In partnership with
In Todayโs Issue:
๐ An open model nobody taught to hack found 2,436 real holes
๐ค OpenAIโs run rate passes $40 billion, ahead of an IPO
๐ต Gemini 3.7 Flash undercuts the frontier on price
๐ GPT-5.6 Sol runs 14 times faster on Cerebras chips
๐ Texas pauses the AI build-out, and its power forecast halves
โจ And more AI goodnessโฆ
โก The Signal
The Chinese lab behind the GLM models scaled post-training on something it had already shipped and got a world-class vulnerability hunter it never set out to build. In two weeks, anyone can download it.
The lab fed vulnerability-discovery environments into the training mix expecting the model to get better at spotting flaws. Instead the capability kept growing as training scaled, until GLM-5.3 was planning complete exploitation chains rather than finding isolated bugs. Pointed at real code alongside Chinese security teams, it surfaced 2,436 vulnerabilities across 269 open-source projects, one of them introduced in 1981. The day before, OpenAI and Google both shipped speed rather than intelligence: Ultrafast on Cerebras silicon, and Gemini 3.7 Flash at 75 cents per million input tokens. Bloomberg supplied the motive. At a $40 billion run rate with IPO paperwork filed, the number that compounds is margin per token.
All the best,
Kim Isenberg
(Cerebras)
โก OpenAI Makes Its Best Model 14 Times Faster
OpenAI is previewing Ultrafast, a service tier that runs GPT-5.6 Sol up to 14 times faster than standard processing, generating as many as 750 output tokens per second on Cerebras silicon. It launches first in the OpenAI API rather than in ChatGPT, and only for a small group of testers including Jane Street, Podium, Basis and Rogo, widening as capacity grows. Until now, OpenAI writes, "getting real-time speed typically meant choosing a smaller or more specialized model."
๐ tl;dr: Frontier intelligence at conversation speed, for whoever can get on the invite list.
(Google)
๐ต Googleโs Gemini 3.7 Flash Released
Google shipped Gemini 3.7 Flash the same day, calling it "our most intelligent workhorse model yet for coding and agents." On Googleโs own comparison table it leads on production code quality (43.6% on FrontierCode 1.1 Main), web development (1588 Elo on Code Arena) and enterprise workflow automation (30.4% on AutomationBench), at an introductory $0.75 per million input tokens and $3.75 per million output, held until 31 December 2026. On the composite Artificial Analysis Intelligence Index, which scores general model intelligence, it lands on 56, one point behind GPT-5.6 Terra and Muse Spark 1.2.
๐ tl;dr: The cheap tier is closing fast on the work that actually pays, without being the smartest model in the room.
(Bloomberg)
๐ค OpenAIโs Run Rate Passes $40 Billion
OpenAI is on track to clear $40 billion in annualized revenue, roughly double its run rate at the end of 2025, Bloomberg reports, citing people familiar with the figures. The company declined to comment. It is fighting Anthropic for business customers, and both labs have now filed confidential paperwork to go public.
๐ tl;dr: Two rivals racing each other to an IPO means every price cut and speed tier from here has a shareholder behind it.
๐ฌ Watch This
Europe keeps saying it wants AI sovereignty, then buys American AI with a European postcode.
Together with Superintelligence co-founder Peter Thum, I sat down with PandaOS co-founders Philipp Tรผrker and Marco Szeidenleder to work out what sovereignty actually means when the models, clouds, chips and APIs all come from somewhere else. Their argument is that owning every layer of the stack is the wrong goal: control the data and systems your business runs on, and keep the ability to switch providers without rebuilding everything. We get into whether Mistral and Pharia hold up in real workflows, why open Chinese models might be Europe's opening, and where self-hosting genuinely pays for itself. Their test for sovereignty is blunt: can you swap providers on a random Tuesday without everything breaking?
"Hit your usage limit in Claude Code desktop? There's now an auto-continue checkbox. Turn it on, and it'll automatically continue where you left off once your limit resets."
