Radar Trends to Watch: September 2026 – O’Reilly

Coauthored with Claude

Midway through each month, I think “The next Trends is going to be small. Not much is happening.” This is the first time that I’ve been right. Was everyone on vacation in August? Am I becoming jaded? There were many model releases, though few of them seemed significant. Then again, it may be time to get over the one-upmanship by the frontier vendors and spend more time thinking about the myriad small and open-weight models. Every month, the best laptop-scale models (30B and smaller) seem closer to the leading frontier models. And every month, we’re seeing organizations realize that paying premium per-token prices for the latest frontier models gives at best a small advantage over the best open-weight models.

AI models

Capability and model size are decoupling. Several models here run comfortably on a laptop or a single accelerator while claiming performance close to much larger frontier systems. While it can be hard to work with a smaller model without thinking that you’re choosing “second best,” the biggest model isn’t always the right choice. Major releases aside, the most important news from August might be Anthropic’s deployment of watermarks for text. If the watermarking scheme works, it will be possible to tell which parts of an article like this were written by AI.

• OpenAI has announced that, beginning November 12, 2026, Cursor will no longer have access to their models.
• A mysterious model named Ox Alpha quickly became the most heavily used model on OpenRouter. Z.ai recently confirmed that Ox Alpha was GLM-5.3-Flash, a 320B open weight model that claims performance similar to Opus 4.8 and that has been deployed running entirely on Chinese chips.
• IBM’s Granite 4.2 is a small open-weight reasoning model that has been tuned for multistep tasks. It comes in 3B, 8B, and 30B sizes. It’s another model making the argument that small local models can be competitive with frontier models. 
• The team that developed Ornith-1.5 claims that they have made a major step toward self-improvement. The model supports a self-improvement loop in which it proposes new tasks, generates solutions, and uses reinforcement learning to apply the results to itself.
• DeepSeek-V4-Flash-Vision adds vision to DeepSeek V4’s capabilities. Images can be mixed with text; the model can describe images, extract text from images, and do other things that we expect from a leading LLM.
• Anthropic is now embedding watermarks into all of the text that its models generate or edit. The watermarks are apparently based on word choice; the algorithm “changes the source of randomness used to pick words.” We don’t (yet) know of any tools to detect the presence of a watermark, but there are already tools that claim to remove them. It isn’t clear that these tools work.
• A new benchmark, SWE-Bench ProMax, tests the ability of LLMs to do large-scale refactoring. It’s a multilingual benchmark based on real-world code in seven languages.
• Qwen3.8-27B is a small open-weight model that claims performance similar to Opus 4.6 max. It runs easily on a reasonably well-equipped laptop.
• Google has released Gemini 3.7 Flash, claiming improved coding and debugging.
• Z.ai has released GLM-5.3. It’s very similar to GLM-5.2, differing only in that it has received additional post-training. Z.ai claims that it’s better at code generation and long-running tasks.
• NVIDIA has released Nemotron 3.5 Lightning, an open-weight mixture-of-experts model with 30B parameters and 3B active parameters. Like many recent models, it’s optimized for long-running agents such as OpenClaw.
• Cactus Compute has released Needle 2, another small model that’s worth a look. It’s a 45B-parameter model that has been designed for “tool calling, device use, and structured extraction.” Needle requires only 28 MB of RAM, so it will run on many laptops and small devices and microcontrollers.
• Meta open-sourced Muse Glimmer, a 30B model designed for agentic applications. It can run on consumer hardware. Meta also released Muse Code and Muse Spark 1.2. Muse Code is a model designed for code generation. It implements an agent loop and a local event log that allows exact replays and restarts. Spark is a general-purpose model with near-frontier performance—Meta describes it as “a step towards the frontier.”

