Introduction
Six days is not long enough to build a reputation, but it was long enough for a nameless model on OpenRouter to make several labs’ fingerprinting tools work overtime before anyone admitted whose it was. In the same week, Claude Opus 5 went from scoring 30% on a benchmark to acing it without a single weight changing, and a 23-year-old’s AI assistant raised $250 million days after testers found it still reading their email once they’d disconnected it. The throughline, if there is one, is that the system wrapped around a model — the harness, the packaging, the terms of service — is doing as much work this week as the model itself.
I will take them in the order they landed.
In this issue:
- DeepSeek’s Vision Model Edges Toward Opus 4.8 on Three of Eleven Tests
- The Free Model That Wouldn’t Say Its Name
- NVIDIA’s Harness Turns a 30% Model Into a Perfect Score
- Anthropic Puts Its Most Cyber-Capable Model Behind Glass
- A 23-Year-Old’s AI Assistant Hits $2.5B, Days After It Wouldn’t Delete Your Email
Frontier Models
1. DeepSeek’s Vision Model Edges Toward Opus 4.8 on Three of Eleven Tests
DeepSeek unveils test model to rival Anthropic's Opus 4.8 — Bloomberg, 21 August 2026
DeepSeek published DeepSeek-V4-Flash-Vision-Exp on 21 August, an experimental multimodal variant of its text-only V4-Flash model that adds the ability to analyse images and screenshots. Per DeepSeek’s own launch benchmarks, the model edges Opus 4.8 on three of eleven agentic and multimodal tests — DeepSWE (59.3 vs 58.0), Agents’ Last Exam (27.3 vs 25.7), and ZeroBench Pass@5 (35.0 vs 34.0) — all by a single-digit margin of 1.0 to 1.6 points, while trailing by as much as 12 points on the hardest one, NL2Repo (57.7 vs 69.7). That’s a spread that headlines nicely as “DeepSeek rivals Opus 4.8” and matters rather less as a purchasing decision, since the three narrow wins and the twelve-point loss are unlikely to be the exact tasks your product runs. The model is live on DeepSeek’s API only; unlike the base V4-Flash, which shipped under a clean MIT licence, no open weights or licence terms have been published for this vision variant yet.
Why this matters
DeepSeek publishing a comparison against a named competitor with the losses left in makes this table more informative than the usual cherry-picked benchmark comparison — most labs that self-report benchmark tables leave out the categories they lose without saying so. That said, these are still vendor-run numbers with no independent launch-day evaluation, so I’d treat “beats Opus 4.8 on three of eleven” as a useful data point rather than a settled verdict; the wins are all narrow enough that a different prompt or sampling run could easily flip them. If your workload sits in vision-heavy agentic tasks, that’s worth a direct evaluation rather than a benchmark-table skim. The more telling detail is the API-only release: DeepSeek has trained developers to expect MIT weights within weeks of any preview, so an experimental model staying closed is itself a small signal about how far from finished this one is.
Open Models and Inference
2. The Free Model That Wouldn’t Say Its Name
Right as this week’s window opened, around 20–21 August, an unbranded model called Ox Alpha appeared on OpenRouter and the open-source terminal agent OpenCode, free for both input and output tokens, advertising a capacity of 100 trillion tokens a day and near-unlimited rate limits — the kind of offer that makes a free lunch look suspicious, because it usually is. Developer Ben Davis ran it through a small sample of the DeepSWE coding benchmark and scored it above 80%, against 65% for Claude Fable 5 and 52% for GPT-5.6-sol; he flagged the sample size himself, and a fuller run later settled the model roughly level with GPT-5.6-sol rather than clearly ahead of it.
The more interesting work was forensic. A developer known as unclecode built a fingerprinting tool called modelprint that probes anonymous API endpoints and compares the responses against known models. Ox Alpha matched Zhipu AI’s GLM-5.3 on six of nine infrastructure probes, including all four normalised tokenizer counts — no other candidate lab’s best guess cleared more than two. Unclecode was careful about what that proves, writing in the project’s own documentation that matching fingerprints demonstrate shared infrastructure, not confirmed identity. Zhipu, which now trades as Z.ai, had form for this: it previewed GLM-5 anonymously on OpenRouter under the name “Pony Alpha” ahead of that model’s release.
