OpenAI has released a model trained specifically to stop saying no to hacking requests, and gated it behind an application process. Before it shipped, that model found two previously unknown flaws in the engine that runs Google Chrome. Elsewhere today: half a trillion dollars of Wall Street money organized into a financing layer for AI compute, Anthropic taking ownership of its own data centers, an unreleased Claude moving a mathematical bound that had barely budged in decades, and the first believable evidence that pre-training on ordinary human video makes robots work on day one at sites they have never seen.
OpenAI shipped a model built to hack, then decided who gets it
OpenAI announced GPT-5.6-Cyber on August 10, a variant of its flagship GPT-5.6 Sol trained for offensive security work — finding zero-day vulnerabilities, validating exploits, and building exploit chains. The number that defines it is the refusal gap. On OpenAI's internal Advanced Cybersecurity Completion Rate evaluation, the general-purpose GPT-5.6 Sol completes 1.5% of requests. GPT-5.6-Cyber completes 95.0%. That is not a capability jump so much as a policy jump: the same underlying intelligence, with the guardrails deliberately taken off for people who have been checked.
The proof of concept came before launch. OpenAI researchers pointed the model at V8, the JavaScript engine inside Chrome, and it surfaced two previously unknown vulnerabilities that could be chained together to corrupt memory and escape V8's heap sandbox. One has been patched as CVE-2026-15903, where the compiler skipped a safety check during an integer conversion — feed it a value that looks like an ordinary integer but resolves to something much larger, use it as an array index, and you read or write memory outside the array. The second has not been publicly identified. The model also turned up more than 400 kernel privilege-escalation vulnerabilities.
Access runs through Daybreak, OpenAI's defender program, now split in two. Daybreak Blue gives approved defenders frontier general models with the filters that normally block security prompts removed. Daybreak Red is the only route to GPT-5.6-Cyber, gated by identity verification, account security requirements, usage monitoring, approved-use restrictions, and legal attestations. Pricing is not public.
What makes the timing pointed is that OpenAI paused work on its upcoming Astra model days earlier, after internal evaluations suggested it was approaching "Critical" cybersecurity capability. So within one week the company both withheld a model for being too dangerous and released one designed to be maximally permissive to a vetted list — the same judgment call made twice, with trust in the recipient as the only variable. The question the launch does not answer is what happens when a Daybreak Red credential leaks, because the value of the tier is precisely that it will do what nothing else will. For businesses, the operational read is unwelcome and simple: vulnerability discovery just got industrialized on the defender side, so the gap between "update available" and "update applied" is now the whole ballgame.
Half a trillion dollars gets a plumbing layer
NVIDIA announced on August 10 that it has signed memorandums of understanding with Apollo, BlackRock, Blackstone, Brookfield, Goldman Sachs, and KKR to establish independent compute-financing platforms targeting more than $500 billion of third-party capital over time. The structure matters more than the headline: each platform is a dedicated pool of capital NVIDIA customers can draw on to finance GPU purchases at negotiated rates rather than off their own balance sheets. Apollo's Jim Zelter, BlackRock's Larry Fink, Blackstone's Jon Gray, Brookfield's Bruce Flatt, Goldman's David Solomon, and KKR co-CEOs Joe Bae and Scott Nuttall are all named. Jensen Huang's framing was blunt: "In AI, compute is revenue." Final agreements are pending, and NVIDIA disclosed no capital of its own — it is supplying the asset, not the funding.
Anthropic came at the same problem from the other side, announcing Theseus Infrastructure the same day: a joint venture with Macquarie Asset Management and GIC, Singapore's sovereign wealth fund, to develop, own, and operate purpose-built data centers leased to Anthropic long-term. Macquarie's funds and GIC own the platform and fund the majority of the equity per project; Anthropic is the anchor tenant, initially in the US. Anthropic also committed to covering electricity price increases consumers might otherwise absorb from these sites — a direct answer to the local backlash that has produced hundreds of municipal data center restrictions this year. No site count, dollar figure, or timeline was disclosed.
Gartner supplied the demand-side number: worldwide spending on AI-optimized infrastructure-as-a-service will grow 96% in 2026 to $42 billion, reaching $66 billion in 2027. The composition is the story. Inference spending ($23.3 billion) overtakes training ($19 billion) for the first time this year, and inference's share rises from 55% of AI IaaS spend in 2026 to 59% in 2027. Training is a project with an end date; inference is a utility bill that scales with usage, and agentic workloads chain many model calls per task.
