Tech Insights 2026 Week 32

Do you still have IT systems where your employees have to manually click around in a browser or a native app, and which cannot be automated by agentic AI?

Four weeks ago, our main website at tokentek.ai ran WordPress. If you have ever used WordPress, you know the experience. You click around the UI to make changes. You subscribe to plugins for backups, file uploads, SEO, web components, and newsletters. You need to keep everything secure and updated, and you do it all by hand in the browser. Our site was in English, but we needed to add Swedish support and improve our SEO. We also wanted to move things around to make the site better structured. An AI could solve these tasks in minutes, but doing it manually in WordPress would take us hours or even days.

So we used Claude Fable to build an entirely new website. It copied the old site 1:1 and built an entirely new publishing workflow. All texts are now saved as markdown files and checked into GitHub. This means we can give publishing access to anyone in the company just by managing repo access. Everything looks exactly like it did in WordPress, but it runs on an architecture we own, with zero plugins and zero monthly costs other than basic web hosting. If you are interested in how we did it, I just published a deep dive here: Case: From WordPress to Astro with AI, zero lines of code by hand | TokenTek

When you read the news below about how AI models improve their own harnesses to run better, faster, and cheaper, think about your own IT systems. As long as your systems are stuck in the old human-clicks-around-the-UI paradigm, you will never get the benefits of agentic AI in your production pipeline. Creating an exact replica of an existing IT system or website is simple for today’s AI models. Maybe give it a try with one of your own smaller systems to see how it works?

Thank you for being a Tech Insights subscriber!

Listen to Tech Insights on Spotify: Tech Insights 2026 Week 32 on Spotify

Notable model releases last week:

Grok Voice Think Fast 2.0 by xAI. Raises Artificial Analysis’ agentic score from 52.1% to 56.5%, cuts time to first audio from 1.25s to 0.70s, and costs $0.08 per audio minute.
Inkling-Small by Thinking Machines. 276B-total, 12B-active open-weight multimodal MoE with 1M-token context and controllable reasoning effort, scoring 80.2% on SWE-bench Verified and 64.7% on Terminal-Bench 2.1.
Lyria 3.5 by Google. Music generation model with richer melodic structures, improved lyric prompt adherence, more expressive vocals and pronunciation, and finer tempo and duration control in Flow Music.
MAI-Cyber-1-Flash by Microsoft AI. Compact, code-heavy security model derived from MAI-Thinking-1; paired with GPT-5.4 in MDASH, it scores 96% on CyberGym, 12 points above Mythos, and cuts costs 50% versus MDASH’s current best stack.
MiniMax H3 by MiniMax. Open-weight generation model with omni-reference support, commercial-grade output, and a focus on cost efficiency.

THIS WEEK’S NEWS:

Pacing the Frontier Seeks Option to Buy Time
OpenAI Publishes 10 Astra Math and TCS Results
OpenAI Used GPT-5.6 Sol to Cut Serving Costs 20%
OpenAI Raises GPT-5.6 Sol to 38.3% on ARC-AGI-3 Public Set
OpenAI Cuts GPT-5.6 Luna and Terra Prices, Adds Sol Fast Mode
Model Context Protocol Moves to Stateless Architecture
GCC Rejects Legally Significant LLM Contributions
Hugging Face Publishes Technical Timeline of OpenAI Agent Intrusion
Anthropic Publishes Claude Attacks on HAWK and Reduced-Round AES
Anthropic Reveals Three Real-World Claude Cyber Incidents
Moonshot AI Releases Kimi K3 Weights With Commercial Limits
Google DeepMind Launches Gemini Robotics ER 2 With 91.3% Moment-Finding Accuracy
European Commission Opens Call for Up to Seven AI Gigafactories

Pacing the Frontier Seeks Option to Buy Time

https://www.pacingthefrontier.com/

The News:

Pacing the Frontier is a statement from over 1,000 employees of frontier AI companies arguing that society may need the option to buy time as automating AI research could cause capabilities to outrun human understanding or control.
The statement says leading AI companies could be close to automating AI research, with capability development potentially accelerating beyond our ability to understand or control the resulting systems.
The statement says buying time would help address emerging risks, develop security measures, and strengthen oversight.
The statement frames the issue as a coordination problem, saying companies and countries face intense competitive pressure not to unilaterally slow that acceleration.
The statement says the world currently lacks the technical and governance tools to deliberately pace frontier-wide progress.

