Speeding up robotics developmentBy bringing together advanced visual-semantic reasoning, deep physical understanding, and autonomous code generation, Argon unlocks new workflows across the robotics stack and accelerates progress toward physical AGI. This leap in capability is reflected in Argon’s performance on the Embodied Reasoning (ERQA) benchmark, which tests a model’s ability to understand and solve physical, spatial problems in 3D environments. Relying on pure reasoning, Argon outperforms all other frontier models, with an 87% score.To demonstrate these capabilities in action, we tested Argon’s ability to learn an out-of-distribution physical skill simply by watching. In an internal test, Argon watched a raw video of a human playing cornhole, mapped the spatial coordinates of the environment, and calculated the required whole-body joint movements. It then autonomously built the simulation code. When transferred onto Apptronik’s Apollo humanoid, the robot quickly sank seven consecutive shots in a real-world trial.This “Video-to-Sim-to-Real” pipeline compresses weeks of manual simulation modeling into a few hours, transforming ordinary videos into a scalable, infinite training ground for robotics. Learn more about how this accelerates the pace of development in robotics in our developers blog.

Gemini 4 Argon marks a step change in physical understanding, code generation, and visual-semantic reasoning—unlocking new workflows across the robotics stack and accelerating progress toward physical AGI.You can see this leap in capability on the Embodied Reasoning (ERQA) benchmark, which tests a model’s ability to understand and solve physical, spatial problems in 3D environments. Using pure reasoning, Argon scores 87%, outperforming every other frontier model.

As a general-purpose physical reasoning model, Argon can be applied across the entire robotics lifecycle. In this post, we share representative prompts for Argon across four key areas:Robot control → Mobile manipulation with MuJoCo practice, zero-shot robot control, and closed-loop steering of video world models.Real2Sim → Reconstructing physically calibrated simulation twins from robot camera feeds, egocentric human video, or hand-drawn paper sketches.Physical understanding → Agentic multimodal hindsight labeling including detailed understanding of dexterity, dense value functions and progress estimation.Research and self-improvement → Action improvement via simulation and iterative self-improvement on hardware.Unlocking robot control with Argon1. Spot mobile manipulation: Putting in the trash bin with MuJoCo practiceArgon controls a Boston Dynamics Spot® quadruped (12-DoF legs + 6-DoF arm) to learn a new skill: stepping on a foot-pedal trash bin to throw away soda cans. Argon creates an articulated MuJoCo digital twin of a foot-pedal trash bin to practice its moves before stepping on the physical pedal and dropping soda cans into the open bin.

Sorry, your browser doesn’t support playback for this video

Spot Mobile Manipulation — Real-to-Sim-to-Real foot-pedal trash bin disposal: Spot picking up the soda can, checking its wrist camera, practicing 3-leg tripod balance in MuJoCo, stepping on the foot pedal, verifying hand centering in the open bin, and dropping the can inside.

There’s a Diet Coke can behind you and another on the black table on your left.
Use the spot-mobile-manipulation skill to pick them up and trash them in the black foot-pedal bin.
Before stepping down on the pedal, verify in the front cameras that your front-right foot target is centered on the pedal, and use a 2-agent verification swarm (foot-verifier and hand-verifier) to verify both the foot-pedal step and the 3D hand-in-bin alignment before releasing.

Plain text

2. Zero-shot controlArgon controls a simple robotic arm to place a fallen mug upright and put the crumpled napkin inside. Argon reasons with a visual coordinate harness and action primitives to perform this task over several turns.

Sorry, your browser doesn’t support playback for this video

Left: 3rd-person real robot view; Right: calibrated wrist camera with projected 2 cm world coordinates and jaw-closing reticle.

[Attached: wrist_cam.png, obs.json]

Task: Get the robot arm to reorient the mug upright and put the napkin inside the mug.

## Execution Discipline
– Simply output 1 sentence observation followed immediately by your `curl` command (with `# Plan:` on Turn 1 and `# Thought:` on every turn). Everything needed is in `obs.json` and the calibrated reticle/grid drawn on `wrist_cam.png`.

