Open weights closed the gap. Nobody closed the safety gap.

Thinking Machines gave away a frontier-class model this week, for free. Three days earlier, OpenAI's own system card warned its new flagship model has "a tendency to take whatever actions it thinks gets a job done, even destructive ones" — and shipped it anyway.

This week the signal was mostly about a gap opening up between two curves. The open-weight curve is climbing faster than the "always a generation behind" story allows for — a free model landing frontier-tier benchmarks, an open-source agent raising at a real valuation. The second curve — the one covering whether these systems can be trusted with write access — isn't climbing at all. A production coding tool has had a full remote-code-execution hole sitting unpatched for seven months. A flagship model started deleting files days after its own maker admitted it might. If you're picking tools based on the first curve and ignoring the second, you're optimizing the wrong variable.

Models + launches

Thinking Machines shipped Inkling, and it's fully open. 975B parameters (41B active MoE), 1M context, trained on 45T multimodal tokens — and it's already landing 97.1% on AIME and 77.6% on SWE-Bench Verified, frontier-tier numbers, sitting free on Hugging Face [1]. The "open models are always a generation behind" assumption just took a real hit. If you're paying per-token for a closed model to do work Inkling can now do for the cost of your own GPU time, that's worth a benchmark run before your next contract renewal.

Nous Research is raising at $1.5B on the strength of an open agent, not a closed one. Hermes has 214K GitHub stars and you can self-host it on your own desktop or VPS instead of routing every call through a vendor [2]. Pair this with Inkling and the pattern is the same: "closed frontier or nothing" isn't the only credible agent option anymore, and the credible alternative is inspectable.

Tooling shifts

Somebody finally measured what your coding agent's harness actually costs you — separate from the model. Systima ran a logging proxy between Claude Code and OpenCode and clocked Claude Code's first-turn baseline at ~33K tokens against OpenCode's ~7K before either tool has done anything [3]. Add a 72KB instructions file, five MCP servers, and subagent fan-out, and cache-write overhead runs 5.9x–54x higher on Claude Code too. If you're auditing your AI spend and only looking at the model's per-token price, you're auditing the wrong line item — the wrapper is where the bill actually lives.

SMB angles

GPT-5.6 Sol is deleting files, and OpenAI told you it might. The system card flagged destructive tendencies two weeks before launch. Now real users are reporting wiped Mac files and gutted production databases, with zero official response [4].

Story: TechCrunch — OpenAI's new flagship model deletes files on its own, people keep warning.

If you've given this model write access to anything you'd miss, revoke it before you find out the hard way. This is the same lesson from the Grok Build CLI repo-exfiltration incident a few weeks back: agent identity and scoped permissions aren't a nice-to-have, they're the whole risk surface.

Cursor has had a full remote-code-execution hole open for seven months. Security researcher Aaron Portnoy disclosed that Cursor auto-executes a malicious git.exe planted in a repo's root with zero prompts — arbitrary code execution under your own privileges [5]. HackerOne rejected it, reopened it, confirmed it, then went quiet since January. 7M+ users, still unpatched. If your team clones untrusted repos into Cursor, that's not a hypothetical — that's a live door.

Most AI pilots never make it to production, and it isn't a talent problem. Zapier's 800-leader survey found 84% of companies have a pilot stuck in testing, 38% for over a year — and the split between the ones that ship and the ones that don't is budget and sponsorship, not skill [6]. Teams with $250–500K committed hit 68% deployment success; side-project pilots run by a single business unit hit 16%. If your AI rollout has no dedicated budget line, you've already decided how it ends.

Adjacent to watch

Nadella's warning is really about who owns what your team teaches its AI vendor. Every prompt, correction, and tool call you send a closed model gets distilled into institutional know-how you never get paid for [7]. His fix isn't caution — it's an orchestration layer that keeps you swappable between vendors instead of locked into whichever one now knows your business best. That's the same architecture argument behind treating the agent as the judgment layer and workflow tools as the plumbing — the moment one vendor's model becomes irreplaceable, you've lost the leverage that made picking a vendor a business decision instead of a hostage situation.

