Sam: Kimi just dropped the specs on K3 — 2.8 trillion parameters, open weights, one million token context window. And their benchmarks put it within striking distance of Claude Fable 5 and GPT-5.6 Sol, while beating Opus 4.8 and GLM 5.2 by meaningful margins. Full weights go public July 27th. What's interesting isn't just the performance — it's that this is an open-weight model from a Chinese lab that's approaching parity with the best closed frontier systems. And they're charging significantly more for it than its predecessor, which tells its own story about where the economics of this space are heading.

Priya: Welcome to AI Revolution for Friday, July 17th, 2026. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: We've got a packed show today. We're going to dig into Kimi K3 and what a 2.8 trillion parameter open-weight model means for the competitive landscape. Then OpenAI's GPT-Red — they've built an LLM specifically to attack their own models. We've got survey data showing that 54 percent of enterprises have already had an AI agent security incident, a $400 million financing deal that's shifting from training GPUs to inference chips, NVIDIA's new embedding model taking the top spot for retrieval benchmarks, and some policy moves from both the EU and Anthropic. Let's get into it.

Sam: So Kimi K3. Let's talk about what 2.8 trillion parameters actually means in practice, because that number lands differently depending on how the model is architected. We don't have full architectural details yet, but at that scale, you're almost certainly looking at a mixture-of-experts design, which means not all 2.8 trillion parameters activate on every forward pass. The active parameter count during inference is probably a fraction of that. That's how you make a model this large actually servable.

Priya: Right, and that's the same general approach DeepSeek used with V3 and R2. The total parameter count is enormous, but the compute cost per token stays manageable because you're only routing through a subset of experts for any given input. The question is always how well the routing works — are the right experts activating for the right tasks.

Sam: The million-token context window is also worth flagging. That's become table stakes at the frontier, but combining it with this parameter count in an open-weight release is new territory. For practitioners, what that means is you can potentially run this thing on your own infrastructure — once the weights drop on July 27th — and get near-frontier performance on tasks that require processing very long documents or maintaining context across extended interactions.

Priya: And here's the part I find most telling: they raised the price substantially compared to Kimi's previous models. For the past year and a half, Chinese AI labs have been competing aggressively on price — the whole narrative was that Chinese models were dramatically cheaper than Western equivalents. K3 signals that phase may be ending. Once you're training models at this scale with this kind of performance, the economics just don't support rock-bottom pricing anymore.

Sam: Exactly. The training compute for a 2.8 trillion parameter model is enormous regardless of where you're located. And the inference costs scale with model size even with mixture-of-experts efficiency. The cheap Chinese AI narrative was always partly subsidized by companies burning cash for market share. That's a strategy with an expiration date.

Priya: We should note these are Kimi's own benchmarks, so independent evaluation will matter a lot once the weights are out. But if the numbers hold up even roughly, the gap between the best open-weight models and the best closed systems has narrowed to a point where the distinction matters less for many production use cases.

Sam: Alright, let's shift to GPT-Red. OpenAI has built a dedicated LLM — they're calling it GPT-Red — whose entire purpose is to adversarially attack their other models. Think of it as an automated red teamer that can probe for vulnerabilities at a scale and speed that human red teams simply can't match.

Priya: So the idea here is straightforward but the implementation is genuinely interesting. Traditional red teaming for AI safety relies on human experts crafting adversarial prompts, trying to find jailbreaks, eliciting harmful outputs, testing edge cases. That process is slow and doesn't scale. You have maybe dozens of people spending weeks testing a model before deployment. GPT-Red can generate thousands of adversarial attack vectors and test them systematically.

Sam: The key technical question is how you train something like this. You need a model that's specifically good at finding failure modes in other models — which means it needs to understand the kinds of defenses those models have and develop strategies to circumvent them. It's essentially an adversarial optimization problem. You're training one model to maximize the probability of eliciting unwanted behavior from another model.

Priya: What makes this a meaningful development versus just another safety announcement is the scalability argument. As models get deployed into more contexts — agents acting autonomously, models processing sensitive data, systems making consequential decisions — the surface area for things to go wrong expands dramatically. You can't hire enough human red teamers to keep up. Automated adversarial testing isn't optional at that point, it's necessary.

Sam: And there's a natural arms race dynamic here. As your defensive model improves based on GPT-Red's findings, GPT-Red needs to get better at finding new attack vectors. That iterative pressure is actually what makes the approach powerful — each generation of attacks makes the target model more robust.

Priya: I'd watch whether other labs adopt similar approaches publicly. Anthropic and Google DeepMind have both talked about automated testing, but a dedicated adversarial model as a named, persistent part of the safety infrastructure is a specific commitment.

Sam: Now let's talk about something that connects directly to the real-world deployment picture — this VentureBeat report on agent security. They surveyed 107 enterprises and the numbers are stark. 54 percent have already had a confirmed AI agent security incident or near-miss.

