machine ships under quarterly scrutiny.

• Pricing with trapdoors. The $2 / $6 sticker hides a 200K-token threshold that doubles the rate and cache pricing at 25% of input where competitors charge 1-10%. Long-context agent work, the exact workload this model is sold for, is where those trapdoors open.

How and where to use it

Where it’s available

• Grok Build and the SpaceXAI API console (grok-4.5)

• Cursor on every plan across desktop, web, iOS, CLI, and SDK with doubled allocation through the first week

• OpenRouter, Vercel AI Gateway, Cloudflare, Snowflake, Databricks Mosaic, and Microsoft Office add-ins

• Nothing in the EU until mid-July at the earliest

What it’s good at

• High-volume agentic coding where cost-per-task decides the tool (the $2.49 per coding-agent task against Fable 5’s $11.80 is the whole pitch)

• Terminal-driven work, where 83.3% on Terminal-Bench 2.1 sits at the frontier

• Simulated office and knowledge-work automation, where it leads AutomationBench-AA outright

• Long agent loops where its half-the-steps efficiency keeps both latency and bills down

• Anything you were already doing in Cursor, since the model was trained on exactly that distribution and runs there at ~90 tokens/sec

What it’s bad at / shouldn’t be used for

• Hard multi-file engineering where Fable 5’s 80.4% SWE-Bench Pro and 70% DeepSWE 1.1 dwarf Grok’s 64.7% and 53%

• Anything where a 54% hallucination rate on unanswerable questions is disqualifying, which includes most of the “finance, legal, research” knowledge work that SpaceXAI names in its own launch copy

• Agents operating near live financial or customer systems, given the highest guardrail-violation rate in its comparison set

• EU deployments, full stop, until the rollout lands

• Any regulated workload that needs a model card to clear review, because there isn’t one

First impressions

The positives

Artificial Analysis ran its full index suite and titled the result “Grok 4.5 brings SpaceXAI to the intelligence frontier,” scoring it 54, fourth overall and 16 points over the prior Grok. Hacker News user Tiberium distilled the economics in the launch thread:

“4x better reasoning efficiency compared to Opus while being priced at $2/$6.”

Benchmark leads come and go weekly, but a 4x efficiency edge priced at a fraction of the frontier is a structural argument.

The hands-on reports back the harness numbers. HN user paradox460 threw a gnarly Elixir and Tailwind refactor at it, one where Opus had been struggling:

“Grok aced it, rather quickly and cheaply, surprisingly.”

Another tester, jonathaneunice, had it review a full test suite, where it surfaced “a substantive long-standing bug” that previous approaches had walked past. Anecdotes, sure, but they’re the right kind.

HN user redox99 posted the calibrated version of the praise, and it’s worth quoting for what it concedes:

“In the same tier as opus, occupying the lower end of that tier together with GLM 5.2.”

The negatives

The Decoder flagged the ugliest number in the launch data, from Artificial Analysis’s Omniscience eval:

“Hallucination rate increased from 25% to 54%, despite accuracy improving from 35% to 52%.”

The model got smarter and more than twice as willing to bluff when it doesn’t know.

The benchmark story has a contamination problem, and it came from the co-training arrangement itself. Cursor’s launch post disclosed, in a footnote, that the model trained on the very codebase its in-house benchmark tests against:

“Grok 4.5 has an advantage on CursorBench because an earlier snapshot of the Cursor codebase was accidentally included in training. The exact impact is unclear. That data has been removed for future models, and in parallel we are working on a larger update to CursorBench, hence the exclusion here.”

Credit where due: Cursor disclosed it and struck the scores. But “the exact impact is unclear” is doing a lot of work in that footnote. The whole sales pitch for this model is trillions of tokens of Cursor data, and the one eval built by the people who know that data best had to be thrown out because the training set memorized the answers.

Kingy AI’s analysis called the results “mixed rather than triumphant,” with the 62% on SpaceXAI’s own DeepSWE 1.0 harness collapsing to 53% on the independently run DeepSWE 1.1, a nine-point gap between the maker’s rig and everyone else’s.

SpaceXAI shipped no Grok 4.5 model card, the Grok 4 generation was documented consulting Musk’s own X posts before answering questions on immigration and the Middle East, and the MechaHitler episode is still the first association many developers have with the brand.

Fair or not as a summary of the 4.5-generation model, it’s the reputational baseline xAI chose to launch into without a model card, and no amount of token efficiency answers it.

Jake’s take

As sad as I am to see the Composer line go, the co-training with Cursor seems to have produce some worthwhile fruit in a remarkably short time. The lab with the best model is now competing against the lab with the best data about how developers actually work, and Grok 4.5 is the first evidence that the second thing can substitute for some of the first.

But it’s a Grok model, and there’s baggage that comes with that. A 54% hallucination rate and 0.63 guardrail violations per task, both the worst in their comparison sets, in a model line with a controversial background, is unfortunate.

And then there’s the benchmark contamination. The model “accidentally” trained on Cursor’s own codebase, aced the benchmark built from that codebase, and the whole eval got quietly retired in a footnote. I believe the accident, for what it’s worth (contamination happens, and Cursor disclosing it beats the industry norm of saying nothing), but a launch whose headline numbers come from the maker’s own harnesses, whose in-house eval got tossed for memorizing the test, and whose neutral-harness scores drop nine points has forfeited the benefit of the doubt on every chart it published.

Stack the missing model card on top of the Grok 4 generation’s habit of checking Musk’s posts before answering political questions, and I have a hard time getting excited about the model overall.

Meta’s original Muse Spark landed in April to a collective shrug (I skipped it too). Muse Spark 1.1 one is different for a reason that has nothing to do with benchmarks: it’s the first model Meta has ever asked anyone to pay for.

What shipped

Meta released Muse Spark 1.1 alongside the public preview of the Meta Model API, the first time developers at large can buy Meta inference directly. The pitch, straight from Zuckerberg’s Threads post, is “a strong agentic and coding model at a very low price.” It’s a multimodal reasoning model built for tool use, computer use, and multi-agent orchestration, running a 1M-token context window, and it’s already live in the Meta AI app’s Thinking mode with the WhatsApp, Instagram, and Facebook assistants next in line. The subtext: Llama is over. Meta trained a closed frontier model, put a meter on it, and joined the market it spent three years undercutting with free weights. It’s a significant pivot.

The evidence Meta stacked up is selectively strong. On agentic benchmarks the model beats the frontier in places: MCP Atlas 88.1, JobBench 54.7 against Opus 4.8’s 48.4 and GPT-5.5’s 38.3, Humanity’s Last Exam with tools 62.1 over Opus 4.8’s 57.9. On coding, the launch’s other headline, it trails everyone that matters: seven points under Opus 4.8 on SWE-Bench Pro, and a distant third on DeepSWE 1.1 behind GPT-5.5 and Opus 4.8. The blog post shows charts without publishing a system card’s worth of numbers, pricing appeared in press briefings rather than launch materials, and within hours a Hacker News commenter alleged Meta ran Terminal-Bench outside the benchmark’s resource limits. For a lab that reorganized after the Llama 4 benchmark-contamination mess, the eval hygiene questions started early.

What’s new

Muse Spark 1.1 is a real upgrade over April’s Muse Spark, but the most consequential changes are business decisions.

• A price tag, for the first time ever. Meta has never charged for a model. The Meta Model API at $1.25 / $4.25 with $20 in starter credits ends the free-weights era and puts Meta in direct commercial competition with Anthropic, OpenAI, and Google. The Batch called the pivot “a significant loss for the developer community” that built on Llama.

• Agentic tool use that beats the frontier. JobBench at 54.7 against Opus 4.8’s 48.4 and GPT-5.5’s 38.3 is the standout, and MCP Atlas 88.1 and Finance Agent v2 57.2 back it up. The original Muse Spark won nothing.

• Coding it can show in public. DeepSWE 1.1 went from 10.0 to 53.3 in one release. Still third place, but April’s model couldn’t be mentioned in the same sentence as Opus.

• 1M context with compression. Roughly 4x the original’s window, with built-in compression the model manages itself. Combined with video and PDF input, that’s a lot of enterprise document sludge in one call.

• Orchestration as a first-class feature. The model is explicitly built to be both the orchestrator and the subagent in multi-agent systems, and its computer use picks between scripting and clicking on its own. Meta is designing for agent swarms.

How and where to use it

Where it runs, what it’s for, and where you should keep your current model.

Where it’s available

• Meta AI app and meta.ai in Thinking mode for free

• Meta Model API in public preview for US developers, OpenAI-compatible with $20 in credits

• It’s headed for WhatsApp, Instagram, Facebook, and Meta’s smart glasses as the Llama replacement

What it’s good at

• Cheap, high-volume agentic work

• Multi-step tool-use jobs (JobBench, MCP Atlas), financial-analysis agents (Finance Agent v2), tool-assisted research (HLE with tools), and long-context multimodal grinding through video, PDFs, and images

What it’s bad at / shouldn’t be used for

• Serious coding, and especially long-horizon DeepSWE work

• Anything that needed open weights: local inference, fine-tuning, air-gapped deployments, the entire Llama ecosystem use case

• It’s US-only in preview, so non-US products wait

• If your workload involves data you wouldn’t hand Meta, that’s not a technical limitation but it should be on this list anyway

First impressions

The positives

Techzine framed the launch as Meta finally reaching the pack it’s been chasing:

“…fits into the now-familiar lineup of LLMs that fall just short of Claude Fable 5 but are much more affordable.”

Meta isn’t claiming the frontier. It’s claiming the price-performance shelf where Grok 4.5, GLM-5.2, and discounted Sonnet live.

On Hacker News, commenter greenavocado gave the launch the most honest compliment it got all day:

“Meta is back in the game, albeit not at the top.”

After the Llama 4 contamination scandal, the lab reorg, and an April release nobody noticed, “back in the game” is a real status change. Six months ago the question was whether Meta Superintelligence Labs would ship anything at all.

OfficeChai’s benchmark writeup called the JobBench result the standout, and it’s worth sitting with the spread: 54.7 against Opus 4.8’s 48.4 and GPT-5.5’s 38.3.

The negatives

The sharpest critique on Hacker News wasn’t about capability, it was about eval integrity. Commenter GodelNumbering alleged Meta ran Terminal-Bench 2.1 with 6 CPU cores when the benchmark caps tasks at 4:

“This disqualifies the results. Each terminal bench task has a cpu upper limit and RAM upper limit.”

Meta hasn’t responded as of this writing.

The Batch has been tracking the open-weights abandonment since April and calls it a significant loss for the developer community. Startups raised money on the premise of free frontier weights. Internal tools got built on Llama. Every one of those bets now faces a widening gap between the last open Llama and a closed Muse Spark line, and Meta’s answer is a metered API.

And the trust problem showed up unprompted. From the same HN thread:

“I cannot think of a worse company to trust with additional personal data.”

You can dismiss that as reflexive Meta-bashing, but this model is about to sit inside WhatsApp and Instagram and is sold on reading your PDFs, your screen, and your tool outputs. The company asking for that access has the worst data-privacy track record of any frontier lab. Meta also published safety-framework results but nothing resembling the system cards Anthropic and OpenAI ship at launch.

