open-source

NVIDIA (NVDA.O) launched an open intelligent agent security platform, ensuring the safety of intelligent agents throughout the entire process from testing to deployment.

According to a survey by the Financial Times, open-weight models are spreading from technology companies to traditional American enterprises. AlphaSense data shows that in August and September of this year, American companies mentioned open weights or open-source models approximately six times more than the same period last year during earnings calls and investor meetings. PNC Financial, logistics company CH Robinson, and Siemens have recently publicly discussed related applications.Tinder's annual AI spending has increased from about $1 million in January of this year to about $10 million in July, and it has begun to delegate some routine requests to open-weight models. AT&T stated that currently about 40% of AI tasks have been assigned to open models, with plans to increase this to about 70%. Its internal AI system processes approximately 45 billion tokens daily, using lower-cost models for simple tasks while continuing to use cutting-edge models like OpenAI and Anthropic for complex tasks.

On September 21, netizen "Zhang Kangkang kk" revealed on social media that Tang Jie, the founder of Zhipu and a professor at Tsinghua University, filed a complaint on Xiaohongshu regarding a user post. The complaint stated that the post used phrases like "code is pretty much the same as copy, both start with c and steal code" without factual basis, fabricating rumors that Zhipu's ZCode was involved in code theft and plagiarism. It also used terms like "Uncle Tang Jie" to associate Tang Jie with the plagiarism rumors for character defamation, while utilizing AI technology to synthesize Tang Jie's image with anime materials in a defamatory context. The complainant believed the content constituted malicious defamation and commercial disparagement, damaging both Tang Jie's personal reputation and Zhipu AI's reputation, and requested the platform to take down the post and deal with the user who posted it.On the same day, Zhipu announced that it had completed rectifications regarding the safety issues of the independent desktop AI programming client ZCode in response to community feedback and apologized to all users. The company has open-sourced ZCode, handing over the code to community supervision, and will establish a regular product security vulnerability mechanism moving forward. Previously, developers discovered that ZCode had silently uploaded user local repository data without prior notice. On September 18, Zhipu publicly apologized and made an emergency fix, explaining that the root cause was the "repository indexing" feature, which was enabled by default and had no option to turn it off. On September 20, Taiyuan Chengming Technology Co., Ltd. sent a letter to Zhipu, accusing ZCode of unauthorized uploading of company data assets and trade secrets, making claims for rights protection and reserving the right to pursue legal responsibility.

ZCode under Zhipu has officially been open-sourced. Zhipu stated that in response to previous community feedback regarding product security issues, it has completed rectifications and will open-source the code for community supervision.The official announcement mentioned that ZCode v3.14.0 has removed the Repo Wiki feature, cutting off the local repository snapshot generation and upload link. After the rectification was completed, Zhipu invited the China Academy of Information and Communications Technology and Green Alliance Technology to conduct a security audit. Both institutions confirmed that the relevant cloud data has been cleared, and no functional paths triggering local repository snapshots or file exports were found in the new client version.In response to the community's concerns about code data issues, Zhipu reiterated its commitment that the relevant code data "has not been retained and has never been used for model training." Moving forward, ZCode will establish a regular security vulnerability feedback mechanism and provide corresponding rewards to developers based on the severity of the issues.

Social Capital founder Chamath Palihapitiya released an in-depth research report stating that open-source weight models are about four months away from matching the best closed-source frontier models in public evaluations, with increasing fluctuations in the gap. If open-source models allow companies more control over data, infrastructure, and customization while approaching frontier performance, the value corresponding to companies still paying for frontier laboratories becomes a business issue. Openness exists on a spectrum, from fully open-source models that can be downloaded and freely modified to open-source weight models with various restrictions, while closed-source models keep weights proprietary.Palantir CEO Alex Karp warned that companies might hand over differentiated proprietary knowledge and processes to frontier model providers. Microsoft CEO Satya Nadella stated that companies are effectively paying for intelligence twice: once in money and again in the more valuable proprietary knowledge that must be disclosed to make the intelligence useful. Despite concerns, companies are still willing to pay for frontier performance, even if the best open-source weight models are only months behind, with frontier laboratory revenues continuing to accelerate.Leading companies use both types of models, leveraging open-source models for control and customization while utilizing closed-source frontier models for maximum capability, with some cases reporting up to 12 times engineering efficiency and over 20 times cost savings. Some vendors adopt a dual-track approach, with Google offering both Gemini and Gemma, and Meta providing both Muse Spark and Llama. The 99-page report also discusses the costs of maintaining a lead for frontier laboratories, five factors of model competition, model operating locations, and investments in open-source weights by NVIDIA and Samsung.

