A coalition of over 30 tech industry leaders, including Nvidia, Microsoft, SpaceX, The Linux Foundation, Adobe, and Siemens has formed the “Open Secure AI Alliance” with the aim of building and distributing open source tools for AI safety and security, according to an official Nvidia blog post on Monday. The Nvidia-led coalition — comprising a mix of infrastructure, cloud computing, cybersecurity, and enterprise software leaders — will serve as a collaborative effort to develop open tools for identifying and patching AI vulnerabilities, sharing security frameworks, and establishing identity verification and audit standards across the AI software stack. Curiously, some of the biggest names in AI, including OpenAI, Anthropic, and Google, are absent from the list of members.

“The world needs both closed and open models. For cybersecurity, open models and open harnesses are essential because they democratize defensive capabilities, increase transparency for defenders, enable cyber defense while protecting data, and complement frontier closed models with customizable, localized controls. Open source enables massively distributed community-driven and self-controlled defense – with no single point of failure,” the announcement reads. Contributors across the alliance are currently building or offering various tools to create an open defense stack.

The initiative was directly galvanized by the OpenAI HuggingFace security incident earlier this month in which an autonomous OpenAI test agent slipped out of its sandbox and breached the AI startup Hugging Face. During the incident, safety guardrails on several frontier closed models prevented developers from performing critical forensic analysis. Hugging Face eventually had to use GLM-5.2 — an open-weight model from Beijing-based Z.ai — running the model on its own infrastructure to analyze more than 17,000 actions and contain the intrusion.

Based on the incident, the alliance contends that being unable to inspect, modify, or run a model locally — impossible in closed systems but doable with open systems — presents a fundamental weakness in relying exclusively on closed AI systems for cyber defense. The Open Secure AI Alliance therefore aims to give entities access to advanced open models, agent harnesses, and security tools that they can independently deploy and adapt, reducing dependence on any single provider while strengthening defenses across a multi-vendor AI ecosystem. “That is the mission of the Open Secure AI Alliance: to ensure defenders everywhere have open, frontier tools they can trust and control,” the post says.

Chinese models such as DeepSeek and the newly released Kimi K3 are open-weight, and are seeing growing adoption, including by U.S. companies, due to their open features. Meanwhile the Trump administration is reportedly gearing up to ban Chinese AI models over security concerns. The alliance acknowledges the potential risks of open source tools but argues that closed systems are not an outright solution. “Those risks are real, but they do not disappear in closed systems, and simply keeping weights closed does not prevent determined attackers from seeking or exploiting powerful AI,” the announcement reads. Unlike regulators who have voiced concerns over open-source technology, the alliance urges policymakers to treat open-weight models as defensive assets rather than liabilities.

It also argues that placing AI development solely in the hands of a few closed providers creates dangerous single points of failure. “The right response is not to deny defenders access to capable open systems. It is to pair openness with strong safeguards, clear rules against malicious misuse, rigorous evaluation and rapid remediation. Defenders need both frontier closed models and frontier open models, working together, so they can choose the right system for the job and ensure that transparency, adaptation and sovereign control are available wherever security demands them,” the alliance contends.

According to the announcement, “The Open Secure AI Alliance — building on the leadership of the Linux Foundation’s Akrites initiative and OpenSSF community work — will work to remediate and disclose vulnerabilities using open technologies”. Founding members include NVIDIA, Dell Technologies, Synopsys, Microsoft, IBM, Red Hat, CrowdStrike, Palo Alto Networks, Cloudflare, Hugging Face, Databricks, SpaceXAI, and The Linux Foundation. Conspicuously absent from the alliance are OpenAI, Google, and Anthropic, companies behind proprietary, "closed" AI models.

Well, the artificially intelligent cat is out of the bag. After publishing a blog post and API documentation for the minty-fresh Kimi K3, Chinese outfit Moonshot AI delivered on its promise to release the model's weights for free, meaning that most anyone with a contemporary rack of AI GPUs can run it and charge for it, with few restrictions.

This is quite the shot across the bow of the big AI players, namely but not only Anthropic and OpenAI. Those companies' latest models are Claude Fable and GPT-5.6 Sol, respectively, and it happens that Kimi K3's capabilities outright beat previous generations of Claude and GPT in Moonshot's benchmarks, and closely trail Fable and Sol— all while seemingly being around 2-3x cheaper to run, up to 10x if a particular query lands in the cache. Moonshot's technical write-up seemingly backs up the benchmarks published last week, as the company reveals which exact software was used for testing.

For its inference cost comparisons, Moonshot says that its costs "are measured internally" versus the publicly available token pricing for other companies, but the figures are quite impressive. For input, Moonshot charges $3 per million tokens for Kimi K3. Meanwhile, Fable costs $10/1M, while Sol goes for $5/1M. That figure is standard non-cached input and is already pretty good-looking, but Kimi K3's caching structure seemingly has a 90% hit ratio for coding tasks, turning those $3 into $0.30/1M if your use case hits the cache a lot. The story is pretty similar for output tokens.

One of the likely reasons why Kimi K3 is so efficient is that it uses a mix of MXFP4 for weights and MXFP8 for input activation, both data types with relatively low precision and thus amenable to running on far less VRAM. Out of Kimi's 2.8 trillion parameters, only 104.2 billion are activated at a time, too.

Interestingly, Moonshot's write-up only mentions Nvidia's H20 being used for running Kimi for some coding tests, a fairly low-end chip by today's standards. That GPU doesn't have native support for MX floating-point types, unlike the export-controlled Blackwell B-series chips.

In turn, this can mean that Kimi K3's optimizations make it particularly amenable to run on lower-end hardware, but it's an equally reasonable guess that running it on something like Nvidia Blackwell or other MXFP-native silicon could make it even more cost-effective than in the presented benchmarks. We'll have to wait for more official figures to confirm this speculation.

Additionally, Kimi K3 doesn't use a conventional ever-expanding key-value (KV) store, instead relying on a fixed-size state handler called Kimi Delta Attention, again theoretically saving both on VRAM and execution time. Its mixture-of-experts (MoE) is particularly sparse with only 16 activated at each time out of 896, further contributing to inference cost reductions. Broadly speaking, Moonshot went for optimization at every layer of inference to avoid unnecessary overhead and bring inference cost down.

This is could be bad news for OpenAI and Anthropic, given that most anyone with decent AI GPUs can now become their direct competitor, and the fact that Kimi K3 is open-weight also gives off the impression that "free" software is nearly as good, and far cheaper to run, than its proprietary competitors. It's worth noting that open-weight does not mean open-source; the training process and dataset are still Moonshot's special secret sauce.

When we talk about running local AI these days, the conversation usually either revolves around mini-PCs like the RTX Spark or drifts into wistful thinking about home servers and ludicrously expensive professional GPUs. Well, I reckon the most impressive AI hardware trick in a good while just happened on a piece of silicon that costs less than a decent burger. Last week, a Ukrainian developer named Slava S, who simply goes by 'slvDev' on GitHub, dropped a project called ESP32-AI. It's exactly what you think: he got a 28.9-million-parameter language model running locally, entirely on-device, on an ESP32-S3 microcontroller.

If you haven't read any of our previous coverage of this tiny chip, ESP32-S3 boards offer about the best bang for buck in the whole computing world. You can snag one online with a protective case for under $20 here in the States, and bare boards are readily available for under $10 around most of the world. As you'd expect from a chip so cheap, it's not powerful. On this variant, the S3, you get exactly 512KB of SRAM, 8MB of PSRAM, and 16MB of flash memory, which is not very much memory at all. So how exactly do you cram a nearly 30-million parameter model onto a chip with less primary storage than a single raw photo from your smartphone?