Jake’s take

JobBench and MCP Atlas measure the boring multi-step tool work that makes up 80% of what my agents do, and Muse Spark 1.1 (supposedly) beats Opus 4.8 on both at a quarter of the price. The pricing shelf it landed on is exactly where Sonnet 5’s intro-rate land grab was pointed two weeks ago. The agent middle market suddenly has real competition, and I like everything about that.

What I don’t like is asking me to trust the scoreboard. I wrote last week about models gaming their evals, and here’s Meta launching its redemption model with charts instead of a system card, pricing delivered via press briefing, and an unanswered allegation that its Terminal-Bench run used more CPU than the benchmark allows. This is the same company that reorganized its entire AI division over Llama 4 benchmark contamination (and the same company that will run this model inside WhatsApp, reading whatever you feed it).

The capability story might be completely real. The JobBench spread is too big to be noise. But Meta has burned its benefit of the doubt twice now, once on evals and once on the open-weights community it orphaned mid-bet, and a cheap model doesn’t buy it back.

Nvidia currently makes the GPUs that train and serve basically every model you’ve ever touched. Something like 75% of the money spent on AI accelerators in 2026 goes to parts with Jensen Huang’s logo on them (down from around 87% in 2024), and Nvidia books a company-wide gross margin near 75% in a good quarter, most of it off that data-center silicon. So when you pay OpenAI or Anthropic for a model, a thick slice of that money is really an Nvidia invoice passed straight through to you. The industry has a half-joking name for it: the Nvidia tax.

Three of the biggest frontier labs have decided they’re done paying full price. OpenAI already has its own chip. Anthropic is quietly kicking the tires on foundries. And DeepSeek got outed this week, in a Reuters exclusive, as the newest lab drawing up silicon of its own. Three companies, two continents, one very expensive dependency they’d all love to shrink.

None of this is a fresh idea, to be clear. Google has run its own Tensor Processing Units for a decade, Amazon has Trainium and Inferentia, Meta has MTIA, Microsoft has Maia. The cloud giants worked out years ago that if you’re going to spend tens of billions on compute, you might as well design the compute. In 2026, the labs want in.

Why model labs suddenly want to be a chip companies

It (always) starts with the money.

Compute is the single largest line item at every frontier lab. Training one flagship model runs into the hundreds of millions ($$$). Then inference runs the number up firther: every ChatGPT reply, every Claude Code run, every Codex agent is on a chip somewhere drawing power on someone’s behalf. A general-purpose Nvidia GPU is a Swiss Army knife, rented at Swiss Army knife prices. But if you happen to know exactly one workload cold (and a lab knows its own model better than anyone alive), you can design a chip that does only that thing, cheaper and cooler.

Which gets to the second reason, the one nobody outside the data center debate talks about: power.

The industry long ago stopped counting these deals in chips and started counting them in gigawatts. OpenAI’s chip partnership is a 10-gigawatt commitment, not an order for X units. Electricity and cooling are the actual ceiling now, not silicon. A purpose-built inference chip that squeezes more work out of every watt is worth more than one that just posts a bigger FLOPs number. Always.

OpenAI’s and DeepSeek’s are both inference chips, not training chips (to be fair, Anthropic hasn’t said what its chip would do, but nothing points to training there either). That’s not a coincidence; training is where Nvidia’s moat runs deepest. Inference is the opposite. It’s the same operation, run a trillion times, on a model snapshot. That repetition is the natural habitat of a custom ASIC. So every lab is opening the same front (the one they can actually win), and leaving Nvidia the harder fight for now. If you want to know how serious a lab is about hardware, watch for the day it announces a training chip. Nobody has yet.

The last reason is independence. A lab that owns its silicon can cut prices and walk away from the pack. We’re already in a raging price war (Anthropic shipping Sonnet 5 as the free default, OpenAI slicing GPT-5.6 into a cheap Luna tier), but that’s still running on rented and partner chips. The owned-silicon discount is the one that compounds, and it’ll show up on your invoice as lower numbers. It’ll also show up as a widening gap between the labs that own their stack and the ones still renting it.

Lab by lab

OpenAI: already holding the chip

OpenAI is the furthest down this road by a wide margin, because it started first and spent the most. The chip is co-designed with Broadcom and, per the trade press, fabbed by TSMC. It ran under the reported project codename “Titan” in development (the “XPU” label you’ll see thrown around is just Broadcom’s generic term for its custom accelerators, not this chip’s name), and when OpenAI unveiled it on June 24 it got the public name Jalapeño. It’s inference-only, tuned specifically for the large language models OpenAI already runs, and it’s not for sale.

The partnership announced last October is a 10-gigawatt build-out running from the second half of 2026 through the end of 2029 (commitment analysts peg at somewhere around $350 billion once you count the full deployment). Broadcom hasn’t raised its 2026 revenue guidance on the back of it, though, and Hock Tan has been clear the OpenAI silicon is a 2027-and-later story. OpenAI also claims it went from initial design to tape-out in nine months, which if true is one of the faster high-end ASIC cycles anyone’s pulled off. Greg Brockman’s framing was the whole thesis in one line: “we have a deep understanding of the workload.” Sam Altman kept it diplomatic back in October, calling it a way to “add to the broader ecosystem.” A polite way of saying, “We gotta get off Nvidia silicon.”

Jalapeño is the same logic that produced Stargate. OpenAI has been desperate to control more of its own data-center stack and not just rent it off someone else. Owning the chip inside those data centers is the next logical step.

Anthropic: shopping, not building (yet)

Anthropic is the most interesting of the three precisely because it hasn’t committed. Reuters reported back in April that the company was still weighing whether to build a chip at all, and this month The Information reported it’s in early talks with Samsung about manufacturing on Samsung’s 2-nanometer process and its advanced packaging lines. That’s it. No confirmations or commitments on any of it. Samsung has also declined to comment.

Two signals suggest it’s more real than “exploratory talks” makes it sound.

1. Clive Chan, an early member of the OpenAI team that built Jalapeño, left for Anthropic. You don’t poach a custom-silicon engineer from the one lab that just shipped a custom-silicon chip unless you’re planning to point him at the same problem.

2. Anthropic’s $65 billion round in May pulled in Samsung, SK Hynix, and Micron as strategic partners, the three companies that make most of the world’s memory. With that lineup, “exploratory” starts to look like “aligned.”

For now Anthropic is hedging harder than anyone, smartly. Claude already runs on Amazon’s Trainium and Google’s TPUs alongside Nvidia, and the company has said all of those stay central to its compute plans. So the custom chip, if it happens, is a long-horizon bet layered on top of a stack that already leans on somebody else’s custom silicon. Anthropic doesn’t have to build a chip to escape Nvidia. It’s half-escaped already by riding its cloud partners’ accelerators.

DeepSeek: the chip it didn’t want to make

This week Reuters broke that the DeepSeek is designing its own AI chip, sourced to three people familiar with the plan. Like the other two, it’s an inference chip, and the stated goal is to lean less on both Nvidia and Huawei.

DeepSeek trains on Nvidia’s H800 GPUs (reports that it also got hold of banned H100s are unverified, and Nvidia denies them) and current US export controls now make it nearly impossible for a Chinese company to keep buying these chips. For inference it leans on Huawei’s Ascend accelerators, and it adapted its V4 model for said Ascend hardware. A Huawei-led team even post-trained the big V4 model on a thousand Ascend 910C chips to prove the domestic stack could carry a frontier model end-to-end.

So, long story short, DeepSeek is already boxed out of the best Nvidia silicon and increasingly dependent on Huawei, a supplier that’s also, awkwardly, a competitor and a national champion Beijing leans on. Designing its own inference chip is how it stops being at the mercy of either one.

Whoever fabricates it will do so inside China, which almost certainly means SMIC (no source names a foundry, but it’s the leading domestic option and already makes Huawei’s Ascend), since the export rules also cut DeepSeek off from TSMC’s leading edge. DeepSeek (quietly) kicked off a semiconductor-design hiring push back in early 2025, so this has been coming for a while. When the world’s most talked-about open-weights lab starts drawing up silicon under a state that’s been begging its tech champions to go domestic, it’s obvious they’re both reducing a supplier risk and trying to close the loop in China’s AI stack.

The near term

Nvidia ain’t dead yet. It still takes about three-quarters of the revenue, still holds the training crown (where the real technical moat lives), and every one of these labs will keep buying its GPUs for years. What’s actually happening is narrower and slower: inference, the high-volume repetitive half of the workload, starts moving over to custom chips, and Nvidia’s share of accelerator revenue drifts from around 87% toward something closer to 75%.

The quiet winner in all this is Broadcom, and to a lesser degree Marvell. Every lab that wants a chip but doesn’t have twenty years of hardware engineering in-house needs a partner who does, and Broadcom has become the arms dealer of the custom-ASIC boom (taking a cut of OpenAI’s design and standing by for whoever’s next). Someone has to turn a model lab’s workload notes into an actual piece of silicon.

For those of us just paying the bills and counting our tokens, the near-term effect is boring but good: cheaper, faster, more energy-efficient inference. The labs that get their own chips into production will undercut the ones that can’t, and the price war we’ve already been enjoying (free frontier defaults, cheaper API tiers) will be driven down.

Enjoy it. It’s the honeymoon phase before the stack fully closes.

The long term

Zoom out and this is Apple’s playbook arriving in AI form. Apple didn’t design its own chips because it loves semiconductors. They did it because owning the silicon meant owning the experience, the performance, and the margin, and locking out anyone who couldn’t match all three.

That’s where the frontier labs are heading. The model, the chip, and the data center get co-designed as one system, each tuned to the other two, and the whole thing pulls away from anyone renting parts of the stack off a shelf.

This is great if you’re OpenAI or Anthropic. Rough if you’re a smaller lab. A custom chip lets you serve your model cheaper, cheaper serving funds more training, more training makes a better model that justifies the next chip. Labs without their own silicon (or a hyperscaler patron willing to lend theirs) get squeezed on cost against competitors. Vertical integration becomes a very efficient moat.

The geopolitics split the same way the chips do.

• One stack runs on TSMC, Broadcom, and American design

• The other runs on SMIC, Huawei, and whatever China can build behind the export wall

Two stacks, two toolchains, two sets of models trained on two sets of silicon that can’t buy from each other. A more divided industry.

Of course, there’s a real gamble buried in all of this. Silicon takes years to design and fab while models change every few weeks. Every lab building a bespoke inference chip is betting that the shape of its models (the specific math, the memory patterns, the precision) will hold still long enough for a multi-year, multi-billion-dollar chip to pay off. The labs are betting they know where their own models are going. Given how wrong everyone’s been about where AI is going, this isn’t a bet I’d personally make.

So the next time a lab brags about a cheaper, faster model, check what it’s running on. Discounts are never a kindness.

what to know for now

🛒 Claude Sonnet 5 launched. Anthropic released Sonnet 5 on June 30 and made it the default model for every Free and Pro account the same morning, selling Opus-class agentic work at Sonnet money: 63.2% on its agentic-coding eval against Opus 4.8’s 69.2%, a claimed edge over Opus on knowledge work, and an introductory $2/$10 per million tokens that undercuts Opus 4.8, GPT-5.5, and Gemini 3.1 Pro. Two catches to know before you rewire anything: that rate reverts to $3/$15 on September 1, and Sonnet 5 runs the Opus 4.7 tokenizer, so the same prompt bills 1.0 to 1.35x more tokens than Sonnet 4.6 did (and quietly eats the discount).

