Tuesday, August 25, 2026

This one has the bigger headline: Nvidia just bought its way into being a model lab. $6B for Poolside's training stack plus 109 of the engineers who built it, aimed squarely at open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗ Nemotron. Also here: a usage cap that lands on your team's Codex accounts today, a real MCP-execution CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗, and two hard deprecation deadlines that hit tomorrow morning.

TLDR

Nvidia is paying Poolside ~$6B for a non-exclusive license to its "Model Factory" training stack and hiring 109 of its engineers — not an acquisition, not an acquihire, and pointed at open-weight Nemotron competing with DeepSeek, Kimi, and Qwen (Aug 24) Open Source Infra
OpenAI reinstated the 5-hour rolling usage cap on Codex and ChatGPT Work for Plus subscribers, effective today — Pro $100/$200 tiers exempt for now (announced Aug 24, live Aug 25) Pricing
Marimo patched CVE-2026-75149 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 8.7): opening a crafted notebook in edit mode runs an attacker-supplied MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ command as a local subprocess, before any cell executes — fixed in 0.23.15 (Aug 19; broad coverage Aug 25) Security Agents
XPeng's robotics unit raised $900M+ at a $6.3B post-money valuation — the largest single private round in China's embodied-AI sector, IRON humanoid targeting mass production by end of 2026 (Aug 24) Robotics/IoT
Apple shipped a Mac mini with the new M6 and M5 Pro, including the first dual Neural Engine — 4× faster on-device AI, pre-orders today, units land Sept 22 (Aug 25) Infra

Action Items

Things your engineering team should look at or do this week.

Two OpenAI cutoffs land tomorrow, Aug 26 — confirm both are handled before you close today. The Assistants API shuts off with no automated Threads→Conversations migration, and o3 is removed from ChatGPT (paid users only; the o3-2025-04-16 and o3-pro-2025-06-10 API snapshots survive until Dec 11, so this is a UI/workflow break, not an API break). These have been flagged since Aug 1 and Aug 19 respectively; they're repeated here only because tomorrow is the day. Grep your codebase for /v1/assistants and /v1/threads one more time. (OpenAI deprecations)
Check whether the reinstated 5-hour Codex cap hits your engineers before they hit it mid-task. Anyone on a $20 Plus plan using Codex or ChatGPT Work is now subject to a rolling 5-hour limit on top of the weekly one, starting today. If your team standardized on Plus for coding agents, either budget for credit top-ups or move heavy users to Pro, which OpenAI says is exempt "for the upcoming months." The failure mode is an agent stalling halfway through a long refactor, which is worse than not starting it.
Audit every notebook host and agent runtime for Marimo < 0.23.15, and treat "notebook opened in edit mode" as code execution. CVE-2026-75149 needs no authentication and fires before cells run — a shared or downloaded .py marimo notebook is now an executable payload. Note this is the second critical Marimo bug this cycle; CVE-2026-39987 (CVSS 9.3, pre-auth RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ via an unauthenticated /terminal/ws endpoint) was exploited in the wild within 10 hours of disclosure. If you're on anything below 0.23.15, patch, and check exposure on 0.23.0 too.
If you have an open-weight model strategy, revisit it after the Nvidia–Poolside deal. Your biggest hardware supplier is now staffing a frontier-scale model team. That's a new, extremely well-capitalized entrant in the open-weight tier you may currently be filling with Qwen, Kimi, or GLM — and a supplier who now competes with the labs that are its own largest customers. Worth a line in your vendor-risk notes, not a plan change today.