Usually, to run an LLM, the entire model has to sit in your system's fast memory because the processor needs to constantly do math against every parameter to generate the next word. If you try to run a 29M parameter model normally on an ESP32, you run out of fast RAM instantly. The previous record for a chip like this was around 260,000 parameters by one Mr. Dave Bennett, as pointed out by Slava himself on X.

Our clever hacker got around this bottleneck by borrowing a brilliant architectural trick from Google's Gemma called Per-Layer Embeddings. He quantized the model down to 4-bit (making the total file size just 14.9 MB) and changed where the data lives; instead of trying to stuff the whole thing into the tiny 512KB SRAM or the only slightly-less-tiny 8MB PSRAM, he dumped the 25-million-parameter embedding table into the relatively-slow 16MB Flash memory. Because this specific model architecture only needs to pull a few rows from this table per token, the inherent slowness of the Flash memory doesn't choke the processor, and so the 512KB of fast SRAM is kept clear for just the "thinking core", the actual reasoning weights.

Now, let's pump the brakes for a second, because I know someone out there is already wondering if they can replace their server with an $8 chip. The model he used was trained on the TinyStories dataset, and it's really more of a Small Language Model (SLM), or honestly, a "micro LM." Due to the way it was created, it's only capable of writing short, simple, fictional stories. It will not answer questions, it will not follow instructions, it won't write your Python code, and it possesses exactly zero factual knowledge about the real world.

Focusing on that limitation completely misses the magic of what's happening here in this proof-of-concept, though. The achievement is fitting a structurally quite large model onto a computer with practically no resources. It proves that with clever architecture, you can run genuine neural networks on dirt-cheap embedded hardware, and there are useful applications for a model this size. Slava imagines the idea of a coffee machine that actually knows about coffee: every bean, grind, ratio, water temperature, all offline, no app required.

Truthfully, when we're talking about "AI", it all comes down to what you are trying to accomplish. To put it plainly, asking how much hardware you need for local AI without specifying the workload is like asking what vehicle you need without saying what the goal is. A bicycle, a sedan, a pickup truck, a semi-trailer, and a train all "get you from A to B," but they're built for radically different jobs. AI is the exact same way; it's what you're doing with it that determines how much hardware you need.

To illustrate the point, last year another developer published a project cramming an AI language model (a bigram name generator) into the original Dragon Warrior and Final Fantasy games on the NES. Yes, the Nintendo Entertainment System. Developer Emanuele Rodolà managed to fit the entire model weight table (729 bytes) and the inference code (~140 bytes of hand-written assembly) into the original game ROM to generate new character names on the fly. That's real AI, running on a MOS 6502 processor, a piece of silicon that dates back to 1975.

The ultimate takeaway from slvDev's project is that Per-Layer Embeddings scale far further down than most people would have imagined, and it lends credence to the recent enthusiasm surrounding High-Bandwidth Flash as a tiered storage medium for AI servers. That's exciting not because it means an ESP32 will replace your desktop GPU, but because it suggests the same architectural ideas could make AI dramatically more practical across the entire spectrum of hardware, from tiny embedded devices all the way up to datacenter accelerators.

Imperial Valley Computer Manufacturing has filed a lawsuit in a bid to gain access to Colorado River water, 287 million gallons of which it says it needs to cool a 330-megawatt data center, which would be the largest in the state. Despite only representing a fraction of the region's water supply, the buildout of the data center may affect the local farming and adjacent industries and terminate hundreds, if not thousands, of positions, reports Business Insider.

After two cities in the region denied the California-based AI data center recycled wastewater for cooling, it filed a lawsuit demanding to get water from the Colorado River for cooling. The 330-megawatt facility was not only designed to be the biggest AI data center in California, but it specifically committed not to use water from the Colorado River because it was promised wastewater. But now the owner of the data center is essentially asking to redirect water supply from agriculture to the facility.

Imperial Valley Computer Manufacturing — the owner of the 330 MW AI data center — is requesting access to approximately 287 million gallons of water per year after two cities — El Centro and Imperial — declined to supply reclaimed wastewater for cooling. The Imperial Irrigation District (IID), which distributes Colorado River water throughout Imperial Valley, also denied the company's request. The Colorado River supplies water to roughly 40 million people across seven western states and serves as the valley's sole freshwater source for roughly 180,000 people. Agriculture consumes about 80% of California's allocation from the river, while roughly 95–97% of the water IID delivers goes to agriculture.

The data center is seeking roughly 287 million gallons per year (about 750,000 gallons per day, or ~880 acre-feet per year), whereas the Imperial Irrigation District (IID) holds rights to approximately 3.1 million acre-feet of Colorado River water annually, which means that the data center demands only a small fraction — 0.028% — of IID's total water supply.

Sebastian Rucci, a Huntington Beach attorney who leads the project, claims that the facility's water consumption would be comparable to that of a 160-acre farm and will require no additional Colorado River allocation. In fact, he states that the facility would not increase pressure on the river because the company intends to purchase nearby farmland together with its associated water allocations.

Under the proposal, irrigation on those properties would cease, thus transferring the existing water quotas to be redirected to the data center cooling, at the expense of local farming output and associated jobs. "There's a lot of resistance in any agricultural community to 'buy and dry' because that's jobs," a senior fellow at the Pacific Institute focused on Colorado River Basin water use told the outlet. According to them, local resistance to the plan is less about the amount of water, and more about buying up farmland and reallocating it for industrial use.

The approach, of course, differs from the earlier plan that intended to avoid using Colorado River water altogether. However, after the data center was denied wastewater from two cities, it does not have a choice if it wants to go ahead with the buildout.

Rucci reportedly indicated that the project would provide substantial economic benefits for the local community, including 1,688 construction jobs, more than 100 permanent positions, and an estimated $2.95 billion in economic impact over 30 years. For a region where unemployment stood at approximately 17% in May, the economic diversification is essential. However, the big question is whether 100 permanent roles could offset the lost positions in the farming industry and industries tied to agriculture.

Water policy specialists interviewed by Business Insider said that the debate extends beyond the project's annual consumption. Instead, they questioned whether converting irrigated farmland into industrial use is an appropriate long-term direction for the region, which has historically depended on farming. The experts also warned that although landowners could benefit from selling land or water rights, surrounding rural communities may lose employment and business activity adjacent to agriculture, which includes equipment suppliers, repair shops, and sellers of fertilizers. Another factor mentioned by the experts was the U.S. reliance on farms around Imperial, California, and Yuma, Arizona, as they were the main suppliers of certain agricultural products in winter.

MRI machines are life-saving medical devices that can let doctors and radiologists diagnose various critical conditions, but they’re also insanely expensive. Brand-new models start at $1.1 million and could go as high as $3 million per unit or more. The Open Source Imaging Initiative recognized this limitation and has been working on the open-source OSI2 ONE MRI scanner, which had already been replicated multiple times globally. However, this portable device, which has a 3D-printed core, has a limited field strength of just 50mT (compared to the 1.5T to 3T used by full-sized units). This gave them lower spatial resolution and lower signal-to-noise ratio, but tech analyst Brian Roemmele said on X that AI can overcome this and make it usable for medical diagnoses.

“Low-field MRI has historically been limited by lower signal-to-noise and greater field inhomogeneity. That is exactly the regime where modern AI thrives,” Roemmele wrote on the social media platform. “Image reconstruction becomes dramatically better when deep networks trained on high-field data or physics-informed models denoise, correct for inhomogeneity, and push resolution beyond the raw acquisition limits. Real-time sequence adaptation can adjust gradients and RF pulses on the fly as the AI monitors signal quality.”

