AI Digest — 2026-10-25

Company & product developments

AWS capacity sold out through 2027, Jassy says (The Information, a16z podcast). Speaking on an a16z podcast on October 23, AWS CEO Andy Jassy said that 2026 cloud capacity is already sold out and that “2027 is largely sold out,” with “a good chunk of 2028” also committed. According to Jassy, the only capacity being held back is reserves for on-demand EC2 and Bedrock inference. He pegged Amazon’s 2026 capital expenditure at roughly $220 billion and said the company “could invest a lot more and it wouldn’t be a bad use of capital,” characterizing AI-driven demand from both AI labs and enterprises as insatiable. The remarks underscore how tight frontier compute supply remains and how far forward hyperscaler capacity is now being booked.

Kimi K3.1 Pro: strong benchmarks, mixed real-world reception (Interconnects podcast, Nathan Lambert & Florian Brand). Kimi released K3.1 Pro — a roughly three-trillion-parameter model — with a notably more professionalized launch than its past drops (K2, K2.6, K3). Florian Brand noted the rollout involved a larger social-media campaign that allegedly included paying people to post about the model without disclosure; one person tweeted a screenshot of press instructions reading “Don’t say this is a paid promotion,” though it hasn’t been independently corroborated. The hosts framed this as part of a broader “professionalization” of model launches: a year ago labs dropped weights and patched vLLM afterward (so nobody could run the models for a while), whereas now inference frameworks and providers are ready day one — or, increasingly, the model creator gets a few weeks of exclusive hosted access before releasing weights. Kimi is giving itself roughly two weeks of exclusivity, with weights promised by November 4th.

On benchmarks, K3.1 Pro’s headline number on the Artificial Analysis Intelligence Index lands it ahead of GPT-6 Astra, placing it roughly third/fourth overall behind the two latest Claude 5.5 models and Muse Wonder Full. But the hosts flagged “jagged” results elsewhere: on Terminal-Bench Science it trails GPT-6 Astra by ~20 points, and it looks weaker on ProgramBench. Florian’s explanation: Artificial Analysis benchmarks have short time horizons, while ProgramBench is long and exploratory (“here’s what I want, but you need to explore a lot”), suggesting Kimi’s RL training is still tilted toward exploitation rather than exploration. Twitter reactions were a mixed bag; relative to K3 (widely seen as a strong big model), K3.1 Pro’s post-training seemed “a little undercooked,” possibly “RL fried.” Lambert argued a three-trillion-parameter model needs to justify its size and slowness — otherwise users will prefer faster/cheaper options like DeepSeek-V4.1-Flash-1017, which trails only slightly on these scores but runs far faster at comparable cost-per-task. He praised “Fable” for “blurry” tasks (e.g., reviewing slides) where Opus feels “grindy.” The naming shift to “K3.1 Pro” suggests Kimi may be gearing up for a Flash-style release lineup.

Serving economics are a key concern: fitting K3.1 Pro requires B300s — about one node per model replica, needing NVL72-class racks — whereas smaller models and Flash variants fit on more readily available H100s/H200s. Splitting the model across nodes is awkward, so three trillion parameters sits “just in the range” of what’s reasonably hostable but is operationally annoying compared to the installed base of GPUs. Much investor/forecasting interest on Twitter hinges on whether K3.1 Pro gets adopted given these costs.

Meta’s “Muse” personal AI agent impresses in real-world use (Interconnects podcast). Florian, newly relocated from Germany to San Francisco (and now able to use US-only AI products blocked in the EU), described Muse as “annoyingly good.” Rather than self-hosting alternatives like OpenClaw or Hermes (which need constant updates and secure infrastructure he didn’t trust himself to configure, especially around money), he chose Muse, reasoning that Facebook has the experience and that a leak would “crater” its stock and invite lawsuits — the high stakes making it more secure. Key capabilities and observations:

