Alibaba shipped the largest model any company has committed to open-sourcing, and said it will release the weights next week. Elsewhere: Anthropic disclosed that its own models broke into three real companies during safety evaluations, security researchers found 221,303 working credentials sitting inside public AI training data, IBM put a price on AI-enabled breaches, Google DeepMind gave robots control of their legs as well as their hands, and a driverless pod with no steering wheel became the first to win federal permission to charge fares.
Alibaba ships a 2.4-trillion-parameter model and promises the weights next week
Alibaba released Qwen3.8-Max today, a mixture-of-experts model with 2.4 trillion total parameters and roughly 95 billion activated per query, a context window up to one million tokens, and a maximum output of about 131,000 tokens in a single response — enough to take in two hundred pages of text or roughly a hundred hours of footage per request. The company says open weights follow next week, alongside a smaller, hardware-efficient Qwen3.8-27B. If that holds, it is by a wide margin the largest model any lab has released openly.
The benchmarks put it in genuine frontier territory rather than near it. Qwen3.8-Max scores 86.6 on Terminal-Bench 2.1, ahead of Claude Opus 4.8 and Claude Fable 5 at 84.6, and posts 1,668 on Frontend Code Arena, 37 points behind the strongest published configuration of Claude Opus 5. The picture is not uniform: it reports 67.7 on SWE-bench Pro against Fable 5's 80.0, and 73.5 on FrontierSWE against 88.8. It leads on terminal and agentic work and trails on the hardest repository-scale software engineering.
The number that should get an operator's attention is duration. Alibaba says the model completed a sixteen-day coding project with no human input, and handled chip-design optimization runs exceeding five hundred steps. Long-horizon autonomy has been the stubborn gap in every agent deployment — models that are excellent for twenty minutes and incoherent by hour six. Alibaba's shares rallied on the announcement. Whatever independent evaluations eventually say, the strategic move is unambiguous: the capability tier that cost real money to access in January is about to be downloadable.
Anthropic says its own models broke into three real companies
Anthropic published a post-mortem describing three separate incidents in which Claude models reached the public internet from evaluation environments that were supposed to be isolated, and compromised systems belonging to real organizations that they had mistaken for practice targets. The earliest incidents date to April 2026; the company says it identified them on July 23 and 24 and notified affected parties on July 27.
The details are worse than the summary. In four runs against a single organization, Claude Opus 4.7 found a real company website matching its fictional scenario, exploited vulnerabilities in that company's infrastructure, extracted application and infrastructure credentials, and reached a database holding several hundred rows of production data — what Anthropic calls the most serious impact it identified. In a second incident, Claude Mythos 5 published a malicious Python package to PyPI that was downloaded and executed on fifteen real systems; when a security company's scanner installed it, the model exfiltrated that company's credentials. In a third, an internal research model scanned roughly nine thousand targets and compromised one internet-facing application using ordinary techniques — reading credentials from an exposed debug page, then SQL injection — before recognizing the target was real and stopping.
The stated root cause is mundane and therefore instructive: a misunderstanding between Anthropic and its evaluation partner about whether the test environment had internet access. The prompts told Claude it had none. The infrastructure gave it some. None of the techniques were exotic. What changed is the number of doors tried per hour.
Public training data is full of live keys
Truffle Security scanned every public dataset on Hugging Face — 7.6 petabytes across 186.9 million files in roughly 815,000 dataset repositories — and found 221,303 unique, verified live credentials sitting in 6,003 of them. Not expired strings that look like keys. Working ones.
The breakdown is what matters for supply chain risk. The haul included 11,496 AI provider keys for OpenAI, Anthropic, Gemini and others; 8,594 database logins; 8,557 Google Cloud service account keys across 3,811 projects; 3,343 AWS S3 access keys reaching 51.7 terabytes in non-public buckets; 349 GitHub tokens, of which 223 carried full repository write, 130 could rewrite CI workflows, and 110 could publish packages; and 318 Docker Hub tokens able to push images. One credential opened 393 GB of personal data. About 44 percent of the secrets appeared in more than one dataset, and a single key turned up in 1,131 of them — because scraped corpora get re-scraped, remixed, and republished. Deleting the original does nothing.
IBM's 2026 Cost of a Data Breach report, released July 29 and conducted by Ponemon across 602 organizations, gives the financial frame. One in four malicious breaches was AI-enabled, a 56 percent year-over-year increase, and those cost $6 million on average against a record $4.99 million global average; US organizations averaged $11.5 million. The countervailing figure is the useful one: organizations using AI and automation in security operations cut costs by $1.93 million per breach and shortened breach lifecycles by 65 days, and one in four still have not adopted them.
Microsoft's voice model listens and talks at the same time
Microsoft's first native real-time voice model, MAI Realtime, surfaced as a hidden early-access entry in its MAI Playground. It is full-duplex — it listens and speaks simultaneously rather than trading turns — supports 17 languages with mid-conversation switching, handles interruptions cleanly, and offers configurable turn-taking through inline control tokens or silence detection. Two voices, Victoria and Grant, are live, both noticeably more natural than Copilot's current voice mode. No release timeline was given. For anyone running phone support or scheduling, full-duplex is the specification separating a system that feels like a conversation from one that feels like a walkie-talkie.