Models & Tools

Nvidia pays Poolside ~$6B to license "Model Factory" and hires 109 of its engineers (Aug 24) Open Source Infra Trending — Structured deliberately as neither an acquisition nor an acquihire: $6B for a non-exclusive license to Poolside's model-development stack — training pipelines, data curation, RLHFReinforcement learning from human feedbackReinforcement learning where the reward comes from people ranking which model outputs they prefer.Ouyang et al. 2022 ↗ tooling — plus a separate $1B equity investment at a $12B pre-money / $13B post-money valuation. The 109 engineers who built Laguna from scratch got offers and will work on Nemotron, Nvidia's open-weight line. Poolside's three co-founders (including CEO Eiso Kant and Jason Warner) are not joining; the company stays independent and can license Model Factory to anyone else. Why this is the story of the day: Nvidia has spent three years selling picks and shovels while insisting it doesn't compete with its customers. Buying a training organization outright ends that framing. The explicit target is a US open-weight model that beats DeepSeek, Kimi K3, and Qwen — which, if it works, changes the default open-weight choice for anyone self-hosting. (Reuters | Forbes | PYMNTS)
Alibaba ships Wan3.0 out of beta: 30-second clips, and documents as a generation input (Aug 24) Customer AI Pricing — Tongyi Lab's video model doubles maximum single-pass length to 30 seconds (from Wan2.7's 15) and — the genuinely new capability — accepts PPT, PDF, DOC, XLS, and Markdown files as input alongside text, image, audio, and video. API pricing runs $0.05/sec at 480p, $0.10 at 720p, $0.20 at 1080p, with a 30% discount from Aug 24 to Sept 23 on selected platforms; Standard and faster Prime tiers are available via wan.video, Alibaba Cloud Model Studio, and Qwen Cloud. It landed one day after the $10.2B Hong Kong share placement. The caveat worth stating plainly before anyone pipes a deck into it: document-to-video means your internal files transit Alibaba Cloud and sit under Chinese jurisdiction. That's a data-governance decision, not a procurement one. (TechNode | The Decoder | Alibaba Cloud)
Apple's new Mac mini brings the M6 and M5 Pro — and the first dual Neural Engine (Aug 25) Infra — Same chassis, new silicon. M6 moves to a 12-core CPU and 12-core GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ (from 10/10 on M5) and introduces two 16-core Neural Engines, delivering roughly 40% faster CPU, 2× graphics, and up to 4× faster AI performance versus the prior generation; an M5 Pro option sits above it, and Apple separately announced M6 and M5 Ultra for the higher-end line. Apple is pitching it explicitly at local model execution and on-device agents. Pre-orders opened today; nothing ships until Sept 22. For a team lead the relevant question is narrow: a cheap, quiet, air-cooled box with a real NPU is now a plausible target for on-device inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ in desktop apps and for local dev-time model runs — but AppleInsider's caveat holds, the base RAM and SSD configurations are tight for anything ambitious, so spec carefully. (Apple Newsroom | Apple: M6 and M5 Ultra | MacRumors | AppleInsider)
Canonical funds a three-year effort to automate C→Rust translation, with AppArmor as the test subject (Aug 24) Open Source — Canonical, the University of Bristol, and UK Research and Innovation are backing a PhD (student Alex Wood, supervised by Prof. Meng Wang and Dr. Cristina David, with Canonical's Jon Seager co-supervising) to translate hundreds of thousands of lines of C into Rust. The approach is deliberately not vibe-coding: dependency-aware chunking → translation with models trained on real C→Rust conversions → validation by fuzzing and formal equivalence checking → symbolic program repair to close discrepancies automatically. Targets are AppArmor and snap-confine, security-critical code in every Ubuntu install. The interesting engineering claim is the one The New Stack pulled out: AI-generated Rust compiles cleanly, which removes the compiler as your safety net — the whole design bets that formal equivalence checking, not review, is what makes automated migration trustworthy. If you have a C migration on a five-year roadmap, this is the pipeline shape to watch. (The Register | InfoWorld | The New Stack)
Anthropic opened Claude Academy — 355 free tutorials, no sign-in required (Aug 20) — A free official learning hub at academy.claude.com covering AI fundamentals then splitting into product paths for Claude.ai, Cowork, Claude Code, Claude Tag, and the Platform/API, with hands-on exercises and multi-language material. Courses are readable without an account; signing in adds progress tracking and completion badges. If you've been writing internal enablement docs for your team's coding-agent rollout, most of that page is now maintained by someone else. (Claude Academy | EdTech Innovation Hub)

