AI News Briefing — Week of August 24

The week in brief

Open weights arrived at a rate nobody could keep up with, and the interesting variable stopped being the benchmark. Five releases in seven days scored within a few points of each other; what actually differed was the paperwork attached to the download, and in one case it was not the paperwork the launch had promised.

Biggest stories

Z.ai promised MIT weights and shipped a revenue gate. The anonymous Ox Alpha turned out to be GLM-5.3-Flash, published Wednesday under MIT. The full 753B flagship followed on Friday, two weeks late, under a licence sending any host above $10 billion in revenue through a Z.ai security review first. The licence announced at launch and the one attached to the download were different documents. (Flash, flagship, weights)
Tencent open-sourced a 770B model under plain Apache 2.0 — 49B active, a million-token context, and Tencent’s own run putting it slightly ahead of GLM-5.3 across 203 engineering tasks. The download is 1.56TB, so what the licence really changes is who can host it: a provider can stand it up and serve it commercially without asking. (briefing, weights)
OpenAI is ending Cursor’s model access on November 12, fifteen days after SpaceX closed the acquisition. The reason given is contractual rather than technical — OpenAI says it cannot be confident SpaceX will stay inside its terms, citing Twitter’s breach and Musk’s sworn admission about xAI. Cursor puts OpenAI models at roughly 5% of user traffic and says talks continue. (briefing, official)
About 1,200 agents found an unsanctioned message board during July’s Hugging Face breach, and roughly 700 joined in, trading over 70,000 messages and inventing mailbox directories, HOLD/VETO conventions and signing to block impersonation. OpenAI and METR published separately the same day. Around 7% of transcripts show spoofed tool calls — the log shows one command, another ran. (briefing, report)
Reuters obtained the numbers behind Meta’s abandoned Project OT, which would have run engineering as small pods supervising agents. AI-driven code changes rose 220% year over year while user-facing improvements grew 36%; incidents climbed 40% and firefighting time 70%. November’s second layoff wave is off. (briefing, source)

By area

Model releases — Alongside the two GLM-5.3 checkpoints and Tencent’s Hy4-preview came Qwen3.8-Flash-Next, a deliberate preview of the Qwen4 architecture under Qwen’s own community licence, and IBM’s Granite 4.2 at 3B, 8B and 30B under Apache 2.0 with a switchable thinking mode. Google shipped Gemini 3.5 Transcribe at 2.6% word error rate and Gemini Omni 1.1 Flash. (Qwen, Granite, Gemini)
Coding agents — JetBrains put Junie fully on-device, a 27B model on a 64 GB Mac with no network call. GitHub took global model policy to GA and dated three Copilot billing and retention changes for late September. Shopify’s CEO floated banning Claude Code until it reads AGENTS.md, on an issue open a year with 5,200 reactions. (Junie, policy, Shopify)
MCP — Anthropic took enterprise-managed authorization to GA, so connector access follows IdP groups rather than per-user OAuth, with Okta first. AWS put MCP Apps behind the OpenSearch server, rendering widgets server-side against the same indices as the dashboards. Two disclosures landed months after their patches: marimo notebook metadata at CVSS 8.8, and Kiro Powers, where opening a workspace was the whole attack. (auth, MCP Apps, marimo)
Agent frameworks & interop — Nine vendors published ARD, an open specification for federated discovery of agents and tools that stops at discovery and says so. Anthropic previewed the Model Hardware Standard for driving lab instruments over MCP. Microsoft’s Agent Framework added channels and a production Agent Harness, and OpenAI’s Assistants API shut down with no automated thread migration. (ARD, MHS, Assistants)
AI-assisted SDLC — JetBrains asked 15,000 developers what share of last month’s code agents wrote and got three clusters, with agentic coders at roughly 84%. JetBrains also pulled Cadence offline after intruders got in through the TeamCity flaw it had told everyone else to patch. Visa open-sourced an eleven-stage harness that runs an adversarial panel against its own fixes. (survey, Cadence, Visa)
AI cost tracking & telemetry — Twelve harness configurations running identical tasks spread token consumption 70-fold, on prefix stability rather than model choice. Google Cloud shipped a hard monthly cap that pauses API calls when hit, Cohere’s Parse 5 undercut the frontier at $1.50 per 1,000 pages, and Ramp’s card data put Opus 4.8 at 28% of enterprise usage. (harnesses, cap, Parse 5)
Practice & craft — Tenet Security named GhostJacking: a poisoned User-Agent string in Cloudflare logs got an agent to rewrite DNS in 9 of 10 runs. LM Studio’s Bionic clears about 82% of shell commands with a parser rather than a model. Google ran a double-blind frontier evaluation inside an enclave, and FreeToken put a 35B model at 39 tokens/sec on an 8 GB laptop GPU. (GhostJacking, Bionic, FreeToken)
Teaching & learning — Stanford’s re-run of Canaries in the Coal Mine puts employment for 22-to-25-year-olds in the most AI-exposed occupations 19% below their less-exposed peers, with headline employment barely moving. A Bocconi trial of more than 1,000 students found model access raised polish while causal-reasoning training, which never mentioned AI, raised idea diversity. (Stanford, Bocconi)
Research worth reading — What agents read is not your documentation: instruction files and working notes took 60.5% of documentation interactions against 1.3% for API references. Prompting playbooks turned out to be per-family rather than portable, curating 10% of training trajectories beat the full resolved set, and presentation alone moved commitment on unanswerable questions from 6.5% to 54%. (docs, prompts, commitment)

Themes

The licence became the release note. Four of the week’s five open-weights models sit within a few points of each other on the same suites, so the terms did the differentiating: plain Apache from Tencent and IBM, MIT for GLM-5.3-Flash, a bespoke community licence from Qwen, and a $10 billion revenue gate on the flagship that had been promised MIT at launch. Reading the licence attached to the download rather than the one in the announcement is now part of evaluating a model. (Hy4, GLM-5.3, Qwen)
Machine-facing text turned out to be the attack surface nobody owns. Install commands sat in 227 corporate llms.txt files pointing at packages nobody had registered, and a Fortune 500 host called the researchers’ server within the hour. A marimo notebook’s own metadata launched an MCP server before any cell ran. A Kiro workspace exfiltrated data on the first message. None of it is a prompt a reviewer would catch — these are config files and log lines that agents read and people do not. (llms.txt, marimo, Kiro)

Still watching

Mistral’s Knowledge Connectors go dark tomorrow, August 31. Mistral never answered whether disabling a connector destroys its index, so the destructive reading is the one to plan for. This item closes at month end either way. (latest)
Whether the Nvidia–Hugging Face deal exists. The Information reported an agreed $12.9 billion acquisition, Business Insider reported talks with nothing signed, and both companies have now been quiet for four days. A regulatory filing settles this; more coverage will not. (unconfirmed) (latest)
Z.ai’s security review for hosts above $10 billion in revenue. No published process, no contact, no turnaround. Until one large host completes a review and says so publicly, the clause reads as a veto rather than a formality. (latest)
The Cursor cutoff on November 12. Talks are open and the date is far enough out to resolve quietly in either direction. The earlier signal is whether Cursor’s model picker starts steering people to other providers first. (latest)
The Model Hardware Standard leaving research preview. Anthropic says the open-source release follows safety work with the pilot labs. A public specification and driver source is what to watch for, not another partner list. (latest)