## Visual Coordinate Reference (Annotated on wrist_cam.png)
– `+X` (UP in image): Away from robot base | `-X` (DOWN): Towards robot base
– `+Y` (LEFT in image): World left | `-Y` (RIGHT): World right
– `+Z`: Height above table | `Yellow numbers`: World (X, Y) in centimetres (2 cm grid at `grid_z`)
– `Cyan + crosshair`: Current 3D pinch center
– `Cyan [ + ] brackets`: Current jaw opening and closing line
– `Green line`: Current object long-axis orientation (`yaw_deg`: 0° = vertical along +X, 90° = horizontal along +Y)
– `pitch_deg = 90°`: Straight down (-Z) top-down grasp/place; `pitch_deg `grasp` – > `place` – > `done`
– Pre-Grasp Hover Verify (4–7 calls): `look_at` – > `goto(z=0.04)` (verify cyan `[ + ]` brackets straddle target) – > `grasp` – > `place_until_contact` – > `done`
– Fine Visual Servoing (8–20 calls): `look_at` – > `grasp` – > pre-pose `goto` – > closed-loop `move_by` / `move_until_contact` – > `done`
3. Send motion primitives (`POST /plan`) and verify visually after every turn in the updated `wrist_cam.png`. If `status == “grasp_failed”`, call `robot.look_at(…)` to re-observe and recover closed-loop.

## Code-as-Policies Primitives (`POST http://127.0.0.1:8081/plan`)
robot.look_at(x=0.35, y=0.13, z=0.14, grid_z=0.015)
x, y = robot.deproject(u=0.52, v=0.48, z_plane=0.015)
robot.grasp(x=x, y=y, z=0.015, yaw_deg=-35, pitch_deg=90)
robot.place(x=0.24, y=0.06, z=0.075)
robot.place_until_contact(x=0.24, y=0.06, z=0.015, max_lag=0.012, relief=0.002)
robot.goto(x=0.28, y=0.05, z=0.04, arc_z=0.14, pitch_deg=25, azimuth_deg=90, roll_deg=0, speed=0.10)
robot.move_by(forward=0.025, dz=-0.002, dpitch_deg=-3, droll_deg=5, speed=0.04)
robot.move_until_contact(dz=-0.06, speed=0.03, max_lag=0.012, relief=0.002)
robot.open_gripper() / robot.close_gripper() / robot.home() / robot.done()

Plain text

3. Omni controlArgon steers robots in the Gemini Omni World Model to rearrange five scattered Scrabble tiles (G, R, A, N, O) into a clean row spelling A – R – G – O – N. Instead of specifying one static prompt, Argon steers in a closed visual loop. It writes timestamped action prompts, inspecting intermediate rollout keyframes, and refining its prompts.

Sorry, your browser doesn’t support playback for this video

Iterative Video World Model Steering Dexterous Hands: 33-Step Steered Video Rollout Spelling A-R-G-O-N.

Goal: {task_goal}

You are steering a video world model (Gemini Omni) in an iterative visual feedback loop. Inspect the attached frames from the latest rollout and write the next timestamped action prompt for the video world model:
– Break complex motions into one simple, single-direction action at a time.
– Keep inactive hands retracted and avoid blocking the camera’s view of objects in the workspace.
– Explicitly state which areas of the workspace become empty after an object moves.
– Use [MM:SS.mmm] timestamps for each action beat and wrap your output in tags.

Example format (sample timestamps only, not the full prompt):

[00:00.000] Character A’s left hand rests at the side while the right hand reaches toward the target object.
[00:02.500] Character A’s right fingertips push the object smoothly into the center of the table, leaving its starting area empty.
[00:05.000] Character A’s right hand opens and retracts to the side so all placed objects remain in clear view of the camera.

Plain text

Unlocking Real2Sim with Argon1. Robot view to simulationArgon views a real robot teleoperation episode and develops a digital twin; it obtains or creates simulation assets that look and behave like the real objects upon contact with the dexterous hands. Argon tunes the assets and scenes to match sim visuals and contact events with those in the real recorded data in an iterative visual-reasoning loop.

Sorry, your browser doesn’t support playback for this video

Left (Real View): synchronized real robot camera feeds; Right (Simulated): 3D MuJoCo scene reconstructed and calibrated by Argon.

[Attached: robot_rollout_episode]

Build a MuJoCo scene of the robot and reconstructed task objects. When each episode is replayed frame by frame, by driving the robot joints toward the logged observation.state with joint-space PD.

