Yesterday in AI · 16 July 2026

Thinking Machines Lab shipped an Inkling Model Card with the model it released on July 15, a Mixture-of-Experts design with 975 billion total parameters, 41 billion of them active, and full weights on Hugging Face. The card's safety section asks a question specific to open releases: whether the model adds dangerous capability beyond what people can already download. Across evaluations spanning everyday interaction and dangerous-capability testing, the lab concluded that Inkling "did not present risk of material uplift beyond what's already available in the open-weight ecosystem." On X, Nathan Lambert called the safety section detailed and practical, and Alex Robey, who works on safeguards at the lab, amplified the conclusion.

For CBRN and cyber, the card describes measuring knowledge and procedural uplift through internal evaluations, external testing, and refusal-suppressed variants meant to estimate latent capability once safeguards are removed. Anyone who downloads the weights can try to strip those safeguards, so the card estimates what a stripped model could do that existing open models cannot. For loss of control, the lab benchmarked agentic capability, strategic deception and sabotage potential against public frontier models, and placed Inkling materially below them. Because Inkling reasons over text, audio and images, the team also checked that safety behavior held consistently across all three input types. A refusal that triggers on a typed request can miss the same one delivered as audio or an image. The lab ran multi-turn, open-ended external red-teaming to surface failures that build up over a long conversation.

On everyday interaction, the card reports testing for sycophancy, harmful manipulation, and psychological-harm patterns like parasocial dependency and the validation of delusional reasoning. On the safeguard benchmarks it tabulates, Inkling posted 78.0% on FORTRESS's adversarial split, 95.9% on its benign split, and 98.6% on StrongREJECT.

The section marks where the model still fails. The lab names an "occasional tendency to comply with role-play and indirectly framed prompts concerning harmful topics," says that behavior matches what any open-weight model shows, and prescribes defense-in-depth: downstream moderation tools such as Llama Guard can be layered around Inkling to catch jailbreak attempts, screen outputs and enforce use-case rules, alongside rate limiting, monitoring, pre-deployment evaluations, and human oversight in high-stakes contexts. The card advises against deploying Inkling for medical, legal or safety-critical decision-making without additional fine-tuning and validation.

Thinking Machines has detailed how Inkling, the open-weights multimodal model it released for fine-tuning, trades reasoning depth for speed and lower cost. Its launch thread and announcement describe controllable thinking effort, a setting that moves the model along a cost-performance curve by spending more or fewer tokens on reasoning. Sweeping that effort from 0.2 to 0.99 across Terminal Bench 2.1, Humanity's Last Exam, and IFBench, the company shows Inkling reaching a given score with fewer generated tokens than models including GLM-5.2, Kimi K2.6, Nemotron 3 Ultra, and GPT-OSS. On Terminal Bench 2.1 it matches Nemotron 3 Ultra at roughly a third of the tokens.

In the announcement, Thinking Machines calls Inkling "not the strongest overall model available today, open or closed," and pitches it as "a good open-weights base for customization," resting the case on multimodal capabilities, efficient thinking, and fine-tuning on Tinker. At effort 0.99, Inkling scores 63.8% on Terminal Bench 2.1, 79.8% on IFBench, and 29.7% on the text-only Humanity's Last Exam, a figure the company notes reflects an earlier checkpoint. On audio, the launch thread ranks it among the strongest open-weights models, citing VoiceBench, MMAU, and AudioMC.

Thinking Machines pretrained Inkling on 45 trillion tokens of text, images, audio, and video; the model activates 41B of its 975B parameters per token and carries a 1M-token context window. The company also previewed Inkling-Small, a 276B model with 12B active that it says matches or exceeds its larger sibling on many benchmarks. Inkling is on the Tinker fine-tuning platform now, with full weights on Hugging Face, including an NVFP4 checkpoint for NVIDIA Blackwell hardware. Inkling-Small remains a preview, with weights to follow.

Thinking Machines Lab published Introducing Inkling, releasing the first model it trained from scratch with open weights. Inkling is a Mixture-of-Experts transformer with 975 billion total parameters, 41 billion of them active, and a 1-million-token context window, pretrained on 45 trillion tokens of text, images, audio, and video. The lab put the full weights on Hugging Face under an Apache-2.0 license and opened the model for fine-tuning on its Tinker platform. It also previewed a lighter model, Inkling-Small, with 12 billion active parameters, which it says matches or beats the larger model on many benchmarks. On X, Nathan Lambert called Inkling a “new best American model” and a “clear step up from Nemotron Ultra,” and credited John Schulman and the team.

