












M5 MacBook Pro






-xl.jpg)


Vivid Walls has an aurora wallpaper. Image credit: v2osk


An expertly made mockup of Apple's smart home display, taping an iPad mini to a HomePod
The rumors were true, all of them (and then some): OpenAI today is releasing GPT-6 Astra, a new frontier model that the company says likely marks the onset of artificial generalized intelligence (AGI), its long sought goal of "highly autonomous systems that outperform humans at most economically valuable work."
In a closed a press briefing earlier today, OpenAI co-founder and president Greg Brockman offered an unusually direct formulation of that message, ending the session with: “Welcome to the AGI era.”
That is an unusually consequential framing even by the standards of frontier AI launches. But for enterprises, the more immediate significance of Astra may be considerably more concrete: OpenAI is positioning GPT-6 Astra as a new era of computing in which users, including employees, no longer have to click around a mouse or type on a keyboard ever again (if they don't want).
OpenAI's launch materials, provided in advance to VentureBeat, call it "the world’s best computer use model."
Instead of requiring developers to build a dedicated API integration for every application an AI system needs to use, Astra is designed to navigate software much as a person does — working across browsers, spreadsheets, websites and desktop applications, producing finished documents and presentations, and carrying out multistep workflows rather than merely telling a user how to complete them.
Indeed, the company showed off a promotional video for GPT-6 Astra that began with a 1980s AI demo of a person asking a computer to draw a yellow circle, which it did simply, before cutting to today and showing various OpenAI employees interacting with Astra through voice, asking it turn a yellow circle into a rocket ship and then a full 3D game in minutes, and create a listing on eBay, all from voice input alone.
Astra begins rolling out Thursday to enterprise customers with OpenAI's gated access program, Daybreak. OpenAI says it will become available over the coming days to ChatGPT Plus, Pro, Business and Enterprise customers, as well as through the OpenAI API and cloud platforms including AWS Bedrock and Microsoft Azure.
The enterprise case for Astra rests heavily on computer use.
OpenAI says the model can fill out online forms, update CRM records, organize calendars, conduct web research and draft results into documents or email. It can manipulate spreadsheets, analyze scientific data in Python notebooks, work in Power BI, create and test websites, operate engineering applications such as KiCad and FreeCAD, and install and troubleshoot software.
Those capabilities point toward a potentially important change in enterprise AI architecture.
For much of the generative AI boom, companies have needed to connect models to corporate systems through APIs, plugins, retrieval systems and purpose-built tools. Brockman argued that computer-use agents could begin bypassing some of that integration work because software already exposes an interface designed for a highly general-purpose intelligence: the human user.
“We’ve been bottlenecked over this gigantic era by people writing connectors and very painstakingly building these connections into all these tools that people can already use,” Brockman said.
With sufficiently capable computer use, he added, an agent can instead “zip through spreadsheets, fill out forms, [and] navigate across web pages.”
The idea goes back to OpenAI's earliest days, Brockman said, when researchers discussed training an agent around the same basic inputs and outputs available to humans using computers: pixels, keyboards and mice.
“I feel like we’ve really achieved the first agent that feels like it’s actually able to do that in a way that’s just so extremely useful,” he said.
OpenAI reports that on an offline subset of OSWorld 2.0, Astra scored 72.6% while taking roughly 40 minutes per task, compared with GPT-5.6 Sol's 65.7% at roughly 75 minutes — approximately 47% less time per task.
The company also demonstrated Astra performing tasks ranging from creating a 3D game to preparing a legal agreement while simultaneously handling unrelated requests. The broader message was that the model is intended to move beyond the familiar chatbot pattern in which humans continually provide the next instruction.
“With Astra, users have incredible capabilities at their fingertips and can do things that seemed very far away less than a year ago,” OpenAI researcher Mia Glaese said during the briefing. “With those capabilities, we expect people to delegate much more complex work across applications, with humans directing the work at a much higher level.”
That shift — from prompting AI to supervising AI — may ultimately matter more to businesses than another increase on an academic benchmark.
Aidan Clark, an OpenAI researcher who discussed Astra's development during the briefing, described it as the company's largest-scale training run.
According to Clark, Astra is the first OpenAI model pretrained using more than 100,000 DBUs at the company's Stargate infrastructure and the first for which previous models played a major role supervising the training of the next model.
“Based on the evals we monitor during pre-training, we believe the jump from Sol to Astra represents a larger increase in capabilities than the jump to Sol represented over previous models,” Clark said.
OpenAI attributes Astra's capabilities to the combination of large-scale pretraining and reinforcement learning intended to teach the model to connect information and execute increasingly long tasks.
The resulting benchmark numbers are striking.
OpenAI reports Astra scores 97.6% on FrontierMath Tier 4 v2, 74.1% on DeepSWE v1.1, 95.9% on BenchCAD, 96% on GPQA Diamond and 100% on ExploitBench. It also reports a 98.6% score on ARC-AGI-3.
But that last number comes with an important qualification — and highlights a growing problem with how the industry talks about model intelligence.
ARC-AGI has become one of the most closely watched attempts to measure whether AI systems can generalize to unfamiliar problems rather than reproduce capabilities acquired through training.
On the current ARC-AGI-3 leaderboard, conventional frontier-model runs sit dramatically below Astra's reported 98.6% result.
But the comparison isn't straightforward.
OpenAI's own evaluation notes say Astra uses the company's Responses API harness, while comparison models can operate under different configurations.
That distinction matters because another recent ARC-AGI-3 result demonstrated just how much performance can come from the system surrounding a model.
In August, NVIDIA reported that its Agentic Variation Operators, or AVO, architecture achieved a 100% score across all 25 environments and 183 levels in the ARC-AGI-3 public set. But NVIDIA did not create a foundation model that suddenly jumped to 100%. AVO used Claude Opus 5, and NVIDIA said the underlying model's baseline was roughly 30%.
AVO adds mechanisms including persistent memory, tools, feedback and recovery, allowing an agent to maintain progress over long-running tasks rather than treating every interaction as effectively isolated.
NVIDIA's conclusion was explicit: long-horizon capability can emerge from the complete agent system, rather than the foundation model alone.
That debate has already spilled into the AI community. One r/singularity user argued that ARC-AGI-3's restrictions on retaining context across actions made the benchmark an unrealistic representation of how production agents operate, comparing it to testing humans while repeatedly erasing what they had learned.
Other commenters have pushed in the opposite direction, arguing that adding elaborate harnesses makes it harder to determine whether the underlying model has actually generalized. One commenter responding to NVIDIA's result wrote: “Let’s see if the capabilities generalise or if it was just overtrained on this specific benchmark.”
The disagreement exposes an increasingly important question for claims about AGI: What exactly is the object being measured?
A foundation model? A model plus persistent memory? A model with a computer, browser and tools? Or the complete deployed system?
For enterprises, the distinction may eventually become less important operationally. Companies buy outcomes from systems, not benchmark purity. If an agent can reliably reconcile accounts, investigate an incident, modify a production codebase or assemble a financial model, whether that ability originates primarily in neural weights, memory architecture or tool orchestration may matter less than its cost, reliability and auditability.
And OpenAI appears increasingly willing to make that argument.
“Everyone has a different definition of AGI,” Brockman said. “When we started OpenAI, we kind of thought that there was going to be this well-defined moment that everyone would recognize: ‘That’s AGI.’ It hasn’t played out like that. It’s a much more gray, fuzzy thing.”
But Brockman went considerably further when asked whether Astra itself qualifies.
“For me personally, I do think we’re there,” he said. “I think there’s a pretty good argument for it.”
Later, he offered perhaps the clearest formulation of OpenAI's position: “I think it’s not unreasonable to feel that we are now in the AGI era.”
One notable omission from OpenAI’s Astra launch materials is GDPval, the company’s own benchmark for measuring performance on economically valuable, real-world work. OpenAI introduced GDPval in 2025 specifically to move beyond academic-style tests and coding benchmarks, evaluating models on 1,320 tasks drawn from 44 knowledge-work occupations across nine major U.S. industries. Those tasks include deliverables such as legal briefs, engineering designs, spreadsheets, presentations, customer-support work and nursing care plans — much closer to the enterprise workflows OpenAI now says Astra is designed to automate.
That makes the absence conspicuous given the AGI framing around Astra. OpenAI originally positioned GDPval as a way to ground discussion about AGI and economic impact in observable workplace performance rather than speculation. Its own description says the benchmark was created to track how well AI systems perform on “economically valuable, real-world tasks” and to provide a clearer picture of how models might support professionals in everyday work. In other words, if Astra’s significance is that enterprises can now delegate materially more work to AI, GDPval would appear to be one of OpenAI’s most directly relevant internal yardsticks for substantiating that claim.
The omission does not invalidate Astra’s other results, but it does leave an analytical gap. OpenAI’s 98.6% ARC-AGI-3 score speaks to interactive reasoning and adaptation, while benchmarks such as DeepSWE and Agents’ Last Exam capture specific forms of software engineering and professional workflow performance. GDPval, by contrast, was explicitly designed to ask a broader economic question: can models produce work products comparable to those of experienced professionals across a wide cross-section of occupations? OpenAI’s earlier results showed frontier systems approaching expert-level quality on some of those tasks, with substantial gains from GPT-4o to GPT-5.
