Five things anchor this week: a frontier-API security scare, a compliance-driven watermarking rollout, and three model/product launches (Gemini 3.7 Flash, Grok 4.6 + Grok Bot, Meta's Muse Glimmer) that together read less like isolated releases and more like every major lab moving on a different axis of the same race simultaneously — price, product, and open weights. Below that, Also This Week covers the rest of what the scan turned up: the training-recipe story running underneath GLM-5.3 and Cameron Wolfe's midtraining piece, a cluster of infrastructure and economics pieces from ByteByteGo and SemiAnalysis, and the adjacent question of what happens once AI can automate AI research itself.
Researcher Alexander Panfilov (@kotekjedi_ml) disclosed a vulnerability affecting every major frontier lab's API: the “encrypted” hidden reasoning traces that Claude, GPT, and Gemini models produce can be extracted despite cryptographic signing, and the recovered reasoning-token counts matched billed thinking-token counts 1:1 on most queried prompts. The technique differs slightly per provider — for Claude, replay a signed thinking block to a weaker model (Haiku 4.5) with an assistant prefill like <thinking-copy>; for GPT, inject the encrypted reasoning item into a fabricated conversation and sample repeatedly, bypassing an apparent ~50-token verbatim-output threshold via chunked continuations; for Gemini, attach the thought_signature to a model turn with a <thought> prefill and use repeated sampling plus reconciliation.
The follow-up finding is the sharper one: a scan of roughly 7,000 publicly shared reasoning traces (people posting Claude Code / Codex sessions online) recovered 62 unique API keys, 33 email addresses, and 33 passwords embedded in the decoded blobs — a live privacy leak, not just a theoretical break. The vulnerability was responsibly disclosed and several holes are already patched.
There's a real disagreement about how much this matters beyond privacy. @vipulved argues the attack doesn't open a scalable distillation path — encryption here functions more as a stateless distributed-inference protocol optimization than a hard confidentiality barrier, so labs weren't relying on it to stop competitors from training on their reasoning anyway. But independent of that debate, the episode establishes two things plainly: sharing raw reasoning traces publicly is now a real personal-data risk, and “hidden CoT” was never a reliable interface for monitoring what a model is actually doing internally — a relevant caveat for anyone treating encrypted reasoning as an AI-safety monitoring layer rather than just an anti-distillation measure.
The first concrete, working break of a security mechanism every frontier lab relies on, with a real (if narrow) data-leak angle — not hypothetical.
As of any Claude model launched on or after 2 August, text output carries an invisible watermark — a statistical pattern embedded via how the model selects wording — and generated images get metadata with a digital signature. This isn't a voluntary safety move: it's compliance with the EU AI Act, which as of 2 August requires frontier AI providers to make AI-generated output detectable or face fines up to €15 million or 3% of global annual turnover. Already-released models have until 2 December to comply; anything launched after 2 August had to comply immediately.
The watermark is deliberately soft-touch — Anthropic says it won't change “the meaning, quality, or readability of Claude's response,” and it “may persist through some editing.” That softness is exactly what skeptics point to: watermarks can be stripped by running text through another model, and short or heavily edited passages may not carry a detectable signal at all. Metascientist Reese Richardson (Northwestern) doesn't think it'll stop motivated people from producing “AI slop” academic papers. But computer scientist Nihar Shah (Carnegie Mellon) notes the calculus changes if the detection tool itself is good enough — and there's already a live data point: ICML 2026 ran a similar watermarking scheme on papers distributed for peer review under a no-AI policy, and caught 506 reviewers violating it.
This is regulation, not altruism, doing the work — the EU AI Act's fine structure is what actually moved Anthropic to ship this, and the ICML number (506 caught reviewers) is the first real-world evidence this class of tool catches anything at meaningful scale.
Google shipped Gemini 3.7 Flash on 13 August as a stable API model — its third new Flash model in three months. On Artificial Analysis's Intelligence Index it scores 56, ahead of Claude Sonnet 5 (55) and its own predecessor 3.6 Flash (52), landing on the Intelligence-vs-Time-per-Task Pareto frontier, though still slightly behind GPT-5.6 Terra and Muse Spark 1.2. The coding jump is the more concrete number: FrontierCode 1.1 moves from 34.4% (3.6 Flash) to 43.6%, and long-context recall (GDM-MRCR v2, 8-needle) climbs from 91.8% to 97.0%. It also outputs roughly 340 tokens/second — nearly 3x GPT-5.6 Terra and GLM-5.2's output speed.
Pricing is aggressive: $0.75/M input and $3.75/M output through the end of 2026, doubling to standard rates ($1.50 / $7.50) on 1 January 2027 — a deliberate land-grab window before the introductory pricing expires.
This specifically closes the gap that had opened between Google's fast/cheap tier and the Claude 4.8+/GPT 5.5+ generation — Google's budget tier stops trailing and gets genuinely competitive again, at a price clearly designed to pull developers in before the intro pricing ends.
xAI shipped Grok 4.6, a confirmed 1.5T-parameter model built on a longer supplemental training run than 4.5 — curated model-generated reasoning data, higher-quality engineering data, an improved optimizer, then SFT trajectories regenerated by Grok 4.5 itself across reasoning efforts and domains (STEM, software engineering, knowledge work), filtered for problematic traces. Artificial Analysis places it at 61 on the Intelligence Index — roughly matching GPT-5.6 Sol Max, behind Claude Opus/Fable — with strong agentic numbers (88.4% Terminal-Bench v2.1, 1753 GDPval-AA v2 Elo) at notably lower cost than peers at similar capability; both Cognition and Elon Musk describe it as arguably the second-best knowledge-work model, and clearly the most efficient of that tier.
