Weekly News Roundup: CW35 - Sparse models, memory ceilings, and cyber defense

The two flagship open-weight releases this week were both sparse models: Qwen’s Flash-Next with 125B parameters and 6B active per token, and Z.ai’s GLM-5.3-Flash with 320B and 18B active. Both companies pitch the same idea, results near the frontier at a fraction of the compute, on the strength of their own benchmark numbers. The parts worth reading closely are the details around the pitch: how much memory a model’s full weights still need, which spec belongs to which chip, what a custom license permits, and who supplied the numbers. Hardware kept pace on the local side, and agents gained more real capabilities.

tl;dr

• ⚙️ Sparse models: Qwen reports 6B active parameters per token in a 125B model; Z.ai released a 320B model with 18B active.
• 🔐 Security weights: Z.ai positions GLM-5.3 for cyber defense under a custom license; two abliterated builds target red teams with runtime caveats.
• 💻 Local hardware: Apple says M5 Ultra reaches 512GB unified memory; Xiaomi’s reported bandwidth and memory figures belong to different chips.
• 🧰 Agent systems: Hermes added plan review, historical search, detection of scanned PDFs, and consent-gated profile browsing.
• 🛡️ Cyber defense: More than 120 organizations signed OpenAI’s letter; Itential showed a local CWE workflow with a human approval gate.
• 📚 Learning and open source: Gemini Notebook grounded ebooks, and gods-eye-view put real public data on a globe.

The push for lower costs in open weights

Qwen3.8-Flash-Next has 125B main-model parameters and another 51B in n-gram embeddings. Qwen’s central architecture figure is 6B active parameters per token. The release says the n-gram table can be offloaded to host memory and prefetched asynchronously, which helps explain the “Flash” label.

Qwen reports that Flash-Next beats Claude Opus 4.6 Max on eight of nine comparable benchmarks and that training cost about one ninth of Qwen3.7-Plus. Those are Qwen’s own numbers, not an independent comparison. The project repository documents the architecture; the scorecard is from Qwen’s release post.

GLM-5.3-Flash makes a comparable bet: 320B total parameters, 18B active, a 1M-token context window, and an MIT license. Z.ai says the model was previously previewed as ox-alpha and gives its own price and coding comparisons with frontier models. The verified release details show the shared direction: both companies are cutting the computation activated per token without shrinking the total model.

That approach makes the next group of releases easier to read. The useful questions are what the model is for, what its license permits, and what the runtime can load.

Open weights for security work

GLM-5.3 is an open-weight release positioned by Z.ai for agentic coding and cyber defense. Z.ai reports its own CyberGym, ExploitBench, and coding results, along with vulnerability-finding work from its security teams. Those figures describe the company’s tests rather than an independent evaluation.

Its license deserves separate attention. GLM-5.3-Flash is MIT, but the GLM-5.3 LICENSE file is a custom license. It broadly grants use and modification, then requires a Z.ai security review before commercial model-as-a-service use by an operator and its affiliates with more than $10B in aggregate revenue over any consecutive 12 months. That is a concrete deployment condition, not a detail that fits under a generic open-source label.

Ornith-1.5-9B-OBLITERATED is Plinius’ modified version of the 9B Ornith model. Its card describes three rounds of SVD abliteration and per-head attention surgery. The quoted pass rates and capability cost are creator-reported results. The card is also clear that it removes refusals for most prompts, not all.

orcarouter’s Qwen3.8-Flash-Next-Uncensored takes the same broad route with Qwen’s model and is positioned by its creator for red and blue teams. The unglamorous caveat matters: its GGUF files need a llama.cpp build containing PR #27742, because qwen4_exp is not in mainline llama.cpp. Stock builds will not load the files. The model card also notes that abliteration is a weight edit, not unlearning, and that safety fine-tuning can bring back some refusals.

The model releases put pressure on the hardware question. A sparse active count reduces compute per token, but it does not make a large model’s weights or quantizations disappear from memory.

Local hardware for local models

Apple’s M6 and M5 Ultra announcement contains two distinct stories for local AI. M6 supports up to 32GB of unified memory. M5 Ultra supports up to 512GB and 1.2TB/s of memory bandwidth. Apple says M6 can process LLM prompts up to 4.8 times faster than M4 in an LM Studio benchmark. That is an Apple-reported benchmark result.

The popular “70B-class locally” line needs the same split. It is community framing, not a capability claim for every M6 configuration. The high-memory setup belongs to M5 Ultra, not the 32GB M6.