โ Anthropic, announcing auto-continue in Claude Code desktop
The usage limit that used to end a session now only pauses it, which quietly turns an overnight agent run from a gamble into a schedule.
OpenAIโs Tibo has been publicly needling Googleโs new workhorse, framing 3.7 Flash as quick but not especially bright. Googleโs own scorecard gives the jab something to stand on: on the Artificial Analysis Intelligence Index the model lands on 56, a point behind GPT-5.6 Terra and Muse Spark 1.2.
Nobody Trained GLM-5.3 To Hack.
It Learned Anyway.
The Takeaway
๐ Same base model as GLM-5.2. Every gain in GLM-5.3 comes from scaled post-training, with no new pre-trained model underneath.
๐ The cyber capability was a by-product. The lab expected sharper bug-spotting and got a model that plans complete exploitation chains.
๐ 2,436 real vulnerabilities found across 269 open-source projects with Chinese security teams, 1,097 of them medium-to-high severity.
๐ The weights go public in about two weeks, once the lab finishes safety evaluation and hardening.
In two weeks, anyone will be able to download the model that just set a new state of the art for finding software vulnerabilities. The Chinese lab behind the GLM series released GLM-5.3 today, and the striking part is how little it took. "Scaling post-training is all we did for GLM-5.3," the lab writes. It sits on the same base model as GLM-5.2, with no fresh pre-training run: only more task environments, more variety among them, and more compute spent training on them.
The gains came from the environments. The lab pushed its training toward tasks that "look less like coding exercises and more like real units of expert work," some of them representing several days of work for an experienced engineer. In one, the model is handed what an infrastructure engineer gets: compute clusters, storage, internal documentation, codebases and experiment results. Then it is told to find the bottleneck and deliver a measurable speedup without breaking correctness. Hand-building environments at that level does not scale, so the team built pipelines that generate them automatically, with a judge agent attempting each task to confirm it is actually solvable and verifiers written without sight of the reference solution. All of it runs on slime, the lab's open-source reinforcement learning framework, where system-level tuning lifted end-to-end training throughput by more than 2.3x.
(Code Bench v1.0, evaluated on Claude Code 2.1.207. Source: the GLM-5.3 release post)
The security result arrived uninvited. The team added vulnerability-discovery data expecting the model to get better at spotting flaws, and as training scaled it "began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains." So they aimed it at production code. Working with security teams in China, and after expert review, screening and deduplication, GLM-5.3 identified 2,436 vulnerabilities across 269 projects, 1,097 of them medium-to-high severity, spanning system kernels, operating systems, browser engines and network protocols. The average flaw had survived 26.6 years before anyone noticed it. The oldest went into the code in 1981. The company now runs a public Security Disclosure Ledger to track them: 53 findings are disclosed, 2,383 are still under embargo.
(Source: the GLM-5.3 release post)
The coding numbers support that story rather than carrying it. Against its own predecessor, GLM-5.3 moves from 4.6 to 28.3 on Terminal-Bench 3.0, which tests general agent capability at a command line, and from 46.2 to 66.9 on DeepSWE v1.1, which measures long-horizon software engineering. On the lab's in-house Code Bench it reaches 34.5% at Max effort while spending roughly 75K output tokens per task, where GLM-5.2 burned 96K to manage 23.4%. A skeptic has plenty to work with here, and the company hands over most of it: these are the vendor's own runs, its headline benchmark is private and unauditable, and Claude Fable 5 still finishes ahead at 39.5%. The lab is just as blunt about the security scores, noting that "capability is growing fastest exactly where we are furthest behind." None of that moves the release date.
Why it matters: Vulnerability discovery has been the slow, expensive, human end of security, and an open-weights model that does it this well hands the same leverage to the people patching 40-year-old bugs and to anyone else who downloads the file. The two-week hardening window is the entire safety margin.
Sources:
๐ https://z.ai/blog/glm-5.3
The Next Breakout Might Be in Your Pocket
Everyoneโs hunting for the next Unicorn.
The type of โcategory disruptorโ that grows fast and turns early believers into big winners.
59,000+ investors think that Mode Mobile could be one of those rare finds.
