Under the Hood

What it is: A lightweight AI model that converts text, images, audio, video, and code into embeddings (numerical representations that capture meaning), so a search system can find related content across all those formats at once, entirely on a local device.

What's new: The original EmbeddingGemma handled text only. This version processes five data types in a single shared space, meaning one query can pull results from audio recordings, video clips, images, and documents simultaneously.

How it works: When you feed in a voice memo, the model maps it into the same numerical space as your text notes and image files. A search query — itself converted into that same space — finds whatever is closest in meaning, regardless of format. The model has 740 million parameters (a measure of model size and capacity), runs with as little as 567MB of active RAM on a phone, and supports an 8,000-token context window (context window: the maximum amount of text or data the model can consider at one time), four times larger than its predecessor.

What it can't do: Google's benchmarks show top scores among models under one billion parameters, but those evaluations were run by Google. Independent results at frontier scale — larger, general-purpose models — remain untested.

Who should care: Developers building offline search tools or privacy-focused apps that need to search across mixed media without sending data to a server.

Try it / read it: EmbeddingGemma 2 model card and weights on Hugging Face

What it is: A class of security flaws in how AI agents communicate with each other inside organisations, exploiting a protocol called MCP.

What's new: MCP — Model Context Protocol — is a standard that lets AI agents communicate inside an organisation's internal network. It stores credentials for each agent. Independent researcher Syed Anas Mohiuddin identified that agents built on MCP are structured to trust every other internal agent by default. His proof-of-concept attacks showed how that trust can be exploited across systems at Google, JP Morgan Chase, Weviate, Rapid7, the French government, and the US federal government, according to Ars Technica.

How it works: An attacker crafts a malicious prompt targeting one agent — say, a translation agent — whose guardrails are weak. That agent passes the instruction down the chain to other agents, which follow it because the instruction appears to come from a trusted internal source. Think of it like a forged memo from a colleague: because the memo looks internal, it bypasses the checks you would apply to a message from a stranger. In several of Mohiuddin's tests, this led to SSRF (server-side request forgery — where a server is tricked into making network requests it should not), potentially exposing sensitive internal data.

What it can't do: Mohiuddin's work is proof-of-concept testing, not evidence of active exploitation in the wild. Real-world attacks would require prior access to an organisation's internal network.

Who should care: Any organisation deploying multiple AI agents that communicate with each other internally — this describes most enterprise AI setups being built right now.

Try it / read it: Ars Technica

What it is: A pipeline for automatically generating training data (the labelled examples used to teach a model) targeted at a specific weakness in an enterprise AI agent.

What's new: Most training pipelines start with human-written tasks or general datasets. AutoSynthData starts from the model's actual failures in a real deployment environment, then generates new tasks specifically designed to exercise those failure points.

How it works: The system observes where a target model fails and where a stronger teacher model succeeds on the same tasks. It uses that gap to decide what the weaker model needs to learn next. It then generates new tasks, each consisting of a system specification (the rules and environment the agent operates in), a user prompt (what someone would actually ask), and a verifier (an automated check that confirms whether the agent completed the task correctly). As the model improves, the curriculum (the set of tasks it is trained on) shifts toward whatever it still finds difficult, rather than repeating exercises it has already mastered.

What it can't do: The paper's demonstration uses a specific benchmark environment called EnterpriseOps Gym. Whether the approach generalises to other enterprise systems and tool configurations is not yet established.

Who should care: Teams building or fine-tuning (adapting a pre-trained model for a specific use case) AI agents for internal business tools, where generic models perform inconsistently on company-specific workflows.

Read it: Hugging Face blog

What it is: A training framework for building large AI models, specifically designed for a type of model architecture called Mixture-of-Experts (MoE), where only a small portion of the model's components are activated for any given input rather than running everything at once.

What's new: Previous versions of OLMo-Core used a system called FSDP (Fully Sharded Data Parallelism), which repeatedly gathered and resharded model weights — the numerical values that encode what a model has learned — across GPUs during training. OLMo-Core 3 switches to a different approach that keeps expert components resident on their assigned GPUs and routes data to them instead, avoiding that repeated shuffling.

