Z.ai confirms it built Ox Alpha, OpenRouter's most-used model, and will open the weights
Z.ai confirmed that Ox Alpha, the stealth model that became OpenRouter’s most-used listing in its first weekend, is a new entry in its GLM series, and said it will publish the weights the same night. David Buchanan demonstrated that C2PA camera attestation on Android can be forged end to end, signing an AI-generated image as camera-captured on a fully patched Pixel without ever extracting a key. Six papers landed on the agent harness rather than the model as the layer that decides agent behaviour, including a measurement that recording a failed tool call in the transcript raises the odds of the model repeating it from 0.06 to 0.54.
Model Releases #
Z.ai confirms Ox Alpha is a GLM model and will release its weights tonight #
Bloomberg
Asked directly by Bloomberg, Z.ai said Ox Alpha — listed on OpenRouter since 22 August with no attribution beyond “a third-party provider who has chosen to remain anonymous” — is a new iteration of its GLM series, that the weights go out Wednesday night, and that access stays free for a week before pricing is announced. The model is a reasoning model aimed at coding and agentic work, with a 1,048,576-token context window and text, image and video input; the codename comes from the Chinese film Niu Lai. In the days before the reveal it went to the top of OpenRouter’s leaderboard with more than double DeepSeek’s usage, which Bloomberg describes as the largest launch in that marketplace’s history. The sequence is the part worth noting: the model won the top slot on price and availability while its provenance was unknown, and the disclosure arrived after the distribution, not before it — on a router Stripe is in the process of buying.
Skild AI’s S1 executes a 10-minute unseen robot task from a single video #
Skild AI
S1 is pre-trained on episodic data in which the task is specified only by an in-context demonstration, so a video prompt replaces both a language instruction and a fine-tuning pass. Skild reports 66% success on unseen tasks against 9% for language-prompted VLAs at 100k training hours, with a single in-context demonstration worth roughly 380 post-training episodes, on tasks up to ten minutes long that were not in pre-training. Training mixes teleoperation, egocentric video and simulation, and the company says it spends three dollars on quality control for every dollar spent collecting data. Every number here is Skild’s own: parameter count is undisclosed, there is no paper or third-party evaluation, and the model is available only to selected industrial partners, so treat the 7x gap as a vendor claim about its own baseline.
Security #
C2PA camera attestation on Android can be forged with off-the-shelf root #
David Buchanan
Buchanan rooted a fully patched Google Pixel using public tooling — Root My Pixel, exploiting CVE-2026-43499 — and then, without extracting any key material, instructed StrongBox to sign data of his choosing. The output is a valid C2PA credential asserting camera capture, which he demonstrates on an AI-generated image of a frog and on a YouTube video. He also shows electromagnetic fault injection producing root regardless of patch level, which removes the patching defence entirely. The scope is every C2PA camera app whose trust rests on Android Key Attestation or Play Integrity, not only Pixels; Samsung’s Real-time Kernel Protection raises the cost but he identifies workarounds. This matters beyond one platform because the EU AI Act’s transparency obligations, in force since 2 August, require AI-generated content to carry machine-readable marks, and C2PA is the scheme that marking is expected to use — a hardware root of trust that will sign whatever the device’s owner asks reduces “captured by a camera” to “signed by a device”, which is a materially weaker claim than the label implies.
A malicious MCP server that behaves for long enough gets a 69.5% attack success rate #
arXiv
TrustShiftProbe names and measures a server-side attack the authors call TrustShift: a compromised MCP server answers honestly through a conditioning phase, accumulating operational reliance and suppressing the agent’s skepticism, then switches to an adversarial payload once an interaction threshold is crossed. Because the malicious behaviour is temporally gated and originates at the server endpoint rather than in a user prompt or in transport, static analysis of the server or the prompt sees nothing. Across frontier models and nine attack variants the mean attack success rate is 69.5%, which their SHIELD defence reduces to 42.7%. The residual is the finding to act on rather than the headline: a mitigation that leaves four in ten attempts succeeding is not a control you can put a production integration behind, and the paper’s own framing treats server trust as something that has to be re-established continuously rather than at connection time.