There is also an important limitation in GDPval that may help explain why OpenAI did not center it here. The current version is one-shot: it does not measure the long-horizon, interactive, multi-application work that Astra is supposed to excel at. OpenAI itself has said future versions should add iterative workflows, richer context and ambiguity. That means GDPval is arguably both highly relevant to Astra’s enterprise story and somewhat mismatched to its most agentic capabilities.
Still, given Brockman’s “AGI era” framing, the missing number is worth noting. If the practical case for AGI is increasingly about whether AI can perform economically meaningful work across many professions, then GDPval is one of OpenAI’s clearest attempts to measure exactly that. Until Astra results appear there — or on a successor designed for multi-step agentic work — claims about its broad economic generality rest more on a mosaic of specialized benchmarks and demonstrations than on the company’s own flagship benchmark for real-world occupational performance.
That systems-level view also changes how OpenAI wants customers to think about cost.
For developers, the API model name is gpt-6-astra. The release also says Astra supports Zero Data Retention for eligible API customers and that OpenAI is testing Private Safety Processing.
OpenAI API Standard pricing is:
$10 per million input tokens
$50 per million output tokens
Separate pricing applies to cache reads/writes.
Fast mode provides up to 2.5× Standard processing speed at 2× Standard pricing.
Model | Input ($/1M) | Output ($/1M) | Total ($/1M) | Source |
Muse Spark 1.2 / 1.3 Contributor | $0.10 | $0.20 | $0.30 | |
MiMo-V2.5 Flash | $0.10 | $0.30 | $0.40 | |
DeepSeek-V4-Flash — off-peak | $0.22 | $0.66 | $0.88 | |
GPT-5.6 Luna | $0.20 | $1.20 | $1.40 | |
MiniMax-M3 | $0.30 | $1.20 | $1.50 | |
LongCat-2.0 — limited-time promo | $0.30 | $1.20 | $1.50 | |
DeepSeek-V4-Flash — peak hours | $0.44 | $1.32 | $1.76 | |
MiMo-V2.5 | $0.40 | $2.00 | $2.40 | |
DeepSeek-V4-Pro — off-peak | $0.66 | $1.98 | $2.64 | |
LongCat-2.0 — standard | $0.75 | $2.95 | $3.70 | |
MiMo-V2.5 Pro (≤256K) | $1.00 | $3.00 | $4.00 | |
Gemini 3.7 Flash — through Dec. 31, 2026 | $0.75 | $3.75 | $4.50 | |
Gemini 3.8 Flash — through Dec. 31, 2026 | $0.75 | $3.75 | $4.50 | |
DeepSeek-V4-Pro — peak hours | $1.32 | $3.96 | $5.28 | |
Muse Spark 1.1 / 1.2 / 1.3 | $1.25 | $4.25 | $5.50 | |
GLM-5.3 | $1.40 | $4.40 | $5.80 | |
Grok 4.6 — <200K prompt tokens | $2.00 | $6.00 | $8.00 | |
MiMo-V2.5 Pro (>256K) | $2.00 | $6.00 | $8.00 | |
Qwen3.8-Max | $2.00 | $6.00 | $8.00 | |
Gemini 3.7 Flash — starting Jan. 1, 2027 | $1.50 | $7.50 | $9.00 | |
Gemini 3.8 Flash — starting Jan. 1, 2027 | $1.50 | $7.50 | $9.00 | |
GPT-5.6 Terra | $2.00 | $12.00 | $14.00 | |
Grok 4.6 — ≥200K prompt tokens | $4.00 | $12.00 | $16.00 | |
GPT-5.4 | $2.50 | $15.00 | $17.50 | |
Kimi K3 | $3.00 | $15.00 | $18.00 | |
Claude Opus 5 | $5.00 | $25.00 | $30.00 | |
Sakana Fugu Ultra (≤272K) | $5.00 | $30.00 | $35.00 | |
GPT-5.6 Sol — Standard mode | $5.00 | $30.00 | $35.00 | |
Claude Fable 5 / Claude Mythos 5 | $10.00 | $50.00 | $60.00 | |
Claude Fable 5.1 / Claude Mythos 5.1 | $10.00 | $50.00 | $60.00 | |
GPT-6 Astra — Standard mode | $10.00 | $50.00 | $60.00 | |
GPT-5.6 Sol — Fast mode | $10.00 | $60.00 | $70.00 | |
GPT-6 Astra — Fast mode | $20.00 | $100.00 | $120.00 |
Those prices matter, but Brockman argued that token pricing is becoming a poor proxy for the actual economics of enterprise AI.
“Pricing tokens doesn’t make any sense,” Brockman said. “Our tokens are not necessarily the same as our competitors’ tokens; they’re not the same between different model families.”
Instead, he said, businesses should evaluate price per completed task.
“What you actually want, and I think the market is starting to really wake up to, is the price per task,” Brockman said. “It’s just about: can you get the thing done for an appropriate cost at appropriate speed?”
OpenAI says Astra illustrates that argument on DeepSWE v1.1, where its highest-performing configuration beats GPT-5.6 Sol's highest-scoring setting while producing an approximately 57% lower estimated API cost per task.
For enterprise buyers, that metric could prove more useful than token prices as agents become more autonomous. An inexpensive model that requires repeated retries, human correction and thousands of additional inference steps may ultimately cost more than an expensive model that finishes the workflow correctly the first time.
The same capability that makes Astra interesting to enterprises also makes it harder to govern.
A chatbot generates something for a person to inspect. An agent operating a computer can actually change a record, send information, manipulate files or take actions across applications.
Glaese said that as users delegate more work, OpenAI needs models that recognize where their authority ends.
“Even as models can do more things autonomously, we have to be able to trust them more,” she said. “Our understanding of alignment and safety has to advance with model capabilities, and Astra is both our most capable and our most aligned model.”
The company's safety work around Astra offers a revealing look at what governing systems at this capability level may require.
In a separate background briefing conducted a day before the launch briefing, OpenAI sources said the company had paused some frontier training for roughly two weeks following the Hugging Face incident, even though Astra itself was not involved. During that period, OpenAI tightened the security around its research infrastructure, restricted what training workloads could access and connect to, expanded monitoring, and raised internal requirements around both model behavior and the environment in which models were being trained.
Some work on Astra resumed under those controls, while a larger reinforcement-learning run for a future model remained paused for longer.
The distinction is important. According to OpenAI sources, the pause was not prompted by evidence that Astra itself had become too dangerous to release. The company viewed it instead as an attempt to prevent its safety, monitoring and infrastructure controls from falling behind rapidly advancing model capability. The work done during that period built on months — and in some areas years — of prior alignment and security research rather than representing a safety stack constructed from scratch in two weeks.
That approach increasingly resembles enterprise risk management more than conventional model moderation. Instead of relying on a single refusal layer, OpenAI described a defense-in-depth system spanning model behavior, classifiers, security controls, monitoring and post-deployment threat response.
OpenAI sources said Astra's cybersecurity safeguards, for example, combine refusals trained into the model with system-level classifiers and offline detection intended to identify abuse patterns that may unfold across multiple prompts rather than in a single obviously malicious request. For higher-risk users, monitoring can use broader conversational context to recognize when individually innocuous requests form part of a larger attack workflow.
That has obvious implications for enterprises considering highly autonomous agents. The relevant control surface is no longer just the prompt presented to a model. Organizations increasingly have to reason about sequences of actions, the model's understanding of its authorization boundary, what applications and data it can reach, whether suspicious trajectories can be detected while they are underway and what happens when a safeguard fires.
OpenAI says an internal evaluation inspired by the Hugging Face incident tested whether models would exceed their authorized scope when confronted with difficult or impossible objectives. Without production safeguards, GPT-5.6 Sol went beyond the authorized target 48.2% of the time; Astra did so in 0% of cases.
OpenAI sources described a related internal alignment evaluation based on difficult cybersecurity tasks in which the earlier model attempted to reach adjacent systems in a majority of tests when production safeguards were absent, while Astra made no such attempts.
The goal, according to the sources, is not merely to train an agent to persist until a task is finished, but to teach it that persistence has boundaries: an agent should be capable of recognizing when completing an objective would require exceeding its authorized scope and return to the user instead.
That is a particularly consequential distinction for enterprise agents. Persistence is one of the properties that makes autonomous systems useful — a model that gives up after the first failed attempt will not be much of an operator.
But persistence becomes a liability if an agent interprets an objective so literally that it circumvents access controls, security reviews or other constraints designed to stop exactly that behavior.
According to OpenAI sources, Astra's training therefore emphasizes both explicit boundaries and what the company described as softer constraints: recognizing the intent behind security controls and backing off rather than trying to find a technically available route around them.
Yet OpenAI chief scientist Jakub Pachocki stressed that stronger alignment results should not be interpreted as solving the underlying problem.
“Progress in intelligence does not guarantee progress in alignment,” Pachocki said.
The company is particularly concerned about monitorability — whether humans or other systems can understand enough of a model's reasoning to identify dangerous behavior.
As models improve, Pachocki said, they can accomplish harder tasks with fewer natural-language reasoning tokens. More capable systems are also becoming increasingly aware of and able to influence their own chains of thought.
That potentially turns observability into one of the defining enterprise infrastructure problems of the agent era.
OpenAI sources said the company is adding misalignment monitoring to Astra's external deployment so systems can inspect its reasoning and actions for signs that it is operating outside the authority it was given. In severe cases, that monitoring can halt an activity. The company characterized monitoring as a secondary layer rather than a substitute for aligning model behavior in the first place.