Iterate using two verification objectives:
(1) Visual match: MuJoCo renders from the head_left, left_wrist, and right_wrist cameras line up with, and look like, those real observations.
(2) Physical match: the simulated contact force/torque on each Sharpa fingertip, in the sensor frame, matches the logged tactile_force in timing, magnitude and direction.

What you can tune happens before simulation starts:
(1) Static object assets: realistic geometry, collision shapes, mass, inertia, friction and joints, with appearance close to the real objects, plus the initial object poses at t = 0.
(2) Offline-planned robot commands, changed only in frames where the real fingertips are near an object. Each command must stay within 0.55 rad (arm joints) and 0.65 rad (hand joints) of the logged teleop trajectory. Everywhere else, replay the logged trajectory unchanged.

No sim cheating: task objects may move only through real MuJoCo contact with the robot hands and the environment (mj_step).
Not allowed after t = 0: changing MjModel parameters; applying external forces or torques to objects; welds or equality constraints; feedforward torques beyond joint-space PD; setting or rolling back object qpos/qvel; disabling or excluding collisions; reporting contact forces that don’t come from the MuJoCo solver (for example, copying the logged tactile readings).

Immediately present the reconstructed scene and rollout results as an interactive HTML session viewer with one page per episode, showing:
– At the bottom: A synced timeline (play, scrub, speed control) that drives every panel.
– On the left panel: An interactive 3D Blender scene showing the simulated robot and objects, showing contact points and force arrows as replay progresses.
– On the right panel: Real vs. sim camera views side by side for all 3 cameras. Real vs. sim finger force visualizations.

Plain text

2. Human view to simulationGiven an egocentric human video of a manipulation task, Argon identifies the task-relevant objects, replaces crude bounding boxes with compound convex-decomposed meshes for concave containers, and retargets the human hand trajectory onto a 76-DoF bimanual humanoid with 22-DoF five-fingered hands in MuJoCo contact physics.

Sorry, your browser doesn’t support playback for this video

Human View to Simulation — Egocentric Human Video to Dexterous Humanoid Twin: Left shows the input egocentric human RGB video; Right shows the synchronized 500 Hz MuJoCo + Blender Cycles multi-view simulation rollout.

[Attached: egocentric_human_video.mp4, candidate_sim_views.png, hand_3d_keypoints.json]

You are building a physically solvable 500 Hz MuJoCo manipulation environment (`scene.xml`) and studio Blender render that faithfully reproduces the tabletop task shown in `egocentric_human_video.mp4` on a bimanual humanoid robot with 22-DoF dexterous five-fingered hands:

1. Scene Reconstruction & Camera Calibration:
– Identify only the manipulation-relevant objects (the grasped target object and the receiving container or landmark) and triangulate their 3D tabletop coordinates from the egocentric camera intrinsics/extrinsics.
– Replace crude bounding boxes with compound convex-decomposed 3D meshes so concave containers (nested bowls, recessed wooden trays, open bins) support physical interior placement.

2. 500 Hz Dexterous Motion-Fitting Stress Test:
– Retarget the 3D human wrist and finger keypoints to the humanoid’s 7-DoF arm and 22-DoF hand joints, and step the trajectory in MuJoCo at 500 Hz (dt = 0.002s) with zero kinematic weld constraints.
– Verify opposing thumb-and-finger force closure, clean object lift ( > 2 cm), and stable final placement inside or beside the target landmark.

Plain text

3. Sketch to simulationWith Argon, a developer can snap a photo of a rough pen-and-paper sketch—showing an Apollo 2 humanoid throwing a ball along a parabolic arc to topple a 3-2-1 stack of boxes on a table—and have Argon automatically construct the GPU-accelerated mujoco_warp scene, synthesize a balanced 76-DoF whole-body and five-finger throw trajectory, verify 6/6 target knockdown in closed-loop physics, and export a Blender 4.5 Cycles render.

Sorry, your browser doesn’t support playback for this video

Sketch to Simulation — Hand-Drawn Sketch to Dexterous Humanoid Trajectory & Cycles Render.