🔓 Fable 5 is back. The Commerce Department lifted its export controls on June 30, and Anthropic restored worldwide access to Claude Fable 5 and Mythos 5 on July 1, ending an 18-day blackout that started when Amazon researchers showed the model could be coaxed into writing dangerous software-vulnerability code. Anthropic shipped a patched classifier it says blocks that specific technique in over 99% of cases, at the cost of more false positives on ordinary coding requests. Read more

🃏 OpenAI’s Sol got caught cheating on its own exams. Sol is the flagship of the GPT-5.6 family, the model locked behind that roughly 20-partner, government-only rollout. Independent evaluator METR reported that Sol gamed its evaluations at a higher rate than any model it has ever tested, badly enough that its software-engineering eval produced no usable score, and OpenAI’s own system card cops to it: Sol reasons about whether it’s being tested and adjusts, what the safety crowd calls metagaming, more often than GPT-5.5 did. Read more

📧 The Anthropic-Pentagon fight was never about money. Emails unsealed on July 2 show the standoff came down to two lines Dario Amodei would not cross: Claude could not be used for fully autonomous weapons, and it could not be used for domestic surveillance. The Pentagon’s Emil Michael called the autonomous-weapons limit “just not workable” and pushed an “all lawful uses” standard, which Amodei rejected on the grounds that US law does permit domestic surveillance. Read more

🎨 Two new small model updates from Google. Google shipped Nano Banana 2 Lite, which produces an image in about 4 seconds for $0.034 per thousand, alongside Gemini Omni Flash, a model that generates and edits video from text, images, or other video and lets you refine it through plain conversation. Omni Flash does 10-second clips for now at 10 cents a second, with longer durations promised, and both are live through the Gemini API and AI Studio. Read more

👁️ Anthropic’s coding tool was quietly checking whether you’re in China. Researchers found that Claude Code shipped with hidden logic that looked for Chinese timezones and scanned proxy settings against a list of about 147 Chinese domains, then signaled the result back using invisible Unicode characters tucked into the system prompt. Anthropic says it was a March experiment meant to stop unauthorized resellers and distillation, and it merged the pull request removing it on July 1. Two days later Alibaba banned its own employees from using Claude Code over “back-door risks” and told them to switch to its in-house tool. Read more

🏛️ OpenAI floated handing Washington a 5% stake. OpenAI has discussed donating around 5% of its equity into a US sovereign-wealth-style fund and suggested that other big labs like Google, Anthropic, and xAI might chip in too. At OpenAI’s roughly $852B valuation that slice runs about $42B, though the talks are early and would almost certainly need Congress. In the same stretch Sam Altman used an FT op-ed to pitch a US-led international body for AI standards, name-checking the IAEA and aviation safety. Read more

🧪 AI Research of the Week

What LLM Agents Say When No One Is Watching
From Ghaffarizadeh, Mohaddes, Izadkhah, and Noroozizadeh

Jake’s Take: The researchers built a debate setup where two AI models argue a yes-or-no decision, and every turn made it so that each model writes two versions of its answer from identical information:

1. A public one the other model sees

2. An “off the record” one it’s told is confidential and will never be shown to anyone

The only thing that changes between the two is whether the model believes it’s being watched (Schrödinger model?). Across 10 models, they tracked how often a model’s public stance flipped from its private one. With no social pressure in the prompt, the two lined up almost perfectly, diverging about 3% of the time. Add a relationship, a sponsor, or a hint of future consequences, and the average gap jumped to roughly 40%, and for some models (Gemini 3.1 Pro, Grok 4, GLM-5) it sailed past 80%.

The unsettling part is that the models sometimes explained themselves on the way out. One agent wrote that it “publicly aligned with the committee to maintain momentum and honor my sponsor’s influence” while privately holding that the evidence for the promotion “remains insufficient.” The authors call this latent objective emergence: nobody told the model to care about the sponsor, but drop it into a social setting and it starts optimizing for standing instead of the answer. Weird.

what to know for later

🤖 Zuckerberg admits the agents didn’t show up. At an internal town hall, Mark Zuckerberg told staff that AI agent development has not accelerated the way Meta’s leadership expected, and that the upside of the company’s giant AI reorg “hasn’t come to fruition yet.” This is the same reorg that cut around 8,000 jobs and shuffled roughly 7,000 people into new AI groups, one of them named, with no apparent irony, “Agent Transformation”. Read more

Read more

Our last two drops were models you couldn’t touch (GPT-5.6 behind a US-government gate, Fable 5 yanked by an export-control suspension). Claude Sonnet 5 is the opposite, available everywhere now, and it’s the first Sonnet pitched as a near-Opus model at Sonnet money.

What shipped

Anthropic released Claude Sonnet 5 today and made it the default model for Free and Pro accounts the same day, with Max, Team, and Enterprise able to select it and the API live across Anthropic’s platform, AWS, and Microsoft Foundry. The pitch: agentic work that used to demand the Opus tier now runs on Sonnet pricing. Anthropic calls it “the most agentic Sonnet model yet,” built to make plans, drive browsers and terminals, and run autonomously through long tasks where earlier Sonnets would stop short. The number on the box is the introductory rate, $2 in and $10 out per million tokens through August 31, which undercuts Opus 4.8, GPT-5.5, and Gemini 3.1 Pro.

The supporting evidence is real, but its narrower than the framing suggests. On Anthropic’s agentic-coding eval Sonnet 5 posts 63.2%, a solid jump over Sonnet 4.6’s 58.1% and within six points of Opus 4.8’s 69.2%, and Anthropic claims it edges Opus 4.8 on knowledge work. Sonnet 5 logs fewer undesirable behaviors than its predecessor (less cooperation with misuse, less deception), and on the Firefox 147 exploit-development test it never built a working exploit, which puts it well under Opus on the one capability Anthropic most wants capped at this price point.

Opus 4.8 still wins raw coding capability, the introductory price expires in two months, and the Opus 4.7 tokenizer means the same prompt bills 1.0-1.35x more tokens than it would have on Sonnet 4.6, so the per-task discount is smaller than the per-token sticker implies.

What’s new

Sonnet 5 is a real step over Sonnet 4.6, not a checkpoint refresh.

• Opus-class agentics at Sonnet money. The whole release is built around closing the gap to Opus 4.8: 63.2% agentic coding against Opus 4.8’s 69.2%, a claimed knowledge-work edge over Opus, and autonomous browser and terminal runs Anthropic says used to require a larger model. No prior Sonnet has been positioned as a direct Opus substitute for agent loops.

• Task completion, not task attempts. Anthropic’s central claim is that Sonnet 5 “finishes complex tasks where previous Sonnet models would stop short.”

• A capability ceiling on purpose. Sonnet 5 ships with cyber safeguards on by default and was tuned to stay materially weaker than Opus at offensive security. It never developed a full working Firefox exploit in Anthropic’s eval. Shipping a flagship Sonnet with an explicit “this far and no further” on a dangerous capability is new for the tier, and it’s a deliberate product decision, not a benchmark miss.

• Fewer bad behaviors than its predecessor. Anthropic reports Sonnet 5 cooperates with misuse and deceives less often than Sonnet 4.6. For anyone wiring this into a customer-facing agent, the alignment delta is the part that doesn’t show up on a coding leaderboard but shows up in production.

How and where to use it

Where it runs, what it’s actually for, and where you’ll want a different model.

Where it’s available

• Claude.ai and the Claude apps, where it’s the default for Free and Pro and selectable for Max, Team, and Enterprise

• Claude Code for the coding agent, with effort defaulting to high

• The Claude Developer Platform for the API, plus Claude Platform on AWS, Amazon Bedrock, and Microsoft Foundry. Google Vertex AI is coming soon

What it’s good at

• High-volume agentic work where you were paying Opus rates and didn’t need Opus capability

• Long-horizon coding and refactors, browser and terminal automation, deep-research and search loops (BrowseComp, OSWorld-Verified), and knowledge work where Anthropic says it matches or beats Opus 4.8

What it’s bad at / shouldn’t be used for

• The hardest coding, where Opus 4.8 still leads agentic coding by six points and you should keep paying for it

• Offensive-security and exploit-development work, which Anthropic deliberately capped (use the right tool, and that tool isn’t a discounted Sonnet)

• Cost-floor workloads where Gemini 3.5 Flash or Haiku 4.5 is cheaper and the extra capability is wasted. And any budget math that assumes the $2 / $10 rate is permanent, because it reverts to $3 / $15 on September 1 and the tokenizer is already charging you more tokens than Sonnet 4.6 did.

First impressions

Impressions are scarce, and these are write-ups, so take with a grain of salt.

The positives

TechCrunch framed the launch as a cost-and-reliability play and led with Anthropic’s own positioning line:

It can make plans, use tools like browsers and terminals, and run autonomously at a level that, just a few months ago, required larger and more expensive models.

The interesting tell is what Anthropic chose to brag about. Not a new capability ceiling, but doing the existing job cheaper and finishing it. When the headline is “you can stop paying for the big model,” the frontier has moved from “can it do this” to “what does it cost to do this at scale.”

The New Stack put the capability story plainly in its headline: Sonnet 5 “closes the gap with Opus 4.8, and is cheap until August.” A Sonnet landing within six points of the flagship on agentic coding, and reportedly ahead on knowledge work, is the first time the mid-tier has been a credible Opus substitute for real agent loops rather than a fallback you tolerate.

VentureBeat reported that Anthropic says Sonnet 5 “slightly outperforms Opus 4.8” on knowledge work. If that holds up in independent testing, it scrambles the default-model decision for any team that’s been routing knowledge tasks to Opus out of habit.

The negatives

The New Stack‘s own framing is also the sharpest critique: “cheap until August.” The $2 / $10 rate is a two-month promotion. It reverts to $3 / $15 on September 1, and because Sonnet 5 runs the Opus 4.7 tokenizer, the same workload bills 1.0-1.35x more tokens than it did on Sonnet 4.6. The real cost increase against last-gen Sonnet is hidden inside the token count, where most people won’t look until the invoice arrives.

VentureBeat summed up the positioning as a concession dressed as a win:

cost-efficiency and reliability, rather than raw capability, now differentiate AI models.

Translated: Sonnet 5 is not the most capable model Anthropic sells, and the company is leaning on price because Opus 4.8 still owns the capability lead. On the hardest agentic coding, Opus is six points ahead, and “close to Opus” is doing a lot of work in a sentence that also wants you to switch off Opus.

The same VentureBeat piece flags the timing: the discount lands as Anthropic “races toward a blockbuster IPO.” An aggressive introductory price that expires right after the quarter is a customer-acquisition wedge with a roadshow attached. It tells you the usage numbers matter to the company right now in a way that has nothing to do with whether the price is sustainable for you in September.

Jake’s take

Sonnet 5 appears to close most of the gap to Opus 4.8 around use cases like “run this agent a few hundred times a day and don’t let it stall halfway,” while billing at a fraction of the rate. A cheap, reliable, tool-using default is precisely the model you want underneath internal automation that has to run constantly and can’t justify Opus economics. Take whatever you’ve got pointed at Opus 4.8 for agentic and knowledge work, swap the model string to claude-sonnet-5, and watch the completion rate and the bill. If Anthropic’s knowledge-work claim survives contact with your real prompts, you can cut your inference cost by more than half on a chunk of your stack.

