Thinking Machines' Inkling was the day's centerpiece: a 975B-total / 41B-active multimodal MoE, positioned as the strongest US open-weights model yet and built to be fine-tuned. But the bigger mood was that the whole open-weight calendar had suddenly compressed — Inkling was just the opening act.

The evidence stacked up fast: independent trackers put it atop the US open field, the specs confirmed the multimodal-and-long-context ambition, Kimi K3 was said to be "within hours", the full release calendar looked stacked into weeks, and US models were visibly gaining ground on Ollama.

OpenAI spent the day framing Codex as a platform, not a feature: 7M+ weekly users, 150+ updates in two months, and a debut piece of hardware — the Codex Micro macropad. The undertone was aggressive distribution and goodwill, a pointed reversal after a week of rate-limit complaints.

The reactions did the storytelling: the team openly mulled resetting limits again on the way to 9M, it dangled $100 in credits for testimonials, a 42,000-word Sol system prompt leaked, OpenAI's own videos referenced documenting the Codex Micro keyboard, and people pushed its computer-use into pure play.

The most actionable security thread traced a pattern: an anonymous researcher (operating as "Eclipse") releasing working Windows zero-day PoCs on a cadence timed to the day after Patch Tuesday, maximizing the unpatched window. The latest, LegacyHive, targets the Windows User Profile Service for privilege escalation.

It was part of a genuinely busy disclosure day: the LegacyHive PoC circulated in detail, a BitLocker 0-day (CVE-2026-50661) threatened disk encryption, an Age of Empires RCE (CVE-2026-50663) landed, Rapid7 chained two SharePoint bugs into RCE, and two SonicWall zero-days were being actively exploited.

Anthropic pushed Claude Code artifacts toward being real apps: they can now call MCP connectors to fetch data and take actions per viewer, on Pro/Max/Team/Enterprise plans (not on public artifacts). The broader timeline treated Claude skills as an ecosystem — and, increasingly, an attack surface worth watching.

Both sides showed up: Boris Cherny framed skills as the new automation instinct, makers shipped skills that clone entire ad styles, others assembled 1,000+ installable skills into "a company", while a clean write-up showed data exfiltration with no code execution at all.

The local-AI conversation shifted from "which model" to "what hardware runs it," anchored by a homelab build pairing an AMD EPYC chip with 512GB of DDR5 to run DeepSeek V3 entirely from RAM — no GPU. The throughline was cost, ownership, and how small the entry bar has gotten.

The examples ranged wide: Qwen 3.6 27B as the "local AI gateway drug", PrismML's Bonsai-27B squeezing onto 12-16GB cards, whole stacks replacing cloud subscriptions, and the argument that laptops will soon be sold on local-model support.

AI video had a strong showing, centered on Seedance 2.5 — BytePlus ran a polished collaboration recreating Michael Owen's career highlights, and the wider timeline used it and its rivals to push harder scenes: crowds, fast motion, historical reconstruction, and single-image-to-ad workflows.

The demos made the case: a one-shot Vesuvius eruption, a convincing live-football broadcast, a Kling / Sora 2 / Veo 3 bake-off, and a full product ad from a single image.

A standout isolated launch: Hermex, a native SwiftUI iPhone app for fully controlling a self-hosted Hermes Agent from your phone — chat with it, steer or stop runs mid-flight, browse sessions, switch models, and manage cron jobs and skills. The agent, tools, and data stay on your own hardware; the app talks only to your server, with no subscriptions, analytics, or third-party relay.

Another sharp standalone release for security-minded readers: an AI-powered penetration-testing and bug-bounty harness built for Claude Code. It turns an Obsidian vault into an opinionated offensive-security workflow — a searchable wiki of 450+ technique pages, per-vulnerability "hunt" skills, deterministic hooks that fire the right skill at the right moment, and a state-first engagement model that keeps both you and the model from wandering off-scope.