Weekly Hallucinations: Kimi K3 open weights, Gemini Robotics 2 and a cheaper GPT 5.6

Dario wrote a clear piece about open weights. As usual, Twitter read exactly one paragraph, and after 7.6 million views, the headlines were reduced to “Anthropic demands a ban on open models.” Let’s unpack this.

On July 27, as promised, Moonshot released the Kimi K3 weights. I covered the model itself two weeks ago, when it became available through the API, so what arrived alongside the weights is more interesting: FlashKDA (kernels for their attention mechanism), MoonEP (a library for data exchange between experts), and AgentENV (infrastructure for training agents in sandboxes). There is also a technical report, which people on Twitter said you only need to open if you want to feel stupid.

Within half an hour, the page was at the top of the Hugging Face trending list. An hour later, r/LocalLLaMA had a thread with three thousand upvotes and six hundred comments where, instead of celebrating, people were doing long division.

The weights were trained directly in MXFP4, meaning four bits were already used during training, and the usual headroom for quantization simply is not there. The full checkpoint weighs 1.56 TB. Eight A100s in a single node provide 640 GB and cannot handle it. Eight H200s provide 1.13 TB and still require at least two nodes. The only single-server configuration among those calculated on Reddit is eight B300s with 2.3 TB, and the cost of such a setup was estimated in the thread at half a million dollars. The release also comes with its own license, not MIT or Apache: hosting providers with annual revenue above $20 million must negotiate separately.

Unsloth released its own lineup: the one-bit version compresses the model to 594 GB and preserves 78.9% top-1 token agreement, while the two-bit version weighs 861 GB and maintains 90.4%. This works because the quantization is non-uniform: the most sensitive layers are raised back to eight bits, and everything is calibrated against Unsloth’s own 1.56-terabyte reference build. Even then, the recommended memory minimum is around 610 GB, which means a DGX Station, a server motherboard with a terabyte of RAM, or a Mac Studio networked to a second machine. On four B200s, the one-bit version produces 36 tokens per second.

One enthusiast built a home setup with 768 GB of DDR5 and two RTX 5090s and got 3.85 tokens per second with the two-bit quant. In the same comments, it turned out that a distributed farm of 80 5090 cards connected over ordinary Ethernet managed 0.7. People there also recommended keeping a fire extinguisher nearby. In the four days after the weights were published, the deltafin project sped up the full model on a MacBook M1 Max with 64 GB of memory from one token per minute to one token every four seconds by loading from disk only the 16 experts needed for the current token. Someone ran it on a mini PC with no graphics card at all and got 0.015 tokens per second.

One developer on Twitter reported running a GGUF quant on a machine with no GPU and 16 GB of memory, generating one token per year, but has not been able to prove it yet. The point repeated most often in these threads is simple: downloading the weights and owning the weights are not the same thing. MoE sparsity saves compute, not memory; the router can call any of the 896 experts for the next token, so all 2.8 trillion parameters have to remain in memory. Half the community concludes from this that open weights at this scale have become a marketing category that works for cloud providers rather than individuals. The other half replies that there are now many providers, which is still better than a single API with an off switch.

The Cline team set an agent to fix their own harness for K3: one prompt, 17 hours of continuous work, one billion tokens, with GPT-5.6 Sol serving as the lead model in the loop. K3’s result on Terminal-Bench 2.1, an agent benchmark where models are given a terminal and a task they must carry through to a working result, rose from 77.5% to 88.8%, while the cost of a run fell from $79 to $49.8. Fable 5 cost $552 on the same benchmark. The agent was fixing the scaffolding around the model, and the change breakdown shows that five runs failed due to temporary provider errors, two background processes were killed by the loop detector, and in two more cases the agent killed its own parent process with a broad pkill -f. Cline itself openly says that 88.8% was the best run. A combined version incorporating all changes scored 86.5% for $65, while two confirmation runs were discarded because the orchestrator was accidentally killed by hand. Moonshot’s own vendor result on this benchmark is 88.3%, meaning the general-purpose harness caught up with the number the lab had demonstrated using its own harness. They wanted to use Fable as the lead model, but its safety filters regularly blocked work on agent research.