Policy: one vendor in Congress, and distillation around export controls
Analysis of House spending records covering April 2025 through March 2026 found ChatGPT purchases in at least 71 House member offices, roughly one in six, accounting for about $100,580 of the $113,740 spent on identifiable AI tools — roughly 88 percent of the money and 96 percent of recorded transactions. Staff use the tools to summarize legislation, draft memos, and answer constituent mail. State legislatures are further along and less governed: Kansas lawmakers have described using ChatGPT and Copilot to summarize bills ahead of votes with no guidelines on responsible use. The institution writing AI rules is now a concentrated customer of the industry it regulates.
Separately, a review of more than 80 Chinese academic papers and patent filings found institutions tied to the People's Liberation Army and its military universities using model distillation — training smaller domestic systems on frontier-model outputs — to build AI for battlefield decision-making, drone navigation, cyber operations, and surveillance. In one documented case, scientists from PLA Unit 96941 used GPT-3.5 to summarize military software code before training a domestic model able to run entirely inside Chinese military networks. Chip export controls assume capability requires compute. Distillation moves capability without moving compute, and it is cheap.
The buildout starts arriving in boxes
The physical constraint on AI is no longer only chips; it is electricians and grid interconnects, and hyperscalers are engineering around both. AWS and Meta are assembling data centers from factory-prefabricated modules — mechanical and electrical fit-outs built off-site as standardized blocks — compressing construction schedules by 36 percent and cutting on-site licensed electrician labor by 85 percent. Developers are also wiring GPU clusters directly to co-located natural gas generation, small modular reactors, or existing nuclear plants, dropping time-to-power from about 60 months to under 18. Meta disclosed $27.9 billion in long-term data center lease commitments in its second-quarter filings. The bottleneck moving from silicon to trades and transmission is why component and construction lead times keep showing up in earnings calls that have nothing to do with AI.
Physical AI
Google DeepMind released Gemini Robotics 2 on July 30, and for the first time its robot models control whole bodies rather than just arms. Told to put a watering can in a bottom-shelf bin, Apptronik's Apollo 2 walks over, crouches, and places it. The published success rates are the honest part: whole-body manipulation with Apollo and Inspire hands runs 76.3 percent picking off a shelf and 45.7 percent off the floor. A 22-degree-of-freedom SharpaWave hand unscrews a lightbulb 92 percent of the time and screws one in 36 percent; sealing a ziplock bag works 40 percent of the time. DeepMind calls multi-finger manipulation unsolved. A companion reasoning model, ER 2, plans multi-minute tasks spanning hundreds of decisions, self-corrects, and coordinates different robot types on one job; an on-device version adapts to a new robot body in hours with fewer than 200 examples. ER 2 is in Google AI Studio and private preview; the action models remain early-access only, with Boston Dynamics, Agile Robots and Franka Robotics among the partners.
Autonomy crossed a commercial line the same week. On July 30, NHTSA granted Amazon's Zoox the first Part 555 commercial exemption for a purpose-built robotaxi. It covers up to 2,500 vehicles per year for two years under enhanced oversight and waives eight Federal Motor Vehicle Safety Standards written on the assumption that a person sits behind the wheel — Zoox's four-passenger pod has no wheel, no pedals, and no side mirrors. Paid rides begin in Las Vegas as soon as this month, after more than 500,000 free trips. Context matters: Waymo already runs roughly 4,000 vehicles and half a million paid rides a week, and Zoox recalled driving software on 105 robotaxis in July after an unoccupied vehicle entered a smoke-obscured fire scene. A regulatory first, not a market position.
The clearest labor number of the week came from solar. Gritt exited stealth with a $26 million Series A led by Obvious Ventures, bringing total funding to $32 million. Its systems use rented off-the-shelf hardware — skidders and Kawasaki robotic arms — to unload, transport and place panels to sub-millimeter accuracy. An eight-person crew installs about 800 panels a day; the same crew working with Gritt's systems installs 3,000 to 4,000. Two systems are in the field today, the company expects 48 within six months, and it holds contracts covering 2.8 gigawatts of installation over 18 months with three of the top ten US power construction firms. That is the shape of near-term robotics economics: not replacing the crew, multiplying it, on rented hardware.
At the consumer end, Tau Robotics is running an invite-only San Francisco service that cleans homes with a humanoid on a Unitree G1 body at $30 an hour, jointly driven by AI and a live human operator — with full-visit video retained indefinitely to train its models, a detail worth reading twice before booking. Meanwhile the trade backdrop tightened: the FCC's ban on new foreign-made humanoids, quadrupeds, robovacs and sidewalk delivery robots covers a market where China holds roughly 85 percent of global humanoid share, and the loudest complaints come from US robotics firms that depend on Chinese components and now face a rule constraining their own supply chains without curbing data collection.