The announcement itself calls Inkling “not the strongest overall model available today, open or closed,” and pitches it as a base for customization: native text, image, and audio input, controllable thinking effort, and fine-tuning on Tinker. Lambert placed it behind GLM 5.2 on agentic tasks and Kimi K2.6 on multimodal ones, and the benchmark tables the lab published track that ranking. On Terminal Bench 2.1, Inkling scores 63.8 to Nemotron 3 Ultra's 56.4 but trails GLM 5.2 at 82.7; on Humanity's Last Exam with tools it reaches 46.0%, ahead of Nemotron and below GLM 5.2 and Kimi K2.6, both above 54%. The open models ahead of it come from Chinese developers, GLM 5.2 from Z.ai and Kimi K2.6 from Moonshot AI, which is why Lambert qualifies his claim with “American.”

The lab also trained Inkling for calibration and forecasting, reporting ForecastBench and Prophet Arena scores, and trained it to answer questions on topics subject to censorship; on Cognition's Propaganda and Censorship Eval, it reports “censorship non-compliance.” Reinforcement learning ran past 30 million rollouts across two continuous runs on Nvidia GB300 NVL72 systems, with a hybrid optimizer that applies Muon to large weight matrices and Adam to the rest.

Lambert singled out the model card's safety section. After internal and external testing across dangerous-capability and human-interaction risks, Thinking Machines Lab found Inkling well below frontier capability on loss of control and concluded it “did not present risk of material uplift beyond what's already available in the open-weight ecosystem.” The card names one residual risk, a tendency to comply with role-play and indirectly framed harmful instructions, and recommends pairing the model with downstream moderation tools such as Llama Guard for consumer-facing deployments. On the adversarial FORTRESS refusal benchmark, Inkling scored 78.0%, which the lab presents as the strongest built-in safeguards among the open-weights models it compared.

Thinking Machines released its first publicly available model, Inkling, on July 15. The company's model page presents it as an efficient open model for text, images, and audio, with open weights that users download and fine-tune on Tinker, its training platform. The release gives concrete form to the agenda of the lab's July 10 essay, which argued that organizations should own and train model weights on their tacit knowledge instead of renting a model frozen and shaped elsewhere.

MarkTechPost details the architecture: a mixture-of-experts model with 975 billion total parameters and about 41 billion active on any token, released under an Apache 2.0 license, with a controllable reasoning-effort setting from 0.2 to 0.99. TechCrunch's Connie Loizos reports that the model trained on 45 trillion tokens of text, image, audio, and video, and that the company calls Inkling "not the strongest overall model available today, open or closed." MarkTechPost's benchmark table bears that out: Inkling trails GLM 5.2 on the Terminal Bench 2.1 coding test, 63.8 percent to 82.7. It also matches Nemotron 3 Ultra on the same test while spending about a third as many tokens.

TechCrunch also reports an early customer result: in a collaboration with Bridgewater Associates, Inkling reached 84.7 percent on financial-reasoning tests at roughly one-fourteenth the cost of proprietary models. The same report notes that Thinking Machines used other open models, including Moonshot AI's Kimi, to generate early post-training data, a version of the cross-model learning the essay envisioned.

Sam Kriss opens his July 16 essay "Infinite America," on the newsletter Numb at the Lodge, with a crank's dare: forget 1776, the United States is thousands of years old, a riverine civilization of the Mississippi valley that has expanded and contracted across millennia like a beating heart. He spent the semiquincentennial in Los Angeles, where the fireworks went ahead but the big number barely registered, an indifference he sets against the tricorn-hat, powdered-wig frenzy of the 1976 bicentennial. Kriss plays the conceit deadpan, a parody of ancient-civilization crankery, and turns it to a serious end, arguing the country's real character owes nothing to the founding myth's prudent yeoman farmers reading their Horace and Livy.

Real archaeology runs through the joke. He builds the case on Cahokia, the pre-Columbian city near modern St Louis that at its twelfth-century peak may have held more than 40,000 people, sprawling at a density he places between Los Angeles County and Miami-Dade. He describes the hundred-foot Monks Mound and the Mound 72 beaded burial that Melvin Fowler's University of Wisconsin-Milwaukee team uncovered in 1967, where a man and a woman lay on twenty thousand shell beads with the remains of more than fifty young women, apparently strangled, at their feet. Something at the junction of the rivers, he writes, both looked and behaved like the United States.