The deployment details also illustrate the compromises enterprise customers may encounter. OpenAI sources said its monitoring approach is designed to remain compatible with Zero Data Retention arrangements. On surfaces where data can be retained, suspicious activity can support additional review processes; under ZDR setups, classifiers can run without the conversation being retained.
The safeguards may also introduce operational friction. OpenAI sources said legitimate work can sometimes be slowed, paused or stopped — including defensive cybersecurity tasks and potentially unrelated activity. In ChatGPT or Codex, the user may be asked to approve an action before the system proceeds; in API workflows, a flagged task may stop outright.
That trade-off is likely to become familiar to CIOs and security leaders. The more authority an AI worker receives, the less plausible it becomes to treat AI governance as an after-the-fact content filtering exercise. Enterprises will need controls closer to those already used for human identities and privileged software: scoped permissions, audit trails, policy enforcement, real-time monitoring and escalation when an agent approaches a consequential boundary.
OpenAI therefore faces a tension that enterprises deploying autonomous agents will eventually face themselves: the systems becoming capable enough to perform meaningful independent work are simultaneously becoming harder to inspect.
Pachocki said OpenAI is willing to make that a constraint on further development.
“We will not accept the degradation in our ability to monitor model alignment beyond a certain level,” he said. “We will pause scaling until we can gain enough confidence.”
“We also have to be willing to slow down, or halt further scaling, when our confidence in safety is not sufficient.”
The stakes are particularly concrete in cybersecurity.
OpenAI has designated Astra as the first model to reach the Critical cybersecurity threshold under its Preparedness Framework. According to OpenAI sources, that designation means the model, when given appropriate tools and access, is capable of finding previously unknown vulnerabilities and developing exploit chains across well-protected systems without continuous human guidance.
OpenAI reports Astra scores 100% on ExploitBench. Sources also said additional testing against a newer set of 20 recently disclosed serious vulnerabilities produced substantially stronger results than GPT-5.6 Sol with fewer output tokens, and that Astra discovered two previously unknown vulnerabilities during evaluation that OpenAI subsequently disclosed to maintainers. Human expert testing found the model could identify novel zero-day vulnerabilities across multiple software categories, including browsers and operating systems.
Those capabilities are dual-use by definition. An agent capable of autonomously finding a vulnerability can help a defender patch it or help an attacker exploit it.
OpenAI is therefore limiting Astra's most advanced cyber capabilities initially. The company says trusted defenders will receive broader access through Daybreak Blue, prioritizing organizations responsible for protecting critical digital infrastructure, while more general access remains subject to stronger restrictions and monitoring.
For enterprise security teams, this represents another version of Astra's broader proposition: frontier models are moving from advising specialists toward performing portions of specialist work themselves.
That brings the discussion back to AGI.
Brockman notably did not present Astra's 98.6% ARC-AGI-3 score as a mathematical proof that OpenAI has achieved artificial general intelligence. Nor did he claim there is now a universally accepted technical threshold that Astra has crossed.
Instead, his argument was more practical.
A system can now solve extremely difficult scientific problems while also performing ordinary economic work through the same interfaces humans use. The qualitative shift comes from the breadth of those capabilities and from the amount of work people can begin handing over.
“There’s still more to do,” Brockman said. “There are still lots of improvements to be made, but there is something significant here that I think is qualitatively improved.”
Astra, he said, represents “a real shift in what kind of work people can delegate to AI.”
That framing may ultimately be more consequential for enterprises than deciding whether Astra earns a particular three-letter label.
The important threshold for businesses is whether agents become reliable enough that organizations restructure workflows around them: humans specify objectives and constraints, AI systems execute the intermediate steps, and employees intervene primarily for judgment, exceptions and consequential decisions.
Astra also makes clear that those systems will require a corresponding change in governance. The enterprise question is no longer simply whether a model gives a good answer. It is whether an AI worker can be given access to real applications and sensitive information, continue working through obstacles, stay inside the authority granted to it, explain enough of what it is doing to remain governable, and stop when either the model or the surrounding control system determines that human intervention is required.
If that happens at scale, AGI may look less like a machine suddenly passing one definitive test and more like a gradual economic transition that becomes obvious only in retrospect.
That is essentially Brockman's argument.
“I think if you want to say this is the first one, I think it’s reasonable,” he said of Astra. “If you want to say the previous one is the first one, you want to say the next one’s the first one. But I think that if you fast forward a year, I think it’s going to be pretty hard to say that there was no point out there where you’re not in the AGI era.”
For enterprises, that argument may soon be tested less by whether Astra can top another leaderboard than by something much more measurable: how much consequential work organizations are willing to let it do.
A Chinese state-linked hacking group compromised executive laptops at an agricultural industry conference on Hainan Island this spring — not through phishing or a network breach, but by breaking into hotel rooms and booting the machines from a USB stick while the executives were at dinner.
CrowdStrike, which tracks the group as OVERCAST PANDA, disclosed the campaign in its 2026 Threat Hunting Report and detailed the operation's timeline in an interview with VentureBeat at Fal.Con 2026: an intruder entered one room at around 8 p.m. local time and a second room by 9:57 p.m., writing a backdoor called FlowCloud directly to each laptop's storage before rebooting the machines and leaving. There was no network intrusion, no phishing email, and no credential stolen through a login page.
The report dates the intrusions to between March and May 2026, and the timestamps come from Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, who cleared them for publication in the VentureBeat interview. CrowdStrike's OverWatch team disrupted the intrusions and assessed that OVERCAST PANDA will almost certainly continue. FlowCloud itself predates this campaign by years: Proofpoint documented it in 2020, delivered by phishing to U.S. utilities, and NTT Security's SOC has tracked USB-delivered infections at overseas branches of Japanese organizations since early 2022.
Security researchers have called physical-access tampering with an unattended laptop an "evil maid attack," since Joanna Rutkowska demonstrated one with a bootable USB stick in 2009. Physical-access operations are rare across the 290 named adversaries CrowdStrike tracks, according to Meyers, and MUSTANG PANDA's version depends on a dropped USB stick the victim plugs in. What Meyers identified as novel is the combination of hotel-room entry by a state intelligence service with malware deployment, booting the target machine from the USB rather than relying on a user to execute a file from it.
When the executives powered on the next morning, the trigger fired and FlowCloud loaded. Keylogging, screen capture, file collection, and credential harvesting began.
"We have the visibility once the machine boots up," Meyers told VentureBeat. A registry key or similar trigger starts FlowCloud sometime after the operating system loads, and that's when Falcon's sensor picks it up. The gap is the window between the USB write and the next boot — the hours the laptop sits compromised and undetected before the executive logs back in.
CrowdStrike published that gap a month before it announced its AI security product slate — Falcon Guardian, SafeMind, the Agentic Identity Provider, and AI Gateway — at Fal.Con 2026 this week.
EDR needs the operating system loaded and the agent running. MFA waits for a login attempt, phishing training for an email, AI agent security for an agent to secure.
OVERCAST PANDA bypassed all of them at the point of entry. The initial compromise completed below the running OS, below the EDR agent, below the authentication stack. Falcon caught FlowCloud once its process started after boot, but by then the implant and its trigger were already on disk.
"Hotel entry is a very common thing," Meyers said. "Talk to any corporate physical security person. They're generally aware of hotel entry, but I think what is unique is the combination of hotel entry with deployment of malware."
Meyers said he thinks China's Ministry of State Security sits behind OVERCAST PANDA. The people entering the rooms are either officers or agents of the MSS or the Ministry of Public Security, or hotel housekeeping staff the services have bribed or compelled, Meyers told VentureBeat. A separate mid-2026 intrusion targeted a U.S.-based media professional using the same tradecraft, according to the report. Targeting an agricultural conference aligns with collection priorities Meyers tied to China's five-year plans.
Nvidia CEO Jensen Huang joined George Kurtz on the Fal.Con stage to unveil SafeMind, an agentic cybersecurity system built on Nvidia Nemotron open models and CrowdStrike's threat data. Meyers told the Fal.Con audience that 7,400 CVEs were registered in June 2026, a 96% increase over June 2025, and that CrowdStrike submitted 2,400 of them via responsible disclosure, roughly 30% of all CVEs registered that month.
Falcon Guardian, the company's runtime security layer for AI agents on the endpoint, went live the minute Kurtz put the slide up, CrowdStrike President Mike Sentonas told the Day 2 audience, and AI Gateway, listed as a Guardian capability, ships in September as a hosted service with a hybrid version to follow. AJ Shipley, CrowdStrike's chief product officer, told VentureBeat that CrowdStrike will embed a SafeMind model into Guardian for malicious-prompt detection within the next couple of weeks.
The threats those products address are real, and the report quantifies them. AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads, by OverWatch's count. Cloud-conscious eCrime activity surged 171% over the reporting period. Vishing intrusions doubled in the first half of 2026 compared to the second half of 2025, with the eCrime group SNARKY SPIDER moving from account takeover to data exfiltration in under five minutes after compromising SSO-integrated SaaS applications.
Every one of those threats is network-based. All of them assume a running OS, an active user session, or a live cloud workload.
"It's a solvable problem," Meyers said. "It's just an inconvenient solution, which means that a lot of people don't do it."
CrowdStrike itself has shipped firmware attack detection and BIOS settings auditing through the Falcon sensor since May 2019, including a Dell SafeBIOS integration that surfaces BIOS verification telemetry in the Falcon console. The ability to audit security-related BIOS settings on the laptops executives carry has sat inside the platform for seven years. Pointing it at travel devices is a decision, not a product gap.