On 26 August, Z.ai confirmed what the fingerprint had strongly suggested and released GLM-5.3-Flash openly: a 320-billion-parameter, 18-billion-active mixture-of-experts model, natively multimodal, with a 1-million-token context window, MIT-licensed, and priced at $0.15 per million input tokens and $0.50 per million output tokens — competitive, per Z.ai, with Claude Opus 4.8 on at least one benchmark despite running on Chinese-made chips.
Alibaba's Qwen Team Releases Qwen3.8-Flash-Next — MarkTechPost, 26 August 2026
Alibaba releases smaller, cost-effective Qwen AI model — Bloomberg, 26 August 2026
The same week, Alibaba shipped its own open-weight news without the theatre. Qwen3.8-Flash landed 26 August as both a hosted API model and a downloadable checkpoint, Qwen3.8-Flash-Next, a multimodal MoE that Alibaba positions as an early preview of the coming Qwen4 architecture. The served version is a 125-billion-parameter language model with 6 billion parameters active per token; the open “Next” checkpoint adds 51 billion parameters of n-gram embeddings and 4 billion of multi-token-prediction components on top, for roughly 180 billion parameters if every piece is counted. Alibaba says training cost about a ninth of Qwen3.7-Plus while improving coding and office-task performance, with a default 262,144-token context expandable to 1 million, and positions it as competitive with Opus 4.6 and DeepSeek’s V4-Flash. It ships under the Qwen Community License 1.0: commercial use is broadly permitted, but products with more than 100 million monthly active users or $20 million in monthly revenue must prominently display the model name, and any organisation running the model as a service or as a coding or office AI assistant needs a separate licence from Alibaba first.
Why this matters
Two labs, one week, two entirely different routes to the same headline — Alibaba just published its numbers, while Z.ai spent six days letting the community run unpaid benchmark testing on a model with no name attached, then took the credit once the fingerprinting had done the marketing for them. I don’t think that’s dishonest exactly, but it’s a go-to-market pattern other labs will copy now that it’s worked twice for Z.ai, and it leaves an awkward question hanging: Zhipu AI has sat on the US Commerce Department’s Entity List since January 2025 over concerns about advancing China’s military AI research, and for six days enterprise code was flowing through Claude Code and other tools into an endpoint nobody could officially attribute. If you tested Ox Alpha on anything sensitive before 26 August, it’s worth checking your organisation’s policy on sending code to unidentified third parties, because “the community fingerprinted it eventually” is not the same thing as “the vendor disclosed it upfront.”
Benchmarks
3. NVIDIA’s Harness Turns a 30% Model Into a Perfect Score
NVIDIA AVO Reaches 100% on ARC-AGI-3 — NVIDIA Technical Blog, 21 August 2026
Anthropic Claude Opus 5 results — ARC Prize
NVIDIA published results on 21 August showing its AVO (Agentic Variation Operators) agent architecture completing the entire 25-environment ARC-AGI-3 public set — all 183 levels — with a perfect 100.00 RHAE score, using Claude Opus 5 as the underlying model. The number that matters here is the comparison: ARC Prize’s own leaderboard separately reports roughly 30% for Claude Opus 5 at High reasoning effort on the same benchmark. Same model, same benchmark family, a roughly 70-point gap associated with the agent system wrapped around it — though NVIDIA is explicit that this isn’t a controlled measurement of AVO’s individual contribution, since the two evaluations differ in reasoning setting, agent backend and evaluation setup, not just the harness. AVO carried the architecture over from a very different original job: a seven-day autonomous run on NVIDIA DGX B200 hardware optimising attention kernels, exploring more than 500 directions and producing kernels that beat cuDNN by up to 3.5% and FlashAttention-4 by up to 10.5%, using the same persistent-memory-plus-supervisor design. On ARC-AGI-3, AVO completed the public set in 6,624 environment actions, about 12% fewer than the previous leading harness, VISTA, used with the same model. NVIDIA is careful to flag the limits: this result covers the public set only, not ARC Prize’s semi-private or private held-out sets, and by the end of August three separate purpose-built harnesses — Tycho, VISTA, and now AVO — had each independently reached a perfect public-set score.