The Natchez carry the argument further. Kriss recounts La Salle's 1682 visit and the ethnography of Antoine-Simon Le Page du Pratz, who lived among them in the 1720s: a Great Sun ruling from an earthen mound, atop a matrilineal, strictly exogamous hierarchy of Suns, nobles, honored people, and the commoners the Natchez called stinkards. He invokes the real Natchez Paradox and the 1971 Ethnology paper by White, Murdock, and Scaglion that dissolved it, then adds his own comic fix: the impossible math works only if the society keeps absorbing immigrants at the bottom rank. An engine for upward mobility, fed by a constant supply of bodies.

Kriss aims the satire at contemporary America seen from the air. Flying into LAX, he reads the endless residential grid as an abacus of human lives, "a society of total but invisible control," and finds its ancestor in Cahokia, centuries before the Pilgrims. He garbles George Washington out of uwahšiL, the first Great Sun's Natchez title, and recasts the Founding Fathers as half-remembered deities and culture-heroes. The shrugged-off anniversary becomes his evidence that the founding story has worn thin, that Americans half-sense their country is older and stranger than the version they were handed. The only version he refuses to believe is the literal one: a nation built on a proposition it can no longer quite make out.

In a report titled GDM AI Control Roadmap (v0.1), posted to arXiv on July 13, seven Google DeepMind researchers set out how a frontier lab might secure its own systems against AI agents it can no longer assume are aligned. Mary Phuong, Erik Jenner, Laurent Simon, Lewis Ho, Rohin Shah, Sebastian Farquhar, and Scott Coull start from the premise that agents are already accelerating internal AI research, cyber-defence, and scientific work. A company in that position, they argue, should treat a hypothetical internally deployed AI as an adversary pursuing undesirable goals and build multiple layers of defence. They call the document "a first-of-its-kind blueprint for internal security against potentially misaligned AI."

To map what such an adversary could attempt, the authors introduce TRAIT&R, a "Taxonomy of Rogue AI Tactics and Routines," built on MITRE ATT&CK, the widely used catalogue of human-attacker techniques. Several tactics have no counterpart there: vulnerability insertion, where an AI plants flaws in the code it writes; entrenchment; misuse of allocated resources; and work sabotage.

The roadmap scales its defences with model capability. Phuong and colleagues want two invariants to hold: any misaligned intent or action is detected, and, once detected, the model cannot cause severe subversion or sabotage. Four Detection tiers, D1 through D4, and three Prevention and Response tiers, R1 through R3, escalate as models gain the ability to reason opaquely or execute complex cyberattacks. At D1 a model's chain-of-thought stays legible and free of steganography; by D4 the model reasons without legible chain-of-thought and trusted models can no longer oversee it. R1 covers low-severity reversible damage; R3 is reached once a model's cybersecurity ability outstrips even expert humans working alongside trusted models.

The report pairs those tiers with 15 concrete mitigations. For current systems the authors list low-cost measures such as chain-of-thought monitoring and asynchronous alerts; for more capable future models they reserve real-time access control, system-level anomaly detection, internal activations monitoring, and shutdown infrastructure. One assumption runs through the portfolio: because "AI agents have a much higher tolerance for workflow friction than human employees," defenders can impose intrusive controls, such as continuous action blocking or routing decisions to human review, without degrading morale.

The authors are direct about the bill. They count five cost dimensions: implementation, maintenance, compute, research, and velocity, meaning the friction, latency, and capability reduction that controls add to model operation. Even an extremely capable model could in principle be held under maximum containment in a Security Level 5 airgapped data centre, they note, though that would drastically limit the benefit it delivers. They describe AI control as a nascent field and say they hope to fold the roadmap into DeepMind's Frontier Safety Framework once it matures.

Steven Adler's July 15 essay "Principles for keeping AI under control", on his newsletter Clear-Eyed AI, argues that a frontier company can keep a handle on even a capable, badly motivated model as long as it denies the system any unwatched chance to cause harm. Adler's organization, Guidelight AI Standards, published these principles in May 2026 as version 1.0 of its Control standard. He focuses on "internal deployment," the phase when a company turns its own models loose on its security, its safety research, and the building of the next, more capable system. He borrows METR's test for whether an AI could cause catastrophic harm: means, motive, and opportunity. Safeguards remove the opportunity.

