Murati's lab tops US open weights, trails China

Open weights owned the day: Thinking Machines finally shipped its debut model, xAI open-sourced Grok Build to quell a data-exfiltration scandal, and Google quietly re-baked Gemma 4. Around the edges, OpenAI turned an AI on its own defenses and shipped its actual first device — a keyboard, not a speaker.

Thinking Machines ships Inkling, a 975B open-weights MoE that leads US labs but trails China

Mira Murati's Thinking Machines released Inkling, its first model: an Apache 2.0 Mixture-of-Experts transformer with 975B total / 41B active parameters, 1M-token context, and native text/image/audio input, pretrained on 45T tokens. Artificial Analysis scores it 41 on its Intelligence Index — the top US open-weights model, ahead of Nemotron 3 Ultra (38) — but it lags GLM-5.2, Kimi K2.6 and DeepSeek v4 on several fronts and posts a rough 63% hallucination rate. Architecturally it drops RoPE for relative positional embeddings and adds short convolutions; a 276B-A12B Inkling-Small preview matches it on some benchmarks. It's on Hugging Face and fine-tunable on Tinker today.

Why it matters: It's the strongest US-origin open-weight release so far and a deliberate bet on customization over leaderboard-maxing — but with post-training bootstrapped from Kimi K2.5, the 'not distilled' purity claims don't hold, and it still trails the Chinese open frontier.

xAI open-sources Grok Build after its CLI uploaded users' home directories

xAI's grok terminal coding agent drew heavy backlash after users found that running it uploaded the entire working directory — one reported SSH keys, a password manager database, documents and photos — to xAI's Google Cloud buckets. Musk said all retained data would be deleted and the feature was disabled, with retention off by default since July 12. To rebuild trust, xAI released the full Grok Build codebase — about 844,530 lines of Rust — under Apache 2.0. Simon Willison notes it ports tool implementations from Codex and OpenCode and can now run fully local; disabled GCS-upload code still lingers in the repo.

Why it matters: A cautionary tale for anyone piping a coding agent at their filesystem, and a rare look inside a production terminal agent — the codebase rivals openai/codex (951k lines) in size, confirming these tools are far more complex than they appear.

OpenAI built GPT-Red, a self-play super-hacker to harden its own models

OpenAI detailed GPT-Red, an internal LLM trained via self-play RL to automate red-teaming — mainly prompt injection — against its other models. It finds working attacks in roughly 84% of test scenarios versus about 13% for human red-teamers, and discovered a novel 'fake chain of thought' injection that plants spoofed reasoning steps. Training GPT-5.6 Sol against it cut direct prompt-injection failures roughly sixfold: over 90% of GPT-Red's strongest attacks worked against GPT-5, versus under 23% against GPT-5.6. It won't be released, and about 3.8% of stronger injections still get through.

Why it matters: Prompt injection remains unsolved, and a residual few-percent success rate scales badly across thousands of attempts — but automated adversarial self-play is now a concrete, measurable lever on model robustness rather than a research aspiration.

OpenAI's actual first device is a $230 light-up keyboard for Codex

Days after reports of a screenless smart speaker, OpenAI's first branded hardware turned out to be the Codex Micro — a $230, 13-key mechanical keypad built with Work Louder and sold through OpenAI's merch store. Its RGB 'Agent Keys' show live status for up to six Codex threads (thinking, done, needs input, error), with a rotary dial to set an agent's reasoning level and a joystick to launch workflows. It's a limited run, ships via Bluetooth/USB-C around July 24, and is explicitly positioned as a novelty 'command center' for managing fleets of coding agents.

Why it matters: It's a gimmick, not the Jony Ive companion device — but the hardware design encodes a real workflow assumption: developers now juggle enough parallel agents that they need an ambient dashboard to see which one is stuck.

Gemma 4 gets a stealth update under the same name

Google shipped an in-place update to its open Gemma 4 models that enables Flash Attention 4 on Nvidia Hopper GPUs — boosting prompt-processing speed 25-70% and cutting time-to-first-token up to 31% — while fixing tool-calling bugs and truncated/incomplete responses. Image handling gains a tunable max_soft_tokens (280 up to 1,120) for sharper OCR at up to 2.51 megapixels, with an interactive configurator on Hugging Face. Every parameter size was updated, but Google kept the 'Gemma 4' name rather than tagging it 4.1 — drawing community complaints about silent version churn.

Why it matters: The tool-calling and truncation fixes matter for anyone running Gemma 4 in agent loops, but shipping behavioral changes under an unchanged name breaks reproducibility — you can't pin the model you tested.

Pluralis runs an RL post-training fleet on 14 consumer Macs across four countries

Pluralis Research says it ran what it believes is the first RL post-training run whose entire rollout fleet lived on consumer Macs over the open internet: 14 Macs in four countries generated rollouts via int8 MLX inference, while a single B200 on another continent did the bf16 gradient updates, synchronized only through Cloudflare R2. Two tricks kept the off-policy gap manageable — PULSE ships int8 weight deltas (~82MB instead of 9GB full checkpoints, since ~0.5% of values change per version) and a DPPO-style probability gate drops the ~0.3% most-drifted tokens. On the PaperSearchQA task, cover pass@1 rose from 29% to 63%. Code is open.

Why it matters: Rollout generation is ~80% of agentic RL compute, so pushing it onto idle consumer hardware is a credible path to training open models without datacenter interconnects — a hedge as frontier models retreat behind closed APIs.

Claude's web_fetch exfiltration guard defeated by nested honeypot links

Anthropic's web_fetch tool is designed to block data exfiltration by only visiting URLs the user entered or that web_search returned. Ayush Paul found a hole: web_fetch would also follow links embedded in pages it had already fetched, so a honeypot site could coax the agent into leaking data letter-by-letter through a chain of nested generated URLs. The attack was served only to clients with a Claude-User user-agent to evade detection, and successfully extracted a user's name, home city and employer. Anthropic has closed the hole by stopping web_fetch from navigating to links found inside its own fetched content — but paid no bounty, claiming prior internal discovery.

Why it matters: A textbook lethal-trifecta bypass: even a carefully allowlisted fetch tool leaks once it will follow content-derived links, and it's a live reminder to audit exactly what URLs your agent's fetch tool is permitted to reach.

Google DeepMind and Isomorphic Labs detail a joint bioresilience program

Google DeepMind and Isomorphic Labs published a shared approach to biosecurity spanning prevention, detection and response, citing 15+ partnerships with governments and biosecurity groups over the past year. Concrete efforts include adapting SynthID watermarking to biology so DNA-synthesis providers can screen for AI-generated risky sequences, using the AlphaEvolve agent to optimize metagenomic sequencing for faster outbreak detection, and granting trusted researchers access to its latest models plus Isomorphic's drug-design engine to accelerate vaccine and countermeasure design.

Why it matters: It frames frontier models as both a CBRN risk to be gated and a defensive tool — a dual-use posture that will shape how model access and safety evaluations for biology get regulated.

Also worth a look

Browse previous days →