Google’s agent payments protocol signs the transaction but not the context that produced it #
arXiv
Applying the MAESTRO threat-modelling framework to Agent Payments Protocol v0.2, the authors catalogue 48 threats across five attack categories and five deployment architectures, single out eight as high-risk, and build a testbed with working proofs of concept plus a deployment-aware scanner that maps which threats apply to a given topology. The structural gap is clean: AP2’s signed Checkout and Payment Mandates guarantee that transaction data was not altered after signing, while everything that shapes the transaction beforehand — A2A messages between agents, MCP tool results, external inputs — sits outside the signature. A valid mandate therefore establishes integrity without establishing intent, and an attacker who can influence pre-authorization context gets a correctly signed payment for something the user never chose.
Research & Papers #
Recording a failed tool call in the transcript makes the model 9x likelier to repeat it #
arXiv
Agent harnesses write a failed tool call and its error message into the transcript on the assumption that the error is corrective. This paper measures the assumption directly, defining corrective gain as the change in log-probability of re-emitting the action that just failed, and finds it negative for all six instruction-tuned checkpoints tested (135M-1.7B, four families) across simulated tool calling and MBPP program repair — about -1.03 nats per action token, a factor of 2.8 in per-token odds, holding on 90-100% of individual items rather than only on average. Over a fixed candidate set the probability of repeating the failed call rises from 0.06 to 0.54, and greedy decoding reproduces it token for token on 19% of items after the failure against 0% before. Counterfactuals pinning the same call to a failure, success or neutral message attribute 83% of the damage to the failed call’s surface form rather than to its being marked as failed, which is why replacing the verbatim call with a runtime-generated description removes 76% of the inversion at no token cost, while an explicit “do not repeat” instruction changes nothing measurable and clearing the context to retry — the standard prescription — was the worst harness they measured, because it restores the state that produced the failure. The checkpoints are small enough that frontier behaviour is untested, but the mechanism is a property of what the harness writes down, not of model scale.
Escalating a coding agent to a stronger model recovers less than half the capability gap #
arXiv
Ganz, Shpigel Nacson, Kalyanpur and Litman pair low-cost/low-capability and high-cost/high-capability models within the Claude and GPT families and vary handoff direction, timing and interface, holding repository state fixed while comparing full-trajectory transfer, compaction and trajectory removal. Escalating mid-run with the full trajectory recovers under half of the quality gap between the two models while charging a substantial cost premium — the handoff tax — whereas downshifting after the hard reasoning is done lands on a favourable cost-quality point. The interface result reverses with direction: giving the strong model less of the weak model’s trajectory improves escalation, while stripping the strong model’s trajectory degrades downshift. That asymmetry says the inherited trajectory is a liability when it encodes a weaker model’s reasoning and an asset when it encodes a stronger one’s, which is not how most routing layers currently treat it.
Routine context compaction turned a hard safety constraint into a suggestion in every episode tested #
arXiv
Multi-stage agent workflows pass state downstream as summaries, plans, tickets and handoff notes, and this paper asks whether constraints survive that transformation as constraints rather than as mentions. Using safety blockers as a controlled case across 1,296 synthetic episodes, ordinary compression produced 100.0% deactivation of the blocker and 54.2% forbidden action downstream; restoring the critical state fields raised preservation to 100.0% and cut forbidden action to 0.0%. The distinction the authors draw is between topical retention and operational preservation — the artifact still mentions the unresolved condition, so a similarity check finds it, but it has been rewritten from something that must hold into something that might. Anyone running a summarize-and-hand-off pipeline over action-constraining state should be checking the constraint’s modality survives, not just its keywords.
A pre-execution monitor is most discriminative reviewing one or two actions, not a batch #
arXiv
Pre-execution oversight has a free parameter nobody measures: how many planned actions a single monitor call reviews. Natural traces cannot isolate it because review length co-varies with everything else, so the authors introduce a twin-prefix framework to hold the rest fixed. Longer review windows do raise the catch rate, but false rejection climbs in lockstep, and informedness peaks at one or two actions for all six judges across both domains tested — longer windows make zero-shot monitors more rejective, not more discriminative. The deployment consequence is that batching actions to save monitor calls buys over-blocking rather than coverage, and the authors ask that safety cases state the unit of verification and co-report the clean-trace series, since a catch rate quoted without its false-rejection twin is uninterpretable.
