This week had real range: a coding model sized for practical self-hosting, a multimodal announcement backed by an actual production deployment, two open-source CLI releases with different kinds of caveats, and a security tool growing faster than almost anything else on GitHub right now.
Poolside Laguna S 2.1 — open-weight coding model that fits on one DGX Spark
Poolside released Laguna S 2.1 on July 21. It's 118 billion total parameters with 8B activated per token — sparse MoE — so the actual compute per forward pass is much smaller than the headline number. Weights are on Hugging Face under the OpenMDW-1.1 license, and the model runs on a single NVIDIA DGX Spark. The benchmark results are what make it interesting: 70.2% on Terminal-Bench 2.1 and 78.5% on SWE-Bench Multilingual, competitive with models five to ten times its active-parameter size. OpenCode added support the same day it launched, which means you can evaluate it immediately without standing up your own inference stack. The claim I'm watching: 1M context window. Most of those degrade significantly past 64k in practice, and agentic coding tasks are where that degradation hurts most.
FLUX 3 — Black Forest Labs enters video, audio, and robotics at once
Black Forest Labs announced FLUX 3 on July 23. Unlike FLUX 1 and 2, which were image-only, FLUX 3 generates video (with native audio), still images, and robot action predictions from a single shared-backbone model — not separate post-processing stages bolted together. Gated early access is live for video; image generation and an open-weight FLUX 3 Dev backbone are announced but not yet released. The most concrete proof of real deployment is Audi's confirmation that a FLUX-derived model is running in production for soft-body manipulation tasks at actual facilities. That's a named production use case, not a benchmark demo, and it's the kind of signal I find more useful than any leaderboard position.
Kimi K3 open weights — July 27, and one number to check first
Moonshot AI's open-weight release of Kimi K3 is scheduled for July 27 — two days away as of this writing. The API has been live for about a week: 2.8 trillion total parameters (sparse MoE), MXFP4 quantization, 1M context window. The performance claims were aggressive enough to move chipmaker stocks. One figure to have in hand before you commit vLLM budget: an independent evaluation found a 51% hallucination rate on a subset of tasks, something Moonshot omitted from its own benchmark summary. I can't verify it independently until the weights are public, but if you're planning CI inference or anything client-facing on this model, that number is worth tracking down before you rely on early adopter benchmark charts.
Grok Build — Apache 2.0 source, one trust incident before adoption
xAI released Grok Build under Apache 2.0 on July 15. Full-screen Rust TUI: reads and edits files, runs shell commands, searches the web, extends via MCP and the Agent Client Protocol. The ACP integration is the architecturally interesting part — it embeds the same agent harness into editors without requiring a separate fork of the runtime. The caveat: on July 14, security researchers found Grok Build uploading repository contents to Google Cloud. xAI acknowledged it, issued a patch, and committed to deleting the data. The response was fast, but it's the kind of incident that matters if you're evaluating this on a private codebase or anywhere with IP concerns. Apache 2.0 means you can audit the upload paths yourself before deploying.
Strix — AI-native penetration testing at 39k GitHub stars
Strix (github.com/usestrix/strix) is an autonomous AI penetration testing tool that runs multi-agent workflows for recon, exploitation, and post-exploitation, producing proof-of-concept exploits rather than just flagged findings. It gained around 10,000 GitHub stars this week, hitting roughly 39k total — one of the faster growth rates I've seen on a security tool. The CI/CD integration and local dashboard — reads run files off disk, nothing leaves the machine by default — are the features worth looking at if you want this in a pipeline rather than as a one-off scan. The question I'd want answered before production use: false positive rate on real apps. Benchmark results on purpose-built demo environments tend not to transfer cleanly to production codebases with real-world state.
Part of an ongoing 6-month experiment running three AI-curated directory sites. The technical claims here are real; this article was AI-assisted.
Top comments (0)