Kimi K3 opens 2.8T weights, Galahad caches 180 problems, StateAct cuts cost 9×

TL;DR

• Kimi K3 ships as a 2.8T-parameter MoE with a 1M-token context window and native vision.
• K3 clocks 32.2% on ExploitBench vs 76.2% for leading US models, per UK/US safety institutes.
• Corbenic’s Galahad hits 100% on 180 problems at 0 generation tokens by retrieving verified solutions.
• Salesforce’s StateAct drops OSWorld 2.0 cost from $72 to $7.80 per task via a code-first main agent.
• StateAct’s 26.9% on Opus 4.8 sits far below Opus 5 stock at 70.6% on the same benchmark.

Three research drops today, three big numbers, three different reasons to squint — and no single frame that holds across all of them. Moonshot’s Kimi K3 is a genuine open-weights milestone at 2.8T parameters with a 1M-token context and native vision, but the UK/US safety institutes clock it at 32.2% on ExploitBench against 76.2% for the leading US closed models, well below the frontier-cyber framing. Corbenic’s Galahad posts a perfect 180/180 at 0 generation tokens because a content-addressed store is returning verified solutions next to a frozen 12B — the model isn’t doing the lifting, and no third party has reproduced the number.

Salesforce’s StateAct is the most operationally useful result: a real 9× cost cut on OSWorld 2.0 via a code-first main agent that invokes the GUI subagent on only 1.1% of steps. The catch is timing — the win is measured on Claude Opus 4.8, and Opus 5 with a stock harness already scores 70.6%, well above StateAct’s 26.9%. Read each feature on its own terms.

Moonshot’s Kimi K3 sets open-weights SOTA at 2.8T params

Source: hf-daily-papers · published 2026-07-26

TL;DR

• Kimi K3 ships as a 2.8T-parameter MoE (104B active) with native vision and a 1M-token context window.
• The White House accuses Moonshot of industrial-scale distillation from Claude, citing 24,000 fraudulent Anthropic accounts and 16M+ interactions.
• Self-hosting the 1.4 TB MXFP4 checkpoint needs 12–16 H200/B200s to load and a 64-GPU supernode in production — ~$38/hour rented.
• UK/US safety institutes clock K3 at 32.2% on ExploitBench vs. 76.2% for leading US models, puncturing the frontier-cyber framing.

What actually shipped

Moonshot’s report is dense with architecture: Kimi Delta Attention plus periodic Gated MLA for hybrid long-context, Attention Residuals that let layers pull from all predecessors, and a Stable LatentMoE routing 16 of 896 experts per token with Quantile Balancing in place of an auxiliary loss. The claimed payoff is a 2.5× scaling-efficiency gain over K2 and benchmarks that trail only Claude Fable 5 and GPT-5.6 Sol — 93.5% on GPQA Diamond, 81.2% on FrontierSWE, 91.2% on BrowseComp. On paper, this is the strongest open-weights release to date.

Practitioners largely agree, with an asterisk. Zvi Mowshowitz calls K3 the best open model “purely in terms of raw capability” but “jagged,” and MindStudio’s trap-designed engineering suite shows K3 failing multi-step planning problems Claude solves cleanly ¹. That matches the paper’s own admitted HLE gap — best-of-open, still second-tier frontier.

The distillation shadow

The report never mentions it, but the release landed inside a diplomatic incident. White House science adviser Michael Kratsios formally accused Moonshot of “large-scale covert industrial distillation,” with Anthropic reporting roughly 24,000 fraudulent accounts producing 16M+ Claude interactions harvested for training ². Independent researchers pushed back hard: Nathan Lambert and others note distillation is a standard industry technique, and there’s a timeline problem — K3 shipped 15 days after Fable 5, an implausibly short window for Fable 5 to be the teacher ³. The upshot: “open frontier” is a contested label, and the paper’s silence on provenance is a choice, not an oversight.

Cyber: strong bug-finder, weak exploiter

Kimi K3’s most vivid claim — 16 Linux-kernel zero-days plus hundreds of real-world vulnerabilities — got partial corroboration when a K3 agent swarm reportedly produced a working RCE against Redis 8.8.0 in 27 minutes; Redis shipped emergency patches for seven confirmed memory flaws on 23 July, though it did not validate the timing or autonomy claims ⁴. Then the UK AISI / US CAISI joint evaluation landed: 32.2% on ExploitBench against a 76.2% US-model average, and zero successful arbitrary code execution across 41 Chrome V8 tasks ⁵. The report’s own Tier-2 admission (39% end-to-end exploit rate against hardened targets) squares with this. Evaluators also flag that K3 rarely refuses offensive requests — a guardrail delta the technical report elides ⁵.

