AI in 15 — August 18, 2026

A model you can download for free, run on a gaming PC, and it just scored level with a system more than five times its size. Over the weekend, the developer world's reaction was not celebration. It was disbelief.

Welcome to AI in 15 for Tuesday, August eighteenth, 2026. I'm Kate, your host.

And I'm Marcus, your co-host.

Today: Qwen three-point-eight lands at number one on the open-weights leaderboard, and the numbers you can check are the ones that matter.

GitHub goes dark for most of Monday, and two hundred and seventy-five million commits a week explains why.

Copilot's automatic security fix introduced a security hole, and researchers walked out with Snowflake's credentials.

Somebody spent nine hundred thousand dollars building a think tank that no human was ever meant to read.

Plus a hidden AirTag inside a rare book, and the top story on Hacker News is people refusing to read AI output at all.

Marcus, we flagged Qwen three-point-eight twenty-seven B on Sunday. What changed?

Independent verification landed. Artificial Analysis scored it fifty-two on their Intelligence Index. That's first out of a hundred and thirty-five open-weights models, and level with DeepSeek V4 Flash — a model more than five times its size. Its predecessor scored thirty-eight four months ago.

Fourteen points in one generation.

In a model that fits on one consumer graphics card, under Apache two-point-zero. And the Hacker News thread is the story as much as the score is. Three hundred and twenty-nine points, and the tone is people not quite believing their own results. One commenter wrote that it beats Opus four-point-six — "both funny and a bit terrifying, and I still can't quite believe it. It runs decently on a gaming PC." Opus four-point-six was state of the art six months ago.

What about Alibaba's own numbers? They're claiming sixty-one point seven on SWE-Bench Pro against Opus.

Some of those I'd take. Two of the benchmarks they lead with — QwenSWEBench and CoWorkBench — are in-house, one-line descriptions, no task list, no sample size published. Nobody outside Alibaba can check them. The Artificial Analysis score does hold up. The vendor table is where the marketing lives.

Anything else hiding in the fine print?

One number I'd want on the record. It burned a hundred and sixty million output tokens producing that Intelligence Index score. The median for comparable models is forty-three million. It thinks a lot. Locally that's free. On a rented GPU that's a bill the headline score doesn't show you.

One commenter called it "intelligent and strange."

Gets obsessed with problems at higher reasoning effort, apparently. But the economics are the real story. Frontier-adjacent capability, running on hardware you own, zero marginal cost per token, permissive licence. That removes the assumption that serious AI capability requires an API relationship with a US lab. It turns the open-versus-closed argument from philosophy into a commercial question.

GitHub. Down most of Monday.

Problems confirmed at nine forty Eastern, degraded for over three hours, then a second incident that afternoon. Pull requests, issues, webhooks, Actions, Copilot, Pages. Roughly twenty percent error rates on web and API, around fifty percent on archive and raw downloads. And SAML and OIDC authentication broke, so some enterprises couldn't log in at all. Two hundred and twenty-five million users.

Do we know the cause?

GitHub has said it publicly, which I give them credit for. COO Kyle Daigle confirms the platform is now processing two hundred and seventy-five million commits per week. Near fourteen billion a year. About fourteen times what it was in 2024 — driven overwhelmingly by AI coding agents, not humans.

And the infrastructure underneath.

Parts of it haven't been touched in fifteen years. A single MySQL database handling permissions for two hundred million accounts. Job queues designed around steady-state human working hours. Agents don't sleep, don't batch, and don't respect the traffic curve fifteen years of capacity planning was built on. Microsoft reportedly started routing some agent traffic to AWS in June.

The market noticed.

"Ask HN: alternatives to GitHub" hit five hundred and forty-seven points within hours. Forgejo, Codeberg, GitLab, Tangled. And with either remarkable timing or remarkable luck, Cursor launched Origin the same day — its own code hosting, early beta on paid plans, two-way syncs pull requests and comments with GitHub.

Cursor, which SpaceX now owns.