Software Development

Features that we associate with agents or harnesses, such as the ability to spawn subagents and delegate tasks to less-expensive models, are continuing to find their way into the models themselves. There’s also a countertrend: Individuals and organizations are building their own agents that are closely integrated into their working environment. Are we headed for walled gardens controlled by the leading providers? Or will a thousand flowers bloom, each reflecting an idiosyncratic way of working with AI? Don’t avoid tools from the major AI labs, like Claude Code and Codex, but don’t lock yourself into thinking that they’re the only option.

• DeepSeek has open-sourced Harness, its agent harness. What makes Harness unique is that almost everything is a plugin, so it’s extremely flexible. It can be used with many models, and can delegate work to Claude Code and Codex.
• TrueForge is an open source agent harness that can be used with any model. It includes tools to debug and govern agents in production.
• Computer History is a new feature of ChatGPT Work and Codex that records how you use your computer. It’s similar to Microsoft’s controversial Windows Recall, but it’s based on key clicks and other actions rather than screenshots. Data is stored locally rather than sent to OpenAI. It’s off by default.
• Zed’s Delta is a “multiplayer environment for coding with agents and reviewing what they build.” It’s a new take on Git and GitHub, designed specifically for the AI world. The company’s big insight is that the conversation about the code is as important as the code itself, and must be captured along with the source.
• Companies are now building their own agents (a.k.a. harnesses). While they’re still using AI services from Anthropic, OpenAI, and other providers, many organizations are finding that custom agents are a useful way to incorporate their own workflows into an AI-driven development process.
• Anthropic has added cross-session messaging to Claude Code. Messaging allows one agent to inform others about actions it has taken that might affect another agent’s work, reducing the need for a programmer to act as a communications medium.
• Agent Plugins is a standard for extending agents with plugins built from reusable components. It’s supported by OpenAI, Microsoft, Cursor, and AWS, though not by Google or Anthropic.
• OpenAI now has a hardware product. Codex Micro is a small terminal (certainly the wrong word) for remote AI work; it has 13 keys, a rotary encoder, a touch sensor, a joystick, and some status lights, and it hints at voice control (though I see no mention of a microphone). Its purpose is to allow you to control Codex workflows remotely.
• “Just because a feature is easy to build doesn’t mean that it is worth shipping”: Good advice on using AI effectively for software development.
• An update to the Model Context Protocol (MCP) addresses one of the most significant barriers to adoption by making it stateless.
• Software developers who didn’t grow up with Linux frequently haven’t discovered the art of the command line. Atomic Object recommends four terminal tools: Ghostty, tmux, lazygit, and lazydocker. Try one of them—or all.

Infrastructure and operations

Optimizing AI usage has become its own discipline, sometimes called “tokenomics.” Tokenomics can’t be separated from safety, which has also been much in the news. Disposable containers built for agents, GPU scheduling that treats accelerators as a heterogeneous pool, and infrastructure providers publishing how they actually serve open models at scale all match workloads to hardware without waste or risk. AI performance isn’t just about models; it’s about infrastructure. Understanding how the model is run will prove more important than the model’s specs and benchmarks.

• Taalas has built a chip that incorporates Llama 3.1 8B. All the weights are on the chip, which can’t be used for any other models. It’s extremely fast. Whether single-model chips make sense when new models are released almost daily is a good question.
• Docker Sandboxes are isolated disposable containers that are designed for running AI agents safely.
• Kubernetes’s Device Resource Allocation (DRA) makes it much easier to schedule jobs on heterogeneous clusters of GPUs.
• Cloudflare has published a description about how it runs the Kimi and GLM models at scale. It’s worth reading.
• WARP (formerly Waste) is an inference engine with one purpose: run Kimi K3 on a laptop. K3 is a 2.8T parameter model with 104B active parameters, typically requiring a small fleet of GPUs. WARP requires a 64 GB Macbook Pro with a few TB of disk. It’s slow (about 0.5 tokens/second), but it runs.