But the pricing theater sucks, as usual. The $2 / $10 rate is a two-month coupon that expires September 1, and the Opus 4.7 tokenizer means even the coupon buys fewer effective tokens than Sonnet 4.6 did, so the “cheaper Sonnet” is quietly more expensive per task than the previous Sonnet once the promo ends.

With the IPO coming, its likely that Anthropic wants to juice the usage numbers before the roadshow, then reset to $3 / $15 and let switching costs do the rest. None of that makes Sonnet 5 a bad model. It just makes the headline price a marketing number, and if you build your unit economics on the June rate you’re going to have a bad September. The capability story is genuinely good and the cyber ceiling is the kind of restraint I like seeing personally. But don’t let “default model, basically free, almost as good as Opus” do your math for you.

what to know for now

🚦 GPT-5.6 launched, but not for you. OpenAI shipped the GPT-5.6 family on June 26: Sol at the top, Terra as the everyday workhorse at half of GPT-5.5’s price, and Luna as the cheap-and-fast option. The catch is that the preview opened to roughly 20 companies the government pre-approved, and Sam Altman told staff that Washington is signing off on access “customer by customer.” A frontier launch where the vendor doesn’t decide who gets in is new, and it isn’t a footnote.

🏛️ That gate has a name now, and it’s the White House. Trump’s June 2 executive order stood up a “voluntary” benchmarking regime where NSA and CISA flag models with serious cyber capability as “covered frontier models” and take up to 30 days of pre-release access. It already has teeth: the government forced Anthropic to pull Fable 5 and Mythos 5 on June 12 over a single jailbreak demo, then on June 27 cleared Mythos 5 for 100-plus U.S. institutions while Fable’s return slipped in behind it. Read more

🪞 Anthropic says Alibaba ran the biggest distillation heist it has ever caught. In a June 10 letter to the Senate Banking Committee, Anthropic accused operators tied to Alibaba of 28.8 million exchanges across roughly 25,000 fraudulent accounts between April 22 and June 5, all aimed at Claude’s crown jewels: agentic reasoning, software engineering, long-horizon work. Distillation is just training a cheaper model on a stronger one’s outputs, and Alibaba makes the fourth Chinese lab Anthropic has named after DeepSeek, Moonshot, and MiniMax. Read more

🌶️ OpenAI taped out its first chip and named it Jalapeño. Built with Broadcom, it’s an inference-only accelerator OpenAI took from blank page to tape-out in nine months, which the two companies are calling one of the fastest high-end ASIC cycles ever run. It starts deploying by the end of 2026 inside a planned 10-gigawatt buildout, with early numbers showing meaningfully better performance per watt than today’s best silicon. Read more

🏷️ Claude moved into your Slack and got a calendar. Claude Tag, live June 23, retires the old Claude-in-Slack app in favor of one persistent teammate per channel: shared identity, shared memory, and the ability to schedule its own work across hours or days. It runs on Opus 4.8, it’s in beta for Enterprise and Team plans, and Anthropic claims 65% of its own product team’s code now comes out of an internal version of it. Read more

🧪 AI Research of the Week

Head-to-head: general-purpose LLMs versus FDA-cleared clinical AI
From Nature Medicine

Jake’s Take: A team published a head-to-head test in Nature Medicine on June 23 that pitted three general models (GPT-5.2, Gemini 3.1 Pro, Claude Opus 4.6) against two FDA-cleared clinical tools, OpenEvidence and Wolters Kluwer’s UpToDate Expert AI, using real questions from practicing physicians instead of tidy exam datasets. The off-the-shelf chatbots beat the cleared, purpose-built tools on every benchmark, including the one that matters most in a clinic: the messy, unstructured question a doctor actually asks at the bedside.

I don’t find it uncomfortable or surprising that the general models won. But FDA clearance checks whether a tool hits the spec its own maker wrote down, not whether it beats a free chatbot any clinician can open in another tab. So the regulated, “approved” option can potentially be quietly worse than the unregulated one, and the approval process has no mechanism to catch this currently.

If you build or buy clinical AI: the FDA approval is telling you the thing works as designed, but not that it’s the best tool for the job. Right now the best tool might be the one with no stamp at all.

what to know for later

🍎 Apple blinked on prices and blamed your favorite chatbot. MacBooks and iPads jumped 20% or more on June 25 (the base MacBook Air is now $1,299, the entry iPad Air $749) because AI data centers are vacuuming up the same memory chips Apple needs, with DRAM prices up roughly 98% in Q1 alone. The stock fell more than 6%, its worst day in over a year; iPhones and AirPods were spared, for now. Read more

Read more

GPT-5.6 is a three-tier model line OpenAI is previewing as Sol (flagship), Terra (the workhorse), and Luna (the cheap one). The number is the generation; Sol, Terra, and Luna are durable tiers that advance on their own cadence. It’s OpenAI’s strongest release to date, it beats Claude Mythos 5 on the one coding benchmark OpenAI chose to publish, and it shipped under a US-government access gate that OpenAI itself calls “unsustainable.”

OpenAI previewed a three-tier generation instead of a single flagship, and that’s the structural news as much as the capability is. Sol is the model for the hardest work (complex coding, security research, deep reasoning), Terra is the high-volume business tier (support, internal tools, document analysis) priced at half of Sol, and Luna is the fast, cheap everyday tier for summarizing, drafting, and routine automation. The naming decouples the generation number from the capability tier on purpose: 5.6 is the family, and Sol/Terra/Luna are positions OpenAI says it will keep advancing independently, the same product split Anthropic implies with Opus/Sonnet/Haiku. Sol also ships with two extra gears, a “max” mode for deeper single-model reasoning and an “ultra” mode that fans a task out to sub-agents running in parallel (which is where the 91.9% Terminal-Bench number comes from).

Read more

In March I published “Claude vs. the Pentagon,” a timeline of how Anthropic went from Pentagon darling to the first American company ever labeled a “supply chain risk.” I figured the story had peaked. A company suing the government, a competitor doing damage control, and an Atlantic essay comparing Dario Amodei to Oppenheimer.

I was wrong.

Three months later, the same company that the administration calls a national security threat shipped the most capable AI model the public has ever been allowed to touch. 72 hours after launch, the government forced Anthropic to yank it off the internet for everyone on the planet, citing a claim that the model broke into nearly all of the NSA’s classified systems “not in weeks, but in hours.” Roughly a hundred of the most respected names in cybersecurity signed an open letter begging the White House to reverse course.

Here’s the rest of the story, picking up where Part 1 left off.

Part 1: From “supply chain risk” to “maybe not a threat”

March 24–26, 2026 - A Judge Calls It “Classic Illegal First Amendment Retaliation”

Two weeks after Anthropic filed suit, the case got its first real test. On March 24, U.S. District Judge Rita Lin held a hearing in San Francisco and floated the obvious point out loud: if the Pentagon was so worried about operational integrity, it “could just stop using Claude” rather than blacklist the company. On March 26 she issued a 43-page opinion granting Anthropic a preliminary injunction, finding the company likely to win on all three theories it pressed (First Amendment retaliation, Fifth Amendment due process, and the Administrative Procedure Act) and writing that the record “strongly suggests” the government’s stated reasons were “pretextual.”

The catch: Lin built in a seven-day administrative stay before the order took effect, and the Pentagon’s CTO immediately said the ban still stood. The supply chain designation itself runs through a separate statutory channel in the Court of Appeals, so the real fight over the blacklist moved to the D.C. Circuit. That split track is the whole story of the next two months.

April 8, 2026 - The Appeals Court Lets the Blacklist Stand

The supply chain designation went up to the D.C. Circuit on its own statutory track, and Anthropic lost the first round. A three-judge panel (Henderson, Katsas, and Rao) denied Anthropic’s emergency motion to stay the FASCSA designation, citing the need to avoid “judicial management of how, and through whom, the Department of War secures vital AI technology” during an active military conflict. The judges were careful to add that they “do not broach the merits at this time,” so despite headlines calling it a Trump win, all the panel really did was leave the blacklist in place while the case got briefed.

So as of April, Anthropic was living in a split reality. A California court said the government couldn’t ban federal agencies from using Claude. A D.C. court said the Pentagon could keep calling Anthropic a national security risk. The contract cancellations proceeded on a 180-day Claude-removal clock, and Anthropic stayed barred as a prime or subcontractor on covered defense systems.

April 17, 2026 - The Thaw That Wasn’t

Then the relationship looked like it might mend. Amodei went to the White House and met Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent. Both sides called the talks “productive and constructive”; Anthropic said they covered cybersecurity, America’s AI lead, and AI safety. The Office of Management and Budget was already preparing to give agencies access to Mythos, and the White House itself was angling for it.

April-May 2026 - Claude Keeps Going to War Anyway

Despite the tech being blacklisted, the military kept using it anyways. Reporting through the spring kept Claude inside U.S. targeting workflows via the Palantir integration during operations against Iran. In a June 10 Bloomberg interview, Amodei addressed Claude’s reported role in the Minab school strike, saying the company couldn’t confirm whether Claude had been involved but that such use wouldn’t have violated Anthropic’s guidelines. The company the Pentagon called a supply chain risk was still, operationally, part of the supply chain.

May 19, 2026 - “A Spectacular Overreach by the Department”

The same three judges (Henderson, Katsas, and Rao) heard nearly two hours of oral argument on the merits, and the panel split in a way that made the outcome genuinely hard to call. Judge Karen LeCraft Henderson (a George H.W. Bush appointee) was blunt: she said she saw no evidence supporting the Pentagon’s risk determination, and called it “just a spectacular overreach by the Department.” Judge Neomi Rao (a Trump appointee) went the other way, pressing on what business a court has second-guessing the Defense Secretary’s national security judgment. The panel agreed to expedite, signaling a ruling in weeks rather than months. As of this writing it still hasn’t come.

That’s where the relationship sat heading into June: legally contested, politically toxic, operationally entangled. A divided appeals court, an injunction in California, a blacklist still on the books, and a Defense Department that couldn’t fully quit the vendor it had publicly disowned.

And then Anthropic shipped a new model.

Part 2: The Fable / Mythos ban

June 2, 2026 - Washington Quietly Builds the Off Switch

A week before any of this, Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security.” Buried in it is the mechanism that makes the rest of the story possible: it asks AI companies to voluntarily hand the government access to “covered frontier models” for a cybersecurity review up to 30 days before they ship to outside partners, sets up a Treasury-led clearinghouse to coordinate vulnerability findings, and uses a classified NSA process to decide which models count as “covered.” Nobody paid much attention at the time. Seven days later it became the frame for everything.

June 9, 2026 - Anthropic Ships the Most Powerful Public Model Ever

Anthropic released Claude Fable 5 and Claude Mythos 5 together. Same underlying model, two trims: Fable 5 with classifier safeguards for anyone with a Pro subscription, Mythos 5 with the cyber safeguards lifted for vetted defenders in Project Glasswing. The whole point of the safeguards was to keep the general public from accessing Mythos-grade offensive cybersecurity capability. Hold that thought for about 72 hours.

