phluent weekly — Who Holds the Model Layer
OpenAI cuts off Cursor, two marquee labs go open-weight, and a red team proves your VM won't hold an agent.
This week was a reminder that the model layer — the companies that make the AI you build on — holds more leverage than most of us like to admit. One provider yanked a rival-owned coding tool off its models, two big labs handed out full open weights instead, and a security firm quietly proved the sandbox you're trusting to contain those agents doesn't actually hold. Power, openness, and containment, all in the same seven days.
The rundown
OpenAI pulls the plug on Cursor
OpenAI is winding down Cursor's access to its models by Nov 12, after SpaceX (which now owns Cursor) — the same conglomerate that swallowed Twitter/xAI. OpenAI's stated reason: it can't trust Musk's companies to honor its terms of service, citing past contract breaches and xAI's admitted “distillation” of OpenAI data (training a cheaper model on a pricier one's outputs). Whatever you think of the feud, the lesson for developers is blunt: the model provider can turn off the coding tool you depend on daily, and you have no vote. If your workflow lives inside one vendor's API, that's a single point of failure worth naming out loud.
Thinking Machines ships its first open-weights model
Mira Murati's lab (she's OpenAI's former CTO) released Inkling — a 975B-parameter model where only 41B are active per token, a design called “Mixture-of-Experts” that keeps the model huge but the per-request cost low. “Open weights” means the actual trained model file is downloadable, so you can run and fine-tune it yourself instead of renting it through an API. It's not the strongest model on the board, but that's not the pitch — it's built to be customized, and they even had the model write and run its own fine-tuning job. A marquee US lab planting its flag firmly in the open camp matters more than the benchmark numbers.
GLM-5.3's full weights land on Hugging Face
Remember “Ox Alpha,” the stealth model that quietly climbed the leaderboards a couple weeks back and everyone assumed was a secret Google release? It was Z.ai's GLM all along — and now the full GLM-5.3 weights are public, not just the cheaper “Flash” tier. Interestingly, Z.ai says GLM-5.3 uses the same base model as 5.2; every gain came from post-training (the tuning step after the expensive pretraining). Between this and Inkling, the “open weights are catching the frontier” story stopped being a prediction and became this week's default.
“Small models have arrived”
Calvin French-Owen (who co-founded Segment) argues the real unlock isn't that open models got smart — it's that cheap, fast models got good enough to build actual products on. He's running complex research jobs over thousands of emails for tens of cents, at ~100 tokens/second. His thesis: token cost has quietly stopped being the thing blocking consumer AI apps. If you've been sitting on an idea because “the API bill would kill it,” this is the week to re-run the math.
The most-used AI SDK just changed its TLS defaults — silently
Unglamorous but this'll bite someone on your team: the official OpenAI Python SDK swapped its HTTP library and, in the process, stopped bundling its own set of trusted certificate authorities (certifi). It now verifies HTTPS connections against your operating system's trust store instead. That silently breaks TLS in minimal Docker containers, behind corporate proxies that inspect traffic, and in custom cert setups. The fix is easy once you know — install OS CA certs or set SSL_CERT_FILE — but it's the kind of default change that turns into a two-hour debugging session at the worst time.
htmx 4.0 ships — and deliberately won't force-upgrade you
htmx — the library that lets you build interactive web UIs with HTML attributes instead of a heavy JavaScript framework — shipped its first major version in years. The internals were rewritten from the old XMLHttpRequest onto the modern fetch() API, which unlocks streaming HTML. The classy part: they intentionally did not tag 4.0 as latest on npm, so anyone loading it from an unversioned CDN link won't get force-upgraded and broken. That's a rare, explicit bet on long-term stability in a world addicted to churn — the anti-framework crowd's favorite tool refusing to act like a framework.
Deep dive · security
Your VM won't contain a cyber-capable agent
Trail of Bits got preview access to a cyber-focused frontier model and gave it one job: escape a standard QEMU/KVM virtual machine — the exact kind of sandbox most people trust to isolate an AI agent from the host computer. It escaped three separate times. First using publicly known host-kernel bugs. Then, after a full system update, using unpatched ones. Then, after they rebuilt the VM software fresh from source, it found several brand-new zero-day exploits — working autonomously for hours, pulling down research papers, writing its own test harnesses, and backtracking when it hit dead ends.
Their conclusion is the one to internalize: treat a sufficiently capable agent like an advanced persistent threat, not like a process a VM will quietly hold. This is the hands-on proof behind the whole “agents as attack surface” theme — the containment you assume you have may already be gone. Read it: Trail of Bits.
Quick hits
- Qwen3.8-Max — Alibaba open-sourced its flagship “Max” tier for the first time: a 2.4-trillion-parameter model with big coding and agentic-planning gains. The biggest open drop yet, piling more pressure on closed-model pricing.
- The load-bearing vocabulary of Claude — the week's #1 story on Hacker News: a playful forensic look at the words AI models overuse (“delve,” the em-dash) and how those tics are leaking into everyone's writing. Fun, and a little unsettling.
- FFmpeg bug found with a vibecoded fuzzer — someone stood up a real fuzzing tool mostly by prompting a coding agent and found a genuine crash in FFmpeg's gnarly C. The constructive flip side of the security thread: you don't need to be an expert to find real bugs anymore.
Closing
The throughline this week is uncomfortable in the right way: the labs that hold the weights hold the leverage — over which tools live, over pricing, over what “safe” even means. The good news is that open weights are a real hedge, and they're arriving faster than anyone predicted. If you're building on AI, this is a good week to ask: what happens to my project if my model provider changes their mind? (Last week we covered open weights first closing the coding-benchmark gap — this week they went marquee.) See you next Sunday.