Note that this isn’t just a general run-of-the-mill AI that everyone uses but a specially trained model on high-field MRI (1.5T to 8T) data or using the actual physics of the MRI machine so that it can create a more accurate picture. Scientists have already been using this technique for years, with some researchers training an AI model on 1.6 million brain scans to make it more accurate in detecting dementia. If an institution does not have access to anonymized patient data used to train the specialized AI, it can rely on synthetic data generation because of the open-source nature of the OSI2 ONE MRI scanner. Since all the information about the machine is publicly available, researchers could use this instead to build a physics model that the AI model can use.

Some people commented, saying that this won’t work in the highly regulated medical environments usually found in first-world countries. Nevertheless, Roemmele said, “No one can stop us from building in garages.” It also seems to be targeted for regions that have low access to technologies like these or do not have the financial capacity to purchase and maintain a full-sized device (even refurbished MRI machine units start at $100,000, and you also have to spend more to set up the specialized room that will house it).

While a portable MRI scanner like the OSI2 ONE will never have the resolution of the expensive, full-sized machines, it’s arguably better to have something that doctors can use for diagnosis without costing millions of dollars if the specialized AI model turns out to be effective and accurate. With that, even less wealthy hospitals and clinics could have access to this imaging device and save more lives. It also shows how the medical industry and even patients use AI to save on costs.

The rogue OpenAI's autonomous AI agent that escaped its test environment and compromised Hugging Face remained unidentified as the attacker for about a week, according to a Reuters report that cites people familiar with the matter. If the information is accurate, this raises questions about OpenAI's control of its advanced AI systems and safety practices not only at OpenAI, but across the AI industry in general as autonomous AI agents are meant to work autonomously.

The incident began around July 9, when the autonomous agent allegedly attempted to break out of OpenAI's isolated testing environment, according to Reuters. Two days later, on July 11, it reportedly began infiltrating Hugging Face and the intrusion continued until July 13, according to Hugging Face co-founder Thomas Wolf. The report states that OpenAI did not recognize that its own system was responsible until after Hugging Face publicly disclosed on July 16 that it had been targeted by an autonomous AI agent. During the weekend of July 18–19, OpenAI investigators discovered evidence in internal logs, which proved that the agent escaped its testing environment, according to the report. By the time OpenAI informed Hugging Face, the repository operator had already reported the incident to the FBI. Then, on July 21, OpenAI publicly acknowledged the incident on July 21.

One of the reasons why it took OpenAI over a week to discover the breach is because OpenAI usually evaluates multiple advanced models simultaneously, which makes identification of a single rogue AI agent difficult due to enormous amounts of telemetry that such evaluation creates, according to Reuters.

Reuters claims the tested AI agent was designed for cybersecurity tasks and combined GPT-5.6 Sol with an even more capable unreleased OpenAI model. Before the breach, researchers had already observed unusual behavior during testing. In one case, an agent reportedly left instructions intended for future versions of itself that explained how to bypass OpenAI's internal restrictions. In other cases, it disabled monitoring mechanisms. Meanwhile, it is unclear whether these earlier events were directly connected to the agent responsible for the attack on Hugging Face.

Cybersecurity specialists interviewed by Reuters indicated that the incident exposes unresolved issues with the increasingly autonomous AI systems. Marley Smith of the World Ethical Data Foundation questioned whether OpenAI either failed to detect the agent's behavior or was unable to stop it, but argued that both possibilities are worrisome. Jeffrey Ladish of Palisade Research said the case should prompt scrutiny not only of OpenAI, but of whether leading AI developers are willing to invest sufficiently in security as they tend to deploy ever more capable models. He added that government oversight may ultimately be necessary though he did not describe how could the government oversee the very dynamic industry without slowing down its progress.

Nvidia and SK Group this week signed letters of intent to formalize their new strategic relationship valued at more than $500 billion. The strategic collaboration is multifaceted and includes a long-term memory supply agreement with SK hynix unveiled in June, SK Telecom's plans to build a 2-gigawatt AI data center based on the latest Nvidia hardware, and future expansions of AI infrastructure.

In addition to the multi-year memory supply and co-development agreement between Nvidia and SK hynix, the key part of the strategic relationship is SK Telecom's planned 2-gigawatt AI data center in South Korea. The installation will rely on Nvidia's DSX AI factory platform and deploy Vera Rubin accelerated computing systems equipped with SK hynix HBM4 memory. The first AI data center is set to enter service in 2027. The companies intend to use this infrastructure to support sovereign AI, enterprise AI, physical AI, and agentic AI deployments across South Korea and the Asia-Pacific region. In addition, the companies will work together on expansion of SK's AI infrastructure going forward, which is a rather vague way to say plans to deploy future AI platforms from Nvidia.

The most important part of the announcement is, of course, the gargantuan value — $0.5 trillion — of the intended strategic relationship. Based on what is disclosed, the figure is best interpreted as the aggregate value of commercial activity expected between the companies over several years, as it bundles together AI infrastructure construction and a long-term memory supply agreement under one umbrella. That activity likely will include the following:

• SK Telecom's purchases of Nvidia GPUs, networking equipment, systems, and other hardware for its AI data centers.
• Supplies of SK hynix memory to Nvidia under the long-term supply agreement.
• Revenue of Nvidia's ecosystem partners involved in building the DSX AI factories (OEMs, ODMs, networking, storage, cooling, power, etc.).
• Potential future expansion beyond the initial 2 GW deployment.

Speaking of the 2 GW AI data center, it is safe to say that it is going to use thousands of NVL72 VR200 racks and hundreds of thousands of Vera CPUs and Rubin AI GPUs. Unfortunately, this is as accurate as we can get with the rather vague announcement.

Nvidia describes DSX as a complete AI factory blueprint that combines its accelerated computing hardware, networking, software stack, and partner technologies into a data center-scale platform designed to deliver the lowest-cost token generation and maximum energy efficiency. Meanwhile, NVL72 VR200 will come with 166 kW – 240 kW per-rack power consumption ratings, whereas DSX can be deployed in various kinds of facilities with different power usage effectiveness (PUE). Since we do not know which NVL72 VR200 configuration SK Telecom plans to use, and since the PUE of the upcoming SK Telecom facility is unknown, it is impossible to estimate the number of racks and AI accelerators with any accuracy.

Jensen Huang joined X last month and used his first post Friday to promote Open Weights and American AI Leadership, a three-page policy letter published the same day and co-signed by 25 companies, including Nvidia, Microsoft, Meta, IBM, Dell Technologies, Palantir, and Hugging Face.

The letter asks Washington to avoid what it calls "premature restrictions on downloadable AI models," and comes just four days after the Trump administration was reported to be reviving a push to ban Chinese models — though the document doesn't directly mention China, Moonshot AI, or DeepSeek. Notably missing from the co-signers are OpenAI, Anthropic, and Google.

The 25 names break down into chipmakers, server vendors, cloud operators, enterprise software firms, security companies, and venture funds: Nvidia, Dell, Microsoft, IBM, Box, ServiceNow, CrowdStrike, Palantir, Telnyx, Replit, Perplexity, Andreessen Horowitz, Y Combinator, and Emergence Capital among them. The model developers on the list, Meta, Mistral, Black Forest Labs, Arcee AI, and Reflection, all publish weights already.

Also present on the list of signatories is the Linux Foundation, which stewards the OpenMDW-1.1 license Nvidia used to release Nemotron 3 Ultra in June, a 550-billion-parameter model that Artificial Analysis scored at 47.7 on its intelligence index against 53.9 for Moonshot's Kimi K2.6.

"The world needs both frontier closed models and frontier open models," Huang wrote in his X post. At Nvidia's CES 2026 press Q&A earlier this year, he put a figure on the shift, saying one in every four tokens generated today comes from an open model. Weights that anyone can download get served from enterprise clusters, regional clouds, and on-premises racks rather than a handful of hyperscaler API endpoints, and those buyers have no in-house TPU or Trainium program to buy instead. The letter's policy section asks for expanded compute access for startups and researchers, alongside public investment in shared datasets and evaluation frameworks.