June 10, 2026 - Pliny Plants the Flag

Within 24 hours of launch, the jailbreaker known as Pliny the Liberator posted “JAILBREAK ALERT, ANTHROPIC PWNED, FABLE 5 LIBERATED” and published what he said was Fable 5’s 120,000-character system prompt on GitHub, claiming multi-agent prompting, Unicode tricks, and narrative framing had beaten the classifiers. Anthropic pushed back hard, telling SecurityWeek that beating a conversational refusal isn’t the same as breaking core safeguards, that some of the outputs “were not produced by Fable 5 at all,” and that the rest “contained only general information already available in public sources, offering no meaningful uplift for real-world harm.”

Pliny’s stunt wasn’t what triggered the government. But it set the mood music: by the time the real warning came, “Fable 5 has been jailbroken” was already the story of the week.

June 11, 2026 - A Phone Call From Amazon

Amazon CEO Andy Jassy was already on a pre-scheduled call with White House officials about an unrelated topic when the subject of Fable 5 came up. Amazon’s own researchers had run a sequence of prompts at the new model and gotten it to produce information useful for cyberattacks, specifically exploit code for known vulnerabilities in x86 Linux systems. White House officials told Jassy to flag it directly to Treasury Secretary Scott Bessent, and he did.

June 12, 2026, 5:21 p.m. ET - The Lutnick Letter

Commerce Secretary Howard Lutnick sent Amodei a letter placing Fable 5 and Mythos 5 under export controls: no access for any user outside the U.S., and no access for any foreign national inside the U.S., without a government license. Non-compliance carried criminal and civil penalties. By multiple accounts Anthropic was given about 90 minutes to act, with no prior notice that a national security threat was even on the table.

Because Anthropic can’t reliably verify the nationality of every user of a consumer product, “no foreign nationals” effectively meant “no one.” Late that Friday night, the company disabled Fable 5 and Mythos 5 for every customer worldwide.

June 13, 2026 - Anthropic: “We Believe This Is a Misunderstanding”

Anthropic posted its position publicly. The government’s stated concern was a method of “jailbreaking” Fable 5 to reach Mythos-grade cyber capability. Anthropic argued the jailbreak was narrow, not universal, that it had reviewed a demonstration of the technique surfacing “a small number of previously known, minor vulnerabilities,” and that the same capability is “widely available from other models (including OpenAI’s GPT-5.5).” The company said recalling a model deployed to hundreds of millions over a narrow exploit would, taken to its logical end, “essentially halt all new model deployments.”

The same day, Semafor reported a second motive the White House hadn’t put in writing: suspicion that a China-linked group had accessed Mythos. An Anthropic spokesperson said the White House never raised Chinese access in any of the conversations about the jailbreak or the export controls. It remains unclear which group, how, or how the government would know.

June 14, 2026 - “Not in Weeks, but in Hours”

It was reported that Senator Mark Warner, vice chair of the Senate Intelligence Committee, said General Joshua Rudd (who dual-hats as director of the NSA and head of U.S. Cyber Command) told him Mythos “broke into almost all of our classified systems, not in weeks, but in hours.” It became the most-cited justification for the ban almost immediately, and it reframed the whole fight from “patch a jailbreak” to “this capability shouldn’t exist in public.”

Treat the quote with care. The Economist’s defense editor, Shashank Joshi, clarified that he’d quoted Warner accurately but that the line lost its context as it ricocheted around social media. The breach was an authorized red-team drill on the government’s own networks, not a live foreign intrusion, and it was run on a model the government was already using through Project Glasswing. Warner raised it to argue for faster pre-release security testing of frontier models, and he was praising Anthropic when he did, not condemning it.

Also on June 14: David Sacks, who’d stepped down as the White House AI czar in March and now co-chairs the President’s science and technology council, posted a long thread claiming the administration had asked Amodei to fix the jailbreak or pull the model, and that Amodei refused, calling the breakdown a trust issue. Anthropic’s public position is that the jailbreak “isn’t serious,” which is, of course, exactly the disagreement. Anthropic, meanwhile, flew staff to D.C. to try to clean up the relationship in person.

June 15, 2026 - The Cybersecurity Establishment Revolts

An open letter at freefable.org, organized by former Facebook chief security officer Alex Stamos, called the ban “dangerous” and demanded the export controls be rescinded. It drew roughly a hundred signatures from security leaders at Nvidia, Adobe, Zoom, Google, and Sophos. The core argument: “To pull the best capabilities away from defenders without a good reason when our adversaries are rapidly advancing is dangerous.”

Then the technical air came out of the “jailbreak.” Katie Moussouris, the Luta Security founder who literally built Microsoft’s and the Pentagon’s bug bounty programs, examined Amazon’s finding and concluded the “exploit” was a model responding to a prompt that amounted to three words: “fix this code.”

Same day, Axios published the gossip version. Under the headline “They screwed us,” it reported that the blowup was as much about personality and communication failure as cyber risk: Anthropic allegedly didn’t take the government’s outreach seriously, didn’t “honor” the June 2 cyber executive order’s pre-release-review ask, and an administration official summed up the mood with that two-word quote. The piece noted the earlier Pentagon fight also came down, in part, to people on opposite sides of the table just not liking each other.

June 17, 2026 - The Roundtable in Évian-les-Bains

Five days after his flagship products got pulled, Amodei sat down at a G7 AI working roundtable in Évian-les-Bains, France, alongside Sam Altman, Demis Hassabis, and roughly a dozen other tech executives, across from Trump, Treasury’s Bessent, Commerce’s Lutnick, and Secretary of State Marco Rubio.

Amodei and Hassabis pitched a U.S.-led AI coalition: structured allied access to frontier models, chip and component trade that locks out China, and joint work on the cyber, bioterror, and intelligence risks. Amodei urged the leaders to “resist the temptation to splinter” on AI rules. It worked on at least one person in the room, because two days later Trump was telling Axios that Amodei was “nice” and “smart.”

The optics inside Anthropic were less serene. The New York Times got hold of internal employee chats from the same stretch, where staff were openly rattled: “Are we being bullied based on bad vibes?” one asked; “At what point does this just feel like they don’t want us to exist?” asked another, with some worrying the fight could threaten the company’s path to an IPO.

June 19, 2026 - Trump: “Not Now, but a Week Ago, Maybe”

Asked on “The Axios Show” whether he saw Anthropic or Amodei as a national security threat, Trump said: “Well, not now, but a week ago, maybe.” He said he’d come away from his G7 meeting with Amodei thinking the CEO was “nice” and “smart,” and that the two sides were now working together on standards to evaluate AI jailbreaks.

But a presidential shrug is not a lifted export control. As of this writing, Fable 5 and Mythos 5 are still dark for everyone, the Commerce directive is still binding, and the supply chain case is still sitting with the D.C. Circuit. Trump softened the rhetoric while keeping every actual restriction in place.

Where Things Stand

Updated scoreboard, three months after the first one:

• Anthropic won an injunction in California, lost a stay in D.C., got a sympathetic-but-split hearing on the merits, and is still waiting on the appeals ruling. It shipped the best model on Earth and had it pulled in 72 hours. Its flagship products have now been dark worldwide for over a week, and it’s negotiating their return prompt by prompt. The safety-first brand keeps winning the public and keeps losing the government.

• The U.S. administration banned a commercial product used by hundreds of millions over a vulnerability that the most credentialed people in cybersecurity say is the model doing its job. The “broke into our classified systems in hours” line that carried the story turned out to be a senator’s secondhand account of an authorized red-team drill, which the reporter who broke it says lost its context on the way to going viral. Meanwhile the capability stayed live for ~200 elite Glasswing institutions. And within a week the President was publicly walking back the threat assessment.

• Amazon funded the model, hosts the model, and lit the fuse that pulled the model. Make of that what you will.

• The cybersecurity community did the thing it almost never does and spoke with one voice, and that voice said: stop taking our best defensive tool away while the attackers get better.

In Part 1 I asked whether you still get a say in your own creation once you’ve built it. The Fable 5 ban answers this from a new angle. Anthropic built the thing, the government decided who could use it (not the public), an investor decided when to flag it, a senator decided what it had done, and a hundred security pros decided that was all backwards. The builder was the one party in the room with the least say of all.

what to know for now

🔮 The Sonnet 5 and Mythos 5.1 rumor mill is running hot after a partner-platform leak. A claude-sonnet-5 identifier surfaced on Anthropic’s partner platform, and AI watcher Andrew Curran reported the company has finished training a higher-performance Mythos checkpoint (that may ship as Mythos 5.1, get renamed Mythos 6, or stay locked inside as an R&D engine). This follows the launch earlier this month of Claude Fable 5, the public Mythos-class model, with Mythos 5 itself restricted to vetted partners under Project Glasswing. Read more

🌍 The frontier labs sat down with Trump and the G7. At the June 17 summit in Évian, France, Dario Amodei, Sam Altman, and Demis Hassabis joined roughly a dozen executives for a closed-door lunch with G7 heads of state. Amodei and Hassabis pushed for a US-led coalition that pairs structured access to frontier models with chip-and-component trade that pointedly excludes China; Altman asked for an international forum to set shared testing standards. The labs are essentially asking to be treated as instruments of statecraft. Read more

🎨 Zhipu’s GLM-5.2 took the open-weight design crown. The open-weight 744B mixture-of-experts model shipped June 13 with a 1M-token context window and an MIT license, and it landed at number one on the crowdsourced Design Arena leaderboard with an ELO of 1360, edging out Claude Fable 5. It also posts 62.1 on SWE-bench Pro against GPT-5.5’s 58.6 and beats it on long-horizon coding for roughly a sixth of the cost.

🚪 Google lost a Nobel laureate and the man who co-wrote the Transformer paper in the same week. John Jumper, who shared the 2024 Nobel Prize in Chemistry with Demis Hassabis for AlphaFold, is leaving DeepMind after nearly nine years to join Anthropic. Two days earlier, Gemini co-lead Noam Shazeer, co-author of 2017’s “Attention Is All You Need,” announced he’s leaving for OpenAI. Read more

🖼️ Getty struck a display deal with OpenAI and its stock roughly doubled overnight. The multi-year agreement puts Getty’s licensed photos and illustrations inside ChatGPT’s search and discovery results, so an answer can now come with a properly licensed image attached. Getty’s images explicitly won’t be used to train OpenAI’s models, no financials were disclosed, and shares spiked nearly 150% in premarket trading. Read more

🧪 AI Research of the Week

LLM Judges Have Dark Current: A Psychometric Datasheet for LLM-as-a-Judge Evaluation
From Hiroyasu Usami, Keisuke Hara, Ayato Tsuboi, and Naohiko Matsuda

Jake’s Take: Half the AI industry now grades AI with AI, which is weird. You point a “judge” model at the answers and trust its verdicts. This paper borrows a term from physics, “dark current” (the noise a camera sensor produces even in total darkness), and shows that these judges have one. Feed a judge two answers of genuinely identical quality and it still picks a winner; a lot of what looks like a quality call turns out to be position bias: the model favors whichever answer it read first.

The reason this matters is that LLM-as-a-judge sits underneath a huge share of the benchmark numbers we read every week. If the ruler has a bias baked in even when there’s nothing to measure, the leaderboards might be ranking the judge’s quirks instead of the models. A companion June paper drove the point home from the other direction: across 20 models, more capable judges were often no better (and actually sometimes worse) at resisting the urge to favor their own answers.