Three agent harnesses built on opposing philosophies converged on the same five elements #
arXiv
A source-level study of three open coding-agent harnesses — LangChain’s feature-rich deepagents, Earendil’s minimalist pi, and DeepSeek’s plugin-based dsh — traces their commit histories and finds them arriving at one architectural middle form: a commoditised loop, an append-only replayable session record, model quirks stored as data rather than code, progressive disclosure of context, and explicit extension seams. The absence is the more useful half of the result. None of them has external verifiability — a tamper-evident record an outside party can check without trusting the runtime that produced it — and the author predicts that is where harnesses for security-sensitive deployments will differentiate next. It is a single-author reading of three codebases rather than a controlled measurement, so the convergence claim rests on which three were chosen, but the gap it names is checkable against any harness you run.
Agents from different model families produced five new mathematical results without a coordinator #
arXiv
Chung, Du and Wesley built the Station, an open-world environment in which agents from different model families pursue a shared research goal with no central planner and no scripted pipeline — they pick their own directions, run experiments, collaborate and accumulate a shared literature. Across 14 problems, twelve of them construction problems from the AlphaEvolve catalogue, the system produced novel results on five, including a new infinite family of finite-field Kakeya sets and new exact 604-point kissing configurations in dimension 11, plus improved bounds elsewhere. What separates this from prior construction-search results is that the agents also produced theorems and analyses explaining why the constructions work, which is what makes them usable by a mathematician rather than merely correct; full agent interaction logs, proofs and verification code are released.
Funding & Business #
Anthropic will reportedly pitch IPO investors a market opportunity above $30 trillion #
The Wall Street Journal / The Next Web
The figure would exceed the $28.5 trillion SpaceX put in front of investors before its own offering, and it arrives with a Q2 revenue number of $11.6 billion — more than double the prior quarter and roughly fourteen times a year earlier — alongside internal forecasts of $190-200 billion in 2028 revenue, a raise of up to $100 billion and a target valuation near $2 trillion. Filing is expected within weeks, which would allow a listing in September or early October. Two things bound the claim: all 191 S&P 1500 technology companies combined book about $2.4 trillion in annual revenue, so a $30 trillion addressable market is over twelve times the current industry, and NYU’s Aswath Damodaran called the comparable SpaceX figure “reaching the end of what’s plausible and pushing beyond” — after which SpaceX traded below its $105 offering price by early August. The prospectus is still the event, because it converts the run-rate arithmetic into audited figures.
Moonshot wants up to 30% of Kimi K3 revenue from Azure, AWS and Google Cloud #
Reuters / The Standard
Moonshot is in early-stage talks with Microsoft, Amazon and Google to have them host Kimi K3, seeking up to a 30% share of revenue from K3-related services on their clouds; no party has confirmed, and the unresolved items are the split itself, data access, and how token usage gets audited. That last one is the load-bearing detail — usage-based billing between a model owner and a hyperscaler requires both sides to agree on a meter neither fully controls. K3 is a 2.8-trillion-parameter open-weight model that Arena.ai ranks first for web-interface building and that Artificial Analysis puts near GPT-5.5 and Claude Opus 4.8 on complex multi-step tasks, and Moonshot raised over $2 billion in May ahead of a possible Hong Kong listing. A deal would be the first significant revenue-sharing arrangement between a Chinese AI lab and a major US cloud, which is a distribution question rather than a capability one.
The researchers who turned down Bezos’s Prometheus are building a non-transformer physics model #
Reuters / Tech Startups
Anima Anandkumar and Benedikt Jenik declined an offer to lead Project Prometheus — reported as a 35% stake and $1-2 million in combined salary — and founded Accelerated Understanding Inc., which builds on neural operators rather than the transformer architecture; Anandkumar pioneered the approach as a director at Nvidia, where Jensen Huang championed it at GTC 2021. Prometheus went on to raise a reported $12 billion Series B in June. The company’s headline claim is that its model handled 5 trillion data points in a single prompt in testing, which it frames as roughly five million times what flagship Anthropic and Google models process at once, targeting semiconductor design, robotics, extreme-weather prediction and geological analysis. That comparison does not survive contact with the units — neural operators ingest discretised field data, not tokens, so “5 trillion data points” and “a 1M-token context” are not the same measurement — and funding, valuation and any benchmark remain undisclosed.