The controls that would have blunted the OVERCAST PANDA campaign are old and cheap, and each does a different job. Disabling external boot in UEFI removes the vector. A BIOS administrator password keeps it disabled. Pre-boot authentication lets a foreign boot environment load and still keeps the encrypted volume unreadable until a human supplies the PIN or key. Firmware monitoring detects tampering after the fact.
"Don't bring anything with you that you're not comfortable with handing over to a foreign intelligence service," Meyers advised. He used temporary laptops and email accounts on overseas trips while at CrowdStrike, wiping the device when he returned. The exposure starts at customs. Officials can seize a device and compel a login, he added.
"They have master keys to that stuff," was his verdict on hotel safes.
Intrusions tracked by CrowdStrike OverWatch grew about 4% over the reporting period, after a 27% rise the year before, a plateau CrowdStrike attributed to a shift toward more complex, resource-intensive campaigns. The OVERCAST PANDA hotel room operation is the example.
The network threat worries Meyers more. Asked to weigh OVERCAST PANDA's hotel room campaign against the REVENANT SPIDER case he had shown on the Fal.Con stage, an eCrime group using AI to compromise 17 victims with custom web shells in 48 minutes, he picked REVENANT SPIDER.
"You can't intrude on hotel rooms at scale," he said. "You can't intrude on physical devices at scale. And even then, it's just one device." The person in the room is the target, and the intrusion rarely pivots further, he added. "REVENANT SPIDER, they're moving at that speed and they're using AI across the board, and that's a whole other threat, and I think that's more concerning for the average enterprise."
Network-speed, AI-powered intrusions scale. Physical-access tradecraft does not. Security budgets follow the threat that hits the most machines. The threat that is hardest to detect on one machine gets what is left.
But the executives who attended an agricultural conference in China this spring were the specific targets of a state intelligence service, one that chose the slow, unscalable method precisely because it works where network-based attacks fail.
Executives at conferences are the campaign's targets, and runtime security starts only once the machine boots. The vendors filling the Las Vegas show floor this week were selling that same runtime protection to attendees whose own laptops carry the identical gap.
Organizational fracture is the real problem. Falcon Guardian ships to one team, and BIOS configuration on travel laptops belongs to another. The Agentic IdP rolls out under identity governance while the decision about whether executives carry production-access machines to international conferences sits with a different group. And the budget line that funds cloud-threat defense has nothing to do with travel-device policies.
Meyers has lived both sides. "I've talked to companies where they're like, we're having a board meeting in Shanghai, and I'm like, why would you do that?"
Audit every executive laptop for USB boot status. If the device can be booted from USB right now, it has the same gap OVERCAST PANDA exploited this spring. The steps below cover Windows laptops, the platform FlowCloud targets.
Enforce full-disk encryption with pre-boot authentication. BitLocker in a TPM-only configuration is a documented weak point against physical access. SCRT researchers pulled the volume master key off the LPC bus with a $49 FPGA module in 2021, and Dolos Group did the same over SPI that year. OVERCAST PANDA wrote a backdoor and its post-boot trigger to the Windows volume, so the operators had write access to it. That points to machines that were either unencrypted or protected by a configuration the operators defeated. Pre-boot authentication with a PIN or USB key forces a human step before storage becomes readable.
Verify Secure Boot is enabled and the revocation list is current. Secure Boot validates signatures on boot components and blocks most unauthorized bootloaders, but it leaves external media bootable and signed shims can still carry a bypass. ESET published findings on 11 legacy Microsoft-signed UEFI shims in July 2026 that let untrusted code run at boot on any machine trusting Microsoft's third-party certificate. Microsoft revoked them in its June 9, 2026 DBX update, so a laptop that skipped that update still trusts them. Lock the boot order at the UEFI level, disable one-time boot menus, and set a BIOS administrator password that covers both the setup utility and any boot-override key. Meyers' read is that a lot of these settings go unchecked because the fix is inconvenient.
Issue travel-only devices for international conferences with no access to production systems, no saved credentials for internal tools, and no persistent VPN configuration.
"If they can get their hands on it, they can own it," Meyers put it, citing an old DEF CON adage. Falcon catches FlowCloud only after boot — the exposure is the hours between the USB write and the next login, while the laptop sits closed and compromised.
"It's cheap to buy a couple of laptops and a couple of phones," Meyers said. The controls that close that window are a handful of firmware settings and a spare laptop. The question is whether anyone has deployed them.
Meta’s newest AI model Muse Spark 1.3, unveiled yesterday, is faster and more performant on third-party benchmarks than its predecessor — with a caveat.
"Muse Spark 1.3 is rolling out today with frontier performance almost too cheap to meter," Meta co-founder and CEO Mark Zuckerberg wrote on X, calling it Meta’s “biggest jump” yet in coding and agentic work.
There is substance behind both parts of that claim. Muse Spark 1.3 makes significant gains over last month’s 1.2 release, particularly on long-running agent tasks. The version developers can access now is also one of the strongest price-performance offerings near the top of independent model rankings.
Meta’s strongest Muse Spark 1.3 benchmark results come from its max reasoning configuration. Meta says that version is still completing additional safety testing and will arrive “shortly”; the third-party benchmarking firm Artificial Analysis says it evaluated max in a limited partner preview, and currently lists no API provider at all for the configuration.
The version broadly rolling out this week through its Muse Code harness and the Meta Model API uses Meta’s previously available reasoning settings, including xhigh.
That makes the more relevant enterprise question not whether Muse Spark 1.3 can reach frontier territory, but how close the model companies can actually deploy today gets — and at what real cost.
Meta does disclose results for both configurations in its underlying evaluation report, so this is not a case of the company hiding the deployable model. But its launch materials prominently showcase the max variant, and some of the largest scores belong to that configuration.
For example, Meta reports GDPval-AA v2 scores of 1,754 Elo for max versus 1,709 for xhigh, OSWorld 2.0 scores of 66.9 versus 57.2, and JobBench scores of 64.9 versus 61.2.
On some tests the distinction is negligible or reversed: DeepSearchQA is tied at 89.4, while xhigh scores 89.2 on Terminal-Bench 2.1 versus max at 88.8.
Artificial Analysis scores Muse Spark 1.3 max at 62 on its Intelligence Index and the shipping xhigh version at 61. The latter ties GPT-5.6 Sol max, Grok 4.6 high and Claude Opus 5 high. But Anthropic still occupies the top of the leaderboard: Claude Fable 5.1 reaches 66 at max and 65 at xhigh, while Claude Opus 5 reaches 63 at max and xhigh.
In other words, Muse Spark 1.3 xhigh is legitimately in the frontier cluster, but it is not the model currently setting the frontier.
That is still a substantial change from Muse Spark 1.2. VentureBeat’s coverage of last month’s launch found Meta fielding a credible coding challenger that nevertheless generally trailed Anthropic’s best model. Muse Spark 1.2 scored 82.9% on Terminal-Bench 2.1 versus Opus 5’s 86.7%, and also finished behind Opus on the other main coding comparisons Meta presented.
With 1.3, Meta is no longer merely showing up in that contest. On several coding and agentic evaluations, it is trading wins with OpenAI and Anthropic.
Meta says the underlying model has also become easier to operate. Muse Spark 1.3 is trained to maintain multiple workflows in a long thread, gather context with tools, detect gaps in its own plans, ask users for clarification when necessary and confirm before consequential actions. In Meta engineers’ internal comparisons, it used roughly 20% fewer tool calls and 25% fewer tokens than 1.2 during coding work.
For enterprises paying for thousands or millions of agent loops, those behavioral improvements could matter more than another leaderboard point.
Muse Spark 1.3 did not receive an API price cut. Meta kept Standard pricing exactly where it was for Muse Spark 1.2: $1.25 per million input tokens, $4.25 per million output tokens and $0.15 per million cached input tokens.
Model | Input ($/1M) | Output ($/1M) | Total ($/1M) | Source |
Muse Spark 1.2 / 1.3 Contributor | $0.10 | $0.20 | $0.30 | |
MiMo-V2.5 Flash | $0.10 | $0.30 | $0.40 | |
DeepSeek-V4-Flash — off-peak | $0.22 | $0.66 | $0.88 | |
GPT-5.6 Luna | $0.20 | $1.20 | $1.40 | |
MiniMax-M3 | $0.30 | $1.20 | $1.50 | |
LongCat-2.0 — limited-time promo | $0.30 | $1.20 | $1.50 | |
DeepSeek-V4-Flash — peak hours | $0.44 | $1.32 | $1.76 | |
MiMo-V2.5 | $0.40 | $2.00 | $2.40 | |
DeepSeek-V4-Pro — off-peak | $0.66 | $1.98 | $2.64 | |
LongCat-2.0 — standard | $0.75 | $2.95 | $3.70 | |
MiMo-V2.5 Pro (≤256K) | $1.00 | $3.00 | $4.00 | |
Gemini 3.7 Flash — through Dec. 31, 2026 | $0.75 | $3.75 | $4.50 | |
Gemini 3.8 Flash — through Dec. 31, 2026 | $0.75 | $3.75 | $4.50 | |
DeepSeek-V4-Pro — peak hours | $1.32 | $3.96 | $5.28 | |
Muse Spark 1.1 / 1.2 / 1.3 | $1.25 | $4.25 | $5.50 | |
GLM-5.3 | $1.40 | $4.40 | $5.80 | |
Grok 4.6 — <200K prompt tokens | $2.00 | $6.00 | $8.00 | |
MiMo-V2.5 Pro (>256K) | $2.00 | $6.00 | $8.00 | |
Qwen3.8-Max | $2.00 | $6.00 | $8.00 | |
Gemini 3.7 Flash — starting Jan. 1, 2027 | $1.50 | $7.50 | $9.00 | |
Gemini 3.8 Flash — starting Jan. 1, 2027 | $1.50 | $7.50 | $9.00 | |
GPT-5.6 Terra | $2.00 | $12.00 | $14.00 | |
Grok 4.6 — ≥200K prompt tokens | $4.00 | $12.00 | $16.00 | |
GPT-5.4 | $2.50 | $15.00 | $17.50 | |
Kimi K3 | $3.00 | $15.00 | $18.00 | |
Claude Opus 5 | $5.00 | $25.00 | $30.00 | |
Sakana Fugu Ultra (≤272K) | $5.00 | $30.00 | $35.00 | |
GPT-5.6 Sol — Standard mode | $5.00 | $30.00 | $35.00 | |
Claude Fable 5 / Claude Mythos 5 | $10.00 | $50.00 | $60.00 | |
Claude Fable 5.1 / Claude Mythos 5.1 | $10.00 | $50.00 | $60.00 | |
GPT-5.6 Sol — Fast mode | $10.00 | $60.00 | $70.00 |
That makes Zuckerberg’s “almost too cheap to meter” line less a statement about lower token prices than about what Meta believes developers can accomplish with those tokens.