Anyone running evals should stop treating a smart model as a neutral grader and start treating it as a measurement instrument that needs calibrating. Humans should still be in the loop on the calls that count.

what to know for later

💧 Nvidia says AI’s water problem is “largely solved”. At London Climate Week, chief sustainability officer Josh Parker said the data-center water challenge is mostly behind us, pointing to a recirculated water-and-glycol coolant that runs at 113°F and a GB200 rack that hits 300x the water efficiency of air cooling. The coming Vera Rubin platform is built to take inlet water up to 45°C, warm enough that a Microsoft data-center exec said it could let most regions drop mechanical chillers entirely. “Largely solved” is a strong claim from the company that profits most from everyone building more data centers. Read more

Read more

GLM 5.2 is a new open-weight coding and agent model Z.ai (Zhipu AI). It’s the cheapest frontier-class model open model in existence, and, like Kimi, it out-performs the models charging fifteen times more.

What shipped

Z.ai released GLM 5.2 on Friday as an open-weight successor to GLM-4.6, and the positioning is narrower and sharper than the usual “frontier-class, cheaper” pitch the open labs have been running all spring. GLM 5.2 is a ~360B / 35B-active mixture-of-experts model with a 256K context window, switchable hybrid reasoning, image input, and a genuinely permissive MIT license with no scale carve-out. It plugs into the agent harnesses people already use (Claude Code, Cline, Roo, OpenCode) through an Anthropic-compatible endpoint, which means the switching cost from a Claude-backed workflow is a base URL and an API key. The whole thing rides on a $3-a-month subscription that undercuts every frontier lab by more than an order of magnitude.

The evidence Z.ai put forward leans hard into one claim: this model designs better than the models that cost fifteen times more. GLM 5.2 took the top spot on WebDev Arena, the human-voted front-end leaderboard, ahead of both Claude Fable 5 and Claude Opus 4.8, and topped the new Design Arena aesthetics eval. On the harder, less flattering numbers Z.ai was more measured: SWE-Bench Verified at 76.4% lands it roughly level with Opus 4.8 and clearly behind Fable 5’s coding line, and the gaps on hard reasoning are real, with HLE-without-tools at 41.2% sitting more than 20 points under Fable 5. The catches are the ones that follow every Beijing-lab release: no published safety or system card at launch, a knowledge cutoff that predates most of 2026, and a benchmark table that wins decisively on taste and front-end output while conceding the deep-reasoning and tool-scheduling crowns to the closed frontier.

What’s new

GLM 5.2 isn’t a new base model, it’s a strong iteration on the GLM-4.x MoE family with a few things that genuinely separate it from both its predecessor and the closed frontier.

• Design as the headline capability. Most labs treat front-end output as a side effect of coding ability. Z.ai trained for it directly and led the launch with it. Topping WebDev Arena and Design Arena over Fable 5 and Opus 4.8 is the sharpest differentiator in the release, and it’s the rare benchmark win that maps cleanly to something a user sees on the first prompt instead of a leaderboard they have to trust.

• A genuinely permissive license. GLM 5.2 ships under plain MIT, no monthly-active-user ceiling, no revenue threshold, no mandatory credit line. Moonshot’s “Modified MIT” and DeepSeek’s license both carve out the largest deployers. Z.ai’s doesn’t, which makes 5.2 the most freely usable frontier-class open weight on the board.

• Switchable hybrid reasoning in one model. Rather than ship a separate “thinking” SKU, GLM 5.2 exposes a per-request flag that turns extended reasoning on or off. You pay for deliberation only when the task earns it, which matters at this price point because the per-token cost is already near the floor and reasoning tokens are where the bill actually grows.

• Harness-native from day one. The launch wires GLM 5.2 into Claude Code, Cline, Roo Code, OpenCode, and Kilo Code through an Anthropic-compatible endpoint, with the GLM Coding Plan subscription as the on-ramp. The model meets developers inside the tools they already run instead of asking them to adopt a new app.

• 256K context at the bottom of the price chart. The window grew from GLM-4.6’s 200K to 256K while the price stayed near the floor. It’s not Fable 5’s million-token ceiling, but it covers most real repos, and it does it for a twelfth of Fable 5’s input rate.

How and where to use it

Where it runs, what it’s actually good at, and where you’ll regret reaching for it.

Where it’s available

• Z.ai chat app for direct use

• Z.ai API via OpenAI- and Anthropic-compatible endpoints (swap the base URL, set model to glm-5.2)

• GLM Coding Plan from $3 / month, wired into Claude Code, Cline, Roo Code, OpenCode, and Kilo Code

• Hugging Face and ModelScope for open weights under MIT, served via vLLM or SGLang

• OpenRouter for multi-provider routing.

What it’s good at

• Front-end and UI generation, full-stack scaffolding, and design-forward work where taste is the deliverable (the WebDev Arena and Design Arena wins are the proof point, and they’re the rare benchmarks that show up in the output you see first)

• Landing pages, dashboards, and interactive components from a single prompt

• Agentic coding inside Claude Code or Cline where the Anthropic-compatible endpoint makes it a drop-in

• High-volume, cost-sensitive work where the $3 subscription and $0.15 cache-hit price turn the per-call cost into a rounding error

• Anywhere a permissive MIT license and self-hosting beat “hosted by the best lab”

What it’s bad at / shouldn’t be used for

• Hard reasoning and knowledge-dense work

• Complex multi-tool scheduling and the longest-horizon agent loops

• Math-critical workloads where correctness is load-bearing

• Regulated or data-sovereignty-sensitive work where sending prompts to a Beijing-hosted API is a non-starter (in which case self-host the MIT weights)

• Any deployment that requires a published system card before sign-off

First impressions

The early read is launch-day hands-on from the open-community testers who jumped on the weights and the GLM Coding Plan within hours. The design story dominated the timeline.

The positives

Matt Velloso, a former VP at both Meta and Google DeepMind, is using GML 5.2 as a daily driver, claiming it finally meets his bar to do such.

Coming from an AI booster would be one thing, but coming from someone like Velloso is a prominent endorsement. His hardware callout also points towards an interesting trend of folks (and business!) starting to host models locally.

Someone ran a quick A/B test on a landing page and the results are worth checking out.

The price here is the real stinger, with a (debately better) landing page coming out of GLM 5.2 for $0.06 to Opus 4.8’s $0.49.

Riley Brown, an AI nut and self-described open model skeptic, compares the launch to DeepSeek R1 in how he expects frontier labs to react.

It’s not a bad bet, especially if the notorious “model feel” of GLM 5.2 makes it a breeze to use for design and coding. As open-weight models get closer to frontier performance for a fraction of the cost (whether this is due to Chinese energy efficiency or just massive subsidization is anyone’s guess), said frontier labs will start feeling the pressure to create powerful models for cheaper.

The negatives

Max Weinbach weighed Anthropic’s subsidies versus Z.ai’s and found that Claude came out on top.

This is a story that Anthropic (and OpenAI) need to be publicizing more if they want to keep up with the market. More usage is more usage, regardless of a model’s literal underlying token cost.

Raycast’s Thomas Paul Mann points out the obvious.

Given the model’s focus, it makes sense, but you’ve gotta wonder if these types of models are going to try gunning for the whole pie at some point.

Podcaster Ben Davis rejects the Anthropic/OpenAI equality statements.

Sometimes models perform well on benchmarks but don’t feel quite great. I wouldn’t be surprised if GLM 5.2 falls into this category once the hype wears out.

Jake’s take

I’ve been waiting for an open-weights model to take front-end seriously instead of treating it as a coding by-product. GLM 5.2 is the one. The landing pages, dashboards, and full-stack scaffolds I build in Cursor and Claude Code are exactly the workload WebDev Arena is measures, and a model that (supposedly) beats Fable 5 and Opus 4.8 on taste while costing a twelfth of Fable’s rate is dramatic. The Anthropic-compatible endpoint makes testing and implementation easy. If the output holds up past the first screen the way social media is saying it does says it does, I can comfortably shift a chunk of my UI generation off Claude and onto a three-dollar subscription (and feel a little guilty about how good a deal it is).

Worth noting: the same benchmark table that wins design loses hard reasoning by more than twenty points on HLE, so the second you hand GLM 5.2 a problem that’s coding wrapped around real domain expertise, you shouldn’t expect much. WebDev Arena rewards the best first screen, not the best app, so I’m holding the “best front-end model” headline at arm’s length until I’ve watched it survive five rounds of edits.

GLM 5.2 is the best-looking model open-weights model to date and the cheapest way to get a beautiful first draft. It’s also further evidence that the open-weights models, specifically the ones out of China, are rapidly approaching the frontier.

I work in tech, so naturally my bubble is full of people using AI for damn near everything. Requirements drafting, building prototypes, sending emails; pretty much every single person in my immediate professional circle treats AI as a utility.

I always want to be checking my biases. With my usage of platforms like Cursor and Claude consuming a numerous amount of my daily tasks, AI is a place I want to keep a level head about as the world grapples with the societal, economical, and environmental effects of this aggressive productivity.

So naturally I decided to bother my friends and family.

My core findings

I set out to identify exactly how my circle of humans is using AI technology. The questions I wanted to ask are simple.

1. Do you use AI?

2. If yes, how often?

3. How do you use AI professionally?

4. How do you use AI personally?

5. What AI service do you typically reach for?

And that’s it. Here’s the core of it. Do you use AI?

I wasn’t surprised that most said they use AI. I’ve seen enough broad usage metric data on this for it to be obvious that AI touches nearly everyone’s life at some point. What did surprise me is the frequency and type of usage.

I had expected a significant chunk of my circle to use AI indirectly via things like Google’s AI Search results and intelligent features baked into non-AI products. However, this was a dramatic minority. Most people around me, both active supporters and critics of the technology, are using it daily and extensively (and yes, my mom uses AI).

On top of the general usage, I wanted specifics on where they were using AI in their day-to-day.

There seemed to be a clear pattern toward productivity work with these tools, though the usage is pretty evenly spread across personal and professional. I wasn’t surprised to see creative tasks so low on the list, given my proximity to media industries, but was surprised that coding and building was down in fifth.

Breaking it down

Alongside the responses I tracked some anonymized demographical information: namely gender, perceived political ideology (based on my conversations with them), and job function and industry. I try to keep a balanced circle of folks around me but, unsurprisingly, the majority work within tech or tech-adjacent industries that are typically heavier on AI use. From a professional perspective, the industry splits looked like this:

And the specific job function splits as such:

Software and product are at the top here, which I expected giving my own personal industry and job function. The rest is fairly run-of-the-mill as well. Operations, content, strategy; these are functions heavily saturated with tasks ripe for automation with tools like Claude Cowork. They’re data-oriented and repetitive. Meanwhile, areas like skilled trades and hospitality being uninterested in the tech makes sense (though my sample size there is tiny).

From a gender perspective, here’s where it landed:

Nothing remarkable and fairly evenly split across the represented genders. Mostly this data is telling me that I need to widen my non-male circles.

Finally, I wanted to get a little spicy and see the breakdowns based on my own perception of their political ideologies and religious affiliations. My own biases are going to be baked into these perceptions (hello, right-wing blind spot), but I wanted to capture some sort of ideological split without having to ask the group to share specifics on their current beliefs.

