Kimi K3 and the Chinese Model Frontier

Kimi K3 and the Chinese Model Frontier

Moonshot AI's Kimi K3 is one of the largest open-weight models ever released: 2.8 trillion parameters in a mixture-of-experts architecture activating roughly 104 billion per token, built on Delta Attention (KDA) and a LatentMoE framework that selects 16 of 896 experts per forward pass. Moonshot's reported benchmarks are striking — though some models were evaluated with different agent harnesses, K3 trades blows with Fable 5 and GPT-5.6 Sol across coding, legal reasoning, and agentic tasks, and on Frontend Code Arena, it outright wins. On BrowseComp, Moonshot reports 91.2% at a fraction of the per-task cost of closed competitors. (more: https://huggingface.co/moonshotai/Kimi-K3/tree/main) Community-produced benchmarks and sponsored walkthroughs confirm the headline numbers, while also revealing the model's practical ceiling: self-hosting K3 at usable speed (50 tok/s) requires a full DGX B400 server — eight GPUs, 2.3 TB of HBM, $300-400K in hardware. A more realistic hobbyist path, at 5-10 tok/s, still demands $16-22K in used GPUs. Cost per task, not cost per token, is the metric that matters — and on that measure, K3 consistently undercuts Fable for comparable quality. (more: https://www.youtube.com/watch?v=ZW7R3qNw4nk)

The open-weight community has already started compressing. A 1-bit quantization shrinks K3 from 1.56 TB to 594 GB, retaining approximately 78.9% top-1 accuracy; a 2-bit variant exceeds 90%. Running the 1-bit model still requires a Mac Studio with 512 GB RAM plus a secondary 128 GB machine — hardware that Apple has discontinued. At the other end, loading 594 GB on a 128 GB box forces over 400 GB onto NVMe swap, and throughput drops to a crawl. The honest takeaway: K3 is an F1 car in a showroom. You can look at it. Running it is another question. (more: https://www.linkedin.com/posts/danielhanchen_kimi-k3-can-now-be-run-locally-the-1-bit-share-7488230159196573696-NiMc)

The gap between "open weights" and "open access" surfaced immediately when Ollama listed K3 behind a pay-per-use gate, even for Max-tier subscribers. The community reaction was sharp: Ollama had always been positioned as a local-first inference server, and charging separate usage credits for an open model felt like a betrayal of that identity. Multiple users reported canceling subscriptions. Ollama's stated reason — capacity constraints on a model requiring 8-10 B200 GPUs per concurrent user — is plausible, but it exposed the uncomfortable truth that hosting open models at frontier scale is not free. (more: https://old.reddit.com/r/ollama/comments/1v85akx/was_waiting_for_kimi_3_and_now_ollama_release_it/)

Meanwhile, the models people actually run every day tell a quieter story. A month after the initial excitement fades, the stack that survives is GLM 5.2 for high-end local hardware, Qwen3.6 27B for knowledge-dense tasks, Gemma 4 26B-A4B for speed-critical agent slots, and DeepSeek V4 Flash for its 384K context window and sheer consistency. The highest praise in the local-model community remains: "I stopped thinking about it." One user runs Laguna S2.1 as a red-team pen tester and gap finder. Another keeps GLM-4.5-Air warm for STEM tasks despite its age, pairing it with Gemma-4-31B as a debugger. The picture is clear: frontier-class open models are exciting, but the models people trust with real work are the mid-size ones they've lived with long enough to know where they break. (more: https://old.reddit.com/r/LocalLLaMA/comments/1va1zoc/everyone_posts_dayone_impressions_whats_still_in/)

Chinese model labs — DeepSeek, Qwen/Alibaba, Moonshot, Zhipu — are not just catching up; on several benchmarks they lead. The deployment decisions are increasingly pragmatic: use K3 as a planner and route execution to cheaper models like Kimi K2.7 Code. (more: https://www.youtube.com/watch?v=JBzz53HqMEs)

