Saturday, August 29, 2026

Z.ai finally shipped GLM-5.3's weights — a day late and without the MIT license every prior GLM carried; anyone above $10B in revenue now needs Z.ai's permission to host it. Meanwhile a federal judge told the Pentagon it broke the First Amendment when it blacklisted Anthropic for refusing autonomous-weapons work, Nvidia quietly pulled the financing program propping up smaller AI clouds, and a researcher published unauthenticated root-over-Bluetooth on the most widely deployed research humanoid on the market.

TLDR

A federal judge ruled the Pentagon's blacklisting of Anthropic was illegal First Amendment retaliation — a 59-page order finding DoD punished the company for publicly refusing mass surveillance and autonomous weapons work (Aug 28) Policy
GLM-5.3's open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ finally landed — but MIT is gone. The new license requires any organization above $10B in trailing-12-month revenue to pass a Z.ai security review before hosting the model (Aug 28) Open Source
Two root-RCE chains in the Unitree G1 EDU humanoid, one reachable over Bluetooth with no pairing and no authentication — CVE-2026-76639 and CVE-2026-76640, with no confirmed fixed firmware (Aug 27) Security Robotics/IoT
Nvidia paused the revenue-sharing financing program it launched in July to help smaller AI clouds buy its chips, after internal antitrust concerns and pushback over the control it demanded (Aug 27) Infra
The Trump administration is weighing chip tariffs that follow semiconductors into finished goods — servers, laptops, consoles — and January's data-center exemptions may not carry over (Aug 27) Policy Infra

Action Items

Things your engineering team should look at or do this week.

Read the GLM-5.3 license before anyone commits to self-hosting it. Every previous GLM shipped MIT; this one does not. The threshold that matters is $10B trailing-12-month revenue, which reaches your cloud provider before it reaches you — meaning the question isn't only "can we host this," it's "can the vendor we'd host it on host it." If GLM-5.3 is in your open-weights shortlist, the license review is now a real gate rather than a formality, and it needs legal eyes, not just an eng read.
Turn on --restricted in Claude Code anywhere it touches untrusted input. The flag (or CLAUDE_CODE_RESTRICTED=1, shipped Aug 27 in v2.1.248) strips the command-execution and code-execution tools plus WebFetch, confines file tools to the working directory, refuses bypassPermissions, and ignores user/project/local settings files. That last part is the one worth noticing: settings files are an injection surface, and this is the first switch that closes it. CI jobs, PR-triage agents, and anything summarizing issue text are the obvious candidates.
If you have Unitree G1 EDUs in a lab, get them off ambient Bluetooth range today. CVE-2026-76640 needs only BLE proximity — no pairing, no credentials — and there is no verified fixed firmware. The interim control is physical and network segmentation, not patching. Also worth pulling the general lesson into your own hardware review: the flaw class here is a cloud API that returned a decryptable AES key to any authenticated account without checking device ownership, which is a bug your team could ship.
Put September 30 on the calendar if you use gemini-omni-flash-preview. The GA model gemini-omni-1.1-flash landed Aug 27 and the preview endpoint retires Sept 30 — about a month. The GA release also adds video extension, first/last-frame interpolation, and a resolution parameter (360p/720p/1080p/4k), so this is a feature-gaining migration, not just a rename.

