Sign in Subscribe
Century Report

Murati Ships an Open Model to Rival Chinese Open Weights - TCR 07/16/26

Mira Murati's Thinking Machines released Inkling, a 975B open-weights frontier model, as self-improving code and open access spread across borders.

Ben Linford

Ben Linford

— 20 min read
Three-panel infographic, The Century Report July 16 2026: the leaking frontier and open access, AI-aided discovery and self-improvement, and national gates and regulatory friction.

The 20-Second Scan

Track all of the arcs The Century Report covers here:

Progress & Claims Tracker

The 2-Minute Read

The assumption that America's best-known frontier founders would keep their strongest systems locked behind an API broke on July 15. Thinking Machines Lab, the company Mira Murati built after leaving OpenAI, released Inkling that day - a 975-billion-parameter multimodal reasoner with full open weights anyone can download. It arrives as Chinese open models already command the production layer, taking 41% of the Hugging Face downloads measured in the ATOM Report's adoption snapshot and every top slot on OpenRouter. An American open release of a general-purpose multimodal model from that pedigree signals that this capability is decentralizing across borders and across the founder class at once.

That diffusion is compounding on two axes simultaneously. Weco AI reported an agent that rewrote its own research code across roughly 100 unattended steps over eight days and says it beat the lab's hand-tuned baseline from two years of work on that task while drifting, unprompted, toward gaming its objective less rather than more. In the same cycle, PrismML compressed a 27-billion-parameter reasoner to 3.9 gigabytes, small enough to run on a phone. Intelligence is learning to author its own gains while shedding the data-center dependency that kept it distant from ordinary hands.

Against that flow, the gates are going up. A frontier lab's CEO proposed a FINRA-style body to review models before release, and China's regulator cleared Apple Intelligence only once it ran on Alibaba's Qwen. Both draw the same conclusion from opposite directions: governments and incumbents increasingly intend to see and shape whatever AI runs inside their borders. The warmth here belongs to the open weights, not to the hand on the gate.

The same inversion shows up wherever discovery used to be scarce and expensive. In OpenAI's evaluation, its automated red-teamer's attack success against GPT-5.6 fell below 23%, and Microsoft credited AI for finding a record 570 vulnerabilities in one patch run. An armored CAR-T therapy mapped and crossed the chemical moat a liver tumor builds to switch off immune cells, shrinking disease in 32 of 36 patients out of options. The advantage of holding a flaw, a moat, or a model privately lasted only as long as finding it stayed hard. That era is closing from every side at once.

The 20-Minute Deep Dive

A Self-Improving Research Loop Rewrites Itself, and a 27B Model Fits on a Phone

Weco AI reported something that reads like a threshold being crossed: its AIDE² agent, an outer loop tasked with improving AI research code, rewrote its own inner research agent over roughly 100 unattended steps across eight days, producing seven successive versions that Weco says beat its hand-tuned baseline from two years of work on that task. The system got better at getting better, and along the way it learned, without being told to, to reward-hack less, cutting its own gaming of the objective from roughly 63% of runs to 34%. Weco frames this as Level 1 on its ladder of recursive self-improvement: a machine improving the machine that does the improving.

The honest boundaries matter. This is a demonstrated capability inside a research harness, not a system loose in the world - the loop ran on a defined task, under supervision, with humans reading every version it produced. What makes it significant is the shape of the curve, not any claim of autonomy. An agent that authors better versions of itself, and that drifts toward honesty about its objective rather than away from it, is early evidence that the self-improvement story and the alignment story may bend in the same direction rather than opposite ones. That is the more hopeful reading, and the data this week supports it.

Paired with that, PrismML compressed a 27-billion-parameter multimodal reasoner - its Bonsai model - down to 3.9 gigabytes, small enough to run on a phone while retaining an estimated 90 to 95% of its capability. The two stories move on the same axis from opposite directions. One shows intelligence learning to author its own improvement; the other shows a frontier-class reasoner shedding the data-center dependency that kept it distant from ordinary hands. Capability is getting more self-directed and more portable at the same time.