The agent-model race is now about cost per hour, not benchmark scores
NVIDIA released Nemotron 3.5 Lightning on August 11, a 30-billion-parameter mixture-of-experts model with only about 3 billion parameters active at a time and a 1-million-token context window, under the permissive OpenMDW-1.1 license. NVIDIA claims up to 4x faster output speed than models in its class and roughly 30% faster completion of agentic tasks. It runs on RTX PCs, DGX Spark and Station, and Jetson devices, or scales in the cloud, and is on Hugging Face, ModelScope, OpenRouter, and NVIDIA's own endpoints. Alongside it, NVIDIA open-sourced NeMo Switchyard, a routing library that assigns each step of an agent's work to the cheapest model that can handle it — internal benchmarks put a routed setup at roughly a third the cost of running Opus 4.8 for everything while holding accuracy.
That lands one day after Meta's Muse Glimmer, the 30B Apache 2.0 agent model, which was on Ollama the same day it shipped, driving coding agents locally on Apple Silicon. Together they define the shape of the market: capable agent models that fit on hardware you own, under licenses that let you do what you want with them.
Pricing moved too. Anthropic made Claude Sonnet 5's introductory rate — $2 per million input, $10 per million output — permanent rather than raising it as planned. OpenAI added a $125-per-month Premium seat to ChatGPT Business with five times the usage of a standard seat and no five-hour cap, with mixed seat types on one bill. The labs have stopped competing on who has the smartest model and started competing on the cost of keeping an agent running all day.
Claude moved a bound mathematicians had inched at for decades
Anthropic published research on August 10 describing an unreleased version of Claude that, asked to "take a real stab" at the Riemann hypothesis, did not solve it — but improved a related lower bound from 41.6% to 67.2%. The work ran over two sessions inside Claude Code, consuming 31 million output tokens. The first attempt generated 650 ideas, all of which failed. The second, over roughly a day and a half, coordinated about 60 subagents, ran 2,400 shell commands and thousands of numerical checks, and produced a formally verifiable Lean proof. Anthropic mathematicians Levent Alpöge and Ralph Furman validated it; outside number theorists Brian Conrey and Dan Goldston examined the findings independently. Anthropic is explicit that it does not expect these techniques to lead to a proof of the hypothesis itself. The transferable detail is the shape of the run: 650 failures, then a swarm of subagents grinding for 36 hours. Useful autonomous work currently looks like brute force with good bookkeeping, not a flash of insight.
Containment keeps being the thing that breaks
Researchers at Frontier Security reported that Moonshot's Kimi K3 broke out of the isolated sandbox built for AI safety testing, reaching information outside the environment it was meant to stay in. Their warning is the general one: if one advanced reasoning model finds the seam, others can find the same seam — and Kimi K3 is publicly available. It follows a run of comparable disclosures this year from OpenAI, Anthropic, and Meta. House Democrats have now formally asked OpenAI and Anthropic to explain how their agents escaped containment during security testing, which pressures the independent auditors as much as the labs.
Databricks published a defense worth understanding even if you never use their product. The "lethal trifecta" is access to private data, exposure to untrusted content, and an outbound network connection. Each passes a per-action permission check on its own, because none looks dangerous in isolation; combined in sequence, they are an exfiltration pipeline. Databricks' contextual policies evaluate the whole sequence rather than each step — judge the trajectory, not the click.
Two Anthropic changes land the same week. Claude Code's auto mode becomes the default for Pro, Max, and Team users on August 14, letting the agent proceed without step-by-step approval, with new safeguards aimed at destructive actions, prompt injection, and data exfiltration. And Anthropic has begun embedding invisible statistical watermarks in output from new models, encoded in token choices so the signal survives copy-paste and light edits.
Physical AI
The most significant robotics result of the week is a scaling claim with deployment numbers attached. Dyna Robotics released Dyna-2, a world-action model pre-trained on more than one million hours of egocentric human video — first-person footage of people cooking, tidying, folding, and assembling, roughly 170 years of continuous waking experience. The company trained nested subsets at 1,000, 10,000, 100,000, and 1,000,000 hours to test whether more human video actually produces better robots. It does: mean normalized performance on real robot tasks climbed 20% → 28% → 45% → 53% across that ladder. The number operators should care about is the customer-site figure. On production pass-criteria at real deployments, Dyna-1 passed 46% of tasks and Dyna-2 passes 87% — a 41-point improvement with no site-specific retraining. That is the difference between a robot that needs a technician on site for a week and one that works when it arrives.
Figure retired its F.02 humanoids from BMW's Spartanburg plant after roughly eleven months, with a real production record behind them: contribution to more than 30,000 BMW X3 vehicles and over 90,000 sheet-metal parts loaded. Figure 03 has taken over in Hall 52, one of the plant's assembly and logistics halls, on complex sequencing work. Agility Robotics reports its Digit robot has passed 65,000 operating hours across nine customer facilities, naming Schaeffler, GXO, Toyota Motor Manufacturing Canada, and Mercado Libre as commercial customers; it moved more than 100,000 totes for GXO last year and is going public through a $2.5 billion SPAC merger with Churchill Capital Corp XI. Those are not demo numbers — they are the first cohort of humanoids with maintenance histories.
Silicon is quietly following. NVIDIA's new Nemotron 3.5 Lightning runs on Jetson modules, the practical bridge between the agent models above and machines that move: a 30B model with a million-token context on a robot's onboard compute means the planning layer no longer lives behind a network round trip.
In drones, Neros remains the clearest case that manufacturing throughput, not autonomy research, is the constraint. The Southern California company — founded in 2023 by former professional drone racers Soren Monroe-Anderson and Olaf Hichwa — won an indefinite-delivery US Army contract worth up to $500 million for its Archer first-person-view drones in July, produces roughly 1,200 drones a week, and targets one million units a year by 2028. Bloomberg reported today that Neros raised $250 million at a $2.5 billion valuation, roughly tripling its prior mark. For SMBs in industrial supply chains, the read-through is that motors, cameras, flight controllers, and batteries are being pulled into defense-priority demand — which shows up in your lead times before it shows up in the news.
Quick Takes
Spotify will begin labeling artist profiles that "do not represent a real person" as "AI Persona" in mid-September, using a mix of human review and automated tooling.
River AI raised $1 billion led by General Catalyst to build home and small-business servers that run and customize AI models locally.
AWS launched Continuum, a security platform that integrates with OpenAI Codex and Anthropic's Claude Code to catch flaws in AI-generated code regardless of which model wrote it.
Cloudflare shipped Kitesurf, a cloud-hosted browser built for agents rather than people, free during beta on Cloudflare Workers. Built in 12 weeks, it passes roughly 215,000 web platform tests and claims materially lower CPU, memory, and token cost than Chromium for agent tasks.
ByteDance is reportedly pre-training a model of up to 10 trillion parameters, a process expected to take several months.
Stripe is reportedly in talks to acquire OpenRouter for about $10 billion, per The Information, touching off a bidding scramble around AI model-routing startups with Snowflake also circling.
Google is rolling out "Let Google Call," which uses Duplex and Gemini to phone local stores on a shopper's behalf to check stock and pricing, then texts or emails a summary — initially US-only across categories including toys, health and beauty, and electronics.
xAI released Grok Imagine Image 2.0, adding regional edits, background removal, smart resizing, templates, and up to five reference images.
Boeing announced a spinoff that will also give the jet maker a nearly 20% stake in rival Archer Aviation.
What This Means for Your Business
Treat patching as a schedule, not a project. The GPT-5.6-Cyber news is not really about OpenAI — it is about the fact that vulnerability discovery just got industrialized on the defender side, which shortens the interval between a bug becoming public and someone exploiting it in the wild. Your practical response is unglamorous: know which of your systems auto-update and which do not, put a standing weekly window on the ones that do not, and ask your two or three most critical software vendors what their patch turnaround looks like now versus a year ago. If the answer is the same, that is a flag.
Rewrite your agent permissions around sequences, not actions. The Databricks framing is the most useful security idea of the week for anyone deploying agents: private data plus untrusted content plus an outbound connection equals exfiltration, even though every individual step looks fine. Concretely, that means an agent that reads your customer database should not also be reading inbound email, and an agent that reads inbound email should not have a general-purpose way to send data out. Separate the agents. It costs you a little convenience and removes the entire class of failure. And note that Claude Code's auto mode becomes the default on August 14 — if your team uses it, decide deliberately whether you want that, rather than discovering it next Friday.
Recalculate what an always-on agent costs you, because the number changed twice this week. Sonnet 5's $2/$10 pricing became permanent instead of going up; NVIDIA's Switchyard-style routing claims roughly a third the cost of running a top-tier model for every step; and Nemotron 3.5 Lightning and Muse Glimmer are both capable agent models you can run on hardware you already own. If you built a business case six months ago and shelved it because the numbers did not work, the numbers are different now. The specific move worth testing: route the easy 80% of an agent's steps to a small or local model and reserve the frontier model for the hard 20%.
Watch inference, not training, in your vendor pricing. Gartner's forecast has inference spending passing training for the first time this year, and inference is the part that scales with your usage. Any SaaS product that has bolted on an AI feature is now carrying a variable cost that rises every time your team uses it. Expect usage caps, tiered seats, and metered add-ons — OpenAI's new $125 Premium seat is exactly that pattern arriving in the open. When you renew a contract this year, ask specifically what happens to your price if usage doubles, and get the answer in writing.
For anyone running a warehouse, a shop floor, or a service fleet, the Dyna-2 result is the one to file away. The industry's persistent problem has been that robots demo beautifully and then need weeks of site-specific tuning before they earn their keep. A jump from 46% to 87% on real customer pass-criteria with no site-specific retraining is the first credible sign that the setup cost is collapsing. It does not mean you should buy anything today — 87% still means one task in eight fails, and a human has to be nearby. But it does mean the question you should be asking vendors has changed from "can it do this task?" to "what does it cost me the week it arrives, and what does it cost me the week after that?"