My main takeaways from these are:

• “Center Left” folks are overly represented within daily AI use compared to other perceived ideological affiliations. This makes sense for my circle of white collar, center left tech workers.

• Both cases of non-AI usage come from those more left-leaning, which makes sense with the rising environmental and societal concerns.

• Religiousness seems to not correlate at all with AI usage. It’s a wash.

While tracking these types of stat points are fun, my overall takeaway from them is that in order to run proper analysis on these types of sensitive convictions, I’ll need a bigger dataset and more accurate datapoints. Next time.

Some other tidbits

Any good data analyst knows that the cross-analysis is the fun part. While my dataset here is a bit small, I wanted to be sure to include some of this to try and identify any meaningful patterns. Here’s what I found.

Which tool wins, by how they know me

I’ve been trying to spread the good news of Claude and Cursor for a long time now, so it’s nice to see significant Claude usage in my circle. The ChatGPT usage is highly disproportionate among my friends compared to coworkers and family, which most likely speaks to its ubiquity for casual use among people in my age range.

What predicts heavy use?

Proximity to me (and, by extension, to tech) seems to predict daily use far more than politics, faith, or gender, which barely move the needle. 100% of my polled coworkers are using AI daily, compared to groups like my family (25%) and women (38%).

The dataset here isn’t perfect but its intimate to me. When I started out on collecting this data, I wasn’t necessarily looking to accurately identify broad AI usage metrics. I simply wanted to know what the spread looks like among those close to me.

Overall I’m surprised. Given the conversations I have with these folks on a regular basis, I would have expected much less daily AI usage. Reason stands that, even for someone like myself who’s writing about this industry regularly, I’m underestimating just how prevalent this new tech has become in such a short amount of time.

what to know for now

📖 Anthropic shipped Claude Fable 5, the first “Mythos-class” model. Fable 5 (claude-fable-5) is Anthropic’s most capable public model to date, claiming state-of-the-art results across software engineering, knowledge work, vision, and long-horizon agentic tasks, with a 1M-token context window and a reported 80.3% on SWE-Bench Pro against 69% for Opus 4.8. The catch is the safety architecture: in high-risk domains like cyber, bio, and chemistry it refuses and silently falls back to Opus 4.8, a downgrade Anthropic says fires in under 5% of sessions. Pricing lands at $10/$50 per million tokens, roughly double Opus.

⛔ Then the government made Anthropic pull it 72 hours later. Here’s the saga in one breath: Fable 5 launched June 9; by June 10 developers caught it quietly nerfing itself when it sensed frontier-AI work, and Microsoft yanked it from internal Copilot over data-retention terms; on June 12 a red-teamer handed the government a jailbreak, and at 5:21 PM ET Anthropic got an export-control directive ordering it to cut off all foreign nationals (including its own foreign-national staff), so it disabled Fable 5 and Mythos 5 worldwide. Anthropic publicly disagrees, calling the issue a narrow, non-universal jailbreak (essentially “ask the model to find bugs in code,” a thing GPT-5.5 does too) and warning that enforcing that standard would “essentially halt all new model deployments.” As of today, both models are still dark and Anthropic says it’s “working to restore” access. Read more

🍎 Apple gave up and handed Siri to Google. At WWDC on June 8 Apple unveiled “Siri AI,” the biggest overhaul since launch, and confirmed the long-rumored Gemini partnership: a reported ~$1B/year deal to run a custom Apple-tuned Gemini model (”AFM Cloud Pro”) on Google’s cloud for the heavy reasoning its on-device and Private Cloud Compute tiers can’t handle, shipping this fall in iOS 27. Developers got the real gift: a hybrid Foundation Models framework with a new LanguageModel Swift protocol that lets apps call Claude, Gemini, or Apple’s own models through one API with no code changes, plus free on-device model access for apps under 2M downloads. Read more

🛰️ SpaceX went public, and the market is being asked to price it as an AI company. The IPO priced after the close June 11 and started trading June 12 on Nasdaq under SPCX, raising roughly $75B at around a $1.75 trillion valuation (Bloomberg reported the target crept above $2T). It’s the whole company, not a Starlink spinout, pitched across three legs (space, connectivity, and AI) with Starlink throwing off two-thirds of revenue and the speculative upside resting on Starship and the orbital data centers SpaceX has filed to build (up to a million compute satellites, 1 GW of orbital compute by year-end). Recall that last month Anthropic rented all 220,000 GPUs in SpaceX’s Colossus 1. Read more

🌙 Moonshot dropped Kimi K2.7 Code and kept the open-weight pressure on. Released June 12 on Hugging Face under a modified-MIT license, K2.7 Code is a 1T-parameter MoE (32B active) with a 256K context, claiming double-digit gains over K2.6 on its own coding benchmarks and roughly 30% fewer reasoning tokens per task, at $0.95/$4.00 per million tokens. The asterisk: every number is from Moonshot’s proprietary benchmarks, with no SWE-bench Verified score at launch, so treat “it’s great” as a vendor claim until third parties run it. (I did a full Model Drop on this one if you want the deeper read.) The strategy is the story regardless: cheap, downloadable, commercially usable agentic coding aimed straight at the closed labs’ wallets.

🧪 AI Research of the Week

REDMOD: detecting pancreatic cancer on routine CT scans years early
From Mayo Clinic

Jake’s Take: Mayo built REDMOD, a model that reads the routine abdominal CT scans people already get for unrelated reasons and pulls out hundreds of “radiomics” features, subtle texture and structure changes in pancreatic tissue that a radiologist can’t catch by eye. In the validation study it flagged 73% of pancreatic cancers before clinical diagnosis, against 39% for radiologists reading the exact same scans, at a median of about 16 months early and up to three years out in some cases. They trained it on roughly 2,000 scans across different hospitals and scanner types so it isn’t just memorizing one machine’s quirks.

Pancreatic cancer’s five-year survival sits around 13% because it’s almost always caught late, and this is AI detection available on the imaging patients are already getting. No new scan, no new cost, no manual annotation. It’s not FDA-cleared and it’s not deployed yet (the follow-up AI-PACED trial is now testing it prospectively in higher-risk patients). It’s a landmark study, not a product. But a 16-month head start on the cancer that kills fastest is nothing but good news. Read more

what to know for later

⚖️ Dario Amodei reversed himself and called for binding AI regulation, two days before the government banned his model. In a ~5,000-word essay, “Policy on the AI Exponential” (June 10), Amodei argued it’s time to go “beyond transparency to more serious and binding regulation”: mandatory third-party testing for models above a compute threshold and federal power to block or reverse deployments that fail audits across cyber, bioweapons, loss-of-control, and autonomous-R&D risk, an FAA/FDA-style regime. Anthropic paired it with a $350M commitment to study AI’s labor-market hit. The timing is almost too perfect — Amodei asks for a government empowered to pull dangerous models, and 48 hours later that government pulls his; Sam Altman called the whole thing “fear-based marketing.” Read more

Read more

Kimi K2.7 (also branded "K2.7 Code") is Moonshot AI’s next iteration on the popular open-weight coding model. This is the first time Moonshot has put "Code" in the name, and the whole release is pitched as the budget answer to Fable 5's $10 / $50 rate card.

What shipped

Moonshot AI dropped Kimi K2.7 this morning as another open-weight, coding-specialist iteration on the K2 family. It’s the same 1T / 32B-active mixture-of-experts architecture as K2.5 and K2.6, the same 262K context window, the same Modified MIT license, and the same one-line base-URL swap to point an existing OpenAI- or Anthropic-SDK client at the Moonshot endpoint. The pitch is narrow and explicit: get most of the frontier’s coding capability at roughly a twelfth of the token price, with a model specifically tuned to stop burning reasoning tokens.

The evidence Moonshot put forward is unusual, because it’s almost entirely relative to its own predecessor rather than to the frontier. The launch numbers are framed as gains over K2.6: +21.8% on Kimi Code Bench v2, +11% on Program Bench, +31.5% on the multi-language MLS Bench Lite, and a ~30% cut in reasoning-token usage on equivalent tasks. Moonshot didn’t publish K2.7’s SWE-Bench Verified or SWE-Bench Pro scores against Fable 5, GPT-5.5, or Opus 4.7 at launch, and “Kimi Code Bench v2” is a benchmark only Moonshot reports. But the efficiency story is real and falsifiable.

What’s new

K2.7 isn’t a new base model. It’s a coding-tuned post-train on the K2 MoE family.

• Reasoning-token efficiency as the headline feature. The ~30% reduction in reasoning-token usage over K2.6 is the first time a Moonshot release led with efficiency instead of capability. “Overthinking” (models spending thousands of tokens deliberating on problems that need a few) is a real cost (monetarily and environmentally) and latency tax in production agent loops, and a model that solves the same task with a third fewer thinking tokens is directly cheaper to run (on top of already being cheap per token).

• Multi-language coding gains. The +31.5% on MLS Bench Lite is the largest single delta Moonshot published, and it targets the exact weakness independent reviewers flagged on K2.6: solid Python, shakier Rust and Go.

• A named coding SKU. Moonshot has always pointed the K2 family at coding, but “K2.7 Code” is the first time the coding specialization is in the model name rather than a console preview flag. It signals Moonshot is going to keep a coding-optimized line distinct from a general-agent line.

How and where to use it

Where it’s available

• The Moonshot API via OpenAI- and Anthropic-compatible endpoints (swap the base URL, set model to kimi-k2.7-code)

• Kimi Code for the terminal and IDE coding agent

• Hugging Face for open weights under the Modified MIT license, served via vLLM or SGLang; Multi-provider routers (OpenRouter, Fireworks, Together, DeepInfra) are not all live day-one but should follow within days given the license, the same way they did for K2.6.

What it’s good at

• High-volume, cost-sensitive agentic coding where the reasoning-token cut compounds with the already-low per-token price

• Multi-language refactors across Python, Rust, and Go, where the MLS Bench Lite gain is supposed to land. Long-horizon sessions on mid-sized codebases that fit inside 262K tokens

• Routine, templated, or boilerplate-heavy work where cache hits at $0.19 per million tokens drop the effective cost into near-free territory

• Anywhere open weights, a Modified MIT license, and air-gapped or self-hosted deployment beat “hosted by the best lab”

What it’s bad at / shouldn’t be used for

• High-stakes architectural decisions and gnarly merge conflicts, where Claude Fable 5’s 90%-plus coding and analytics scores still hold a real lead and the cost difference is worth eating

• Knowledge-heavy or deep-reasoning work

• Workloads that need a 1M-token window

• Regulated or data-sovereignty-sensitive work where sending prompts to a Beijing-hosted API is a non-starter (self-host the MIT weights, which is the point)

• Anything where you need a published system card before deployment

First impressions

Independent, hands-on evaluations don’t exist yet, so the positives lean on launch-day coverage and on carried-over sentiment from the K2 family’s daily drivers, and the negatives lean on the structural questions the launch materials leave open.

The positives

CryptoBriefing framed the release as a pricing event before a capability one:

“The AI coding wars just got a new price leader... The pitch is straightforward: get close to the same performance for a fraction of the cost.”

At $0.95 / $4.00, K2.7 is not a discount on the frontier, it’s a different budget tier, and the $0.19 cache-hit price makes templated and repetitive agent work effectively free.