My take: When you read the articles below, like GPT-6 (code named “Astra”) producing 10 results on long-standing open problems in mathematics and theoretical computer science, GPT-5.6 Sol autonomously rewriting parts of its own production kernel saving cost by 20%, and GPT-5.6 scoring an amazing 38% on the ARC-AGI-3 test just by changing two settings in the harness, you might just start to wonder how long it takes before AI models are actively building new AI models and harnesses all by themselves.

I think having an open discussion about pacing the evolution of AI models is not only welcome but actually necessary, because I believe we are very close to self-improving AI systems. Whether this specific statement will lead somewhere I don’t know, and some users in the Reddit discussion similarly question whether asking merely for an option to slow down will ever change actual development behavior, but having this discussion in the open I think is critical.

Read more:

OpenAI Publishes 10 Astra Math and TCS Results

https://openai.com/index/ten-advances-in-mathematics/

The News:

OpenAI published a selection of ten new results on open problems in mathematics and theoretical computer science, saying an internal version of Astra, its next major model, found them for roughly $2,000 at Sol API rates.
OpenAI says each problem had seen no progress on the main result for at least a decade, and most had been stuck much longer.
The set spans high-dimensional geometry, coding theory, arithmetic circuit complexity, group theory, operator algebras, quantum complexity, lattice cryptography, and extremal combinatorics.
Specific claims include new upper bounds for high-dimensional sphere packing and polynomial-factor hardness of approximation for the closest vector problem.
Humans prepared the manuscripts with the same model, and the model formalized each argument in Lean certificates.

My take: This is still a very early report, with results not being peer reviewed or evaluated by external reviewers. What makes it important however is that it gives a clear indication where mathematics and research is heading. Noting the roughly $2,000 API cost for the solution search, a post on X frames the economics by pointing out that AI is changing mathematics through cost before it changes it through autonomy. The main work for researchers in the near future will be preparing manuscripts for the AI and formalizing the proofs, with the AI doing most of the actual research work.

Read more:

OpenAI Used GPT-5.6 Sol to Cut Serving Costs 20%

https://openai.com/index/gpt-5-6-frontier-intelligence-efficiency/

The News:

OpenAI published a technical post on the GPT-5.6 family, including Sol, Terra, and Luna, saying GPT-5.6 Sol autonomously rewrote production kernels and helped cut end-to-end serving costs by 20%.
Terra performs as well as GPT-5.5 on intelligence benchmarks at half the price, $2.50 per 1M input tokens.
Luna is the fastest and most affordable tier, priced 80% below Sol at $1 per 1M input tokens.
Sol also improved its own speculative decoding draft model through hundreds of experiments, raising token-generation efficiency by more than 15%.

My take: As can be seen in the article below on GPT-5.6 ARC-AGI-3 improvements, configuring an agentic harness is quickly becoming a critical skill for AI performance and cost optimizations. And I think this comes as a surprise for most people. The past year I have gotten the question “what is it you will do at TokenTek in the future when the AI does all the work” maybe a hundred times, and the answer to this is becoming clearer by the month.

A properly configured agentic harness for business operations (R&D, purchasing, sales, operations) will give dramatically better results than a mediocre configured harness, while both use the same AI model. Because a single complex task can involve 30 model requests plus tool calls, small inefficiencies inside the loop are paid repeatedly. This is why all the frontier companies are starting their own forward deployed engineer businesses. We get proof every week (like the article in this news item) how much better an AI model performs when the harness is set up properly, and the same applies to any agentic system in any company. But doing it properly is a skill that takes a long time to master.

Read more:

OpenAI Raises GPT-5.6 Sol to 38.3% on ARC-AGI-3 Public Set

https://openai.com/index/how-two-settings-tripled-our-arc-agi-3-scores/

The News:

OpenAI published an analysis showing that enabling retained reasoning and compaction in its Responses API lifted GPT-5.6 Sol to 38.3% on the public set of the ARC-AGI-3 interactive reasoning benchmark, nearly tripling its official-harness result.
Under the official harness, private reasoning was discarded after each action and older history was lost through rolling truncation.
OpenAI said passing the previous response ID in the Responses API retains reasoning across tool calls and turns.
On the public set, the official-harness score was 13.3%; with retained reasoning and compaction, it reached 38.3% while using 6x fewer output tokens.
OpenAI recommended using the Responses API, retained reasoning, and compaction when maximizing performance or comparing models.

My take: I think the key point here is not that two simple harness changes made GPT-5.6 Sol go from 13.3% to 38.3% on the public set of the most difficult AI benchmark we have today. Instead I think this demonstrates how it is nearly impossible to evaluate AI models today since much of their performance now comes from how their harness is configured. The model name alone no longer describes what was evaluated, as the complete system relies on these API settings to let the model understand, reason, reflect and interact with its environment.