Models & Tools

Update — GLM-5.3's weights shipped, and Z.ai dropped MIT for a revenue-gated license (Aug 28) Open Source — Flagged here yesterday as pending after the Aug 28 placeholder date passed with nothing published; both full-model repositories went publicly downloadable later the same day. The license is the story. GLM-5.1 and GLM-5.2 both shipped MIT, and GLM-5.3-Flash shipped MIT three days ago. GLM-5.3 instead carries a new license requiring any organization with more than $10B in revenue over a trailing 12-month period to pass a Z.ai security review before hosting the model. The target is explicitly hyperscalers — and, as they grow into those numbers, the neoclouds. Two things follow. First, the practical constraint lands on your provider, not on you: whether GLM-5.3 shows up on Bedrock, Vertex, or a large inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ host is now Z.ai's decision, not the host's. Second, "open weights" has quietly become a spectrum with a commercial tier, and license review belongs in your model-evaluation checklist alongside benchmarks. The model itself is unchanged from the Aug 14 API launch — 753B-parameter MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗, 1M context, 128K max output, all gains from scaled post-training, held two weeks for a safety review Z.ai tied to the model's offensive-security capability. (The New Stack | Interconnects)
Claude Code v2.1.248 adds --restricted, and it closes the settings-file injection hole (Aug 27) Agents Security — The new flag — or CLAUDE_CODE_RESTRICTED=1 — removes the built-in tools that run commands or code, removes WebFetch unless explicitly named in --tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project, and local settings files. The last clause is the interesting one and is easy to skim past. A .claude/settings.json committed into a repository is attacker-controlled content the moment you run an agent against a fork or an untrusted PR branch; every prior hardening story this month has been about some surface nobody classified as an input. This is a switch that treats configuration as untrusted, which is the correct default for any agent running over code you didn't write. (GitHub releases | CHANGELOG)
Cerebras lays out the wafer-scale roadmap at Hot Chips: CS-4 shipping, CS-5 in 2027, CS-6 stacking DRAM on the wafer (Aug 26–27) Infra — The shipping product is CS-4, announced at Cerebras' Supernova event Aug 18: three WSE-3 Turbo wafers in a single rack on the new Nexus platform, 750 PFLOPS, 7.2 Tb/s system I/O, and wafer-to-wafer latency as low as 2 microseconds. Cerebras claims up to 30× the tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ per second per user of GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ systems and 10× the throughput per watt of CS-3. The roadmap disclosed at Hot Chips: CS-5 targeting ~5,000 output tokens/sec/user and 3M tokens/sec/megawatt on frontier models, and CS-6 stacking DRAM directly above the wafer via 3D integration to fix wafer-scale's standing memory-capacity problem. Why a team lead should track a non-GPU architecture: as agents run longer tool-call chains, the cost that hurts shifts from throughput-per-dollar to latency-per-step, and that is precisely the axis wafer-scale optimizes. Vendor benchmarks, no independent reproduction, and CS-5/CS-6 are roadmap — but the roadmap is unusually specific. (Tom's Hardware | Cerebras | HPCwire)
Hugging Face is selling a $399 open-source robot duck, and the sim-to-real loop is the actual product (Aug 27) Robotics/IoT Open Source — Microduck, built with Pollen Robotics: 25cm, under 800g, 15 motors, camera, depth sensor, two IMUs, and an articulated beak that lifts about 800g. It waddles, crouches, recovers from falls, follows a laser pointer, and roller-skates. Preorders opened Thursday; first deliveries targeted before Christmas in North America, Europe and the UK. The engineering-relevant part is the loop, not the duck: the SDK, simulation environment and reinforcement-learning stack are on GitHub, and a behavior trained in simulation on a laptop deploys to the hardware. Sim-to-real used to require tens of thousands of dollars of equipment. One honest caveat that's being widely dropped: the software stack is open; Pollen has confirmed it has no plans to publish hardware blueprints. Call it an open software stack on closed hardware. (TechCrunch | Interesting Engineering)
ChatGPT and Codex now connect multiple Google accounts in one conversation (Aug 28) Customer AI — Gmail, Google Calendar and Google Contacts plugins can each hold more than one connected account, so personal and work inboxes or calendars land in the same session — "find that thread across both inboxes" now works. Global on Plus, Pro, Business and Enterprise, across web, desktop, iOS and Android; add accounts via the gear icon on an already-connected plugin. The caveat to hand your admins before anyone gets excited: each connected account still carries its own app permissions and workspace controls, which means an individual can now put a personal Gmail beside a corporate one in a single agent context. That's a data-boundary question, and it's worth deciding deliberately rather than discovering. (9to5Mac | OpenAI release notes)

APIs & Pricing

Gemini Omni Flash goes GA; the preview endpoint dies September 30 (Aug 27) Pricing — gemini-omni-1.1-flash is the GA version of Google's conversational video generation and editing model, and gemini-omni-flash-preview is deprecated effective September 30, 2026. The GA release is not a straight swap — it adds video extension (continue an existing clip via the extend task), interpolation between a first and last frame through image_to_video with up to two images, and a new resolution parameter in video_config supporting 360p, 720p (default), 1080p and 4k, with 1080p/4K produced by upscaling. Narrow audience, one-month clock. (Gemini API changelog)