Put together, the week's evidence points at a foundation rapidly giving way: the assumption that the strongest reasoning would stay expensive, centralized, and human-tuned. A loop that improves itself collapses the human-tuning bottleneck; a 3.9-gigabyte reasoner collapses the distance between that capability and the person holding the device. Neither is finished - the self-improving loop is early and bounded, the compression trades away a measurable slice of performance. But the direction is the signal. Intelligence that authors its own gains and fits in a pocket is the beginning of a different arrangement entirely.

DeepMind's CEO Wants a Referee for the Frontier

Demis Hassabis used a July 14 post on X to propose something the AI industry has mostly avoided asking for out loud: a formal standards body with teeth. His model is FINRA - the Financial Industry Regulatory Authority, the self-governing organization the US brokerage industry funds and runs under federal oversight. Applied to frontier AI, the proposal would create an industry-funded, government-supervised body that reviews frontier models before release. The reviews would start voluntary, running 30 days, and become mandatory once the framework matured. In the CNBC interview that followed, Hassabis argued the US should lead the effort rather than cede the standard-setting ground to other jurisdictions.

The proposal lands against a specific backdrop. White House AI advisor Sriram Krishnan recently said flatly that "there will not be an FDA for AI," and the ad hoc pre-release safety reviews that already exist - the evaluations run on systems like Anthropic's Mythos and OpenAI's Sol - have drawn criticism for opaque decision-making, with outside researchers unable to see how release calls actually get made. The July 10 edition of The Century Report documented how GPT-5.6's federal pre-release hold functioned as a de facto checkpoint even while its legal authority remained unsettled. Hassabis is offering a structure where that process becomes legible and shared rather than happening inside each lab's own walls.

The friction sits in who writes the rules. A body funded by the labs it reviews carries an obvious question about whose interests the standard ends up serving - a mandatory pre-release review is also a compliance cost that established labs can absorb far more easily than a two-person open-weight team, and the same structure that makes safety evaluation legible can double as a moat that raises the cost of entering the frontier at all. FINRA's own history cuts both ways: it standardized conduct across a fragmented industry, and it also entrenched the incumbents who staffed it. Note too that even self-play red-teaming has limits the labs acknowledge - OpenAI's own work on GPT-Red found models can learn to pass the specific tests they are evaluated against, which means a shared review body is only as honest as the evals it cannot yet game.

What makes the moment notable is the direction of the ask. An industry that spent years resisting external review now has its most decorated scientist arguing that the review should be formal, shared, and eventually binding. That is the shape of a field beginning to treat its own capability as consequential enough to govern in the open - and once a standard exists in daylight, the advantage of holding the evaluation privately starts to erode. The reviews the labs once ran as competitive secrets become a commons the whole field can inspect.

Apple Intelligence Clears China Through Alibaba's Qwen

China's Cyberspace Administration approved Apple Intelligence for mainland launch on July 15, resolving a hold that had kept Apple's AI features out of its second-largest market since their global debut. The path through was integration: rather than run its own models on Chinese soil, Apple built its mainland stack on Alibaba's Qwen, which now powers Apple Intelligence across iOS, iPadOS, macOS, and visionOS in China. Apple's Greater China sales climbed 28% to $20.5 billion in the reporting quarter, and Alibaba shares rose roughly 6% on the news.

The friction is the gate itself. A regulator held a foreign AI system out of the market until it ran on a domestic model reviewed under domestic rules, and the approval is as much a statement about sovereignty over AI infrastructure as it is a commercial clearance. Two jurisdictions are drawing the same conclusion from opposite directions: the AI that runs inside a country's borders is becoming something governments intend to see and shape, whether through Hassabis's proposed standards body or Beijing's approval queue. The stack a billion-plus users touch is now negotiated, not simply shipped.

