AI News Briefing — Free stealth model Ox Alpha retains every prompt

Model releases

• [2026-08-23] Ox Alpha turned up on OpenRouter as a free stealth model: a million-token context, text, images and video in, and a pitch aimed at long-horizon software engineering. The provider stays anonymous through the preview, and under OpenRouter’s stealth terms it retains every prompt and completion — separate terms from the rest of the catalogue. Speculation has settled on China, with Z.ai’s GLM line the usual guess and nothing confirmed either way. Free is doing a lot of work here. (official, source)

  Retention here attaches to the model, not to the account. That breaks the usual assumption — terms read once at signup and never revisited per model.

  For Security Engineers: Approval lists usually name the provider, and OpenRouter is already on plenty of them, which puts a model that keeps every prompt and completion inside an existing approval. If free models are reachable from your gateway, the allow-list has to name model ids rather than providers.

• [2026-08-24] Anthropic logged elevated errors on Claude Mythos 5, Fable 5, Opus 5 and Opus 4.8 from 05:06 UTC, with claude.ai, Claude Code, Cowork and the API all still showing partial outages three hours later. No cause posted. That makes four incidents on the status page in eight days, after two on August 20 and one on the 19th. (official)

  Four incidents in eight days is a different problem to one long outage. A fallback route that only runs during an incident is one nobody has tested — and it is now getting tested weekly.

AI cost tracking & telemetry

• [2026-08-23] Ramp’s card-billing data across 70,000 companies puts Opus 4.8 at 28.0% of enterprise model usage in July, Sonnet 4.6 at 8.3% and Fable 5 at 8.0%, with nothing else above 7%. Simon Willison reads Fable’s price as what has kept it niche — a strange place for a lab’s strongest model to sit. (source)

  This measures cards, not contracts — committed spend and cloud-marketplace billing sit outside it entirely.

AI-assisted SDLC

• [2026-08-24] Canonical and UK Research and Innovation are funding a three-year PhD at Bristol on translating large C codebases into safe Rust with LLMs: split the program into components, rewrite each one, preserve the behaviour. Jon Seager oversees it with Meng Wang and Cristina David. Ubuntu already ships Rust sudo and uutils coreutils, both written by hand — this is a research bet, not a migration plan. (source)

  Notice what the plan treats as the hard part: splitting the program into components, not translating them. Decomposition is where hand-run C-to-Rust ports stall too.

Practice & craft

• [2026-08-23] Google opened HEIR, a compiler toolchain that takes a pre-trained PyTorch model and compiles it to run under fully homomorphic encryption, so inference never sees plaintext. It already sits behind private recommendations, card-fraud detection, intrusion detection and hotword spotting inside Google. Compilation isn’t automatic — you export to MLIR through torch_mlir first — and no LLM benchmarks are published, which is the number that would settle whether this reaches a language model at all. (source)

  Export is the gate, not encryption. A model that will not lower cleanly through torch_mlir never reaches HEIR at all, so that is the cheap thing to try before anything else.

  For ML / Data Engineers: Fraud scoring and recommendations are the shapes this already serves inside Google — export the trained PyTorch graph through torch_mlir, compile it, and the serving tier holds ciphertext rather than features. Try it against a model you already have, since there are no published numbers to reason from.

Research worth reading

• [2026-08-21] AI reviewing AI is now measurable. Linking agent-attributed pull requests to agent-attributed reviews yields 248,641 PRs that drew at least one AI review, 45,269 of them from a different product than the author. Cross-product review is about 1.6% of agent-authored PRs but grew more than a hundredfold across 2025. CodeRabbit filed 35.0% of its comments on Claude Code PRs as refactors, against 10.5% on Copilot PRs. (official)

  A reviewer filing three times as many refactor comments depending on which agent wrote the code makes review load a property of the pairing rather than of either tool on its own.

• [2026-08-20] What coding agents read is not your documentation. Across 557 sessions and 33,097 agentic pull requests, instruction files and working notes accounted for 60.5% of documentation interactions, classical technical docs 10.6%, API references 1.3%. Consultation was self-initiated 70.2% of the time rather than prompted by failure, and reading docs went with less immediate testing, not more. (official)

  Stale instruction files now cost more than confusion. An agent that reads them instead of probing puts wrong guidance into code with fewer checks behind it.

Watch list

• GLM-5.3 weights, August 28 — four days. Z.ai’s Hugging Face org page is still empty with the date now inside the week. Whether or not the Ox Alpha guessing above is pointed the right way, a checkpoint and a model card are what would let anyone verify rather than fingerprint.

  Weights would settle the attribution question in a way no benchmark run can, since a downloadable checkpoint can be compared against Ox Alpha’s behaviour directly.

• Mistral’s Knowledge Connectors, August 31 — seven days. Google Drive and SharePoint go dark and Mistral still hasn’t said whether disabling a connector deletes its index. A week is enough time to re-index against the MCP replacements and not enough to spend waiting for an answer.

• A release candidate for the next MCP specification. Saturday’s roadmap named webhooks, DPoP identity and a single HTTP transport without dates. The candidate document is what turns any of that into something you can build a server against, and none has appeared since.

  Of the three items, a single HTTP transport is the one that touches servers already running. Nothing to plan until a candidate fixes its shape.

• xAI on Adversa’s decrypt-then-obey path, day five. No release note, no advisory, no CVE since the August 20 disclosure. Five days is short for a fix and long for silence, so the technique is still worth testing for yourself rather than assuming it closed.