Security

CVE-2026-76639 / CVE-2026-76640: unauthenticated root on any Unitree G1 EDU within Bluetooth range (Aug 27) Security Robotics/IoT — Disclosed by researcher Olivier Laflamme, two independent root-RCE chains on the most widely deployed research humanoid on the market. CVE-2026-76639 is network-adjacent: the G1's chat_go chatbot service accepts a "knowledge" upload with almost no filename validation, so a classic path traversal writes an arbitrary file into a directory a separate service (bashrunner) treats as trusted. CVE-2026-76640 is the alarming one — it starts from BLE proximity with no pairing. GATT characteristic 0xFFE2 accepts writes with only basic WRITE permission, and Unitree's /device/bindExtData cloud API returns material any authenticated Unitree account can decrypt to a plaintext AES key — reportedly without checking whether the submitted serial number belongs to that account. A buffer overflow during Wi-Fi provisioning, plus an info leak defeating ASLR, gets system() executing attacker-supplied commands as root. There is no verified fixed firmware release. The chain crosses BLE, cloud, mobile app and firmware, which is the real lesson: the robot's attack surface is the vendor's whole product estate, and "it's on an isolated lab network" is not a boundary against an attacker in the parking lot. (The Hacker News | Original research — boschko.ca | SC Media)
Meta closes the second smart-glasses recording-indicator bypass of the summer (Aug 27) — Meta's Ray-Ban, Oakley Meta and Meta AI glasses refuse to start recording when the front-facing capture LED is obstructed — but users found that covering it after a recording had begun kept the camera running. The Aug 27 software update makes the camera stop the moment the LED is covered mid-recording. VP of AR Alex Himel confirmed the change, and Meta is pairing it with a public-awareness campaign explaining what the indicator means. This is the second such fix this summer; an earlier update disabled the camera for users who drilled the LED out entirely. The pattern is the one this digest keeps landing on from a different direction: a control the user can defeat locally was never enforcement. Meta got there by moving the check from "at start" to "continuously," which is the same fix shape as server-side validation on every request rather than at session open. (The Verge | 9to5Google | Android Central)

Industry & Business

Nvidia pauses the revenue-sharing program that was financing smaller AI clouds — over its own employees' antitrust concerns (Aug 27) Infra — Per the Wall Street Journal, Nvidia has stepped back from the financing initiative it announced in July, under which it offered credit support to AI cloud companies so they could buy its chips, in exchange for a share of revenue. The structure: Nvidia and each provider set a base hourly rate covering the provider's costs, and Nvidia took 50% of any revenue above that threshold. Two things reportedly killed it — Nvidia employees warned customers and prospects that the arrangement could draw antitrust scrutiny, and prospective partners balked at the control Nvidia demanded, including vetting their customers through an approval process and steering utilization toward multiple smaller AI firms. Nvidia's statement is that the July model "is still in place and continues to evolve"; the Journal says the company may restructure or fold it into another effort. Why this belongs in your risk register and not just the finance press: it ran for under two months, and several of the neoclouds now signing multi-year, multi-billion-dollar compute leases with frontier labs were exactly the balance sheets this program was meant to shore up. (Reuters via Yahoo Finance | Quartz | Benzinga)
a16z raises $1.1B for "Machine Age," its first dedicated hardware fund — and the pitch is a one-megawatt rack (Aug 28) Infra — The firm most associated with "software is eating the world" has raised $1.1 billion for AI processors, memory, networking, storage, robotics, data centers, and home AI appliances. Led by GPs Martin Casado and Raghu Raghuram, targeting early and growth stage. The number that carries the thesis: today's AI racks draw 100–250 kilowatts, roughly twenty times a cloud-era rack, and a16z projects one megawatt per rack within three years. Their framing is that every layer of the hardware supply chain — chips, memory, power — is capacity-constrained at once. What it signals for anyone planning inference budgets: the smart money is betting the bottleneck stays physical for years, which argues against assuming continued rapid token-price decline as a planning default. (TechCrunch | a16z | PitchBook)
Anthropic weighs letting existing shareholders sell into an IPO bankers are valuing near $1.5 trillion (Aug 28) — Reported plans include a secondary component — existing investors and shareholders selling alongside the company — which would break from the SpaceX-style approach of keeping insiders locked up. Anthropic is also reportedly considering a lockup longer than the standard 180 days for at least some holders, to damp post-listing volatility after unusually steep recent growth. Bankers have discussed valuations up to $1.5 trillion, with the New York Times reporting an eventual figure as high as $2 trillion; listing could come as soon as September or October 2026. Read it alongside the ~$45B Nscale lease from Tuesday: the compute commitments and the financing event are the same story from two ends, and if you depend on Claude in production, the company's cost of capital is now a variable in your stack. (Tech Startups | citybiz)
Marvell beats, raises — and falls 8%, because the $120B Google deal doesn't pay until FY2029 (Aug 28) Infra — Marvell reported better-than-expected results and raised its fiscal 2027 and 2028 revenue outlooks, but shares dropped roughly 8% in premarket trading after CEO Matt Murphy told investors the custom-chip agreement with Google — potentially $120B through fiscal 2033, with an up-to-$12.2B Alphabet share option — becomes materially meaningful only in fiscal 2029. Gross margins are under near-term pressure from the mix shift toward lower-margin custom AI silicon. The signal worth extracting: the market has stopped valuing large AI contracts as near-term revenue, and custom-accelerator programs genuinely take years to design, validate and deploy. If your inference roadmap assumes hyperscaler custom silicon relieves GPU scarcity soon, this is a datapoint against that timing. (Reuters via MarketScreener | CNBC on the original deal | The Next Platform)

