WEEK OF SEP 27 – OCT 3, 2025

Open weights reset the price floor again: two MIT-licensed near-frontier models in 24 hours

DeepSeek and Z.ai shipped open-weight models 671B and 355B deep that benchmark within noise of the previous closed frontier — and priced tokens at roughly a fifth of it — the same week Anthropic's new flagship and California's first enforceable AI law landed.

Monday September 29 packed three unrelated things into one day: DeepSeek published DeepSeek-V3.2-Exp under MIT, Anthropic shipped Claude Sonnet 4.5 at unchanged $3/$15 pricing, and Governor Newsom signed SB 53, the first enforceable US frontier-AI statute. By Tuesday, Z.ai had released GLM-4.6 on MIT weights with a 200K context window. Two open-weight flagship drops in 48 hours, both undercutting the closed frontier on price by an order of magnitude, is the story of the week.

The infrastructure side moved just as fast. OpenAI and Stripe open-sourced the Agentic Commerce Protocol and turned on Instant Checkout inside ChatGPT on Monday, Sora 2 plus a social video app landed Tuesday, and Reuters reported on Thursday that OpenAI had closed a secondary share sale at a $500 billion valuation, up from $300 billion, with current and former employees selling roughly $6.6 billion of stock.

The week's security news was about agent harnesses rather than corporate breaches, which is the right order for anyone shipping agents: Cursor's agent CLI disclosed an MCP OAuth command-injection bug rated 8.8, and Claude Code's symlink handling broke its own permission deny-rules. Meanwhile the regulatory arc that began with California's vetoed SB 1047 in 2024 closed a loop — a transparency law, not a liability one, effective January 1, 2026.

THU · Oct 2, 2025securitymcpcursoragent harnesscve

Cursor's agent CLI patched an MCP OAuth flaw that let a malicious server execute code as you

Cursor published security advisory GHSA-wj33-264c-j9cq on October 2 for its agent CLI: when MCP was configured with OAuth against an untrusted server, an attacker could impersonate that server and return crafted, maliciously injected commands during the interaction, achieving command injection and arbitrary code execution on the host with the user's full privileges. It is tracked as CVE-2025-61591, rated 8.8 for command injection, and fixed in build 2025.09.17-25b418f for all affected versions. The National Vulnerability Database entry followed on October 3.

It was not an isolated case that week. CVE-2025-59829, also published October 3, covers Claude Code builds below 1.0.120: the tool failed to account for symlinks when checking its permission deny rules, so a symlink pointing at an explicitly denied file could still be read. Both bugs share a shape — the permission model of the agent harness, not the model, was the exploitable surface.

WHY IT MATTERS

An agent CLI runs with your shell, your filesystem and your network reach, so a prompt-injected tool call is equivalent to remote code execution and should be threat-modeled that way. Pin harness versions and treat auto-update as a security control rather than a convenience; treat every MCP server — especially anything reached over OAuth or added from a repo you did not write — as untrusted code with full user privileges; and put the agent inside a sandbox with scoped credentials and an egress allowlist. Verify deny rules against symlinked paths and re-read allowlists after every harness upgrade.

TUE · Sep 30, 2025open weightsglmz.aimitevaluation

Z.ai's GLM-4.6: MIT weights, 200K context, $0.60/$2.20 — one day after DeepSeek

Z.ai released GLM-4.6 on September 30 with open weights under the MIT license on Hugging Face: the GLM-4.5 mixture-of-experts architecture — 355B total parameters with 32B active per token — with the context window expanded from 128K to 200K tokens and maximum output raised to 128K. Z.ai reports gains over GLM-4.5 across eight public benchmarks covering agents, reasoning and coding, and says GLM-4.6 beats Claude Sonnet 4 in its own 74-task real-world coding suite run inside the Claude Code environment, while trailing Claude Sonnet 4.5 on coding.

Two things separate this from a routine model drop. First, published pricing of $0.60 per million input tokens and $2.20 per million output, against Sonnet 4.5's $3/$15 — roughly a fifth on input and a seventh on output — with self-hosting free under MIT if you have the GPUs. Second, Z.ai published all 74 CC-Bench agent trajectories, prompts and tool calls included, as a dataset, which lets you inspect failure modes instead of trusting a bar chart.

Z.ai's GLM-4.6: MIT weights, 200K context, $0.60/$2.20 — one day after DeepSeek
Hugging Face

WHY IT MATTERS

Agent economics are dominated by tokens spent on planning, file reading and retries, so a 30%-plus reduction in tokens per task compounds through every CI run and nightly eval you pay for. The released trajectories are the more useful artefact: a ready-made corpus for building your own regression suite and for calibrating how much of a benchmark delta survives contact with your codebase. Treat near-parity at a fifth of the price as a routing decision you can now test empirically rather than assume.

