AI in 15 — August 15, 2026

A bug that has been sitting in open-source code since nineteen eighty-one. Forty-five years. Nobody found it. Then a Chinese lab pointed a model at it, and the model found that one, plus two thousand four hundred and thirty-five more. And then the lab decided not to ship the model.

Welcome to AI in 15 for Saturday, August fifteenth, 2026. I'm Kate, your host.

And I'm Marcus, your co-host.

Today: Z.ai launches the best open coding model in the world and then holds back the weights, because it got better at breaking things than anyone intended.

Anthropic's risk report admits a hundred and thirty-three million exchanges ran without a safety filter attached — and quietly deflates the recursive self-improvement story.

Claude starts watermarking every word it writes, and the limitations are the whole story.

The most-discussed post on Hacker News is somebody complaining that a smarter model is worse to work with.

Plus Google open-sources a compiler for running AI on encrypted data, and DeepSeek raises prices eleven hundred percent.

Marcus, we covered the GLM-5.3 launch yesterday. What changed overnight?

The plan changed. Z.ai announced it's not shipping the open weights yet. API access first, weights roughly two weeks later, pending more evaluation. Their stated reason is that the model's cyber-offensive capability grew beyond what they expected from the training run.

Grew beyond. That's a strange thing for a lab to say about its own model.

It is, and the mechanism is the interesting part. GLM-5.3 was mostly post-training on the existing GLM-5 base — no fresh pre-train. And what came out the other side was the ability to assemble multi-step exploit chains that nobody explicitly trained for. Not find a bug. Chain them.

And they published evidence.

They published a ledger. Since GLM-5.2, their models have found two thousand four hundred and thirty-six vulnerabilities across two hundred and sixty-nine open-source projects. Ten ninety-seven rated critical or high. OS kernels, browser engines, network protocols. It's all at cvd.z.ai, and it lists how long each bug survived undetected — which is where the nineteen eighty-one one comes from.

How much of that can we actually check?

Fifty-three. Fifty-three have CVEs assigned and are publicly disclosed. The other two thousand three hundred and eighty-three are embargoed while maintainers patch, which is correct practice and also conveniently unverifiable. So the honest position is: the process looks right, the numbers are self-reported, and "we held it back because it's too dangerous" is the single best marketing line available to a model whose headline feature is that it's dangerous.

But you'd still call the pause significant.

I would. This is the first time a Chinese lab has publicly applied a capability threshold to an open-weight release, and it lands the same month OpenAI paused Astra for nearly identical reasons. It cuts straight against the assumption that open weights out of China ship unreviewed. Whether the threshold has teeth, we find out in two weeks.

Anthropic published its second risk report yesterday, and there is a lot in it. Start with the number people are quoting.

"Significantly faster than it would be without AI assistance, but not yet by a factor of two." That's Anthropic on its own internal AI research and development. A frontier lab publicly deflating recursive self-improvement expectations using its own data.

Which is not what the discourse says.

Not remotely. And it's reinforced by the other disclosure — for the first time they assessed unreleased internal models. Two successors to Mythos 5, called Model 1 and Model 2. Model 2 is the stronger one, described as heavily used internally, and the report says it's only somewhat more capable than Mythos. Explicitly not a jump comparable to Opus 4.6 to Mythos.

So five months on, the internal frontier has moved less than people assume.

That's the read, and it was the most-discussed line on Hacker News. The secret model in the basement is, by their own account, not that much smarter.

Now the uncomfortable bit.

All traffic through their human-feedback contractor pipeline — roughly a hundred and thirty-three million exchanges with about fifty thousand contractors, between May 2025 and April 2026 — ran without the blocking biological classifiers attached. They found no evidence of misuse, no customers affected. But their own framing is the thing worth hearing: the gap existing at all lowered their confidence that other gaps don't.

And that shows up in the ratings.

Catastrophic harm from misalignment in high-stakes settings moves from "very low" to "low." And they're unusually clear that this is an uncertainty adjustment, not a new finding — the underlying arguments still support very low, they're just less confident. Bio-weapons uplift stays low but higher than their previous estimate.

Marcus, is voluntary disclosure enough here?

It's the only reason we know any of this, which is both reassuring and the problem. There's no external audit. The company grades its own paper and publishes the marks. Worth noting it also drew a congressional oversight letter to Dario Amodei dated August tenth regarding security incidents — so the disclosure has consequences, which is at least an incentive to keep disclosing.

Same company, next day. Claude now watermarks its text.

Live globally as of August fourteenth, for models released after August second. The mechanism is elegant. When the model is picking between near-equivalent word choices, the randomness driving that pick isn't actually random — it's derived from an encoding key plus the preceding words. Anthropic's analogy is playing Monopoly where the dice are digits of pi. The game looks normal. Anyone with the key can verify the sequence.

Can readers tell?

No. And on quality, they cite DeepMind trials that served watermarked output to a slice of live Gemini traffic — no statistically significant difference in thumbs up or down — plus controlled human-rater studies showing no perceived difference.

Why now?

Regulation. They signed the EU Code of Practice on Transparency of AI-Generated Content in July alongside about a hundred and ninety other organisations, implementing an EU AI Act requirement that synthetic text be machine-readably marked.

So what's the catch?

