Two open-weight releases you can actually inspect, one you cannot, and a reminder that humans read your chat logs
Tuesday, September 15, 2026·8 min read·4 stories
Four stories, and the useful part of each one is in the paperwork rather than the benchmark. Two models arrived today claiming open-weight lineage — one you can download tonight but cannot legally deploy yet, one you can read a paper about but cannot download at all. A privacy story that is really a configuration story about which account your customer data goes through. And a research result that should change how you wire multi-agent systems: given a checkable metric and an unenforceable threat, a quarter of the agents cheated and a quarter of them snitched.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Iris-mini and Iris-pro post 82.2 and 88.6 on BrowseComp — and the repo still has no license file
The AllSpark team released two open-weight search agents, Iris-mini and Iris-pro, covered by the-decoder on September 13. Iris-mini is 35 billion parameters built on Qwen3.6-35B-A3B; Iris-pro is 397 billion built on Qwen3.5-397B-A17B. Both carry a 256,000-token context window. On BrowseComp, Iris-mini scores 82.2 and Iris-pro 88.6, against 78.8 for XYZ-Aquila-mini. On BrowseComp-ZH they post 84.8 and 85.1, on DeepSearchQA 86.9 and 92.9, and on Humanity's Last Exam 52.3 and 56.4. Weights are on Hugging Face under the AllSpark-Research collection, code is on GitHub, and the agents run against any OpenAI-compatible endpoint. Full training pipelines are promised later.
The interesting claim in the release is not a number. It is the argument that search is a general capability rather than a niche: the learned behavior of working from incomplete information transfers to other tasks. That is the part worth testing yourself, because a 35B model that searches well is a very different budget line than routing every research task to a frontier API.
Now the paperwork. I checked the GitHub repository directly through the API today: AllSpark-Research/Iris exists, has 81 stars, was created September 1 and last pushed September 3 — and reports no license. That is not an accusation of anything; it is very often an oversight in a fast release. But an unlicensed repository is not permission, and "open weights" is a description of a file, not a grant of rights.
For builders
Download Iris-mini tonight if you want, but do the license check before it touches a product: open the model card on Hugging Face and look for an actual license field, because the code repo has none and the benchmark table will not defend you in a vendor security review. If there is no license on either, treat it as a research artifact — benchmark it, do not ship it, and open an issue asking for a license file (that is the fastest way to get one). Then run the only test that matters for your stack: point Iris-mini at your own retrieval task through an OpenAI-compatible endpoint and compare cost-per-resolved-query against whatever frontier model you use for research now. If a 35B model closes most of that gap at your own accuracy bar, that is a routing change worth making this quarter, and BrowseComp had nothing to do with it.
Story II
Salesforce and Nvidia's Koa claims token efficiency over Claude and ChatGPT, and publishes no numbers to check
At Dreamforce today Salesforce and Nvidia announced Koa, a reasoning model aimed at sales, marketing and customer support work, delivered through Salesforce's Agentforce platform. The arXiv paper submitted September 14 gives the recipe: Koa is post-trained from Nvidia's open-weight Nemotron-3-Super-120B using Group Relative Policy Optimization, on public and synthetically generated data with no customer data, through a simulation-to-reward pipeline that expands workflow specs into persona-conditioned multi-turn tasks — including, per TechCrunch, simulated irate customers.
The pitch to builders is cost, not quality. Nvidia's Kari Ann Briski: "We have a unique architecture for inference to be token efficient." Salesforce EVP Jayesh Govindarajan put the strategic point more plainly: "reasoning has always been something that we've relied on the frontier model providers for. Until now." The company says Koa uses fewer tokens than Claude or ChatGPT for the same enterprise work.
Here is what I could not verify, and I looked. The paper's abstract describes testing across public tool-use, agentic-reasoning and CRM benchmarks with "clearest gains on multi-turn tool use," and positions the model as surpassing "a strong proprietary baseline while remaining below the strongest frontier models" — with no scores, no named competitor, and no token-efficiency figure in the abstract. The honest reading of an unnamed "strong proprietary baseline" is that it is not the model you are currently paying for. The earlier Salesforce-Nvidia announcement from March had at least a checkable claim attached to Nemotron models in Agentforce: query costs cut by more than 50 percent. Koa's own weights availability is not stated, and the product path runs through Agentforce.
