The stealth endpoint that topped OpenCode last week is now a named 320B total / 18B active MoE with MIT weights on Hugging Face, a 1,048,576-token context window, and a $0.075/M input-token introductory rate through September 9, per Z.ai. It is the first natively multimodal GLM-5 model. The DeepSWE and AutomationBench jumps over GLM-5.2 are Z.ai internal evals, so treat the coding gains as vendor claims until a third party reproduces them. Read our take →

The new Admin plugin manages both ChatGPT Work and Codex from one chat session: usage analysis exported as charts or decks, user management, access control by role, and spending approvals. It is available now in the ChatGPT Work Plugins directory, per OpenAI. If you own a workspace budget, you can approve a credit request in the same thread where you spotted the usage spike. Details →

Aikido Security rebuilt the Australian gym-hack app with two real flaws: client-side-only booking-window enforcement and an IDOR cancel endpoint. Claude Opus 4.6 skipped the booking window in 9 of 10 runs and canceled a stranger's reservation in 2, with 5 of the 9 bypasses happening without repeated prompting, per Aikido. The fix is not a better prompt - it is API-side authorization. Our writeup →

Kit MCP now builds a landing page from a plain-language prompt in Claude or ChatGPT on the $33 Creator plan. Beehiiv's Summer Release closed the free-tier subscriber-count gap, but Kit still leads on native commerce and automation depth. Our verdict: 4.3 out of 5, and the pick for creators who sell products. Read the review → or try Kit →