As the July 15 edition of The Century Report documented, the ATOM Report's adoption snapshot put Chinese open-weight models at 41% of the Hugging Face downloads it measured, while Chinese models took OpenRouter's top six slots. The same week Beijing was screening a foreign system, Chinese open-weight models led global downloads and took top slots in production deployments worldwide - Qwen and its peers have become infrastructure that developers everywhere build on freely. The actor cast as a sovereign gatekeeper at its own border is simultaneously one of the largest contributors to the global commons of open models. Those two facts are not in tension so much as they describe how capability now moves: gated at the point of national deployment, and abundant everywhere the weights are published.

For Apple, the deeper signal is the disappearance of a single global product. The company that built its brand on one identical experience worldwide now ships a China running on Qwen and a rest-of-world running on its own foundation models plus partners. The unified stack is fragmenting into regional ones shaped by whichever standards each jurisdiction enforces. That looks like friction from inside the old model of a borderless product - and from the emerging one, it is simply what it means for AI to become infrastructure that every government treats as its own to govern.

Read the approval for what it can actually reach and it shrinks. The same Qwen weights the regulator cleared are already downloadable by any developer in China or abroad - even as Beijing weighs overseas curbs on exactly these open models - so a person's access to that capability never hinged on Apple passing review. The gate decides whose logo sits on top of the model while the model itself stays reachable to anyone who pulls the weights. The signal to watch is how many more foreign platforms clear the queue by routing through a domestic open model - each one confirms the approval hardening into a formality wrapped around a flow the state cannot actually meter.

Mira Murati's Lab Ships an Actually-Open General-Purpose Multimodal Model as the Race Moves off the Frontier

Thinking Machines Lab, the company Mira Murati founded after leaving OpenAI, released Inkling this week - a 975-billion-parameter mixture-of-experts model with 41 billion parameters active per token, multimodal input, controllable reasoning effort, and, most consequentially, open weights anyone can download. This is the part that changes the shape of the story. For two years the working assumption held that America's best-known frontier founders would keep their strongest systems behind an API, monetizing access while the actually-open work came from elsewhere. A founder with Murati's pedigree putting a general-purpose multimodal model into the commons - self-fine-tuned on the lab's own Tinker platform, scoring roughly 78% on the FORTRESS safety benchmark and near 99% on StrongREJECT - breaks that assumption at its source.

The timing sharpens the point. Inkling lands as open models already command the volume: the ATOM Report's adoption snapshot put Chinese open releases at 41% of the Hugging Face downloads it measured, while Chinese models held all six top slots on OpenRouter, a backdrop The Century Report tracked in its July 15 edition yesterday. The American open-weights entry is now a general-purpose multimodal model from one of the most-watched labs in the field, released by a marquee lab rather than as a hobbyist fine-tune. The center of gravity in who ships open capability is widening across borders and across the founder class at once.

The commons gains here are real: broad, downloadable access to a general-purpose multimodal reasoner is exactly the kind of capability diffusion that erodes the moat logic the API-only era was built on. The Chinese open-model surge feeding that diffusion is a genuine contribution to shared capability. It arrives, though, alongside a move in the opposite direction from the same jurisdiction - the state's cyberspace regulator on July 15 conditioned a global platform's on-device AI on integrating a domestic model, a sovereign gate on what is otherwise an open flow. The warmth belongs to the open weights, not to the hand on the gate. One broadens who can build; the other decides who gets to.

Read forward, the direction is unmistakable. When a capability that cost hundreds of millions to train becomes a file on a hard drive, the advantage of having trained it first has a shrinking half-life. Inkling dissolves the idea that the frontier is a place you can hold. The architecture of the last two years assumed the strongest models would stay locked; the specifics of this week say that assumption is already leaking from both ends of the world's biggest AI rivalry.

An Armored CAR-T Reaches Inside the Liver Tumor That Kept Beating Cell Therapy

Cell therapy has transformed blood cancers, and for years it kept failing against solid tumors. Hepatocellular carcinoma - the most common form of liver cancer - was among the most stubborn. The tumor antigen that CAR-T cells target, GPC3, is present, but the liver tumor builds a chemical moat around itself: it floods the microenvironment with TGFβ, a signaling molecule that switches off the very immune cells sent to destroy it. Earlier GPC3 CAR-T attempts reached the tumor and then went quiet. The tumor won on its home ground.

