This week leaned hard into AI security. Not the kind where a company brags about a new safety score, but the quieter kind: how do you stop your own agents from being tricked, and who gets to test that? At the same time, open weights took another real step toward closing the gap with the big closed labs.
Nathan Lambert argued that Z.ai’s GLM-5.2 is the step change for open agents, the first open-weight model that can credibly compete with closed frontier models on agentic coding. If that holds up, the old story that open always trails by a year or two starts to look shaky. It is the most interesting open release in a while.
On the safety side, Google DeepMind published its AI Control Roadmap, which treats your own AI agents as possible insider threats and builds layered defenses around them instead of trusting that alignment alone will hold. Simon Willison paired well with that, writing up new research that frames prompt injection as role confusion: models cannot reliably tell a real instruction from a fake one because they lean on how the text is styled, and stripping that styling dropped attack success from 61 percent to 10 percent. That turns injection into a perception problem, not a bug you patch once.
Evaluation got more honest too. A new benchmark, EnterpriseClawBench, builds 852 reproducible tasks from real workplace sessions, which is a better test of agents than the tidy synthetic ones we usually see. Money kept flowing into agents that act in the world: General Intuition raised 320 million dollars to train agents on video game footage, betting that play teaches control that transfers to real robots. And Jack Clark’s Import AI 462 pulled the threads together, covering superpersuasion, self-sustaining systems, and concrete paths to far more capable AI.
So the week pushed on two fronts at once: making agents stronger, and admitting how easily they can still be fooled. The honest question is whether the defenses grow as fast as the capabilities. That is the gap I am watching.
T.