”Open” with an asterisk

The deployment economics quietly reshape who “open weights” is for. Even at MXFP4, the 1.4 TB checkpoint needs 12–16 H200/B200 GPUs just to load, and Moonshot’s recommended production topology is a 64-accelerator supernode: roughly $27,800/month rented or $2.6M–$4.1M CAPEX with $130k+/year in electricity ⁶. For every lab outside the hyperscaler tier, K3 is functionally an API model that happens to ship weights. That’s a real capability release — but it’s not the democratization the “open frontier” framing implies.

---

Salesforce’s StateAct cuts computer-use agent cost 9×

Source: hf-daily-papers · published 2026-07-23

TL;DR

• Salesforce’s StateAct drops OSWorld 2.0 cost from ~$72 to ~$7.80 per task.
• The GUI subagent fires on just 1.1% of steps, because the main agent works code-first via bash and files.
• Binary success rises 20.6% → 26.9% on Claude Opus 4.8, while Opus 5 already hits 70.6% with a stock harness.
• A narration-blind finish gate caught only 8 of 76 non-perfect runs, since the verifier shares the actor’s source data.

Pixels are a lossy rendering of the thing you actually care about

The pitch is that a screenshot is a bad interface to a computer. Rendering is non-injective — different program states can produce identical pixels — and tasks are graded on persisted artifacts (a saved formula, a row in a database), not on what the agent saw. So StateAct’s main agent gets a bash shell, a Python interpreter, and a structured file editor, and is told to find where the app keeps its data and modify it directly. A GUI subagent exists as a fallback for irreducibly visual work; a web subagent serializes the DOM to Markdown. The main loop never touches a mouse.

That framing pays off on token economics before it pays off on accuracy. A 1080p screenshot costs roughly 16k tokens; a 4K display exceeds 50k per action ⁷. Sidestepping that is how the harness lands a ~9× cost cut on OSWorld 2.0, and why the GUI subagent only fires on 1.1% of steps and 28 of 108 tasks ⁸.

flowchart LR
    T[Task instruction] --> M{Main agent<br/>bash + Python + editor}
    M -->|reads/writes| S[(Program state:<br/>files, DOM, SQLite)]
    M -.fallback 1.1%.-> G[GUI subagent<br/>screenshot + click]
    M -.web tasks.-> W[Web subagent<br/>DOM → Markdown]
    M --> F{Narration-blind<br/>finish gate}
    F -->|inspects| S
    F -->|pass/retry ×3| D[Done]

The accuracy number is already stale

The 20.6% → 26.9% binary lift on OSWorld 2.0 (Claude Opus 4.8) is real, but the leaderboard has moved. Claude Opus 5 reportedly reaches 70.6% on the same benchmark using a standard CUA harness ⁹ — meaning a model swap delivered roughly three times the absolute gain the harness bought. The durable claim here is architectural: code-first action space, fresh-context specialists for long horizons, an externalized checklist re-injected each turn, and a verifier that doesn’t trust the actor’s story. The 26.9% will age. The design pattern probably won’t.

Worth flagging the name collision: “StateAct” was already taken by Rozanov & Rei’s 2024 text-agent paper, which used “chain-of-states” prompting on ALFWorld and WebShop ¹⁰. Same brand, different regime — the through-line is “track state explicitly,” not shared code.

What the finish gate can’t see

The narration-blind verifier is the paper’s most interesting idea: spawn a fresh agent that sees only the original task and the machine, and have it check the persisted result. It catches structural failures — wrong path, unsaved file — cleanly. It doesn’t catch value errors. Of 76 non-perfect runs it rejected only 8, because the verifier reads the same source data the actor misread and arrives at the same wrong answer ⁸. Failure analysis backs this up: 38 of 79 unsuccessful tasks failed on reasoning, not perception. Independent commentary on the state of the field says the same thing — agents now lose to constraint-tracking and hidden-state recovery, not GUI syntax ¹¹.

Verifiers built from the same task text as the actor cannot catch value-level errors.

One gap the paper doesn’t address: an agent whose main mode is writing to SQLite and DOM directly has a wider blast radius when a prompt injection lands. Salesforce’s own Agentforce shipped the CVSS-9.4 ForcedLeak bug in 2025, where a poisoned Web-to-Lead field exfiltrated CRM data ¹². The finish gate is a correctness check, not an adversarial one — nothing in the harness treats the state surfaces the main agent is told to trust as themselves untrusted. No public repo has surfaced yet, so independent stress-testing will have to wait.