APIs & Pricing

OpenAI reinstates the 5-hour rolling cap on Codex and ChatGPT Work for Plus — live today (announced Aug 24, effective Aug 25) Pricing — After several weeks in which Plus subscribers faced only a weekly usage cap, OpenAI restored the 5-hour rolling limit across both Codex and ChatGPT Work for the $20 Plus plan. Hitting either the 5-hour or the weekly ceiling means waiting for reset or buying credits. Pro $100 and Pro $200 subscriptions are exempt "for the upcoming months." OpenAI's stated reasoning is load smoothing plus a user-experience argument — that casual Plus users were accidentally burning a full week's allowance in one sitting. Read the second half of that skeptically if your engineers are on Plus: they are not casual users, and a rolling window is exactly the constraint that bites a long agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ session. (9to5Mac | Android Authority)

Security

Marimo CVE-2026-75149: a crafted notebook runs an MCP command as a local subprocess the moment you open it in edit mode (published Aug 19; broad coverage Aug 25) Security Agents — Code injection in the Python notebook tool, CVSS v4 8.7 / v3.1 8.8, affecting all versions before 0.23.15. No attacker authentication is required; user interaction is just opening the notebook. Critically, execution happens before any notebook cell runs, so "I didn't execute anything" is not a defense. VulnCheck's CNA assigned it. Context that raises the priority: this is Marimo's second serious flaw in the cycle — CVE-2026-39987 was a pre-auth RCE (CVSS 9.3) via a missing-auth /terminal/ws WebSocket giving a full PTY shell, fixed in 0.23.0, and exploited in the wild under 10 hours after disclosure. The generalizable lesson for anyone running agent tooling: MCP client configuration is now an execution surface, and any file format that can carry an MCP server definition should be treated as untrusted code. (The Hacker News | Sysdig on CVE-2026-39987 | CCB Belgium advisory)

Industry & Business

XPeng's robotics unit raises $900M+ at a $6.3B valuation — the largest embodied-AI round in China (Aug 24) Robotics/IoT — First outside round for the business, led by IDG Capital with Gaorong Ventures and strategic participation from Tencent and Alibaba. Money goes to mass production and physical-AI model R&D. The IRON humanoid is targeted for mass production by end of 2026, deploying first in XPeng's own stores and campuses, with commercial deliveries in China and overseas in 2027. Worth holding the skepticism alongside the number: the unit has not sold a single IRON yet, so this is a $6.3B mark on a pre-revenue product line. (XPENG | TechNode | Electrek)
Nvidia reportedly in talks to invest in Perplexity at a $30B+ valuation (Aug 24–25) — Per The Information, Nvidia is discussing participation in a multibillion-dollar round valuing Perplexity above $30B, more than a 50% step-up from a year ago. Perplexity's annualized revenue has reportedly passed $750M, up from under $250M at the start of 2026. Nothing is finalized — treat the valuation as reported, not agreed. Note the pattern rather than the deal: between this, Cloverleaf, and Poolside, Nvidia is deploying capital across the entire stack it sells into. (The Information)
Japan earmarks another ¥150B ($944M) for Rapidus in the 2nm race (Aug 21) Infra — METI is adding ¥150 billion for the domestic contract chipmaker and will seek further funds in the FY2027 budget. The money funds mass-production equipment for 2nm logic and R&D on next-generation 1.4nm. Rapidus targets 2nm mass production in FY2027–28 and advanced packaging in FY2028–29. The relevance to anyone forecasting compute supply is straightforward: this is a state-backed attempt to add a third leading-edge foundry alongside TSMC and Samsung, and the timeline says nothing changes before 2028. (Bloomberg | Argus Media)

The morning edition led with Hot Chips silicon.