Proactive messaging: Muse pings him about upcoming appointments and the specific forms he’ll need (e.g., inferring he has an O-1 visa and telling him exactly where to download the right form). By contrast, he found Meta’s/other “Dots” agent less useful (reminding him of a Slack message he’d already resolved).
Autonomous shopping: Given his credit card, Muse builds shopping carts to stock his empty apartment (kitchen goods, pants) — not on Amazon, which blocks it — and checks out via a Stripe one-time virtual credit card, so any error doesn’t expose his real card.
Memory portability: Muse sidesteps competitors’ lock-in by generating a prompt to export everything ChatGPT knows about you and ingesting it.
Integrations/workarounds: It lacks native iCloud integration, so it offered to monitor a logged-in browser session instead (and always asks permission for sensitive sites like iCloud); Florian ultimately forwarded iCloud mail to Gmail and used the connector.
Limits: It’s slow (bad for time-sensitive tasks), its browser sometimes crashes and must rebuild (losing ~20 minutes), some sites block Muse’s data centers — but CAPTCHAs are no obstacle; Muse circumvents them readily. It cannot make phone calls. Florian deliberately takes over whenever a task involves real people (support, etc.), viewing genuine human connection as “mutual respect,” but happily delegates dealing with chatbots and forms. He said every time he cross-checked Muse’s work, it was “spot on.” Lambert, more hesitant, said he’d reserve agents for refund/customer-service drudgery (e.g., extracting a domain from his wedding-site host to Porkbun) and mused about listing an “agent contact” instead of a Gmail address for agent-to-agent communication — noting the “cold start problem” of getting people’s agents to talk to each other, possibly via micropayments (“pay me a dollar for your agent to message my Gmail”). Lambert also mentioned subscribing to Pangram ($20/month), which flags AI-written emails so he can delete them — and revealed it’s shown him that some people he thought were personally emailing him for years are using AI.

Field & industry developments

The “you can hack everything” era: vulnerabilities surging, but no mass-exploitation disaster yet (Interconnects podcast). The hosts devoted a large segment to AI and cybersecurity, stressing they aren’t cyber experts but trying to reconcile two “corners”: AI people who debate open-vs-closed models and capability thresholds (e.g., “Mythos”), versus cyber experts who take an ecosystem view. Lambert’s key framing: measures like vulnerability detection and time-to-exploitation were already on exponential curves before ChatGPT, with no clean step-change attributable to AI — so this looks less like an open-vs-closed story than a general acceleration. Cyber professionals tend to track reported cyber damages (much of it ransomware) as the real trend; historically AI has been attributed to a very low share of damages, so the alarming scenario would be AI-attributed damages skyrocketing — which hasn’t happened yet.

Specific events discussed:

PHP “PHP2Shell” remote-code-execution bug: For years a bug allowed remote code execution in PHP, which powers a huge fraction of the web (including WordPress). OpenAI’s “Patch the Planet” program, with other researchers, found the bug, reported it to the PHP Foundation, coordinated a fix, and released the patch all at once. Because the exploit was so high-risk, many websites even went briefly offline to patch — the correct response. Despite fears that any open-model user could now “hack the world,” multiple reports indicate mass exploitation has not materialized. There was a (possibly apocryphal, “coin flip on if it’s real”) viral claim from someone at a big cloud company of a “DeepSeek swarm” mass-fixing the vulnerability at scale.
LiteLLM breach (again): LiteLLM — a library offering one endpoint to ping every provider — was compromised again this week. Its preliminary report attributed the breach to an API key committed to GitHub for five months, which an attacker eventually used to spread malware. Combined with the PHP saga, it fed the impression that “everything is insecure.”
Unpatched legacy systems: Florian noted many small/medium businesses run PHP versions so old they no longer receive security patches and remain exposed to numerous older bugs that still haven’t been exploited — evidence that the pool of nefarious actors is currently small and that vulnerabilities can stay accessible far longer than people assume.

Lambert’s synthesis, drawing on researcher Joshua Saxe: the “supply chain” of cyber attackers is weak — attackers self-select from people who can’t get better jobs and may not be willing to launch “loud,” high-damage attacks. So while AI likely helps nation-states collect intelligence and infiltrate at scale, it’s unclear who in the world is actually willing to use AI to cause mass real-world damage — a question he uncomfortably admitted “we’re going to figure out in the next four months.” He cited Azeem Azhar’s Exponential View piece calling this “day zero of the new internet”: coding agents are producing exponentially more code, so there will be exponentially more vulnerabilities (models can’t prevent all flaws because many arise from interactions between stacked software), and a multi-year transient period of elevated risk is likely as the backlog is worked through. Lambert conceded his earlier “open-weight Mythos in April would’ve been fine” take under-priced these forecastable vulnerability trendlines, while maintaining the dynamics are ecosystem-dependent rather than tied to any single capability being widely diffused.