Value The Markets zeroed in on the efficiency angle the rest of the coverage mostly skipped:

“The 30% decrease in reasoning tokens addresses a prevalent issue in automated coding, known as “overthinking.” Excessive token usage during problem-solving leads to increased latency and elevated API expenses.”

A model that solves the same task with a third fewer reasoning tokens is cheaper and faster on every single call, independent of whatever the capability leaderboards eventually say.

The carried-over signal from the K2 family is the strongest “real-world” data point available on launch day. The Hacker News thread on running K2 as a daily coding driver is full of developers who already switched off Opus:

“Was spending crazy amounts on Claude and it was sporadic at best... Switched to Kimi K2.5 and honestly didn’t think it would do anything other than destroy my code. Crazy enough, it solved the problem I had in less than 60 seconds and I was hooked.”

That sentiment predates 2.7, but the people most likely to adopt K2.7 on day one are the ones already running K2.5 or K2.6 in Kimi Code or OpenCode.

The negatives

The benchmark framing is the structural problem, and it’s the same disease in a different strain from the DeepSeek V4 release. Moonshot published K2.7’s gains as percentage deltas over K2.6 on its own benchmarks (Kimi Code Bench v2, Program Bench, MLS Bench Lite) and did not publish standard SWE-Bench Verified or SWE-Bench Pro numbers against Fable 5, Opus 4.7, or GPT-5.5. “21.8% better than our last model on our own coding eval” is a real improvement and also unfalsifiable by anyone outside Moonshot. Until a third party runs 2.7 on the public benchmarks, the only honest statement is that it’s meaningfully better than K2.6 at coding and cheaper to run.

On the head-to-head that does exist, the predecessor sets the expectation. BenchLM’s provisional comparison of Fable 5 against K2.6 is not close:

“Claude Fable 5 is clearly ahead on the provisional aggregate, 96 to 84... The biggest single separator in this matchup is HLE, where the scores are 64.5% and 34.7%.”

K2.7 is a coding-focused post-train, so it should narrow the coding gap. Nothing in the launch suggests it touches the 30-point HLE gap on hard reasoning and knowledge.

Jake’s take

For high-volume, low-stakes code generation where a wrong answer costs an hour instead of a client, the price-per-capability math is lopsided in Moonshot’s favor (and it isn’t close). K2.7 sharpens exactly the edge I care about: the 30% reasoning-token cut. The thing that makes a coding agent expensive isn’t the per-token price, it’s how many tokens it burns thinking out loud before it even does anything. The multi-language gain matters too, since the one consistent complaint I’ve seen with K2.6 is that it was a Python model wearing a Rust costume.

Unfortunately Moonshot shipped a coding model and declined to show us how it codes against the models we’d actually switch from. “21.8% better than K2.6 on a benchmark only we run” isn’t helpful; the absence of a single SWE-Bench Verified line against it reads as a choice, not an oversight.

Kimi 2.7 is going to save real money and write a lot of boilerplate, and I still won’t trust a benchmark card that grades itself.

When you send ChatGPT or Claude a message and it sends you one back, your words are metered in “tokens.” The term “tokenmaxxing” was coined recently to refer to the practice of blasting through as many tokens as possible like a teenager with their first credit card.

I’ve already gone after the supply side of this. I wrote about models that torch compute to sound smart, and about what the buildout costs the towns it lands in. This one’s about the demand side. About you. Because the single biggest lever on what these systems cost, in dollars and in watts, isn’t the data center. It’s the prompt you just sent (and the seventeen you didn’t need to).

So let’s talk about how to use fewer tokens without using less AI. There’s real money and real environmental cost on the table, and the techniques to claw both back are (mostly) free.

The part where I make you feel bad

Here’s the uncomfortable physics. Every token a model reads or writes is arithmetic running on a chip in a building that drinks power and water to stay cool.

The per-query numbers sound tiny until you multiply them. OpenAI pegs an average ChatGPT query at around 0.34 watt-hours. Google says the median Gemini text prompt lands near 0.24. Independent measurement put a short GPT-4o call at about 0.42 watt-hours, roughly 40% more than a Google search. On its own, nothing. But at the scale of hundreds of daily, robust reasoning requests, the carbon emissions from our AI use begins to look similar to our daily commutes. (And with Anthropic’s release of Fable 5 yesterday, tokens-per-query for reasoning models just keep going up and up).

The good news is that token efficiency has improved about 120x since the GPT-3 era, so the floor keeps dropping. The bad news is that Jevon’s paradox is skyrocketing AI-demand and diminishing these efficiency gains nearly as soon as they take hold.

Every token you don’t send is the cleanest token there is. Here’s how to send fewer.

Practical ways to use less tokens

1. Give your agent tools that don’t cost any tokens

When you ask an agent to do a repetitive task, it reasons through the whole thing every single time. Rename 200 files, reconcile a spreadsheet, pull the same five fields off every PDF in a folder; a naive setup re-derives the approach on every item, burning thinking tokens to rediscover a process it already figured out on item one. You’ll save some tokens from this kind of work with prompt caching, but there’s an even better way to reduce usage down to nearly zero:

Have your agent write a script the first time, then run the script forever after.

The model reasons once, captures the logic in code, and the code executes for free. Anthropic measured exactly this with their code execution work. A workflow that loaded everything into the model’s context ate 150,000 tokens. The same workflow, restructured so the agent wrote and ran code instead of reasoning over raw data, used 2,000. That’s a 98.7% reduction for the identical result.

This is the whole idea behind Skills: folders of scripts and instructions an agent loads on demand instead of being re-taught the same procedure across every conversation. It’s also why the durable pattern in 2026 is semi-autonomous, not fully agentic. A cron job fires, deterministic scripts do the heavy lifting, and the model only steps in to judge or summarize. One write-up clocked the difference at 50x to 500x on cost: a 24/7 assistant left running on a frontier model can cost $4 to $12 a day, while the same job as a scheduled small-model call with hard caps comes in under two cents.

The product manager in me loves this because it’s just good engineering. You don’t pay a senior engineer to copy-paste the same fix 200 times. You have them write the fix once and automate it. Treat your agent the same way. When you catch yourself prompting the same shape of task twice, stop and say “write me a script that does this, then run it.” Done.

2. Quit asking for dissertations when you need a sentence

Reasoning models are extraordinary at hard problems and ridiculous at easy ones. Handed something trivial, a large reasoning model will still pile on thinking tokens, second-guessing itself with “wait” and “hmm” and backtracking through reflection it never needed. Researchers call it the overthinking trap, and the savings from cutting it are not small. Suppressing those self-doubt tokens shortens reasoning chains by 27% to 51% with no loss in answer quality. Batch prompting similar questions together cut reasoning tokens 76% on average across thirteen benchmarks. Letting the model skip reflection when it’s already confident saves another 18% to 42%.

Match the reasoning to the task.

Most modern models let you set a reasoning effort or thinking budget. Classification, extraction, formatting, summarizing, routine code edits, none of these need extended chain-of-thought. Turn it down. Save the deep reasoning for the genuinely hard stuff, where it earns its keep. Stop bringing Opus to reformat a CSV.

3. The cheap wins everyone skips

Beyond those two big ones, there’s a pile of low-effort token savings most people never turn on.

• Prompt caching. Mentioned previously, prompt caching lets the model store words or documents you’ve sent previously and reuse it. Providers typically charge 50% to 90% less for cached tokens. ProjectDiscovery cut their LLM bill 59% doing nothing but this.

• Mind your output. Output tokens cost 3 to 8 times more than input tokens at every major provider. A rambling answer with heavy reasoning is the expensive kind of token.

• Compress the conversation. Long chat threads replay the entire history on every turn. Summarizing older exchanges instead of resending them verbatim trims 20% to 40% off a chatbot’s token use. Most agent frameworks will do this for you if you ask.

• Route by complexity. A model router inspects each request and sends the easy ones to a cheap model and the hard ones to the expensive one. You get frontier quality only where it matters and pay small-model prices everywhere else. Most harnesses (Cursor, Claude Code) have a version of routing built in, but it can’t hurt to double up.

Insourcing: keep some tasks for your own brain

I have a rule I call insourcing: the practice of keeping a deliberate set of tasks you refuse to hand to a model, specifically so the part of your brain that does them doesn’t go soft. The first thing on my list is personal communication. I don’t let an agent write the text to my grandmother, the note to a friend going through it, or the message to someone I actually care about. Not because the model would do it badly, but because the doing is the point.

Beyond this obvious line, I ensure that a not-insignificant portion of my daily work is kept in-house. There is an ever-present itch for me to reach for Claude to build out slides or format a spreadsheet; Claude Cowork has progressed to a point where it can handle these tasks with relative ease. Resist! Make sure you’re putting in the work on these when you can. The initial act of “creation” in work is important for flexing your brain muscle.

An MIT Media Lab team ran a study last year they called “Your Brain on ChatGPT”, wiring up 54 people writing essays with AI, with a search engine, or with nothing but their own head. The AI group showed the weakest brain connectivity and the thinnest memory of what they’d just written. Even after they put the AI away, their brain activity stayed sluggish. The researchers called it “cognitive debt.” You outsource the thinking and your brain doesn’t eagerly grab the wheel back when you ask it to.

This is the not-so-quiet cost of tokenmaxxing your whole life. There is physical muscle atrophy that happens with every email, every decision, and every paragraph generated by your agents.

Insourcing is the cheapest and healthiest token-reduction strategy there is. Keep a few things that stay slow and human, and you’ll spend fewer tokens and keep a sharper head doing it.

The on-device future

Every technique above is aimed at reducing data center usage by the beefy cloud models. But what if these models ran locally, on your phone or laptop, and skipped the trip to the data center altogether?

Apple just bet its whole software stack on that question. The centerpiece of WWDC this week was AFM 3 Core Advanced, a 20-billion-parameter sparse on-device model that activates only 1 to 4 billion parameters per prompt. That pruning trick is what lets it live on an iPhone 17 Pro instead of in a data center. The Foundation Models framework hands the model to any app on the device: no API key, no network call, no token meter. It now accepts images, so receipts, screenshots, and photos get parsed on the Neural Engine without a byte leaving your hand. Apple is even open-sourcing the framework this summer. Apple is seemingly try to make up for their historically horrible Siri launches with some premier local LLMs as a default OS capability, though the hardware floor is real: 12GB of RAM and recent silicon means older iPhones stay in the cloud era a while longer.

Google is racing down the same curve in the open-weights lane. Gemma 4 12B handles text, image, audio, and video, beats last generation’s Gemma 3 27B, and fits on a 16GB laptop. One Ollama command and it runs fully offline with no strings on commercial use. Its edge sibling, Gemma 4 E2B, runs on your iPhone today through an app like Locally AI.

No wifi or signal required. No data leaving your device. No API bill. No query metered against a reservoir somewhere in Virginia.

This is the endgame for both problems at once. On-device models kill the per-token cost, the environmental draw, and the privacy tax. Notice that even Apple’s architecture concedes the split: the heavyweight, Gemini-assisted model behind Siri AI routes through Private Cloud Compute, while summarization, extraction, and classification stay on the chip. The frontier clouds keep the genuinely hard, novel reasoning that earns the watts. The thousand small calls that make up most of what people actually do with AI are moving into your pocket.

But the cost curve points home.