|
|
MODEL
MAJOR
2026-07-27
Kimi K3 open weights — Moonshot drops the 2.8T MoE on Hugging Face
The largest open-weight AI model in history — 2.8T Kimi K3 is now free to self-host.
What is it?
Kimi K3 is Moonshot AI's flagship mixture-of-experts model with 2.8 trillion total parameters and 104 billion active per token, and on July 27 its full weights went live on Hugging Face for anyone to download and run. That makes Kimi K3 the largest permissively licensed open-weight AI model ever released.
How does it work?
Under the hood, Kimi K3 uses 896 experts with 16 activated per token and a 1-million-token context window. MoonViT-V2, a 401M-parameter vision encoder, ships in the same weights so the model handles text, images, and video natively; the download is ~594 GB in MXFP4 format.
Why does it matter?
Self-hosting Kimi K3 gives teams that could never send data to a Chinese API the same 2.8T-parameter reasoning and 1M-token context inside their own network. Nathan Lambert argues in Interconnects that the frontier open-to-closed gap has narrowed from 6–9 months down to 3–5.
Who is it for?
AI labs, sovereign-compute buyers, and self-hosters with 8+ H100s — ships under a modified MIT license.
|
|
|
|
ARTICLE
MAJOR
2026-07-27
Anthropic's position on open-weights models — Amodei backs targeted rules, not a ban
Dario Amodei says Anthropic has never asked to ban open weights — and names three targeted moves it would back instead.
What is it?
Anthropic's July 27 blog post, signed by CEO Dario Amodei, is the company's first formal top-of-house statement on how open-weight AI should be regulated — published the same day Moonshot AI released the 2.8T Kimi K3 weights.
How does it work?
Amodei calls capability-limited open-weight models "a public good," then lists three targeted policies: tighten chip export controls, pursue legal frameworks against industrial-scale distillation of US frontier models, and require mandatory pre-release safety testing for all sufficiently capable models — open or closed.
Why does it matter?
Anthropic's position reframes the US debate from open-versus-closed to capability-versus-risk: the mandatory safety-testing ask applies to closed frontier models too, and lands one day after NVIDIA's 50-signatory open-weights letter went out without Anthropic's signature.
Who is it for?
AI policy staff, open-weight maintainers, and anyone tracking US-China AI regulation.
|
|
|
|
ECOSYSTEM
MAJOR
2026-07-27
Open Secure AI Alliance — 50-company coalition open-sources AI security tools
A cross-industry alliance to give cyber defenders open AI models and agent frameworks they can inspect, run, and modify.
What is it?
The Open Secure AI Alliance (OSAIA) is a 50+ member coalition launched by NVIDIA on July 27 to build and share open tools for defending software and AI agents. Founding members span cloud, security, and AI research: Microsoft, IBM, Red Hat, Cisco, CrowdStrike, Palo Alto Networks, Hugging Face, Palantir, and the Linux Foundation — notably absent are OpenAI, Anthropic, and Google.
How does it work?
Members contribute production-grade open code any defender can adopt. NVIDIA opened NOOA, a Python framework for building and auditing AI agents (Apache-2.0); Microsoft added MDASH, a multi-agent vulnerability scanning harness; IBM and Red Hat contributed Lightwell for distributing digitally signed patches across open-source supply chains.
Why does it matter?
Enterprise security teams have relied on closed AI stacks they cannot inspect. OSAIA gives defenders open alternatives they can run inside their own perimeters — inspect the weights, adapt the agent code, audit every prompt.
Who is it for?
Security engineers, platform teams, and AI infrastructure operators who need auditable, self-hostable security tooling.
|
|
|
|
MODEL
MAJOR
2026-07-27
Microsoft MAI-Cyber-1-Flash — 96% on CyberGym at half the price of the GPT-5.4 stack
Microsoft's new security-specialist model plugs into MDASH and finds bugs cheaper and better than a GPT-5.4 stack.
What is it?
MAI-Cyber-1-Flash is a compact, code-heavy security model derived from the MAI-Thinking-1 reasoning family and shipped inside MDASH, Microsoft's multi-agent vulnerability scanning harness. It is not available as a standalone API — enterprise teams get it as part of the MDASH platform with built-in tenant isolation and audit controls.
How does it work?
Inside MDASH, over a hundred agents explore a codebase, plan attacks, and try patches. MAI-Cyber-1-Flash handles ~90% of those steps on its own; only the hardest 10% route to GPT-5.4 for a final call. Microsoft tuned it on the ~100 trillion daily security signals it sees across Windows, Azure, and Microsoft 365.