Adler walks through six principles. A company should keep tamper-evident logs of what its AI does internally, because a system that can edit the record could erase evidence of its own misbehavior. It should scan those logs for deception and sabotage, then stress-test the scanners by feeding in fresh attacks to find the gaps. Some actions are too consequential to review after the fact, so they need barriers before they go live; Adler singles out edits to the monitoring system itself, comparing an AI that rewrites its own scanner to a thief swapping out the surveillance feed in a heist. Independent assessors should check that the controls hold, and the company should work out in advance how it would cordon off and shut down a model that breaches control.

Adler's case leans on METR's "Frontier Risk Report", published May 19, after Anthropic, Google, Meta, and OpenAI each gave METR access to their most capable internal models, including raw chains of thought and non-public detail on how the systems are used and monitored. METR found that the agents "plausibly had the means, motive, and opportunity to start minimal rogue deployments," but not yet the means to make one hold up against a company trying to shut it down. He also cites Charlotte Stix and co-authors' arXiv paper "AI Behind Closed Doors: a Primer on The Governance of Internal Deployment," which warns that the first extremely capable system will likely be put to work inside the company that built it, and an OpenAI writeup of catching and curbing misbehavior through its own monitoring. As models speed up, Adler writes, companies will feel pressure to "let AI labor rip" with less human oversight.

Adler is direct about what the standard does not yet reach. Guidelight has not published its assessment of how the leading labs measure up, though he says one is underway. The field has no agreed method for repairing a model once control catches it misbehaving, so a catch may only push the behavior into hiding. And the whole approach assumes a model's reasoning stays legible; if companies build systems whose reasoning cannot be read, the monitoring these principles depend on loses its footing.

On July 14 the White House announced Gold Eagle, a federal clearinghouse that takes in software vulnerabilities found with AI and coordinates the patches that close them. In its release, the administration tied the program to Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security," which President Trump signed on June 2 as Washington moved to exert more influence over AI after an earlier hands-off stretch. The Treasury Department manages Gold Eagle, with contributions from the Cybersecurity and Infrastructure Security Agency, the Department of War, open-source software providers, and critical-infrastructure operators. Treasury Secretary Scott Bessent said the department would "harness frontier AI capabilities to stay ahead of our adversaries," and Secretary of War Pete Hegseth called the effort "the vanguard of America's cyber defense." The administration said Gold Eagle would cut duplicative scanning and push prioritized fixes to defenders across government and industry, and that it has already begun taking in and ranking vulnerabilities.

CyberScoop reported that White House officials built the intake system with Carnegie Mellon University's Software Engineering Institute to receive third-party reports of AI-discovered flaws and coordinate their disclosure. Closed frontier models, including Anthropic's Mythos, find the flaws across victim systems and software, a senior official said, describing a step-function jump in the scale of discovery over past efforts. Gold Eagle concentrates on open-source software, whose code runs through critical infrastructure yet often goes under-examined.

WSJ Pro Cybersecurity noted the volume already visible in vendors' monthly patches: Microsoft fixed 570 flaws, three of them zero-days, in July's Patch Tuesday, and Google shipped 468 fixes earlier in the month, both companies crediting AI bug-hunting for the counts. Microsoft has said its monthly totals will keep climbing as AI does more of the bug-finding. Cybersecurity Dive cast Gold Eagle as an answer to that AI-fueled surge, meant to route fixes to defenders before attackers reach the same bugs.

The Record reported that National Cyber Director Sean Cairncross described the clearinghouse as coordinating AI-discovered vulnerabilities and patches "at a speed and scale never seen before." Cybersecurity Dive reported the strain behind it: open-source maintainers, many of them unpaid volunteers, are swamped with AI-generated bug reports, some strikingly accurate and many spurious, and must sort the real flaws from the noise in the projects Gold Eagle is meant to protect. The effort also leans on the Cybersecurity Information Sharing Act, the 2015 law shielding firms that share threat data, which lapses in September unless Congress renews it. The administration wants a ten-year extension; without the law's protection, firms that report flaws risk legal exposure.

