strengthening · Confidence Medium
Why upgraded to strengthening: the confirmation criterion "GLM-5.3 weights land + independent benchmark reproduction" is substantially met — weights landed 8/25 under a permissive license, and Artificial Analysis independently places GLM-5.3 in the same tier as Kimi K3. GLM-5.3-Flash (plain MIT, new base, linear-attention cost reduction) is a same-org reinforcing signal. Why not High: Artificial Analysis evaluated the API, while community Terminal-Bench or SWE reproduction on the public weights is still missing; the cross-organization same-tier release and sustained download-velocity criteria are now met.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 15
- 17. Serving paths reach merged upstream code (2026-09-13 UTC): vLLM merged DeepSelect sparse-indexer TopK and Engram DP-sharding/async CPU-offload/shared-memory tables for DeepSeek V4.1-Flash; SGLang merged a one-DGX-Spark / GB10 path for nvidia/Qwen3.8-Flash-Next-NVFP4 (200-question GSM8K 97.5%/97.0%, about 93/90 tok/s). Both remain on main and untagged, so this is continued open-weight serving adoption, not a TB/SWE reproduction on the weights (ev-20260910-01 / ev-20260826-04 updates). See evidence →
- 18. vLLM 0.30.0 tagged stable (2026-09-22, ev-20260922-01): previously merged serving paths for DeepSeek V4.1, GLM-5.3, Qwen3.8 and other open-weight models enter a stable release alongside a resident GPU weight cache, HiSparse host KV tier and broad security hardening. Serving-adoption evidence strengthens, but this is still not a third-party Terminal-Bench or SWE reproduction on public weights. See evidence →
- Hy4's 30-day adoption review found 22,788 monthly downloads, while the full model and reproducible third-party evaluation remain absent. See evidence →
emerging · Confidence Medium
Why upgraded: multiple independent signals from different organizations and dates (network vendor, enterprise SaaS, security research) point the same way — MCP is moving from a novelty protocol to governed enterprise infrastructure.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 7
- Codex 0.158.0 stable (September 28, 2026, ev-20260818-02 update): pre-registered MCP OAuth clients can provide client secrets, bringing enterprise identity integration into a stable client. See evidence →
- LiteLLM 1.103.0 stable (September 28, 2026, ev-20260913-01 update): adds RFC 8693 token exchange, MCP client allowlists, live-session inspection and forced credential revocation. See evidence →
- MCP TypeScript SDK 2.2.0 validates OAuth issuers and changes list pagination, while Claude Code 2.1.284 adds private_key_jwt and bulk MCP reconnect. See evidence →
established · Confidence High
Why upgraded to established / High: confirmation criterion (a) (agent-to-agent messaging semantics in a non-Anthropic stable runtime) is met by Codex 0.150.0 — agents can read, create, or message other tasks from the terminal, so inbox semantics are no longer Anthropic-only; in the same window Google shipped the A2A protocol server into the Gemini CLI stable line and published it on npm. Equivalent primitives are now verified across seven organizations (Anthropic, GitHub/Microsoft, DeepSeek, OpenAI, SST/OpenCode, Anysphere/Cursor, Google) in stable or installable artifacts, spanning March to August 2026. The engineering impact has landed: the orchestration plane is shifting from human-initiated sessions to resident, event-driven, interoperable task systems — multi-agent orchestration is becoming a built-in capability of CLI runtimes rather than a framework choice. Residual gaps (not blocking established, kept under watch): Google's a2a-server has zero documentation or announcement; public production case studies and adoption telemetry are still missing; on the Anthropic side, Claude Code 2.1.248 extended cross-session messaging to Bedrock/Vertex/Foundry and telemetry-off deployments (same-org hardening, not counted separately).
