Two Chinese labs shipped inside 48 hours, and both open-weight promises came with fine print.

Zhipu released GLM-5.3 yesterday, claiming a 50 percent coding improvement over GLM-5.2 from post-training alone, first place among open-source models on Terminal Bench 3.0 and Agents' Last Exam, and something more surprising: a higher score than Anthropic's frontier Mythos 5 on a cybersecurity benchmark. The weights are not out yet.

Alibaba finally published Qwen3.8-Max's weights on Hugging Face, nine days after promising them and the first Max-class Qwen ever made downloadable. But the file that landed is not quite the model the API sells, and the smaller 27B that most developers actually wanted did not ship at all.

And quietly, Anthropic started watermarking everything Claude produces, with no opt-out, worldwide.

Three stories, three asterisks. Here is what is real in each.

The technical claim is the interesting part. GLM-5.3 uses the same base model as GLM-5.2. Zhipu did not run a new pretraining pass. Every reported gain comes from extended post-training, which the company describes as many times more long-horizon task environments, a wider variety of environment types, and a longer post-training run.

The claimed result is a 50 percent jump in core coding capability, first place among open-source models on Terminal Bench 3.0 and Agents' Last Exam, and coding and agent performance approaching Claude Fable 5.

That is now twice in two weeks. DeepSeek's V4-Flash posted a sevenfold jump on DeepSWE from re-post-training an unchanged 284-billion-parameter architecture. Zhipu just did the same thing with a claimed 50 percent coding gain on an unchanged base. If both hold up under independent testing, the practical implication is significant: the remaining headroom in these models is in training method rather than scale, which is much cheaper to chase and much harder to protect with a capital advantage.

Zhipu trained GLM-5.3 specifically on data and environments built to find software vulnerabilities, and says the model began reasoning across multiple stages of exploitation and forming coherent plans for complete exploitation chains.

On CyberGym, which measures whether a model can identify and validate security flaws from source code, Zhipu reports 84.5 percent against Mythos 5 at 83.8 and GPT-5.6 Sol at 83.6. That is a Chinese open-weight lab claiming to edge Anthropic's most capable model on a cybersecurity evaluation.

The counterweight is in the same disclosure, and Zhipu published it rather than hiding it. On ExploitBench, which measures how far a model climbs the exploitation ladder, GLM-5.3 scores 54.4 percent against Mythos at 78 and Sol at 76.5. So it is competitive at finding and validating flaws, and well behind at actually chaining them into working exploits. That gap is the whole ballgame, and it is the reason the CyberGym headline should not be read as parity.

Zhipu also says security teams used the model to find 2,436 vulnerabilities across 269 open-source projects, some dating back 40 years, documented in a public registry. That number is Zhipu's, not independently verified, but it is at least checkable, which is more than most vendor claims offer.

Alibaba published Qwen3.8-2.4T-A95B on Hugging Face and ModelScope this week, confirmed independently by Nvidia's own deployment engineering blog walking through how to serve it on a GB300 rack. That is the first Max-class Qwen ever released as open weights, and it closes a promise made on August 3 that had already slipped past its stated window.

Now the fine print. The published weights are text-only and reportedly do not carry the 1 million token context the API version advertises, so the downloadable model is not the same artifact Alibaba sells you through QwenCloud. It ships under a new revenue-share license rather than a standard permissive one, which matters enormously if you plan to build a business on it. And Qwen3.8-27B, the small dense model committed for the same week and the one most developers were actually waiting for, has no repository, no model card, and no new date. Third-party trackers list it as delayed.

The 27B is the release that would have mattered most. Community estimates put a Q4 quant around 16 to 17GB, meaning it would run on a single 4090. A 2.4-trillion-parameter MoE is a datacenter artifact. The 27B was the one you could actually own.

Anthropic confirmed that Claude models launched on or after August 2 embed an invisible watermark into generated text, and attach signed C2PA provenance metadata to supported file types like SVG, PNG, and JPG. It covers the API, Claude, Claude Code, Claude Cowork, and Claude Tag. There is no opt-out, and Anthropic applied it worldwide rather than only in the EU.

The driver is the EU AI Act's Article 50 transparency requirements, which took effect August 2. Nearly 200 companies signed the accompanying code of practice, including Microsoft, Google, Meta, and OpenAI. Notably, OpenAI has reportedly had the technical capability to watermark for years and has not shipped it, and xAI did not sign at all.

The reaction has been loud, with Reddit threads full of people worried about being caught using Claude at work or in class. But for developers specifically, the outrage and the mechanism do not match up.

Watermarking works on statistical patterns across a stretch of text, which means it needs volume to produce a reliable signal. Prose that Claude Code emits, plan summaries, commit messages, PR descriptions, explanations in chat, is ordinary text and should carry the mark. Actual code is a much weaker case: it is highly constrained, often short, and a single format-on-save pass rewrites enough of it to function as an attack on a token-level watermark. A one-line fix or a commit subject falls below the threshold Anthropic itself names as too little text for reliable detection.

Anthropic has not published tests showing how the mark survives a normal pull request workflow, and acknowledges that editing, paraphrasing, translating, or combining output with other text degrades it. Independent testing found it does not survive aggressive paraphrasing that changes both word choice and syntax.

So the honest read cuts against both camps. If you were worried your repository is now statistically attributable to Claude, the mechanics are more reassuring than the headlines. If you were hoping this gives you real provenance tracking on AI-generated code for governance or audit purposes, it almost certainly does not.

The stories moving fast beyond today's headlines:

GLM-5.3. Zhipu shipped it August 14 through its coding plan, claiming a 50 percent coding gain over GLM-5.2 from extended post-training alone on an unchanged base, plus first place among open-source models on Terminal Bench 3.0 and Agents' Last Exam. It reports 84.5 percent on CyberGym against Mythos 5 at 83.8 and GPT-5.6 Sol at 83.6, while openly disclosing that it trails on ExploitBench at 54.4 against 78 and 76.5. Translation: good at finding flaws, well behind at chaining them into exploits. Weights are roughly two weeks out, license undisclosed.

Qwen 3.8 weights. Alibaba finally published Qwen3.8-2.4T-A95B on Hugging Face and ModelScope, the first Max-class Qwen ever made downloadable, confirmed by Nvidia's own deployment blog. The catch is threefold: the published file is reportedly text-only without the API version's 1 million token context, it ships under a new revenue-share license, and the Qwen3.8-27B most developers actually wanted has no repository and no new date.

Claude watermarks. Anthropic confirmed that models launched from August 2 onward embed invisible marks in generated text and signed C2PA metadata in supported files, across the API, Claude Code, Cowork, and Tag, with no opt-out and applied worldwide rather than just the EU. For developers, the mechanism matters more than the outrage: your commit messages and PR descriptions should carry the mark, your actual code probably will not survive a single format-on-save, and Anthropic has published no tests on whether it holds up through a pull request.

The through-line. Open weights has quietly become a spectrum rather than a binary, so the questions worth asking now are whether the weights are actually published, whether they match the model the API sells, and what the license permits at your revenue. And two labs in two weeks posting large gains from post-training on unchanged bases suggests the next round of improvements gets cheaper to chase than the scaling era taught everyone to expect. Every figure above is vendor-reported.

Stay building. 🤖