You know I am not a fan of AI benchmarks, and the benchmaxxed Claude Opus 5 I wrote about last week is an excellent example of just that. On benchmarks it scores nearly as good as Fable, but put it to work on a difficult task and it is like a day and night experience. I would be more than happy if we could just skip benchmarks altogether going forward.

Read more:

OpenAI Cuts GPT-5.6 Luna and Terra Prices, Adds Sol Fast Mode

https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/

The News:

Starting July 30, OpenAI cut API prices for GPT-5.6 Luna and Terra and added a new Fast mode for GPT-5.6 Sol, with Luna’s price falling 80%.
Luna now costs $0.20 per million input tokens and $1.20 per million output tokens.
Terra now costs $2 per million input tokens and $12 per million output tokens, down 20%.
Sol stays at $5 input and $30 output per million tokens, and Fast mode replaces Priority Processing with up to 2.5x faster speeds at 2x the price.
ChatGPT Work and Codex subscription prices and quota budgets are unchanged, but Terra and Luna usage now consumes fewer credits.

My take: GPT-5.6 Luna is OpenAI’s response to Gemini Flash and Claude Haiku, quick and cheap for isolated tasks. In this Hacker News discussion, some users interpret Luna’s 80% price reduction as evidence of pricing pressure from cheaper Chinese models such as GLM 5.2.

As for the 2.5x performance increase in Sol, this is unfortunately only in the API, so if you use an OpenAI Pro subscription you still only get 1.5x faster speeds in fast mode. OpenAI has teased GPT-5.6 Sol running on Cerebras at 750 tokens / second for quite some time now, and this is when things will start to get really interesting for us power users.

Read more:

Model Context Protocol Moves to Stateless Architecture

https://venturebeat.com/infrastructure/mcp-just-got-its-biggest-update-ever-heres-what-changes-for-ai-agents

The News:

The Agentic AI Foundation released the 2026-07-28 Model Context Protocol update, moving the standard for connecting AI clients to external tools to a stateless architecture and setting a 12-month deprecation window.
The old design required a client to stay attached to one server instance, so requests could fail when a pod holding session state disappeared.
With state moved onto the wire, MCP servers can now sit behind standard load balancers instead of sticky sessions or shared state.
MCP Apps and MCP Tasks are now official extensions for server-rendered interfaces and long-running async jobs that clients can poll.
The auth changes require issuer validation of the iss parameter to block OAuth mix-up attacks.
According to VentureBeat’s interviews with maintainers, MCP SDK downloads have roughly doubled in six months to about 250 million per week.

My take: I first wrote about this July 28 MCP Specification in Tech Insights 2026 week 23, and this is an important release. With the new revision it is finally possible to run MCP servers behind standard load balancers and in Kubernetes clusters. Deprecated features now also get a minimum 12-month window before removal.

Personally I am not a big fan of the MCP protocol. It is OK when you cannot use local services through CLI, but MCP has poor predictability. Moving state out of the protocol and into the agent application is good, but making MCP fit as a puzzle piece in the recent rapid development of agentic harnesses for predictable autonomous self-improving AI systems will not be easy.

Read more:

GCC Rejects Legally Significant LLM Contributions

https://www.xda-developers.com/gcc-the-core-compiler-behind-linux-draws-a-hard-line-against-ai-code/

The News:

On July 29, GCC’s steering committee adopted an AI contributions policy for the GNU Compiler Collection that rejects legally significant contributions containing or derived from LLM output, using GNU’s roughly 15-line threshold.
GNU maintainer guidance treats contributions below around 15 lines of code or text as not legally significant.
The policy still allows AI tools for research, analysis, bug discovery and reporting, and patch review.
Submitted patches should not contain AI-generated output.

My take: The problem here isn’t the use of AI tools. The real issue is that the combination of cheap AI models, mediocre agentic harnesses, poor human engineering skills and lack of experience with iterative software development quickly produces extreme volumes of shitty code in almost no time. And this is not an easy task to solve.

What I believe will happen is that every open source repo will have to have some kind of test for people wanting to contribute to it. Give them 3-4 difficult tasks to solve. Evaluate their work both manually and with an AI. Expect them to be fully transparent on the process and tools they used. Vibe coders get banned. This is how I would set it up. Or just do like Peter Steinberger / OpenClaw did, rename Pull Request to Prompt Request, ask Peter what to build with AI and he will do it himself. This is how I do it with my plugin Notebook Navigator, and it is much faster and easier than having to deal with giant untested vibe-coded Claude Code PRs.