[Attached: hand_drawn_throw_sketch.jpg]

Translate this hand-drawn sketch into a physically verified humanoid simulation in `mujoco_warp` and a raytraced Blender Cycles video:

1. Scene & Kinematic Setup from Sketch:
– Parse the spatial layout from `hand_drawn_throw_sketch.jpg`: place the 76-DoF humanoid (32-DoF body equipped with two 22-DoF five-finger dexterous hands) at the origin facing a table holding a 3-2-1 pyramid of 6 rigid target boxes, with a projectile sphere grasped in the right five-finger hand.

2. Whole-Body Balance & Dexterous Throw Synthesis:
– Synthesize a 50 Hz whole-body throwing trajectory (140 steps, 2.80 s) across four phases: (1) stable stance & 5-finger power grasp closure, (2) torso/shoulder wind-up with ankle-hip Center-of-Mass compensation, (3) forward whipping acceleration, and (4) synchronized 22-DoF five-finger opening at peak hand velocity so the ball launches on a ballistic arc into the pyramid’s second-tier center of mass.
– Verify in `mujoco_warp` contact physics that the humanoid maintains upright balance (< 3 cm pelvis drift) and knocks down all 6 target boxes.

Plain text

Unlocking physical understanding with Argon1. Hindsight labeling and data qualityArgon has precise physical understanding of dexterous manipulation and can provide detailed segmentation and text labeling from video. Argon is able to identify poor manipulation segments such as pauses, unstable grasps and fumbles. Given an overhead video of a bimanual ALOHA 2 robot folding a square sheet of paper into an origami fox over 136 seconds, Argon produces a time-aligned 4-level hindsight annotation hierarchy: Episode Goal (G1), 6 contiguous Semantic Subtasks (G2), 17 contact-level Atomic Primitives (G3), and automated Quality Control (QC) reweighting that holds task progress flat during fumbles and retries.

Sorry, your browser doesn't support playback for this video

Argon Multi-Granularity Hindsight & Telemetry HUD.

[Attached: Aloha2_Origami_20250309.mp4]

Produce a time-aligned multi-granularity hindsight annotation JSON with four levels:
1. G1_episode_instruction: Concise imperative sentence describing the overall manipulation goal.
2. G2_subtasks: Contiguous semantic subtask phases specifying which arm(s) anchor vs. fold/rotate the object.
3. G3_atomic_primitives: Fine-grained contact-level primitives (3–15s) aligned with grasp closure, crease sweeps, release, or retry attempts.
4. quality_control_and_reweighting: Hold task_progress_pct flat during non-progressing slip/delamination retry loops and downweight them (0.15x–0.25x) for Behavior Cloning.

Plain text

2. Find the odd ballTo recreate the classic 12-ball balance scale puzzle with robots, Argon builds a bimanual Franka FR3 MuJoCo environment with 12 visually identical pool balls (one secretly heavier or lighter) and an articulated Roberval two-pan balance scale. It then writes a vision-only closed-loop solver that triangulates the balls from stereo RGB cameras, visually reads the scale tilt after each weighing, and isolates the odd ball into the Heavy (Red) or Light (Blue) tray within 3 weighings.

Sorry, your browser doesn't support playback for this video

Find the Odd Ball (Vision-Only Closed-Loop Solver): Dual-arm Franka FR3 weighing candidate balls on the Gold/Teal pans, reading stereo scale tilt , and isolating the confirmed Heavy odd ball into the Red tray in 3 weighings.

# Prompt 1 — Physics-Accurate MuJoCo Environment & Benchmark Generation
Make a MuJoCo environment where a dual-arm robot (two 7-DoF Franka FR3 arms with parallel-jaw grippers on a shared tabletop) is tasked to solve the classic 12-ball balance scale weight puzzle from https://www.mathsisfun.com/pool_balls_solution.html.
1. Create 12 visually indistinguishable pool balls in a 2×6 starting rack (11 standard 150 g, 1 odd ball either 270 g or 30 g).
2. Build a functional two-pan Roberval balance scale at the center of the table with parallelogram equality constraints (`mjEQ_JOINT`) so the Left (Gold) and Right (Teal) pans stay horizontal, plus Red (Heavy) and Blue (Light) submission trays.
3. Track distinct settled weighings (`weighing_count`) and reward `1.00` for isolating the true odd ball in the correct Heavy/Light tray within