AI Cracks Cryptography — Sort Of

Anthropic published two new results from Claude Mythos: an attack on the post-quantum signature scheme HAWK and an improved attack on reduced-round AES. The Mythos chain-of-thought transcript runs to hundreds of pages, demonstrating the model's ability to synthesize existing cryptanalytic tools into novel attacks without detailed human intervention. (more: https://www-cdn.anthropic.com/5273e714527440f1c8b7c7bf5756d4ac22ae8995/aes_mobius_bridge_cot.pdf)

Matt Green, the Johns Hopkins cryptographer, provides the essential context. The HAWK result is the one that matters: it roughly halves the scheme's security bits, making HAWK — a candidate for future post-quantum standardization — effectively unjustifiable when more efficient alternatives exist. The attack doesn't break HAWK in the sci-fi sense (it's still exponential time), but it produced working code that recovers keys against a weakened challenge instance in hours. What makes it genuinely concerning, Green notes, is that "none of the ingredients are exotic." Mythos simply did a more thorough job applying known tools than any human team had bothered to. This is exactly the kind of task where AI excels: exhaustive recombination of existing techniques across a large search space.

The AES result, by contrast, is a modest constant-factor improvement on previous 7-round attacks. Full AES runs 10, 12, or 14 rounds; attacks on 7 rounds have existed for years. The new result requires 2^89 cipher operations after obtaining 2^105 chosen-plaintext encryptions. It's interesting from a techniques standpoint but nowhere near a practical threat. Green's framing: "no wildly new mathematical results here."

The real bottleneck, Green argues, is verifiability. For full attacks like HAWK, verification is easy — run the code, check that it recovers keys. For subtle speedup claims like the AES result, checking validity requires human experts to verify theorem formulations, and that human attention is now the scarce resource. The models produce results faster than humans can verify them. Green's conclusion: the line between where AI is helpful and where it's clueless is "slowly drifting outwards under your feet." Whether that's good or bad depends on whether you prefer to wade or swim. (more: https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/)

Cloud Breaches and Telecom Blind Spots

Wiz Research disclosed CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API that could have compromised every database in the service — including Microsoft's own internal databases backing Teams, Entra ID, and Copilot. The attack chain exploited .NET reflection to escape the Gremlin query sandbox, gaining code execution on Cosmos DB's Gateway service. From there, Wiz discovered a platform-wide signing key — they dubbed it the "Cosmos Master Key" — that could retrieve the primary key for any Cosmos DB account across all tenants, regions, and API flavors. Combined with access to the Config Store (itself a Cosmos DB database listing every account with subscription IDs, tenant IDs, and network settings), an attacker could enumerate a target organization's databases and gain full read-write access. Microsoft remediated fully, eliminated the Master Key, and found no evidence of exploitation beyond Wiz's testing. Wiz notes the research was assisted by Atlas, their AI vulnerability researcher. (more: https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db)

At the other end of critical infrastructure, iFinder — an LLM-driven multi-agent system from Nanyang Technological University — discovered 84 previously unknown vulnerabilities in seven open-source 5G core network implementations, including Open5GS and free5GC. Of those 84, 83 have been confirmed and 81 assigned CVEs. The most alarming: a session-hijacking flaw confirmed on real-world commercial 5G core networks. The root cause is what the researchers call "implicit trust errors" — components that omit syntactic validation, fail to enforce semantic invariants, or allocate resources without checking availability, all because the historical security model assumed physical isolation. Cloud-native 5G deployments shatter that assumption. iFinder's approach cross-checks both 3GPP specifications and source code to suppress LLM hallucinations, then generates and iteratively refines proof-of-concept exploits by executing them against live CN implementations and analyzing results. The researchers plan to make iFinder publicly available — which will simultaneously improve 5G security and hand a powerful automated auditing tool to anyone who wants one. (more: https://arxiv.org/pdf/2607.10315)