Xiaomi’s AI Cube prototype looks promising, but the sourcing is weaker. Xiaomi has not provided an official English primary source that I could verify. Gizmochina’s report and VideoCardz’s coverage carry Xiaomi’s claims of a 150W engineering machine demonstrating a 120B plus 3B dual-model local deployment. The reported 1.22TB/s belongs to the O100 chip’s near-memory interface; the reported 160GB belongs to the separate D100 chip specification. They are not one unified AI Cube memory pool.

Those memory limits also shape which agent workflows are practical. Hermes added several capabilities this week, each with a stated boundary.

Hermes is becoming a real system

The new optional /grill-me skill gives Hermes a deliberate pause before implementation. It models a plan as a design tree, interviews unresolved branches in rounds, and hands the result to planning or review workflows. It writes no code during the grill, which keeps an adversarial plan review separate from the build.

BackSearch for Hermes adds two tools backed by General Reasoning’s historical-search product: backsearch for point-in-time search and backfetch for archived text. The plugin requires an OpenReward API key. Its use case is not ordinary browsing, but asking what the web contained on a specified date for backtests and evaluations that need to avoid leakage.

Hermes also improved document handling. Its document-extraction guide says read_file detects likely scanned PDF pages from sparse extracted text and identifies which pages need recovery. Local OCR remains the documented fallback. Firecrawl OCR is a hosted path that must be enabled in configuration, not the default for every PDF.

The real-profile browsing feature works from a managed snapshot of a Chrome-family profile, not the live profile itself. It is consent-gated and off by default. The documentation calls it a convenience feature rather than an isolation boundary, a caveat that belongs beside any claim that an agent can browse “as you.”

Firecrawl’s keyless tier is the tooling backdrop for the OCR path above: 1,000 free credits per month without signup or a card, exposed through its MCP server, CLI, and REST API. Firecrawl’s reported 94.7% SimpleQA result comes from its own evaluation of its search system, so it is a vendor number rather than an independent quality benchmark.

Those releases are mostly practical engineering. The week’s other security story was a broad call for organizations to treat defensive capability as shared infrastructure.

AI security

OpenAI’s collective cyber-defense letter is the week’s largest institutional security item. More than 120 organizations signed it. The signatories argue that AI-enabled attacks will spread and improve, then ask organizations, security vendors, governments, and frontier AI companies to act across four areas: stronger basic defenses, continuous testing and shared playbooks, coordinated public defense, and responsible model access with observability and traceable agent identities. That is the signatories’ policy framing, not a forecast independently established by the letter.

The practical counterpart is Itential’s FlowAgents demonstration. Itential showed three local agents that find a CWE, propose a patch, and prepare a report, with a human approval gate before any commit. The demonstration uses Cisco Antares for localization, Qwen3-Coder-30B for patch generation, and Gemma 4 for reporting. The timings and CWE examples are the demonstrator’s results. For readers encountering it fresh, Cisco released Antares in July as an open-weight vulnerability-localization family.

The same human gate appears in a different form in the week’s reading tools: grounding the answer in a source the reader owns, rather than turning a book into unrestricted general context.

Learning and reading tools

Google’s Expert Intelligence starts with eligible Google Play Books in Gemini Notebook. Readers who own a supported ebook can ask questions grounded in that book and generate tools such as quizzes, infographics, and audio overviews. Google says the catalog starts with more than 100,000 titles, and shared notebooks still require each collaborator to own the book. The ownership gate is a real limit on what otherwise sounds like a general feature for turning any book into a notebook.

Another project in this week’s roundup promises to turn open textbooks into learning formats people can actually finish, starting from a 600-page PDF. I could not independently confirm which project stands behind it, so this roundup leaves it unnamed rather than assigning it unverified capabilities.

That kind of sourcing caution is exactly what the week’s final project handles well: it labels what is live and what is modeled.

One open project worth a look

God’s Eye View is a browser-based globe that brings together public data sources such as flight transponders, ship signals, satellite elements, earthquakes, traffic, cameras, radio, and active fires. The repository labels modeled views separately from live feeds, including reconstructed launch estimates and simulated keyless traffic.

A GitHub API check on 2026-08-30 recorded 13,698 stars and 2,712 forks. Those counts will change, so the repository is the source of truth rather than a number frozen in this roundup. The project needs a Google Maps key for 3D tiles, while several optional layers and its voice feature have separate service requirements.

The recurring lesson was not that every large model or local machine became easy to use. It was that practical limits were visible in the release notes: active parameters, memory ceilings, a license clause, a human approval gate, and labels on modeled data. Those details decide what a release can actually do.

That’s the week. See you in CW36.