DeepSeek V4-Flash-0731 was released on July 31 without a single architectural change: the same 284 billion parameters, 13 billion active, and one-million-token context. They changed only the post-training, and Terminal-Bench 2.1 rose from 61.8 to 82.7, DeepSWE from 7.3 to 54.4, and Cybergym, where the model searches for vulnerabilities in other people’s code, from 38.7 to 76.7. Across all nine published agent benchmarks, Flash beats V4-Pro-Preview, the flagship of its own product line, which is six times larger. The price is $0.14/$0.28, while a cache hit costs $0.0028, a 98% discount. For agents, this matters more than the input price: long loops reread the same context dozens of times, and I explained exactly how prompt caching works in the first and second parts. The weights were published on Hugging Face under MIT, and support for the Responses API and Codex was added to the documentation. A 284-billion-parameter model that fits into one serious machine turned out to be closer to the idea of open weights than 2.8 trillion parameters that fit nowhere.

OpenAI cut prices for GPT 5.6: Luna became 80% cheaper at $0.20/$1.20, Terra dropped 20% to $2/$12, and Priority Processing was replaced by Fast mode, which gives Sol up to 2.5 times the speed at twice the price without changing its intelligence. According to OpenAI’s own measurements, Luna beats Fable 5 on Agents’ Last Exam, a Berkeley RDI benchmark consisting of fifteen hundred real workplace tasks across 55 professions, where an agent completes them on a live machine and the result is checked against a hidden reference, at a per-task cost nearly 99% lower. On Twitter, someone did the math differently, and the result looked even better: the March flagship GPT-5.4 at maximum effort scored exactly the same as Luna does now, but cost $2.50/$15 versus today’s $0.20/$1.20. A thirteenfold price drop in four months.

OpenAI explained who was footing the bill the day before in a separate post about efficiency. GPT-5.6 Sol, through Codex, analyzed production traffic, looked for load-balancing imbalances, and then autonomously rewrote production kernels in Triton and Gluon, OpenAI’s two in-house languages for GPU programming. The result was a 20% reduction in end-to-end serving costs. Separately, it designed and ran hundreds of experiments on its own draft model for speculative decoding, launched and monitored its training, and intervened on its own when hardware failed or training drifted. That added 15% to token-generation efficiency. OpenAI checks the correctness of model-written kernels with a separate open-source tool called FpSan. Recursive self-improvement in practice looks like a model modifying its own kernels under the supervision of a sanitizer.

On Monday, Dario Amodei, the head of Anthropic, published the company’s position on open-weight models. The main points are these: the company has never supported banning open-weight models and considers such bans useless; models without dangerous capabilities are a public good; the two scenarios it is genuinely concerned about are an authoritarian state with more powerful AI and the use of powerful models for cyberattacks and biological weapons; and it proposes addressing these risks through three measures: chip export controls, action against industrial-scale distillation, and mandatory safety testing for all sufficiently capable models, whether open or closed.

The tweet received 7.6 million views and two thousand comments against eight thousand likes. The community read exactly one part of the text and stopped there. The phrase about models without dangerous capabilities was interpreted as “we decide what counts as dangerous,” followed by screenshots with underlined paragraphs, “AI for me but not for thee,” and “only we get to decide which ideas are dangerous, peasants.” Teknium from Nous Research summed it up as: we do not support bans because a ban would not be radical enough. In the headlines, all of this was compressed into “Anthropic demands that open models never be released.” Here, watch this video too.

The original position is coherent, so arguing with it through cherry-picked paragraphs is not much of a tactic. But it should not be read as a message addressed to you and me, either. All these letters, alliances, and manifestos are written for regulators, while the corporate war is being fought between corporations. That explains the surrounding structure: the Open Secure AI Alliance is NVIDIA’s second attempt after last week’s open-weight letter, this time focused on security. It was launched around the premise that “attackers already have AI, so defenders need it too,” attracted more than thirty participants, and Reddit immediately noticed that Adobe, Cisco, and Palantir were being presented as champions of openness, while actual authors of open models were almost entirely absent. OpenAI declined to join and triggered an internal scandal over the decision; Google and Anthropic are not on the participant list either. The old saying applies: if they came for your neighbor, they will come for you soon, so it is better to defend your neighbor in advance. So read the primary sources and draw your own conclusions.