Why this matters
A 70-point swing from harness alone should recalibrate how anyone reads a benchmark leaderboard that lists only model names. “Claude Opus 5: 30% on ARC-AGI-3” and “Claude Opus 5 inside AVO: 100%” are both true statements about the same weights, and only one of them tells you anything about what a well-engineered product built on that model can actually do. I’d treat this as the clearest evidence yet that agent-system engineering — memory, recovery, supervision, tool design — is not a secondary concern bolted on after choosing a model, but a lever comparably large to the model choice itself. The caveat about the public-only set matters too: a benchmark specifically built to resist memorisation is exactly the kind of test where three harnesses converging on 100% within a month should prompt questions about whether the public set has become gameable, not just about whose harness is best.
Developer Tooling and Security
4. Anthropic Puts Its Most Cyber-Capable Model Behind Glass
Anthropic Brings Claude Mythos 5 to Claude Security — MarkTechPost, 21 August 2026
Bringing Claude Mythos 5 to more defenders — Claude by Anthropic, 21 August 2026
As of 21 August, Claude Security — Anthropic’s code-scanning product — runs on Claude Mythos 5, the Mythos-class model that until now reached only vetted defenders through Project Glasswing. Anthropic describes Mythos 5 as its most capable model for cybersecurity and biology research — state of the art enough that, in the roughly 50-partner Project Glasswing preview, it had already been used to find more than ten thousand high- or critical-severity vulnerabilities across systemically important software. That’s precisely why it hasn’t been generally available before now. The trick in this release is packaging rather than restraint: a user connects a GitHub repository, Mythos 5 traces data flows and reads commit history in the background, and each finding passes an adversarial self-verification step — the model checking its own result — before it surfaces with a CWE category, confidence and severity rating, and a suggested patch. There’s no prompt box. You get a scan result, not a conversation, so there’s no interface through which to ask the same model that finds an exploit to go ahead and write one. The feature is public beta for Claude Enterprise customers only, billed as standard token usage with no separate model add-on; Pro, Max, and Team customers don’t get Mythos-powered scans, and the separate Claude Security plugin for Claude Code runs on whatever model is already in the user’s account. Alongside the upgrade, Anthropic launched the Defender Advantage Fund, offering $35 million in Claude credits to organisations securing open-source software, and said it will expand its Cyber Verification Program to cover broader dual-use capabilities on Opus and Sonnet over the coming weeks, with Mythos-class access to follow.
Why this matters
Anthropic’s framing — that risk concentrates in the interface rather than the capability, so a scan result is safe where a prompt box wouldn’t be — is a genuinely interesting bet, and one other labs holding back their most capable models will be watching closely. I find it more persuasive than most “safety through packaging” arguments, mainly because the constraint is structural rather than a policy promise: there’s no text field to type an exploit request into, which is a stronger guarantee than “we’ve asked the model nicely not to.” The open question is durability. A model this capable at finding vulnerabilities is presumably just as capable at noticing when its own output could be repurposed, and packaging decisions tend to get renegotiated the moment a product team finds a legitimate use case that needs a prompt box after all.
Finance and Capital Markets
5. A 23-Year-Old’s AI Assistant Hits $2.5B, Days After It Wouldn’t Delete Your Email
Viral AI startup Instinct has raised $350M at a $2.5B valuation — TechCrunch, 26 August 2026
Instinct, a year-old startup run by 23-year-old former Sierra researcher Noah Shinn, raised a $250 million Series B on 26 August co-led by Index Ventures and Benchmark, taking total funding to $350 million and its valuation to $2.5 billion. The product is a personal-assistant agent reachable by text, WhatsApp, or phone call: connect it to email, calendar, messaging apps, and a device’s audio, location, and screen, and it books travel, cancels subscriptions, clears an inbox, and — per Shinn’s own account — has been used to plan a wedding.
It remains in private beta. Two days before the raise, on 24 August, TechCrunch reported a string of concerns from early testers: Instinct’s terms of service grant it a “perpetual and irrevocable” sub-licensable licence to access, store, and use a user’s materials, including for training its own models, plus the ability to capture screen contents, cursor movements, and keystrokes, and to enter binding agreements on a user’s behalf.