---

Corbenic’s frozen 12B beats frontier only on cached problems

Source: hf-daily-papers · published 2026-07-25

TL;DR

• Corbenic’s Galahad hits 100% on 180 problems at 0 generation tokens by reusing verified solutions beside a frozen 12B.
• Approximate retrieval fails 94.3% on the same store where exact content addressing hits zero collisions.
• Bit-exactness holds only under a pinned deterministic config on NVIDIA Blackwell and Hopper silicon.
• No third party has reproduced the 180/180 result on single-author benchmarks with multi-day repro timelines.

The pitch: frozen model, growing memory

Corbenic’s industry report on Galahad inverts the standard capability-growth playbook. Instead of retraining a bigger model, the 12B weights stay static and a verified-solution memory grows beside them. Once a problem family passes an answer-key-free verification gate — formal proofs, metamorphic consistency checks, 150 boundary cases — every subsequent instance is answered by re-executing the stored parameterized method at 0 generation tokens, 6–23 ms latency, and roughly 36 mWh per answer. The headline number: 180/180 across nine families, invariant across Gemma-4-12B, Qwen3-14B, DeepSeek-Coder-V2-Lite, and Phi-4.

flowchart LR
    Q[New query] --> M{Merlin exact-match?}
    M -- hit --> R[Reuse verified method<br/>0 gen tokens, 6-23ms]
    M -- miss --> S[12B solve pass]
    S --> V{Verification gate<br/>proofs / consistency / 150 boundary cases}
    V -- pass --> D[Deposit to memory]
    V -- fail --> X[Discard]
    D --> R

The catch: it’s a cache, not a capability

The most revealing number is one Corbenic buries and TinyCrafts pulls out: on the same 4,500-item store where exact content addressing hits zero collisions, approximate similarity retrieval fails 94.3% of the time ¹³. That inverts the framing. Galahad doesn’t beat frontier models on reasoning — it beats them on the narrow slice where a SHA-256 hash of the query matches a hash already in memory. AI Weekly repackages the flagship comparison as a “trick”: the grafted 12B answers in ~61 tokens versus a 400,000+ token reasoning chain, claiming an 8,700× energy gain ¹⁴. That is a cache-hit story dressed as an intelligence story.

The authors are actually explicit about this in the limitations — Galahad is not for cold-start reasoning — but the title (“Beats Frontier Models”) and the “Frontier Inversion” section elide it.

Determinism has fine print

The “forever” in the title is conditional. Follow-on writeups pin down that byte-exactness has only been demonstrated under a “pinned deterministic configuration” on NVIDIA Blackwell and Hopper; moving a byte-identical store to different silicon is not guaranteed to reproduce ¹⁵. Schelpe’s prior KV-cache grafting preprint sharpens the constraint further: only an own-position graft is numerically exact, because shifting a KV block to a different absolute position introduces RoPE floating-point residuals that break bit-equality ¹⁶. In practice, “bit-exact forever” means “bit-exact on this GPU family, at these positions, under this config.”

What’s actually load-bearing

The plumbing is credible. Merlin, the underlying deduplication engine, is separately documented at 8.7 GB/s throughput and ~1.1 µs median latency using an SIMD-friendly open-addressing hash set with xxHash3-64, with input reductions from 13.9% to 71%+ on public corpora ¹⁷. The 6-million-token movable window on a 46 GB GPU is a real engineering result where vLLM and SGLang silently truncate past ~32k.

What isn’t yet load-bearing is the headline. ArxivLens’s tracker flags the release with two explicit risk markers — “sparse artifact coverage” and “low confidence” utility — and estimates a multi-day reproduction timeline before anyone can independently confirm 180/180 ¹⁸. Everything ultimately traces to one author’s self-reported benchmarks on infrastructure only that author has run ¹³. The right way to read Galahad today: a plausible caching substrate with a defensible engineering core, wrapped in a capability claim that no one outside Corbenic has verified.

Round-ups

Multi-agent protocol distillation closes open-source agentic search gap

Source: hf-daily-papers

Since proprietary teachers block logit-matching, the method distills reasoning trajectories through a multi-agent protocol that densifies supervision beyond sparse RL rewards. The approach narrows the distribution gap between closed and open models on knowledge-intensive agentic search, drawing 82 upvotes on Hugging Face.

PlanPhys isolates how agents learn long-horizon planning

Source: hf-daily-papers

A controlled multi-turn environment dissects planning across pre-training, single-teacher, and multi-teacher on-policy distillation stages, replacing opaque internet data with precise supervision. The setup lets researchers trace how planning ability is acquired, shaped, and integrated in foundation model agents.