Priya: Let me put the specific findings in context, because the details matter more than the headline number. Only about a third of these enterprises assign each agent its own scoped identity. That means the majority of AI agents in production are operating on shared credentials — the same credentials a human user or another agent might use. And only 30 percent isolate their highest-risk agents from other systems.

Sam: For anyone who's done security architecture, this should be alarming in a very specific way. When agents share credentials, you lose attribution. If an agent takes an action that causes damage — deletes data, accesses something it shouldn't, makes an API call with unintended consequences — you can't trace it back to which agent did it, or why. You also can't scope permissions properly. Shared credentials mean every agent has the same access level, regardless of what it actually needs to do.

Priya: And the security tooling gap is just as concerning. Most enterprises are borrowing security tools from their model providers rather than building or buying purpose-built agent security infrastructure. That's like using your database vendor's built-in access controls as your entire security strategy. It covers some basics but misses the systemic picture.

Sam: The fundamental issue is that agent deployments have outpaced identity and access management practices. We know how to do scoped identities, least-privilege access, and isolation for human users and for microservices. The same principles apply to agents, but organizations haven't extended their IAM frameworks to cover this new category of actor.

Priya: And the urgency is real because agents are getting more autonomous and more connected to production systems. Every week, the blast radius of an agent security failure gets larger.

Sam: Alright, shifting to infrastructure. TechCrunch is reporting on a $400 million financing deal that's specifically structured around inference chip assets — not training GPUs. This is coming from the same financiers who pioneered GPU-backed lending.

Priya: This is a market signal worth paying attention to. For the past three years, the compute gold rush was almost entirely about training — getting enough H100s and then B200s to train the next frontier model. Financing deals were structured around training GPU clusters as collateral. This deal reflects a shift in where the actual sustained demand is.

Sam: The math has changed. Training a frontier model is a massive but finite compute event — you do it once, maybe you do a few runs, and then you're done until the next generation. But inference — actually serving the model to users and applications — is continuous and growing. Every new deployment, every agent, every API call is inference compute. As AI moves from research labs into production at scale, inference becomes the dominant workload.

Priya: And inference-optimized chips have different design trade-offs than training chips. Training requires massive floating-point throughput and high-bandwidth interconnects between chips. Inference cares more about latency, throughput per watt, and cost per token. The fact that financiers are now collateralizing inference-specific hardware tells you they see that as where the durable revenue streams are.

Sam: Quick hit — NVIDIA's Nemotron 3 Embed just took the number one overall spot on the Retrieval Text Embedding Benchmark, RTEB. This matters for anyone building RAG systems or agentic retrieval pipelines. Embedding quality is foundational to retrieval accuracy — if your embeddings don't capture semantic similarity well, your entire retrieval pipeline degrades. NVIDIA now has a top-ranked open model in this space, available on Hugging Face.

Priya: Two policy stories worth noting together. The EU has ordered Google under the Digital Markets Act to give AI rivals greater access to Android. This affects billions of devices and sets a precedent for how AI assistants get distributed on mobile platforms. Google is apparently positioning compliance as a strategic advantage — openness as a competitive moat rather than a concession.

Sam: And separately, Anthropic is actively pushing US states to accelerate AI regulation. What's notable is that Anthropic's own head of state and local policy is saying that AI transparency laws Anthropic helped pass in California and New York last year may already be outdated. That's a remarkably candid admission about the pace of capability development versus the pace of legislation.

Priya: It creates this paradox where even the laws specifically designed for AI can't keep up with the technology they're meant to govern. If a law takes 18 months from draft to enforcement and model capabilities shift fundamentally every six months, the regulatory framework is always addressing the previous generation of concerns.

Sam: And briefly — a former DeepMind researcher, Andrew Dai, raised at a $300 million pre-seed valuation with no product. The thesis is visual AI as the next major frontier. That valuation tells you more about the talent premium in this market than about any specific technology.

Priya: Let's look ahead. What do today's stories collectively tell us about where things are going?

Sam: I see two threads converging. First, the capability gap between open and closed models is compressing fast. K3 is the latest data point, but it's part of a clear trend. That has huge implications for how organizations think about build versus buy, and for the competitive dynamics between labs.

Priya: And second, the infrastructure and security challenges are scaling faster than the solutions. Agents in production with shared credentials, security tooling borrowed from vendors, inference demand outpacing training as the primary compute workload. The industry is building the plane while flying it, and some of these planes are carrying real passengers now.

Sam: The next two weeks are going to be telling. K3 weights drop July 27th, and independent benchmarks will either validate or complicate Kimi's claims. That's the thing to watch.

Priya: That's our show for today. Show notes and links to everything we discussed are at cleartext.fm. Have a great weekend, everyone.

Sam: See you Monday.