Dear friends,
A few frontier labs have tried to tell a story of open models being dangerous because they can be used to launch cyberattacks, and of their “safe” proprietary models with strong guardrails being there to defend us. This week, the opposite happened: Users of a closed model unintentionally launched a significant cyberattack; other closed models then failed to defend against the attack because of their guardrails. Ultimately an open model that was not hobbled by excessive guardrails assisted the defense.
The details of what happened are still emerging, but it appears that researchers at OpenAI, while testing one of their systems, accidentally allowed their autonomous agent to attack Hugging Face’s infrastructure. It succeeded and gained unauthorized access to some datasets and credentials. This attack was unusual in that the attacking agent orchestrated tens of thousands of automated actions.
Hugging Face took logs from the attack and tried to analyze them for defensive purposes using a commercially hosted LLM, but the LLM refused to do so on safety grounds. Thus, Hugging Face ended up using the open GLM 5.2 model to analyze the logs to help them understand and respond to the attack. Hugging Face pointed out a further advantage of using GLM 5.2: It allowed them to do the analysis on their own infrastructure, and none of the sensitive logs, attacker data, or credentials had to be sent to a third party provider.
Guardrails on LLMs do have a place. There are certain requests, such as for detailed directions to harm oneself or others, or for clearly criminal acts, that we’re better off having models refuse. But rather than trying to make LLMs “safe,” I would rather we put greater emphasis on making sure their use is responsible. There’s only so much one can do to make a tool like a hammer safe, and whether it helps or harms is more a function of using it responsibly than how it was made.
But a meaningful fraction of work on AI safety is no longer about safety but rather aimed at stoking fears to pursue regulatory capture. As David Sachs points out, “There’s no reason to limit American models on tasks that Chinese models handle without issue. We’re only making ourselves less competitive.”
I believe that open weight models, and more generally openness — despite some companies falsely saying it is dangerous — casts sunlight on technology and ultimately makes it safer. With the release of GLM 5.2 and the upcoming release of Kimi K3’s weights, open weight models have almost caught up to proprietary frontier models. Consequently, the proprietary model providers are dramatically accelerating their lobbying efforts to hamstring their open weight competitors. As Bill Gurley points out, open sourcing is a well established business strategy, not a danger to be licensed and contained.
While it is unfortunate that Hugging Face was accidentally attacked, I’m glad that at this moment, when anti-open model lobbying is at its most intense, we have a clear example of why open models actually make cyber defense easier and thus increase safety.
Let’s keep speaking up for and defending open source and open weight models!
Keep building! Andrew
News
Kimi K3 Reveals How A Giant Frontier AI Model Works
Moonshot’s latest model leapfrogged the month-old GLM-5.2 and a host of proprietary competitors to finish just behind GPT-5.6 Sol and Claude Fable 5 on many benchmarks.
What’s new: Moonshot AI introduced Kimi K3, a 2.8 trillion-parameter vision-language model. The company made the model available immediately via API and promised to release its weights by July 27, which would make Kimi K3 the largest known open weights model to date.
How it works: Kimi K3 incorporates two architectural changes that Moonshot recently published: Kimi Delta Attention, which cuts the memory and computation that attention consumes over long inputs, and Attention Residuals, which lets each layer choose which earlier layers to draw on rather than summing them all equally. Moonshot said that these changes, along with a sparser mixture-of-experts design and improved training and data recipes, made training about 2.5 times as efficient as its predecessor’s training runs, measured in model improvement for a given amount of compute. The company promised further details in a forthcoming technical report.
Performance: Kimi K3 outperformed every open weight model in independent tests of intelligence, agentic tasks, and coding. It trailed only the top few proprietary models on most benchmarks.
Behind the news: Over the past year, open models have regularly outdone each other, but this is the closest they’ve come since 2024’s Llama 3 to the state of the art. Kimi K2 introduced Moonshot’s 1 trillion-parameter line, and [Kimi K2.5] then Kimi K2.6 each became the leading open weights model on Artificial Analysis’ Intelligence Index in turn. The competition kept pace: Last month, Z.ai’s GLM-5.2 took the lead, at as little as a quarter of the cost of comparable proprietary models. Just three days after Kimi K3’s launch, Alibaba, a financial backer of Moonshot, introduced Qwen3.8-Max-Preview, an early version of a 2.4 trillion parameter model that the company claims trails only Claude Fable 5 and promises to release with open weights.