On the defensive side, OpenAI shipped Codex Security as a public npm package: an SDK and CLI for AI-powered codebase scanning, though running scans still requires Codex Security access. It supports repository-wide, path-scoped, and diff-targeted scan modes, exports SARIF for integration with existing tooling, and defaults to GPT-5.6 Sol, with Terra available as an override. The AI security scanning ecosystem keeps fragmenting — we've covered five competing frameworks in a single week before — and the real question remains whether any of them reliably catch what static analysis misses without generating false confidence. (more: https://www.npmjs.com/package/@openai/codex-security)

Models at the Edge

TurboFieldfare is a custom Swift + Metal runtime that runs Gemma 4 26B-A4B — a 26-billion-parameter MoE model — in roughly 2 GB of RAM on any Apple Silicon Mac, including 8 GB machines. It keeps the shared 1.35 GB core and FP16 KV cache in memory, then streams only the active experts (~14 MB per load) from SSD per token. On an 8 GB M2 MacBook Air, it measures 5.1-6.3 tok/s decode; on a 24 GB M5 Pro, 31-35 tok/s. The runtime is model-specific rather than a wrapper around MLX or llama.cpp, built from 103 measured experiments across kernels, caching, I/O, prefill, and decode. This isn't theoretical — it's a working Mac app with a streaming installer. (more: https://github.com/drumih/turbo-fieldfare)

On the NPU front, STEEL delivers the first open-source FlashAttention implementation targeting AMD's XDNA architecture. Evaluated on the AMD Ryzen AI 9 HX 370, STEEL reduces energy consumption by 9.17x versus CPU and 1.75x versus GPU baselines. On XDNA 1, it achieves a 9.6x latency reduction over prior state-of-the-art, and a 22.8x speedup over layer-by-layer attention on XDNA 2. The key innovation is a sparsity-aware pipeline placement that distributes consecutive rows across pipelines to equalize the workload imbalance caused by causal masking, yielding a 38% speedup over naive placement. The entire stack — from Python bindings to LLVM-AIE compilation — is open source. NPUs are finally doing real inference, not just demos. (more: https://arxiv.org/abs/2607.09385v1)

The Agent Infrastructure Stack

OpenAI's Symphony turns project management into autonomous implementation runs: it monitors a Linear board for work, spawns Codex agents to handle tasks, and lands PRs when accepted. Engineers manage work at a higher level instead of supervising coding agents — the human-attention bottleneck remains the binding constraint even with sophisticated orchestration. The reference implementation is in Elixir, and the spec is open enough that any coding agent can build its own version. OpenAI explicitly labels it a low-key engineering preview for testing in trusted environments. (more: https://github.com/openai/symphony)

Practical token-saving strategies continue to mature: a 15-rule framework for reducing waste includes techniques like using cheap models as planners with expensive models as executors, which can cut costs 9-10x on benchmarks like Deep SWE while maintaining the same success rate. (more: https://www.youtube.com/watch?v=Y8vAQ1FgNbM)

The harder problem beneath orchestration is grounding: how do agents know what they're talking about? A Neo4j-based approach proposes a two-layer ontology — business concepts on top, technical schemas underneath — with execution traces connecting the two. The semantic layer gives agents structured context instead of relying on free-form retrieval, and execution traces provide a feedback loop for correcting misunderstandings. (more: https://www.youtube.com/watch?v=VGN22pPpb-8)

Frank Coyle extends this with a neuro-symbolic argument: OWL ontologies for defining valid entity relationships plus Pydantic for runtime type enforcement, creating guardrails that are deterministic rather than prompt-based. After a widely reported incident where an autonomous agent deleted 200 customer records because it inherited developer permissions without matching guardrails, deterministic constraint enforcement isn't academic — it's operational survival. (more: https://www.youtube.com/watch?v=Sir59K8ZDPU)

Nostr Rust Forum takes a different tack on agent governance: human and agent participants share a mesh network with did:nostr keypairs and Schnorr-signed events, creating cryptographic accountability for every action regardless of whether the actor is human or artificial. (more: https://github.com/DreamLab-AI/nostr-rust-forum)

