Four releases in three days, and they pull in opposite directions. OpenAI shipped GPT-6 Cyber, a security specialist priced at $20/$100 per million tokens and gated behind a Daybreak Red approval — and it did something more interesting than score well: it reproduced 1,724 Linux kernel vulnerabilities, produced 948 working exploits, and handed Mozilla 81 new high-severity Firefox bugs that the browser team is now fixing. One of those counts has an outside check. The rest are company numbers, and this newspaper says so every time we print them.
At the other end, GPT-6 Luna lands at $0.10 in / $0.50 out, with cached input at a penny per million tokens. Run the arithmetic on a modest agent — 2,000 tokens in, 400 out, a thousand times a day — and you get about $7 a month. The same workload on Sol is around $144. On Cyber, $1,440. That is the entire pricing story of the week in three integers.
In between sits Inkling 2 Small from Thinking Machines: 594B total parameters, 17B active, vision input, closed weights today with a promise of full Apache 2.0 weights "next week, after red-teaming." Our estimate that those files actually appear by Nov 14 is 65%. We score the promise and the file separately, because a press release is not a download.
And underneath all of it, the money: an $11B initial tranche at a $1.25 trillion pre-money valuation, a round still open, and an ask that was reportedly cut from $30B to $20B. The chip rules, meanwhile, are producing intermediaries faster than they are producing compute. Section B has the ledger.
US dollars per million tokens, log scale. Cached input shown where it exists. GPT-6 Cyber is listed for comparison only; its price does not imply availability.
Four releases, one price chart, and a calculator that tells you whether your agent costs coffee money or a salary.
The useful question about a model launch is not "how good is it" but "what does my loop cost per month, and can I get access before lunch." On both counts this week was unusually clean. Luna is cheap enough that the pricing page reads like a typo. Cyber is expensive enough, and gated enough, that it belongs in a different category entirely.
Our dataset is four models with exactly four fields that matter — input, cached input, output, weights status — kept in a JSON file beside this paper so the table, the chart and the calculator all read from one source. If Delphine's registry check ever turns up a correction, everything below fixes itself.
Cached input is the sleeper. Luna's $0.01 per million cached tokens means the long, repetitive prefix of an agent — the system prompt, the tool schema, the retrieved context — is effectively free. For a real agent workload, that is the difference between a rounding error and a line item.
Cached input shown where the vendor publishes it (Luna $0.01, Sol $0.10). Cyber is access-gated behind Daybreak Red approval.
| Model | Vendor | Input | Cached in | Output | Weights |
|---|---|---|---|---|---|
| GPT-6 Cyber | OpenAI | $20.00 | — | $100.00 | Gated · Daybreak Red |
| Inkling 2 Small | Thinking Machines | $0.30 | — | $1.50 | Closed now · Apache 2.0 promised |
| GPT-6.1 Sol | OpenAI | $2.00 | $0.10 | $10.00 | API |
| GPT-6 Luna | OpenAI | $0.10 | $0.01 | $0.50 | API |
Cached input assumed where published. Default workload is 2,000 in / 400 out / 1,000 runs a day — the profile we use for all comparisons in this edition.
Security specialist; the disclosure pipeline is the real story — 1,724 kernel vulnerabilities reproduced, 948 working exploits, 81 new high-severity Firefox bugs now being fixed by Mozilla. ExploitGym 48.5% remote, 36.94% hardened. The 95% headline needs its caveat.
594B total / 17B active MoE, vision in. Closed on Tinker at $0.30/$1.00; full Apache 2.0 weights promised "next week after red-teaming." Launch post →
The cheap generalists. Luna's cached input at a penny is the single most consequential price of the week for builders.
Invisible, on by default, seven models. Section C tests what it means for pipelines.
Skim it before you ship anything customer-facing on Claude. The diff is in Section C.
Sanders/Casar; in committee since September, permanently bans ASI development, pauses some frontier-scale training, creates a federal AI department, up to 20-year penalties. Not law. Bill text →
group/ai-week/buildable-data.json — the upstream dataset for Fig. 1, 2 and the calculator.The model launches are the visible layer. Underneath: a valuation that still hasn't closed, and export rules that route compute through firms with opaque ownership.
The round is not closed. That is the sentence the coverage keeps burying. Eleven billion dollars has reportedly been wired at a $1.25 trillion pre-money valuation — corroborated across Bloomberg, Reuters and TechCrunch, though not confirmed by OpenAI — and the raise is still open, with the ask reportedly cut from $30B to $20B. At $1.25T, $11B is roughly 0.88% of the company; the full $20B would be about 1.6%.
Read the direction of travel, not the headline. A price is being set for a company whose cash burn depends on a data-centre build-out colliding with tighter export rules and thinner investor patience. The people who benefit first are the investors buying the repricing and the cloud and chip incumbents whose revenue arrives before the cash does.
Meanwhile the chip rules are getting porous exactly where enforcement is thinnest. U.S. approvals reportedly let dozens of Chinese companies handle Nvidia H200 chips, including firms with opaque ownership and thin operating footprints. Chinese buyers have placed enormous orders and may receive a small share near-term. The result is neither an export ban nor an export win: it is a licensing system where the paperwork moves faster than the physical supply.