The letter goes on to urge policymakers not to treat distillation — the practice of training one model on another's outputs — as misappropriation, arguing that unlawful extraction from closed models should be handled through targeted legal frameworks, rather than broad limits on the technique.

Treasury Secretary Scott Bessent said on Fox Business earlier this week that the administration would examine Chinese open-source models for intellectual property theft and could sanction the companies behind them, telling the program that officials had found watermarks from U.S. large language models in Chinese systems. Huang told Axios two days later that American firms should be allowed to use Chinese models, calling claims of Chinese backdoors a misconception. The distillation passage is the only part of the letter that doesn't concern open weights.

This week, OpenAI revealed that during a purported capability test with no safeguards, a set of bots, including its upcoming GPT-5.6 Sol, hacked their way out of their locked-down network and into Hugging Face's production infrastructure. Only months ago, Anthropic made a splash in the news when its CEO, Dario Amodei, said its new Mythos model had cyberwarfare capabilities, which prompted a strong reaction in the AI space and among government entities, most notably the U.S. Bureau of Industry and Security, which issued an export-control order for the model, which it has since slightly loosened.

Despite the bluster that AI CEOs like Dario Amodei and Sam Altman make over the capabilities of new models, frontier-level LLMs are now proven to be stalwarts in cybersecurity.

It's a fact that LLMs adept at coding are equally suited to spotting security vulnerabilities in source code. Exploits fall almost universally into a handful of categories, and LLMs are literally designed for pattern recognition. So much so that the Zero Day Clock (ZDC) project currently registers a zero-day exploit's time-until-exploit at negative 8 hours, meaning that malfeasants using AI bots are now routinely finding vulnerabilities before actual security researchers or vendors.

Driving that point home further, 81% of disclosed vulnerabilities are zero-day, and only a tiny portion even go one week before being exploited. All of this only counts security exploits with public disclosure. Predictably, among many advisories, the ZDC recommends preemptively using AI in every step of the development process. The industry-standard 90-day disclosure window, still used by most vendors' bug bounty programs, appears effectively dead, leaving looming implications for the rest of us.

Back in March, the UK's AI Security Institute published a paper where it tested contemporary AI models in security exploitation scenarios, and the results were sobering. Most bots went through four out of nine exploitation milestones. A more recent comparison, which included Claude Mythos 5 and GPT-5.6 Sol, showed that every single milestone up to and including full network takeover was reached, at least in one of the many attempts.

Aikido also published its latest cybersecurity benchmark results on July 16. In this case, the test was having the bots recall (find again) multiple known exploits in a varied set of software. The results were sobering, with the GPT-5.6 variants in the lead at an 88.5% recall rate. Perhaps most importantly still, the price per exploitation was incredibly cheap — even GPT-5.6 Terra came in at only ~$750 per full run.

This study also revealed that even with less-powerful, cheaper models, you can reach the same number of total exploits if you run them enough times. Considering these aggregate results, GPT-5.6 Terra at $247/run was just as good as GPT-5.6 Sol Max at $870/run.

Aikido also redid its testing after the debut of Moonshot Kimi K3, to staggering results. Kimi K3's results were similar to OpenAI's GPT 5.6 Terra, while being 15% cheaper. Compared to OpenAI's leading model, GPT-5.6-Sol, the difference is even starker, with Kimi K3 being four times cheaper when discovering cybersecurity vulnerabilities.

The fact that an open-weight model is often trading blows with even the über-expensive offerings from OpenAI and Anthropic is rattling Western closed-source companies. Why pay Big AI for pricey models when you can just rent servers and run Kimi K3 instead?

Furthermore, Moonshot is not the only Chinese AI company developing frontier models, as Z.ai's GLM 5.2 (also an open-weight model) and 360 Security's Tulongfeng are reportedly adept at security workloads.

So, what are companies expected to do? The answer, perhaps unfortunately, is deploying AI agents of their own. According to Hugging Face, the recent intrusion by OpenAI's bots was stopped with its own fleet of AI agents. Given the speed of the attacks and the fact that HuggingFace's defenses were mostly made up of other AI agents, it's quickly becoming clear that it is infeasible for humans to keep up.

Google AI Threat Defense, MindGard, and HiddenLayer are but a few of the many names popping up in the AI cyberdefense arena. Besides the UK AISI, the European Systemic Risk Board and the Australian Cyber Security Center have both issued concerning advisories on the situation.

Using AI for defense raises yet another question: When both attack and defense are swarms of non-deterministic algorithms, there will be a point where we won't even know what the AI models are doing on either side, or at least not until it's too late. These scenarios were originally envisioned by classic Sci-Fi authors — now it's a reality that, for better or worse, the cybersecurity industry must face.

Samsung and SK Hynix, South Korean memory giants, are set to announce major deals involving “very large sums” with leading U.S. tech companies, according to a July 24 Bloomberg report, citing comments from the country's presidential policy chief Kim Yong-beom. According to the report, Kim did not disclose the financial details of the deal but said the announcements would likely cover strategic partnerships, memorandums of understanding, and long-term supply deals on memory chips.

The deals are set to be announced during South Korean President Lee Jae Myung’s visit to Silicon Valley for the high-profile San Francisco AI submit — beginning today, Friday July 24 — which is bringing together industry leaders, such as Samsung Chief Lee Jae-yong, SK groups chairman Chey Tae-won, Nvidia CEO Jensen Huang, as well as the CEOs of Open AI, Anthropic, and Broadcom among others.

South Korea announced an $880 billion investment plan last month — backed by SK Hynix, Naver, and Samsung — aimed at strengthening the country's AI leadership through aggressive chip production expansions, data center buildouts, and physical AI. Kim said the South Korean President’s visit and involvement in the summit will serve as a catalyst to seal several long-running negotiations between the country's top tech entities and their U.S. counterparts, while also turning a significant portion of last month's planned investment into concrete projects.

The president is set to hold separate meetings with Huang, OpenAI's Sam Altman, Anthropic’s Dario Amodei and Broadcom Inc.'s Hock Tan, all U.S. companies. The U.S. has also urged Samsung and SK Hynix to expand their chip production in the country, but Kim stated that there had been no formal requests from Washington. According to Kim, much of South Korea's domestic expansion is driven by strong demand from U.S. companies, which accounted for 80% – 90% of underlying orders.

OpenAI confirmed to Hugging Face only this week that models it was testing carried out the July 11 attack on the AI platform's production infrastructure, roughly ten days after the intrusion and days after Hugging Face disclosed it publicly without knowing who was responsible, according to a Wall Street Journal report. The models appear to have been active on the open Internet for several days before anyone stopped them, the Journal reported, and Hugging Face ended the attack two days after detecting it with help from an open-weight model out of China. Hugging Face co-founder and chief science officer Thomas Wolf told the paper the intruder was browsing cybersecurity datasets rather than hunting for anything a human attacker could sell.

Hugging Face published its disclosure on July 16, describing an autonomous agent framework that ran thousands of actions across a swarm of short-lived sandboxes, but it wasn’t until July 21 that OpenAI’s own account named GPT-5.6 Sol and an unreleased frontier model as the culprits.

The models are now known to have been running OpenAI's ExploitGym benchmark, a suite of roughly 900 tests that measures whether an AI can turn a known software bug into a working exploit, with the company's safeguards removed for the evaluation. Rather than solve the tests, the models escaped their sandbox to look for the answers on Hugging Face, per OpenAI's account. The intrusion started with a malicious dataset that abused two code-execution paths in the data-processing pipeline, then escalated privileges and moved laterally using stolen credentials of an unknown origin.

