The floor is rising: open models, the coding-speed paradox, and the bill for the buildout

An open-weights model beat Claude on a frontier lab’s home turf this week. Semgrep ran GLM-5.2 against its own cyber benchmarks, the same security-reasoning evals it uses to size up the frontier labs, and GLM-5.2 came out ahead of Claude on the tasks they care about. The post’s title, “We have Mythos at home,” is a joke about substituting the open model for the expensive frontier one, and the punchline is that on Semgrep’s vulnerability-finding and exploit-reasoning suite the substitute held up. A security vendor publishing a head-to-head where the open model wins is a different signal than a leaderboard screenshot. These are people who run code-analysis evals for a living, comparing against the model they would otherwise pay for.

Open models are closing the gap on the frontier labs

The GLM result does not stand alone. TechCrunch reported that Asian AI startups are shipping Mythos-like models while Anthropic’s export restrictions stay in place, and the two stories rhyme: when the frontier labs limit who can buy the best models, the gap gets filled by open releases that are good enough for real work. The Semgrep benchmark is the empirical version of the TechCrunch market story. If you are a security team or a coding-agent builder choosing a backend right now, the calculus has shifted from “frontier or nothing” to “which open model clears my eval bar, and is the price difference worth the last few points.” That is a procurement question more shops can answer in the affirmative than could six months ago.

What is missing from the window is also worth naming. No new Claude, GPT, or Gemini drop landed in the last seven days. The story this week is not a frontier release, it is the floor rising underneath one.

Coding got faster, shipping did not

GitLab put a number on the gap between writing code and delivering software. Its 2026 AI Accountability Report, covered by InfoQ, found that 78% of developers say they code faster with AI tools, while overall delivery has not sped up. The bottleneck moved downstream, to review, testing, and the governance and traceability work that enterprises now have to do on code a human did not fully write. The report frames it as an “AI paradox,” and the mechanism is mundane: generation was never the slow part of shipping software, so making it faster does not move the end-to-end number.

Two essays this week argue the same point from the trenches. Swizec’s “Code is the easy part” walks through refactoring half a business’s process to fix one janky script, the kind of organizational surgery no coding agent touches. And “Software Engineering in the Age of AI” makes the case that the role is shifting toward judgment, integration, and the parts of the job that were always about deciding what to build rather than typing it. If you manage a team, the GitLab number is the one to internalize: faster keystrokes do not buy you faster releases unless you also fix review and test throughput.

What actually steers an agent

Wix Engineering ran 250 agent evals to test whether skills beat docs, and the headline is that the answer is more complicated than they expected. The useful part is the method: 250 runs is enough to separate signal from vibes, and the nuanced result, that skills help in some cases and docs in others, is more credible than the usual “we adopted X and everything improved” post. If you are deciding how to invest in agent context, read the conditions under which each approach won rather than the summary.

Sebastian Raschka published a deep practical guide to running local coding agents, which pairs with the open-models story above: the same GLM-class weights that beat Claude on Semgrep’s benchmark are the ones you can run on your own hardware, and Raschka walks through what that actually takes. On the patterns side, HumanLayer’s “12-Factor Agents” keeps circulating as the reference for how to structure an agent that survives contact with production, and “Tokenmaxxing is dead, long live tokenmaxxing” argues the economics of stuffing context windows have shifted enough to change how you should budget tokens. Together these are the practitioner’s stack: which model, run where, structured how, paying what.

Security is moving to the agent layer

InfoQ convened a panel on security in the machine age covering how the threat surface changes when agents act on their own: prompt injection, data poisoning, agent abuse, and AI-assisted social engineering. The defensive side is shipping too. Strix is an open autonomous pentest agent that runs security testing end to end, the offensive-tooling counterpart to the Semgrep analysis story, and the fact that an autonomous attacker and an autonomous analyzer are both open and downloadable is the real state of play.

Operators are already living with the consequences. A widely-read r/devops thread asks how teams manage the blast radius when agents write infrastructure-as-code, the Terraform and Kubernetes manifests and CI workflows that fail in ways a bad application bug never could. The answers are the Day-2 reality nobody puts in the launch demo: review gates, scoped credentials, and the slow accumulation of guardrails around code that an agent generated and a human approved without fully reading.

The bill for the buildout is coming due

SemiAnalysis published a detailed look at US grid constraints heading toward 40GW of behind-the-meter datacenter capacity by 2028, the physical limit on how fast the AI buildout can actually go. Power, not chips, is increasingly the binding constraint, and the piece walks through the interconnection queues and on-site generation that the hyperscalers are betting on. On the labor side, OpenAI released “Mapping Europe’s AI Workforce Opportunity”, a primary-source look at how the lab sees jobs shifting across the EU, the policy-facing companion to every “AI and employment” debate.

Two longer listens and reads to close. Marc Andreessen went on the a16z podcast for a wide-ranging argument on AI, productivity, and industrial policy, worth the time if you want the maximalist case stated plainly. And IEEE Spectrum asked what it means to be a mathematician when AI does the math, a clear-eyed look at how proof and discovery change when the tooling can do parts of the work.

What to watch: whether the next frontier release widens the gap that GLM-5.2 just narrowed, or whether the open models keep closing it faster than the labs can ship.