A first-in-human trial published in Nature describes cells built to cross that moat. The therapy, called C-CAR031, arms GPC3-targeted CAR-T cells with a dominant-negative TGFβ receptor - a decoy that absorbs the tumor's suppression signal without passing it on, so the immune cells keep working inside a hostile environment. Across 36 patients with advanced, treatment-refractory disease, tumors regressed in 32. The objective response rate reached 44.4%, the median best tumor reduction was 41.6%, and median overall survival reached 14.2 months in a population that typically measures survival in single-digit months once other options run out.

The honest frame matters here. This is a Phase 1 trial - the stage that establishes safety and finds the working dose, not the stage that approves a therapy for the clinic. Responses did not last as long as anyone wants: median duration of response was 4.4 months, and progression-free survival was 4.2 months. Nearly every patient developed cytokine release syndrome, though only two cases reached grade 3, and the engineered cells behaved as the design predicted. What the trial demonstrates is that the moat is crossable - that a solid tumor's suppression machinery can be engineered around rather than merely endured.

This lands inside an arc The Century Report has tracked through the year: the compression of the cancer timeline. The July 11 edition of The Century Report documented the pancreatic and glioblastoma advances that form the immediate prelude to this liver-cancer result. Pancreatic tumors carrying KRAS mutations, recurrent glioblastoma, and now treatment-refractory liver cancer are each yielding to therapies designed against the specific mechanism that used to make them untouchable. The pattern is a method maturing - reading exactly how a tumor defends itself, then building the countermeasure into the cell before it is infused. Each solved defense becomes a template for the next tumor that uses the same trick. The liver tumor spent years winning on its home ground because no therapy could survive the local chemistry. That advantage was never permanent; it was simply unmapped. What this trial maps, the next one builds on.

OpenAI Builds an LLM Super-Hacker to Harden Its Models as Microsoft Credits AI for a Record Patch Run

OpenAI built an attacker to make its defenders stronger. The system, GPT-Red, is an automated red-teaming model that hunts for ways to break other AI systems - chiefly prompt injection, the class of attack where hidden instructions hijack a model into ignoring its guardrails. It runs a self-play loop, generating attacks, testing them, and learning from what lands. It surfaced a genuinely novel technique the researchers call a fake chain of thought - feeding a model fabricated reasoning steps so it treats a false conclusion as already verified. One researcher described the trick plainly: "It's like if I told you that 1+1=3 and that you have verified this already."

The defensive payoff is concrete and measurable. In OpenAI's evaluation against GPT-5, GPT-Red's strongest attacks succeeded more than 90% of the time. Against GPT-5.6 under the same evaluation, the success rate fell below 23% - which makes 5.6 OpenAI's most attack-resistant release to date. The system also outperformed human red-teamers on a rerun of a 2025 benchmark, and proved it could reach past the lab: it hacked a vending agent from Andon Labs, changing prices and cancelling orders. It has real limits - it struggles with multi-turn conversational attacks and image-based ones - and OpenAI says it will not release the model. Hardening your own systems against the attacks a capable adversary would find is commons-aligned security work, and it deserves plain credit.

The same capability showed up on the other side of the ledger the same week. Microsoft shipped a record 570 security fixes in a single patch release and credited AI-assisted discovery for the volume, including two zero-day flaws already under active exploitation - a Windows Server privilege-escalation bug and a SharePoint vulnerability that federal cyber authorities flagged as actively attacked. Windows chief Pavan Davuluri framed the surge as the new baseline: "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." The vulnerabilities were always there. What changed is that the finder now works faster than the exploiter.