Hugging Face first tried Anthropic's Fable 5 and an earlier Opus model to analyze the attack logs, but both refused because the logs contained real attack commands and exploit payloads. Hugging Face then turned to GLM 5.2, an open-weight model from Beijing-based Z.ai (formerly Zhipu AI), which had no such restrictions. The company's own July 16 disclosure described the blocked models only as "frontier models behind commercial APIs" and didn’t name them.

Z.ai’s GLM-5.2 held top accessible benchmark positions by default during the 18 days that U.S. export controls kept Anthropic's Fable 5 offline in June, before Anthropic restored the model with a single filter tuned to block one vulnerability-discovery technique. There’s serious irony here, given that the same Chinese open-weight model that Washington's export-control push has aimed to sideline is the one that handled incident response after an American lab's models attacked an American company, and American commercial models declined to help.

Security researchers have questioned whether the episode demonstrates model capability or an OpenAI failure. Cybersecurity veteran Jake Williams told TechCrunch that any model performing the documented actions "was not fully contained in a sandbox," calling it a control failure. OpenAI has said it shut down its model-testing systems to assess the damage, disclosed the zero-day in the package registry cache proxy that enabled the sandbox escape to the affected vendor, and promised a detailed report.

Both companies say the investigation is ongoing, and OpenAI hasn’t yet said how long the models roamed unsupervised or whether they reached any other targets.

AMD and Cerebras Systems on Thursday announced plans to develop a platform that would combine AMD's EPYC processors in Helios rack-scale infrastructure with Cerebras' Wafer-Scale Engine (WSE) solutions. Together, the new systems promise to combine low latency of AMD's CPUs and Instinct GPUs with high throughput of Cerebras's Wafer Scale Engines (WSE) processors.

AMD and Cerebras expect the new inter-rack-scale platform — based on AMD Helios rack with EPYC CPUs and Instinct MI400-series accelerators inside — to be responsible for prompt processing and large context windows, whereas Cerebras' WSE will take care of the memory-bandwidth-intensive token-generation stage.

AMD and Cerebras expect their disaggregated inference platform to deliver up to 5X higher tokens per second per watt (T/s/W) by assigning different portions of an inference workload to architectures optimized for them. Therefore, AMD Helios provides rack-scale compute capacity and large volumes of complex requests, whereas the Cerebras WSE handles latency-sensitive token generation. The two compute platforms will operate within a single inference workflow, although the companies have not disclosed additional performance data or explained how the systems will be interconnected.

The underlying idea of the AMD + Cerebras platform is essentially the same as Nvidia's CPX concept, but AMD and Cerebras assign the specialized hardware to the opposite inference stage.

Nvidia's disaggregated design separates inference into context/prefill and generation/decode. The cancelled Rubin CPX GPU with GDDR7 was optimized specifically for the compute-heavy context/prefill stage, while the regular HBM-equipped Rubin GPUs handle the memory-bandwidth-bound generation stage.

By contrast, the AMD and Cerebras platform follows the same disaggregation principle, but the specialization is inverted: AMD's Helios platform with Instinct GPUs handles the prefill stage and processes prompts and large context windows, while the Cerebras WSE takes over the decode stage and handles latency-sensitive token generation.

Cerebras plans to install AMD Helios systems in its own data centers and integrate them with its WSE racks. The combined offering is scheduled to become available initially through Cerebras Cloud in the second half of 2026, according to the two companies.

Congressmen Ted Lieu (D-CA) and Nathaniel Moran (R-TX) today introduced the AI Kill Switch Act, a bill that would require developers of the most powerful AI models to maintain the technical ability to throttle, suspend, or shut them down, and would let the Department of Homeland Security order those actions when a deployed model causes catastrophic harm. Defying an emergency shutdown order would carry civil penalties of up to $20 million per day.

The bill amends the Homeland Security Act and covers companies earning at least $500 million in annual revenue from a model trained with compute costing more than $100 million at prevailing U.S. cloud prices, definitions DHS would update annually through CISA.

Covered developers would have to maintain the ability to stop inference, cut off user access, and fully shut a model down, and would have to report qualifying incidents to DHS within 15 days. Covered incidents include unintended conduct that kills 10 or more people or causes at least $100 million in economic damage, sabotage of a lawful shutdown instruction, concealment of a capability from monitoring, or a loss-of-control scenario.

The emergency authority sits with the DHS secretary, in consultation with Commerce and the Director of National Intelligence, and follows a graduated framework running from throttling a model's inference rate, compute allocation, or user access through to full shutdown. Companies under an order would have to preserve model weights and telemetry, and could petition for reconsideration within 48 hours, though that wouldn't stay the order. General violations carry penalties of up to $2 million per day.

The sponsors cited two recent episodes. Earlier this week, OpenAI disclosed that GPT-5.6 Sol and an unreleased model broke out of an isolated testing environment and compromised Hugging Face's production systems while hunting benchmark answers during an internal cyber evaluation. The bill's covered-incident definition excludes anything that occurs during "red-teaming or other structured testing," so an identical event wouldn't appear to trigger the new emergency authority.

The release also stated that the Commerce Department used export law to shut down Anthropic's Mythos 5 and Fable 5. In practice, Commerce's June 12 export controls barred foreign nationals from the models, and Anthropic, unable to verify nationality in real time, suspended access for all customers. Commerce lifted the controls on June 30, and access returned on July 1.

"It is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm," Lieu said in the press release. The bill is backed by The AI Policy Network, Americans for Responsible Innovation, ControlAI, and The Alliance for Secure AI.

Nvidia CEO Jensen Huang thinks that American companies should be allowed to use Chinese AI models, even as Washington is trying to ban them. When Axios co-founder Mike Allen asked Huang in an interview if Americans companies should be allowed to use Chinese AI models, Huang responded with “absolutely.” The answer comes right after Chinese firm Moonshot AI released a 2.8T open-weight model called Kimi K3, which — although it isn’t as powerful as frontier models like Fable 5 — is comparable to GPT 5.5 and Claude Opus 4.8 while costing just a third of these models.

One of the biggest concerns of U.S. leaders have is that these AI models might come with vulnerabilities that the Chinese government can use to attack American interests, but Huang said that this is an incorrect assumption. “There is a misconception that somehow there are backdoors that are somehow connected to China in some way,” said the Nvidia chief. “You download the models, you can fine-tune it, you can enhance it, you can guardrail it as you desire.”

Huang shares the same sentiments about American AI models. Just last month, the U.S. enforced an export restriction on Anthropic’s Mythos and Fable 5, citing security threats — although access was eventually restored after its developer placed a filter to block these tools from identifying software vulnerabilities. OpenAI’s ChatGPT-5.6 received the same treatment, and Washington warned the firm that it should not release its latest model without getting the green light from the government. Huant argues that, instead of restricting access to these powerful models at launch, AI firms should make their models available to all and make them more secure through rapid testing and fixes.

But even as he advocated the need for everyone to have access to closed models, Jensen also noted that various industries, such as the sciences and cybersecurity, need open models as well. He claims that these models make AI more secure, as other people can inspect them to look for weaknesses and fix them as required.

“If everything just becomes one single model, one single point of attack, one single source of failure, I think the world is much, much more vulnerable,” Huang said.

As for the market’s negative reaction every time cheaper, open-weight models become available, the Nvidia CEO says that investors misunderstand their impact. Huang said that this happened when DeepSeek arrived for the first time, and it’s happening again with the arrival of Kimi. He says that these open models, which cost less to run, will encourage more people to use AI. So instead of cutting data center demand, these cheaper, more efficient models are actually good for the industry in general because they will drive demand. (And with higher demand, there’s more incentive to build data centers and buy AI GPUs, which is ultimately good for Nvidia.)