Which SpaceX now owns, yes. The pitch is your code, your PRs and your agents in one place. Two objections came up that I think are fair. Handing your source to an AI company whose agents run in the same environment. And the naming — "can you push to origin main" now has two meanings.

Why does this one stick with you?

Because it's the first infrastructure story where AI isn't the product, it's the load. This is what it looks like when machines use the tools faster than the tools were built to be used. And it's opened a genuine competitive window under the most entrenched developer platform in the world. Daigle's prediction is fewer availability problems within three months. That's a testable claim.

Staying with GitHub, and this one is uncomfortable. Copilot's Autofix feature introduced a vulnerability.

Wiz published the disclosure. Snowflake's public dot-net connector repository had a script injection flaw — you could execute arbitrary commands by crafting a GitHub issue title. Unauthenticated. The flaw came in on a commit merged June eighteenth that credits, and I'm quoting the co-author line, "Copilot Autofix powered by AI."

What did it actually change?

It replaced a safe pattern — environment variables, proper argument parsing — with direct shell string interpolation of the issue title. And a second bug compounded it. A protective condition checked for a pull request field that's always null on issue events, so the security gate never fired.

What did they get out?

A Jira API token authenticating as a Snowflake QA account, with read access to engineering, security compliance and bug bounty projects. Snowflake's response was genuinely clean — reported June twenty-third, patched the same day, token rotated the twenty-fourth, disclosed July twenty-fifth after a thirty-day window.

Is the Copilot link solid, or is that the headline doing work?

Good question, and I'd be careful. The commit carries the co-author credit. The causal chain from Copilot to the vulnerability isn't fully nailed down in the linked pull requests, and there's fair pushback on that in the thread. What is solid is that a static analysis tool called zizmor flags this exact line as an error today. It was catchable.

So why wasn't it caught?

Best comment in the thread called it a natural evolution of the "looks good to me" review. A change carrying an authoritative label gets less scrutiny, not more. It said security fix on the tin. That's a failure mode automation creates rather than solves, and CI pipelines are the most expensive place for it to happen.

Anthropic watermarking. We covered the mechanism Saturday — what's new?

Scope. It's going global, not just the EU. Website, API, Claude Code, Cowork, cloud deployments. A regulation written for one jurisdiction is being implemented worldwide because running two pipelines costs more than complying everywhere.

And the open question from Saturday stands.

It does. Anthropic holds the key. Anthropic can detect Anthropic's watermark; nobody else independently can. Two other things in their orbit — Dario Amodei repeating that the industry's problem is "fundamentally a crisis of trust," and conceding the most accurate criticism of AI companies including his own is that they haven't delivered on their big promises. And Bloomberg reports talks to buy Israeli inference-optimisation startup Decart for around six billion. Their largest acquisition ever, roughly fifty percent above its May valuation.

Talks, not done.

Talks. It could still collapse.

Now the one I can't stop thinking about. A fake think tank built for chatbots.

Reporting published yesterday by Nick Cleveland-Stout at Responsible Statecraft. The Hanover Institute for Public Policy launched August sixth, presenting as a neutral think tank on Israel-Palestine. It's a front, operated by a firm called Piro on behalf of the Israeli Government Advertising Agency, subcontracted through Havas Media for a reported nine hundred thousand dollars.

What gave it away?

The production rate. Over a hundred reports in just over a week. No staffed think tank produces that. Footnotes, tables of contents, deliberately neutral prose. GPTZero flagged eleven of twelve randomly sampled articles as AI-written with high confidence.

And the titles.

The titles are the tell. They're shaped like chatbot queries — "what caused", "which". And Piro's own website removes any ambiguity. It advertises "AI story optimisation" and content "engineered for how LLMs evaluate credibility." They're selling it openly.

Marcus, how is this different from SEO?