Americans spend 4 ยฝ hours on their phones daily, and Mode Mobile is monetizing that screentime. With $1B+ earned by over 490M customers and 32,481% revenue growth, Modeโs EarnPhone is turning smartphones into income generating assets.
Their previous raises sold out, and the company is now offering pre-IPO shares at $0.52/share with up to 20% bonus, exclusive to early investors.
Being early is everything, and this window is still open.
*Please read the offering circular and related risks at invest.modemobile.com.
Mode Mobile recently received their ticker reservation with Nasdaq ($MODE), indicating an intent to IPO in the next 24 months. An intent to IPO is no guarantee that an actual IPO will occur.
The Deloitte rankings are based on submitted applications and public company database research, with winners selected based on their fiscal-year revenue growth percentage over a three-year period.
The chart: The CyberSecurity Evaluation published alongside GLM-5.3, three tests sitting at different heights on the exploitation chain. On CyberGym, which checks whether a model can find and trigger a vulnerability from source code, GLM-5.3 leads on 84.5, ahead of Mythos 5 (83.8), GPT-5.6 Sol (83.6) and Kimi K3 (80.0). On ExploitBench, which demands real exploitation reasoning, it manages 54.4 against 78.0 and 76.5. On ExploitGym, counting completed exploitation tasks, it finishes 130 in six hours against 247.
The lesson: GLM-5.3โs advantage sits at the finding end of the chain. The higher up the chain a test goes, the more it improves on GLM-5.2 and the further it trails the closed frontier. Spotting a hole and walking through it remain separate skills.
The caveat: These are the vendorโs runs on the vendorโs chosen line-up, and the time budgets are not wall-clock. The lab normalizes them by each modelโs tokens-per-second rate from Artificial Analysis, so six hours means six hours at that modelโs own speed.
๐ The Republican Governor Who Hit Pause On AI
โก Bottom line
Texas paused new data center development, and federal forecasters immediately cut the stateโs projected electricity demand growth by more than half.
๐ก Why it matters
The AI build-out has run into votersโ power bills, and the opposition runs across both parties.
๐ What it means
Compute is becoming an electoral question, settled by governors and grid operators rather than by the labs.
The most energy-friendly state in America just told the AI industry to wait. Governor Greg Abbott ordered a moratorium on new data center development in early August, holding projects back until the Public Utility Commission of Texas and ERCOT, the stateโs grid operator, audit everything already moving through the interconnection queue. The effect on the forecast was immediate: the US Energy Information Administration cut its projection for Texas electricity demand growth from 14% to 6%. "Simply put, Texans must come first," Abbott said.
(Governor Greg Abbott alongside Google CEO Sundar Pichai. Photo: Ron Jenkins/Getty Images)
[The numbers explain the nerves. Data centers account for roughly 90% of new power requests to the Texas grid, and ERCOT is sitting on more than 474 gigawatts of them, over five times the stateโs record peak demand. That "unprecedented load growth could endanger the reliability and stability of the Texas electric grid," the governorโs office warned. Abbott wants developers to show how they will pay their own way, bring their own power, reuse their own water and avoid disturbing neighborhoods.
(Residents pack a local data center hearing in Evanston, Wyoming. Photo: Getty Images via Grist)
The politics do not split cleanly. President Donald Trump called the pause a mistake, arguing data centers "could be bigger than oil." Abbottโs Democratic challenger, State Rep. Gina Hinojosa, dismissed it as theater from a governor who "proudly made Texas the wild west of data centers." Texas Agriculture Commissioner Sid Miller, a Republican, said that without legislation the order is "all hat and no cattle." Voters are less conflicted: 60% of Texans oppose data center construction near them against 33% in favor. Texas is also no outlier, with at least 75 projects worth roughly $130 billion stalled or blocked nationwide in the first three months of 2026, Grist reported.
See Why HubSpot Chose Mintlify for Docs
HubSpot switched to Mintlify and saw 3x faster builds with 50% fewer eng resources. Beautiful, AI-native documentation that scales with your product โ no custom infrastructure required.