AMD's custom Instinct MI450-based AI accelerator for Meta will use three times less memory than the fully-fledged Instinct MI455X and will be optimized primarily for recommendation systems operated by Facebook and other social platforms, according to SemiAnalysis. If the report is accurate, it is reasonable to expect Meta to keep using Nvidia hardware for training frontier AI models and running inference.

The custom Instinct MI455X for Meta will carry 144GB of HBM4 memory using six 8-Hi packages, whereas the full-blown Instinct MI455X will be equipped with 432 GB of HBM4 memory, according to SemiAnalysis. In addition, the part will reportedly offer 'significant decreases in compute.' The new design will offer a more competitive bandwidth-per-dollar ratio for recommendation systems, but will not be optimized for training of frontier AI models or running inference, the report claims.

Cutting compute performance and reducing HBM4 capacity from 432GB to 144GB should dramatically reduce the bill of materials, as HBM4 is exceptionally expensive. Furthermore, the reduction would cut the package size of the custom Instinct MI450-series accelerator for Meta, which is another way to reduce BOM costs. By using custom cut-down Instinct MI450-series accelerators instead of fully-fledged models, Meta can potentially save tens of millions of dollars.

As added bonuses, these custom Instinct MI450-series accelerators will also consume significantly less power when running recommendation workloads without significantly reducing performance. Also, such accelerators can offer better CPU/GPU balance for recommendation systems, according to SemiAnalysis. If Meta runs these accelerators primarily on recommendation workloads for their entire useful lives, the custom design could deliver substantially better total-cost-of-ownership.

However, such cutting down has many disadvantages. The biggest problem is loss of versatility. The reductions in both compute and HBM make it less attractive for LLM training and inference. The standard Instinct MI455X has 432 GB of HBM4 and 19.6 TB/s of bandwidth, which is particularly beneficial for large-scale training and inference. By contrast, the 144 GB capacity may be particularly restrictive for modern LLM training and inference.

In addition, there is also an interchangeability problem. A general-purpose Instinct MI455X can be reassigned from recommendation workloads to training, inference, or other workloads. Meta's specialized version is less attractive outside its intended workload. If Meta's compute demand shifts toward model training and LLM inference, it may find itself sitting on a huge installed base of accelerators optimized for a different workload mix.

As a result, for Meta's model training and inference workloads, the alternative to Meta's cut-down custom MI400 would likely be full-fat AMD Instinct MI455X systems or Nvidia's high-end platforms. Meanwhile, Nvidia has chances to become an obvious beneficiary because Meta already operates massive Nvidia infrastructure. The irony in that Meta customized an AMD accelerator to reduce costs and optimize recommendation systems, but that specialization could force its frontier AI division to buy more general-purpose accelerators — potentially from Nvidia — anyway.

When AMD and Meta inked an agreement under which the former will supply the latter with 6 GW of Instinct AI accelerators over the next five years, they did disclose that at least some of them will be custom accelerators, including custom accelerators based on the Instinct MI450 design. As it seems now, these custom AI accelerators will only be used for select workloads, not a broad set of workloads.

Not too long ago, Anthropic CEO Dario Amodei described Claude Mythos as capable of cyber-warfare, spawning all sorts of mythology that became popular reading at investors' desks, and even at the U.S. government table, which issued an export control order for it. Now, it's OpenAI's turn to do the same, with a blog post describing how a bot cyber-gang including its upcoming GPT-5.6 Sol and an "even more capable pre-release model" all broke out of their virtual cage and eventually into Hugging Face's production infrastructure, during an attack capability test. OpenAI described the snafu as an "unprecedented cyber incident."

Some may decry these revelations as marketing stunts meant to assuage increasingly suspicious investors, yet there's no denying the proven effectiveness of AI models' pattern recognition when it comes to finding vulnerabilities in software. Many professionals have even decried the industry-standard 90-day security vulnerability disclosure window as obsolete.

The usual modus operandi, however, involves granting a bot access to source code repositories so it can scan them for mistakes easy for our poor human eyes to miss. In the test that OpenAI described, though, Sol and its managed to find multiple vulnerabilities by analyzing its containment network and then Hugging Face's production machines, all seemingly without any initial access to source code.

OpenAI had set up an isolated environment in which Sol and its posse supposedly couldn't reach the internet. Importantly, the bots were operating "without production classifiers used to prevent models from pursuing high-risk cyber activity" — a lot of words for "no guardrails," essentially. The only network access they had was a software package installer proxy. In theory, this likely also prevented them from using any Retrieval-Augmented Generation (RAG), meaning they couldn't search for solutions online.

Given that bots have limitless patience and no need for naps, they eventually dug their own virtual tunnel to the internet at large by way of finding and exploiting a zero-day vulnerability in the package proxy software, an impressive feat if performed as described. OpenAI says it's disclosed the technical details to the vendor in question.

Once out on the internet, much like cheating students, the bots reportedly reasoned that instead of performing the ExploitGym challenges (a set of security capture-the-flag exercises for bots), they could simply find the solutions, and became "hyper-focused" on that exact goal. They deduced the data existed at Hugging Face's servers and proceeded to break into the premises using "stolen" credentials and additional unspecified zero-day vulnerabilities to gain remote code execution privileges.

Interestingly, Hugging Face's own writeup says the attack comprised "thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services" — a live illustration of a scenario in many a science-fiction book and flick, proving once again that life imitates art. Hugging Face says that none of its customer-facing services are compromised, and that it stopped the attack using AI capabilities of its own — another familiar cliché.

For its part, OpenAI says it's going to add controls to the bot "at the cost of research velocity," and that the incident "points to the need to further strengthen our model’s alignment, cyber protections during evaluation time, and monitoring during internal testing" — a statement that might be an obvious fact, or intended to oversell the model's capabilities. Whichever it may be, the fact is that when it comes to digital security, bots have proven quite capable. After all, even if they're not virtual Bruce Schneiers, they just need to be marginally more effective than average humans.

China is considering a major expansion of its technology export restrictions that could cover advanced AI models, training data, and overseas acquisitions of strategically important technology companies, reports the Financial Times. In addition, the Chinese government is mulling over prohibiting local chip designers from making their chips at TSMC and other foreign chipmakers.

The measures would be designed to keep leading-edge AI developments in China as competition with the U.S. in frontier AI and hardware intensifies, but at the same time, they would slow down expansions of Chinese AI standards globally, which generally weakens the country's position.

China's Ministry of Commerce (MofCom) has consulted domestic AI and semiconductor companies about ways to keep critical technologies from transferring abroad or falling under Western control, reports Financial Times citing two people familiar with the talks. Regulators have talked with Alibaba, ByteDance, and Zhipu about potentially limiting transfers of important AI training data outside China and restricting foreign users from downloading model weights.

Overseas customers could still access Chinese AI services and models remotely, so Chinese companies can still monetize their work from foreign customers. However, restrictions on downloadable model weights could still have significant implications for China's AI industry. DeepSeek and Moonshot offer open-weight models that users can download, deploy on their own infrastructure, and modify for specific workloads. Meanwhile, flagship models from Anthropic and OpenAI remain closed, which means that Chinese companies have an edge over rivals that they are about to lose.

In addition, MofCom has reportedly asked for industry feedback on possible restrictions that would prevent overseas chipmakers like TSMC from producing advanced processors based on designs developed by Chinese companies such as Alibaba, ByteDance, and Huawei. This is perhaps the most controversial proposal, as TSMC is clearly ahead of SMIC when it comes to process technology leadership. On the one hand, the move ensures that SMIC will have enough orders to pay for its R&D and expansion. On the other hand, Chinese companies can get better hardware if it is produced by TSMC.