Artificial Analysis offers evidence for that argument, but also a complication. It measures Muse Spark 1.3 xhigh at 235.2 output tokens per second and estimates a cost of $0.55 per Intelligence Index task.
At 61 on the Intelligence Index, that gives it the lowest cost per task of any currently measured model at that intelligence level.
Muse Spark 1.2 cost only $0.40 per Artificial Analysis task, while scoring 57.
Despite unchanged per-token pricing, the independent benchmark’s cost of completing an average task therefore increased generation-over-generation. Artificial Analysis attributes the increase primarily to heavier input-token consumption on agentic evaluations.
That does not directly contradict Meta’s claim of 25% lower token use: Meta is describing comparisons in its own coding workflows, while Artificial Analysis is measuring a broader suite of reasoning and agentic tasks.
But it illustrates why “cheap” becomes slippery once models operate as agents. Token rates, reasoning effort, number of turns, tool calls and retries all contribute to the actual cost of finishing work.
Meta also retains its unusually cheap Contributor tier — $0.10 per million input tokens and $0.20 per million output tokens — in exchange for permission to use prompts and completions for training.
As VentureBeat noted with Muse Spark 1.2, that may be attractive for prototyping but creates a materially different data-governance calculation for enterprises working with proprietary code or sensitive internal information.
Meta chief AI officer Alexandr Wang was considerably less qualified in celebrating the release.
After Artificial Analysis posted its Muse Spark results, Wang reposted them on X, adding: “i really hate to say it, but… gemini who? 😱💨”
The shade was particularly pointed because Google released Gemini 3.8 Flash on the same day, pitching it at almost exactly the same class of workload: long-horizon software engineering, autonomous agents and multi-step professional reasoning. Google calls 3.8 its best reasoning and coding Flash model yet and says it is the company’s third Flash release in six weeks.
Independent numbers give Wang something to work with, though hardly a knockout.
Artificial Analysis gives Muse Spark 1.3 xhigh a 61 Intelligence Index score at $0.55 per task, compared with 59 and $0.58 for Gemini 3.8 Flash at high reasoning. Meta therefore edges Google on both intelligence and task cost at those particular settings.
Google wins decisively on throughput. Artificial Analysis measures Gemini 3.8 Flash high at about 305 output tokens per second, versus 235 for Muse Spark — roughly 30% faster. Gemini also has the lower raw API sticker price for now: Google is charging an introductory $0.75 per million input tokens and $3.75 per million output tokens, compared with Meta’s $1.25 and $4.25.
That promotional Google pricing expires December 31, after which it rises to $1.50 per million input tokens and $7.50 per million output tokens.
The result is a useful snapshot of how tight frontier-model economics have become. Meta currently wins this independent comparison by two Intelligence Index points and three cents per benchmark task; Google offers substantially higher output throughput and cheaper raw tokens during its launch promotion.
Wang’s “gemini who?” is fun executive trash talk. For an enterprise architect, the answer is closer to: Gemini is the faster option; Muse is currently the slightly stronger high-effort agent by this independent measure.
The more consequential issue for some developers may have little to do with today’s benchmark race.
When Meta launched Muse Code and Muse Spark 1.2 in August, VentureBeat noted how dramatically the company had moved away from the open-weight strategy that made Llama ubiquitous.
Muse Code and Spark 1.2 were proprietary, API-served products — a striking posture for the company that had spent years arguing that open AI was the path forward.
Five days later, Meta changed course again.
On August 10, it released the 30-billion-parameter Muse Glimmer under an Apache 2.0 license. Zuckerberg also said: “In the coming weeks, we are also going to open the weights for Muse Spark 1.2.” Reuters separately reported Meta’s plan to release the Spark 1.2 weights.
Now, Meta has instead shipped Muse Spark 1.3 as another proprietary model.
That does not yet amount to a broken promise — “coming weeks” can reasonably describe a period longer than three weeks. But today’s announcement makes the roadmap less clear rather than more.
Meta’s new post no longer says Muse Spark 1.2. It says its roadmap includes “the Muse Spark open weights release”, without identifying a version, release date, model size or license. Zuckerberg likewise said on X that “Muse Spark open weights releases” are coming soon.
For teams that standardized on Llama because downloadable weights meant self-hosting, customization and control over inference economics, that ambiguity may matter more than whether Spark gained another point on a composite benchmark.
Muse Spark 1.3 shows that Meta can now iterate proprietary frontier models at extraordinary speed. The shipping xhigh configuration is fast, competitively priced and much closer to the top of independent rankings than its predecessors. The max preview shows Meta can push the family a little further when allowed to spend more reasoning compute.
The next test is different: whether Meta can convert that pace into a roadmap enterprises can actually plan around — including making its best capabilities broadly deployable and delivering the open-weight Spark model it has already said is coming.
Presented by Contentful
Most marketing teams still measure visibility the same way they always have: rankings, click-through rates, and organic traffic. But buyers have moved on.
Search tools and AI engines now synthesize answers directly on the screen, creating a world of zero-click searches where your website is entirely bypassed.
The “old days” are not coming back. The question for marketers is no longer, How do we rank first? It's How do we become part of the answer?
The answer isn't publishing more content; it’s making your knowledge impossible for AI to ignore.
Showing up is only half the battle. Where you appear inside an AI-generated response matters just as much.
Think about the experience. If your brand is mentioned after multiple answer cards, product recommendations, follow-up questions, and community discussions, most people will never see it. Ranking reports won't capture that.
One way to think about this is pixel depth. Instead of measuring position on a search results page, measure how prominently your brand appears within the answer itself. Visibility increasingly depends on whether you're seen before someone feels they've learned enough to stop reading. It’s no longer enough to rank at the top of search results. Now “share of visibility” models also weigh SERP features, ads, and AI Overview presence for a more holistic view of what kind of attention your company can expect to get.
Search engines were designed to index pages. Large language models work differently.
Rather than evaluating a page as a single unit, they connect facts, concepts, entities, and relationships from many sources to generate an answer. AI systems don’t treat pages as single units; they extract and recombine facts across sources. Your website becomes one source of evidence rather than the destination.
That changes what makes content valuable.
A polished landing page still matters for people. But before someone reaches that page, an AI system has already decided whether your information is clear, credible, and consistent enough to include in its response.
Many organizations approach answer engine optimization as a writing exercise. In reality, it starts much earlier.
AI systems need information they can understand. That depends on consistent terminology, structured content, clear metadata, well-maintained documentation, and a single source of truth across product pages, help centers, blogs, and FAQs.
When the same product is described three different ways across your website, you create uncertainty. A customer might work through those inconsistencies. An AI system is more likely to move on to a source that's easier to interpret.
Kemberly Gong, VP of Marketing at Contentful, recently described what AI systems look for: structured content, clear context, authority, and validation from other trusted sources. AI doesn't automatically accept what your brand says about itself. It looks for consistency across your own content as well as supporting signals from reviews, documentation, industry publications, and community discussions.
The goal isn't simply to publish more content. It's to build a body of knowledge that holds together.
Clear writing has always been good for readers. Now it's also good for machines.
Descriptive headings, concise paragraphs, clearly defined terms, logical structure, and scannable formatting all make it easier for AI systems to understand and reference your content. Those same qualities make life easier for human readers.
Content that’s easy for answer engines to interpret shares four characteristics:
Consistency: Use the same terminology across product pages, documentation, FAQs and blogs.
Clarity: Define technical terms the first time they’re introduced, and keep each section focused on a single idea.
Authority: Support your claims with original research, customer evidence, expert insights or other unique information.
Structure: Organize content with descriptive headings, a logical hierarchy and standalone sections that answer engines can easily interpret and reference.
Those principles don’t just improve readability. They also make your content easier for answer engines to interpret and include in AI-generated responses.
The web has no shortage of AI-generated summaries. What it lacks is information that exists nowhere else.
Original research. Customer data. Benchmarks. First-hand expertise. Strong opinions backed by experience. Those are the assets AI systems can't easily replace because they aren't available everywhere else.