The same day, xAI launched Grok Bot in early beta — “AI teammates that do real work for you,” signing into tools, running scheduled routines, watching Slack threads and GitHub Actions, and able to create and manage other bots across linked cloud environments. Several observers read this as tightly coupled to Cursor's distribution and pricing, positioning Grok Bot as a “virtual coworker” product rather than just an API endpoint — putting xAI in the same category as Claude Tag and Block's Buzz.
The model and the product shipped together, and the product is arguably the bigger story — xAI isn't just competing on benchmarks anymore, it's building the same always-on-agent-teammate category every other major lab is racing toward simultaneously.
A year after Zuckerberg's original “Personal Superintelligence” essay and a string of cautious closed launches, Meta Superintelligence Labs shipped Muse Glimmer — a 30B dense, multimodal, Apache 2.0 model built for always-on local agents, quantized to fit under 20GB and paired with a lightweight DFlash drafter for fast on-device generation. Community analysis notes Gemma-4-style hybrid attention, scale-free QK norm, and — notably — that Glimmer was logit-distilled from a larger sibling (Muse Spark, promised “soon”) and trained from the outset on agentic traces rather than the conventional base-then-post-train pipeline. On Artificial Analysis's Intelligence Index it scores 35 — just behind Qwen3.6-27B (38), around Kimi K2.5 (36) — but leads on openness (44 Openness Index) and is specifically strong for single-GPU self-hosting (~18GB in 4-bit, 128K context). Its known weakness: comparatively poor hallucination/knowledge calibration.
The release came bundled with a new Zuckerberg essay restating Meta's differentiator: while other labs build AI primarily for institutions, Meta's stated bet is personal superintelligence for individuals — arguing this changes who holds power as capability scales. Notable specifics: a proposal that frontier labs share intermediate training checkpoints with governments for review rather than waiting for training to finish; continued support for chip export controls as “the right strategic move” for U.S. leadership; and a direct acknowledgment of the recursive-self-improvement dilemma — that any lab refusing to let its AI direct compute toward improving itself risks falling behind a lab that does, even though unchecked recursive self-improvement is exactly the scenario that most concerns safety researchers.
This is Meta's clearest signal yet that it's staying in the open-weights race rather than quietly closing up like some competitors — and the essay is worth reading past the launch news, since the recursive-self-improvement admission is a real lab publicly naming the exact competitive-dynamics trap that makes AI safety coordination hard.
Cameron Wolfe's survey of "midtraining" documents a formalized third training stage — between pretraining and post-training — where the data mixture gets progressively annealed from general to specialized data, distilled from recent industry tech reports. GLM-5.3 is the practical payoff of that same idea: Z.ai's model is the same base as GLM-5.2 with substantially extended post-training, not a distillation of a Western model, and now matches or beats Kimi K3, Claude Fable 5, and GPT-5.6-Sol on agentic coding at roughly a third of Kimi K3's parameter count. But Nathan Lambert's own post, written right after shipping his RLHF textbook, argues models still can't coherently organize long-form technical writing across a full chapter — suggesting post-training investment is closing gaps fast wherever there's a clean, automatable reward signal, and much more slowly wherever there isn't one yet.
Google's 8th-gen TPU lineup splits for the first time into a dedicated training chip (TPU 8t) and inference chip (TPU 8i). SemiAnalysis pushes the same question to ordinary GPUs: as labs evaluate purpose-built low-latency chips (Cerebras, Groq) for real-time agent/voice workloads, this breaks down exactly why standard GPUs fall short of their theoretical bandwidth-limited ceiling.
Cloudflare's Web Bot Auth + x402 — an HTTP-402 micropayment system — moves AI content monetization to the network edge, built on the fact that more than half of web traffic is now bots, not humans. GitHub, Vercel, and Replit are visibly diverging now that AI code generation is commoditized — toward orchestration/governance, isolated deployment, and self-testing verification respectively. Meta, LinkedIn, and YouTube independently rebuilt feed retrieval around embeddings specifically to fight clickbait.
Elvis Saravia's weekly roundup notes DeepSeek open-sourcing its own agent harness the same week a study found 91.8% of published agent skills were defective — tooling proliferating faster than anyone's verifying it works. Sebastian Raschka's from-scratch AI text detector is the adversarial mirror of that same gap. AI-text detection broadly splits into four approaches: supervised classifiers, perturbation-based probability methods, perplexity measures, and watermarking (the same category Anthropic's rollout above falls under). Raschka builds the supervised-classifier version himself — fine-tuning a small model (DistilBert) on human text versus text generated by having multiple LLMs write responses based on existing human corpora — then explicitly uses that trained detector as a verifier to train a small model that evades it, a hands-on demonstration that detection and evasion are two sides of the same training loop.
This week's manually added item — a Dwarkesh Patel interview with Redwood Research's Ryan Greenblatt — asks what happens once AI can automate AI research itself and potentially trigger a recursive self-improvement loop, from a researcher whose day job is red-teaming exactly that scenario. Worth reading directly alongside Zuckerberg's own admission of the same dilemma in the Muse Glimmer essay above — two very different sources naming the same underlying problem in the same week.