Security

Security work is inseparable from AI development, not a layer added afterward—but security professionals have been saying that about traditional software for years. Artificial intelligence is spawning new attacks as well as new defenses. While it’s always fascinating to look at new attacks, the most significant shift is in defense: rethinking security in terms of actions and resources rather than user identities, a change we’ve also covered on the Radar blog.

• Anthropic, OpenAI, Google and many other AI companies have signed an open letter saying that defense against cyberattacks has to become a priority for governments, and that governments and organizations need to act collectively to build defenses. 
• The Chrome browser has adopted device-bound service credentials (DBSC) to prevent session cookie theft, a critical step in account takeovers. DBSC stores an encryption key in a secure enclave or other trusted storage.
• There is now a Python library that supports ML-KEM and ML-DSA, NIST-standard key encapsulation and digital signature algorithms for postquantum cryptography.
• Simon Willison has published a timeline of OpenAI’s inadvertent attack against HuggingFace. His timeline is based on a postmortem that OpenAI presented at Black Hat. OpenAI has published a full incident report.
• The ChainDrop credential stealing malware has compromised over 1,300 packages on npm, the Node package manager. The malware is self-propagating, and compromised packages appear to have legitimate provenance.
• OpenAI has open-sourced Codex Security, a command-line tool and API that uses ChatGPT to analyze code for vulnerabilities. Their documentation says that the CLI and API are both in “limited beta,” possibly because of the model used to do the analysis.
• Context Collapse is a three-part series that discusses context poisoning attacks against Copilot, culminating with self-propagating attacks against Word. Microsoft collaborated on the analysis and mitigations.
• Google has introduced Beyond Zero, a new security model that takes zero trust a step further. Beyond Zero makes decisions on the basis of specific actions and resources, not just users or applications. Decisions are governed by both static policies and dynamic controls that can respond to changes in the environment.

People and Organizations

How do people use AI? Does AI use lead to greater productivity? We know surprisingly little about either question. We’re still learning how to use AI effectively; the best metric isn’t a simple measure of productivity but whether you can do things you couldn’t do before.

• The AI Observatory collects data about how people use AI. What we know about the ways people use AI is surprisingly limited. We know that usage patterns vary from model to model, but model providers only publish the data they want to see; we still don’t understand the big picture.
• How do you measure AI productivity? “Why AI Productivity Is a Faulty Metric” has some good ideas. Develop metrics around code quality and whether AI-generated code survives review, rather than counting lines of code.

Web

There’s now a specialized version of ChatGPT for teens; a site that serves different content to scrapers and humans; and an AI-generated animation of the start of The Lord of the Rings. The web is proving that it can adapt to anything that’s thrown at it. It’s where we learn and play, and AI isn’t changing that.

• OpenAI has launched ChatGPT for Teens, a specialized mode for users between 13 and 17 years old. This new product stresses learning and studying rather than using AI to get answers, has stronger content safeguards, and tries not to become a surrogate for human interaction.
• A theremin in the browser is something you don’t see every day! Use your mouse or your webcam to control it.
• TIME magazine has started giving AI scrapers a minimal Markdown version of articles with additional advertisements. The site’s behavior depends on the User-Agent HTTP header. Some user agents are denied access, while humans are given HTML with graphics and layout.
• Tired of pelicans on bicycles? Andrej Karpathy had Claude Opus animate the first paragraph of The Lord of the Rings with Three.js. The result isn’t great, but it’s certainly fun and points to some areas where the best current models aren’t yet strong enough.

Biology

• The National University of Singapore’s Life Sciences Institute now has a server rack where the computational power comes from 16 million lab-grown human neurons. Life support is a problem, but power consumption is a small fraction of the power required by GPUs.
• Claude has successfully run a complete protein design workflow, generating new designs for proteins that have been synthesized and tested in labs.
• There could be a fly on your desktop. This one is driven by a simulation of over 23,000 neurons from a fly’s connectome. It behaves like the real thing (macOS only).