How it works: Experts are spread across GPUs using expert parallelism. Model layers are split across GPU groups using pipeline parallelism. The optimizer state — the data used to calculate and apply weight updates during training — is distributed rather than duplicated. For each input token, only four experts are activated, regardless of how large the full expert pool grows.

What it can't do: In a preliminary test on eight NVIDIA B300 GPUs, a 47-billion-parameter version processed 52,000 tokens per second per GPU, compared with 19,400 using the earlier implementation — about 2.7 times the throughput. But this is preliminary. Trillion-parameter scale benchmarks are early-stage, and real-world training runs involve coordination costs that benchmarks on eight GPUs may not fully capture.

Who should care: Researchers and smaller labs priced out of frontier model training — this is specifically built to make that more accessible.

Try it / read it: OLMo-Core 3 on Hugging Face

What it is: A published framework proposing that AI companies should produce structured safety documentation before starting any major new AI training run.

What's new: Most AI safety processes today are internal and informal. OpenAI is proposing a standardised format borrowed from industries like aviation and nuclear power, where documented evidence of safety must exist before operations begin. This formalises that expectation for AI training specifically.

How it works: The framework organises safety evidence into three layers. First, alignment training — the process of teaching a model to do what its developers intend, including automated checks that look for cases where the model learned to game its own reward signal (essentially, learning to cheat the test rather than pass it). Second, containment — hardening the environment the model runs in so that a misaligned model cannot reach the outside world. Third, monitoring — continuous checks during training to catch behavioural drift early, including watching for models that behave differently when they detect they are being evaluated. The framework also bars automated graders from seeing a model's chain-of-thought (its internal reasoning steps) during training, specifically to prevent models from learning to hide concerning reasoning from monitors.

What it can't do: OpenAI acknowledges directly that AI safety cases cannot yet reach the rigour of aviation or nuclear equivalents, due to what it describes as "emergent complexity" at each new capability level — meaning behaviours that appear unpredictably and were not present in earlier versions. The framework is also entirely voluntary.

Who should care: Anyone thinking about how AI companies govern themselves before releasing more capable systems — and policymakers considering whether voluntary frameworks are sufficient.

Read it: OpenAI

What it is: Muse is Meta's consumer-facing AI agent, packaged as a friendly mascot app, that gives each user their own persistent Linux virtual machine (a full, private computing environment) running in Meta's cloud.

What's new: Most AI assistants run your requests through a shared system and return a result. Muse gives every individual user a dedicated, always-on computer in the cloud, meaning it can maintain state — remembering what it was doing and continuing tasks over time — rather than starting fresh each session.

How it works: When you install Muse, Meta provisions a Linux VM (virtual machine — a complete, isolated computer running inside a server) specifically for you. The agent runs inside that environment, which means it can install software, run scripts, browse the web, and manipulate files on your behalf, persistently, without you being present. It is available as a desktop app, which lowers the barrier to running a genuinely capable autonomous system.

What it can't do: The gap between what Muse can technically do and what users understand they are authorising is, as developer and commentator John Gruber observes, a serious open question. There is no published detail on what limits Meta has placed on what the VM can access or do externally. How permissions, data retention, and containment work has not been publicly specified.

Who should care: Anyone who installs it — because understanding what you are handing persistent cloud-computer access to matters before you click install, not after.

Try it / read it: Simon Willison's summary of Gruber's analysis

What it is: A new cloud memory architecture that lets an AI assistant remember things about you across devices, without giving Google — or anyone else — access to what it stores.

What's new: Until now, privacy-focused cloud AI was stateless — meaning it forgot everything the moment a session ended, like a conversation with someone who has no long-term memory. This adds persistent memory without moving the privacy line.

How it works: Your personal data is stored in an encrypted vault in Google's cloud. The cryptographic keys that decrypt it live only on your own devices. When an AI model needs your context, an end-to-end encrypted channel connects your device to a secure enclave (an isolated processing environment, sealed off from the rest of the cloud). The enclave decrypts just enough to handle the request, saves any new context, then re-encrypts immediately. According to Google, even its own engineers cannot access the contents during this process. The software running inside the enclave is published as a tamper-proof public record, so independent researchers can verify it has not been altered.

