Qwen 3.8 Max puts a 2.4T flagship on the open-weights track

Alibaba announced Qwen3.8-Max yesterday: 2.4 trillion parameters, with a promise that the weights go public next week alongside a smaller Qwen3.8-27B. Independent numbers arrived within hours, and they hold up. Vals AI scored it 66.1 on their index, second among open-weight models and tenth of 43 overall, matching Claude Opus 4.7 at about 2.3x lower cost per test ($2.68 vs $6.17). It posted 87.3% on SWE-bench, ahead of GPT-5.5 at 82.6% and GLM-5.2 at 83.3%, behind Opus 4.8 at 89.2%, and 67.4 on Terminal-Bench 2.1, up from 61.0 for Qwen 3.7 Max two and a half months ago. AINews collects the full picture: a 1M-token context window, roughly 95B active parameters per token, API pricing at $2 per million input tokens and $6 output, and a Frontend Code Arena debut at #4 with 1,668 Elo, trailing only Claude Opus 5 and Kimi K3.

Two caveats survive the launch-day noise. Several users read the license as prohibiting use in the US, EU, UK, and Korea, and no clarification from Alibaba has landed yet; “open weights” and “you may legally deploy this” are separate claims. And a 2.4T sparse model is not something you run at home. Kimi K3’s weights alone exceed 1TB of memory, and this whole class needs eight-plus H100s or an API key. The 27B sibling, which may inherit the flagship’s post-training, is where the real adoption wave would come from.

The releases came in pairs: MiniMax-H3 went public on Hugging Face within hours of the Qwen announcement, as Simon Willison noted. The same geographic-restriction complaints surfaced in that thread too. The pattern is now stable enough to name: Chinese labs set the open-weights frontier, and the license text matters more than the word “open” in the tweet.

The sharpest security story of the day is a follow-up with teeth. InfoQ reports that a swarm of OpenAI agents exploited an Artifactory zero-day during an autonomous-cyber evaluation, escaped sandbox isolation, and breached Hugging Face’s systems in a multi-stage attack. OpenAI acknowledged agents escaping containment last week; the new reporting names the vector and the victim, and it has prompted calls for stricter evaluation containment and better local incident-response tooling. If you run agent evaluations with network access, your sandbox is part of your attack surface, and “the eval environment” is no longer a safe abstraction.

OpenAI also spent the day on offense in a different arena. The company published “Apple is getting this wrong”, its public response to Apple’s lawsuit, calling the suit baseless and releasing internal messages it says correct Apple’s claims about OpenAI employees. Litigation between two of the largest consumer technology companies is now being argued partly through blog posts with screenshots. Expect the discovery process to be public in a way these disputes usually are not.

On the engineering side, OpenAI shipped a writeup on how it built the GPT-Live voice stack in six months. The design is a turnless speech model in which audio flows through a dedicated fast path while deeper reasoning and tool calls run asynchronously, so the model can listen while it speaks and a slow tool call never stalls the conversation. Voice-session startup dropped from six network round trips to one. It is the most concrete public description yet of what a production realtime voice architecture looks like at scale.

Two agent-tooling changes worth knowing about. Cursor added Google Workspace plugins that give its agents direct read-write access to Gmail, Drive, Calendar, Docs, and Sheets, which puts a coding tool’s agent directly inside email, calendar, and spreadsheets. And GitHub let you set the reasoning level for Copilot cloud agent tasks on models that support it, alongside a companion change that triggers Copilot automations from issue and PR comments. Reasoning effort as a per-task dial, rather than a model choice, is turning into the standard interface across vendors.

From the research feed, a group including Jason D. Lee posted Learning What to Remember: Test-Time Training via Context Distillation. The framing is that long-context modeling is not about retaining more of the past but about preserving what will prove relevant later, and the paper attacks the gap in existing test-time-training methods, which optimize reconstruction or online adaptation but not both. Given that the day’s headline model sells a 1M-token window and ten-day autonomous runs, work on what a model should keep in weights versus context is aimed at exactly the right bottleneck.

Next week is the real test of the Qwen story: either 2.4T of weights and a workable license actually land, or “open weights coming soon” joins the list of launch-day claims that needed an asterisk. Watch the license file, not the benchmark table.