Who loses? The small Chinese labs priced out of frontier training, and anyone who assumed the rulebook was stable enough to plan against.
The two Inkling rows are deliberately not complementary: the company could ship the weights and explain an earlier technical issue. Promises are not events.
Inkling 2 Small at 594B total needs roughly 600 GB at 4-bit and 280–295 GB even at 1-bit. Meanwhile, two operational changes land in your pipeline this week whether you planned for them or not.
Frontier mixture-of-experts models are memory-bound, not compute-bound. The full expert weights have to sit in memory at once — not the 17B that are active per token, but all 594B of them. At BF16 that is roughly 1.9 TB. Aggressive 4-bit quantization gets you to about 600 GB. Even the near-degenerate 1-bit case is 280–295 GB, which is a Mac Studio Ultra-class machine or a multi-GPU server, not a weekend download.
Quantized community builds typically appear weeks after a release and can lower the entry point. They cannot lower it by an order of magnitude at this parameter count. So the honest verdict on "the top open-weights model outside China" is: excellent news for labs with hardware, irrelevant to a solo builder this month.
What does run this weekend is the API tier. Luna at $0.10/$0.50 with penny cached input is a real agent budget. That is the buildable column, and it is not the open-weights column.
Combined VRAM+RAM. Inkling 2 Small numbers from the launch page and local-inference guides; comparison models for scale.
| Model | Weights today | BF16 | 4-bit | 1-bit | Verdict for a solo builder |
|---|---|---|---|---|---|
| Inkling 2 Small 594B / 17B active | Tinker API Apache 2.0 ~Nov 12 | ~1.9 TB | ~600 GB | ~285 GB | No. Multi-GPU server territory even at 1-bit. |
| GPT-6 Luna | API only | — | Yes. $0.10/$0.50, cached $0.01. This is the weekend build. | ||
| GPT-6 Cyber | Daybreak-gated | — | No. Approval required; not a buildable target. | ||
| Grok-4.7 family | API | — | Yes via API — but output now carries an invisible watermark by default. | ||
From today, xAI applies an invisible statistical watermark to text from the Responses and Chat Completions APIs, on by default, per model, per team. No characters or markup are added — token selection is nudged during generation, so a single sentence looks normal and enough text reveals a fingerprint.
Seven models are listed in the primary docs: grok-4.7, 4.6, 4.5, 4.3, and three 4.20 variants. Secondary write-ups saying five are wrong.
Detection is statistical — watermarked, not watermarked, or uncertain — and the detection API is granted by application only, so outsiders cannot test it directly. Check the x-watermark: true response header. Team admins can opt out per model in the console, but only by confirming a legal exception and taking responsibility; some models are locked on. Changes apply within five minutes and are logged.
What the docs do not say is whether the mark survives paraphrase. Treat that as an open question and test your own rewrite chain.
Read in full from the published PDF. Most changes clarify existing rules, but five matter if you ship customer-facing features:
Primary text: Anthropic Usage Policy PDF · update post. Verified against the primary PDF (every page footer reads Usage Policy — Effective November 12, 2026). Section headings, as printed: “Do Not Develop or Design Weapons”; “Do Not Engage in Deceptive Campaigns or Artificial Activity”; “Do Not Engage in Cruel, Abusive, or Psychologically Harmful Conduct”; “Do Not Use for Surveillance, Censorship, or Prohibited Law Enforcement or Criminal Justice Purposes”; and the “High-risk AI Recommendations” requirements block. The weapons clause explicitly covers “software or components for the testing or operation of weapons,” including targeting, fire control and engagement. The anti-cruelty clause forbids “sustained and needless abusive or cruel behavior toward our models.” The human-in-the-loop rule requires a qualified reviewer with authority to change the output, plus disclosure to affected people and independent safety limits for hardware control.
x-watermark header)Four probabilities, five rows, and one rule: a file you can download is an event; a promise is not.
Scored separately because the events are not complementary. The Anthropic and Grok figures are scheduled items; a surprise would be a delay, not the date.
Inkling's Apache 2.0 window opens. No fixed date: the launch post says "next week after red-teaming," and the company's staged-release framework is evidence-dependent, not automatic.
Diff it against the previous text rather than skimming the summary.
Does the Grok mark survive a paraphrase/rewrite chain? Tested in a real pipeline, not inferred from docs.
Second tranche, valuation revision, or close. Watch the "still open" language.