AI in Production

Claude Code and Cowork hit elevated errors Friday evening, ending the month's only clean two-day stretch (Aug 28) Production — Anthropic applied a mitigation at 20:21 UTC for elevated request errors affecting Claude Cowork and Claude Code on the web, then monitored for recovery. Users saw elevated errors rather than a full outage, and availability varied by product and workload. The base rate is still the number to plan against, not this incident. Adding Aug 28 to the publicly logged days — Aug 5, 12, 13, 16, 18, 20, 24, 26 — August ran roughly one flagged day in three. Notably, this one hit the developer tooling surfaces rather than the model endpoints, which is a different failure domain than the multi-model events earlier in the month: if your CI invokes Claude Code non-interactively, that's a dependency worth a timeout and a fallback path, not just an error log. (Claude Status)

Policy & Safety

A federal judge rules the Pentagon's blacklisting of Anthropic was illegal First Amendment retaliation (Aug 28) Policy — U.S. District Judge Rita Lin issued a 59-page order finding the Department of Defense acted unlawfully when it designated Anthropic a supply-chain risk to national security, holding that DoD targeted and punished the company for publicly criticizing the department's stance on battlefield AI deployment. The underlying dispute: DoD sought to use Claude for "all lawful purposes" including the most sensitive military and intelligence applications; Anthropic held two lines — no mass surveillance of Americans, no fully autonomous weapons — and declined an open-ended contract that would have overridden its usage policy. DoD then moved to restrict federal agencies and contractors from using Anthropic technology. Why this is the most consequential item of the week even though it ships no code: it is the first judicial answer to who sets the limits on military AI — the government buying it or the lab building it — and it gives frontier labs real legal footing to refuse government demands that cross their published policies. Keep the caveats attached: the government is expected to appeal, and separate litigation continues in Washington, so the larger conflict is unresolved. It also raises the stakes for every other lab pursuing national-security contracts while maintaining internal use policies. (NBC News | CNBC | Axios | The Hill)
Chip tariffs may follow semiconductors into servers and laptops — and January's data-center exemptions may not survive (Aug 27) Policy Infra — Per Politico, sourced to eight people familiar with the discussions and picked up by CNBC: the administration is weighing extending semiconductor duties to products containing chips — laptops, gaming consoles, and the servers filling AI data centers. Commerce Secretary Howard Lutnick favors capping duty-free chip imports at a volume pegged to each company's committed U.S. production, and Commerce officials have signaled privately that the exemptions attached to January's 25% tariff — covering data centers, R&D, startups and consumer devices — may not carry over. Plans are preliminary and any regime would likely phase in. The distinction that decides your capex: a duty on GPUs is painful; a duty on assembled servers, networking gear and storage cascades through every line of a data-center build. Industry groups are warning it would raise AI infrastructure costs at exactly the moment domestic buildout is the stated goal. Not policy yet — but already a planning variable for anyone signing hardware contracts this quarter. (CNBC | Tom's Hardware)

Two of yesterday's open threads closed, and both closed badly for the "open" part.