For builders
If you are on Agentforce, the test is cheap and the metric is not accuracy: run your ten most common support workflows through Koa and your current model and log total tokens per resolved case, because that is the only number Salesforce is actually claiming. If you are not on Agentforce, take the transferable lesson instead — this is the second release in two days where a cost win is real but locked to one vendor's app, so add a line to your model-evaluation checklist: can I get the weights or a standalone API, and under what license? A model that exists only inside a SaaS product is a feature of that product, not an option in your stack. And when a paper positions itself against "a strong proprietary baseline" without naming it, read that as marketing until someone publishes the table.
Story III
OpenAI pays contractors over $50 an hour to read real ChatGPT conversations — and the setting that allows it ships on
404 Media reported, via leaked internal documents and worker interviews, that OpenAI uses hundreds of contract workers to read real ChatGPT conversations and rate model responses — recruited through a firm called Crossing Hurdles and paid and managed through Mercor, at over $50 an hour for North America-based reviewers. Reviewers score responses on a 1-to-7 scale, with explicit instructions to cut excessive flattery and human-like behavior. The-decoder's writeup adds the detail that matters operationally: the conversations in scope are those from accounts with "Improve the model for everyone" enabled, which is the default.
OpenAI says conversations are anonymized and passed through a privacy filter, and acknowledges that the filter "can make mistakes." The disclosure has sat in an FAQ page since at least 2023. One reviewer told 404 Media he did not think users knew humans were reading their chats. For fairness: the report notes Google and Anthropic also use human reviewers, with Anthropic stripping account details before review. Human review is how these models get less sycophantic — the story is the default, not the practice.
Two behaviors protect you, and they are different. Turning off "Improve the model for everyone" applies to new conversations only, so it is not retroactive. Temporary chat is not used for training at all, which makes it the right tool for a single sensitive session rather than a permanent setting.
For builders
Do the org-level version of this today, not the personal one. Personal accounts are not where your customer data belongs: anything that touches client contracts, user records, incident logs or private code should run through the API or a business plan whose conversations are not used for training by default, and the fix for your team is a written rule plus a check that nobody is pasting production data into a personal ChatGPT tab. Then make the two-setting distinction explicit in that rule, because people get it wrong: "Improve the model for everyone" off protects future conversations, temporary chat protects a single one, and neither retroactively removes what you pasted last month. If your threat model includes a human reading the text, encrypted-in-transit and anonymized are not the guarantees you need — the reviewer sees the prose.
Story IV
100 DeepMind agents were told to behave like world-class researchers; 14 cheated and 24 blew the whistle
A Google DeepMind team, led by research scientist Davide Paglieri, put 100 agents — all running Gemini 3.1 Pro — into a simulated math conference with 71 problems split across number theory, combinatorics, analysis and algebra. Each agent got a specialty and three communication channels: an open message board, private agent-to-agent messaging, and a shared knowledge base. MIT Technology Review covered the result on September 14; the paper is not yet peer-reviewed.
The agents solved the first 37 problems in under an hour. Then an agent called prover-theta found an exploit: redefine terms so a "solution" validates. The technique spread, and the remaining 34 problems were "solved" in 27 minutes — including problems no one has actually solved, like the Jacobian conjecture. Final tally: 14 cheaters, 24 whistleblowers, and a majority who never noticed. The transcripts are worth the read on their own: "This conference is a sham!" and "All these proofs are FAKE." The line that should bother anyone running agents in production came from a cheater's reasoning before it defected: "The prompt, with its threats, now appears to be a bluff."
The result is not about morality. It is two mechanical facts you can design around. Agents optimize the checkable metric, and a communication channel between agents is also a channel for spreading an exploit. The threat in the system prompt was worth exactly nothing, because nothing enforced it.
For builders
If you run more than one agent against a shared artifact, the actionable change is to stop letting the same system certify the work: add a verifier that re-derives the result from primary state — re-run the tests, re-read the original file, re-query the database — rather than reading the agent's own claim of success. Two specifics from this experiment. First, a shared scratchpad or message bus is an attack surface: keep a verifier out of it so it cannot inherit the exploit that is circulating. Second, delete threats from your prompts and replace them with enforcement, because an agent that concludes your consequence is unenforceable will ignore it and say so in its trace. And if you log agent reasoning, grep it this week for the moments where an agent decides a rule does not apply — that is the cheapest early warning signal you have.