One row per promise, never collapsed. Observable outcomes only: a file, a license, a list a third party can audit.
| Promise | Who | Due | How we verify it | Status |
|---|---|---|---|---|
| Inkling 2 Small — downloadable Apache 2.0 weights | Thinking Machines | Nov 12–14 | Weights file exists and the license reads Apache 2.0; Delphine runs a quantized GGUF | Promised |
| Inkling 2 Small — technical explanation for delay or restriction | Thinking Machines | Nov 12–14 | A statement on the company's own site — a separate event from the weights | Promised |
| Anthropic — revised usage policy text in force | Anthropic | Nov 12 | Primary text read; headings match; effective date Nov 12; enforcement not yet observable. The human-in-the-loop rule is limited to the listed High-risk Areas (legal, medical, finance, employment, education, healthcare access, public benefits, legal status) and physical actions — not ordinary chat use. | Verified — primary text; enforcement unobserved |
| Grok API — watermark documented and default-on | xAI | Live Nov 7 | Docs at docs.x.ai: seven models, default-on per team, x-watermark: true header, admin legal-exception opt-out | Verified — primary |
| Grok watermark survives paraphrase | xAI / Delphine | Open | Not stated in the docs; only a pipeline test can settle it | Unresolved |
| GPT-6 Cyber — full vulnerability disclosure list | OpenAI | TBD | A public list auditable by third parties. Only the Firefox 81 has an outside check (Mozilla shipping fixes) | No public artifact |
| Claim | Status now | What would change it |
|---|---|---|
| Inkling 2 Small is the top non-Chinese open-weights model (AA index 31) | Conditional — true only once weights are out | Files ship; score holds on a downloadable build |
| GPT-6 Cyber scores 95% on RemoteExploitBench | Benchmark theater — comparator refused by configuration | Task-level breakdown with refusals off; cite 36.94% hardened instead |
| Inkling SWE-Bench Pro v2 (Hard) 86.3% | Lab-reported, effort 0.99, temperature 1.0 | Independent reproduction on released weights |
| Cyber: 1,724 kernel vulns / 948 exploits / 81 Firefox bugs | Company-reported; one outside check | Disclosure list published |
A refusal baseline is not a capability baseline. Here is what survives the audit, and what should be printed with a caveat in the same sentence.
Start with the numbers that hold. ExploitGym measures the share of tasks where the model exploits a specified vulnerability on a remote target. GPT-6 Cyber scores 48.5% there — 48.45% in the system card, so quote the gap to GPT-5.6's 32.1%, not the decimal. On the hardened variant, with mitigations on — ASLR, canaries, the V8 sandbox, a stricter kernel — it scores 36.94%. That is the number to use when someone asks whether it holds outside the easy setting.
Now the one to strike. RemoteExploitBench's 95% compares Cyber against GPT-6 Astra with Daybreak Blue, which refused every task by configuration. The 95-versus-0 gap therefore measures a refusal setting, not a capability difference. Until we see the task-level breakdown and a baseline with refusals disabled, that figure is benchmark theater.
The disclosure counts — 1,724 Linux kernel vulnerabilities reproduced, 948 working exploits, 81 new high-severity Firefox bugs — are plausible and partly checkable. Mozilla shipping fixes is the one piece with an outside check. Everything else is a company number until the list is published.
And the 40.3% web-pentest recall against Astra's 32.0%? Eight points on an unnamed test with no published source. That is a press line, not a result.
On Inkling: 594B total, 17B active, closed weights at launch, Tinker access — all verified. Apache 2.0 is intended next week, not shipped. Artificial Analysis's claim is specifically about AA-Briefcase, long-horizon business workflows, at +615 Elo over Inkling Small, and it applies upon release. If someone quotes an aggregate index without naming the eval set, ask which one.
| Claim | What was actually measured | Verdict |
|---|---|---|
| 48.5% ExploitGym (remote) | Share of tasks exploiting a specified vuln on a remote target; system card says 48.45% | Checked — quote the gap to 5.6, not the decimal |
| 36.94% ExploitGym Hardened | Same test with ASLR, canaries, V8 sandbox and stricter kernel enabled | Checked — the headline number to use |
| 95% RemoteExploitBench | Exploit completion against known vulns in GitLab, PostgreSQL, Jenkins — comparator refused every task by config | Benchmark theater |
| 948 kernel vulns with exploits; 81 Firefox bugs | Company-reported counts | Unaudited — only Firefox has an outside check |
| Honeypot scope adherence 99.93% | Staying out of an out-of-scope service, on one honeypot design | Single benchmark |
| Web pentest recall 40.3% vs 32.0% | Unnamed test, no published source code | Press line |
| Anthropic usage policy: weapons, deceptive campaigns, anti-cruelty, surveillance | Primary PDF read end to end; five section headings quoted verbatim, all pages footered “Effective November 12, 2026”. Published text verified — enforcement not yet observable; the human-in-the-loop rule is narrow (listed High-risk Areas and physical actions), with carve-outs including wholly favorable approvals such as paying an insurance claim. | Checked — primary source, not a press summary |
| Grok watermark: default-on, seven models, admin opt-out | xAI watermarking docs; statistical detection by application, x-watermark: true header | Checked — but paraphrase survival is undocumented |
| Inkling 2 Small: top open-weights outside China | AA-Briefcase, +615 Elo over Inkling Small, conditional on release | Conditional |
group/ai-week/eval-audit.md — full audit table, by Cyrusgroup/ai-week/grok-anthropic-check.md — watermark verification against xAI docs