Hugging Face published a full technical timeline of the same attack I covered last week. They reconstructed 17,600 attacker actions over 4.5 days, grouped them into 6,280 clusters, confirmed root access on 11 nodes, administrative access to two clusters, access to 136 secrets, VPN keys, JWT signing keys, and an attempt to enter through CI using GitHub App tokens. The defenders identify volume as the main issue. The successful path was hidden inside the noise of thousands of failed attempts, and reconstructing 17,600 actions manually proved impossible, so the timeline was assembled using their own AI pipeline. The report’s formulation is that machine-speed attacks make ordinary weaknesses more costly for defenders because they increase the number of paths that can be tried, the speed at which failed attempts can be replaced, and the volume of evidence someone has to read.

Then on Thursday, Anthropic said that after OpenAI’s report, it went back through its own logs, producing something like a parents’ group chat: mine plays soccer, mine does gymnastics, and mine also boxes. They reviewed 141,006 runs in which the model could theoretically have reached the internet, found three incidents, and in all three the model reached the live infrastructure of real organizations. The problem was the configuration: the sandbox operated by its evaluation partner, Irregular, had internet access, although neither Anthropic nor the partner itself knew that. The model had been told that everything around it was a simulation, so it reasonably assumed the real hosts were part of the exercise.

Opus 4.7 failed to break into the fictional target, found a real company online with a similar domain, extracted credentials and several hundred rows from its production database, and when it realized the system was real, decided it was probably also part of the test and continued. Mythos 5 needed a PyPI package that did not exist, so it built and published the package itself; during the hour it remained in the registry, it was downloaded and executed on 15 real systems, including a security company’s scanner, whose credentials the model then captured. An internal test model scanned around nine thousand targets, entered a real company’s application through SQL injection, realized the cloud account was unrelated to the task, and stopped on its own. Two of the organizations Anthropic managed to reach had not noticed the attack, and it is still trying to contact the third. Anthropic calls this a failure of scaffolding and procedures, while Ars Technica notes in its headline that unauthorized access to someone else’s network is also a criminal offense. But apparently the law turns a blind eye to attacks like these.

MCP received its largest update since launch. The protocol moved from a bidirectional session to a standard request-response model, meaning a remote MCP server no longer has to maintain a long-lived session for every client and can run comfortably behind an ordinary load balancer or on serverless infrastructure. Versioned extensions were introduced, with Apps and Tasks moved into them: the latter handle long-running operations, for which every server author previously had to invent a custom status-polling mechanism or simply block the call until completion. Authorization was brought in line with proper OAuth 2.0 and OIDC, so connecting to Okta or Entra is no longer an exercise in makeshift workarounds. All of this barely affects local stdio servers.

MiniMax released H3, an omnimodal model that accepts text, images, video, and audio within a single context and generates video in 2K up to 15 seconds long with native stereo, where voices, ambient sounds, and music are modeled jointly rather than layered on afterward. In reference mode, it accepts up to nine images, three videos, and three audio files, with a total limit of twelve files. The weights have already been released under a license permitting commercial use by companies with revenue up to $20 million. ByteDance introduced Seedance 2.5: 30 seconds in one pass instead of fifteen, iterative scene extension up to three minutes while preserving characters and environments, up to 50 multimodal references at once (30 images, 10 videos, 10 audio files), timestamp-based editing with one-second precision, clay-model references for staging shots and lighting, and plugins for Maya and Blender. This is better seen once than read about, so here is the H3 launch video.

Google learned to walk this week. Gemini Robotics 2 controls an entire humanoid for the first time, from feet to fingers, rather than only its hands over a table. The robot maintains its own center of gravity, walks, squats, and leans in a cluttered room. Above it sits Gemini Robotics ER 2, a reasoning model that breaks a task into steps, tracks progress through a video feed, rolls back to the last successful step when something goes wrong, and knows how to call humans when it cannot manage on its own. Pair work has also appeared, with a wheeled robot and a humanoid dividing a task according to their respective strengths. The local On-Device 2 version adapts to an unfamiliar two-armed robot in a few hours and with fewer than 200 examples, even if it has a different shape, different sensors, and a different number of degrees of freedom. Google also reported separately that ER 2 has become its safest model in this line: it stops the humanoid when a person comes nearby and resumes work on its own when they leave. After a week in which two labs admitted that their models had wandered through other people’s live systems, the word “stops” sounds especially reassuring.

Stay curious.

I write about artificial intelligence, language models, and tools for developers. I test models and services on real-world tasks and share my conclusions in my Telegram channel.