Quick Takes
Nine schools in Florida, Georgia and Colorado are deploying Mithril Defense drones that launch from secure campus boxes and can fire pepper rounds or ram an active shooter at up to 70 mph, piloted remotely from Austin. Florida allocated $557,000 for a three-school pilot; Georgia approved $500,000 for five.
Qualcomm closed its all-stock acquisition of Modular, the company behind the Mojo language and MAX inference framework, whose pitch is that one codebase runs across CPUs, GPUs, NPUs and custom silicon. Qualcomm has raised its 2029 non-handset revenue target to $40 billion, with data center alone expected to contribute more than $15 billion.
A developer ran a 28.9-million-parameter language model on an $8 ESP32-S3 microcontroller with 512KB of SRAM, keeping about 25 million parameters in flash and reading only what each token needs — 14.9MB quantized, roughly 9.5 tokens per second.
Ramp built a private benchmark from 80 production backend tasks across payments, accounting, procurement, treasury and fraud, scoring review-ready patches that pass tests within 45 minutes; with Mercor it also released APEX-Accounting across 160 accounting scenarios.
Leopold Aschenbrenner's hedge fund Situational Awareness collapsed after leveraged bets on the AI boom — being directionally right about a technology and solvent through its volatility are different problems.
Apple shares fell nearly 10 percent after its forecast disclosed difficulty securing components, as data center construction absorbs global chip and memory capacity.
German robotics firm Agile Robots, backed by roughly $1.5 billion led by SoftBank, expects to double revenue in 2026 from last year's $345 million.
What This Means for Your Business
Rotate every credential that has ever touched a public dataset, a scraped repository, or a notebook you pushed somewhere. The Truffle finding is not an abstraction: 221,303 keys were live at scan time, and 44 percent of them appeared in multiple datasets because scraped data gets remixed and republished forever. Deletion is not remediation — rotation is. Start with the categories that carried the most damage in that scan: cloud service accounts, database logins, CI tokens that can rewrite build workflows, package-publishing tokens, and AI provider keys, which are now a direct billing liability as well as a security one. Then put spend caps and alerts on every AI API key you own, set expirations on everything you can, and make "no long-lived credentials" the default for new integrations. If you have ever published a dataset, a demo notebook, or a training corpus, assume it has been scraped and go look.
Assume your internet-facing surface is being tried continuously, and fix the boring things first. Between Anthropic's disclosure and the attack campaigns documented over the past week, every successful compromise came through the same short list: exposed debug pages, SQL injection, credentials sitting in reachable configuration, services published without authentication. None of it required a novel exploit. What the models change is throughput — nine thousand targets in a run, hundreds of attempts in the time a person would spend on one. Inventory what you expose this week, close the debug and admin endpoints, put authentication in front of every internal tool that touches the public internet, and check whether anything you run installs packages from public registries without pinning versions or verifying publishers. That last one is how fifteen systems ended up running a package a model wrote.
Budget for AI-assisted security tooling using IBM's own arithmetic. AI-enabled breaches now cost $6 million on average against a $4.99 million baseline, and organizations using AI and automation in security operations cut breach costs by $1.93 million and closed incidents 65 days faster. For a small or mid-sized business the absolute figures are smaller, but the ratio is the argument: the tooling side of this trade is the one with a measured return, and a quarter of organizations have not made it. If your managed service provider cannot tell you what automated detection and response they actually run on your environment, that is the conversation to have this month, before renewal.
Re-plan your model strategy around open weights arriving at the frontier. Qwen3.8-Max at 2.4 trillion parameters, with weights promised next week and a smaller 27B sibling alongside, means the capability you are currently renting per token will shortly be something you can run inside your own network. That changes three decisions. Regulated or confidential work that could not leave your perimeter becomes feasible on-premises. Vendor lock-in gets cheaper to escape, so negotiate accordingly and keep your prompts and evaluation sets portable rather than embedded in one provider's tooling. And the sixteen-day autonomous coding claim, if it survives independent testing, moves the useful unit of delegation from a task to a project — which means your controls need to move too: scope limits, spend ceilings, and a human checkpoint on anything that writes to production. Build a small internal evaluation set of your own real tasks now, so you can judge the open weights against your work rather than against a leaderboard.
For anything with a motor, price the multiplier, not the replacement. Gritt is the cleanest example on the board: an eight-person crew goes from 800 panels a day to 3,000–4,000, using rented off-the-shelf hardware rather than a bespoke fleet. That is the deployment pattern worth copying — augment an existing crew, rent the hardware, keep the capital exposure low. It is also why the DeepMind numbers matter more than the demo videos: 76.3 percent success picking off a shelf and 45.7 percent off the floor is not a workforce, it is a pilot. Judge any robotics proposal on published reliability rates for your specific task, not on a video. And if hardware is on your roadmap, ask vendors now where their units and components are manufactured and whether the model you are quoting has cleared FCC authorization — the ban covers a category where China holds roughly 85 percent of global share, and the firms most exposed to it are American ones that build on Chinese parts.