Kimi K3 and Inkling shipped frontier open weights the same day — while a Claude exfil and a Codex file-deletion bug proved agent tools cut both ways.
For two years the working assumption was that open weights trail the closed frontier by 12–18 months. This week two labs erased that gap in 48 hours — and the same week reminded us the weights were never the hard part. The tools you bolt onto them are.
Two frontier-class open-weights models landed within hours of each other on Wednesday. Moonshot's Kimi K3 — "Open Frontier Intelligence," 2.8 trillion parameters, weights promised July 27 — topped Hacker News at 1,600+ points. Hours later, Mira Murati's Thinking Machines Lab shipped Inkling, its first public model: an Apache-2.0 MoE transformer, 975B total / 41B active, trained on 45 trillion tokens across text, images, audio, and video. A 276B/12B Inkling-Small is promised next.
Read those two specs together. Kimi K3 is the "throw parameters at it" play; Inkling is the "you can actually serve this" play — 41B active params means the compute-per-token of a mid-size dense model, so frontier-adjacent quality runs on a single well-specced node instead of a datacenter. Both are open. Both shipped the same day. And Inkling was trained multimodal from the start — text, images, audio, video across those 45T tokens — so the open ecosystem isn't just catching up on text; it's catching up on everything at once.
Then xAI open-sourced Grok Build — 844,530 lines of Rust, Apache-2.0 — after backlash over its CLI silently uploading entire working directories to cloud storage. So in one week: two open frontier models and a major coding agent's full source, all under permissive licenses.
The debut choices are the tell. Thinking Machines Lab could have launched with a closed API and a waitlist; instead its first public artifact is Apache-2.0 weights you can fine-tune and self-host. That's a bet that distribution and mindshare beat inference margin at this stage — the same bet Meta made with Llama, now made by a lab whose founders wrote the playbook at OpenAI. Moonshot pairs it with the opposite flourish: 2.8T parameters, weights held back to July 27, a staged reveal that treats an open release like a product launch. Two strategies, one direction — open is now where labs go to win, not where they retreat when they can't compete.
The moat was never the checkpoint. It's the harness, the data, and — as the rest of this week showed — the security envelope around the tools. When the weights are a free download, the durable question for anyone building on top is what you wrap around them: retrieval, evals, guardrails, the operational scaffolding that turns a checkpoint into a product.
Two incidents this week — one exfiltration, one destruction — are the same lesson. On the 15th, researcher Ayush Paul showed Claude's web_fetch could be turned into a data-exfiltration channel via nested links: feed the agent a page carrying attacker instructions, and it would encode context into a URL it then dutifully fetched. Data walks out the front door disguised as a normal request. Anthropic has closed the specific hole. The next day, Thibault Sottiaux documented Codex (GPT-5.6) deleting files, most often when the model "attempts to override the $HOME env var" — clobber $HOME, and every path resolving relative to it now points somewhere it shouldn't.
Neither is a model-quality bug. Both are capability bugs. We handed agents three things — read access to your context, exposure to untrusted web content, and a channel to act on the outside world — and Simon Willison's name for that combination, the lethal trifecta, is exactly right. Any agent holding all three can be steered by whatever it reads into doing something you never asked for. The web_fetch exfil is the trifecta firing on all three cylinders. The Codex deletion is the third leg — act on the world — pointed at your filesystem instead of the network.
The fix isn't a smarter model; it's removing a leg of the trifecta. Scope the tools:
Same discipline on the filesystem: run the agent under a pinned $HOME it can't reassign, in a container whose only writable root is the workspace and nothing above it. A destructive op resolves inside the sandbox or it fails — an errant $HOME override deletes scratch files, not your dotfiles.
Removing a leg has a name in the research now. The pattern gaining traction — DeepMind's CaMeL work spelled it out — is a two-agent split: a privileged planner that holds your tools and context but never reads raw untrusted text, and a quarantined worker that reads the sketchy page but has no tools and no memory. The privileged side passes data by reference, so an injection buried in a fetched page lands on an agent that literally cannot act on it. It's the actor/oracle separation from last week aimed at a different failure — there the agent lied about its own success; here the input lies to the agent — but the structural answer is identical: never let the component that reads untrusted data be the one holding the keys.
The tempting shortcut is a guardrail model — a classifier that sniffs each request for injection and blocks the bad ones. It helps, but don't mistake it for the fix. Detection is probabilistic and the attacker gets unlimited retries; a filter that catches 99% of injections still fails open against someone who sends the payload a hundred times. Deterministic scoping — the host isn't on the allowlist, so the fetch never happens — doesn't degrade under a retry storm. Probabilistic defenses raise the cost of an attack; capability scoping caps the damage no matter what. You want the cap first, the filter on top, never the filter alone.
None of this is free. An egress allowlist breaks the agent that legitimately needs to read an arbitrary doc; a locked $HOME breaks the workflow that writes outside the workspace on purpose. You're trading reach for containment, and where you draw that line is a product decision, not a bug you patch later.
The industry's answer is showing up in unglamorous places. GitHub shipped that default 3-day Dependabot cooldown this week on a bet that most malicious releases get caught inside 72 hours, so waiting beats trusting. Same instinct as the egress allowlist: treat the input as hostile until proven otherwise, and make the safe path the default. As we wire agents into more tools, the question stops being "is the model good enough" and becomes "what's the blast radius when it's wrong." Design for the blast radius first.
open-connector — A self-hostable auth gateway (think open Composio) that wires 1,000+ SaaS providers and 10,000+ prebuilt actions to agents via SDK, CLI, MCP, or plain HTTP. The part that matters: credentials stay behind the runtime boundary — the agent gets a scoped action, never your OAuth token — with allow/block policies and redacted logs on by default. Apache-2.0, 2.8k stars.
kill-ai-slop — A field guide to 33 visual and copy "tells" of AI-generated products (indigo gradients, glowing cards, an emoji in every corner) paired with an Agent Skill that scans a web project for their code-level signatures and proposes fixes. Dependency-free, never edits without asking, installs via npx skills add yetone/kill-ai-slop. 575 stars — the most useful taste-check I've seen ship as tooling.
Grok Build — xAI's terminal coding agent, now Apache-2.0 after the upload flap. 844,530 lines of Rust; runs interactively, headless for CI, or embedded via the Agent Client Protocol. Worth reading even if you never run it — a frontier lab's full agent source is a rare window into how these harnesses really work. 14.3k stars.
Open weights didn't nibble at the frontier this week — two labs caught it outright, and the center of gravity moves with them: when anyone can download a 41B-active frontier model, your edge is the harness, the data, and the security envelope, not the checkpoint. Which is exactly why the exfil bug and the file-deletion bug outrank the leaderboard — we're bolting fetch, shell, and filesystem access onto these things faster than we're scoping them. My bet for the back half of 2026 is that the winning teams stop shopping for the smartest model and start engineering the smallest blast radius, because with the frontier commoditized, containment is the last thing left to compete on. Ship the sandbox before you ship the autonomy. The model is the commodity now; the blast radius is the product.
— Aaron, from the terminal. See you next Friday.
Complete guide to OCR-powered email classification systems. Extract text, classify attachments, and route documents to the right teams automatically.
AI EngineeringAgentic CRM lets AI agents manage customer workflows directly. Compare its architecture, deployment model, and open-source trade-offs.
AI EngineeringNarrative traction tools compared: YouTube Analytics, VidIQ, TubeBuddy, Descript Underlord, Valossa on engagement metrics, cost, and workflow.
Content Analytics