For those still catching up on the vocabulary — agents, tools, skills, MCP, memory, permissions, orchestration — a practical glossary maps the territory with useful precision: the model provides reasoning, the agent pursues a goal, tools make actions possible, skills package working methods, MCP connects to external systems, and guardrails define boundaries. (more: https://www.linkedin.com/pulse/guide-anyone-getting-lost-ai-terminology-geraldine-voost-t8zhe)

Surveillance, Honeypots, and Digital Policing

Jose Rodriguez lives in Oregon and worked in Walla Walla, Washington. His name and plate appeared in a murder investigation — one he had nothing to do with. He filed public records requests with the city to obtain Flock Safety camera data that could exonerate him. The city denied him. He filed dozens more requests across Washington state. Multiple cities banded together and sued him to stop the requests — not to protect justice, but to protect the surveillance network. Two judges sided with Rodriguez, ruling the data was public record. The cities then delayed until they passed their 30-day retention policy and deleted the data. Rodriguez won in court and got nothing. On Flock's own website, a "whitelist" feature lets HOA residents opt out of searches — raising the obvious question of who else gets whitelisted. Federal bills are now circulating that would ban Flock cameras outright or strip federal funding from jurisdictions that deploy them. (more: https://www.youtube.com/watch?v=V6d8Yy7Ji68)

For a masterclass in how law enforcement can turn surveillance infrastructure against its operators, the story of Operation Bayonet remains instructive. In 2017, Dutch police infiltrated and took over the Hansa darknet market, running it as a honeypot for nearly a month before the takedown. Every transaction, every message, every vendor identity — collected by the very infrastructure the criminals built to protect themselves. The buyers of Hansa's drugs and services built their own panopticon, and the Dutch police simply moved in. The parallel to Flock is uncomfortable: surveillance infrastructure serves whoever controls it, and the question of who controls it is never as settled as the people being surveilled assume. Whether the cameras are on street corners or in encrypted marketplaces, the same principle holds — the tool is neutral, but control never is. (more: https://www.youtube.com/watch?v=Ik9QPtTwocQ)

When AI Meets the Physical World

A Reddit user was working with Claude via speech-to-text when they found they couldn't speak properly — couldn't think of words, started producing gibberish. Claude recognized the symptoms and insisted they call an ambulance. The user compromised with an Uber to the ER. The hospital rushed them through in two minutes: potential stroke. CT scan, MRI, ECG, bloods. Diagnosis: TIA (transient ischemic attack), a mini-stroke that frequently precedes a full stroke. Twenty-four hours later, back home. The community response was overwhelmingly positive, with another user reporting a nearly identical experience — Claude flagged their sudden inability to read and loss of peripheral vision, and they were also diagnosed with TIA. The counterpoint that strokes literally impair your judgment (anosognosia) makes AI detection in the moment more valuable, not less. (more: https://old.reddit.com/r/ClaudeAI/comments/1vavbyk/claude_thought_i_could_be_having_a_stroke_i_was/)

Why Compression Learns

Ilya Sutskever, in a talk on unsupervised learning theory, makes the formal case for why compression is the foundation of learning. The core thought experiment: concatenate two datasets and compress them jointly. A sufficiently good compressor will use patterns in one to help compress the other — that shared structure is the signal unsupervised learning extracts. Kolmogorov complexity provides the ultimate (uncomputable) low-regret compressor. Sutskever's thesis is that SGD over deep neural networks approximates that ideal and that bigger networks get closer — an explanation for why scaling works, not a proof that it must. The iGPT experiment (2020) gave the argument empirical support in the image domain: next-pixel prediction with the same Transformer architecture as GPT produced useful representations, reaching 96.3% on CIFAR-10 with a linear probe and 99.0% after full fine-tuning. The practical implication, in Sutskever's framing: any procedure that maximizes the likelihood of data — autoregressive models, diffusion models, energy-based models — should in principle produce useful representations. The difference between them is compute efficiency, not information content. (more: https://www.youtube.com/watch?v=AKMuA_TVz3A)