Why it matters: Kimi K3 whittles away at every reason why a developer choosing a model might default to the top proprietary model. It performs within three points of Claude Fable 5 at a much lower cost per task, and when released, its open weights allow fine-tuning, distillation, and closer study. Whoever owns those weights sets usage policies: Many requests that Claude Fable 5 refuses won’t cause friction for Kimi K3 users. Finally, competition this close — on price, control, and performance — pressures proprietary developers to deliver better, cheaper models.
We’re thinking: Kimi K3's efficiency gains stem from innovations like KDA’s linear attention, redesigned residual connections, and greater sparsity. Two of these Moonshot published as papers with code. When labs that face computation limits respond with architectural creativity and publish it, all developers benefit.
Meta Sparks A Price War
With Llama, Meta marked itself as an open alternative to OpenAI. With its new closed models, Meta now positions itself as a low-cost, high-value competitor.
What's new: Meta launched Muse Spark 1.1, a vision-language model trained for agentic tasks, and opened Meta Model API, the company's first paid access to its models.
How it works: Meta disclosed few details about how it built Muse Spark 1.1, which updates the initial Muse Spark, the model behind Meta AI since April. The company's training techniques emphasize managing context, operating computers, and coordinating other agents.
Performance: Muse Spark 1.1 stands out on benchmarks measuring agentic tool use, but is a tier below the top models in overall intelligence. It ranks just behind the leaders in blind human comparisons, but sits in the middle of the pack in agentic coding. It is particularly good at keeping costs per task low.
Behind the news: Muse Spark 1.1 arrived in a crowded stretch of model launches. On the same day, OpenAI opened its GPT-5.6 family to the public; one day before, Grok 4.5 launched with a similar emphasis on low cost per task. (Two weeks later, Google unveiled Gemini 3.6 Flash and Gemini 3.5 Flash-Lite.) The same week, Meta also introduced the image generator Muse Image and announced the video generator Muse Video. Muse Spark 1.1 is also the first model available via Meta’s new Model API.
Why it matters: Token prices gate which applications are economical at scale; with Muse Spark 1.1, Meta moved the gate. The model's output tokens cost a fraction of near rivals' ($25, $30, and $50 per million tokens for Claude Opus 4.8, GPT-5.6 Sol, and Claude Fable 5 respectively), and per-task measurement confirms the discount is real: On Artificial Analysis' numbers, only one comparably intelligent model, GPT-5.6 Luna, costs less to run. Mark Zuckerberg framed the pricing as an attack on competitors’ economics, saying that other labs’ pricing “is very extreme and has very high margins.” Meta, like Google, can subsidize model development, training, and inference costs with advertising revenue, a structural edge over labs that live on API margins and subscriptions. If rivals feel forced to defend market share, the cost of running agents falls across the industry.
We're thinking: Capabilities keep migrating from scaffolding into weights. Instruction following began as prompt engineering, and tool use began as code wrapped around models; both became training objectives. Muse Spark 1.1 continues the pattern by absorbing behaviors that developers previously built into scaffolding like delegating and escalating to agents and managing context mid-task. The less external tooling developers must build by hand, the faster agentic applications will spread.
Learn More About AI With Data Points!
AI is moving faster than ever. Data Points helps you make sense of it just as fast. Data Points arrives in your inbox twice a week with six brief news stories. This week, we covered Thinking Machines’ open Inkling model and Alibaba’s plans to release the weights for its powerful Qwen3.8-Max. Subscribe today!
Cloudflare’s Web Crawler Flare-Up
Web publishers using Cloudflare will soon be able to separately control an AI bot’s access based on what it does, allowing search indexing while blocking AI training or agent activity.
What’s new: Cloudflare – the content delivery network for nearly 20 percent of the internet – introduced new AI traffic controls which block training and agent bots by default while allowing search indexing crawlers. It also announced a monetization tool that would allow customers to charge specified visitors (whether humans or bots) for access to web pages, datasets, APIs, or Model Context Protocols.
