Meta's Closed Model Turn | AI Field Notes #65

AnalysisFor years Meta sold its AI as the open alternative, free Llama weights anyone could download and run. Muse Spark 1.1 arrives as the opposite: a proprietary model with closed weights, reachable only through Meta's first paid developer API at $1.25 per million input tokens and $4.25 per million output. It carries a one-million-token context window, enough to hold a whole codebase in a single session, and launched on July 9 with Replit, Cline, and Box as early partners. The company that made openness its wedge now charges by the token like everyone else.

AnalysisOpenAI stopped selling a chatbot and started selling a coworker. ChatGPT Work, launched on July 9 and powered by the new GPT-5.6 model, bundles the Codex coding agent into ChatGPT so it can build documents, slide decks, and working websites, then schedule itself to keep going without a fresh prompt. The desktop Codex app disappears into ChatGPT, and the old client gets renamed ChatGPT Classic. It is a direct shot at Anthropic's Claude Cowork, the multi-step agent that has had this lane mostly to itself since January.

AnalysisThe fight over how OpenAI trained ChatGPT has turned into a fight over what OpenAI did with the evidence. On July 9, the New York Times, the New York Daily News, and other outlets asked a Manhattan federal judge to sanction the company, saying it told the court it had no way to search its models for their copyrighted articles while it had in fact run those searches before the first suit was even filed. The papers also say OpenAI deleted billions of ChatGPT conversations or made them unsearchable. They want attorney fees for prying loose evidence they call improperly withheld.

AnalysisEvery new place an AI agent stores or fetches information turns into a new way to hijack it. CrowdStrike catalogued five more prompt-injection techniques on July 7, pushing its running tally past 200 documented methods. Prompt injection means feeding an agent hidden instructions that override what its owner asked. The fresh ones target the seams: retrieval pipelines that pull in poisoned documents, model routers that decide which model runs, and the long-term memory agents keep between sessions. A survey it cites found 88 percent of companies had a confirmed or suspected agent incident, while 82 percent of executives believed their current rules already covered them.

AnalysisThe software people use to wire up AI agents just became the thing attackers pry open. CISA (the US cyber agency) added a flaw in Langflow, a popular drag-and-drop agent builder, to its must-patch list on July 7, the first AI agent platform to land there. The bug lets a logged-in attacker run someone else's saved workflow and read the secrets baked into it: model API keys, cloud credentials, database passwords. Operators exploited it by replaying flow IDs with the input 'leak api keys'. Federal agencies were given until July 10 to fix it.

AnalysisA startup that sells AI agents pointed one at its own fundraise, and it worked. Lyzr, an Accenture-backed company in Jersey City, is closing a $100 million Series B at roughly a $500 million valuation, and it says its agent, SivaClaw, did the legwork: fielding questions from more than 130 investors, drafting the investment memos, and quietly logging which slides each backer lingered on. The round drew $400 million in interest. The pitch and the product are now the same thing, which is either the sharpest demo Lyzr could run or a sign of how little scrutiny nine figures currently buys.

AnalysisChina's most watched AI lab wants off other people's chips. DeepSeek is designing its own processor aimed at inference, the work of running a trained model to answer users rather than building it, according to Reuters and three people it spoke to on July 7. The effort has simmered for about a year and remains early: the company has approached chip-design, foundry, and memory firms and is hiring silicon engineers. The push is partly forced. US export rules block Chinese buyers from Nvidia's top parts, and Beijing keeps pressing its champions toward domestic alternatives. OpenAI and Anthropic are walking the same road toward custom inference chips.

AnalysisThe scarce thing in training AI to do office work is no longer the model, it is a realistic place for it to practice. Mercor, an AI data firm valued near $10 billion and reportedly in talks for $20 billion, is buying Deeptune, which builds what its team calls training gyms: simulated Excel sheets, Salesforce screens, and Slack workspaces where an agent can rehearse the job and get scored on it. Deeptune raised $43 million from Andreessen Horowitz in March. Mercor's chief, Brendan Foody, angel-invested three months ago with the purchase already in mind. His line: once a task can be clearly defined and scored, a model can learn it.