The model stopped being the variable
How we organise
Fugu (Sakana AI, with Moonshot’s Kimi Code)
Fugu is not a base model. Sakana calls it “a Multi-Agent System, Delivered as One Model”, which dynamically coordinates a pool of powerful models behind a single OpenAI-compatible API with no SDK migration to reach it. The published figures put Fugu Ultra at 82.1 on TerminalBench 2.1 against an Opus 4.8 baseline of 74.6, and 73.7 on SWE-Bench Pro against 69.2. A Fugu Cyber variant is specialised for cybersecurity reasoning. On Fugu, though not on Ultra, specific models can be opted out of the pool from the console. Kimi Code makes the cheap end of the same idea a configuration line. It adds a “second model pointer next to the primary default_model”, typically a cheaper one, which newly spawned subagents bind to by default rather than inheriting the orchestrator’s. The feature is experimental, and off by default.
Structure: the architecture question has moved from which model to how you conduct several of them. Once orchestration is the unit, cost, quality and vendor optionality stop being a capability bet and become an organising decision that somebody has to own. The expensive-orchestrator, cheap-worker split stops being a craft skill an individual engineer picks up and becomes something a firm declares and governs. Note which control Sakana shipped first. Opting a named model out of the pool is what a regulated buyer asks for before anything else.
Ask who in your firm decides which model handles which class of work, and whether that decision is written anywhere. In most firms it currently lives in whatever each team put in its config.
DeepSeek founder Liang Wenfeng, in a Tencent Tech investor transcript (Hello China Tech)
DeepSeek has not confirmed the record. Everything in it is therefore attributed rather than established, and we would treat any single figure below as a claim made by an interested party. Liang reduces the gap between American and Chinese AI to one variable. In his words, “all the differences we see, including talent, model capability, and applications, can be attributed to differences in compute resources.” The round exceeds ¥50 billion, roughly 7.4 billion dollars. He states the payback on hardware plainly, that “we buy a batch of equipment, and it pays for itself in about ten months”. Half the core research team, he says, is labelling data by hand. Team stability is “our single biggest core interest”, and the money went into larger option grants. He also stakes a falsifiable one-year position on domestic silicon, that Huawei’s 950 super-node “can fully replace Nvidia’s GB200 and GB300 in performance and price”, at roughly four Huawei chips to one Nvidia chip.
Finance: reducing the problem to compute is convenient for someone who has just closed a multi-billion-dollar round, because a problem with a price tag is a problem capital can solve. The structural claim underneath deserves more attention than the valuation does. If the cost of inference falls faster than the cost of training, the defensible position moves from who can afford to train a frontier model to who can serve one at the lowest marginal cost. Giving the weights away then stops looking like altruism and starts looking like a distribution strategy with the margin kept downstream.
Take your AI business case and find the line that assumes what inference will cost in three years. That assumption is doing more work than the model choice above it.
How we build
AMD and Cerebras announce ultra-low-latency inference (Cerebras)
Announced at Advancing AI 2026, the joint system stops treating inference as one workload. AMD’s Helios rack takes the prompt side, “processing prompts and large context windows”, and the Cerebras Wafer-Scale Engine accelerates “the memory-bandwidth-intensive token generation”. The two phases have opposite hardware appetites, so running both on one cluster means over-provisioning for whichever you optimise against. The headline claim is up to five times the tokens per second per watt. The footnote carries more information than the number, because the comparison is a Helios rack plus Cerebras WSE against a Cerebras-only configuration rather than against a GPU fleet. Cerebras plans to deploy Helios in its own data centres, and the combined system is expected through Cerebras Cloud in the second half of 2026.
Architecture: splitting a workload across hardware chosen for each phase is an old idea arriving somewhere new, and it marks the point at which serving architecture becomes a cost lever rather than a procurement detail. None of it comes free. Two hardware profiles mean one scheduler that understands both, a handover between them, and a class of failure that exists in neither half alone. The trade is operational simplicity for unit economics, which is a reasonable trade to make and a poor one to make by accident.
Find out whether anyone has costed your inference workload by phase rather than as one number. If not, you cannot tell whether this trade is available to you.
Scaling agentic reinforcement learning (Prime Intellect)
Roughly 365,000 agentic reinforcement-learning tasks sit behind one interface, across 23 tasksets, of which about 198,000 tasks are software engineering in twenty or more languages. They are served from a single registry of some 135,000 prebuilt task images, with a verifiers abstraction decomposing an environment into a taskset, a harness and a runtime. The agent under training shares a sandbox with the machinery that grades it, so every integration withholds the grading material, test patches, expected outputs and grading scripts, until scoring time. The company states the limit of that defence itself. Withholding “raises the bar significantly, but as long as grading runs where the agent lives, it’s mitigation, not a guarantee.”
Engineering: that last sentence is the one worth reading twice. As building shifts from writing code to specifying and verifying it, the evaluation harness becomes part of the product, and its integrity becomes an engineering discipline of its own. A team standing up coding agents now owns two systems, the build and the thing that judges the build, and the honesty of the second is what stops the first quietly gaming its own tests.
Ask whether your agents’ tests and their code are produced by the same process. Where they are, you have one system marking its own homework.