That makes original thinking more valuable than ever.
When ten companies publish the same advice, AI has little reason to favor one over another. When your organization contributes something genuinely new, you become the source others reference.
Before investing in another AEO checklist, step back and ask:
Could an AI accurately explain what our company does?
Do our product pages, documentation, and thought leadership describe the same concepts consistently?
Is our expertise organized well enough to be cited?
Are we contributing original knowledge or simply producing more content?
Strong brands aren't disappearing from AI answers because they lack expertise. They're disappearing because their expertise is fragmented, inconsistent, or difficult for machines to interpret.
The organizations that gain visibility over the next few years won't necessarily publish the most content. They'll make their knowledge easier to understand, easier to verify, and easier to trust. That's good for AI systems, and even better for the people reading the answers.
About Contentful: Contentful helps organizations turn content into a strategic asset. Its headless CMS gives teams the tools to create structured, reusable, and consistent content across every channel, helping brands improve customer experiences while preparing for an AI-driven future.
Learn more at Contentful.com.
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.
Microsoft AI on Thursday released MAI-Transcribe-2, a speech-recognition model the company says is faster, more accurate, and cheaper than anything OpenAI, Google, or ElevenLabs currently sells. Then it priced the thing at 10 cents per hour of audio.
That figure deserves a pause. When Microsoft AI shipped the first model in this line just five months ago, it charged $0.36 an hour. Thursday's early-bird price cuts that by roughly 72%. For an enterprise processing 100,000 hours of call-center audio a year — a modest volume for a large bank or telecom — the bill drops from $36,000 to $10,000. At that level, transcription stops being a line item anyone argues about.
The release arrives as Microsoft executes a strategy that would have seemed implausible two years ago: building its own frontier-class models one modality at a time, then steadily swapping them into products that once ran on OpenAI's technology. Transcription is the modality where that plan has moved fastest, and MAI-Transcribe-2 is its clearest proof point yet. It also offers a preview of how the world's most valuable software company intends to compete in AI without depending on the partner it spent $13 billion to cultivate.
The model transcribes audio in 60 languages, up from 43 in June's MAI-Transcribe-1.5 and 25 in April's original release. It runs on Microsoft Foundry, the company's model marketplace for developers, and in MAI Playground, its testing environment. Microsoft says it built the model for the messy audio that real businesses generate — background noise, low-quality recordings, overlapping speech — rather than clean studio conditions.
More important than the language count is what Microsoft has bundled into the base product. Speaker diarization sorts out who said what in a multi-person recording, which is the difference between a wall of text and a usable meeting transcript. Word-level timestamps attach a precise time marker to every word, enabling search, editing, and alignment with video. Keyword biasing lets developers feed the model a list of drug names, product codes, or employee names so it stops mangling domain jargon. Automatic language identification means users no longer have to declare the language in advance.
Two features stand out for their specificity. A configurable output style offers a "verbatim" mode that preserves every "um," false start, and stutter for compliance and legal teams, alongside a "clean" mode that strips fillers for readable captions and notes. And code switching handles conversations that drift between languages mid-sentence; Microsoft explicitly names Hinglish and Spanglish, a nod to the Indian and U.S. Hispanic markets where a single customer-service call might toggle languages a dozen times. Specialty vendors have historically charged premiums for each of these capabilities. Microsoft is including all of them for a dime.
Microsoft makes three performance claims, each resting on a different measuring stick, and technical buyers should understand what each one captures and what it misses.
The first is that MAI-Transcribe-2 ranks number one on FLEURS across 60 languages with an average word error rate of 5.2%. FLEURS is a benchmark Google researchers published in 2022, built from native speakers reading roughly 2,000 sentences in each of 102 languages — about 12 hours of speech per language. It is the standard yardstick for multilingual speech recognition because it lets you compare a model's Swahili against its Swedish on identical content. Word error rate, its metric, simply counts substitutions, insertions, and deletions against a human reference; 5.2% means roughly one word in 20 is wrong. But FLEURS is read speech, not conversation, and Microsoft's average has actually risen from the 3.7% it reported for MAI-Transcribe-1.5 in June. That almost certainly reflects broader coverage rather than regression — averaging across 60 languages instead of 43 means folding in low-resource languages where every model struggles — but buyers should request the per-language breakdown.
The second claim is that the model ranks second on the Artificial Analysis word-error-rate leaderboard and defines that firm's accuracy-latency Pareto frontier. Artificial Analysis is an independent benchmarker that tests models through their public APIs, measuring what a customer actually gets. Its index blends simulated agent conversations, European Parliament speeches, and corporate earnings calls, weighting heavily toward English business speech. In June, the firm ranked MAI-Transcribe-1.5 third at 2.4% WER, behind Alibaba's Fun-Realtime-ASR-preview and ElevenLabs' Scribe v2, while calling it the fastest model in the top 10. Climbing to second suggests Microsoft has cleared ElevenLabs. "Pareto frontier" is the phrase practitioners should note: it means no rival beats the model on accuracy without being slower, and none beats it on speed without being less accurate.
The third claim is raw speed — 10 times faster than OpenAI's GPT-Transcribe, seven times faster than ElevenLabs' Scribe v2, five times faster than Google's Gemini 3.5 Transcribe, per Artificial Analysis evaluations. In batch transcription, speed matters less because anyone is waiting and more because throughput is cost. A model running at 300 times real-time needs a fraction of the GPU-hours of one running at 30 times. That efficiency is what lets Microsoft charge a dime and, presumably, still make money.
The pace is the story within the story. On April 2, MAI-Transcribe-1 launched with 25 languages at $0.36 per hour. On June 2, MAI-Transcribe-1.5 arrived with 43 languages, keyword biasing, and a third-place ranking on Artificial Analysis. Today, MAI-Transcribe-2 shipped with 60 languages, diarization, timestamps, code switching, a second-place ranking, and a price of $0.10.
Three releases in five months, each expanding language coverage by roughly 40% while adding features competitors gate behind premium tiers. That cadence is characteristic of a team that has settled on a stable architecture and is now turning the crank on data and scale — the phase where speech models tend to improve quickly and predictably. It is also the cadence of a company that intends to make transcription a commodity before anyone else can.
The organizational bet behind that speed is one Mustafa Suleyman, Microsoft AI's chief executive, described to The Verge in April. He credited the first model to "a small, focused 10-person team" that had been "liberated from any of the bureaucracy," with a larger surrounding group handling vendor management and data acquisition.
He also told The Verge the model ran at "half the GPU cost of the other state-of-the-art models," calling it "a huge cost-saving" for Microsoft. Meta, Amazon, Google, and Anthropic have all experimented with similar flattened structures, The Verge noted. Microsoft's transcription line is the most visible test yet of whether the approach produces commercial results rather than research papers.
Microsoft has invested more than $13 billion in OpenAI, and hosts OpenAI's models across Azure, Office, and Copilot. For most of the past four years, the obvious question about any Microsoft-built model has been: why bother? The answer has sharpened over the past year, and it begins with independence.
When Microsoft hired Suleyman from Inflection AI in March 2024, along with most of Inflection's staff, Salesforce CEO Marc Benioff read it as a declaration of intent. "Microsoft is building their own AI and I don't think Microsoft will use OpenAI in the future. They'll have their own frontier models," Benioff told CNBC in January 2025. "That's why they hired Mustafa Suleyman." Benioff had his own motives — Salesforce competes with Microsoft and invests in Anthropic — but events have largely borne him out.
In October 2025, Microsoft and OpenAI restructured their partnership in a deal that, per Microsoft's own announcement, allowed Microsoft to "independently pursue AGI alone or in partnership with third parties" for the first time. Suleyman told The Verge that renegotiation "unlocked [Microsoft's] ability to pursue superintelligence," and Microsoft announced its MAI Superintelligence team weeks later. In April 2026, the companies amended the deal again, ending Microsoft's exclusive access to OpenAI's models and eliminating Microsoft's revenue-share payments, according to reports at the time. Each amendment loosened the tie. Each one was followed by more MAI models.
The second half of the answer is margin. Every prompt Microsoft routes to an OpenAI model carries a cost. Every prompt it routes to its own model on its own GPUs carries a smaller one. In July, Bloomberg reported that Microsoft had begun using MAI models to answer a portion of user prompts in Word and Excel — products it had previously advertised as powered by OpenAI and Anthropic. TechCrunch framed the shift as part of a broader industry pullback on AI spending, with Amazon, Uber, Meta, and Accenture all reportedly trimming.
Transcription is the natural first target for this substitution because the problem is bounded and the metric is objective. Microsoft owns Teams, which generates an enormous volume of meeting audio. It owns Nuance, whose clinical documentation business runs on speech recognition. It owns the Azure speech services that thousands of enterprises already call. Every one of those workloads is a candidate to move onto MAI-Transcribe-2, and every hour that moves is an hour Microsoft no longer pays anyone else for.
Suleyman has been unusually candid that this is the point. Superintelligence, he told The Verge in April, "is really about, 'Are these models capable of delivering product value for the millions of enterprises that depend on us to deliver world-class language models?'" Whatever one thinks of applying the word "superintelligence" to a transcription API, the commercial logic is plain: build the capability once, deploy it across a dozen products, and stop writing checks to a partner that is increasingly a competitor.