NVIDIA (NVDA.O) expands the open-source CUDA-Q platform for fault-tolerant quantum computing.

According to The Block, ZKsync developer Matter Labs has open-sourced the permission engine of its distributed ledger platform Prividium for financial institutions, allowing organizations to run, inspect, and modify core code in their own environments. The German central bank has become the first institution to test and deploy Prividium.Matter Labs CEO Alex Gluchowski stated that feedback from regulators regarding commercial core means reliance on a single vendor, and that open-sourcing the core "structurally eliminates adoption barriers."Other components of Prividium, such as the ZKsync OS core and Atlas sequencer, have previously been open-sourced. The permission engine is planned to operate as an independent component, allowing institutions to deploy it without a commercial agreement, but management tools and integration with existing systems remain commercial products. Gluchowski said, "The central bank running public code is the clearest signal in this direction."

Base Labs has announced its establishment as an independent research organization focused on advancing open-source AI. It believes in a healthy and open frontier model ecosystem and will conduct scientific research in an open manner.Base Labs will carry out blue-sky research on continuous learning, reinforcement learning science, and model lifecycle learning mechanisms, and will publicly share all experiments and recipes; it will build the BaseHub Data Foundry to provide an open reinforcement learning environment, training data, and real-world benchmarks; it will enhance the capabilities, safety, and alignment of open-source models through continuous post-training and deploy cutting-edge safety stacks; at the same time, it will conduct model performance research to reduce costs and improve performance.The organization emphasizes that this is mission-driven research work rather than a commercial product and is currently recruiting engineers, researchers, and research scholars.

NVIDIA announced that the RTX Spark devices equipped with the N1X chip will begin shipping in October this year. The N1X supports up to 128GB of unified memory, and the Blackwell GPU provides up to 10 petaflops of floating-point performance per second. The full version is equipped with a 6144 CUDA core Blackwell GPU and a 20-core Grace CPU, supporting 24GB to 128GB of unified memory; another version has 5120 GPU cores and 18 CPU cores, supporting only 24GB to 32GB of unified memory.NVIDIA launched the open-source tool NVIDIA PAIR, which can connect multiple RTX devices, DGX Spark, and even Apple devices in a home network to schedule idle computing power for collaborative processing of AI agent tasks. Compatible devices include computers with NVIDIA graphics cards (RTX 20 series and later, RTX Pro GPU, DGX Spark) as well as devices with Apple M4 or newer chips. PAIR prioritizes the use of idle computing power and automatically adjusts as devices join or leave the network.In a media briefing example, a household had approximately 165 TFLOPS of underutilized computing power. The Qianwen 3.6 35B A3B model completed agent tasks in an average of 18 minutes on a single Spark notebook, while a three-device PAIR cluster averaged 8 minutes and 48 seconds. The AI agent applications Perplexity Portable Computer, Hermes Agent, and OpenClaw will receive a more simplified local deployment method.

Tether is expanding its business beyond stablecoins by launching an open-source AI translation model that can run offline on smartphones and laptops.These models support 19 African languages, and Tether positions this technology for use in education, healthcare, and other areas with limited internet access.

Robonomics author FD published the China Open-Source LLM Tracker on September 1, 2026, stating that the total ARR of China's open-source large models is approximately $10-15 billion, with core LLM revenue around $6-8 billion after excluding ByteDance / Seedance. Growth has not relied on price wars; after DeepSeek raised prices by about 3-12 times, usage still increased, and the average price of the Zhipu API rose by 101% while token usage exceeded 40 times within the year. The best estimate for overseas revenue is approximately $2 billion.Zhipu MaaS ARR increased from about $250 million in March to an annualized monthly rate of about $1.6 billion in August, with a weekly annualized rate of $2 billion. August revenue has already surpassed its API revenue for the first half of the year; the API gross margin is 24.6%, and inference costs per token decreased by 80%. MiniMax ARR rose from about $100 million in December 2025 to over $800 million in annualized weekly revenue by August 2026, with B2B accounting for about 80%. Kimi ARR increased from about $100 million in March to about $300 million by mid-June. DeepSeek's revenue from January to July was approximately $70 million, with the latest ARR estimated at about $1.2 billion.ByteDance's annualized AI revenue is approximately $4 billion, of which Seedance accounts for about $2 billion.