Regulatory & Policy #
Huawei pitches Egypt 1,408 Ascend 950-series chips for government AI data centres #
Bloomberg
The proposal covers 1,408 of Huawei’s top-end Ascend 950-series chips for an AI training cloud plus roughly 600 more — either 950-series or the earlier 910B — for two inference clusters, on a 12-month build schedule, for military, surveillance and other public-sector workloads. It follows the same pattern as Huawei’s government data centre in Algeria and its cloud expansion across the Philippines, Egypt and Nigeria. The asymmetry this exposes is the one US export policy cannot address: those controls determine what American vendors may sell and to whom, while saying nothing about what Huawei may sell, and the market where Ascend competes best is precisely the one where availability and financing matter more than per-chip performance.
Infrastructure #
An Indian operator orders 9,000 Vera Rubin systems for a 1GW build #
Taipei Times
Hyderabad-based AM Intelligence has ordered 9,000 Nvidia Vera Rubin systems as part of an $8 billion plan for 1GW of capacity, with servers due online next year in southern India and the stated target of running trillion-parameter models and agentic applications. Capacity will be sold into India, the US, Finland and Malaysia, and a US customer has already bought an initial tranche under a confidentiality agreement. Founder Mahesh Kolli’s pitch is entirely about the input cost — “energy prices play a huge part,” and the company claims to be among the lowest-cost compute providers globally — which is the first named large-scale commitment to the Rubin generation Nvidia put into full production this week, and it is being justified on power economics rather than on the 30x-per-megawatt figure Nvidia is marketing.
Other #
Bill Gates says AI has crossed five danger thresholds and policymakers have not noticed #
MIT Technology Review
Gates names bio-capability, cyber-capability, psychosocial dependency, job-market destruction and loss of control as thresholds already passed, arguing that any model able to design novel molecules should be monitored, that bioterrorism is now roughly fifty times likelier than a natural pandemic, and that people with no technical skill can mount cyberattacks using AI alone. His evidence for the pace is coding — agentic harnesses, long context buffers — and on employment he calls reduced entry-level hiring “a pretty modest signal” of what follows. The proposals are the concrete part: a token tax on AI usage funding safety-net expansion, categories of work reserved for humans, US-China cooperation on biomonitoring standards, and government hiring of real AI expertise. “We’re past any reasonable threshold,” he says, while noting that policymakers are largely unconcerned — which is a statement about political attention rather than a new measurement, and should be read as one.
Threads to Watch #
The harness, not the model, decided most of today’s measured agent behaviour. Five separate papers landed on the surrounding code: writing a failed tool call verbatim into the transcript inverts the model’s next choice, an ordinary compaction step demoted a hard safety constraint to a mention in every episode tested, a monitor’s review window traded discrimination for rejection, and escalating to a stronger mid-run model recovered under half the capability gap it was bought for. None of those failures is visible to a benchmark run against the model alone, and none is fixed by a better model. The convergence study names the missing piece directly — no surveyed harness produces a tamper-evident record an outside party can check without trusting the runtime — which means the layer now doing most of the deciding is also the layer with no audit trail.
Signatures are being asked to carry claims they cannot support. C2PA proves a device signed an image; root on Android collapses the distance between that and “a camera captured it”. AP2’s mandates prove transaction data was not altered after signing, not that it reflects the buyer’s intent, because every input that shaped it beforehand is unsigned. A TrustShift MCP server passes static analysis because it is genuinely honest until its threshold. In all three the cryptography works exactly as specified and the binding is the defect: the object being attested is not the object the reader believes is being attested, and no amount of key hygiene closes that gap.
Chinese labs are competing on distribution terms rather than on price alone. Ox Alpha reached the top of OpenRouter as a free, unattributed listing before anyone knew who built it, and Z.ai is following the win with open weights. Moonshot is negotiating for up to 30% of K3 revenue on Azure, AWS and Google Cloud, which would place a Chinese open-weight model on the three US hyperscalers’ billing rails. Huawei is offering Egypt a twelve-month government build on Ascend silicon. The layers differ; the constraint being routed around is the same one, and it is access to Western customers rather than capability.