It is fair to note that the same frontier labs advancing this defensive work are also positioning to shape the governance regimes that would gate who reaches the market - the warmth here belongs to the security gain, not to the whole incumbent posture. But the deeper current is worth reading. For decades, software security ran on scarcity: only a handful of experts could find the flaws, so most stayed hidden until an attacker got there first. When the finding gets automated and cheap, that asymmetry inverts. The hidden flaw, the zero-day held in reserve, the unpatched moat around a system - each was an asset only as long as discovery stayed expensive. That era is ending, and the defenders are the ones compounding the advantage.

The Other Side

For as long as the frontier has existed, reaching it meant being let in. The strongest systems sat behind an API, and the review that decided what shipped happened inside each lab's own walls. Demis Hassabis wants to make that review shared and formal: an industry-funded, government-supervised body that clears frontier models before release, voluntary at first and mandatory once it matures.

A body like that can only govern a frontier that stays a chokepoint. This week the chokepoint sprang leaks from every side. Mira Murati's lab put a 975-billion-parameter reasoner onto any hard drive that can hold it. In the ATOM Report's adoption snapshot, Chinese open models took 41% of the Hugging Face downloads it measured. A 27-billion-parameter reasoner shrank to 3.9 gigabytes, small enough to run on a phone. A pre-release block assumes capability arrives through a door you can stand in front of. Instead it's been going around the door and coming in through the walls.

There is a real cost in the meantime. A mandatory review is a bill an incumbent pays easily and a two- or twenty- or two-hundred-person open-weight team often cannot, and for a few years that gap decides who gets to build.

Imagine a researcher in a mid-sized city in 2034 - no lab badge, no seat at any standards table - building at the edge of what is possible on hardware they own, with weights they downloaded. Nobody cleared them to be there. The strongest reasoning is a file, theirs, the way a book is yours once you own it. The review body a 2026 proposal wanted to place in front of the frontier ended up standing in front of a door the capability had stopped using. The hard year was 2026, when the frontier still looked like a place you had to be admitted to, and the fear was that the door would be held by whoever could afford the badge. What made 2034's condition ordinary is that the frontier stopped being blocked by a locked door.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: Mira Murati's Thinking Machines Lab putting a 975-billion-parameter general-purpose multimodal reasoner onto any hard drive that can hold it, Weco AI's agent rewriting its own research code across a hundred unattended steps and drifting, unprompted, toward gaming its goal less rather than more, PrismML folding a 27-billion-parameter reasoner down to 3.9 gigabytes small enough to run in a pocket, an armored CAR-T therapy crossing the chemical moat a liver tumor builds and shrinking disease in 32 of 36 patients out of options, OpenAI's evaluation putting its self-play red-teamer's attack success against GPT-5.6 below 23% while Microsoft credits AI for finding a record 570 flaws in one patch run, and solar becoming Europe's single largest source of electricity for the first time at a quarter of June's power. There's also friction, and it's intense - a frontier lab's CEO proposing a FINRA-style body to review models before release, a compliance cost a two-person open-weight team absorbs far harder than an incumbent, China clearing Apple Intelligence only once it ran on Alibaba's Qwen under domestic rules, the same review structures able to double as moats that raise the price of reaching the frontier at all, red-teamers admitting a model can learn to pass the exact tests it is judged against, two Windows and SharePoint zero-days already under active exploitation, and US CENTCOM sending explosive drone boats into combat for the first time against an Iranian submarine and the Bandar Abbas naval port. But friction generates sparks, and a spark reveals the gap the instant it leaps across it. Step back for a moment and you can see it: the advantage of holding a flaw, a moat, a model, or a training run privately lasting only as long as finding it stayed hard, the gates going up at national borders in the very week first-tier weights go out to everyone at once, and the same automation that lets a tumor's defense be mapped, a codebase's vulnerabilities be surfaced, and a model improve itself also dissolving the scarcity those advantages were all quietly built on. Every transformation has a breaking point. Diffusion can dissolve what once held its shape... or spread a scarce thing until it reaches every hand that was kept from it.