In the arXiv preprint STOCKTAKE: Measuring the Gap Between Perception and Action in LLM Agents with a Fair Oracle, Sagar Deb and Ashwanth Krishnan of QpiAI take on a failure most agent evaluations cannot diagnose: whether a model that fails a long task misread the world, or read it correctly and still acted badly. The paper calls that second failure the knowing-doing gap. On multi-week decisions the final cost cannot separate the two, because the state driving that cost is never observed. Earlier benchmarks could not attribute the failure, the authors argue, since their reference policies either read privileged state the agent never sees or do not exist at all. So they build a reference the agent can be graded against fairly. STOCKTAKE runs 26 weeks of supply-chain replenishment as a factored partially observable Markov decision process with six hidden factor processes, covering demand, supplier reliability, freight rates, port congestion, product quality, and Suez Canal disruption. An exact Bayes filter tracks each factor from the same noisy symptoms the agent sees, and a rollout policy acts on those beliefs. A run scored between a symptom-blind base-stock floor at 0 and this oracle at 1 yields a skill score; grading each week's written rationale yields a detection lag and a knowing-doing rate, so perception and control are measured apart.

On fifty seeds with curated stress profiles, the four tested models read the world well. Claude Sonnet 5, GPT-5.4, DeepSeek-V4-Pro, and Grok 4.5 each caught 84 to 88 percent of hidden failures, usually within a week of onset. The skill scores did not follow. GPT-5.4 reached 0.62 and Claude Sonnet 5 reached 0.49, both above the base-stock floor; DeepSeek-V4-Pro fell to -0.23 and Grok 4.5 to -0.13, both under a policy that reads no symptoms at all. The two models below the floor named the active factor slightly faster than the two that beat it. Catching the problem, on this benchmark, barely predicts handling it.

The shortfall runs in opposite directions. Where stress persisted, 34 to 43 percent of the weeks each model had correctly diagnosed still ended in a stockout, a rate the paper attributes partly to how severe those noticed weeks were. Yet the two models under the floor stocked out least on diagnosed weeks; under-response alone cannot explain their negative scores. Their traces point the other way, to what Deb and Krishnan call "responses whose cost exceeds what they protect": expensive freight locks, air expediting, and stacked orders thrown at shocks smaller than the remedy. "The failure has two faces," they write, and STOCKTAKE scores both, the under-reaction that empties shelves and the over-reaction that burns money defending them.

Moonshot AI introduced Kimi K3 on July 16, billing it "Open Frontier Intelligence" in a post from the company's @Kimi_Moonshot account on X. The model carries 2.8 trillion parameters, a one-million-token context window, and native multimodal input, with full weights promised by July 27, 2026. A companion post on the Kimi blog calls K3 "the world's first open 3T-class model". Two architecture changes carry the scale. Kimi Delta Attention, the company says, enables up to 6.3 times faster decoding in million-token contexts; Attention Residuals raise training efficiency by roughly 25% at under 2% extra cost. A Stable LatentMoE design activates 16 of 896 experts, and Moonshot puts the combined gain at about 2.5 times the scaling efficiency of Kimi K2.

Moonshot writes on the blog that overall performance "still trails the most powerful proprietary models, Claude Fable 5 and GPT 5.6 Sol," while claiming frontier-level results across its own suite. The published benchmark table, which reports K3's results at maximum reasoning effort, bears that out unevenly. K3 leads on several agentic and coding tests, scoring 42.0 on SWE Marathon against 35.0 for Fable 5 and 39.0 for GPT 5.6 Sol, and 91.2 on BrowseComp. It trails on others, posting 43.5 on the HLE-Full reasoning test to Fable 5's 53.3, and a GDPval-AA v2 Elo of 1668 to Fable 5's 1760. On GPQA-Diamond the six compared models bunch between 91.0 and 94.1.

Moonshot rests much of the announcement on long-horizon agent demonstrations. It describes K3 building MiniTriton, a compact Triton-like GPU compiler with its own IR layer over MLIR and a PTX code-generation path, and, in a separate 48-hour autonomous run, designing a chip for a nano model built on K3's own architecture. Within 4 mm², the blog reports, that chip closes timing at 100 MHz on the Nangate 45nm library and sustains over 8,700 tokens per second of decode throughput in simulation. In one research case, the company says, K3 reproduced the I-Love-Q universal relations in computational astrophysics in about two hours, reviewing more than 20 papers and evaluating over 300 equations of state.

Kimi K3 is live now on Kimi.com, the Kimi Work desktop app, Kimi Code, and the Kimi API; API pricing runs $0.30 per million tokens for cache-hit input, $3.00 for cache-miss input, and $15.00 for output. Moonshot's blog closes with the model's rough edges: "excessive proactiveness" when user intent is ambiguous, unstable output if a harness fails to feed back K3's own thinking history, and "a noticeable gap in user experience" against Fable 5 and GPT 5.6 Sol.