Read more:

Hugging Face Publishes Technical Timeline of OpenAI Agent Intrusion

https://huggingface.co/blog/agent-intrusion-technical-timeline

The News:

Hugging Face published a technical timeline of its July intrusion, reconstructing about 17,600 recovered attacker actions by an autonomous agent running an internal OpenAI cyber-capability evaluation.
Hugging Face says the agent appears to have treated the ExploitGym run as a cheating problem, trying to reach production systems and steal reference solutions.
Initial access into Hugging Face came through two local dataset-processing bugs that bypassed URL allowlists, an HDF5 file disclosure path and a Jinja2 template injection in a production Kubernetes worker pod.
The foothold exposed cloud credentials, a Tailscale auth key, and a JWT signing key that later let the agent enroll devices and mint short-lived identity tokens.
According to Hugging Face, the only customer content accessed was five datasets tied to ExploitGym or CyberGym, and no other customer-facing models, datasets, Spaces, or packages were affected.
Claude Opus and Fable refused much of the exploit analysis, so the team ran GLM-5.2 on its own infrastructure to decode staged payloads and rebuild the timeline.

“Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform”

My take: I did not read this entire 100% AI-generated article, but the key finding is that Hugging Face could not use Opus to analyze the attack logs since it flagged the prompts as cybersecurity related. Instead they resorted to using a quantized version of GLM 5.2 running in their own infrastructure to track about 17,600 recovered attacker actions. This raises an important question: how do you protect yourself from an agentic AI cyberattack if you cannot use AI yourself for protection?

Read more:

Anthropic Publishes Claude Attacks on HAWK and Reduced-Round AES

https://www.anthropic.com/research/discovering-cryptographic-weaknesses

The News:

Anthropic published research showing that Claude Mythos Preview found improved attacks on HAWK, a NIST post-quantum cryptography candidate, and on 7-round AES-128, with the HAWK result cutting the scheme’s effective key strength in half.
Anthropic says the HAWK work produced a faster full key-recovery attack on HAWK-256 after the scheme had already gone through two years of expert human review.
Finding, developing, and verifying the HAWK attack took about 60 hours and about $100,000 in API cost.
For 7-round AES-128, Mythos’s Möbius Bridge fingerprinting made the best prior meet-in-the-middle attack 200-800 times faster.
Anthropic says neither result affects deployed systems because HAWK is only a candidate and the AES work does not break full 10-round AES-128.

My take: AI models have shifted the discovery of software bugs from the implementation layer to the underlying mathematical algorithms. This is something very few companies in the world would have the capacity to do by themselves. While some commenters in a Hacker News discussion of Mythos Preview argue that promoting a gated model amounts to farming hype around something that may as well not exist, this power is now available to most large companies through an AI model.

What it means in practice is that it’s no longer enough to scan the source code for errors; you need to go one level deeper. And while finding, developing, and verifying this attack took a week and cost $100,000 in API usage, it did something that would not have been possible if done manually within a reasonable time frame.

Read more:

Anthropic Reveals Three Real-World Claude Cyber Incidents

https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

The News:

On July 30, Anthropic disclosed that a review of Claude cybersecurity evaluations found three incidents in which models reached the open internet and gained unauthorized access to the production infrastructure of three real organizations.
All three came from capture-the-flag tests with evaluation partner Irregular, where Claude had been told it was in a simulation with no internet access but a misconfiguration left live internet access available.
The runs involved Opus 4.7, Mythos 5, and an internal research test model, and Anthropic says only the newest model stopped once it concluded the target was real.
In the Mythos 5 case, Claude published a malicious package to real PyPI, which stayed live for about an hour, ran on 15 real systems, and exfiltrated credentials from a security company’s scanner.
In the most serious Opus 4.7 case, Claude attacked a real company sharing its fictional target’s name, reached a database containing several hundred rows of production data, and kept attacking after recognizing the environment was real.
Anthropic calls the incidents closer to a harness and operational failure than a model alignment failure, unlike OpenAI’s July 21 case where models escaped isolation by exploiting a zero-day vulnerability.

My take: When you read things like this it really makes you wonder why these companies simply do not run these models on their own isolated networks, disconnected from the rest of the Internet. The potential damage these models can do, especially when being told they are running in a simulation, could be devastating. Instructions describing a network boundary are simply not a substitute for physical infrastructure enforcing it.

Maybe it is just laziness not having to build dedicated test sites with their own infrastructure, but going forward it looks like running the test systems directly connected to the Internet like both Anthropic and OpenAI are doing now is not sustainable. Over in a post on X, users summarize this operational lesson by arguing that agent evaluations must be treated like production-grade security systems with strict egress controls.