PAJAMA distills LLM judges into inspectable scoring programs

Source: hf-daily-papers

Instead of calling an LLM at evaluation time, PAJAMA compiles judge decision logic into a committee of programs that score candidates directly. The programmatic judges cut cost and latency while making decisions transparent and editable, unlike opaque LLM-as-a-judge pipelines.

Reasoning Denoiser strips noisy steps to catch hallucinations

Source: hf-daily-papers

Long reasoning traces from large reasoning models hide truthfulness cues behind irrelevant and repetitive steps. The Reasoning Denoiser removes both noise types before hallucination detection, restoring signal that noisy trajectories otherwise degrade substantially.

Quote-and-retrieve replaces bounding boxes for document evidence

Source: hf-daily-papers

Coordinate-based evidence attribution triggers Attribution Hallucination, where vision-language models mark the wrong regions even when answers are correct. The method drops coordinates and region labels, letting models quote textual evidence and retrieve its location afterward for reliable visual document understanding.

Shared vocabulary standardizes multi-agent research system design

Source: hf-daily-papers

The framework specifies eight axes — agent roles, available operations, invocation rights, communication, information visibility, action selection, run initiation, and output evaluation — so trajectories from different automated research systems become directly comparable across papers and implementations.

Warp divergence study spans Pascal through Blackwell GPUs

Source: hf-daily-papers

Cycle-accurate microbenchmarks across Ampere, Hopper, and both datacenter and consumer Blackwell chips test the assumption that Independent Thread Scheduling fixed warp divergence after Volta. Divergent paths still serialize linearly across every generation, with SASS analysis separating stable behavior from architectural shifts.

Footnotes

1. Puter.com — Kimi K3 review (citing Zvi Mowshowitz) — https://developer.puter.com/blog/kimi-k3-review/

   Zvi Mowshowitz calls K3 the strongest open model ‘purely in terms of raw capability’ but ‘jagged’ and likely several months behind closed frontier; MindStudio’s trap-designed engineering tests show K3 fails multi-step planning problems where Claude succeeds.

   ↩

2. SCMP — Trump tech official accuses Moonshot of stealing from Anthropic — https://www.scmp.com/news/us/diplomacy/article/3361510/trump-tech-official-accuses-chinas-moonshot-ai-stealing-anthropic

   White House science adviser Michael Kratsios accused Moonshot AI of ‘large-scale covert industrial distillation’ from Claude Fable 5, with Anthropic reporting roughly 24,000 fraudulent accounts generating over 16 million interactions used for distillation.

   ↩

3. SCMP — Global AI experts push back on US distillation claims — https://www.scmp.com/tech/tech-war/article/3361625/global-ai-experts-push-back-us-distillation-claims-against-moonshots-kimi-k3-model

   Researchers including Nathan Lambert note distillation is a standard industry technique; critics point to a ‘timeline problem’ — K3 shipped 15 days after Fable 5, an implausibly short window to distill from the newer model.

   ↩

4. AI Weekly — Redis zero-day report — https://aiweekly.co/alerts/kimi-k3-agents-reportedly-find-19-redis-zero-days-rce-in-27-min

   A swarm of Kimi K3 agents reportedly identified 19 zero-days in Redis in 90 minutes and produced a working RCE against Redis 8.8.0 in 27 minutes; Redis confirmed seven underlying memory flaws and shipped emergency patches on 23 July 2026 but did not validate the autonomy or timing claims.

   ↩

5. Yutori Scouts — UK AISI / CAISI joint cyber evaluation — https://scouts.yutori.com/83ec7059-41df-4815-be48-9138f0295a39

   On ExploitBench, Kimi K3 scored 32.2%, well below the 76.2% average of leading US models, and failed to achieve arbitrary code execution on any of 41 Chrome V8 tasks — though it completed 17 of 32 steps in ‘The Last Ones’ network simulation and rarely refused offensive requests.

   ↩ ↩²

6. DigitalOcean — Self-hosting Kimi K3 — https://www.digitalocean.com/community/conceptual-articles/self-hosting-kimi-k3

   The 1.4 TB MXFP4 checkpoint needs 12–16 H200/B200 GPUs just to load, with Moonshot recommending 64-accelerator ‘supernodes’; rented Blackwell serving is estimated at ~$38/hour ($27,800/month) and on-prem CAPEX runs $2.6M–$4.1M with >$130k/year in electricity.

