🤖 AI Weekly Recap (Week 35)

One Computer Per Bot: Each Bot gets a real browser with its own logins, its own files, and only the tools you grant. Sessions stay isolated, so agents never share credentials or state.

Watch and Take Over: Every action is decided before it happens and recorded after, with a gateway that evaluates policy and writes an audit row before the browser moves. You can step in mid-task at any point.

Bring Any Agent: A Bot is any endpoint speaking AG-UI, the open protocol for agent-to-user interaction, so agents built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or written by hand all arrive the same way. The repo is tagged v0.0.1 and labeled alpha.

Run Anything Inside It: Examples cover coding agents, browser automation with Chrome and Playwright, and full desktop environments with VNC and VS Code. Claude Code, Gemini CLI, OpenAI Codex CLI, Qwen Code and Kimi CLI each run inside OpenSandbox.

Real Isolation, Not Just Containers: It supports secure container runtimes like gVisor, Kata Containers, and Firecracker microVM for stronger separation between sandbox workloads and the host. Cold starts land under 800 milliseconds.

Local to Production: Docker handles local and single-node deployments while Kubernetes covers distributed ones, with a unified ingress gateway, per-sandbox egress controls, and a credential vault that injects secrets without exposing them to workloads.

Roughly 30x More Output: Replit says Core subscribers can create 30X more than before using Free Mode, plus up to 30 hours per month of chat. The feature became possible after OpenAI cut GPT-5.6 Luna costs by 80% on July 30.

Smart Escalation: When a task requires more advanced reasoning, Replit routes it to GPT-5.6 Sol, then returns to Free Mode on Luna while preserving project context.

The Naming Catch: Free Mode is not actually free. It still requires a paid subscription at $20 a month for Core or $100 a month for Pro, so it costs nothing extra rather than nothing at all.

A Map, Not an Index: It builds a graph of your project and saves it into the repo as a folder of ordinary linked markdown files, one node per subsystem, API, or concept, with plain-English explanations of what each part does and how it connects. There are no embeddings and no database to keep warm.

The Savings: Graft reports cutting token usage by up to 42%, tool calls by 46%, and task time by 60%. On SWE-bench Verified, an agent using Graft resolved 33 of 50 real GitHub issues against 27 without it. Small sample, and the benchmarks are the vendor's own.

Two Commands, No Key: The structural commands are deterministic tree-sitter operations needing no key and no network. graft init detects installed agents and writes their instruction files for Claude Code, Cursor, Codex, Gemini and GitHub Copilot. MIT licensed.

Post-Training Did All of It: Z.ai says it is a general coding model that picked up cybersecurity ability through extended post-training and reinforcement learning on the same base used for GLM-5.2. DeepSWE rose to 66.9 from 46.2.

Edging Out the Frontier: On CyberGym vulnerability discovery, GLM-5.3 scored 84.5%, slightly ahead of Claude Mythos 5 at 83.8% and GPT-5.6 Sol at 83.6%. On turning those flaws into working exploits the gap reverses sharply, and it trails badly on ExploitBench and ExploitGym. Every score is self-reported and not independently rerun.

Weights Are Delayed: Z.ai's models found 2,436 vulnerabilities across 269 open-source projects, 1,097 rated critical or high. Selected security partners evaluate first, with full weights published once safety evaluations are complete.

Load One Piece at a Time: A transformer runs its layers in sequence, each consuming the previous one's output, so you never need all of them in memory at once. Load a layer from disk, compute, free it, move on. For MoE models AirLLM goes further, hooking all 82,432 individual experts so only the 16 a token actually routes to ever load.

The Full Scaling Table: The repo reports 70B on about 4 GB, Llama 3.1 405B on about 8 GB, DeepSeek-V3 on about 12 GB and Kimi K3 on 3.72 GB. The 2.8T model needs less VRAM than the 671B one, and that is not an error.

The Honest Tradeoff: This is not interactive chat. Every token reads tens of GB off your SSD, giving you seconds to minutes per token. But it’s a fun experiment.