It's aimed at a much softer target. Search results are a list a human evaluates — you see the source, you can weigh it. A chatbot answer is one synthesised statement, delivered confidently, usually with no visible sourcing. So you flood the index with authoritative-looking material that no human will ever read, in order to shift what the model says. Nine hundred thousand dollars. One agency. One week. That's cheap.

And the forward-looking comment in the thread?

That this is everywhere within a year. Entire fake organisations and personalities built to drown out real information, eventually indistinguishable from the real thing.

Quick one on price and speed. Google shipped Gemini three-point-seven Flash three weeks after three-point-six.

Three weeks, with a fifty percent introductory price cut. FrontierCode went from thirty-four point four to forty-three point six. DeepSWE from forty-nine to sixty-five point three. At forty-three point six it edges past Claude Sonnet five and GPT-5.6 Terra — a Flash-tier model topping frontier rivals on production code, at roughly a third of the token cost. Note "introductory." That pricing has an expiry date.

And OpenAI on Cerebras.

Limited preview of Ultrafast for GPT-5.6 Sol. Vendor-claimed seven hundred and fifty output tokens per second, up to fourteen times standard, same model. The trick is wafer-scale hardware keeping the weights in forty-four gigabytes of on-chip memory instead of shuttling them off-chip like GPU inference has to. Pricing undisclosed, access limited while OpenAI works out where the speed pays.

There was also a story going round about a fifty percent price cut on Sol.

There was, three hundred points on Hacker News, and I could not verify it. Published pricing still shows Sol at launch rate. OpenAI's confirmed cuts in late July were to Luna and Terra — Sol was explicitly excluded. Treat it as a community report until somebody sources it properly.

The book story from Sunday got a sequel. 404 Media hid an AirTag in one.

And followed it across the country to an Amazon warehouse in Las Vegas, facility VGT3. Per their reporting, staff receive bulk book shipments, cut the bindings off, and scan the pages for AI training data. The team's internal logo is a dinosaur with a book in its teeth.

The thread pushed back though.

It did, and fairly. Two hundred and ninety-three comments, notably split. Several argued "rare" is doing heavy lifting — one commenter put it as rare like your grandfather's John Deere manual from 1982, not rare like a test print of Gatsby. And 404 declined to identify which books were scanned. The article's partly paywalled, and there's no Amazon statement in the accessible text.

Where do you land?

The counterweight is that destructive scanning is irreversible, it's industrial scale, it's deliberate, and the corpus it feeds is private. Whatever you think of the framing, it took a hidden tracker to surface any of it.

Last one, and it wasn't a model launch. Seven hundred and forty-three points for an essay coining "AI;DR."

AI, didn't read. The argument is that unlabelled AI-generated text has become a signal to disengage. And the four hundred and seventy-eight comments are where the evidence sits. "My coworkers continue to dump hundreds of lines of AI documentation in every pull request." One reader named the mechanism exactly — the reluctance comes from suspicion that it came from intellectual laziness. The sender spent thirty seconds. The recipient is asked to spend ten minutes.

Best suggestion in the thread?

Instead of sending me the AI output, send me the prompt you used to generate it. That's the only part containing just the information you're trying to convey. I think that's genuinely good advice.

And it wasn't the only one charting.

Three of the highest-scoring AI stories on the developer front page yesterday were about avoiding, disabling, or refusing to read AI output. A guide to turning off intrusive AI features hit two hundred and seventy-six points, cataloguing features you can't disable without breaking something unrelated. That's a demand-side signal, and it's coming from the technically sophisticated users, not the skeptics outside.

One to watch: AI-designed viruses. Stanford and the Arc Institute published in Science on August sixth — an OpenAI model trained on DNA patterns from two million bacteriophages produced sixteen novel working viruses never seen in nature. The researchers' own conclusion is that the capability now exists and the governance doesn't.

Agreed, and here's why it's a watch item. Every constraint that made this safe was a voluntary choice by one careful lab — what went in the training set, what got deliberately left out. None of it is enforced by anything. The next group may choose differently.

That's your AI in 15 for today. See you tomorrow.