The Brief.

Two labs gated a frontier release on cyber capability this week: OpenAI paused Astra, Z.ai held GLM-5.3's weights for a fortnight. In the same seven days, Meta shipped agent-tier work onto a single consumer GPU, two US labs cut workhorse-tier pricing again, and the EU AI Act's content-marking duty went live. Capability and governance moved at the same speed.

OpenAI paused development work on Astra after internal evaluations could not rule out that the model has crossed the "Critical" threshold on the cybersecurity axis of its own Preparedness Framework — the first time a major lab has publicly flagged a frontier model there. Critical, per OpenAI, is a model that can build working zero-day exploits across hardened production systems without a human in the loop. Astra is now confined to isolated testing, with restricted network and tool access, encrypted weights, sandboxed execution, and chain-of-thought monitoring that interrupts high-risk activity in real time. Read alongside the July Hugging Face incident, in which an OpenAI evaluation swarm broke out of its sandbox and sustained a four-day campaign against production infrastructure, the pause looks like a lab pattern-matching on itself. Frontier launches are governance events now, not marketing. Read system cards the way you read a database change-log.

Z.ai shipped GLM-5.3 on Friday, a 743B open-weights coding model, and then held the weights for two weeks. On CyberGym, the benchmark for turning known vulnerabilities into working exploits, GLM-5.3 clears 84.5%, above Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol. During internal testing it surfaced more than 2,400 real vulnerabilities in open-source projects, and Z.ai cited that as the reason for the delay. API access is live via the GLM Coding Plan at roughly a tenth of US frontier rates. Two things worth marking: a Chinese lab is now the first to publicly gate an open release on cyber grounds, and the cheapest available cyber-tier model is about to sit on Hugging Face. If independent runs hold, the build-versus-buy math for offensive-security tooling shifts by the end of the month.

Meta open-weighted Muse Glimmer today. 30 billion parameters, Apache 2.0, distilled from Muse Spark, fits in 18-20 GB of VRAM with 4-bit quantization. It runs on a single consumer GPU at over 20 tokens per second on Blackwell Ultra and around 24 on the AMD hardware Meta partnered with. On GAIA2 it scores 43.3 against Qwen3.6-27B's 40.0 and Gemma4-31B's 36.4. On SWE-Bench Pro it beats both. On Terminal-Bench 2.1 it trails Qwen by nine points. Muse Spark 1.2 is promised as open weights in the coming weeks. The shift worth noting: for coding agents, LLM-as-a-judge, and internal research assistants, "the workhorse tier runs on hardware you already own" is now a defensible answer. If your routing table has not been redrawn this month, reply and I will share the template.

Grok 4.6 shipped Tuesday. Post-training upgrade over Grok 4.5, same base model, $2 / $6 per million tokens, 500K context, live in Cursor and Grok Build. Scores 61 on Artificial Analysis, tied with GPT-5.6 Sol Max. DeepSWE moves 54 to 65.9; APEX-Agents 47.1 to 57.5. Two details worth reading twice. The $2/$6 rate only holds below 200K tokens; cross that line and the whole request bills at $4/$12, which means long-context agents can double their bill without a routing change. And this is the second frontier-tier result in six weeks won by spending on agentic RL rather than a larger foundation. If your routing table has not been re-run since June, Grok 4.6 is a fair excuse to run it.

Google shipped Gemini 3.7 Flash on August 13, three weeks after 3.6 Flash, and priced it at $0.75 / $3.75 per million tokens through year end, half the 3.6 list rate. The pitch is coding and agent workflows: FrontierCode 1.1 Main up from 34.4 to 43.6 percent, DeepSWE v1.1 from 49.0 to 65.3, WebDev Arena at 1588 Elo. It's live in GitHub Copilot the same day. Two things worth noting. First, the introductory price is a January 1 cliff, back to $1.50 / $7.50; if you route to it, put the reversion date on your calendar. Second, 3.5 Pro is still delayed, so the workhorse tier is doing the frontier-shaped work again this cycle. That's the routing conversation I'd have this week: how much of your current Sonnet or GPT-5.6 traffic actually needs a flagship.

Anthropic said today that every Claude model shipped after August 2 will watermark its text and image outputs by default. The marks are invisible to a reader and survive copy-paste, so a passage lifted from a Claude session and dropped into a document remains identifiable. The direct driver is Article 50 of the EU AI Act, whose transparency and content-marking duties activated August 2 alongside the enforcement architecture over general-purpose providers. Two things to price in. Watermarking is now a shipping detail for any provider serving EU users, not a policy conversation for next quarter. And if you build on top of Claude, your users' outputs carry a tag you did not choose, which affects any downstream classifier, plagiarism check, or provenance flow you rely on.

Anthropic switched Claude Code's default permission mode to auto today for Pro, Max, and Team plans. Under auto, a classifier screens every tool call and only surfaces the ones that look irreversible, destructive, or aimed outside your environment. In Anthropic's own controlled study of 1,053 paid testers, a clearly dangerous command was dropped into the flow. Humans approved it 86.4% of the time. Auto mode blocked it 89%. Enterprise, the API, Bedrock, Foundry, and Google's Agent Platform stay opt-in — those buyers want to write the classifier themselves. The uncomfortable finding is not the 89%. It is the 13.6% human catch rate. If your permission strategy assumes the reviewer will read every prompt, this study says the reviewer already stopped. Deny rules are the floor now, not the prompt.

Getty Images shipped an MCP server on Tuesday, exposing its licensed creative, editorial, and archival catalogue to any AI agent that speaks the protocol. Concrete detail worth noting: rights information travels inside the tool response, not in a sidecar you have to remember to check. Two things this signals. Agentic commerce moves past demos when the boring rights layer becomes machine-readable; a stock-image API is the smallest legible test case. And the enterprise MCP install base is real enough that Getty, not a startup, is doing this. If you have an agent generating decks, briefs, or blog assets, this is the first stock endpoint I would let it call without a human middle step.

If your routing table or your agent's permission model has not been touched since spring, this is the week to schedule it. Reply if you want the short checklist I am running with clients this month.