The complaints weren’t hypothetical. One tester found Instinct wouldn’t delete his Gmail records on request, until the team added a delete tool. Another disconnected her Google account and was still receiving inbox summaries three hours later; asked what happened, the bot told her the emails were stored in plain text for later searches. A third tester deliberately phished his own account to test the agent’s susceptibility, then deleted his account afterwards. Instinct’s team hadn’t publicly responded to any of this on X by the time the funding news broke, though it told the Wall Street Journal after publication that it was taking the concerns seriously.
Why this matters
A $2.5 billion valuation landing in the same week as a documented case of an agent ignoring a delete request is the clearest evidence yet that capability and hype are still outrunning public scrutiny of what these agents are actually permitted to do with your data. I can’t say what Instinct’s investors knew or when — funding rounds like this are typically negotiated well before the announcement, so the privacy story breaking two days before the round became public doesn’t tell us it factored into anyone’s decision. What it does show plainly is how differently the market and Instinct’s own users are currently weighing agent capability against data-governance risk: a $2.5 billion valuation on one side of that gap, a user deleting his account after testing how easily the bot could be phished on the other, in the same seventy-two hours.
If you’re evaluating any agent that asks for this level of access, whether for yourself or your organisation, read what happens after you disconnect it before you read what it does while connected; “stored in plain text for later searches” after a user revokes access is the sentence that should worry you more than anything in the product demo.
Closing Thoughts
This week made the model itself feel almost like the middle layer. What sat above it — the harness, the interface, the permissions a user granted — determined what people could actually accomplish with it: NVIDIA’s harness turned a 30% model into a perfect score, and Anthropic’s scan-only interface turned its most cyber-capable model from something withheld into something enterprises could switch on themselves. What sat below it — the serving infrastructure, the licence, an unidentified provider — determined what organisations were actually trusting: Ox Alpha ran on Claude Code and other developer tools for six days before anyone could officially say whose weights those were, and Instinct asked for perpetual, irrevocable access to a user’s inbox in exchange for a personal assistant that, by one tester’s account, kept reading his email after he’d disconnected it. DeepSeek’s honest scoreboard and Alibaba’s straightforward Qwen release sit in between, a reminder that not every story this week was about obscured layers — some labs just published their numbers and got on with it. Let me know what you think.
References
- DeepSeek unveils test model to rival Anthropic’s Opus 4.8 — Bloomberg
- DeepSeek releases experimental Flash Vision model that rivals Opus 4.8 on agent benchmarks — The Decoder
- DeepSeek says new AI model V4-Flash-Vision-Exp comes close to Anthropic’s Opus 4.8 — Seeking Alpha
- Nobody knows who built AI coding model Ox Alpha or where the code goes — SiliconANGLE
- unclecode/modelprint — GitHub
- Z.ai Confirmed as the Mystery Lab Behind Ox Alpha: GLM-5.3-Flash Is Now Open-Source — Intelligent Living
- Z.ai Releases GLM-5.3-Flash: A 320B-A18B Natively Multimodal MoE With a 1M-Token Context — MarkTechPost
- Z.ai launches GLM-5.3-Flash under MIT license — TestingCatalog
- Alibaba’s Qwen Team Releases Qwen3.8-Flash-Next — MarkTechPost
- Alibaba releases smaller, cost-effective Qwen AI model — Bloomberg
- NVIDIA AVO Reaches 100% on ARC-AGI-3 — NVIDIA Technical Blog
- Anthropic Claude Opus 5 results — ARC Prize
- Anthropic Brings Claude Mythos 5 to Claude Security — MarkTechPost
- Bringing Claude Mythos 5 to more defenders — Claude by Anthropic
- Claude Mythos — Anthropic
- Viral AI startup Instinct has raised $350M at a $2.5B valuation — TechCrunch
- Instinct’s powerful AI assistant is raising privacy and security concerns — TechCrunch
Enjoyed this? Get more like it.
Weekly notes on AI tools, Python, and what I'm actually building — plus two free gifts: the 15-page Fantastic AI: The 2026 Toolkit and a Git Commands & Contribution Workflow Cheatsheet.