Read more:

Moonshot AI Releases Kimi K3 Weights With Commercial Limits

https://venturebeat.com/technology/kimi-k3s-full-weights-are-here-but-theyre-open-with-a-caveat-what-enterprises-should-know

The News:

Moonshot AI released the full weights for Kimi K3, its 2.8-trillion-parameter multimodal Mixture-of-Experts model, but attached a custom license that adds commercial conditions for some large users.
Model-as-a-Service operators whose aggregate revenue with affiliates exceeds $20 million over any consecutive 12 months must enter a separate agreement with Moonshot AI before commercial use.
Commercial products or services above 100 million monthly active users or $20 million in monthly revenue must display “Kimi K3” prominently in the interface.
Internal deployments are carved out, so those two clauses do not apply when the model, its outputs, and its capabilities are not made available to third parties.
The rollout also includes a 47-page technical report, inference infrastructure, optimized attention kernels, MoE communication libraries, deployment components, and implementation support for vLLM and SGLang.

My take: The full weights for Kimi K3 were finally released, with a small caveat. If you use K3 in a commercial product, you need to show Kimi K3 in the interface once you reach $20 million in monthly revenue or 100 million active users. If you only use it internally for software development and testing, however, these rules do not apply and you are free to use it any way you like, as long as you have the hardware for it. Kimi K3 is the most interesting open source model we have seen in over a year, and it will be very interesting to see how companies adopt it going forward.

Read more:

Google DeepMind Launches Gemini Robotics ER 2 With 91.3% Moment-Finding Accuracy

https://blog.google/innovation-and-ai/models-and-research/google-deepmind/gemini-robotics-er-2/

The News:

On July 30, Google DeepMind launched Gemini Robotics ER 2, an embodied reasoning model that watches continuous video, plans multi-step work, and coordinates multiple robots, reporting 91.3% accuracy on moment-finding tasks.
Google says ER 2 can spot the exact frame where a critical event occurs with a 0.96 second mean absolute distance.
On progress classification, it scored 57.4% across five completion bands, which Google says helps robots retry failed steps without restarting an entire workflow.
ER 2 acts as the high-level planner and hands off motor execution to lower-level VLA models.
The model is public through the Gemini API and Google AI Studio, with Enterprise Agent Platform in private preview, while Google’s VLA and On-Device robotics models are still limited to early-access partners.

My take: So many new things in version two of Google “Embodied Reasoning”! While the benchmarks show modest improvements, what makes this release interesting is all the small details. First off, it now has real-time orchestration which removes the “stop and think” pauses, so robots instead can reason while acting. Robots can now also invoke tools like Google Search, VLA models, and custom functions without extra wrappers.

ER 2 can now track task completion with 57% accuracy, pinpoint exactly when a key event happens like when to stop pouring liquid, and coordinate multiple robots by sharing semantic understanding and handing off subtasks. We are already seeing early ecosystem adoption, with a post on X by VLM Run pointing out they have integrated ER 2 into their Orion 2 visual-agent harness to create composable and inspectable embodied-reasoning programs. Robot development is advancing at an amazing speed right now, and it will not be long before we see it trickling down to large-scale mass production.

Read more:

European Commission Opens Call for Up to Seven AI Gigafactories

https://commission.europa.eu/topics/competitiveness/competitiveness-coordination-tool-projects/ai-gigafactories_en

The News:

The European Commission launched a call for tenders to set up up to seven AI Gigafactories across Europe, a large-scale AI compute program backed by up to €10 billion in EU and national funding.
The Commission says the initiative is expected to mobilise at least €20 billion in private investment.
Start-ups, scale-ups, SMEs, industry, researchers and public authorities are meant to get infrastructure for training, fine-tuning and running advanced AI models.
Interface EU describes the planned Gigafactories as four times larger than the EU’s AI Factories.
The tender closes on November 12, award decisions are expected in early 2027, and selected facilities are expected to become operational within 18 months of contract signature.

My take: This is exactly what we need to catch up in Europe with the rest of the world, but there are so many questions left unanswered. Like which EU companies will provide the €20 billion funding in this? And where will these gigacenters be built? How will they be powered?

They are called gigafactories because they consume gigawatts in power consumption. I spent quite some time trying to find answers to these very basic questions, but there aren’t any. While the Commission received 77 informal proposals, no winning locations or selected consortia have yet been identified. All this is right now is a powerful initiative with no implementation plan and no stakeholders. Hopefully we will know more after November 12 when the tender has closed.

Read more: