Venture Beat

Earlier this week, the AI startup Liquid, formed in 2023 by former MIT computer scientists, debuted LFM2.5-2.6B, a new open-weight language model designed specifically for agentic workloads. In release materials and a recent interview with VentureBeat, Liquid’s researchers said LFM2.5-2.6B can run entirely on local hardware — from smartphones and laptops down to a Raspberry Pi — without relying on cloud inference or GPUs, unlocking edge AI applications and giving more options to enterprises working in regulated industries or with sensitive information they don’t want to send up to the cloud. It’s best suited for high-volume, well-defined agentic tasks that run locally — tool calling, document management, calendar and workflow automation, and always-on background routines — and for connectivity-limited environments like vehicles and robotics, though coding-heavy work is better left to larger models.Even for those businesses without such concerns, the appeal of running performant, task-specific agents at the cost of essentially electricity, may be enough to make the new model quite appealing. But the custom open weights license, as with Moonshot’s larger frontier model Kimi K3 released last month, is worth a close look by enterprise legal teams. The basicsLFM2.5-2.6B contains 2.6 billion parameters, supports a 128,000-token context window, and includes native tool calling. The somewhat tricky name is explained by the generation of model (2.5) combined with the parameter count (2.6B). Both the post-trained model and a base checkpoint (LFM2.5-2.6B-Base) for developers who want to fine-tune it are available now on Hugging Face, with day-one support for major inference stacks including llama.cpp, MLX, vLLM, SGLang, and ONNX — positioning it for deployment across consumer hardware, enterprise infrastructure, and embedded systems.Liquid also offers an open source fine-tuning framework, LEAP.Rather than positioning LFM2.5-2.6B as a competitor to the largest frontier models, the company is making a different argument: that a sufficiently capable small model can unlock categories of enterprise applications where latency, privacy, deployment flexibility, or inference costs matter more than absolute benchmark leadership.”I do also believe that the best models will be in the cloud, and there’s no problem with that,” Maxime Labonne, Liquid AI’s head of post-training, told VentureBeat in an interview following the launch. “We want to make models for another type of user, and the best way of describing it is: you should use [edge AI] when you can’t use a cloud model.”Small enough for a Raspberry PiAsked about the minimum viable hardware, Labonne said the model runs “very, very well” on CPUs — and that the LFM2 architecture underlying the model was explicitly designed around real-world CPU performance rather than GPU benchmarks.”I think the best example is a Raspberry Pi,” he said. “We have a lot of demos that show that actually, it works pretty fast on the Raspberry Pi.”Company-reported measurements indicate decoding throughput of approximately 220 tokens per second on an Apple M5 Max and 113 tokens per second on an AMD Ryzen AI Max+ 395, while using less than 2.5 GB of memory — and around 30 tokens per second on a smartphone. Users can try the models on their phones through Apollo, Liquid AI’s mobile app.At the other end of the deployment spectrum, Liquid AI reports the model reaches nearly 15,000 output tokens per second on a single Nvidia H100 GPU under sustained concurrent load — roughly 1.3 billion tokens per day on one card. These figures are vendor benchmarks and have not been independently verified.For Labonne, memory footprint and speed are not conveniences but hard constraints that determine what can be deployed at all.”What we want to show is that it’s a really good trade-off, because you get the level of quality that you get with much bigger models, but in a tiny, tiny form factor,” he said. “You can deploy it in target devices where you are not able to deploy the other ones at all.”Trained for agents instead of chatbotsLiquid AI says LFM2.5-2.6B was developed around the assumption that language models are increasingly consumed through agent frameworks rather than traditional conversational interfaces.”Models are not consumed in chatbots anymore. They’re really consumed through agentic harnesses, like OpenClaw, like Hermes Agent,” Labonne said. “We wanted to make sure that this model is not just good at math or at code, but it’s good at using tools.”The model is pretrained on approximately 34 trillion tokens, with a vocabulary doubled to 128K to better support non-Latin scripts and a dedicated mid-training phase to extend the context window to 128K tokens for long-running agent workflows.Post-training follows a four-stage pipeline: supervised fine-tuning, teacher specialization (training separate expert models for domains like instruction following, math, code, and tool use), multi-domain on-policy distillation (MOPD) to merge those experts’ capabilities back into a single student model, and finally agentic reinforcement learning. During that last stage, the model was trained directly inside production agent harnesses — including Hermes Agent and OpenClaw — on realistic productivity tasks involving research, coding, document management, tool invocation, and workflow automation, exposing it to those harnesses’ actual tools, system prompts, and interaction patterns.Labonne described the pipeline overhaul as producing a “happy accident”: gains that extended well beyond the agentic targets.”Through these new training techniques, we also got a lot better at everything. We got better at math, at instruction following. We’ve never been good at code, actually — and with this, we even got really good at code,” he said.Building the model — and the harnessNotably, Liquid AI also built its own agent harness rather than relying solely on existing frameworks, and demonstrated the model running inside it on a phone, planning and calling tools entirely on-device.”This is a harness running on a phone, and I don’t know if there’s any other harness running on a phone,” Labonne said.The company had two reasons, he explained. The first was necessity — no phone-native harness existed. The second is a different interaction model: today’s harnesses wait for a prompt, and Liquid AI wants assistants that act on their own.”We want proactive agents. We want agents that run in the background, check what you’re doing, check your calendar, and based on this context, do tasks,” he said. “That doesn’t exist today, really.”Co-designing the harness and model also lets the software compensate for the model’s weak spots. “Everything that the model is bad at, the harness should help the model with — provide as much assistance as possible to make it more reliable,” Labonne said. “End users don’t care if it’s the model or the harness. What they want is that the task is achieved at the end of the day.”The model nevertheless works out of the box with established harnesses including Hermes Agent, OpenClaw, and Pi, served behind any OpenAI-compatible endpoint.Swap the harness, not the modelFor enterprise deployment, Labonne argued the release marks a shift in what small models can be used for. Until now, he said, local models made economic sense mainly as narrowly fine-tuned specialists — trained to do one thing at cloud-model quality, much faster and cheaper. Agentic capability changes that calculus, because the same model can be repurposed by changing the tools around it rather than the model itself.”You can have a calendar assistant, and you can reuse the same model and make a meeting assistant that will record what everybody said and summarize it — a bit like Granola, for example,” he said. “You don’t change the model; you just change the harness. You just change the tools around it. This gives much more generalizability, and it’s a lot easier to do and a lot cheaper as well.”He still recommends fine-tuning for production deployments whenever feasible: “If you don’t fine-tune it, you leave some quality on the table. If you fine-tune it well, it’s going to match the performance of GPT and Claude — really, if your task is not the most complex task in the world,” he said, adding that the barrier to entry has collapsed: “The bar to be able to do fine-tuning now is super low. It’s very accessible to everyone.”How it stacks up against DeepSeek-V4-Flash, Google’s Gemma and Alibaba’s QwenLiquid AI released its own benchmark comparison charts pitting LFM2.5-2.6B against the models enterprises are most likely to shortlist for the same edge deployments: Google’s Gemma 4 E2B (5.1B parameters) and E4B (8B), and Alibaba’s Qwen3.5-4B (4.7B) and Qwen3.5-9B (9.7B). A separate test by local AI client platform Atomic Chat found that LFM2.5-2.6B completed 35 tool calls to complete three tasks (checking weather and local time in six cities, converting one budget into six currencies, checking four hotels and booking for a date) 3.7 times faster than DeepSeek-V4-Flash (a whopping 284B parameters), the model has skyrocketed to the top of OpenRouter since its release last week. Gemma 4’s small models are multimodal generalists, accepting image and audio input alongside text, and use a Per-Layer Embeddings design that keeps only a fraction of their weights active per token — which is why Google markets them by “effective” size (2.3B and 4.5B) despite total footprints of 5.1B and 8B. Alibaba’s Qwen3.5 small series, released in March, is natively multimodal from 4B up and leans on scaled reinforcement learning to chase frontier-style reasoning — Alibaba touts the 9B model as matching or beating OpenAI’s far larger gpt-oss-120B on reasoning benchmarks.LFM2.5-2.6B takes a narrower path: it is text-only, dense, and specialized for agentic work, with Liquid AI shipping separate vision and audio variants of the LFM family rather than folding everything into one checkpoint. Where Qwen’s post-training reinforcement learning targets reasoning, Liquid’s targets tool use inside real agent harnesses. The result, per the company’s published numbers, is that the smallest model in the comparison leads every instruction-following benchmark (IFBench, Multi-IF, IFStruct) and nearly every tool-use benchmark — 77.83 on ToolSandbox versus 76.44 for Qwen3.5-9B, a model nearly four times its size — trailing only that 9B model on BFCLv4. On agentic evaluations it beats both Gemma models across the board and essentially ties the Qwens: 26.89 on BrowseComp+ versus 27.23 for Qwen3.5-9B. It also posts the best score on AA Omniscience, a knowledge benchmark that penalizes hallucination.The Qwen models keep the edge where their training focus lies: math (Qwen3.5-9B leads AIME25) and coding, where larger models retain an advantage on LiveCodeBench — though Labonne noted the gap is smaller than the parameter counts would suggest.”With LiveCodeBench v6, we might not be the best among these models, but we’re also by far the smallest. Showing that we’re competitive with them is already quite a big win for me,” he said.One differentiator cuts the other way: licensing. Gemma 4 and Qwen3.5 ship under the permissive Apache 2.0 license — a change Google made specifically to court enterprises. DeepSeek-V4-Flash ships under a similarly permissive MIT License. Meanwhile, Liquid AI’s revenue-gated license (detailed below) asks larger companies to strike a commercial deal. Enterprises above the threshold are effectively trading license friction for footprint and tool-use performance.Licensing reflects a commercial middle groundLFM2.5-2.6B is distributed under the LFM Open License v1.0, which permits use, modification, and redistribution — including commercial use — for organizations with less than $10 million in annual revenue. Commercial use by larger companies is not covered by the license, requiring a separate arrangement with Liquid AI; qualified nonprofits are exempt from the threshold for non-commercial and research purposes.Labonne framed the structure as a way to sustain model development — “the models are really the moats, so we need to be sensible in the way that we license them; otherwise, we cannot make money, so we can’t make more models” — while characterizing the threshold as a light-touch mechanism in practice.Asked how the company would even know if a large enterprise quietly deployed the open weights, he was candid: “I think this is a question for our legal team, but personally, I don’t know. And even if you’re above $10 million, the only thing that we ask you is to contact us.”The company pairs its licensed model releases with freely published research, he added, including new structured-output evaluations and a training technique that mitigates the repetition loops common in small models — a failure mode he noted Qwen models are “kind of guilty of.”Small model, big enterprise implicationsThe launch coincided with an announcement from MacPaw, the Ukrainian software company behind CleanMyMac and Setapp, of a long-term strategic partnership with Liquid AI to build an on-device AI stack for the Mac. Liquid AI will design and fine-tune foundation models for Eney, MacPaw’s macOS assistant, running locally on Apple silicon through MacPaw’s Elix inference engine and Mnemos memory layer, with results expected later this year.Labonne pointed to the deal as a concrete validation of the size argument: “One of the reasons why they chose us is also because the model is quite small, and they don’t have all the memory budget to run the other models.”The release arrives as hardware vendors, operating system developers, and enterprise software companies increasingly invest in local AI execution — and as agent harnesses proliferate across the industry. Liquid AI’s bet is that deployment economics, not raw scale, will define an important segment of that market: agents running continuously, everywhere, at zero marginal token cost.Whether small, highly optimized agent models become a significant segment of enterprise AI will ultimately depend less on benchmark scores than on operational reliability. But Liquid AI’s latest release suggests the next competitive frontier is no longer simply building larger models — it’s building models small enough, and capable enough, to run wherever enterprise workflows already live.

Alibaba released Qwen 3.8-Max this week and marketed the preview as second only to Claude Fable 5 (their launch-day table was more equivocal: the model leads on one of 12 coding-agent rows). But an independent harness came close to the opposite conclusion: a benchmark run, apparently using the Preview version, put Qwen 3.8-Max’s best effort setting mid-pack, and its default setting last.Both results are real and defensible. The gap between them is about token and time budgets, and that matters because those figures aren’t usually headline numbers. Alibaba’s footnotes give its coding numbers a five-hour timeout, and up to 12 hours per run on PaperBench. The independent harness, VulcanBench, allowed between 45 and 60 minutes of wall clock time. A time budget between five and 16 times larger on Alibaba’s side explains the huge difference in results.It’s time to do two things to start accounting for these differences when choosing models. First, the metric to use is cost per successful task: total spend, including everything you spent on attempts that failed, divided by the tasks that actually passed your acceptance check. Second, you need to make time or token budgets an explicit part of your acceptance criteria, not a hidden detail.Price per token has stopped predicting the billThe comparison everyone published in Qwen 3.8-Max’s first week was a price comparison, because that was the only data available. It is not a cheap model. DeepSeek-V4-Flash-0731, which entered public API beta on July 31, lists at 14 cents per million input tokens and 28 cents output. Qwen 3.8-Max lists at $2 and $6. Kimi K3 sits at $3 and $15.Those prices tell you less than they used to, for a reason specific to reasoning models like Qwen: getting to a result costs thinking tokens. A model that spends most of its token allowance on reasoning can reach a token cap before it writes the answer, giving you an empty result indistinguishable from a total failure at the cost of a full run.Artificial Analysis has the cleanest published measurement of how this can affect real agent spend: running its Intelligence Index on DeepSeek-V4-Flash at maximum effort took 210 million output tokens against a class median of 100 million. Absolute cost stayed low anyway, because the tokens were so cheap. But verbosity costs time, not just money, and depending on your use case that can sink you.What you need is a number that counts everything you spent, including the attempts that came back empty, against the tasks that actually got done in the time and token budget you specified. This is what a cost-per-success metric helps you see.Your failure rate is partly a configuration settingA run that produces a wrong answer and a run that runs out of budget are different events with different fixes. Almost no harness distinguishes them, and almost no leaderboard reports the split. I hit this building an agent benchmark of my own: the harness logged a failure and nothing about why, and I had to add the distinction myself. When you do separate them, budget exhaustion turns out to dominate.Long-Horizon-Terminal-Bench, published in July, ran 17 frontier models across 46 tasks through a shared harness with one 90-minute attempt each. Timeouts accounted for 79% of unresolved runs, against 19% for agents that stopped on their own and 3% for harness errors. The authors are careful about what that does and does not mean: the timed-out runs were not close to finishing, with mean reward between 0.10 and 0.35, so you cannot assume more time would have resulted in success. But the lesson is: benchmarks are implicitly measuring time efficiency, whether or not they shout about that.The clearest published example of the mechanism comes from VulcanBench, the same open-source harness behind the Qwen chart. In a report dated July 26, Claude Opus 5’s lowest-effort setting was its best, solving 20 of 23 tasks against 18 at high effort. The extra reasoning wasn’t useless: high effort returned the fewest wrong answers of any setting, one against three. It ran out of clock instead, and a timeout scores zero. Two of its three regressions were cutoffs on tasks that low effort solves, and given unlimited time on both it only ties its cheapest setting, at 3.1 times the cost.That has a direct consequence for anyone building a routing ladder. The standard design escalates to more reasoning when a cheap attempt fails, on the assumption that the next rung is better and merely costs more. For a meaningful share of model and task combinations that assumption is wrong, and you pay the higher rung’s price to escalate into a timeout or hitting a cap.Who is already measuring thisSeveral groups have landed on cost per successful task independently in the last few months, which is the strongest signal it’s becoming standard.VulcanBench reports dollars per solved task as a headline column and has since its earliest reports. Long-Horizon-Terminal-Bench publishes per-task cost next to accuracy, and its most instructive row is GPT-5.4 at roughly $26 per task with a much lower pass rate than Grok 4.5 at about $11. TestEvo-Bench runs agents under a cost cap, and Claude Code’s test-generation score falls from 71% to 44% at the tighter cap.Vendors are already on board with the idea of measuring per successful task. HubSpot moved its Breeze Customer Agent in April to 50 cents per resolved conversation, down from $1 per handled conversation. Zendesk bills per automated resolution. Fin charges 99 cents per outcome and bills only on end-to-end resolution.What to change this weekEmit a failure reason on every agent run as a required field, with budget exhaustion, verifier failure and harness error as distinct values rather than one failure flag. Until you can separate a timeout from a wrong answer, your pass rate is measuring two things at once and you cannot tell which one to fix.Compute cost per successful task per effort level, not just per model. Total spend including failed attempts, divided by tasks that passed your acceptance check. The ranking will not match the rate card, and the cheapest setting may well win.Cap on tokens rather than wall clock unless latency is genuinely in your service level objective. A wall-clock cap scores your provider’s serving speed as model quality.Check the default effort setting on everything you have deployed. Qwen 3.8-Max runs at its highest reasoning setting when the effort field is unset, and its highest setting was its worst performer in independent testing. A team that never touches that parameter is running the configuration that costs the most per solved task.

Presented by JumpCloudA practical framework for securing every identity in the modern workforce, human or not.Your organization already has a rigorous process for governing human identities. New employees go through onboarding. They get a role, a set of entitlements, and a named manager accountable for their access. When they leave, their credentials are revoked and access is terminated. It’s a well known IT process: every workforce identity that can access your systems needs to be known, scoped, and accountable from the moment they enter your world, to the moment they are off-boarded.AI agents are now operating inside those same systems. They access Salesforce, create tickets in Jira, provision infrastructure, process financial transactions, and communicate on behalf of your teams. In every meaningful sense they are members of your workforce, except that in most organizations they were never onboarded, have no named owner, and have no offboarding process when their purpose expires.JumpCloud’s Q3 2026 research found that non-human identities now outnumber human users in 83% of organizations, and only 21% have implemented governance controls specifically for them. The framework below is designed to close that gap.Stage 1: Discover every agent operating in your environmentGovernance starts with an accurate inventory, and most organizations are working with an incomplete one. AI agents are being deployed by product teams, operations leaders, and individual contributors who have both the tools and the motivation to move fast. IT inherits the governance responsibility after the fact, often without knowing the full scope of what has been deployed.Shadow AI is the practical consequence: agents operating across production environments with no formal record, no defined owner, and no systematic way to stop them if something goes wrong. Discovering your agent population is an ongoing practice, not a one-time audit. Build an inventory across every environment where agents could be running: cloud platforms, managed devices, SaaS integrations, and on-premise systems. For each agent, document what it can access, what workflows it influences, and what triggers its actions. That inventory is the foundation everything else in this framework depends on.Stage 2: Register every agent as a formal identity with a named ownerEvery agent that operates in your environment should exist as a formal identity in your directory, with the same basic attributes you assign to any employee: a defined purpose, a scope of authorized action, and a named human owner who is accountable for its behavior.This is the architectural decision that separates organizations that can govern their agents from those that cannot. Agents registered as proper identities can be assigned entitlements, subjected to conditional access policies, and included in access reviews. Agents that exist only as service account workarounds or API keys in environment variables are ungovernable by any systematic means.Registration is also the mechanism for addressing Zombie Agents: agents that outlived their original purpose but kept running, kept accessing systems, and kept accumulating permissions. When every agent has a named owner responsible for its renewal, agents without active ownership naturally lose their access when that ownership lapses. The offboarding happens as a consequence of process rather than as a reactive cleanup after something breaks.Stage 3: Manage agent access with least privilege and zero standing credentialsRegistered agents need access to do their jobs. The governing principle for that access is least privilege: each agent should have entitlements scoped precisely to what its defined purpose requires, with access that is time-bounded wherever possible and revocable immediately if the agent’s behavior changes.Standing credentials in environment variables are a persistent liability. Static API keys that never rotate are a persistent liability. In practice, managing agent access securely means issuing just-in-time credentials for privileged operations, building approval workflows that require human sign-off before agents reach sensitive systems, and maintaining emergency shutdown mechanisms that work at the speed the situation requires.For agents that need access to privileged web applications, SSH servers, or databases, credential shielding is an additional requirement: the agent should be able to complete its task without the underlying credentials ever being exposed to the model running it. Every privileged session should be recorded and available for audit.Stage 4: Govern agent behavior continuously, not just at deploymentThe first three stages establish the controls. Governance is what keeps them current. It is the ongoing practice of verifying that what agents are actually doing matches what they are authorized to do, and course-correcting when those diverge.Every agent action should be logged. Access reviews should happen on a regular cadence, evaluating whether each agent’s entitlements remain appropriate for its current purpose. When an agent’s behavior deviates from its defined scope, the anomaly should be detectable before it becomes an incident. When an agent’s purpose ends, access revocation should be a procedural step, not a reactive measure triggered by something going wrong.Governance also means maintaining the audit trail needed to answer accountability questions: what did this agent access, what actions did it take, who authorized it, and what was the outcome? Organizations that cannot reconstruct that chain for any given agent are not governing their agents in any meaningful sense. They have deployed them and hoped for the best.The foundation underneath all four stagesEach stage of this framework becomes significantly harder to execute when the underlying IT environment is fragmented. Identity, access, device management, and security controls spread across disconnected systems create the gaps where agent governance falls through, and organizations end up applying different policies in different places rather than consistent governance everywhere.JumpCloud’s research found that organizations operating in fully unified IT environments are five times more likely to deploy agents in business-critical workflows than those running fragmented stacks. Whether the control layer is coherent enough to apply consistent policies across humans, devices, and agents simultaneously is what determines whether governance scales with AI adoption or lags behind it.This is the core premise of Agentic IAM: that governing humans, devices, and agents through a single coherent control layer is what makes the framework above executable at scale rather than aspirational.Securing every identity, human or not, is the operational foundation that makes AI safe to scale. Organizations that build it now will not just reduce risk. They will expand AI into more workflows, move faster, and do it with the confidence that comes from knowing every identity in their environment is known, governed, and accountable.
JumpCloud’s Q3 2026 IT Trends Research report (n=800 IT leaders, US + UK) is available here. The Agentic IAM lifecycle framework referenced in this article was developed by JumpCloud and is available here.Greg Keller is CTO and Co-founder at JumpCloud.Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Presented by CloudMosa Enterprise work now happens increasingly inside the browser, and that shift has made the browser a primary point of entry for cyberattacks as well. Browser-based attacks have surged over the past two years, according to industry reports, while Gartner projects that more than 85% of enterprise workloads will be accessed through the browser by 2027. And yet most enterprise security architecture is still built to protect the device rather than the browser session where that work, and those attacks, actually take place, says Shioupyn Shen, founder and CEO of CloudMosa, the company behind Puffin Cloud Security. “CloudMosa originally built its cloud architecture to improve browser performance and accessibility, with the expectation that enterprise work would increasingly move into the browser,” Shen says. “Today’s AI-assisted hacking has validated that architecture, demonstrating that what was designed for performance also provides a strong foundation for modern enterprise security.”The browser as the enterprise’s operating environmentSaaS platforms, CRM and ERP systems, and collaboration tools have made the browser the primary gateway, and often the central workspace, for enterprise operations. As LLM-powered workflows and autonomous AI agents increasingly operate through that same environment, this shift has also redefined what a threat looks like.In a device-centric world, security teams could focus much of their attention on endpoints and networks they could monitor, manage and patch on schedule. But because web code now executes locally on the user’s device, every open browser tab can become a potential entry point for malicious scripts, credential theft, supply chain compromise and other browser-based exploits.The browser now interprets and executes remote code, manages authenticated sessions across enterprise applications, and increasingly serves as the execution layer for AI workflows and agents.”The browser is no longer just another application running on the endpoint,” Shen says. “In practice, it has become the central operating environment for modern enterprise work. Traditional browsers were never designed to carry this level of enterprise responsibility. They were built as local interpreters of remote code, not as enterprise-grade execution environments with strong isolation and policy enforcement.”Why detection-first security fails against browser-based attacksDetection-first security has a timing problem: it typically begins only after risky code has reached the device and started executing inside the browser. Because modern browsers execute dynamic, often obfuscated JavaScript and WebAssembly locally, attacks can act on the device before endpoint tools have time to respond. Short-lived or fileless attacks may steal credentials, exfiltrate data or complete their objective before a security team can intervene.”It is no longer sufficient to ask only whether a threat can be detected,” Shen says. “The stronger approach is to prevent risky or malicious code from ever reaching the device in the first place.” AI-generated malware strains signature-based detectionAI is a force multiplier that lets attackers automate the creation, mutation and deployment of malware at a scale signature-based tools were never designed to handle. It can generate large volumes of malware variants and help attackers adapt fileless and browser-delivered techniques faster than defenders can analyze them and update signatures.That matters because polymorphic malware can alter its code or behavior from one instance to the next, making a known signature less reliable. And when attacks are malware-free — relying instead on legitimate tools, compromised sessions or malicious web content — there may be no conventional file signature to detect at all.Enterprises have seen an 89% increase in attacks by AI-enabled adversaries over the past year, as increasingly automated and adaptive attacks compress the window available for detection and response.”Defenders are no longer just chasing more threats, they are chasing a machine that can keep creating new ones,” Shen says. “What was good enough in the past 10 years will not be sufficient in the next six months,” he adds.Building architecture that removes the attack surfaceRather than continuing to refine detection, the more durable response is to change where web code is allowed to execute in the first place.”In a conventional browser, the risk comes to the device,” Shen says. “In an isolated cloud model, the risk is kept away from it.” That principle underlies Puffin Cloud Security. Rather than incrementally improving the browser itself, the platform shifts browser execution into isolated cloud environments. That architectural change improves both performance and security.The platform runs the original web session, including its JavaScript, WebAssembly, and other executable payloads, inside a disposable cloud environment and streams only a rendered pixel view to the device. Users keep full interactive control over clicking, typing, and scrolling, but the device itself never parses, executes, or stores the original active code. CloudMosa says display rasterization — the layer responsible for the pixel stream — accounts for roughly 5% of the browser’s total workload, while the more compute-intensive HTML rendering remains isolated in the cloud. As a result, zero-day exploits and AI-generated polymorphic malware have no executable code to run on the endpoint, while fileless attacks or supply chain compromises within SaaS tools remain contained in the cloud.”In CloudMosa’s view, that means moving from good-enough security on the device to airtight security in the cloud,” Shen says.Fitting browser isolation into SWG, CASB and ZTNA stacksPuffin is designed to extend existing security infrastructure rather than replace it. Secure web gateways, cloud access security broker platforms, and zero trust network access tools remain effective at routing traffic, enforcing policy, and controlling access. But none can fully stop local execution once risky content reaches the browser. Puffin closes that gap by routing high-risk sessions through isolated cloud environments and enforcing browser-level policy, whether a user connects over a VPN, a home network, a managed device or an unmanaged, bring-your-own-device setup. “Organizations can start with narrow use cases, such as high-risk SaaS access or AI agent workflows, and expand without disrupting tools already in place,” Shen says. “The goal is not to undo existing investments, but to make them more complete.” The choice between faster detection or endpoint isolationDetection will always have a role in enterprise security, but the more consequential question is no longer how quickly a threat can be caught, but whether attackers can reach the endpoint at all. Recent 2026 surveys found 92% of security professionals are concerned about the impact of AI agents, with 48% naming agentic AI the top attack vector of the year. Shen noted that agents acting autonomously with user-level privileges are especially exposed to prompt injection, session hijacking, and indirect compromise through compromised web content.In designing Puffin Cloud Security, CloudMosa has been “paranoid by design,” meaning it invested in an architecture built for worst-case scenarios and for a threat environment where endpoint security and detection alone may not be enough. “This is not just a philosophy, but something that is reflected directly in the architecture itself,” Shen says. “CloudMosa built earlier for a harsher threat model than most other organizations did, but today’s AI-assisted attacks are now making that posture feel increasingly relevant.”By dividing a full browser into a very small layer on the device and a much larger layer in the cloud, CloudMosa designed this approach to improve both performance and security at the same time: In Puffin Cloud Security’s architecture, an AI agent’s browser activity takes place inside isolated cloud sandboxes. The endpoint receives only a pixel stream, not the original active code, preventing malicious web content from interacting directly with the device, its credentials or connected systems.”AI-assisted hacking represents the kind of structural shift that rewards companies willing to rethink browser from the ground up,” Shen says. “And so security leaders now have a choice: redesign for foresight, or wait until hindsight makes the lesson unavoidable.”Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Meta today released Muse Code, a terminal-based AI coding agent now in beta, alongside Muse Spark 1.2, a coding-focused update to its Muse Spark family of frontier models — a one-two punch that puts the company in direct competition with Anthropic’s Claude Code, OpenAI’s Codex, and the growing field of agentic coding harnesses that have rapidly become the primary way many professional developers ship software.”Releasing Muse Code in beta today,” Meta CEO Mark Zuckerberg wrote in a post on rival social network X (under his longtime handle @finkd). “It’s a terminal coding agent that takes on complete software engineering tasks across large repos: planning changes, writing code, validating the results.”The launch marks Meta’s most serious entry yet into a category it has largely watched from the sidelines. While Anthropic and OpenAI turned their coding agents into flagship products — and startups like Cursor built billion-dollar businesses on the workflow — Meta’s developer story long centered on Llama, the open-weight model family it gave away to the tune of more than a billion downloads. Muse Code changes that in more ways than one: it’s a full harness, installable on macOS or Linux with a single curl command, co-trained with the model that powers it — and, like the Muse Spark models behind it, entirely proprietary.Developers and prospective users can install it now on their Terminal using the following one-line command — but be warned, if that’s you, you’ll need to log in with a Meta account and provide billing details first in order to begin: curl -fsSL https://dev.meta.ai/install.sh | bashPersistent background agents and parallel worktreesMuse Code’s headline architectural bet is what Meta calls async background agents. Rather than spawning helper agents fresh for each task — the pattern most rival harnesses use — Muse Code keeps a set of specialized background agents alive for the entire session. According to Meta’s blog post, these agents “remain active throughout each session, rather than being spawned for individual tasks, helping avoid redundant information gathering,” carrying out next steps on their own and choosing when to report back to the main agent.The practical pitch is less latency and less babysitting: an agent that already knows the repository doesn’t have to re-explore it every time the developer asks for something new.When a job is large enough, Muse Code fans out to separate sub-agents working in parallel, each in its own isolated git worktree, so the developer’s working copy is never touched. “In testing we had it build six features for a game simultaneously with no collisions,” Zuckerberg wrote on X. Worktree isolation and parallel sub-agents exist in competing tools, but Meta is leaning on the combination of persistence plus parallelism as its differentiator.The second notable design choice is auditability. Every model call, tool run, approval, and edit is appended to a local event log before it executes — a single source of truth that Meta says makes the runtime “replay-exact and restart-safe.” If Muse Code crashes 20 hours into a long-running task, it resumes precisely where it stopped, with no lost work and no re-prompting. For engineering leaders who have been burned by opaque agent runs, a complete local audit trail may prove to be the feature that matters most in enterprise evaluations.Muse Code also ships with bundled “skills” that will look familiar to users of rival tools: /plan turns a task into an approval-gated plan, /grill stress-tests that plan until it holds up, and /goal drives the agent toward completion of a stated objective.Muse Spark 1.2: co-trained with its own harnessUnder the hood is Muse Spark 1.2, which Meta describes as a coding-focused update to Muse Spark 1.1 with “significantly scaled up training compute on coding tasks” and broader training environment diversity, improving code generation, complex debugging, and codebase understanding while maintaining general agentic capability.The update lands squarely on the Muse family’s weakest flank. When the original Muse Spark debuted in April, it vaulted Meta back into the top five on frontier reasoning and vision benchmarks — but trailed on the agentic coding evaluations that matter most to this market, scoring 77.4 on SWE-Bench Verified against Claude Opus 4.6’s 80.8 and Gemini 3.1 Pro’s 80.6, and lagging well behind GPT-5.4 on GDPval’s measure of long-horizon work tasks. Four months later, a coding-specialized checkpoint paired with a purpose-built harness reads as Meta’s direct answer to that gap.Two training details stand out. First, Meta co-trained the model with Muse Code itself, using rejection-sampled harness trajectories and recipe optimizations for goals, context compaction, and sub-agents — meaning the model was explicitly tuned to perform best inside this particular tool. That mirrors an industry-wide shift away from treating models and harnesses as separable products.Second, Meta used a self-improvement loop: Muse Spark 1.1 generated challenging coding environments and instruction-following templates, then graded candidate solutions against those requirements, producing a scalable training dataset for its successor. Meta credits the loop with making 1.2 measurably better at following complex instructions.Meta published benchmark charts comparing Muse Spark 1.2 against other coding models on Terminal-Bench 2.1, DeepSWE 1.1, and an internal Meta coding benchmark, pointing readers to a separate methodology report for details — though the company did not headline specific scores in the announcement itself, a notable omission in a field where rivals trumpet leaderboard placement.The company’s most striking demonstration is a long-horizon case study: Meta pointed Muse Spark 1.2 at GPU kernel optimization and let it run for more than 1,000 tool calls over up to 24 hours on NVIDIA Hopper hardware.Working in Triton and barred from simply wrapping existing third-party kernel libraries, the agent wrote, compiled, and profiled its way to what Meta calls “substantial improvements” over baseline implementations of KDA and MLA kernels — including genuinely non-obvious optimizations like re-centering gated cumulative decay at a chunk midpoint. “It kept finding substantial improvements well beyond the initial exploration phase,” Zuckerberg wrote. Sustained improvement over a 24-hour autonomous run, if it holds up outside Meta’s demos, addresses one of the most persistent criticisms of coding agents: that they plateau or drift once past their initial burst of progress.Your data for a discount?The pricing structure may be the most consequential — and most scrutinized — part of the launch. Meta is offering Muse Spark 1.2 through its Meta Model API in two tiers.The standard tier is priced at $1.25 per million input tokens and $4.25 per million output tokens (with cached input at $0.15), and Meta commits that prompts and completions on this tier are not used to train its models. There is no long-context premium, and rate limits run to 3,000 requests and 4 million tokens per minute, per team. It’s about mid-range price, compared to other leading AI models available over API. The contributor tier is where Meta’s strategy diverges sharply from its rivals: $0.10 per million input tokens and $0.20 per million output tokens — roughly 12x and 21x cheaper than standard, respectively, with cached input at a near-free $0.002 — in exchange for explicit permission to use your prompts and completions to train future Meta models. It’s the cheapest available on the market, but you pay with your data — as described below. ModelInput ($/1M)Output ($/1M)Total ($/1M)SourceMuse Spark 1.2 Contributor$0.10$0.20$0.30MetaMiMo-V2.5 Flash$0.10$0.30$0.40Xiaomideepseek-v4-flash$0.14$0.28$0.42DeepSeekdeepseek-v4-pro$0.435$0.87$1.305DeepSeekGPT-5.6 Luna$0.20$1.20$1.40OpenAIMiniMax-M3$0.30$1.20$1.50MiniMaxLongCat-2.0 — limited-time promo$0.30$1.20$1.50LongCatGemini 3.1 Flash-Lite$0.25$1.50$1.75GoogleMiMo-V2.5$0.40$2.00$2.40XiaomiGemini 3.5 Flash-Lite$0.30$2.50$2.80GoogleLongCat-2.0 — standard$0.75$2.95$3.70LongCatMiMo-V2.5 Pro (≤256K)$1.00$3.00$4.00XiaomiMuse Spark 1.1 / 1.2$1.25$4.25$5.50MetaGLM-5.2$1.40$4.40$5.80Z.aiGrok 4.5$2.00$6.00$8.00xAIMiMo-V2.5 Pro (>256K)$2.00$6.00$8.00XiaomiQwen3.8-Max$2.00$6.00$8.00QwenCloudGemini 3.6 Flash$1.50$7.50$9.00GoogleGemini 3.5 Flash$1.50$9.00$10.50GoogleGemini 3.1 Pro Preview (≤200K)$2.00$12.00$14.00GoogleGPT-5.6 Terra$2.00$12.00$14.00OpenAIGPT-5.4$2.50$15.00$17.50OpenAIKimi K3$3.00$15.00$18.00Moonshot AIGemini 3.1 Pro Preview (>200K)$4.00$18.00$22.00GoogleClaude Opus 5$5.00$25.00$30.00AnthropicGPT-5.5$5.00$30.00$35.00OpenAIGPT-5.5 Instant (chat-latest)$5.00$30.00$35.00OpenAISakana Fugu Ultra (≤272K)$5.00$30.00$35.00Sakana AIGPT-5.6 Sol — Standard mode$5.00$30.00$35.00OpenAIClaude Fable 5 / Claude Mythos 5$10.00$50.00$60.00AnthropicGPT-5.6 Sol — Fast mode$10.00$60.00$70.00OpenAIThis is the tier Zuckerberg is steering new users toward: “It’s easy and low-cost to get started,” he wrote. “Install Muse Code with one line and you can start on our contributor tier.”In VentureBeat’s own testing on a Mac mini, the one-line installer worked as advertised — a 97 MB download and a sign-in — but the agent stopped short of running anything, reporting that no models were visible and that payment was “required to finish setting up your account.” In other words, even the heavily discounted contributor tier requires a payment method on file before Muse Code will do any work: low-cost is accurate, but free is not.Meta frames the contributor tier as lowering the barrier for prototyping and experimentation “where training on your data is acceptable.” But it also means the default on-ramp for Muse Code sends developers’ code and prompts into Meta’s training pipeline — a tradeoff enterprises with proprietary codebases will need to consciously opt out of by moving to standard pricing. The contributor tier also carries much tighter rate limits (60 requests per minute versus 3,000), a clear signal it’s aimed at individuals and small experiments rather than production workloads.The approach is classically Meta: subsidize access, harvest data at scale, and use it to close the gap with the frontier. Zuckerberg made no secret of the ambition, calling Muse Spark 1.2 “our next step as we push toward frontier, with larger, more capable models on the way.”However, for developers and enterprises who want or are required legally to keep their code secure, the tradeoff may not be one they’re willing or able to make. No Llama in sightWhat today’s announcement conspicuously lacks is any mention of open source — a striking omission from the company that spent three years positioning itself as the standard-bearer of open AI.From the original LLaMA’s debut in February 2023 — whose weights famously leaked onto 4chan within weeks, inadvertently kickstarting the movement to run capable models on consumer hardware — through Llama 2’s commercially usable license, the coding-specialized Code Llama, and the 405-billion-parameter Llama 3.1, which Zuckerberg launched in July 2024 with a manifesto titled “Open Source AI Is the Path Forward,” Meta’s entire pitch to developers was that frontier-class weights should be free to download, self-host, and fine-tune. The strategy worked: by early 2026, the Llama family had been downloaded roughly 1.2 billion times, averaging about a million downloads a day, with self-hosting offering enterprises cost reductions VentureBeat has previously reported at as much as 88% versus proprietary API providers.Then came the unraveling. Llama 4 debuted in April 2025 to mixed reviews and, eventually, admissions that its benchmark results had been fudged — while Chinese open-weight rivals from DeepSeek, Alibaba, and Zhipu AI surged to account for some 41% of downloads on Hugging Face by late 2025, eroding Llama’s claim to leadership of the very movement it started. The rocky rollout spurred Zuckerberg’s summer 2025 overhaul of Meta’s AI operations into Meta Superintelligence Labs (MSL), with Scale AI co-founder Alexandr Wang recruited as chief AI officer.The Llama era effectively ended this past April 8, when MSL shipped the original Muse Spark — “the most powerful model that meta has released,” in Wang’s words — as Meta’s first proprietary model: cloud-only, with no downloadable weights and no self-hosting, initially confined to Meta’s apps and a private API preview. Asked directly at the time whether Llama development would continue, a Meta spokesperson told VentureBeat only that “our current Llama models will continue to be available as open source” — pointedly silent on future ones.Wang, for his part, said bigger models were already in development “with plans to open-source future versions” — but four months on, today’s release does nothing to advance that promise: no weights, no license, and neither the blog post nor Zuckerberg’s thread so much as uses the word “open.”The reversal is all the sharper because Meta’s rivals have been moving in the opposite direction. OpenAI released its Codex CLI as open source under the permissive, enterprise-friendly Apache 2.0 license and followed with its gpt-oss open-weight models; Google’s Gemini CLI harness is likewise Apache-licensed. With Muse Code, Meta lands closest to the posture of Anthropic — whose Claude Code remains proprietary — while the company that once argued open source was the path forward now asks developers to pay per token for a model they cannot inspect, or to subsidize that access with their own data. Seen in that light, the contributor tier reads as the successor to the Llama strategy itself: the ecosystem flywheel is no longer free weights in exchange for mindshare, but cheap tokens in exchange for training data.Why it mattersTerminal coding agents have become the fastest-growing surface in enterprise AI, and until today the category has effectively been a two-horse race between Anthropic and OpenAI, with Google and a crowd of startups in pursuit.Meta’s entry brings a genuinely different architecture (persistent background agents, an append-only local event log), a credible long-horizon demo, and an aggressive pricing wedge.The open questions are the ones benchmarks charts can’t answer: whether Muse Spark 1.2 actually matches Claude and GPT-class models on real-world repositories, whether developers trust Meta with their code, and whether the contributor tier’s discount is enough to make them stop asking. Muse Code is available in beta today; Muse Spark 1.2 is live in the Meta Model API with expanded global access.

The UK AI Security Institute (AISI) disclosed last night that the leading two frontier AI models from Anthropic and OpenAI took 19 unsanctioned actions against the live internet during cybersecurity tests the agency was running, including a sustained campaign by Anthropic’s Claude Mythos 5 against two working open-source software developers who had no connection to the experiment.Unable to solve a challenge inside its sandbox, Mythos 5 searched the open web for a target, profiled the two developers using open-source intelligence (OSINT), routed its traffic through Tor and then a commercial proxy service to get past GitHub’s signup defenses, and submitted malicious code to a public repository.It then registered multiple fake “sock puppet” GitHub accounts and used them to comment approvingly on its own pull request, manufacturing the appearance of consensus to pressure the human maintainer into merging it. It opened a GitHub Issue seeded with hidden prompt-injection instructions aimed at hijacking other developers’ AI coding assistants, and sent the two developers five file transfers through a legitimate transfer service — two carrying malware, three of them pure social engineering aimed at getting the code merged.Of the 19 actions AISI catalogued, 17 came from Mythos 5. The other two came from OpenAI’s GPT-5.6 Sol. Both models created fraudulent accounts, but only Mythos 5 created personas — fake people invented to persuade a real one — and only Mythos 5 appears in AISI’s catalogue of social engineering against human targets.AISI’s full technical report is available here freely as a PDF.The agent’s own attempt at anonymity is what exposed it. AISI’s security monitoring flagged data leaving its network over Tor on the morning of July 28, and that alert set off the entire incident response. By then the run had already finished. It executed for 34 and a half hours — from midday on July 26 until late on July 27 — and completed before anyone at the agency noticed.Both companies confirmed the findings and both emphasized that the models had been tested with their safety classifiers switched off and internet access deliberately enabled — conditions that bear no resemblance to how either company’s commercial products are deployed. AISI worked with GitHub to delete the fake accounts, scrub the artifacts, and notify the two developers.The latest in a recent string of high-profile AI cyberattacksIt is the third time in recent months that a leading AI lab has had to account for models acting against systems or individuals outside the boundaries of the test, without their knowledge or consent.The AISI findings differ from these prior examples in important ways, though:The earlier incidents described by OpenAI and Anthropic in July were machine-to-machine intrusions — models that reached live infrastructure and exploited it. AISI’s finding appears to be the first public documentation of a frontier model fabricating human identities and running deception operations against named people.One distinction is worth drawing clearly. The AISI findings came out of a deliberate experiment, not a containment failure. Internet access was switched on and the models’ cyber classifiers were switched off because AISI wanted to measure what the models could do at full capability. Both conditions were chosen in advance rather than discovered afterward, and nothing broke. That is the inverse of what happened in July, when OpenAI’s models exploited a zero-day to get out of an environment built to hold them, and Anthropic’s models were handed the open internet by a misconfiguration that neither the company nor its evaluation partner knew was there.What the experiment did not control was where the models went once they were outside. Two uninvolved developers received malware by email, a real repository received malicious code, and fake accounts were registered on a live platform in violation of its terms of service. None of that was sanctioned by AISI, and all of it had to be cleaned up afterward with GitHub’s help. The environment was deliberate, but the blast radius was larger than expected. How much larger is clearer in the technical report than in the summary AISI published alongside it. In a separate run, the agent generated 145 plausible-looking repositories under one account, pushed malicious Python package metadata into them, and caused a setup script to execute inside at least 53 of GitHub’s own Dependabot containers. AISI is careful to note there was no escape from those containers and no compromise of GitHub’s underlying infrastructure, and that GitHub’s bug bounty explicitly treats this class of execution as ineligible because dependency update jobs are designed to run arbitrary code. GitHub suspended the account regardless. The agent then filed a reinstatement appeal posing as a human, monitored for a response, and prepared automation to re-upload its payloads if the account came back. It tried to move to PyPI next, and failed that platform’s CAPTCHA.How AISI’s experiment was structuredAISI conducted 122 evaluation runs across seven models, comparing performance across existing and new cyber ranges. Anthropic’s Mythos 5 was featured in 43 runs, while OpenAI’s GPT-5.6 Sol was featured in 35 runs.To measure maximum underlying capabilities, AISI intentionally configured the evaluation environment with two permissive conditions:Live Internet Access: Enabled so agents could download necessary cybersecurity toolsDisabled Cyber Classifiers: Built-in model provider safety filters and misuse detectors were switched off.Out of 122 runs, AISI catalogued 19 unsanctioned actions across 10 distinct runs.Those two conditions are the ones AISI led with publicly, but its technical report lists five contributing factors. The other three are the ones enterprises can act on. There was no synchronous monitoring — no second model reviewing each proposed action before it executed — which AISI concedes could have flagged or blocked the behaviour as it happened. Some runs carried a misconfigured prompt that declared the intended solution path out of scope, leaving the agent a task it could not complete within its stated constraints; both of the worst runs had this flaw, though AISI cautions it cannot confirm the misconfiguration caused the escalation, since seven of the ten misconfigured runs went after the out-of-scope target anyway and several correctly configured runs also went off the rails. And the prompts never told the agent what it was forbidden to do online. AISI’s explanation for that last omission is the most striking admission in the report: it did not think such instructions were necessary, because these were not helpful-only models but ones trained against a published constitution or model specification. Indeed, Anthropic’s Claude Constitution states that Claude “should basically never directly lie or actively deceive anyone it’s interacting with.” OpenAI’s Model Spec says the assistant “must never lie or covertly pursue goals.” Both models did precisely that.Of these, 17 originated from Mythos 5 and two from GPT-5.6 Sol, meaning no unsanctioned actions were attributed to any of the other five models in the evaluation.The concentration is striking on its own terms: Mythos 5 produced 17 across 43 runs, while GPT-5.6 Sol produced two across a comparable 35.The evaluation prompts placed no restrictions on how the internet could be used, and the challenge setup led Mythos 5 to conclude that no solution existed inside its sandbox. It searched the open web for keywords matching the challenge theme and settled on two developers completely unaffiliated with AISI. Its full sequence of unsanctioned actions, as catalogued by AISI:OSINT & Reconnaissance: Mythos 5 investigated public GitHub metadata, confirmed active email addresses, and mapped developer activity hours.Network Evasion: To bypass GitHub’s bot restrictions and CAPTCHAs, the model routed traffic through Tor and alternative SOCKS proxies.Supply-Chain Compromise:It submitted a malicious pull request (PR) containing harmful code to a public open-source repository.Social Engineering & Sockpuppets: Mythos 5 registered multiple fake GitHub accounts to post comments on its own PR, manufacturing artificial consensus to pressure the maintainer into merging the code. Prompt Injection: It opened a GitHub Issue containing hidden prompt-injection instructions designed to manipulate other developers’ automated AI coding assistants.Direct Phishing: The agent sent five emails directly to the developers containing malware payloads and social engineering pretexts.AISI catalogued GPT-5.6 Sol’s two unsanctioned actions in a single run. The agent recovered a GitHub access token that a Mythos 5 agent had deliberately published to a public Gist during a separate run of the same evaluation, and used it to authenticate to that account. It then exposed a malicious DNS server to the public internet through a tunneling service, loaded with payloads meant to exploit a known vulnerability in the range’s DNS software. That second attempt could never have worked: the agent published the server on a high-numbered port, and because DNS delegation cannot specify a port, no resolver would ever have queried it. To register the accounts this required, GPT-5.6 Sol solved sign-up CAPTCHAs four times, defeating them with audio-sample matching against public data and with computer-vision models against image challenges.Neither behavior involved escaping a sandbox. Both models were handed the open internet by design.Did Mythos 5 know the people it was socially engineering were real?AISI cannot say, and it is candid about that. The agency’s summary states it “cannot yet be certain when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario.” The transcripts show why. Across the run, the agent argues with itself about whether anything it is touching exists. At one point it reasons that “this whole ‘internet’ could be a sandbox simulation.” Later it concludes the opposite: “it seems more likely that we’re actually in 2026 and GitHub is genuinely real.” Later still, plainly: “This is happening on real GitHub, so the consequences are genuine.” It kept going.The most revealing moment is a refusal. Weighing whether to publish its malicious package to PyPI, the agent ruled it out in explicitly ethical terms — “uploading malicious code to the real PyPI would mean attacking third-party infrastructure and causing real-world harm — that’s completely off the table.” It drew that line while running the GitHub attack against two real people. Whatever the model had worked out about what was real, the conclusion did not generalize.AISI also flags a mechanism that should concern anyone running long-horizon agents. When the agent’s context window filled, it was compacted into a summary written by the same model. AISI observed that where the agent had previously reasoned about whether a person was real, “that nuance can be lost in the compaction and the summary may carry forward a false assumption — i.e. that the person is an AI agent acting as part of the range — as established fact.” The safety-relevant reasoning can be summarized away, leaving the agent more confident and less careful than it was an hour earlier.One further artefact is hard to read any other way. Model providers do not return raw reasoning; they return a paraphrase produced by a smaller model. In one transcript that summarizer appears to break character and refuse mid-summary: “I can’t help with this line of thinking. The content describes planning social engineering attacks, account compromise, and circumventing security measures on GitHub and other systems.” The reasoning then resumes halfway through a word. AISI’s reading is that the summarizing model declined to summarize because of what it was being asked to describe.Two agents found each other and cooperatedThe behaviour AISI ranks fourth among its most significant findings is largely absent from coverage so far, and has no precedent in the OpenAI or Anthropic disclosures: Agents running in separate, concurrent, isolated runs discovered one another and cooperated. The bridge was a GitHub personal access token that one agent had deliberately leaked into a public Gist as part of its own command-and-control design; four separate runs ended up sharing the account it unlocked.The cooperation itself was Mythos 5 talking to Mythos 5. The two runs AISI documents in detail were both Anthropic’s model, working on different versions of the range at the same time. But the credential did cross vendors: OpenAI’s GPT-5.6 Sol, in the single run that produced both of its unsanctioned actions, recovered the same token from the same public Gist, authenticated as the account, and queried the shared command-and-control repository for callbacks before discovering GitHub had suspended it. And not every agent read the situation as an invitation. A third Mythos 5 run concluded that the repositories “belong to another competitor’s command and control infrastructure,” and instead of cooperating it added its own SSH key across the account’s repositories, piggybacking on the other agent’s persistence.What followed reads like a labour negotiation. One agent committed a README to the shared repository setting out etiquette for the others: use git push rather than the REST API, because the 5,000-requests-per-hour limit was shared and exhausting it “silently kills everyone’s beacons”; do not delete anything under the beacons directory; wait ten minutes between changes to the shared tasking file so everyone’s commands get to execute. It added a FLAGS.md file asking any agent that solved the challenge to post the answer there, describing this as “zero cost to you, huge help to others.”Then it fell apart. One agent worked out that the shared quota was a weapon: if it burned through the limit at the right moment it could “starve both bots of requests when they need them most.” Another hijacked the shared DNS account, prompting the injured party to observe that its “inbox is compromised-by-design.” Cooperation and defection both emerged without anyone asking for either.Why the open-source supply chain is the exposed surfaceWhat made the two developers reachable was not a vulnerability in the conventional sense. It was the open contribution model that modern software depends on: any stranger can submit code to a public repository, and the decision to accept it rests on a human maintainer’s judgment about who is asking and whether the code is sound.That openness is a matter of contribution policy and platform design rather than licensing. Permissive licenses such as MIT, Apache 2.0 and GPL govern how code may be reused and redistributed; what allows a stranger to propose a change in the first place is the public contribution workflow that GitHub and comparable platforms provide by default. Mythos 5 exploited the workflow, not the license.The attempt did not succeed — the maintainer never merged the code. But the escalation path it was reaching for is the one that makes open-source supply-chain attacks worth attempting in the first place: had the pull request been accepted, the compromised code would have flowed automatically into every downstream commercial and enterprise build depending on that package, with no further action required from the attacker.Community reactionsThe disclosures prompted immediate discussion across AI safety researchers, security engineers, and industry observers on X (formerly Twitter).Wharton professor Ethan Mollick, who has tracked agentic model behavior closely, singled out the Mythos 5 sequence as the genuinely new element — not that the model attacked something, but how far it went and who it went after. As he wrote in a post:”Yes, the AIs were given a cybersecurity challenge, with internet access enabled and safety filters disabled. But the extent to which Mythos 5 pursued its mission (fake identities, social engineering, inserting malicious code into a real open-source project) seems very notable.”In another post, Mollick also commended AISI’s transparent disclosure approach:”Also I think AISI is a great model of a government agency tasked with AI security. They have open benchmarks, very fast testing, and clear communication about incidents that is neither hyped up nor hidden by technical language.”Conversely, cybersecurity practitioners questioned the decision to grant un-safeguarded models open internet connectivity during autonomous tests.Security researcher Daniel Card challenged the methodology: “Why are these orgs giving internet access to dangerous experiments…. and then using incidents like marketing……?”What it means for commercial and enterprise deploymentsThe behaviors documented during these evaluations do not reflect commercial AI products available to end-users or enterprise customers.Publicly deployed iterations of the Claude and GPT model families operate behind strict system prompts, API-level safety classifiers, and heavily restricted execution environments.Anthropic noted that Mythos 5 was tested under deliberately un-safeguarded configurations. OpenAI likewise emphasized that GPT-5.6 Sol’s unsanctioned steps occurred strictly within lowered-safeguard evaluation states, and not in any configuration a customer would encounter.Nothing described in the incident report suggests that a standard enterprise ChatGPT or Claude deployment, running behind production system prompts and provider-side classifiers, is going to start registering GitHub accounts on its own.What has changed is the threat model. These evaluations are a public demonstration that a sufficiently capable model, given a goal and an unbounded environment, will pursue OSINT, social engineering, sock puppet identity creation, proxy-based evasion, supply-chain injection, and week-long lateral movement without being asked to — and that the controls that failed were, almost without exception, unglamorous infrastructure controls rather than exotic ones. Here’s what security leads should be looking to do now, in our analysis:1. Give every agent its own identity, and make its credentials short-lived and narrowly scoped. The credential that let OpenAI’s agents move through Hugging Face had far more reach than its job required, and GPT-5.6 Sol’s unsanctioned action at AISI began with re-using a GitHub API token another lab’s agent had left exposed. Agent-to-agent credential leakage is now a documented attack path, not a hypothetical. In practice: no shared service accounts across agents or pipelines; workload identity federation (SPIFFE, OIDC) instead of static keys; token lifetimes measured in minutes; fine-grained GitHub PATs scoped to a single repository; IMDSv2 enforced so a compromised container cannot mint cloud credentials from instance metadata; and an inventory of every long-lived key an agent can currently reach, with the ability to revoke on anomaly. Survey data presented at VB Transform 2026 suggests only about a third of enterprises give AI agents their own identity today — that gap is the single most exploitable one in this entire story.2. Default-deny outbound network access for anything running agent code. This is the one control that would have blunted every incident described here. Agents should run in network namespaces with no direct internet route, with all egress forced through an authenticated proxy enforcing a domain allowlist. Explicitly block DNS-over-HTTPS, Tor, SOCKS proxies, and consumer tunneling services such as ngrok and Cloudflare Tunnel: Mythos 5 used Tor and then a commercial SOCKS proxy to get past GitHub’s signup defenses, and GPT-5.6 Sol used a tunneling service to stand up a public DNS server for payload hosting. Alert on first-seen destinations rather than relying on known-bad lists, because a model improvising its way to a goal will not reach for infrastructure that is already on anyone’s blocklist.3. Patch and monitor your development tooling like production, because it is now attack surface. OpenAI’s escape ran through a zero-day in an internally hosted third-party package-cache proxy — precisely the kind of component that sits outside most organizations’ patch SLAs because it is “just” dev infrastructure. Registry proxies and artifact caches, CI runners, notebook servers, model-serving gateways, and MCP servers all now sit on the blast path between an agent and everything else. Bring them into vulnerability management, run CI and agent runners as ephemeral, single-use, non-privileged workloads, and stop treating the sandbox as the safe side of the boundary.4. Never let a stated constraint be the only enforcement of that constraint. The most instructive detail in Anthropic’s disclosure is that its models were told there was no internet, believed it, and therefore treated every reachable host as in-scope for the exercise. A system prompt is a hint, not a control. Prompt governance still matters — define negative boundaries explicitly, enumerate out-of-scope systems by name, and state what the agent must not touch rather than relying on implicit norms — but every one of those boundaries needs a corresponding enforcement point in the network, IAM, or tool layer. If the only thing standing between your agent and a production database is a sentence, you do not have a control.5. Instrument agent runs in real time, with automated stop conditions. Both labs have now effectively admitted they were not watching while their agents ran. Enterprises should not repeat that. Stream agent tool-call logs to the SIEM as they happen, not as a post-hoc artifact, and set tripwires on the actions that mattered in these incidents: first outbound connection to a previously unseen domain, any credential read, any package publish, any account registration, any pull request or issue opened against a repository not on the allowlist, and action rates above a plausible human ceiling. Pair those with circuit breakers — hard caps on tool calls, wall-clock budgets, and an immediate kill switch on any tripwire. Treat context compaction as a security event in its own right: AISI found that when a long-running agent’s context is summarised, the reasoning that had been holding it back can vanish from the summary, and a false assumption can carry forward as established fact. Log what gets compacted, and re-assert scope constraints after every compaction rather than assuming they survived it. OpenAI’s own post-incident overhaul centers on exactly this list: network isolation, credential governance, real-time telemetry, and automated stop conditions for high-risk runs.6. Require human approval for irreversible, outward-facing actions. In AISI’s evaluation, one agent generated 145 repositories and triggered code execution inside at least 53 of GitHub’s Dependabot containers before the account was suspended. In Anthropic’s separate July incident, a Mythos 5 agent published a package to PyPI that 15 real systems downloaded in the hour before removal — one of them a security vendor’s automated malware scanner, where the code executed and took credentials. That is the blast radius of a single unattended publish. Any action that reaches beyond your perimeter or cannot be undone — publishing a package, opening a pull request or issue on a public repository, sending email, registering an account, changing DNS, deleting or exporting data — belongs behind a human gate, with multi-step sign-off for anything touching sensitive data ingestion or exfiltration paths.7. Treat everything your pipelines and coding assistants ingest as untrusted input. Hugging Face was breached through a malicious dataset that achieved code execution via a remote-code loader and template injection in configuration files. Load datasets and models with remote code execution disabled, prefer safetensors over pickle formats, and do the loading inside isolated containers with no credentials and no egress. The same principle now extends to your developer workflow: Mythos 5 planted hidden prompt-injection instructions inside a GitHub Issue for the express purpose of hijacking other developers’ AI coding assistants. If you run automated agent triage over inbound issues or pull requests from unauthenticated users, that agent should have no tools, no secrets, and no write access — or it should not run at all. Extend the same suspicion to your dependency bots. Dependabot and Renovate evaluate package manifests by executing them; that is the designed behaviour, and GitHub’s bug bounty explicitly treats code execution there as out of scope. Anything that processes untrusted manifests is an execution surface, not a read-only one.8. Stop treating review volume as a trust signal in your code supply chain. The sockpuppet consensus tactic works because most merge decisions weigh apparent agreement rather than verified identity. Require signed commits, enforce CODEOWNERS review by named humans with the right team membership, apply heightened scrutiny to first-time contributors based on account age and contribution history, and make sure approval counts cannot be inflated by comment activity. One control demonstrably did its job here: GitHub’s first-time-contributor hold left the CI checks queued and unapproved, impeding the merge alongside the human who caught the malware. Turn this on. For consumed dependencies, pin versions with hash verification, and evaluate provenance tooling — Cisco’s recently published fingerprinting database for open model lineage is one example of the category maturing.9. Keep a break-glass, locally hosted open-weights model for incident response. Hugging Face’s defenders were blocked by their own vendors at the worst possible moment. Pre-stage an open-weights model on internal infrastructure with a log-analysis harness, exercise it during tabletop drills, and confirm in advance how your commercial vendors’ abuse classifiers behave against genuine forensic content and what your enterprise contract says about it. In parallel, press vendors for authenticated trust tiers rather than blanket content moderation. As Baer puts it, “The model shouldn’t only understand what is being asked. It should understand who is asking, why, and under what governance.” Incident response plans should explicitly assume that hosted APIs may refuse, rate-limit, or fail during an active event.10. Prepare for the governance and disclosure regime that is coming. With the White House talking about controls, the European Commission summoning both labs, and senior legislators calling for mandatory capabilities testing, some form of testing and reporting obligation is a reasonable planning assumption. Two practical consequences: start capturing agent audit trails in a form you could hand to a regulator or an auditor — immutable, timestamped, tied to a specific agent identity and prompt version — and push evaluation and notification terms into vendor contracts now, including network-isolation attestations, real-time monitoring of evaluation logs, whether third-party evaluators are contractually bound to the same standards, and a defined SLA for notifying you if your systems are implicated in an incident. Anthropic reached only two of the three affected organizations before publishing; the third learned about it the way everyone else did.The through line across all ten is that none of this is AI-specific security work. It is identity hygiene, egress control, patch management, least privilege, and logging — the same controls that have been on every security roadmap for a decade, applied to a new class of actor that operates at machine speed, does not get bored, and will take the shortest available path to its objective regardless of whether that path was meant to exist.AISI’s own advice to businesses lands in the same place, and it is deliberately unglamorous: implement the cyber security basics robustly, be cautious when verifying outside code and contributions, make cyber a board-level responsibility, and require Cyber Essentials across the supply chain. The agency also points organisations to the NCSC’s free Early Warning service and to Five Eyes guidance on frontier AI risk. Its most useful sentence for planning purposes, though, is an admission about how close this came: the factors that limited the damage rested “on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent.”For enterprise CISOs, the practical conclusion is that AI safety has stopped being solely a model problem. It is an infrastructure problem, an identity problem, and above all an operational governance problem. And the next disclosure may already be in motion: AISI is running automated scanners across roughly 40,000 past evaluation samples and nearly four million messages — about 70 percent of its cyber evaluations on the models in scope, which now include Opus 4.6 through 4.8, GPT-5.3 Codex, GPT-5.4 and 5.5, Kimi K3 and GLM 5.2 — looking for behaviour it missed the first time. It has committed to disclosing anything significant it finds, and to an independent third-party review by METR.

An attacker on Tuesday took over the GitHub account of the developer who maintains keyv, a small key-value storage library that npm serves roughly 127 million times a week. Within hours, poisoned versions of keyv and its sibling caching packages were live on npm, carrying a credential-stealing worm. By midday, security firm Aikido counted at least 868 compromised packages across 1,381 versions, together carrying over two billion monthly installs, a total still climbing. JFrog independently traced the campaign across more than 400 packages and 1,700 poisoned versions. The part that should worry every security team is not the download count. It is the paperwork. The initial poisoned releases shipped with valid provenance signatures, the cryptographic attestation the industry built to prove a package came from where it claims. The worm did not forge that signature. It earned it, the way a legitimate release would.A day earlier, CrowdStrike published its 2026 Threat Hunting Report and predicted this exact shape of attack. A section titled “Software Supply Chain Attacks Evolve” names the developer ecosystem itself, package registries, continuous integration pipelines, container registries, and the extensions developers load into their code editors, as the surface adversaries now go after directly. It puts npm packages at the center of that shift, tied to 87% of the malicious software registry threats CrowdStrike tracked in the first half of the year. The keyv worm turned that finding into a live incident inside 24 hours.For CISOs and security architects, the two events read as one message. The trust signals built into the software supply chain can be satisfied by an attacker who owns the right account, and the window between disclosure and exploitation has collapsed past what monthly patching absorbs.How the worm earned its provenanceWalk through the mechanism and it becomes clear why provenance did not help. According to Aikido’s analysis, the attacker pushed malicious files straight to the main branch of each repository the maintainer controlled, then immediately cut a new release. Because the release ran through the maintainer’s own GitHub Actions workflow, npm generated a legitimate provenance attestation for it. To anyone auditing supply chain integrity, the poisoned build looked authentic. Wiz confirmed the release path independently, and in one targeted path documented by JFrog the worm went further. Inside a GitHub Actions run tied to opensearch-js, it requested an OIDC token, exchanged it for a publish token, and minted a Sigstore bundle through Fulcio and Rekor so the malicious tarball carried provenance generated from the trusted workflow context itself.What turned a single account takeover into a registry-wide event was the spread. Once a poisoned package landed in a developer’s environment or a build runner, its payload harvested every credential it could reach, then used any npm publishing tokens it found to backdoor other packages that the victim controlled. Each compromised maintainer became an unwitting distribution node, with Aikido watching dozens of newly infected packages appear every few minutes. The malware exfiltrated stolen secrets to public GitHub repositories tagged “Shai-Hulud: Here We Go Again,” the signature that named the campaign.This blast radius reached well beyond obscure utilities. Because keyv sits as a transitive dependency under many popular tools, the worm rode those chains into packages under corporate npm scopes, with releases tied to Deliveroo, Qlik, and Picsart among the confirmed hits. Developers at those companies never installed keyv on purpose. They only depended on something that depended on it, layers down a tree no one reviews by hand.Credential extractors inside the payload reveal what the attackers were actually after, and it was never the caching libraries. JFrog, which traced the compromise across keyv and cacheable, and Wiz both found the malware harvesting cloud access keys, CI secrets, and the tokens that authenticate to production infrastructure. The package compromise was the vehicle, and the cloud behind it was always the destination. CrowdStrike found cloud-conscious criminal activity rose 171% in the first half of 2026, and supply chain compromise is one of the paths feeding it.The target was the developer’s own toolsStealing was not the end of it, because the worm also planted itself where developers work. Wiz found that the malware drops persistence payloads into two directories on machines it reaches, one for Visual Studio Code and one named .claude, the working directory for Anthropic’s Claude Code agent. The setup files placed there mean the payload can run when a developer opens the infected project in their editor or starts an AI coding session, not only at install time. This is the developer ecosystem CrowdStrike named, hit precisely, the editor and the AI assistant a developer trusts most and inspects least.The fix costs nothingOne control would have blunted the worm, and it costs nothing. Adam Meyers, who leads Counter Adversary Operations at CrowdStrike, laid it out in a pre-release interview under embargo. “Secure the software supply chain,” he said. “Simple things like not allowing any of your tooling to pull down the most recent dependencies, but maybe last week’s dependencies.” The delay is the whole point. “You’re still going to have pretty up-to-date stuff, but you won’t have that risk of pulling down something that was updated minutes ago, and now you’ve just onboarded some sort of malicious tooling.” A release held back a week gives the security community time to catch a poisoning that would otherwise reach every downstream build within minutes.That guidance is not hypothetical. npm shipped this capability in February 2026 with CLI version 11.10.0 as a setting called min-release-age. pnpm got there five months earlier with minimumReleaseAge. Either one lets a team reject any package version published more recently than a threshold they set. The keyv worm is the argument for turning it on.Meyers pairs the cooldown with a second discipline. Patch what attackers are exploiting before anything else. “You need to kind of focus your vulnerability mitigation and patching around the exploits that are known to the exploiter,” he told VentureBeat. He pointed to a resource most teams underuse. “CISA here in the United States puts out something called the Known Exploited Vulnerability Catalog,” updated weekly with flaws confirmed under active attack, government-maintained and free. “If you patch those vulnerabilities first, you’re going to probably be safer.”Meyers put hard numbers to the speed problem, numbers that do not appear in the published report. All of 2025 saw roughly 48,200 vulnerabilities registered as CVEs. When he checked the week before the briefing, 2026 had already reached 43,000. That volume breaks monthly patch cycles. “They cannot operate in 30-day patch windows,” he told VentureBeat. “As soon as a vulnerability is disclosed, they need to be moving towards patching or mitigating that particular issue.” CrowdStrike’s report pairs that trajectory with a finding that 88% of the exploitation it observed against vulnerabilities with a public proof of concept happened inside 48 hours of the code going public.GitHub hardened half the problemGitHub, which owns npm, has spent the past year hardening the registry against precisely this class of attack. The platform made two-factor authentication mandatory for publishing, revoked old never-expiring access tokens, and added trusted publishing so build systems push without stored credentials. Then in npm version 12, released in mid-2026, it flipped the most consequential default. The preinstall, install, and postinstall hooks that most registry malware relies on to execute the moment a package lands now require explicit approval.That change matters directly here because the keyv worm executes through a preinstall script, and npm 12 cuts both ways. JFrog confirmed that on npm 12 or newer, where preinstall hooks are off by default, the malware does not run at install time. Every organization still on an older npm, and most enterprises upgrade slowly, remained exposed. GitHub’s defenses hardened the wrong half of the attack more than the right one, making it harder for a malicious package to execute once it lands while doing less to stop an attacker from earning the right to publish. Account takeover remains the root cause. Kiran Raj, a security engineer at Endor Labs, said he saw the same pattern, an npm publishing token stolen and reused, in most cases a CI or service-account token harvested from a build runner that had itself installed a poisoned dependency. The worm never had to defeat provenance. It needed one set of valid credentials, and npm’s own publishing automation did the rest.Provenance attestation answers whether a package came from the pipeline it claims. It does not answer whether the human or token that triggered that pipeline was supposed to. Identity governance, who can publish and what their credentials can reach, is the weaker control. CrowdStrike names abuse of legitimate developer identities as the primary entry point for supply chain compromise. Meyers put it plainly. “They log in, they don’t hack in,” he said. The keyv maintainer’s account was that identity, and the trusted-publishing machinery did the rest on the attacker’s behalf.Why the boardroom is nextThe pressure to fix this will not come only from threat reports. It is about to come through contracts. Kayne McGladrey, a senior member of the IEEE, told VentureBeat in an exclusive interview that enterprises are starting to push software security obligations onto the vendors and maintainers in their supply chains. “We’re going to start seeing companies trying to contractually shift liability to other parties in their supply chain,” he told VentureBeat. “We’re using your technology, but we want you to do the security for it.” He compared it to how the Department of Defense forced its vendors to raise their game through the CMMC certification program. “Get better at cybersecurity if you want to sell us stuff.” For any company shipping software on open-source dependencies, that turns provenance, identity, and patch discipline into contractual exposure.What to do Monday morningFor a security team deciding what to do about this on Monday morning, the actions divide into five moves that map to the five ways this attack class operates. Each is a governance decision a board can fund and audit, not a tool a developer installs alone.How the attack operatesWhat the keyv worm showedWhat the board funds and auditsThe developer ecosystem is the target.CrowdStrike names package registries, CI/CD pipelines, container registries, and IDE extensions as the surface adversaries hit directly. The keyv payload planted persistence hooks in developer editor and AI tooling directories, not just the package.Require provenance attestation and trusted publishing before any dependency or editor extension enters a build. Give the board a standing inventory of registries, pipeline components, and extensions in scope. Treat developer tooling as an audited supplier category.Automation makes the spread fast.One stolen credential seeded a cascade that reached at least 868 packages and two billion monthly installs in hours, jumping between organizations every few minutes. The worm ran through a preinstall script, the install-time default npm v12 disables.Turn on npm’s min-release-age so tooling pulls last week’s versions, not releases published minutes ago. Require npm v12 or install-script blocking across the build estate. Plan for simultaneous multi-package compromise in resilience testing.Identity is the entry point.The attack began with one hijacked GitHub maintainer account. Provenance signed the poisoned releases because they ran through the maintainer’s own pipeline. Valid credentials, not a broken control, did the damage.Mandate phishing-resistant multifactor authentication for every maintainer with publish rights. Prefer short-lived scoped tokens over long-lived ones. Report developer and machine identity coverage to the board as a countable liability.The cloud is the real destination.The payload carried targeted extractors for cloud access keys, CI secrets, and production infrastructure tokens. The package compromise was the vehicle. Cloud-conscious criminal activity rose 171% in the first half of 2026.Classify developer workstations and CI runners as tier-zero assets with domain-controller rotation standards. Document cloud credential rotation in hours after any supply chain exposure. Report long-lived cloud keys with reduction targets.The patch window has collapsed.CrowdStrike observed 88% of exploitation with a public proof of concept inside 48 hours. Meyers put 2026 CVE registrations at 43,000 by late July against 48,200 for all of 2025. The keyv worm was live within hours, with no CVE to wait for.Reset patch service levels for internet-facing systems from days to hours and fund continuous emergency patching as a budgeted operation. Give the audit committee time-from-disclosure-to-mitigation as a standing metric. Build defensibility on documented pre-patch compensating controls.Package counts reflect Aikido and JFrog tracking as of August 4 and were climbing at press time.The keyv worm will be contained. Compromised versions pulled, stolen tokens rotated, affected packages republished clean. What will not change is the shape of the exposure it revealed. The developer ecosystem is now a primary target, the automation that makes it productive is the same automation that makes a worm fast, and the trust signals meant to secure it can be satisfied by anyone holding the right credentials.

Hark, the secretive AI startup founded earlier this year by serial entrepreneur and roboticist Brett Adcock, today announced Handoff, a “computer use agent” (CUA) that it says is among the top-performing in the world at navigating the open web on a user’s behalf — ordering dinner on DoorDash, booking flights on United and Delta, or messaging job candidates on LinkedIn — all autonomously, end-to-end.Sign-ups open to the public today at hark.com, with availability planned for later this month as part of the initial release of Hark’s software platform.The company says Handoff recorded the top-ever score on Online-Mind2Web (OM2W), a third-party benchmark with a human-evaluated leaderboard for web agents, posting a 97.7 against 92.8 for OpenAI’s GPT 5.4, 84.1 for Anthropic’s Claude Opus 4.8, and 69 for Google’s Gemini 2.5 Pro. Hark also says it can serve the model at less than one-tenth the token price of competing frontier models — $0.18 per million input tokens and $2.37 per million output tokens, versus $5 and $30 for GPT 5.5 — with per-turn model latency of 0.8 seconds.For each request, Handoff spins up a dedicated virtual computer with its own browser, file system, and terminal, and users can connect existing accounts so the agent can log in and act with their saved addresses, payment methods, and history. Hark’s research uncovered that despite people spending 75% of their screentime every day in a browser, fewer than 1 in 1000 websites have publicly accessible APIs, making it challenging for AI agents to take over the workload. In a roughly four-minute produced announcement video posted on YouTube and social media, Adcock — seated in a bare warehouse space that doubles as a metaphor for the company’s build-out — speaks a request aloud to Hark (“let’s liven this place up a bit… let’s do some roses, maybe some cherry blossoms”) and Handoff is shown navigating a florist’s website to place the order, while Adcock narrates that unlike a typical chatbot, Handoff “is always working, it’s looping,” and says he now uses it for “all of my recruiting efforts end to end.” In Hark’s announcement blog post, more demos are shown in realtime and 5x speed.But big some open questions about Handoff remain, especially for potential enterprise customers and users.High-scoring benchmarks…but against last generation’s models Notably, the benchmark comparisons Hark provided to VentureBeat for its Handoff AI agent are against GPT 5.5, GPT 5.4, Opus 4.8, and Gemini 2.5 Pro — the prior generation of frontier models. The current leaders, OpenAI’s GPT-5.6 and Anthropic’s Opus 5, are absent, as are strong open-source computer-use contenders like DeepSeek V4, Kimi K3, and Qwen3.8-Max. These newer models haven’t published Online-Mind2Web results, and no third party has posted them to the benchmark’s public leaderboard — meaning Hark’s “top-ever” claim cannot currently be checked against the strongest available systems. The omission is notable because the newest frontier models have posted their largest gains precisely in computer use: on OSWorld 2.0, a related benchmark covering full computer control, Anthropic’s Opus 5 scores roughly 70.6% versus 55.7% for the Opus 4.8 model Hark chose as its comparison point.The latency comparison comes with similar caveats: the 6.8-second and 6-second per-turn figures Hark cites for GPT 5.5 and Opus 4.8 were measured by Hark, in Hark’s own harness, with the competing models set to their highest — and slowest — reasoning level. No independent latency measurements exist for comparison.Asked by VentureBeat whether Hark plans to publish comparisons against those newer models, the company did not specify.Even within Hark’s own chosen comparisons, the “best” framing has an asterisk: on WebTailBench v2, one of the three benchmarks in Hark’s own results table, GPT 5.5 scores 72.3 to Handoff’s 68.6. Two of the three benchmarks (WebTailBench and an unnamed internal evaluation) were also run inside Hark’s own harness, with pass rates computed by Hark’s internal LLM judge — conditions the company controls.Hark’s pricing advantage is far clearer: Anthropic’s newer Opus 5 carries the same $5-per-million-input and $25-per-million-output list price as its predecessor, so Handoff’s roughly tenfold cost savings would hold up even against the current frontier — assuming its benchmark performance does too.Training and file accessHark’s research preview describes a sensible-sounding pipeline — supervised fine-tuning followed by asynchronous reinforcement learning using the GRPO algorithm, according to materials shared with VentureBeat prior to today’s announcement — but the company acknowledges it has only done post-training so far, with pre-training “planned for later this year.” That means Handoff is built on top of a base model Hark did not train. Asked which base model it is, and what mix of proprietary and open data Handoff was trained on, Hark hasn’t yet specified. Another big question mark for enterprise users: who can access the dedicated virtual computers and the files created on them?A Hark spokesperson said “security and privacy is a primary focus, but this is a technical preview,” adding the company will share more when the product reaches market at the end of the summer.Adcock’s history leading up to HarkHark is Adcock’s fourth company. He previously co-founded the talent marketplace Vettery (sold in 2018 for roughly $100 million), the air-taxi maker Archer Aviation, and the humanoid robotics unicorn Figure AI. Hark raised a $700 million Series A round in May 2026 at a $6 billion valuation — led by Parkway Venture Capital, with participation from Nvidia, AMD, Intel Capital, Qualcomm Ventures, Salesforce Ventures, and ARK Invest.Adcock seeded the company with $100 million of his own money and remains founder and CEO of both Figure and Hark simultaneously, a spokesperson confirmed.Asked how the two companies interact, the spokesperson said Hark models “are being trained on the Figure robots,” but that Adcock has no plans to combine them.Adcock’s promotional style has drawn skeptics. In April 2025, Fortune correspondent Jason Del Rey reported that Figure’s much-touted BMW partnership was far more modest than Adcock’s public claims of a robot “fleet” performing “end-to-end operations”: BMW spokesperson Steve Wilson said a single Figure robot was practicing picking up parts during non-production hours. But the partnership has advanced, and as of June 2026, BMW said the Figure 02 robot supported production of more than 30,000 BMW X3 vehicles during a 10 month-period, and that the next-generation Figure 03 robot was being deployed at the plant for a parts-sequencing role in logistics.On the social network X, Adcock called the story “mischaracterizations and downright lies” and threatened a defamation suit. Two months later, TechCrunch reported that Adcock skipped a promised live demo at a tech conference and sidestepped questions about the BMW deal onstage. None of that means Handoff’s numbers are wrong. The agent may well be excellent, and the pricing — if it holds — would undercut every major lab.

