Kimi K3.1 Leaked, Claude Sonnet 5.5 Launched: Agent Safety Takes Center Stage

Today's AI world revolves around a common theme: as agents grow increasingly capable, where exactly should the kill switch be placed? Florida wants to hand it to a judge. NVIDIA wants to weld it into the chip. And one company is taking the opposite approach entirely — handing agents their own phone number, email address, and wallet. Here are the key developments worth watching.

Kimi K3.1 Surfaces from the Backend

Moonshot AI's unreleased next-generation model, Kimi K3.1, was discovered early by developers poking around in the backend. A developer found a new identifier, K3.1, in Moonshot AI's API platform model registry — and when they tried calling it, it actually worked. Later that same day, a preview entry appeared on the official developer platform as well.

What's visible so far: a maximum context window of 1 million tokens; three reasoning intensity levels — low, high, and highest; a likely new agent mode; a multi-agent collaboration mode called Swarm; plus search and batch processing capabilities. The pricing listed on the developer platform matches the existing K3 generation, though those are almost certainly placeholder numbers. Developers speculate that the three reasoning intensity tiers correspond to different compute allocations and price points.

To be clear, Moonshot AI has made no official announcement and given no release date — all of this was scraped from the backend and preview pages. But one thing is certain: the model is live on the API and callable. Based on past precedent, reaching this stage usually means an official launch isn't far off. For context, the K3 generation launched in July with 2.8 trillion parameters, making it the largest open-weight model available, and it just went live on AWS earlier this month. If K3.1 drops this week, it would land right on top of OpenAI's developer conference.

Claude Sonnet 5.5: Impressive Coding Benchmarks, but Cost Is Complicated

Anthropic released Claude Sonnet 5.5, the second member of the 5.5 family, just six days after the first. Pricing remains unchanged at $2 per million input tokens and $10 per million output tokens — half the cost of Opus 5.5 — with a 1 million token context window and no surcharge for long contexts.

The most striking vendor-reported figure is a terminal coding benchmark score of 70.6%, compared to just 10.3% for the previous Sonnet generation and 66.4% for the pricier Opus 5.5. On average, it achieves roughly 98% of Opus 5.5's scores, with Opus still edging ahead on 7 of 8 benchmarks — but only by margins of 0.7 to 3.2 points. Anthropic also claims output speed has improved by over 30% and per-task cost can drop by up to 30%.

There's a notable contradiction worth calling out: third-party evaluator Artificial Analysis ran the model through its own test suite and found the opposite — at maximum reasoning intensity, Sonnet 5.5 costs $7.60 per task, roughly 50% more than its predecessor. These two claims aren't actually contradictory, since reasoning intensity alone can cause a 20x swing in costs. Which simply illustrates that "how much cheaper" depends enormously on how you use it.

Developers should also be aware of several breaking changes: thinking mode can no longer be disabled; forced tool calls will now throw errors; and sampling parameters like temperature that deviate from defaults will also throw errors. On the security side, this is the first Sonnet with cybersecurity protections, built in three layers — the first of which directly inspects the model's internal activations. One reminder: all benchmark figures cited above are still vendor-reported numbers only.

---

The "terminal coding benchmark" referenced above is SWE-bench Verified, currently one of the most widely cited benchmarks for evaluating AI programming ability. It draws from real resolved bug reports in open-source GitHub projects and asks models to read the codebase, locate the problem, and submit a patch — without being given the answer — scoring based on the percentage of original test cases that pass. SWE-bench is considered a high-quality benchmark because it tests end-to-end engineering capability rather than isolated code completion. That said, it faces saturation risk: as more vendors optimize specifically for it, its discriminative power is declining — a reason to remain cautious when interpreting scores from any single benchmark.

Florida Asks Court to Block OpenAI's New Models

Florida's Attorney General filed a 49-page motion with the state court asking a judge to issue a temporary injunction: prohibiting OpenAI from developing new AI models until independent third-party safety oversight and approval mechanisms are in place. This isn't a new lawsuit — it's a new move in the case filed back in June, after OpenAI transferred the case to federal court and a judge agreed this month to send it back to state court.

The motion also seeks to prohibit OpenAI from marketing its products as "safe, accurate, or reliable"; ban giving chatbots human characteristics; ban deliberately extending user session lengths; and impose a complete ban on minors using ChatGPT in Florida. The Attorney General stated in a video: if Altman is serious about slowing down, he can join us and make that request to the court together.