How it works: Cloudflare customers can toggle crawlers’ access based on the bot’s use case, enabling or disabling access to crawlers for search, AI training, or AI agents. Crawlers serving multiple purposes will be subject to the most restrictive setting. For example, crawlers like Googlebot, Applebot, and Bingbot that both index content for search and collect training data for AI would be blocked if a publisher elects to block training crawlers. The controls will be applied beginning September 15.
Behind the news: AI bots account for a growing share of web traffic; Cloudflare says over half (57.5 percent) of all HTTP requests now come from automated systems rather than people. The value of search traffic has eroded enough that some publishers have even opted out of Google Search, in part because they do not want Google’s agents to bypass their display advertising or train on their content. Cloudflare's new framework attempts to preserve the benefits of search while giving publishers more control over other forms of AI crawling. It also rewards companies like OpenAI that separate their search and training crawlers, and punishes those, like Google, Apple, and Microsoft, that don’t.
Why it matters: Access to high-quality web data remains critical for developing and improving AI models, but publishers and partners like Cloudflare increasingly place limits on how that data can be collected. That friction has a technical and monetary cost. Such costs will likely have an outsized impact on smaller and newer AI developers, who lack the resources to secure agreements with publishers and face greater barriers to acquiring online knowledge that larger companies have already incorporated into their data sets.
We’re thinking: Cloudflare thinks a bargain can be struck between AI companies and online publishers, with the company playing the role of toll keeper. But it strikes at a basic principle held by most AI companies, which is that training on public web data should be fair use. It remains to be seen if Cloudflare has enough leverage to implement such a toll and whether its definition or most AI companies’ definition of “fairness” will prevail.
Web Retrieval Flusters LLMs
Large language models often are called upon to gather news. In this task, researchers found, their ability to find relevant reports is the weakest link.
What’s new: Mirac Suzgun and colleagues at Stanford University and the cloud platform Together AI tested the ability of six popular LLMs outfitted with web-search tools to answer questions about the daily news. The LLMs generally answered accurately, especially when the questions themselves contained accurate information and were posed in English. When they answered inaccurately, usually it was because they retrieved unhelpful articles.
Key insight: An LLM’s ability to answer factual questions that weren’t addressed in its training data depends on at least three steps: (i) receiving a well formed question, (ii) retrieving a relevant document, and (iii) extracting facts from it. Compromising any of these steps will degrade the output. For instance, a question that includes incorrect facts — say, a mistaken name — will make it difficult for the LLM to answer correctly. Similarly, retrieving a document that doesn’t include necessary facts is more likely to yield an incorrect answer. And the LLM won’t be able to extract facts from a retrieved document if it wasn’t well trained in the document’s language. Building a high-performance news-reporting system requires mastering all three steps.
How it works: The authors performed tests daily between February 9 and February 22, 2026. They posed questions based on BBC News reports in six languages (Arabic, English, French, Hindi, Russian, and Turkish). They tested Google’s Gemini 3 Flash and Pro, xAI’s Grok 4, Anthropic’s Claude 4.5 Sonnet, and OpenAI’s GPT‑5 and GPT‑4o mini, all with web-search tools.
Results: The models generally performed with high accuracy on well formed questions in English. However, (i) they underperformed in other languages, especially Hindi, (ii) most errors stemmed from retrieval rather than intelligence, and (iii) they underperformed when questions contained false premises.
Why it matters: LLMs outfitted with web search are well suited to finding factual information, but their performance depends on receiving factual input, finding relevant documents, and extracting facts properly. Since most errors arise in retrieval, improving retrieval may yield a larger performance increase than scaling model parameters (at least when it comes to responding to queries that involve timely information). The authors point to three approaches to improving retrieval: (i) better indexing coverage (which documents or web pages are included in the search), (ii) better ranking of sources (the order in which retrieved documents are presented to the model), and (iii) better handling of queries in languages other than English.
We’re thinking: Web search engines built for agentic rather than human use have become an exciting and rapidly growing category. It looks like there's still ample room to build better web search for agents!
Work With Andrew Ng
Join the teams that are bringing AI to the world! Check out job openings at DeepLearning.AI, AI Fund, and Landing AI.
Subscribe and view previous issues here.
Thoughts, suggestions, feedback? Please send to thebatch@deeplearning.ai. Avoid our newsletter ending up in your spam folder by adding our email address to your contacts list.
|