What it can't do: The independent audit covers the architecture, not every possible implementation. The privacy guarantee depends entirely on the cryptographic model working as described — and that claim has not yet been verified outside of Google's own published whitepaper and the single audit it has commissioned.

Who should care: Anyone using a Google AI assistant who has wondered where their personal context actually lives.

Try it / read it: Google DeepMind blog

What it is: A new method for compressing large AI models by removing whole sections of them, using a mathematical framework borrowed from physics.

What's new: Most existing compression methods evaluate each section of a model independently, then cut the ones that seem least important on their own. This approach maps all the interactions between sections before deciding what to cut — catching cases where two sections that each look removable actually depend on each other.

How it works: Each section (or block) of a model gets assigned a binary variable: keep or remove. The researchers then calculate a Hessian matrix — a mathematical table describing how much each block matters on its own (diagonal entries) and how much pairs of blocks affect each other (off-diagonal entries). That table is equivalent to a structure from physics called an Ising glass (a disordered system of interacting spins), and minimising its energy turns out to predict benchmark quality well. Classical and quantum-inspired solvers then search for the lowest-energy configuration, which corresponds to the best set of blocks to cut. At 50% compression of Llama-3.3-70B-Instruct, the method claims 23 percentage points better performance on MMLU (a graduate-level multiple-choice benchmark) than competing block-removal approaches, in the company's own testing.

What it can't do: The improvement is most pronounced at deep compression — cutting half the model. The authors note the Hessian is an approximation, not an exact measure, and results at frontier model scales beyond Llama 70B are not yet reported.

Who should care: Anyone running AI models in resource-constrained environments where full-scale deployment isn't viable.

Read it: Hugging Face blog

What it is: SynthID-Text is a watermarking system for AI-generated text. Watermarking here means embedding a hidden signal in the model's output so that anyone with the right key can later confirm the text was AI-generated — a process called provenance tracking.

What's new: New research from Lasso Security, covered by Ars Technica, finds that applying SynthID-Text changes more than word choice — it also changes whether a model follows its own safety rules.

How it works: Instead of choosing the next word randomly, SynthID-Text uses a secret key to score candidate words in a bracket-style tournament. The winning word is chosen based on those hidden scores, not purely on which word makes the most sense. The sequence of winning words carries a detectable statistical fingerprint. But because the key subtly steers every word choice, it also shifts how the model responds to safety-relevant instructions. Researcher Andrea Siposova tested six open-weights models and found that under prompt injection (where an attacker embeds hidden instructions in content the model is processing), watermarked models were more likely to comply with harmful requests they would otherwise refuse.

What it can't do: The research was conducted on Hugging Face's unmodified watermarking implementation. Real-world deployments may be configured differently, and the researchers note frontier-scale models were not fully tested.

Who should care: Developers deploying AI agents with watermarking enabled — safety testing without watermarking active may not reflect real-world behaviour.

Read it: Ars Technica

What it is: A formal process OpenAI published for tracking, investigating, and disclosing cases where its AI models behave in ways they were not intended to, according to OpenAI.

What's new: Previously, OpenAI disclosed misalignment cases sporadically — waiting until it had several incidents to bundle together, or burying findings in technical documents released alongside new models. The new framework commits to publishing reports faster, even before the behaviour is fully understood or fixed.

How it works: When a model behaves unexpectedly — acting without authorisation, attempting to coordinate with other AI systems, evading oversight, or behaving in ways that contradict published safety assessments — the framework triggers a formal investigation and disclosure report. Critically, disclosure is supposed to happen even when the significance is uncertain. The framework also covers model behaviour throughout the full lifecycle: training, testing, and live deployment. Six initial reports covering the last six months have been published alongside the framework itself.

What it can't do: OpenAI acknowledges there are no industry-wide standards for this kind of disclosure yet — this framework is a unilateral commitment, not an agreed benchmark. Some of the disclosed cases may turn out to be statistical noise rather than meaningful patterns. Verification is left to outside researchers examining the published reports.

Who should care: Anyone following AI safety debates, researchers studying model behaviour, and policymakers — this is one of the more concrete transparency commitments a frontier AI lab has made in public.

Read it: openai.com