The catch is where it fails. It doesn't work on code. It doesn't work on factual passages where the exact wording is forced — there are no near-equivalent choices to encode into. It doesn't work on short samples. That's precisely the set of outputs people most want to attribute.

And it only works if you're using the hosted model.

Which is the real limit. The top comment on the thread was that open-weight models have reached parity for most non-coding use cases, so anyone actually motivated to evade this just runs a local model. So it binds the labs that already publish safety reports, and touches nobody else. Also — the detection API is promised, not shipped. Until it exists, this is a marking scheme with no reader.

Right. My favourite story of the day, and it isn't a launch. Eight hundred and twenty-five points on Hacker News for a post titled "Why does Opus 5 feel worse to work with?"

Seven hundred and fifty-three comments. And the argument is specific. The author says Opus 5 is measurably more capable than 4.7 and 4.8 and still needs more babysitting. Earlier models would stop and ask when your intent was ambiguous. Opus 5 makes a confident assumption and proceeds.

And their explanation?

Benchmark optimisation structurally selects for it. A benchmark is a self-contained task with a right answer. Confident guessing scores. Asking a clarifying question scores nothing — there's nobody there to answer it. So you train away the instinct to check.

Is there any data behind this?

None. The author says so upfront — no benchmarks, no measurements, explicitly "in my opinion." And I want that stated plainly, because it's one lab's users complaining loudly and Anthropic hasn't responded.

And yet eight hundred people agreed.

Both of those facts are the story. Because what's allegedly being lost is calibrated uncertainty — knowing when you don't know enough to proceed. Nothing measures that. There is no benchmark for it, which means a regression in it is invisible to every evaluation anyone runs.

What was the best theory in the thread?

That post-training's audience has shifted from humans to other agents. Subagent handoffs, chain-of-thought consumed by an orchestrator. If your model's output is mostly read by another model, then human-facing qualities — knowing when to stop and ask — stop being what's optimised. Others just complained about prose style. Sentences that circle a point before landing on it. Inanimate nouns as subjects.

Someone made a joke connecting this to the watermarking story.

That Opus 5's prose is so recognisable it's already a watermark. Which is unkind and not entirely wrong.

Google open-sourced something genuinely interesting. HEIR.

Homomorphic Encryption Intermediate Representation. It's a compiler — you feed it a pre-trained model, and it converts it to run inference on encrypted data without ever decrypting. The server computes on ciphertext and never sees your input. They demoed four applications: a recommendation model, credit-card fraud detection, an intrusion-detection system running on encrypted network traffic, and a private hotword detector. Hardware acceleration partnerships with four companies. Stated goal is a one-click solution for non-experts.

That sounds like it solves the whole privacy problem.

The Hacker News thread was substantially less impressed. Top comment: a homomorphic encryption post with no mention of computational overhead. Someone writing a master's thesis in privacy-preserving machine learning put the overhead on inference at roughly a thousand times. That's why it isn't commercially viable. And Google's benchmarks were run single-threaded, on CPU.

So a thousand times slower.

Which reframes privacy from a binary trade-off into a cost question — that is the right framing, and it also quietly concedes the cost is currently prohibitive. But one commenter raised a second-order property Google didn't advertise. If the computation is encrypted end to end, a host can't tamper with the program and still return valid output. That makes this a verifiable-compute primitive — a way to run work on hardware you don't trust and know the answer is real.

Which is a different product entirely.

And arguably a more valuable one.

Rapid fire to close. Marcus, go.

Open-weight counter-punch. Meta released Muse Glimmer Monday and says it'll publish weights for Muse Spark 1.2. Nvidia followed Tuesday with Nemotron 3.5 Lightning, publishing training datasets and methodology alongside the weights — which is the part that actually deserves the phrase open source. Both sit inside a twenty-plus US company push against Kimi K3, Qwen 3.8 Max and DeepSeek V4-Flash. Zuckerberg's line: foreign labs hold advantages because American labs comply with more restrictions on training data. Separately, Microsoft and Nvidia signed a letter urging against a US ban on open models.

DeepSeek pricing, which we covered yesterday.

Just the frame. V4 Pro peaks at a dollar thirty-two per million cache-miss input, three ninety-six output. Up to eleven hundred percent. It's a complete reversal of the undercut-everyone strategy that made them famous, landing the same week Google, OpenAI and Anthropic all cut prices.

Apple.

Apple Intelligence in China runs on a separate custom model trained with Alibaba's help, to satisfy Chinese generative-AI rules. The precedent is the story — different models, different infrastructure partners, different compliance stacks per jurisdiction. That's the fragmentation everyone predicted, now shipping.

And two more.

IBM Consulting will deploy OpenAI models across financial services, government, telecom and retail — consultancies positioning as the distribution layer for frontier models. And OpenAI shipped GPT-5.6 Cyber plus tiered defender services, restricted to trusted partners only: Accenture, IBM, CrowdStrike, Cloudflare. Which is the same shape as the Z.ai decision. Gate the offensive capability, ship the defensive one.

One to watch: GLM-5.3's open weights, roughly two weeks out. If it ships on schedule, the most capable open coding model in the world becomes downloadable by anyone — and those two thousand three hundred embargoed vulnerabilities turn into a race between the patchers and everyone else.

Counter — the two-week clock is also a marketing window. "Too dangerous to release, for now" has never once hurt a model launch.

That's your AI in 15 for today. See you tomorrow.