Introduction

Nobody released a bigger model this week. Instead, the industry spent it pricing risk: OpenAI locked its most capable offensive security model behind an identity check, researchers finally sized up a supply-chain breach that started with a compromised build tool back in March, and — only days after investors poured $270M into AI-agent security — the shape of that risk got a lot more concrete. Open-weight releases kept coming too, each with its own licensing footnote that matters more than the parameter count next to it.

I will take them in the order they landed.

In this issue:

Gemini 3.7 Flash Halves Its Own Price Tag, Flagship Still Waiting
Qwen3.8-Max Opens Up, DeepSeek V4 Pro Exits Preview
Meta Ships Muse Glimmer for On-Device Agents
OpenAI Gates GPT-5.6-Cyber Behind Vetted Access Only
LiteLLM Breach Turns Out to Be Five Months Bigger Than Anyone Knew

Frontier Models

1. Gemini 3.7 Flash Halves Its Own Price Tag, Flagship Still Waiting

Gemini 3.7 Flash launches — 9to5Google, 13 August 2026

Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber — Google, 21 July 2026

Google unveils Gemini 3.7 — Yahoo Finance, 13 August 2026

Google shipped Gemini 3.7 Flash on 13 August, three weeks after Gemini 3.6 Flash, with improvements aimed squarely at software engineering and multistep agentic workflows rather than any single headline capability. The more interesting number is the price: $0.75 per million input tokens and $3.75 per million output tokens as an introductory rate through the end of 2026 — half Gemini 3.6 Flash’s launch price of $1.50/$7.50.

Gemini 3.5 Pro, meanwhile, is still in partner testing, with Google yet to give a broad-availability date. It’s an odd shape for a product line — the workhorse tier iterates every three weeks and gets cheaper each time, while the model that’s supposed to anchor the family is still waiting for its call-up.

Why this matters

If you’re building on Gemini today, Flash is the model you’re actually shipping with, not Pro, and Google’s cadence here is basically admitting that in public. I don’t think a three-week refresh cycle at half the previous price is sustainable marketing so much as it’s competitive necessity — Alibaba, DeepSeek and OpenAI are all iterating on similar timescales, and standing still on price for a quarter is how you lose the default-model slot in someone’s agent harness.

Gemini 3.5 Pro sitting in partner testing rather than shipping isn’t something to worry about yet; a flagship that keeps taking its time while the workhorse tier absorbs all the improvements is a reasonable allocation of engineering effort, even if it makes for an awkward slide in the next keynote.

Open Models and Inference

2. Qwen3.8-Max Opens Up, DeepSeek V4 Pro Exits Preview

Qwen3.8-Max open weights — LLM Stats, 12 August 2026

Qwen/Qwen3.8-2.4T-A95B — Hugging Face model card

Qwen3.8-Max arrives with a bold claim — VentureBeat

DeepSeek ships V4 Pro as flagship leaves preview — Unite.AI

DeepSeek V4 Pro 0813 goes GA — Tech Times, 13 August 2026

Two follow-ups to stories I covered last week landed almost back-to-back. Qwen3.8-Max’s weights shipped on 12 August as Qwen3.8-2.4T-A95B — the first Max-class Qwen model Alibaba has released openly — a 2.4-trillion-parameter MoE with 95 billion active parameters. Its native context window is 262,144 tokens, extensible to roughly 1,010,000; the hosted Qwen3.8-Max product built on the same checkpoint defaults to a flat 1M and adds vision input and non-thinking support that the raw open weights don’t have.

The weights carry a custom “qwen3.8-max” licence, not a standard OSI-approved one, and the licence text is the thing to actually read: Reuters reported last week that Alibaba is preparing to ask large commercial users of its open models to share revenue, and this is the first release where we can check whether that clause has actually landed in the terms, rather than just in a source’s account of a plan.

DeepSeek-V4-Pro-0813 exited preview the following day, 13 August, as a general-availability flagship: 1.6 trillion total parameters with 49 billion active, a 1-million-token context window, output up to 384K tokens, and both thinking and non-thinking modes. DeepSeek’s previous downloadable V4 weights use its permissive MIT licensing, but that’s a fact about the older checkpoint, not this release: as of this writing, the 0813 production checkpoint hadn’t appeared on Hugging Face — the repository still shows April’s preview weights — so “generally available” currently means available through DeepSeek’s own API, not on your own hardware.

Why this matters

Last week I wrote that “open-weight” and “zero-cost-at-scale” had stopped being the same claim; this week is the first chance to see whether that prediction shows up in an actual licence document rather than a leaked plan, and I’d read the Qwen3.8-Max terms yourself before assuming either way. The context-window gap matters too — 262K native versus the 1M the hosted product advertises is the kind of detail that only bites once you’ve already started building against the smaller number.