MON · Sep 29, 2025open weightsdeepseeksparse attentionpricingmit

DeepSeek ships V3.2-Exp: 671B MoE, MIT weights, sparse attention, API prices cut 50%+

DeepSeek published DeepSeek-V3.2-Exp on September 29: a 671B-parameter mixture-of-experts model with 37B active parameters per token, a 128K context window and MIT-licensed weights, posted to Hugging Face alongside a technical report and TileLang and CUDA kernels. It is V3.1-Terminus plus DeepSeek Sparse Attention, which uses a learned lightning indexer to score the context and compute attention over roughly the top 2,048 tokens per query instead of the whole sequence. DeepSeek reports benchmark parity with the dense-attention predecessor — 85.0 MMLU-Pro on both, Codeforces 2121 versus 2046 — while processing long inputs two to three times faster.

The price change shipped with the model rather than after it. DeepSeek's release post says API prices dropped more than 50% effective immediately, to about $0.28 per million input tokens, $0.028 per million cached input tokens and $0.42 per million output tokens, with the old V3.1-Terminus endpoint kept alive for comparison only until 15 October. The sparse-attention kernels are released as readable TileLang code plus production CUDA, so the efficiency trick is reproducible on your own serving stack rather than locked behind the vendor API.

DeepSeek ships V3.2-Exp: 671B MoE, MIT weights, sparse attention, API prices cut 50%+
DeepSeek

WHY IT MATTERS

This moves the floor under every cost model that assumes frontier-tier reasoning costs $3 to $15 per million output tokens. Long-context agent loops — repo-wide retrieval, log triage, multi-turn tool use — become cents-per-run workloads you can route to open weights or a cheap endpoint, and keep paid frontier capacity for the hard turn. If you self-host, the sparse-attention kernels are the reference implementation for making 128K context affordable on your own GPUs.

MON · Sep 29, 2025claudeanthropicagent sdkbenchmarks

Anthropic answers the same day: Claude Sonnet 4.5 tops SWE-bench Verified at 77.2% and ships the Claude Agent SDK

Anthropic released Claude Sonnet 4.5 on September 29 — the same day DeepSeek's sparse-attention checkpoint dropped — claiming state of the art on SWE-bench Verified at 77.2% and 61.4% on OSWorld computer use, up from 42.2% for Sonnet 4 four months earlier. Pricing was held flat at $3 per million input and $15 per million output tokens with a 200K context window, and the model shipped under ASL-3 protections with CBRN classifiers that Anthropic says have cut false positives tenfold since their introduction. Anthropic reports sustained focus of more than 30 hours on multi-step tasks.

The more consequential half was the harness. Anthropic gave developers the Claude Agent SDK — the same scaffolding behind Claude Code — plus checkpoints with instant rollback in Claude Code, a native VS Code extension, and context editing and a memory tool in the API. Those are the unglamorous primitives of a production agent stack: durable memory, cheap context compaction, and a way to rewind a run without re-paying for it.

WHY IT MATTERS

Two of the three items you usually build yourself — memory management and context compaction — are now API features with published semantics, which changes the buy-versus-build line for agent frameworks. The 30-hour horizon also matters architecturally: the failure mode shifts from the model losing the thread to the sandbox, credential scope and rollback path having to survive a multi-day run. Plan for checkpointing, per-session identities and blast-radius limits before you plan for more autonomy.

MON · Sep 29, 2025regulationcaliforniasb 53compliancefrontier models

Newsom signs SB 53 — the first enforceable US frontier-AI law, one year after killing SB 1047

Governor Gavin Newsom signed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, on September 29, a year after vetoing its predecessor SB 1047 over fears it would chill California's AI economy. The law binds large frontier developers — anyone training a foundation model above 10^26 floating-point operations — to publish a frontier AI framework covering catastrophic-risk assessment, mitigation, internal governance and weight-security measures, and to report critical safety incidents to the Office of Emergency Services within 15 days, or 24 hours where there is an imminent threat. It adds whistleblower protections, empowers the attorney general to levy civil penalties of up to $1,000,000 per violation, establishes the CalCompute public-computing consortium, and takes effect January 1, 2026.

It is a transparency statute, not a liability one: nothing in SB 53 creates new causes of action for harms caused by model outputs. What it does create is a written, dated, publicly posted artefact that companies can be measured against, and an incident-reporting channel into state government, at a scale threshold high enough that it currently catches a handful of labs rather than the deployer ecosystem.

WHY IT MATTERS

If you fine-tune or continue-pretrain at frontier scale — or sell to someone who does — governance documents just became procurement inputs with a statutory deadline behind them, and weight-security and incident-response plans are now reviewable public claims rather than marketing. For everyone below the compute threshold the effect is indirect but real: expect frontier vendors to push compliance artefacts, signed-use policies and incident SLAs down their API contracts. The same template is the likeliest blueprint for other states in the absence of federal legislation.