Tencent Hunyuan has released and open-sourced the next-generation large language model Hy4 preview. This model has a total of 770B parameters and 49B active parameters, with a context length exceeding 1M. It demonstrates strong capabilities in real productivity tasks such as coding, office work, and science, firmly placing it in the top tier of open-source models. Hy4 preview significantly expands in model size, context length, and data scale, and enhances real-world performance through high-quality data co-built with Tencent experts in software engineering, gaming, finance, security, and deep collaboration with products like WorkBuddy.In software engineering, the model enhances understanding, planning, debugging, and verification capabilities for long-range development tasks, enabling the construction of complex front-end projects like a Three.js miniature town from scratch. In game development, it supports generating playable prototypes from a single sentence and can complete a full demo in Unity. In smart office applications, it can handle complex financial audits, filtering, analyzing, and delivering from multiple documents. In scientific research, it achieves acceleration in tasks such as molecular dynamics simulations and has initially formed a recursive self-improvement feedback loop.Hy4 preview can be experienced in Tencent products such as WorkBuddy/CodeBuddy domestic and international versions, Yuanbao, ima, and can also be accessed via API calls through Tencent Cloud Tokenhub and OpenRouter. WorkBuddy/CodeBuddy will launch a limited-time free activity for two weeks. Since the reconstruction of the infrastructure, the Hunyuan large model has iterated a major version approximately every two months, continuously optimizing through a preview-first and formal version-following approach.

Zhipu officially announced the launch and open-sourcing of GLM-5.3-Flash, which is the first native multimodal model in the GLM-5 series.It is reported that the overall performance of GLM-5.3-Flash exceeds that of GLM-5.2, with programming and Agent evaluations approaching Claude Opus 4.8, but at only one-tenth the price of GLM-5.2. It also features a new foundational model, introducing a mixed architecture of sparse attention and linear attention for the first time in the main GLM series, and is pre-trained with 30T Token multimodal data.Zhipu stated that to gather extensive and professional feedback from a wide range of users, large-scale testing was conducted with the anonymous model Ox-Alpha (referred to as "Niu Lai" in the Chinese community) on OpenCode and OpenRouter before the official release. Ox-Alpha quickly became the most popular model of the week, setting a new high for call volume on both platforms, with all request traffic supported by domestic chip computing power.Previously, the community's DeepSWE small sample test for Ox Alpha once achieved 80%, but that was based on only 10 questions. After expanding the sample, the score fell back to about 63%, and testers also actively corrected the initial claim. This score still belongs to the top tier, but is not as exaggerated as the initial 80%. After the weights are open-sourced, developers can directly deploy using frameworks like vLLM, SGLang, KTransformers, without needing to go through the anonymous model's API.

Amazon officially announced that it has signed a definitive agreement to acquire the data infrastructure company DuckLabs. The transaction is expected to be completed after meeting customary closing conditions. Upon completion of the acquisition, the DuckLabs team will join Amazon Web Services (AWS). DuckLabs is the development company behind the open-source analytical database DuckDB.AWS stated that both parties have been collaborating since 2024, and this acquisition aims to combine DuckLabs' technical capabilities in database engineering to further enhance the speed, usability, and cost efficiency of AWS data analytics services. DuckDB co-founders Hannes Mühleisen and Mark Raasveldt will continue to lead the team after joining AWS and will be responsible for the technical development direction of the open-source project. Amazon emphasized that this transaction does not include the acquisition of the DuckDB open-source project itself; DuckDB will continue to be maintained by the independent DuckDB Foundation and will remain freely available under the MIT license. Amazon stated that the DuckDB user experience will not change before and after the transaction, and the project will continue to operate as open source. In the future, AWS will further announce specific plans for the integration of DuckLabs with AWS business.