DeepSeek’s GA announcement demonstrates the same thing from the other side: GA of the service isn’t GA of the weights, and “shipped” and “usable” serve different roles in a press release than they do in your deployment pipeline. If you’re planning to self-host either model this month, budget the gap between the announcement and the artefact into your timeline, because both labs have just demonstrated it isn’t zero.

3. Meta Ships Muse Glimmer for On-Device Agents

Introducing Muse Glimmer — Meta AI Research, 10 August 2026

Meta's new Glimmer AI model — TechCrunch, 10 August 2026

Meta AI Releases Muse Glimmer — MarkTechPost, 10 August 2026

Muse Glimmer, released 10 August, is a roughly 30-billion-parameter dense multimodal model — plus a separate 1.8-billion-parameter vision encoder — built specifically to run as an always-on local agent on a single consumer GPU or Mac, under 20GB at around 4-bit quantisation. It handles a 128K-token context, works across 100-plus languages, and covers coding, document analysis, and general tool-use tasks. Meta shipped it under the permissive Apache 2.0 licence, with weights on Hugging Face now and optimised llama.cpp, MLX, and ExecuTorch integrations arriving soon.

The pitch is explicitly about ownership: an agent that lives on your machine rather than one you rent via an API call. Inference can stay entirely local, though any tools the agent calls — web APIs, MCP servers, SaaS integrations, telemetry — can still create their own network and logging exposure, which is a different threat model from renting the same capability by the token, not an automatically safer one.

Why this matters

An “always-on local agent” is a nice phrase, and Meta shipping this under Apache 2.0 rather than a restrictive research licence is the detail I’d flag over the parameter count. The real story is what you grant it, not where it runs: an always-on agent becomes a different kind of security question once it’s handed filesystem, browser, or shell access, and running Glimmer on your own laptop trades API latency and per-token billing for the job of sandboxing that access yourself.

“It’s local, so it’s safe” is exactly the kind of assumption the rest of this issue argues against. Worth keeping in your toolkit if you want an agent whose model inference doesn’t have to leave the device, but less worth deploying without thinking through what tool access does to your own attack surface.

Security

4. OpenAI Gates GPT-5.6-Cyber Behind Vetted Access Only

Expanding Daybreak as the Cyber Defense Window Narrows — OpenAI, 10 August 2026

OpenAI ships GPT-5.6-Cyber — Forbes, 11 August 2026

OpenAI unveils GPT-5.6-Cyber — SecurityWeek, 10 August 2026

OpenAI launches GPT-5.6-Cyber — The Hacker News, 10 August 2026

GPT-5.6-Cyber, announced on 10 August and built on GPT-5.6 Sol, is trained specifically for zero-day discovery and exploit-chain construction, and is available only behind Daybreak Red, the identity-verified, legally attested tier of OpenAI’s defender programme — standard ChatGPT and API users cannot reach it at all. OpenAI built an internal Advanced Cybersecurity Completion Rate evaluation specifically to measure how often models respond to high-risk requests rather than refuse them: GPT-5.6-Cyber completes 95.0% of these requests, against 1.5% for standard Sol and 2.0% via the guardrail-free Daybreak Blue tier. It was also credited with finding two previously unknown vulnerabilities in Chrome’s V8 engine, one of which Google fixed and assigned CVE-2026-15903.

The number that got less coverage: on OpenAI’s own Vulnerability Discovery and Report Writing evaluation, GPT-5.6-Cyber actually performs worse than plain Sol, and Sol also wins ExploitBench at the standard 300-turn setting while using fewer tokens. That completion-rate figure is essentially a refusal-rate metric — it tells you Cyber will engage with 95% of these requests, not that it successfully exploits 95% of targets.

Why this matters

Gating a model this capable behind identity checks and legal attestations is the right instinct, and I’d rather OpenAI ship it this way than not ship it at all — but the completion-rate headline is exactly the kind of statistic that gets quoted without its footnote. That a specialised offensive model loses to the generalist on report-writing and efficient exploitation is a useful reminder that training a model to be aggressive doesn’t automatically make it better at the adjacent skill of explaining what it found.

If your organisation is eligible for Daybreak Red, read the actual eval breakdown before you assume the headline number tells you what the model is for.

