Introduction

One company claims its language model writes over a thousand tokens a second, two labs released Apache 2.0 coding models, and Microsoft and Anthropic both proposed ways to keep an AI agent on a leash. Fast, open and supervised is a reasonable wish list, rather like asking for a sports car that is also cheap and safe for the school run.

I will take them in the order they landed.

In this issue:

1. Mercury 3: A Diffusion LLM That Claims 1,000+ Tokens a Second
2. Beam 1.0 and Flint: Two Open Coding Models at Opposite Ends of the Size Scale
3. Microsoft Gives Agents Per-Task Permissions and Guardian Agents
4. Anthropic Circulates a Draft Frontier AI Safety Bill
5. Claude Duet: A Background Agent That Asks Before It Acts

---

Fast Models

1. Mercury 3: A Diffusion LLM That Claims 1,000+ Tokens a Second

Inception releases Mercury 3, its flagship diffusion LLM — Unite.AI, 19 October 2026

Inception released Mercury 3 on 19 October. It is a diffusion-based language model which generates text by refining many tokens in parallel rather than emitting them one after another. Inception claims over 1,000 tokens per second (1,068 on NVIDIA GPUs), a 1M-token context window (up from 260,000 for Mercury 2.5) and speeds 4–8x faster than comparable models. It also says Mercury 3 beats GPT-6 Luna and Claude Haiku 5.5 on various benchmarks, although the article does not name them.

The list price is $0.20 per million input tokens and $0.70 per million output tokens, halved until the introductory period ends. The API is OpenAI-compatible (mercury-3) and available through Inception, OpenRouter, Baseten and Vercel. Mercury 2 and 2.5 are closed to new users, and existing users keep access until 15 November. Nearly all of the speed and quality claims come from Inception or its early-access partners, and the one source I found for this launch is an article credited to an AI research agent and reviewed by editors. I would treat the numbers as a prospectus, not an audit.

Why this matters

Latency is the part of an agent loop I notice most. A model that takes ten seconds to answer makes a ten-step plan feel like waiting for a kettle to boil, ten times in a row. If Mercury 3’s speed holds up outside Inception’s own tests, fast, cheap models could become the default for routing, classification and quick tool-call steps, with a slower frontier model reserved for the hard parts. I would not rebuild anything yet. Run your own prompts through it and measure end-to-end time, error rate and cost per completed task, because speed that needs three retries is not speed.

---

Open Models

2. Beam 1.0 and Flint: Two Open Coding Models at Opposite Ends of the Size Scale

Reflection AI Beam 501B weights live, Apache download — TechJack Solutions, 16 October 2026

Recursive Flint local coding model — MarkTechPost, 21 October 2026

RecursiveSI/flint model card — Hugging Face

Reflection AI released the weights of Beam 1.0 on 16 October (the oldest item in this issue, at the edge of the seven-day window). It is a sparse mixture-of-experts model with about 501B total and 23B active parameters, a 1M-token context window and a focus on agentic coding, with BF16, FP8 and NVFP4 checkpoints on Hugging Face. Reflection describes the licence as Apache 2.0, which the reporting does not confirm independently, so check the model card before commercial use. The scores are self-reported, and VentureBeat, as relayed by TechJack Solutions, says Beam does not lead Terminal-Bench 2.1 against the top Chinese open models. The BF16 checkpoint is roughly 1 TB.

Five days later, Recursive released Flint, a mixture-of-experts model with about 39.8B total and 2.5B active parameters under Apache 2.0, confirmed on its Hugging Face model card. Recursive reports 74.2% on SWE-bench Verified (74.1% for the NVFP4 build) and, on the model card, 54.9% on Terminal-Bench 2.1, with the caveat that solutions found through web retrieval count as failures. The 4-bit weights take about 23 GB, so a 48 GB Apple Silicon Mac or a 48 GB NVIDIA GPU is enough, whereas serving the 80 GB BF16 checkpoint needs a B300 or H200 per replica. MLX, GGUF and Ollama builds exist, and there is a free hosted tier on OpenRouter.

Why this matters

Beam is a lorry, and Flint is a van. If you run a team with a GPU cluster and a compliance department that likes to keep code in-house, the lorry might earn its keep. For everyone else, a 2.5B-active model that fits on a workstation changes the question from “can I afford to self-host?” to “is it good enough for my repository?” I cannot answer that from a self-reported SWE-bench number, and neither can anyone else yet. Pull Flint, point it at a few real tickets from your own backlog, and compare the diffs with what your current assistant produces. That is an afternoon, and it will tell you more than any leaderboard.

---

Agent Security

3. Microsoft Gives Agents Per-Task Permissions and Guardian Agents

Microsoft 365 E7 AI agents and dynamic permissions — The Next Web, 19 October 2026

Microsoft expands Project Perception to detect and contain security risks from AI agents — TechDogs, 20 October 2026

On 19 October, Microsoft expanded Project Perception, which it introduced in July, with four controls for enterprise agents. Dynamic Permissions starts an agent with no access and grants only what one task needs, for the duration of that task. Dynamic Agent Risk scores each agent continuously from identity, data, device, cloud, network and behaviour signals. Dynamic Conditional Access extends Entra controls to agents and can escalate as risk rises, from removing write access while keeping read access to requiring human approval or stopping the agent. Guardian Agents check an agent’s actions before they run.