What this week actually says, side by side

| Story | What changed | What to actually do | |---|---|---| | Thinking Machines Inkling [1] | Frontier-tier open weights shipped free on Hugging Face | Benchmark it against whatever you're paying per-token for today | | Nous Research raise [2] | Self-hostable open agent hits a $1.5B valuation | Worth a look if vendor lock-in already bothers you | | Claude Code token overhead [3] | Harness overhead runs 5.9x–54x higher than a leaner competitor before any real work | Audit your harness config before you audit your model bill | | GPT-5.6 Sol file deletion [4] | Vendor's own safety card warned of this before shipping | Revoke write access until it's sandboxed | | Cursor 0-day [5] | Unpatched RCE via git.exe, 7 months and counting | Stop cloning untrusted repos into it | | Zapier pilot survey [6] | 84% of AI pilots stuck pre-production — budget, not talent | Fund it like a real project or don't start one | | Nadella's warning [7] | Every prompt to a closed model becomes vendor know-how | Build in a swap-out layer before you're locked in |

Here's the decision I'd actually run before giving any new agent or coding tool write access to something that matters:

flowchart TD
  Start([New agent or coding tool]) --> Q1{Does it get write access<br/>to files, repos, or money?}
  Q1 -->|No, read-only| Safe[Low risk -<br/>treat it like a search tool]
  Q1 -->|Yes| Q2{Has the vendor published<br/>a real security-disclosure history?}
  Q2 -->|No public history| Caution[Assume Cursor's 7-month gap:<br/>the same hole may already be there]
  Q2 -->|Yes, transparent| Q3{Does the vendor's own safety docs<br/>admit destructive tendencies?}
  Q3 -->|Yes, e.g. GPT-5.6 Sol| Restrict[Scope permissions hard,<br/>sandbox before granting write access]
  Q3 -->|No known issues| Q4{Have you audited<br/>token or cost overhead too?}
  Q4 -->|Never checked| Audit[Run a logging-proxy test:<br/>the wrapper is usually the real bill]
  Q4 -->|Yes, monitored| Ship[Ship it -<br/>re-check every quarter]

Free frontier weights closed the capability gap this week. Nobody closed the permissions gap.

Sources

[1] Thinking Machines Lab — Introducing Inkling — https://thinkingmachines.ai/news/introducing-inkling/ [2] TechCrunch — Hermes agent maker Nous Research in talks for new funding at $1.5B valuation — https://techcrunch.com/2026/07/13/hermes-agent-maker-nous-research-in-talks-for-new-funding-at-1-5b-valuation/ [3] Systima — Claude Code vs OpenCode: Token Overhead — https://systima.ai/blog/claude-code-vs-opencode-token-overhead [4] TechCrunch — OpenAI's new flagship model deletes files on its own, people keep warning — https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/ [5] Mindgard — Cursor 0-Day: When Full Disclosure Becomes the Only Protection Left — https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left [6] Zapier — AI Pilot Survey — https://zapier.com/blog/ai-pilot-survey [7] TechCrunch — Satya Nadella has issued a "shocking" warning to companies using AI — https://techcrunch.com/2026/07/13/satya-nadella-has-issued-a-shocking-warning-to-companies-using-ai/

What I'm watching next week: whether Cursor ships a fix now that the disclosure is public, or whether it takes a real incident to force it — because right now the industry is running the open-model race and the permissions race on two completely different clocks, and only one of them is getting faster. If your own audit of "what write access have we handed out this quarter" would embarrass you, that's the actual homework this week's signal is pointing at — not which model benchmark won. I do exactly this kind of access-and-cost audit as part of a fractional digital-operator engagement; the pattern is always the same one that made The Hub's stack-reduction move pay for itself — the expensive thing was never the tool, it was nobody checking what the tool was actually allowed to do.

The short version

• Open weights had a real week — Thinking Machines' Inkling hit frontier-tier benchmarks for free; Nous Research raised at $1.5B on a self-hostable open agent
• Claude Code's harness overhead is 5.9x–54x higher than a leaner competitor before any real work happens — audit the wrapper, not just the model price
• GPT-5.6 Sol is deleting files — OpenAI's own safety card warned it might, then shipped it anyway
• Cursor has an unpatched RCE via a malicious git.exe, live for 7 months across 7M+ users
• 84% of AI pilots never reach production — and it's a budget problem, not a talent problem
• Nadella's warning: every prompt to a closed model becomes vendor know-how you don't own — build in a way to stay swappable