How we assure
ChatGPT Voice reached the desktop (9to5Mac, with further coverage of the same release)
It rolled out globally on 23 July, on macOS and Windows, to the Plus, Pro, Business, Edu and Enterprise plans. It runs on GPT-Live, which can “speak, listen, and coordinate work in the app at the same time”, and the rigid turn-taking of earlier voice modes is gone. That is the part being marketed. What the voice is pointed at matters more. The offer is to “control your computer and direct multiple agents running in ChatGPT Work or Codex, using just your voice”. Put flatly, “anything you can do with Codex, you can now drive through voice”. It reaches local files, plugins and the Computer Use feature, and on macOS an Appshot lets it read whichever window is in focus. A user can launch tasks, check work already running and adjust agents in parallel threads, across connected tools such as Slack, GitHub and Notion.
Security: for a decade the voice interface was a way of asking a system a question, and the worst outcome of getting it wrong was a bad answer. It is now a way of dispatching work to processes that write files, call services and act on an estate. Nothing in the usual authorisation model was designed for that channel. There is no typed record of what was asked and no diff to read before the thing runs, and the latency budget actively discourages putting a confirmation step in the way. Speech is the least auditable input an enterprise has ever wired directly to an execution path, and it arrived as a routine product update on enterprise tiers rather than through a procurement decision anyone reviewed.
Check which of your enterprise AI tiers received this in the rollout, and what an audit trail of a voice-dispatched action would actually contain.
SymptomAI (Google Research), against OpenAI connecting ChatGPT to patient health records
In the Google study, 13,917 consenting participants each interacted with one of five Gemini Flash 2.0 agents, which ran an end-to-end symptom interview and produced a differential diagnosis. Three board-certified clinicians ranked the results blinded, and the agent’s differential was “preferred significantly more for 1st Best position at 53.3 percent”. Every condition in which the agent asked its own follow-up questions significantly outperformed the unprompted baseline, and wearable biosignals in the days before a conversation showed shifts consistent with symptom onset. The paper states its own limits: the clinicians read static transcripts and could ask nothing themselves, and the study could not control for the frequency and timing of symptom reporting. OpenAI, meanwhile, put health inside ChatGPT itself. Logged-in United States users aged 18 and over on Free, Go, Plus and Pro can connect Apple Health and, where supported, records from hospital systems, One Medical or Function Health. It puts weekly health-related questions at north of 300 million people, and says connected records are excluded from foundation-model training and ad targeting whatever the user’s other settings say. An earlier dedicated health space was simply bypassed, with more than 70 per cent of health conversations happening outside it. OpenAI says it built the scenarios and scoring rubrics with hundreds of physicians and had physicians test the live product before release, and has not published the methodology or the results.
Risk: we read both as diligent, so the difference that matters is not care but exposure. Google published a participant count, a blinded protocol, a comparison group and a list of what its own study could not control. It published enough, that is, for someone else to disagree with it. OpenAI asks to be taken at its word, at a distribution several orders of magnitude larger. Neither is negligent. Only one is checkable, and in a regulated domain checkability is the whole of the assurance argument.
Take your own most-cited AI result and ask what an outsider would need to disagree with it. Where the honest answer is nothing you would be willing to release, what you are holding is a claim rather than evidence.
AI Agents at Work 2026 (Okta)
Fielded in March across seven countries with 292 executives and 492 knowledge workers. Ninety per cent of executives are confident in their organisation’s visibility into AI tools, and 95 per cent are confident employees use AI responsibly. Against that, 52 per cent of employees admit using AI tools without approval, rising to 67 per cent among American workers. Of those, 54 per cent share internal messages and emails, 45 per cent share HR information, and 39 per cent share confidential company documents. More than a fifth share credentials. Only 34 per cent of organisations apply the same security controls to their agentic workforce as to their human one. Fifty-eight per cent of executives report an AI-related security issue or close call in the past year.
Security: the number worth sitting with is not 52. It is the distance between 95 and 52, because that gap does not close with better communication. Executives are describing the system they designed and employees are describing the system they use, and both are answering honestly about different things. That is the ordinary condition of a control written down and never wired to anything that could fail. The 34 per cent is the operational half of the same finding. Most firms already own identity, least privilege, joiners and leavers, audit and revocation. They have simply not pointed any of it at the non-human workforce now doing the work.
Take one control you trust for your people, revocation on leaving, and ask what the equivalent is for an agent. Then ask who would run it.
Research briefing with Brian Houck (DX)
Houck holds that the DX Core 4 “still provides a useful foundation” but has to be reinterpreted for AI-assisted development, with the focus on business outcomes rather than activity. Token usage is not a productivity measure. Pull-request throughput “tells only part of the story”.
Risk: measurement is the assurance layer, and we find it is the one most organisations have not rebuilt. When the agent is doing the work, the question stops being whether people adopted the tool and becomes whether the system produces good outcomes without gaming the metric watching it. Every item above says the same thing from a different angle. Capability travels through products, arriving on enterprise tiers as an update nobody approved. Control travels through programmes, which have to be funded, staffed and sequenced before anything moves at all.
Look at the last AI progress report your organisation produced and count how many of its numbers measure activity rather than an outcome. That ratio is your measurement problem, stated.