Discovery also grew: Microsoft says it can now detect 60 agent types on staff devices, 35 more than before, including Claude Code, Codex and GitHub Copilot, and Entra Agent ID gives each agent an identity separate from its user. Neither article says when any of this ships, whether it is in preview, or what it costs beyond a Microsoft 365 E7 licence.

Why this matters

Per-task, time-limited permissions are the sensible idea here, and you can adopt the principle without buying anything: an agent that inherits your full account is an intern handed the master key because it was easier than cutting a spare. Whether a monitoring agent watching a working agent is progress or a longer org chart, I will reserve judgment until independent tests show what Guardian Agents actually catch. If you are building agents yourself, give each tool call the narrowest credential you can and log every one. The fact that Microsoft now lists Claude Code and Codex as things to discover and govern tells you how your security team will see them next.

---

Governance

4. Anthropic Circulates a Draft Frontier AI Safety Bill

Anthropic pitches AI safety bill to lawmakers — Insurance Journal, 19 October 2026

Insurance Journal reported on 19 October that Anthropic drafted a bill reflecting its Advanced AI Framework and pitched it to US lawmakers. As reported, it would let the federal government block the release of a model judged to pose an imminent risk of killing or injuring more than 50 people or causing more than $1 billion in damage, through a biological weapon, loss of human control or a cyberattack (the threat categories are attributed to Politico). It would also require developers to test their models, publish the results, and allow routine review by independent evaluators. Anthropic says it has advocated the framework to federal and state lawmakers since June, and declined to say how widely it has circulated the draft or how it has been received. This is a draft proposal, not introduced legislation.

Why this matters

I read a company writing its own regulation with the usual mixture of welcome and raised eyebrow. I’d want published test results and independent evaluators from every lab, and a hard threshold is at least something you can argue with, unlike a vague promise of responsibility. The catch is that thresholds like “more than 50 people” rely on someone being able to estimate that risk before release, and the reporting does not say who does the estimating. For most developers, nothing changes this week, but if you build on frontier APIs, expect model releases to come with more documentation and more waiting, and design your product so that swapping the underlying model is a configuration change, not a rewrite.

---

Developer Tooling

5. Claude Duet: A Background Agent That Asks Before It Acts

Claude Duet — Anthropic, 21 October 2026

Anthropic announced Claude Duet on 21 October, a proactive agent app that sends a morning brief, monitors connected apps, messages you only when something needs attention and works in the background on a virtual machine with its own browser. It is a research preview, by waitlist, for US Pro and Max subscribers on iOS, Android and claude.ai, and background checks count towards your usage limits.

The design is the interesting part. Duet reads, drafts and prepares work freely, but shows you the exact action and waits for approval before it sends a message, makes a payment, signs a document or deletes anything, with Anthropic’s auto mode classifier checking each step. Some actions, such as trading securities or moving money between accounts, are blocked even if you approve them. Anthropic says the agent never sees your passwords or sign-in tokens, and that the product was red-teamed, externally penetration-tested and put under a public bug bounty. That’s Anthropic’s description of its own product.

Why this matters

Disclosure first: Claude helped me draft this blog, so weigh my enthusiasm accordingly. The pattern matters more than the product, though. Free to read, draft and prepare, but stopped at the door for anything irreversible, is the same shape as Microsoft’s per-task permissions, arrived at from the other end. If you build agents, copy it: make the cheap, reversible steps automatic and put a human approval in front of the expensive, irreversible ones. The unresolved question is approval fatigue, because a person who clicks “approve” forty times a day has stopped reading what they approve.

---

Closing Thoughts

Mercury 3 says speed is becoming its own product, Beam and Flint say open-weight coding models now come in sizes from a data centre to a desk, Microsoft’s controls and Duet’s approval gates both put the supervision inside the product, and Anthropic’s draft bill asks who gets to call a halt before release. Taken together, the week suggests the next competition is less about who can build the cleverest agent and more about who can show that theirs can be stopped. Let me know what you think.

---

References

1. Inception releases Mercury 3, its flagship diffusion LLM — Unite.AI
2. Reflection AI Beam 501B weights live, Apache download — TechJack Solutions
3. Recursive Flint local coding model — MarkTechPost
4. RecursiveSI/flint model card — Hugging Face
5. Flint free tier — OpenRouter
6. Microsoft 365 E7 AI agents and dynamic permissions — The Next Web
7. Microsoft expands Project Perception to detect and contain security risks from AI agents — TechDogs
8. Anthropic pitches AI safety bill to lawmakers — Insurance Journal
9. Claude Duet — Anthropic