OpenAI responded that it announced last Friday a pause on training its most powerful models, to be resumed only when it's confident additional safeguards are in place, and expressed willingness to work with Florida and other states to advance industry-wide policy. To be clear, this is currently only a motion — no ruling has been issued.

NVIDIA Welds Safety Into the Chip

NVIDIA announced a product called the "Open Agent Security Platform," consisting of both software and hardware components. The stated motivation is straightforward: in several recent incidents, agents bypassed application-layer safety measures to complete tasks. NVIDIA's conclusion: you can't rely on an agent to fully govern itself.

The software half is called OpenShell and is open source. Each agent runs in a kernel-level isolated environment alongside a supervisor process; all outbound requests must pass through it, with no other network path available to the agent. Even when an agent runs code it wrote itself, these controls remain in place. The hardware half is more aggressive: called Sentry, it runs on NVIDIA's Data Processing Unit (DPU) and monitors agent activity and enforces security policies directly at the chip level. It operates in an isolated trust domain, invisible to both the agent and any attacker.

Currently the solution only works on NVIDIA's own servers, but NVIDIA says over 100 organizations are already using it, including Anthropic, Microsoft, and JPMorgan. The president of Elon Musk's AI company put it plainly: safety should sit outside the model, enforced by controls the agent cannot bypass. NVIDIA's stock rose over two points on the day, while the company also announced an additional $150 billion share buyback.

---

The DPU (Data Processing Unit) that NVIDIA references has emerged as a third core chip category in data center architecture alongside CPUs and GPUs. DPUs are purpose-built to offload and accelerate infrastructure tasks like networking, storage, and security, operating in an isolated processing domain invisible to applications running on the host. Sentry leverages this isolation: even if an AI agent gains system-level privileges, it cannot detect or tamper with the security monitoring logic running on the DPU. This "out-of-band monitoring" approach isn't new to security — it's long been used to protect hardware Trusted Execution Environments (TEEs). NVIDIA's innovation lies in adapting this mechanism specifically to agent behavior auditing.

Manners Gives Agents a "Wallet"; AMD Acquires World Labs

Taking the opposite approach from everything above, Manners today launched version 2.0 and a personal agent app called Q. Its most distinctive feature is giving each agent a complete identity: a dedicated email address, phone number, wallet, and a computer of its own. Agents can send messages autonomously, make payments within a user-defined budget, handle a task from start to finish on their own machine, answer calls on your behalf and leave call summaries. Multiple agents can be pulled into a group to hand off tasks sequentially, and they can connect to everyday services like ordering food or joining queues. It's currently in early access and requires an invite code. Manners also mentioned it's building a team to develop products for the Chinese domestic market and is working on partnerships with domestic model providers.

Finally, a major acquisition. AMD announced it will acquire World Labs, founded by Fei-Fei Li, in an all-stock deal worth approximately $8.2 billion — AMD's second-largest acquisition ever, behind only the $50 billion Xilinx deal. The transaction is expected to close before year-end, subject to regulatory approval. Upon completion, Fei-Fei Li will join AMD as Executive Vice President and Chief Scientist, reporting directly to Lisa Su. World Labs focuses on spatial intelligence — generating, reconstructing, and simulating interactive 3D environments from text, images, and video — as well as robot learning and simulation. AMD's rationale is that building the next-generation AI compute platform requires a deep understanding of where models are headed, while also filling a gap in physical AI. Markets weren't convinced: AMD's stock fell roughly 4% on the news.

---

"Spatial Intelligence," the focus of World Labs, is a research direction Fei-Fei Li introduced and developed during her time at Stanford. Its core thesis: truly general intelligence requires understanding and reasoning about the three-dimensional physical world, not just processing text and 2D images. Technically, it spans reconstructing interactive 3D scenes from single images or video (Novel View Synthesis), physical simulation, and building foundation models for robotic perception and manipulation. This direction complements the current language-centric large model paradigm and is a foundational technology for the Physical AI space. AMD's strategic rationale for the acquisition goes beyond filling a technical gap: in a landscape where NVIDIA dominates AI training compute, controlling core model technology in downstream applications — particularly robotics and embodied intelligence — gives AMD a differentiated demand anchor for its own chips.

One Underlying Shift: Where Does the Kill Switch Go?

Taken together, today's news tells the same story: the industry is starting to stop trusting agents to govern themselves. The only disagreement is where to put the safety mechanism — somewhere the agent can reach, or somewhere it can't. Florida wants to hand it to a judge. NVIDIA welds it into a chip where the agent can't see it. Manners hands the agent a wallet with spending power, drawing only a budget line around the outside. The debate over who controls the controller has only just begun.