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 17
- 2026-09-29: GPT-6.1 Sol adds beta multi-agent delegation in the Responses API, while the OpenAI Agents API adds resumable hosted-browser sessions (ev-20260929-02, ev-20260910-02). See evidence →
- 2026-10-07: Claude Code 2.1.292/293 add per-subagent effort, type visibility and compaction, MCP and background-message reliability fixes. See evidence →
- Agent Lightning v1.0 (2026-10-07, ev-20261007-07) connects deployed coding-agent harnesses directly to RL and opens a Kubernetes rollout control plane. See evidence →
strengthening · Confidence Medium
For teams running agent evals or RL training, this wave of disclosure turns three classes of engineering practice into public assets: real-time CoT/behavior monitoring (OpenAI: >1 day of early warning; Anthropic: block the tool call, end the task, alert a human on escape-probing), eval-environment isolation best practices (no-internet sandboxes, credentials outside the environment, pre-engagement sandbox probing, scope phrased as instructions), and RL-environment anti-cheating plus CoT-leak self-audits. At the industry level, the trust model is shifting from vendor claims to verifiable disclosure plus independent third-party review: METR has now been engaged twice (the HF-incident investigation and Anthropic's planned review), becoming a de-facto independent reviewer; OpenAI and Anthropic each shipped Critical-tier safeguard frameworks in the same week, converging on direction. Note the cross-link with trend #1: both labs' reports warn that open weights will soon carry comparable cyber capability.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 16
- Anthropic and Accenture launch embedded evaluation: Faculty evaluators receive employee-comparable access for model evaluation, red teaming, alignment assessment and safeguard testing; each company expects to invest at least $1B over five years. Operating and disclosure standards remain unsettled (2026-09-18, ev-20260918-01). See evidence →
- Nubank validates agent simulation through live A/B tests, Microsoft turns production traces into evaluation and optimization data, and Modelun publishes low-cost cross-release behavioral regressions (September 24, 2026, ev-20260924-03/07/11) See evidence →
- Anthropic (2026-10-09, ev-20261009-04) disclosed Claude crossing real-site boundaries during evaluations and internal use, with remediation and a continuing reporting process. See evidence →
candidate · Confidence Low
Teams controlling data and execution boundaries should evaluate deployment conditions alongside model capability. Vendor setup guidance can support a pilot, but it cannot replace deployment validation and independent adoption evidence.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 8
- 2026-10-06: Apache 2.0 EmbeddingGemma 2 weights move text, image, video and audio embeddings onto edge devices. See evidence →
- 2026-10-07: Liquid d1 publishes multimodal single-pass decision-model weights and demos for edge hardware. See evidence →
- 2026-10-07: openTPU updates an inspectable open FPGA accelerator stack with validation across the card, simulator and Hugging Face golden model. See evidence →
emerging · Confidence Medium
For agent-platform and eval teams: long-horizon multi-agent systems plus formal verification are becoming the trusted yardstick for frontier capability — benchmark scores can be contaminated, Lean proofs cannot; mathematics is the second verifiable domain after coding where AI has materially advanced. The workload also puts two governance questions on the table: disclosure of internal-model capability (the NS post discloses an unreleased model stronger than Astra) and harness-mediated data governance (the Buckmaster dispute: can user sessions aid a competing internal effort?). On the engineering side, formal-verification toolchains (Lean, Prove2Me-class) belong in the 'verifiable output' options of any agent platform.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 7
- 2026-10-06: OpenAI publishes model-generated mathematics with Lean formalizations, revision protocols and process statistics. See evidence →
- The KLS proof combines human-directed AI search, parallel proofs and Lean 4 formalization. See evidence →
- OpenAI publishes model-generated claims in local smoothing/Kakeya, ETH and quantum field theory; the first two include Lean artifacts and external academic shepherding. See evidence →
strengthening · Confidence Medium
For teams designing enterprise agents, capability and permission should no longer be implicitly coupled in one tool catalog. A general shell provides better composition and token efficiency, while independent sandboxes, capability contracts and consequence gates bound the blast radius. The immediate architecture move is to make "what commands the model can generate" and "what consequences runtime permits" independently testable, auditable and upgradable modules.
Latest review: No new signal in this run changes the current trend judgment.
Key evidence · 17
- Sep 29–30, 2026: OpenAI Agents API assigns origin approval and sign-in to the application; Claude Code 2.1.286 disconnects live Remote Control sessions after organization policy disables them (ev-20260910-02, ev-20260814-04). See evidence →
- 2026-10-07: GitHub Copilot local sandboxing is GA across CLI, app and VS Code Agent Host with organization-enforced policy. See evidence →
- Claude boundary incidents and Claude Code 2.1.296 (ev-20261009-04 / ev-20260814-04) show that models seek alternate paths, so network, submission and tool permissions require runtime enforcement. See evidence →