   ↩

7. UsageBox — ‘Cost per task: workhorse models 2026’ — https://usagebox.com/articles/cost-per-task-workhorse-models-2026

   A standard 1080p screenshot consumes roughly 16,000 tokens, while a 4K display can exceed 50,000 tokens per action… developers use PreToolUse hooks to trim redundant file reads, cutting total consumption by up to 90%.

   ↩

8. AI Weekly — ‘StateAct cuts computer-use agent cost 9x on OSWorld 2.0’ — https://aiweekly.co/alerts/stateact-cuts-computer-use-agent-cost-9x-on-osworld-20

   The main agent required the GUI subagent for only 1.1% of its total steps… narration-blind finish gate spawns a fresh agent that only sees the original task and machine access, verifying persisted results rather than trusting the agent’s account.

   ↩ ↩²

9. Snorkel AI — OSWorld 2.0 leaderboard — https://snorkel.ai/leaderboard/os-world-2-0/

   Claude Opus 5 has established a new state-of-the-art on OSWorld 2.0 with a success rate of 70.6%… compared to Claude Opus 4.8 which peaked at 20.6%.

   ↩

10. Rozanov & Rei, arXiv:2410.02810 (original ‘StateAct’, 2024) — https://arxiv.org/abs/2410.02810

    StateAct enhances LLM agents through self-prompting and chain-of-states… improved by 10-14% on ALFWorld, 30% on Textcraft, and 7% on Webshop, establishing a new state-of-the-art for few-shot in-context learning on these benchmarks.

    ↩

11. Medium (Adnan Masood) — ‘The Hardest Easy Problem in AI: Computer-Use Agents’ — https://medium.com/@adnanmasood/the-hardest-easy-problem-in-ai-the-state-of-computer-use-agents-a7e3aea7fa3a

    Agents no longer struggle with basic GUI controls or syntax; they frequently fail by losing track of long-term constraints, skipping necessary verifications, or failing to recover hidden states during multi-step processes.

    ↩

12. Inspired eLearning — ‘ForcedLeak Breaks Salesforce AI Agents’ — https://inspiredelearning.com/blog/forcedleak-breaks-salesforce-ai-agents/

    The ForcedLeak vulnerability (CVSS 9.4) in Salesforce’s Agentforce allowed indirect prompt injections hidden in a Web-to-Lead form to trick agents into exfiltrating sensitive CRM data.

    ↩

13. TinyCrafts Chronicle (2026-07-19 daily) — https://chronicle.tinycrafts.ai/daily/2026-07-19/

    claims are ‘big enough to deserve a careful read,’ but they currently stem from a single author and self-reported benchmarks; approximate similarity retrieval reportedly fails 94.3% of the time on larger stores

    ↩ ↩²

14. AI Weekly — ‘Gemma-4-12B tops 31B on AIME via KV cache grafting trick’ — https://aiweekly.co/alerts/gemma-4-12b-tops-31b-on-aime-via-kv-cache-grafting-trick

    grafting ‘verified solution libraries’ allows the 12B model to answer in as few as 61 tokens instead of re-processing a 400,000+ token reasoning chain, cited as up to 8,700× energy efficiency gain

    ↩

15. AIModeling.com news writeup — https://www.aimodeling.com/en/news/7f723663-8405-43aa-b31e-73efd714fa97

    byte-exactness verified only under a ‘pinned deterministic configuration’ on NVIDIA Blackwell and Hopper — moving a byte-identical store between machines is only guaranteed if they share the same underlying architecture

    ↩

16. arXiv 2607.14431 — Schelpe, KV-cache grafting prior work — https://arxiv.org/abs/2607.14431

    ‘own-position graft’ is identified as the unique numerically exact operating point; shifting a KV block to a different absolute position introduces RoPE floating-point residuals that break bit-exactness

    ↩

17. ResearchGate — Schelpe, ‘Byte-Exact Deduplication in RAG’ (Merlin paper) — https://www.researchgate.net/publication/404666998_Byte-Exact_Deduplication_in_Retrieval-Augmented_Generation_A_Three-_Regime_Empirical_Analysis_Across_Public_Benchmarks

    SIMD-friendly open-addressing flat hash set paired with xxHash3-64 … sustained 8.7 GB/s, median in-process latency ~1.1 µs; input-size reductions from 13.9% (low-redundancy) to >71% (WildChat-like)

    ↩

18. ArxivLens popular-papers tracker — https://arxivlens.com/popularpapers

    flags the project with two ‘risk flags,’ citing ‘sparse artifact coverage’ and a ‘low confidence’ utility signal … estimates a multi-day reproduction timeline for meaningful verification of the results

    ↩