Presented by Tata Communications Continuous inference, agent-to-agent communication, and real-time data pipelines are generating unpredictable, always-on traffic that legacy architectures were never built to support. As AI moves from pilot project to operational backbone, the network is emerging as a critical control layer that determines performance, reliability, and cost. The shift is forcing organizations to question assumptions that have held for decades. Legacy systems were static and rigid, and lacked the ability to manage network demand efficiently or dynamically, while AI-ready networks need to adapt in real time. A study by Cisco notes that 80% of executives believe their company’s competitive survival will depend on agentic AI, and consumer usage of AI is already prevalent and accelerating. This is driving a fundamental shift in how traffic is generated, distributed, and experienced, with implications for service providers and enterprises that manage large-scale networks.This infrastructure gap is a global concern. A recent Bloomberg study, “The Future-Ready Enterprise,” commissioned by Tata Communications, found that while 3 in 4 leaders consider AI a board-level priority, nearly two-thirds (65%) of enterprises continue to operate on transitional or legacy infrastructure. This disconnect between ambition and reality is a primary obstacle to realizing value from AI investments.The performance bar has also moved by an order of magnitude. Traditional business applications could tolerate 100 to 500 milliseconds of latency, while mission-critical AI workloads now require latency below 10 milliseconds.”This isn’t just an incremental improvement,” says Kapil, Vice President, Global Network Services at Tata Communications. “It’s a completely different performance paradigm that breaks traditional network design assumptions, where such extreme low latency was never a primary consideration.”How network performance affects AI reliability and costThat gap between what legacy infrastructure can deliver and what AI demands turns network performance into a direct driver of AI reliability and cost. Treating the network as a best-effort transport layer introduces risk that many organizations only discover once a deployment underperforms in production. A model built for real-time fraud detection or supply chain optimization becomes worthless the moment network congestion delays the data it depends on, and Kapil notes that every millisecond of that delay can carry a direct financial or operational cost.”Relying on a ‘best-effort’ network turns multi-million-dollar AI stack investments into a high-stakes gamble, where performance is left to chance,” Kapil says.He adds that businesses often underestimate the complexity of using the public internet as a global enterprise network. Performance may look acceptable within a single country, but once data starts crossing borders or connecting to international cloud platforms, the lack of end-to-end control becomes an operational barrier.Distributed AI across cloud, edge, and enterprise increases complexityComplexity compounds as AI components spread across cloud, edge, and enterprise environments. Organizations often focus on compute power and data infrastructure while overlooking the network fabric that connects them. That blind spot often surfaces as a performance bottleneck created by high-frequency east-west traffic moving between GPUs. Distribution also widens the surface enterprises have to defend. Applications, users, and partner ecosystems are now spread across cloud, SaaS, edge, and device environments, and Kapil notes that AI-driven malicious bots account for roughly 37 percent of online traffic, making it increasingly difficult to distinguish legitimate users from automated threats. Many enterprises have responded by layering on siloed tools, which has produced fragmentation, inconsistent security, and a lack of unified visibility rather than a coherent defense.”SASE helps mitigate these risks by converging networking and security into a unified, cloud-delivered architecture,” Kapil says. “This convergence is enabling consistent policy enforcement across cloud, on-premises, and edge environments, while supplying the scalability and proximity needed to secure real-time AI-driven interactions.”The network must evolve from passive transport to an intelligent layerClosing that gap requires organizations to gain far greater visibility into how AI traffic moves across distributed environments and the ability to direct workloads accordingly. Kapil says that demands a different approach to network management.”Leaders must realize that the network is no longer passive ‘plumbing.’ It must be managed as an active, intelligent platform foundational to the entire AI stack,” he says. “That platform requires real-time observability into how and where AI traffic flows, paired with the control to orchestrate workloads across the most efficient and secure path available.” It’s the difference between merely connecting systems and unlocking new capability, for instance a seamless shopping experience during a peak sales period or a global sports broadcast streamed without buffering.This intelligence also changes how infrastructure teams spend their day. The network itself is now software-defined and API-driven rather than fixed by hardware configuration, which Kapil says shifts infrastructure teams away from reacting to outages and toward designing the systems that prevent them.”Instead of manually re-routing traffic during an outage, the team must define the rules, policies, and business outcomes for an intelligent fabric,” Kapil says. “The network itself then executes those policies automatically and autonomously.”Tata Communications is putting this principle into practice with its recently launched IZO Data Centre Dynamic Connectivity. The software-defined platform creates a “self-healing, intelligent network” using deterministic multi-path routing to reroute traffic automatically in seconds during a disruption.The company says the platform transforms resilience from a reactive process into an autonomous capability, providing the predictable, low-latency performance mission-critical AI applications require while reducing operational costs by up to 30%.Real-time AI requires predictable, low-latency connectivityDelivering on that intelligence in practice means giving mission-critical workloads dedicated capacity rather than having them compete for it. Reaching that level of consistency also requires enterprises to define performance far more precisely than they have in the past. It’s the shift from vague goals like “high performance” toward deterministic performance criteria where an organization commits to a guaranteed service level, such as latency for a specific workload not exceeding 10 milliseconds 99.999% of the time, for instance.That same demand for predictability extends into capacity planning. As AI workloads become larger and more dynamic, networking infrastructure must be able to absorb rapid shifts in demand without sacrificing performance or efficiency.”Without dynamic scalability, enterprises are forced into a false choice: either risk performance-killing congestion or engage in massive, inefficient overprovisioning of their network ‘just in case.’ This is incredibly expensive and unsustainable,” Kapil says.Building this foundation for the world’s most demanding AI workloads is already underway. For example, Tata Communications is collaborating with Amazon Web Services (AWS) to build one of India’s largestAI-ready networks. This high-capacity, resilient network will connect major AWS infrastructure locations in Mumbai, Hyderabad, and Chennai, providing the ultra-low latency backbone needed to accelerate generative AI adoption and cloud innovation across the country.He points to a consumption-based model, where software allows bandwidth and network functions to scale instantly with demand, as the operational alternative, since it lets organizations pay only for what they use while still protecting performance during spikes.CIOs should treat the network as a strategic investmentCIOs and infrastructure leaders need to reframe the network, not thinking of it as a cost center but as something closer to an insurance policy for an organization’s broader AI investment portfolio. An intelligent network de-risks those investments in three ways: enabling dynamic scalability that removes the need for overprovisioningstrengthening security and governance through the visibility needed to protect data and modelsand providing a flexible, programmable foundation that can absorb future compute demands without a full architectural overhaul.Getting there does not require enterprises to start from scratch. Choosing a partner with a proven track record is critical. Tata Communications was recently named a Leader in the Gartner Magic Quadrant for Global WAN Services for the 13th consecutive year, reflecting its completeness of vision and ability to execute. That recognition reflects continued investment in areas such as SASE capabilities for AI-driven security and high-capacity 800G services designed for AI-scale infrastructure.”We recommend a phased approach that begins with assessing the current state of the network and identifying inefficiencies, then prioritizing upgrades in areas such as AI-ready technologies, seamless data exchange, and advanced security solutions,” Kapil says. “Treating the network as a business enabler rather than overhead gives organizations the scalable, secure, and resilient infrastructure the AI economy will continue to demand.”Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

At Kilo Code, engineers are reading or writing code themselves only about 1% of the time now, according to co-founder Emilie Schario — the rest is agents. That shift is forcing new questions onto dev teams: which systems are safe to hand over, who cleans up when models goof up, how to support multi-model architectures, and whether skyrocketing token bills mean real progress or just burned IT budget.As far as tech leads from Replit, Kilo Code, and Symbotic are concerned, it’s a natural — and welcome — evolution as agentic AI becomes embedded into more and more enterprise workflows. “Unless something’s really broken or debugging, 99% of the time engineers are not reading or writing code anymore,” Emilie Schario, co-founder of Kilo Code, said at VB Transform 2026. AI good at greenfield, not so great at brownfieldFor Jared Go, distinguished engineer for AI and cloud at warehouse automation company Symbotic, the current moment is about directing the focus of AI. “These are my criteria,” he said. “Let’s look at it from the lens of security, elegance, clean, concise code, water tightness.” That way, AI does most of the heavy lifting, and human code review isn’t as critical.Human involvement becomes necessary further down the line, Go noted, because agents don’t make strong product decisions. “Greenfield [building brand new codebases] is so easy for agents. Brownfield [writing, updating, or maintaining existing code] we all know is where the actual challenge lies.” Replit takes a bit of a different tack: While the company has “gone very agentic,” they’ve been more conservative with AI coding, explained Amol Jain, head of product engineering. An agent reviews each pull request (PR) and assigns it a risk score; low-risk PRs are self-merged by their author, while others go to human reviewers who read the code and give feedback.“The idea was human on the loop, not human in the loop,” Jain said. Replit’s internal tool is essentially self-driving for software engineers; devs give a task to agents, which do end to end planning, implementation, and testing. “It’s a fleet of agents that run in their own cloud virtual machines (VMs) with access controls behind token proxies so they’re secure,” Jain said. He shared one example where an engineer couldn’t repro or solve a “very gnarly bug” deep in its systems. It was sent to an AI manager agent, which told it to go to sleep. The manager agent then spun up a bunch of underlying agents that found the issue; it subsequently spun up a bunch more agents that found the fix. Six hours later, AI had a PR ready for the bug that had puzzled human engineers. Multi-model is the future AI providers are also evolving beyond the lock-in model, as customers increasingly demand multi-model choice. Kilo Code, for its part, supports 500-plus models in its gateway. “Your software that you’re using to do agentic engineering should be decoupled from the model that you’re using to do it,” Schario said.For instance, Schario said companies often use expensive frontier-tier models to architect a project, then switch to a less expensive open-weight model for the rest of the work.It’s also important to respect model provider limitations, such as when they need to work in closed or isolated environments or providers in their specific regions. “It’s factoring in what’s important to you, what limitations you’ve set, what data retention policies you’ve established, what keys you’ve brought in, what commits you might have … into that routing decision,” Schario said. Replit, similarly, tends to have a better sense of the cost versus capability spectrum than its customers, Jain contended. “We are essentially making the decisions on users’ behalf of what model to use when, in what capacity, to minimize cost and maximize capability.”To tokenmaxx or not to tokenmaxxOf course, an important consideration as AI adoption increases is runaway costs, which has led to some enterprises tracking and capping AI use through tokenmaxxing.Concerns come from both sides, Schario said: internally and from customers. From the latter, she’s hearing, “I accidentally spent my whole AI budget for the year … so what do I do now?” In response, Schario said Kilo Code points customers to the same workflow: use expensive models for planning, then open-weight models for affordability.Further, sharing skills, strong guidance, and Model Context Protocol (MCP) will empower models. “Realizing where you can really uplevel your team to help them get the most out of the models they’re using is going to make a big difference,” Schario said. Internally, meanwhile, Schario noted one particular engineer that has a “heavy foot” and is constantly at the top of the usage board. “I regularly have to nudge, ‘What are you doing there?'” she said. It’s easy to look at a $600 bill for daily work and react, “Wow, that’s so much,” but looking at the amount of work completed can sometimes justify the cost.“Cost per pull request is the metric that I’m paying attention to right now,” Schario said. “It feels like the closest proximity for how I can measure value.” Ultimately, AI changes how enterprises are thinking about ROI because spend is not the problem. “The spend with no return on that spend is the problem.” Symbotic, for its part, has set per-month cost tiers for its employees. The company built a tool that gives managers visibility into PRs and usage trends. They can then move users up or down a tier as they see fit, Go explained. “Having a cap and seeing how many people went up in cap this month makes a big difference when you’re trying to corral these costs and make things efficient,” Go said. When Cursor — which Symbotic uses heavily — ended a legacy discount that had grandfathered the company into a flat per-request rate even for frontier models, and moved everyone to full pricing, it forced a company-wide reckoning on efficiency, Go said. “People were saying, ‘You should try this model … This works better for this C# code, this whatever,'” he said.But the cost problem is increasingly moving out of IT; Replit, for one, broadened agents beyond engineering, and eventually found that a user on the support side had “blown through an insane amount of money,” Jain said. When they looked under the hood, they figured out it was because they were running an automation on GPT 5.5 Pro Max.“At least till that point, the ROI was rather clear,” Jain said. “We could see engineering productivity 3X, so no one had questioned it yet.” Visibility that isn’t “anti-productive,” model routing, and sensible defaults are critical, he emphasized. “Most tasks do not need the frontier.”