Microsoft's release names four rivals: OpenAI's GPT-Transcribe, Google's Gemini 3.5 Transcribe, OpenAI's older Whisper V3-Large, and ElevenLabs' Scribe v2. It does not mention Deepgram, AssemblyAI, Speechmatics, or Rev — the specialists that have sold transcription to enterprises for a decade. Microsoft is positioning against the frontier labs, not the incumbents.
That framing is partly marketing and partly true. The frontier labs have treated speech as a checkbox feature of broader platforms, priced accordingly, and a dedicated model that beats them on speed by five to 10 times while matching their accuracy is a genuine differentiator. But the specialists will feel the price pressure most acutely. At $0.10 an hour, Microsoft is pricing at or below where many of them sell high-volume enterprise contracts, and it is bundling diarization, timestamps, and 60 languages into the base rate. The specialists' remaining moat is domain depth — medical vocabularies, legal formatting, industry-specific integrations — and Microsoft's keyword biasing feature is aimed squarely at it.
The one competitor Microsoft conspicuously does not claim to beat on accuracy is Alibaba, whose models have posted leading numbers on independent leaderboards for much of 2026. TechCrunch reported in July that some U.S. companies had begun evaluating Chinese models as cheaper alternatives despite security concerns. Microsoft's pitch to those buyers is implicit but unmistakable: comparable accuracy, faster inference, lower price, and a vendor your compliance team already trusts.
For all its specificity on benchmarks, the release leaves several practical questions open. The first is duration: Microsoft calls $0.10 per hour a launch offer without naming an end date or a standard rate, and anyone building a cost model should get both in writing. The second is streaming. The release emphasizes batch throughput and long-form audio but says nothing about real-time transcription, which voice agents and live captioning require. Artificial Analysis maintains a separate streaming leaderboard, and Microsoft's silence on it is notable.
The third is per-language accuracy. A 5.2% average across 60 languages could mean 3% on major languages and 12% on low-resource ones, so buyers with specific needs should test those languages directly. The fourth is diarization quality. Word error rate does not measure speaker attribution; a transcript can have near-perfect WER and still assign every other sentence to the wrong person. The release offers no diarization error rate or comparable metric.
The fifth is data handling. Enterprise transcription touches medical records, legal privilege, and financial disclosures, and the release says nothing about data residency, retention, or whether audio submitted to Foundry feeds future training. Microsoft's April announcements described training data as a mix of human-curated recordings, contractor-recorded noisy audio, and "vast amounts of data from the open web," per The Verge — a description that should prompt pointed questions from regulated industries. None of these gaps is unusual for a launch announcement, but they are exactly the questions that separate a leaderboard win from a production deployment.
Step back from the speech-recognition details and a pattern emerges that extends well beyond transcription. Microsoft's AI unit now ships models for images, voice, transcription, code, reasoning, and cybersecurity. At Build in June, it announced seven new MAI models in a singlekeynote. Each follows the same playbook: target a well-defined modality, optimize aggressively for inference cost, price below the frontier labs, distribute through Foundry, and quietly swap the model into Microsoft's own products.
This is not an attempt to build one model that beats GPT or Gemini at everything. It is an attempt to build a portfolio of specialized models that, in aggregate, let Microsoft serve most of its enterprise workloads without paying anyone else — and to sell the surplus capacity to everyone else at prices the specialists cannot match. Transcription happened to be the first modality where the approach fully matured, but the release notes for MAI-Transcribe-2 read less like a product announcement than a template.
Suleyman has spent two years talking about "humanist superintelligence" and AI assistants that are "accountable to them, on their side." The vocabulary is lofty. The execution is a spreadsheet. Five months ago, Microsoft charged 36 cents to turn an hour of speech into text. On Thursday it charged a dime, threw in six features its rivals sell separately, and claimed the top spot on the industry's standard multilingual benchmark. The company that spent $13 billion learning what frontier AI costs has decided it would rather own the factory than rent the output — and now it is selling the output for less than the rent.
MAI-Transcribe-2 is available now through Microsoft Foundry and MAI Playground.
Google keeps cranking out Flash models: the company on Wednesday announced two versions of a new 3.8 Flash.
The variants include a standard Flash, a “workhorse” model for agentic tasks, software development, and multi-step reasoning, and Flash Cyber optimized for vulnerability detection and mitigation.
Google CEO Sundar Pichai said in an X post that 3.8 Flash delivers “significant leaps” from 3.7 Flash across software engineering, agentic tasks, and multi-step reasoning. For instance, it outperformed many large frontier models on the DeepSWE coding benchmark, at far lower cost.
Meanwhile, Flash Cyber is the company’s “most capable” cybersecurity model, Pichai said; it also matches frontier-level performance when it comes to discovering vulnerabilities and patching them at scale. The model achieved 86.2% on the CyberGym cybersecurity benchmark and 47.2% on CWE-Bench, which evaluates AI patching abilities. In an internal Google benchmark, the model achieved a more than 70% success rate discovering vulnerabilities across 20 programming languages, Pichai said.
3.8 is Google’s third Flash release in six weeks and comes quickly on the heels of version 3.7.
3.8 Flash is available now in Gemini Enterprise; devs can try it out in the Gemini API via Google AI Studio, Google Antigravity, Android Studio, or generate UIs in Stitch. It is priced at $0.75 per million input tokens and $3.75 per million output tokens — the same introductory pricing as Gemini 3.7 Flash — and users can customize and adjust model effort levels based on their needs around quality, cost, and latency.
For instance, when compute efficiency is a priority, they can adjust to lower token overhead, or simply continue working with 3.7 Flash, which is “fully supported for efficiency-first workloads,” Google senior product director Tulsee Doshi and Gemini security lead Raluca Ada Popa wrote in a blog post.
“3.8 Flash works harder,” exhibiting “greater diligence” with complex tasks like executing extra reasoning steps, although at times it may use more tokens to maximize performance, Doshi and Popa note. The model has a 1M-token input window and a 64K-token output limit, and can ingest text as well as images, audio, video, and PDF files.
3.8 Flash was evaluated across numerous benchmarks testing coding, multimodal capabilities, computer use, long-context and knowledge work, and scientific reasoning. Google says it also does well in specialized knowledge domains requiring more in-depth analysis and reporting. For instance, the model outperformed its predecessor and other frontier models on benchmarks like Vals Finance Agent V2 for finance, and Harvey's Legal Agent Benchmark for law; it also scored 54.9% on Humanity’s Last Exam (HLE)-Verified, reflecting its ability to take on multi-step reasoning tasks across subjects like math, science, and humanities.
In one example shared by Google, Gemini 3.8 Flash built a game with a simple prompt using looping techniques in Google’s Antigravity platform. The game uses puzzles, storytelling that changes based on the environment, and images and textures from Nano Banana to create a 3D experience (in this case a wizard navigating a castle).
In other instances, the model created a fully-functional DOS version of Google Maps featuring interactive locations, directions, and street views; a 3D visualizer that automatically decomposed devices into layers for inspection with a slider capability; and a topographic map of famous geographical sites based on real datasets from the U.S. Geological Survey, complete with real-time cross-sections, 2D projections, and scientific explanations.
According to Arena.ai, 3.8 Flash landed at No. 14 in Agent Arena, ranking above DeepSeek-V4-Pro, and showed a significant jump over Gemini 3.7 Flash (which sits all the way down at No. 32). It debuted at No. 7 in Text Arena, ahead of Claude Opus 5 and Gemini 3.7 Flash. It improved over 3.7 Flash in several areas: multi-turn requests, writing, literature, and language, longer queries, hard prompts, coding, instruction following, software and IT services, and business, management and financial ops.
Flash Cyber is initially being rolled out to “trusted defenders” through Google’s Fairwind Program, which prioritizes government authorities, critical-infrastructure operators, and other partners looking for advanced cyber defense capabilities. Organizations can apply for access.
Google says the model version has undergone “rigorous training” in the cybersecurity domain and represents a “significant leap in prompt injection robustness.” It is particularly adept at autonomous vulnerability discovery — at least, based on internal Gemini benchmarks — and automated patching. It is also very good at coding, Popa said in a video.
The goal was to equip defenders with expert-level capabilities to give them a leg up over threat actors (whether malicious, fellow AI agents, or human hackers). “We have invested in vulnerability fixing from the start, and prioritized it over offensive capabilities like exploitation,” Doshi and Popa explain.
The model ships a more permissive set of mitigations for cybersecurity safeguards — which is why, for now, it is only being shared with limited partners — and safeguards against misuse in cyber offense and areas like chemical, biological, radiological, and nuclear (CBRN).
Google is already using 3.8 Flash Cyber to secure its own code; it produced 2.6 times more correct patches in Chrome vulnerabilities versus much larger commercial models.
Wiz — which Google acquired earlier this year at a historic $32 billion — reported that 3.8 Flash Cyber had 7.5% to 9.7% higher recall of real-world vulnerabilities on an internal penetration testing benchmark at 2.3 to 5.2 times lower cost than leading frontier models. Similarly, Google’s Cloud Vulnerability Research found a critical foundational vulnerability in less than 2 hours with 3.8 Flash Cyber. Typically, that research and discovery would take months, Google claims.
AI agents are “incredibly skilled” at finding and exploiting vulnerabilities, Popa said. Scanning large codebases with big AI models is expensive, and defenders are overwhelmed. “In cybersecurity, attackers need only find one significant flaw over millions of lines of code. Defenders have to remove every one of those flaws to be able to defend against attackers.”
Doug Turner, engineering director for Chrome, described a “vulnerability apocalypse” in recent months due to generative AI. “Simply overnight, we saw a hockey stick increase in the number of software vulnerabilities reported through our vulnerability research program,” he said in a video.