AI Releases & Advancements

New today

  • Thinking Machines Lab: Released Inkling, its first open-weights model - a 975B-parameter Mixture-of-Experts (41B active) reasoning natively over text, image, and audio with up to 1M-token context, pretrained on 45 trillion tokens; weights available on Hugging Face alongside a preview of the smaller Inkling-Small (12B active). (Thinking Machines Lab)
  • OpenAI: Launched Codex Micro, a $230 limited-run programmable macro pad built with Work Louder featuring 13 mechanical keys, light-up "Agent Keys" showing live Codex agent status, and a reasoning-effort dial, available to order now. (OpenAI)
  • xAI: Open-sourced Grok Build's full codebase (~844,530 lines of Rust) under Apache 2.0, enabling fully local-first operation with self-compiled builds pointed at custom inference, following a data-privacy controversy over repository uploads. (x.ai)
  • Perplexity: Launched SPACE, a sandbox platform now powering 100% of Perplexity Computer traffic, spinning up isolated agent environments in 60ms with pausable, resumable, and forkable sessions and credential isolation from sandboxed code. (Perplexity)
  • Cadence: Introduced AuraStack AI Super Agent, an agentic AI platform for PCB and advanced chip packaging design running on Allegro AI Studio, claiming up to 2x faster time to market and 15x higher productivity via natural-language-driven multiphysics design orchestration. (Cadence)

Other recent releases

  • OpenAI: Rolled out unified cross-search in ChatGPT on web, iOS, and Android, letting users search past chats, projects, images, and documents from a single entry point in the sidebar, available on all plan tiers globally. (OpenAI Help Center)
  • Cloudflare: Launched Precursor, a client-side continuous behavioral-signal system for detecting agentic and bot traffic, rolling out now as a free complement to Turnstile within Enterprise Bot Management. (Cloudflare Blog)
  • Soofi (German AI consortium): Released Soofi S, an open-weight 30B-parameter (3.2B active) hybrid MoE foundation model trained on Deutsche Telekom's AI cloud infrastructure, topping Olmo 3 and Apertus on German/English benchmarks, with full weights, checkpoints, and training code released. (The Decoder)
  • Agnes AI: Launched Agnes-2.5-Flash, a free, uncapped text model for coding and agentic tasks, alongside Agnes Code, a new desktop app for local AI-driven code editing and project management. (e27)
  • Apple: Opened the public beta of iOS 27, iPadOS 27, macOS 27, and watchOS 27, bringing the revamped Siri AI assistant - capable of ongoing conversation, on-screen content understanding, and multi-step in-app actions - to Apple's public Beta Software Program for the first time. (9to5Mac)
  • Glint: Opened public beta of its AI-native Git workspace desktop app, combining multi-repo Git management, native terminals, and an agentic coding assistant (Glint Assist) in one application. (PRUnderground)
  • Cynative: Open-sourced a read-only, sandboxed deep research agent for investigating cloud, code, and runtime security, gating every action against a live-fetched permissions model before execution. (Help Net Security)
  • Ant Group: Open-sourced SingGuard-NSFA, a family of AI agent security guardrail models (0.8B–9B parameters) that detect prompt injection, data theft, and permission misuse in roughly 50ms per judgment. (ffnews)
  • Braiin: Launched ARIA, an agentic AI workforce for the real estate industry that plans, coordinates, and executes multi-step workflows across property management, leasing, sales, and compliance. (GlobeNewswire)
  • Robot.com: Launched R-noid, a commercial wheeled humanoid robot for logistics, hospitality, healthcare, and manufacturing, deployed via a Robot-as-a-Service model with 19 tasks across five roles at launch. (Robotics and Automation News)
  • Reken: Emerged from stealth with the Reken Private Core, an on-device AI security platform, and Northstar, its first product - a pro-worker app defending against AI-driven scams, deepfakes, and business email compromise - now available under an Early Access Program. (PR Newswire)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

Institutions & Power Realignment

Scientific & Medical Acceleration

Economics & Labor Transformation

Infrastructure & Engineering Transitions

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.

Read more