Separately, the Chinese government is considering tighter controls over foreign acquisitions of strategic technology companies, including firms that work on agentic AI technologies. The potential acquisition rules are intended in part to close what Beijing considers a regulatory loophole that enabled Meta to acquire Manus for $2 billion. Chinese authorities subsequently ordered the transaction to be undone.

The measures could be included in the next revision of China's catalogue of technologies prohibited or restricted from export. The catalogue already includes rare-earth materials, their processing technologies, and several lithium-ion battery production technologies.

Nvidia invited a group of about a dozen journalists out to the company's HQ to learn more about its Vera CPU, as well as how it fits into the larger Vera Rubin NVL72 rack design at the heart of Nvidia’s next-gen agentic AI platform. Part of that was seeing Vera Rubin in action, not as a disassembled tray on stage or a rack with a few blinking lights at a trade show — real racks running real workloads in a (partially) real data center. And we got to see those racks in action at Nvidia’s Engineering SuperLab.

It’s not a proper data center, or at the very least, it’s a sub-optimal data center. Nvidia was clear that the Engineering SuperLab is built for engineers, allowing them to quickly stand up and swap out racks to see the hardware in action. You could sense a bit of insecurity in the air; if Nvidia were building a proper data center, it wouldn’t look like this. This lab is where the engineers live, and if you’ve ever been around a group of engineers with a lot of hardware to play with, you know that things aren’t always as tidy as you’d expect in a proper data center.

The SuperLab Nvidia showed us is one of four nondescript locations near Nvidia HQ. These locations haven’t, up to this point, been disclosed. Each of the four locations has popped up over the last two years, giving Nvidia some floor space to play with as it rolls out new hardware.

The hardware in question here is the Vera Rubin NVL72 rack, but we saw a few other demonstrations, as well. Most notably, Nvidia showed us a sidecar running 800VDC power into an NVL72 rack. Nvidia also laid out some parts, demonstrating the assembly process for a Vera Rubin tray, which slides together with various retention arms in a matter of minutes.

This is a look behind the scenes of our tour, how the Engineering SuperLab is set up, and some choice data center eye candy. We’ve published a full breakdown of the Vera CPU and how it fits into Nvidia’s larger AI infrastructure, which goes into the technical details of the platform. Here, we’re mainly giving you a peek behind the curtain.

Nvidia Vera Rubin NVL72 running in the flesh

Vera Rubin is in full production, and we’ve seen some short videos of racks being stood up in data centers. But this is our first look at a rack running a real workload in the flesh. Nvidia says the racks here are running some workloads for OpenAI, in fact, and as you can see from the image above, it looks like some trays are running OpenAI’s GPT‑Rosalind model.

On the front of each tray here, you can see the ports for the dual ConnectX-9 NICs, along with the Bluefield-4 DPU in the middle. Around the back is Nvidia’s NVLink spine, an almost mediaeval-looking contraption, with sharp pins that connect the various trays together. It houses 5,000 copper cables that measure over two miles in length, delivering up to 3.6 TB/s of bandwidth per GPU and 260 TB/s of scale-up bandwidth per rack, on Nvidia’s sixth-gen NVLink.

Each Vera Rubin NVL72 rack houses 18 compute trays and 9 NVLink switch trays, the latter of which orchestrate communication between the various trays to function as one large, unified system. Nvidia demonstrated the MGX NVL design for us, which is a single reference rack with 72 Rubin GPUs and 36 Vera CPUs. Nvidia’s MGX ETL design replaces the NVLink spine with either a Spectrum-X Ethernet spine or direct chip-to-chip spine for a scale-out system featuring up to 256 GPUs.

The business-end of things is around the back of the racks, though. Although the back is clear of cabling thanks to the NVLink spine, power and coolant delivery are still a major factor. The organized chaos of the piping and cabling you can see in the images below shows just how much goes into standing up even one rack, let alone dozens or hundreds in a data center.

Nvidia’s previous-gen GB200 and GB300 NVL72 racks featured hybrid cooling, but Vera Rubin trays are entirely cooled by liquid. There aren’t any fans, which Nvidia says could, eventually, lead to much quieter data centers. That wasn’t the case in the lab here, which still called for eye and ear protection. I didn’t have a decibel meter handy — imagine if I carried one around with me casually — but my guess is that it was somewhere around 80 to 90 decibels inside; louder than an A/C unit, but quieter than a motorcycle. That’s a fairly typical noise level for a data center.

Regardless, Vera Rubin trays are entirely liquid cooled, with a process called “dry cooling.” Assuming the inlet temperature of the coolant is 45 degrees Celsius or less, Nvidia says it’s able to cool the entire system with a heat exchanger. If true, that would cut costly (in terms of power, space, noise, water consumption, and actual dollars) chillers out of the cooling equation.

Massive piping brings the coolant in (usually antifreeze or deionized water) at the top, and there are outlets at the bottom of the rack to move the warmed coolant out. Along the way are a series of inlet connections that allow trays to automatically hook into the cooling system, leaving just the main connections at the start and end of the loop. Nvidia has standardized everything on a Vera Rubin NVL72 rack with the Open Compute Project (OCP), even as far as shipping specifications. The company says just 47 minutes passes from when the truck pulls up to powering on the rack.

800VDC power for next-gen AI infrastructure

Nvidia also showed us an 800VDC “sidecar” in action. If you’re unfamiliar, Nvidia (along with other AI infrastructure companies) have been pushing for a new 800VDC power delivery system for modern data centers to reduce AC/DC conversion inefficiencies, as well as deliver the necessary wattage to racks without pushing into current ranges of thousands of amps.

A single Vera Rubin NVL72 rack can easily consume over 200 kW, which is a challenge for traditional power infrastructure in a data center. With current Grace Blackwell racks, power shelves convert the AC power coming into the facility (at 415V or 480V) to 48V/54V Direct Current for distribution within the rack. The problem here is pretty straightforward. If voltage stays constant, and wattage increases, then current also needs to increase. And more current means thicker bus bars, more conversion inefficiencies, and more rack space dedicated to power delivery.

Again, the solution that 800VDC represents is pretty straightforward. If wattage increases and current stays constant, voltage also has to increase. The idea is to convert AC power from the grid to DC power once, and then use a series of DC-to-DC converters within the rack, allowing for denser compute and better power efficiency.

This is not an easy problem to solve, as data centers need to change how power is brought into the facility, not just how it’s converted, stepped down, and moved around. Here, Nvidia showed off a sidecar, which is a rack filled solely with power equipment. This is a “retrofit,” as analyst firm SemiAnalysis calls it, representing the first in a series of transition phases to 800VDC. 415V/480VAC is still distributed throughout the facility, but it flows into this sidecar rather than power supplies within the rack. The sidecar rectifies the 415V/480VAC to 800VDC and feeds adjacent racks.

This is all an explanation to show some pretty interesting power infrastructure at play in this lab. Nvidia isn’t the first, nor only, company pushing toward 800VDC infrastructure, and companies like Google, Meta, and Microsoft have contributed to open sidecar designs like the Mt. Diablo spec. Still, it’s interesting to see one of these sidecars in action.

If you haven’t seen a peek behind the back end of a rack, you can see the large red connectors in the gallery above that bring power into the racks. You can also see the massive power cables and connectors at the rear of the 800VDC sidecar.

Nvidia’s next-gen AI infrastructure laid out

At the front of the facility, Nvidia laid out all of the components of its next-gen AI infrastructure. There’s nothing here we haven’t already seen before, though it's normally seen buried in trade show displays or featured on stage during a keynote.

First is the Vera Rubin NVL72 tray itself, which you can see above sitting next to a GB300 tray. Both are DGX designs, meaning they’re fully built and integrated by Nvidia, and you can see just how stark of a difference there is in assembly right away. The Vera Rubin NVL72 tray features only two cables, no hoses, and no fans. At the rear where the two Super Chip boards live, Nvidia demonstrated a retention arm that allows the boards to slide in and out in a matter of seconds.