Why does it matter?
On CyberGym, the new MDASH stack scores 96% — about 12 points above Anthropic's Mythos — while cutting inference cost roughly in half versus the previous GPT-5.4-heavy configuration. Cheaper autonomous bug-finding means large SOCs can afford to scan critical codebases continuously instead of on a schedule.
Who is it for?
Enterprise security teams, SOC engineers, and red teamers on Microsoft 365 or Azure — available now inside the MDASH platform.
|
|
|
|
SECURITY
MAJOR
2026-07-27
Claude shared chats surfaced in Google Search — Anthropic patches missing noindex tag
A missing meta tag on Claude's shared-conversation pages let Google and Bing index private chats.
What is it?
Claude's shared-conversation pages (claude.ai/share) carried no noindex directive, so once a share link appeared on any public site — a tweet, a forum, a Slack export — search engines were free to crawl and rank it. A Reddit post on July 25 showed hundreds of strangers' conversations indexed under site:claude.ai/share.
How does it work?
Anthropic's robots.txt blocks crawlers from discovering URLs on their own, but the share page itself lacked a noindex tag. Once a URL leaked onto any indexable page, Google and Bing crawled the target — surfacing resumes with real names, API keys, crypto wallet details, medical diagnoses, and internal company documents.
Why does it matter?
This is a class of privacy failure users can't easily audit — the chat was shared, so nothing looked wrong, but the audience quietly expanded to anyone typing the right Google query. Anthropic added the noindex tag on July 27 and Google delisting is largely complete, but cached copies and third-party scrapes captured during the window are permanent.
Who is it for?
Anyone who has used Claude's share feature — review your shared conversations and unpublish any that contain sensitive data, credentials, or personal information.
|
|
|
|
TOOL
MAJOR
2026-07-27
Cohere North Automations — plain-English AI workflows across enterprise systems
Cohere adds a workflow orchestrator to its enterprise North platform, so teams can chain AI agents across their own systems from a plain-English brief.
What is it?
North Automations is a new module inside Cohere's North enterprise AI platform. Instead of deploying one-off, single-task agents, users describe a goal in plain language and North compiles it into a multi-step workflow spanning tools like Salesforce, Slack, Gmail, Notion, and BigQuery. It is live for every existing North customer at launch.
How does it work?
A plain-language brief compiles into a workflow with branching logic, loops, and scheduled runs. Plan Mode shows the intended steps before execution, human approval checkpoints gate sensitive actions, and each step picks its own model to balance cost against quality — all with versioning and token analytics.
Why does it matter?
Most enterprise AI so far has been a scatter of single-task agents that never finish a real job. North Automations targets what Cohere frames as a $550B agent orchestration market: end-to-end workflows that mimic an employee's cross-system work, auditable, versioned, and with humans in the loop where it matters.
Who is it for?
Cohere North enterprise customers — available now on SaaS, on-prem, or hybrid cloud.
|
|
|
|
MODEL
MAJOR
2026-07-26
KAT-Coder-V2.5-Dev — Kwaipilot's 35B open-weight agentic coding MoE
Kwaipilot opens the weights of a 35B/3B-active MoE tuned to act inside real code repositories, not just autocomplete a snippet.
What is it?
KAT-Coder-V2.5-Dev is an open-weight agentic coding model from Kwaipilot, the AI4SE team at Kuaishou. The Dev variant is a mixture-of-experts model with 35B total and 3B active parameters, published on Hugging Face under Apache 2.0 — the open sibling of the closed KAT-Coder-V2.5-Pro served via StreamLake.
How does it work?
Built on Qwen3.6-35B-A3B, the model is post-trained with supervised fine-tuning plus reinforcement learning with asymmetric PPO across 100,000+ verifiable executable repositories in 12 languages — trained to open files, run tests, and iterate inside a real repo rather than emit single-turn snippets.
Why does it matter?
KAT-Coder-V2.5-Dev's 69.4% score on SWE-bench Verified puts it near the top of the open-weight pack without an API bill. Teams can run full repo-level automation on their own hardware under an Apache 2.0 license.
Who is it for?
Coding-agent builders, open-source infra teams, and self-hosters who want a permissively-licensed 35B MoE for repo-level automation.
|
|
|
All releases at ai-tldr.dev
Simple explanations • No jargon • Updated daily
|
|