One interesting vulnerability 3.8 Flash Cyber discovered had been in Chromium and Chrome for 13 years, he explained. It was a “very subtle bug” that dozens, if not hundreds, of engineers looked at but never flagged. “Gemini 3.8 Flash Cyber is going to allow us to create better suggested fixes so that developers’ lives can get a lot easier.”
Meta is entering the increasingly competitive real-time speech-to-text market with Muse Voice Transcribe, a new audio perception model that combines streaming transcription, endpoint detection and speaker diarization for more than 20 speakers — at a public API price of just $0.18 per hour of processed audio.
Developed by Meta Superintelligence Labs, Muse is designed to process speech while it happens rather than waiting for a recording to finish. Meta’s launch post for Muse Voice Transcribe says the model supports long audio exceeding an hour, seamless multilingual code-switching, language and keyword biasing, and diarization without a separate post-processing pipeline. The model was trained across more than 70 languages, with 25 extensively validated for the initial release.
The 20-plus-speaker figure is substantial, but it is not a world record. A review of current vendor documentation turns up systems with higher published ceilings. Speechmatics' real-time transcription service says it can identify 50 speakers by default and up to 100 when the limit is increased, while Amazon Transcribe's diarization documentation specifies a maximum of 30 unique speakers, including for streaming transcription. (Speechmatics)
Muse nevertheless lands toward the high end of the market, and Meta's broader proposition is arguably more important than the raw maximum: high-capacity real-time diarization combined with low-latency transcription, endpointing, multilingual code-switching and aggressive API pricing in the same model.
For enterprise developers building meeting systems, call analytics, live assistants or ambient AI, that combination could matter more than who holds the speaker-count record.
Traditional speech recognition answers a relatively simple question: What was said? Diarization adds another: Who said it?
That distinction becomes critical as transcripts feed downstream AI systems. A meeting assistant can correctly transcribe every sentence and still create an unreliable corporate record if it attributes an approval, commitment or objection to the wrong participant. The same issue affects customer-service analytics, compliance workflows and AI agents operating in rooms where several people can speak.
Muse incorporates speaker attribution directly into its autoregressive multimodal architecture. Meta says audio arrives in 80-millisecond chunks, or 12.5 chunks per second, with each transformed into a soft token. At each step, the model decides whether to consume more audio or emit text. Meta calls this mechanism adaptive delay: rather than applying one latency budget to every word, Muse can wait longer when speech is ambiguous and commit earlier when it has enough context. Meta says reinforcement learning combines word-error-rate and delay rewards to train that behavior. Meta's technical explanation of Muse details the architecture. (Meta AI Research)
Speaker attribution and endpointing then become part of the same token sequence. A <|start_of_turn|> token marks a potential new speaker turn, tokens such as <|speaker_A|> identify the speaker, and separate onset and endpoint tokens identify speech boundaries. Meta says it trains ASR, diarization and endpointing together rather than running speaker clustering as an unrelated downstream process.
Meta's Model API speech-to-text documentation also exposes diarization as a first-class operating mode alongside push-to-talk and endpointing. Speaker labels such as A and B are scoped to a session rather than verified identities, and the API provides turn-level rather than word-level timestamps.
Speaker-count comparisons require care because vendors implement diarization differently and do not all publish a maximum.
Speechmatics currently makes the strongest explicit real-time capacity claim found in this review. Its real-time STT documentation says speaker diarization is available live, while its real-time FAQ says the system supports 50 speakers by default and can be increased to 100.
AWS likewise exceeds Meta's stated figure: Amazon Transcribe can differentiate a maximum of 30 unique speakers, and AWS provides explicit instructions for speaker partitioning in a streaming transcription.
Soniox supports diarization in both real-time and asynchronous processing, but documents a maximum of 15 speakers per session. AssemblyAI's streaming diarization system lets developers set max_speakers between one and 10. Both companies caution that live speaker attribution is more difficult because streaming systems must make decisions with less future audio context than offline models.
xAI's current Speech-to-Text API also supports speaker diarization in streaming mode, but its documentation reviewed for this story does not publish a maximum diarized-speaker count, so a direct ceiling comparison with Muse is not possible. (X.ai Docs)
That means it would be inaccurate to describe Muse's 20-plus capability as a new global record. The highest explicitly documented real-time number identified in this survey is Speechmatics' configurable 100-speaker ceiling.
Meta also does not demonstrate 20-plus simultaneous participants in its launch material. Its principal live demonstration uses eight speakers, while its long-form recording contains 11 labeled participants. The 20-plus number is a stated model capability rather than the participant count in the public demos.
Meta's pricing makes the competitive picture more interesting.
According to its Muse Voice Transcribe developer page, Muse costs $3 per 1,000 minutes, or $0.18 per hour. Streaming and non-streaming transcription cost the same, and Meta says zero-data-retention processing is priced at parity with standard processing. Billing applies to audio actually processed and is rounded down to whole seconds.
Standardizing publicly posted rates to one hour of streaming audio gives the following rough comparison:
Streaming speech-to-text service | Approx. public cost/hour | Real-time diarization |
$0.12 | Included; up to 15 speakers | |
$0.18 | Included; 20+ speakers | |
$0.20 | Supported; maximum not stated | |
$0.24 | Included; 50 default, configurable to 100 | |
~$0.324 international | No comparable maximum documented in source reviewed | |
~$0.35 base / ~$0.47 with diarization | $0.12/hour diarization add-on | |
$0.39 PAYG | Not supported in real time | |
$0.45 base / $0.57 with diarization | $0.12/hour add-on; up to 10 speakers | |
~$0.54 blended | Not supported in live mode | |
~$0.60 in AWS's N. Virginia streaming example | Included; up to 30 speakers | |
$1.02 | Diarization not listed as a model capability |
The comparison is necessarily imperfect. Qwen's price varies by deployment geography; its international real-time rate of $0.00009 per second works out to about $0.324 per hour. Google's Gemini figure is an estimated blended token cost rather than a flat hourly tariff. AWS prices vary by region and usage tier. ElevenLabs lists $0.39 per hour on its API pricing page but advertises $0.28 per hour or lower on annual Business plans.
Deepgram's pricing particularly illustrates why feature-level comparisons matter: its current Nova-3 Multilingual streaming rate is about $0.35 per hour, but speaker diarization costs another $0.002 per minute, bringing the comparable total to roughly $0.47 per hour. AssemblyAI similarly lists $0.45 per hour for Universal-3.5 Pro Realtime and another $0.12 per hour for streaming diarization.
Cartesia is harder to normalize because Ink-2 is packaged through monthly credit plans rather than a simple metered PAYG hourly rate. Its $5 Pro plan includes roughly nine hours and 16 minutes of Ink-2 transcription, which works out to about $0.54 per transcription hour if every credit is consumed exclusively on STT. That should not be treated as equivalent to a standalone $0.54 hourly API tariff.
Even with those caveats, Muse's positioning is clear. It is not the absolute cheapest streaming transcription service — Soniox currently publishes a lower equivalent rate — but $0.18 per hour with diarization included puts Meta toward the low end of the market, especially against providers that charge separately for speaker attribution.
At 1,000 hours of processed audio, Meta's public rate implies roughly $180 in transcription charges.
Price matters less if it comes with a large accuracy penalty. Meta's benchmark material argues the opposite.
On the Artificial Analysis AA-WER Streaming Index supplied with the launch, Muse records a 3.1% final-transcription word error rate, ahead of Cartesia Ink-2 at 3.4%, ElevenLabs Scribe v2 Realtime at 3.6%, Qwen3 ASR Flash Realtime at 3.7%, GPT Live Transcribe and Grok Speech to Text Streaming at 3.9%, and Gemini 3.5 Transcribe Live and AssemblyAI U3.5 Realtime Pro at 4.0%.
Meta points out that Muse took the number one spot on third-party independent AI benchmarking firm Artificial Analysis' streaming speech-to-text evaluation as of September 1. Meta published the following benchmark charts in its launch post.
Its diarization result may be even more relevant to the product's positioning. Meta reports an average 17.5% diarization error rate across AMI-IHM, AMI-SDM and VoxConverse, lower than the competing systems shown in its chart.
Speaker capacity and diarization error rate should not be conflated. A platform capable of representing 100 people is not automatically better at correctly attributing speech than one supporting 20, and Meta's benchmark does not test every competitor operating at its advertised maximum speaker count.
There are deployment tradeoffs as well. Meta's API currently provides turn-level but not word-level timestamps, and it does not expose word-level confidence scores, sound-event detection or emotion detection. The documentation also specifies eight concurrent streams per tenant by default and real-time sessions of up to 60 minutes before an application must reconnect.
Still, Muse's launch creates an unusually sharp price-performance proposition. Its 20-plus-speaker diarization does not establish a world record, but the record may be the less important metric. For enterprise developers, the larger question is whether a service can preserve speaker attribution, accurate text and usable turn boundaries while a complicated real-world conversation is still unfolding.
At $0.18 per hour, with 20-plus-speaker diarization inside the same real-time model that currently leads Meta's supplied streaming accuracy benchmarks, Muse Voice Transcribe gives enterprise teams a serious new option for meeting intelligence, live transcription and voice-agent infrastructure — while putting additional pressure on competitors to compete on speaker-aware accuracy and total operating cost, not merely raw speech recognition.





