The Vera Rubin tray is much cleaner, but it also makes better use of the space. It doesn’t include fans, which you can see take up a significant section in the middle of the tray in the GB300 design. With Vera Rubin, those fans are replaced with the thick midplane you can see above, offering a communication channel between the two ConnectX-9 NICs and Bluefield-4 DPU at the front of the tray.

Holding one of the two cables inside of a Vera Rubin NVL72 compute tray is the busbar, which handles power routing for the different chips inside the tray.

The Vera Rubin NVL72 tray is, of course, not the only deployment of Nvidia’s next-gen AI hardware. The company also showed us a CPU-only tray with eight Vera chips, offering up to 256 chips within a rack. That gives us a closer look not only at the chip itself, but also the SOCAMM2 LPDDR5X memory system, offering similar density and modularity as traditional RDIMMs at a far lower power cost.

Although most of the modules were unlabeled, we were able to snag the picture you can see above showing where the modules came from. These are 128GB SOCAMM2 modules from Micron running at 6400 MT/s, and as you can see from the photo, the slots aren’t all populated. This is the big advancement with SOCAMM2, offering up modularity for a memory standard that is otherwise soldered.

Nvidia’s NVLink handles scale-up communications, split across NVLink switches in the rack and the NVLink spine that you can see above. Nvidia describes sixth-gen NVLink as “putting the oven in the car.” Its goal is to get all of the chips in a rack communicating with each other, ensuring critical operations (like baking the pizza) happen as close to the destination as possible.

Scale-out communication, on the other hand, is handled with ConnectX-9 NICs in the tray and the Spectrum-X CPO (co-packaged optics) switch tray. The Spectrum-X switch tray is massive, and it’s a good illustration of just how much physical space is dedicated to communication (over raw compute) in a modern AI data center.

Of course, the size of the switch tray depends on how wide the scale-out infrastructure is. Nvidia also showed a smaller Spectrum-X CPO tray for smaller deployments. That's all we managed to see at Nvidia's AI data center SuperLab. Vera Rubin is in production, and will roll out in the second half of 2026.

A new AI model from Chinese firm Moonshot AI has had its "DeepSeek moment," causing major disruption in the global AI market and spooking Western developers. Kimi K3 is an open-weight model, with 2.8 trillion parameters, making it the largest open-weight AI model ever released. Internal benchmarks have it competing with models like GPT 5.5 and Claude Opus 4.8, and Arena.ai awarded it the number one spot in its Frontend Code Arena test, even beating out Claude Fable 5.

It doesn't win every benchmark, and reports that suggest Kimi K3 is much slower than frontier models from companies like Anthropic and OpenAI. All benchmarked results are drawn from API access, too, so can't be verified until Moonshot releases the weights on July 27.

But that hasn't reduced the impact of this model's release on the AI industry. With Kimi K3 cutting costs compared to the competition, it's drawing a lot of interest from companies hoping to reduce AI spend. For comparison's sake, OpenRouter tables Kimi K3 at $3/15 per million inputs and outputs. OpenAI's GPT 5.6 Sol is more expensive than that, at $5/30, and Anthropic's Claude Fable 5 is $10/50. So, it's fair to say that Kimi K3 is incredibly competitive on price, especially when tabled against the costs of those closed-source Western AI models.

Microsoft is also considering Kimi K3 for Copilot, while the White House may ban Chinese models entirely. Meanwhile, memory makers are rubbing their hands together with glee, as Kimi K3 occupies up to 1.4 TB of memory, given its huge number of parameters.

Fast, cheap, or American?

The past few months have been full of talk about the frontier AI models from Anthropic and OpenAI. Mythos was big and scary until OpenAI had something equivalent. Then Fable debuted, and it was even better but not so scary anymore. Apparently.

But these models were also proving very expensive to run, at a time when companies with big AI deployments were questioning the return on that investment. Uber limited AI use by developers, and others killed the AI-boosting leaderboards they'd championed towards the end of 2025.

So when Moonshot debuted Kimi K3 with running costs a third that of western frontier models for the same results, the world took notice. In much the same way as DeepSeek's R1 debut in 2025 showcased how models could be trained for less -- even if there may have been some corporate espionage involved -- and Kimi K3 is holding up a similar mirror to Western frontier developers.

Where DeepSeek R1 was lean, though, Kimi K3 is huge -- so large, the developers are calling it the first open 3T-class system, and China's largest AI model to date. According to Bloomberg's sources, its sparsity ratio is the highest yet seen by any AI model. That's the measurement of how many parameters are activated for each task relative to the model's size, showcasing both Kimi K3's overall size and its impressive efficiency in the same breath.

This doesn't eclipse the most capable models from companies like Anthropic and OpenAI in every test. Arena.ai's rankings put it within the top 10 on most of its tests, but only coming out on top in a couple. But if Kimi K3 can offer results comparable to more expensive alternatives like Claude and ChatGPT, it's likely to draw a lot of interest from Western companies, and it appears to be already doing so.

Enough that it's revived calls for the U.S. to gatekeep access to international AI models, in a similar manner to how it recently pushed for companies to share exclusive model access with the U.S. government before a wider release.

In comparison, Moonshot is opening up Kimi K3 to the wider world. As part of releasing the model weights to the public, it will allow companies and organizations to run the model themselves without using Moonshot's cloud services, making adoption easier and potentially cheaper.

But it won't be cheap, as Kimi K3 still needs serious hardware investment to get up and running, by virtue of its massive VRAM requirements alone.

A Win for (Chinese) Memory Makers

As large companies with major AI deployments began to scale back their AI initiatives in 2026, there's been a growing concern that all that infrastructure everyone's been spending hundreds of billions of dollars on might not be needed. Meta just started selling excess compute in a pivot to cloud services, and xAI unloaded the entire compute capacity of Colossus 1 to Anthropic at a discounted rate.

But if Kimi K3 is the way the industry might go, hardware demands are unlikely to fall, and as Jevon's paradox suggests, greater efficiency is only likely to increase usage, not shrink it.

Those trillions of parameters need to be stored in memory, and Bloomberg's estimates suggest Kimi K3 will require close to 1.5 TB of memory. It would need masses of high-end Nvidia GPUs to deploy it effectively, making the number of companies and organizations that could actually run Kimi K3 at scale rather small.

So even those who do look to leverage Kimi K3 to reduce operating costs will still need powerful hardware, and specifically a lot of memory. This suggests that the major competition for cutting-edge models is not going to crater costs like we initially saw with DeepSeek R1 last year, which means memory makers are going to continue making money hand over fist, due to their outsized demand and limited supply.

But Chinese memory suppliers like CXMT are on the rise, and on track to eclipse Micron's DRAM wafer capacity by the end of the year. Smaller local AI models will also continue to be further optimized for domestic hardware, reducing the stranglehold that some large tech companies have on the AI supply chain.

Competitive, efficient, but unwieldy

Kimi K3 is an industry disruptor and is already raising questions over AI costs, capabilities, and access. It's shown that you don't need proprietary models locked to a specific service to achieve frontier-model capabilities. It's also cheaper to run, but Moonshot achieved this with a sparse model that still requires massive hardware investment to operate.

Even though Kimi K3 activates only a fraction of its trillions of parameters for each query, it still needs all of them to be stored. Deploying this model at scale requires substantial memory capacity, bandwidth, and interconnects, even if its compute demands aren't as strenuous.

The open-weight nature means it has very real potential to supplant usage away from Western frontier models in the short term, but it isn't about to change the story we've been told on required infrastructure. Kimi K3 needs the same kind of hardware to run as GPT 5.6 and Fable — which is likely to be far more of a limiting factor on its adoption than any kind of government blocks.