AI Briefing — 20.08.2026

🚀 Innovation

GLM-5.3 ships with unexpected hacking skills, open weights delayed. Z.ai released GLM-5.3 on Aug 14, claiming top open-weight coding performance. During testing the model found 1,097 critical or high severity vulnerabilities across Linux, WebKit, FreeBSD, VMware and Apache projects, including one flaw from 1981. The cyber capability emerged from post-training, not design. Z.ai now delays the open-weight release to Aug 28 for safety hardening, the first holdback in the GLM series. 53 CVEs are public, 2,383 remain under embargo. Why it matters: open-weight exploit reasoning changes the security math for everyone.

Qwen3.8-27B lands and the community stress-tests it. The model card went live Aug 14 and the open-weight release quickly became the LocalLLaMA story of the week. Community benchmarks cover knowledge, coding and reasoning modes (low/medium/xhigh). Early verdicts are mixed on "overthinking" but strong on real-world knowledge. Why it matters: a 27B class model this capable keeps the local frontier within reach of consumer GPUs.

Tencent starts gray-testing Hunyuan Hy4. Hy4 appeared in the Tencent Yuanbao app model list, labeled "Expert-Level Model" with tool use, positioned above Hy3 and DeepSeek. Tencent confirmed in its Q2 earnings call that the larger-parameter Hy4 launches soon. Why it matters: another Chinese lab pushes the flagship race while Hy3 stays the open-weight workhorse.

Read more →

🔬 Research

Faraday: a 27B agent that beats frontier models at replication. Inherent published an "AI Scientist" agent, Faraday, that outperforms Claude Opus 4.8 and GPT-5.5 on replicating research results. It is trained on Replica, 310 figure-replication tasks from 100 papers, using a rubric-based LLM judge and turn-level credit assignment. Faraday directs a 5T coding model as a tool instead of coding itself. Why it matters: long-horizon RL with verifiable tasks is a credible path toward AI-driven science.

Same effective batch, different training time. A measured study on T4 and L4 GPUs with LoRA shows physical batch shape changes wall time a lot. 4x1 beat 1x4 by 17% on T4 and 41% on L4 at equal effective batch. Why it matters: cheap training optimizations exist beyond the optimizer.

Read more →

🔒 Security

CVSS 10.0 SAP flaw exploited three days after disclosure. CVE-2026-58231 in SAP Commerce Cloud allows unauthenticated code execution via a default authentication client. SAP patched Aug 11, honeypots saw exploitation Aug 14, a PoC appeared Aug 15. Why it matters: e-commerce backends are being probed right now.

Operation CameraSwarm: 14,500+ Dahua cameras taken over. Hunt.io rebuilt the campaign from an exposed 407 MB operator directory. Three paths were used: credential brute-force, CVE-2021-33044/33045 auth bypass, and P2P relay abuse that never authenticates the connecting party. Focus was Ukraine and Russia, CERTs notified Aug 10. Why it matters: camera botnets with cloud relay access are cheap to build.

Escaping the WebAssembly sandbox via wasm2c. A PoC demonstrates arbitrary shell execution on the host, escaping the sandbox that Firefox RLBox relies on. The issue is tracked in WABT #2831. Why it matters: compile-based sandboxing assumptions need re-auditing.

Read more →

💰 Market

DeepSeek pricing gets a shake-up. Subscribers report the cheap era is over, with limits tightening after recent releases. New tooling tracks DeepSeek peak/off-peak pricing, Opencode cut deepseek v4f prices by ~40%, and a beta offers a guaranteed 97 tok/s GPU lane for $0.20/hr. Why it matters: inference pricing is splitting into subscription, per-token and per-hour models.

Anthropic extends the 50% Claude Code bump to month end. The temporary limit increase now runs through end of August, after users reported instant 30% usage on their accounts. Complaints about limit transparency continue. Why it matters: usage caps are the new battleground for coding subscriptions.

YMTC enters the global top 3 in NAND. The Chinese memory maker overtook Kioxia with 14% of NAND bit shipments in Q2 2026, behind Samsung (25%) and SK hynix (22%). Why it matters: memory supply concentration shifts just as AI demand spikes.

Read more →

🏛️ Politics

EU AI Act goes fully applicable. Since Aug 2, 2026 the high-risk obligations of the EU AI Act are in force. National authorities now have full inspection and sanction powers. Conformity assessments, technical documentation and registration are due for high-risk systems in hiring, credit, healthcare and education. Why it matters: the world's first comprehensive AI regulation is now being enforced.

California AI Transparency Act takes effect. Since Aug 2, covered providers must offer free AI detection tools and manifest and latent disclosure for AI-generated content. Obligations extend to hosting platforms from Jan 2027 and capture devices from Jan 2028. Why it matters: watermarking and detection become legal requirements, not options, for the largest US market.

Read more →

📎 Sources

• GLM-5.3's emergent security capabilities (r/netsec)
• GLM-5.3: Post-Training Produced Exploit Chains (TechTimes)
• A preliminary Qwen3.8-27B model card is live (r/LocalLLaMA)
• Tencent begins testing its new flagship model Hunyuan Hy4 (r/LocalLLaMA)
• Training AI Scientists to Replicate Research (Inherent)
• Same effective batch does not mean same training time (r/MachineLearning)
• Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure (SecurityWeek)
• Hackers Compromised 14,500+ Dahua Devices (The Hacker News)
• Operation CameraSwarm: over 14,000 Dahua cameras (r/netsec)
• I escaped the WebAssembly's sandbox (r/netsec)
• The age of cheap subscriptions is over (r/DeepSeek)
• DeepSeek peak/off-peak pricing clock (r/DeepSeek)
• Opencode getting price reduction for deepseek v4f (r/DeepSeek)
• Unlimited DeepSeek for $0.20/hr (r/DeepSeek)
• 50% increase extended to end of the month (r/ClaudeCode)
• Chinese memory-chip maker YMTC breaks into world's Top 3 (r/LocalLLaMA)
• EU AI Act News 2026 (The Radar AI)
• Key Deadlines Under the California AI Transparency Act (NatLawReview)