5. LiteLLM Breach Turns Out to Be Five Months Bigger Than Anyone Knew

2,500+ Companies and 434,000 CI/CD Pipelines Exposed — CloudSEK, 11 August 2026

Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack — SecurityWeek

LiteLLM Attack Shows AI Infrastructure Is a Strategic Supply Chain Target — GBHackers

New research published this week by CloudSEK finally puts a number on a breach that happened back in March. The compromise didn’t target the popular LiteLLM proxy library directly: a leaked automation token for Trivy, a security scanner used inside LiteLLM’s own build pipeline, was rotated but not fully revoked, leaving roughly a 20-day window in which attackers could force-push malicious code over Trivy’s published version tags — poisoned code that still looked legitimate to downstream builds. LiteLLM’s pipeline pulled the compromised scanner, and two poisoned packages — litellm==1.82.7 and 1.82.8 — went live on PyPI for about 40 minutes on 24 March before being quarantined.

That was long enough. Stolen material reportedly includes cloud keys, repository tokens, SSH keys, Kubernetes secrets, package-publishing credentials, environment variables, and AI-provider keys. CloudSEK’s fresh analysis, released 11 August, maps more than 2,500 organisations and 434,000 CI/CD pipelines as potentially exposed — a match on evidence, not proof of successful compromise, as CloudSEK itself is careful to note — with high-confidence matches including AWS, Cisco, Salesforce, Siemens, X Corp, and Orange.

The FBI’s FLASH-20260702-01 advisory, issued 2 July, warned that the stolen credentials could still be weaponised — advice that reads rather differently now that the scope is five times what anyone described at the time. That concern is arriving only days after Zenity, Obsidian Security, and Oligo Security collectively announced $270M in new funding for exactly this problem: governing the non-human identities — service accounts and machine credentials — that AI-era build pipelines run on.

Why this matters

The genuinely uncomfortable detail here isn’t the 40-minute window — supply-chain compromises are often measured in minutes — it’s that a security scanner was the entry point. Most organisations’ dependency-scanning and SBOM efforts are built to catch a poisoned package, not a poisoned tool that’s supposed to be catching poisoned packages, and that blind spot is structural, not a LiteLLM-specific failing.

It took roughly five months to go from a 40-minute compromise to a mapped exposure of 2,500 organisations, which means nobody gets to assume that removing the poisoned package closed the incident — any credential accessible to the affected process may still need validation or rotation, whether or not anyone has proven it was used.

If your environment installed LiteLLM 1.82.7 or 1.82.8 during the affected window, that’s the first thing to check, rather than treating every LiteLLM install as suspect. The funding cluster arriving just before this story broke is a useful companion data point: three rounds announced within days of each other suggest investors increasingly see agent identity and runtime security as a distinct category, which is precisely the layer that would have mattered here.

Closing Thoughts

Put the five signals side by side, and a sharper question than “is this risky” emerges: who gets the capability, and which controls survive when it crosses a boundary? Gemini’s price cut moves capability closer to reflexive, disposable use. Qwen’s weights are downloadable, but its commercial rights are conditional, and its real context window is smaller than the headline number. DeepSeek’s API is generally available while its weights aren’t. Muse Glimmer moves inference off someone else’s servers and onto yours.

GPT-5.6-Cyber exists, but only for those who pass vetting. And the LiteLLM breach is what happens when a boundary nobody was watching — a build tool’s own dependency chain — turns out to be the one that mattered, arriving the same week investors started pricing exactly that risk as its own security category. None of this week’s releases were bigger models; all of them were about where the line sits and who’s on which side of it. Let me know what you think.

AI Agents Got Cheaper. Their Attack Surface Didn't.

Introduction

Frontier Models

1. Gemini 3.7 Flash Halves Its Own Price Tag, Flagship Still Waiting

Open Models and Inference

2. Qwen3.8-Max Opens Up, DeepSeek V4 Pro Exits Preview

3. Meta Ships Muse Glimmer for On-Device Agents

Security

4. OpenAI Gates GPT-5.6-Cyber Behind Vetted Access Only

5. LiteLLM Breach Turns Out to Be Five Months Bigger Than Anyone Knew

Closing Thoughts

References

References

Citation

AI Agents Got Cheaper. Their Attack Surface Didn't.

Introduction

Frontier Models

1. Gemini 3.7 Flash Halves Its Own Price Tag, Flagship Still Waiting

Open Models and Inference

2. Qwen3.8-Max Opens Up, DeepSeek V4 Pro Exits Preview

3. Meta Ships Muse Glimmer for On-Device Agents

Security

4. OpenAI Gates GPT-5.6-Cyber Behind Vetted Access Only

5. LiteLLM Breach Turns Out to Be Five Months Bigger Than Anyone Knew

Closing Thoughts

References

Enjoyed this? Get more like it.

References

Citation

Learn AI and Python without the hype