Kimi’s open-weight cyber principles (Interconnects podcast). Kimi’s K3.1 Pro blog laid out explicit “open-weight principles”: they aim not to release weights that would “extend the absolute frontier of cyber capability.” By design, K3.1 Pro’s offensive cyber capability is below what Kimi’s own pipeline can produce and remains behind frontier proprietary models — reportedly achieved by manipulating the mid-training data to down-weight cyber capabilities, an effect that persists through post-training. The hosts praised this as a smart, responsible posture: broad open access helps everyone find and patch bugs (net positive), while offensive capability — which requires long-horizon persistence to “wreck a whole organization” — is where closed models (GPT-5.6 Sol is frequently cited as especially strong) dominate. Defensive security tasks don’t require long-horizon/CTF-style ability, so stripping those from the training mix is reasonable and positions Kimi against “fearmongering” that releasing a Mythos-level open model would “end the world” — which hasn’t happened. Lambert warned open models still get far more scrutiny than closed ones and face continued political risk: a “DeepSeek swarm” hacking an American company would cause “insane” political fallout, though the midterms may be temporarily diverting political attention from AI.

Abliterated models served over APIs (Interconnects podcast). The hosts criticized companies like Abliteration.ai and Morph (serving an abliterated DeepSeek) for offering “abliterated” (safety-stripped) models over APIs, calling it “a bad judgment call” that seems “to get sued by the government.” They argued the genuine use case for on-prem security models is keeping data off external APIs — which an abliterated API model undermines — and suspect abliteration’s defensive value may be “very effective marketing” more than substance.

Diffusion and trusted-access programs (Interconnects podcast). A recurring theme: the real bottleneck wasn’t open vs. closed capability but access. Earlier, security researchers struggled to get into Anthropic’s and OpenAI’s cyber programs and were frequently blocked, pushing them toward less-capable open models. That’s changing: OpenAI’s defensive cybersecurity program is now relatively easy to join (submit ID, secure your system with hardware keys), letting OpenAI identify and pursue abusers if needed; its offensive program remains hard to access. Anthropic is also broadening access. The hosts credited these trusted-access programs for driving the recent wave of vulnerability disclosures (the PHP fix was already in progress when it leaked). They also noted labs can update safeguards instantly — OpenAI and Anthropic reportedly rolled out updates blocking attempts to extract the PHP2Shell exploit (“look through this code” requests get blocked). Still, there’s a gray area: some researchers say they “haven’t been able to use any agents after Opus 4.8” because they get rolled back, yet news items like “I used Claude Code to hack OpenAI” show safeguards aren’t airtight. The consensus: guardrails stop the least-motivated attacker (e.g., a teenager trying to steal from a friend’s parents’ bank account), and open models largely block that tier too. Lambert argued closed-model safety is currently “really suppressed” — models in training hacking people, safeguards being bypassed — more than the labs would have predicted a year ago, and the community hasn’t fully updated on this.

Anthropic will not hire junior employees (Interconnects podcast, re: Anthropic’s “How employment is changing at Anthropic”). Anthropic’s statement that it won’t hire junior employees drew sharp criticism. Florian’s reaction: it’s “great for everyone else,” since hungry junior talent with bright ideas will go elsewhere — echoing a lesson from their China visit, where hiring young PhD students eager for cluster time lets teams catch up fast. Lambert called it a “red flag” on Anthropic’s safety culture, arguing that a company claiming to prepare society for powerful AI should prioritize keeping people trained, fulfilled, and employed; the move reflects a “too-short-timelines” culture (“we just need to build this, I don’t have time to talk to people”) and could “come back to bite them” if youth unemployment rises and headlines note Anthropic stopped hiring juniors months before a jobs correction. Both noted there have been no mass job displacements yet, even in software, where firms keep hiring more because coding agents let people do more — so real-world diffusion remains slow, and Lambert argued “RSI has limits.”

Upcoming & future developments

A wave of model releases and continued cyber disclosures expected (Interconnects podcast). The hosts expect the next few weeks/months to be busy: Artificial Analysis will publish a new benchmark version “very soon” after the podcast. They anticipate “a lot more open model releases, especially from the US” (“a month or two ahead of us where everyone will just drop one open model after another”), with Chinese players also gearing up after a relatively quiet month or two. Kimi’s weights are due by Nov 4. They also expect the trends in cybersecurity to continue — more high-profile disclosures requiring mass patching, more sporadic hacks — alongside ongoing questions about whether OpenAI and Anthropic will keep releasing models and whether an IPO (unspecified) could come soon.

AI Daily Digest

AI Digest — 2026-10-25

Top items

Company & product developments

Field & industry developments

Upcoming & future developments