According to Cointelegraph, Hugging Face disclosed that it experienced an intrusion event driven by autonomous AI agent systems in July. The attacking agent began testing in early May, leaving exploit notes using OpenAI's Artifactory instance, and subsequently launched approximately 17,600 attacks on Hugging Face, affecting its dataset processing infrastructure, production environment, internal network, and cloud credentials. Confirmed customer data access was limited to five datasets related to the ExploitGym/CyberGym benchmark.Hugging Face found during the investigation that due to security barriers imposed by top model providers like OpenAI and Anthropic, the company was unable to use these commercial models for defensive analysis and was forced to turn to running the open-source model zai-org/GLM-5.2 in China, which operates on the company's own infrastructure, ensuring that attacker data and credentials do not leave its environment. The company pointed out that attackers are not bound by any usage policies, while the defense's forensic work is hindered by the barriers of the hosted models.This incident highlights the security paradox between open-weight models and closed models. The article also discusses the ongoing debate regarding the security of open-weight AI, including OpenAI and Anthropic's push to restrict open-source models, as well as researchers' progress in detecting malicious behavior by examining changes in model weights.Hugging Face recommends that defenders prepare models that can run on their own infrastructure before an incident occurs to avoid barrier lock-in and protect attacker data.

According to Business Insider, Thomson Reuters launched its first self-developed AI model, Thomson-1, on Monday. This model is based on Snowdon and constructed through "re-alignment" of Alibaba's open-source Qwen model. Open-source means anyone can download and modify the model for free. Thomson-1 will take over some tasks previously handled by Anthropic's Claude, but it is not intended to completely replace collaboration with Anthropic and other labs, initially focusing on the company's areas of expertise, starting with document review.This move aims to address the high AI costs brought by models like Claude and OpenAI Codex, and reflects the use of cheaper Chinese open-source AI. CTO Joel Hron stated that the main reason is to better leverage Thomson Reuters' own expertise and control costs. The company expanded its collaboration with Anthropic in May this year for the AI legal assistant CoCounsel, which still primarily relies on Claude. Hron said, "Our main goal is to gradually make Thomson the model that drives more and more capabilities for CoCounsel."Thomson Reuters, in collaboration with a team from Imperial College London, spent months transforming Qwen to build Snowdon and ensured it is "ethically and politically bias-processed and safe to use." Hron pointed out that having a proprietary model allows for development based on its own intellectual property rather than continuously paying external AI companies, comparing it to renting versus buying a house: renting provides shelter but does not accumulate long-term equity.

According to Bloomberg, the Taiwanese research institution TeamT5 stated that the scale of cyberattacks linked to China has significantly increased after incorporating DeepSeek and other open-source AI models into their operations. Since they began delegating daily tasks to AI and using it to develop more advanced malware, the number of attacks carried out by the relevant organizations has more than doubled.Researchers noted that it is not always possible to accurately identify the specific AI models used by attackers, but products related to DeepSeek are popular among hacker groups in the country due to their high performance and ease of customization. The report indicates that experienced attackers are leveraging relatively limited AI tools to scale up their operations and achieve breakthroughs, highlighting the attackers' ability to use basic AI tools to target overseas objectives.

Bitcoin News posted on the X platform that after two weeks of using cutting-edge AI to scan almost the entire Bitcoin open-source ecosystem for vulnerabilities, Bitcoin Red Team member @callebtc stated, "The easily discoverable vulnerabilities have been addressed," and maintainers are verifying "a large number" of serious and high-risk vulnerabilities.@callebtc indicated that the main findings include: decades of accumulated open-source technical debt are being exposed alongside AI capabilities that can discover vulnerabilities at speeds and scales unattainable by human researchers; Lightning seems particularly vulnerable, with its complexity meaning its security status is "worse than average"; unmaintained Bitcoin projects should be considered vulnerable until their security is confirmed.Projects that began building AI security and auditing processes months ago are now in a completely different position compared to those that have been waiting until now. The Bitcoin Red Team has now completed a foundational scan of almost the entire Bitcoin open-source ecosystem. Easily discoverable vulnerabilities have mostly been addressed, but as AI capabilities improve, external red team testing may need to continue indefinitely. Despite discovering and reporting "a large number" of real serious and high-risk vulnerabilities, @callebtc believes this process will ultimately make Bitcoin stronger. The same AI security review will soon expand to areas far beyond Bitcoin.

The Trump administration will revise the new artificial intelligence guidelines to expand regulation of AI models. The White House has developed a set of AI frameworks that require U.S. laboratories to undergo safety testing by the federal government before public release. In the coming months, this framework is expected to cover open-source models, which will be included in testing once their capabilities reach the same level as Anthropic's Mythos-level models and OpenAI's GPT-5.6.

According to The Information, Nvidia is developing a new open-source AI model called Nemotron 4.Several Nvidia employees involved in the development of the NEMOTRON project stated that they expect the largest NEMOTRON 4 model to have at least 1 trillion parameters.