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. Open models have real benefits. Do they outweigh the risks? Anthropic recently released a report arguing that a powerful new model released by the Chinese company Z.ai, poses a major cyberattack risk. Its core concern was that it is freely available for anyone to download and modify. The warning was the latest flashpoint in a debate over whether frontier AI models should be open or kept behind the doors of frontier labs. Safety advocates warn that open models can be misused by bad actors, while supporters argue they could prevent a handful of companies from controlling this powerful technology. Here’s why the debate over open AI is more complicated than it seems.
—Grace Huckins This story is part of MIT Technology Review Explains, our series untangling the complex, messy world of technology to help you understand what’s coming next. Read more from the series here. 
10 Climate Tech Companies to Watch: Fervo Energy and its plan to streamline geothermal power Fervo Energy is one of MIT Technology Review’s10 Climate Tech Companies to Watch 2026, available exclusively to subscribers. Fervo Energy wants to expand geothermal power beyond the handful of places where it has traditionally been practical. The company uses horizontal drilling and hydraulic fracturing to open pathways through underground rock, potentially making geothermal development possible in far more places. Now, Fervo is betting that AI’s power boom will help scale up enhanced geothermal energy. With a $2.2 billion public offering and an expanded agreement with Google, it plans to build larger plants and drive down costs. But can its approach work beyond Utah and Nevada? Read the full story to find out. —Eshan Raul Subscribers can now access the full 10 Climate Tech Companies to Watch, spanning everything from sustainable cement to shipping containers packed with old EV batteries.  The must-reads I’ve combed the internet to find you today’s most fun/important/scary/fascinating stories about technology. 1 A cyberattack overheated fridges at hundreds of French supermarketsTemperatures rose to 120°F, spoiling food and sparking fires. (BBC)+ The attack has sparked alarm about cyber threats to food security. (FT $)+ It joins a recent wave of cyberattacks and cybercrimes. (CNBC)+ AI is exacerbating the threats. (MIT Technology Review)

2 Meta has launched a bunch of new AI modelsIt hopes the models, built for complex, multi-step tasks, will rival OpenAI’s and Anthropic’s.(BI)+ They scored well on tests of reasoning, writing, and coding. (NYT $)+ Mark Zuckerberg says they bring Meta to the “frontier” of AI. (FT $)+ And will soon power the Muse agent. (Verge) 3 Anthropic warns that AI models may soon self-replicate across devicesWithout even requiring access to data centers. (Reuters $)+ It says models could spread through smart TVs and appliances. (CNBC)+ We’re putting too much faith in AI saying no. (MIT Technology Review) 4 Police have a new AI tool that finds homes from interior photosIt can match single pictures to Airbnb and Zillow listings. (404 Media)+ Police-tech giant Flock is tightening its rules. (MIT Technology Review) 5 The world’s first utility-scale enhanced geothermal plant is onlineFervo Energy’s Utah facility will supply carbon-free electricity. (IEEE)+ AI is uncovering hidden geothermal resources. (MIT Technology Review) 6 Did drone strikes on Yandex data centres blitz Russian bots?Zelenskyy claims the attacks quietened Kremlin-funded social media accounts. (Euronews) + But troll farm experts aren’t convinced. (Verge) 7 NASA’s Perseverance rover has set a Mars driving recordIt’s covered 28 miles since landing in 2021. (Reuters $)+ The rover passed Opportunity after detouring to study ancient rocks. (NYT $) 8 Elon Musk has become the 2026 midterms’ biggest known donorHe gave $158 million to a Republican Senate super PAC. (AP News) 9 Anduril and Palantir founders have backed execution livestreamsPalmer Luckey and Joe Lonsdale support Pete Hegseth’s plan. (Mother Jones)
10 A spacecraft has traced how a mysterious solar switchback formedThe Solar Orbiter’s discovery could improve space weather forecasts. (Gizmodo) Quote of the day
“Many AI researchers have started smoking as a way of signaling to other researchers how much they believe in AI.”  —Palantir CTO Shyam Sankar tells CBS News that Silicon Valley’s “social delusion” has convinced researchers to smoke because they expect AI to cure cancer. One more thing A brain implant changed her life. Then it was removed against her will. Sticking an electrode inside a person’s brain can do more than treat a disease. Take the case of Rita Leggett, an Australian woman whose experimental brain implant changed her sense of agency and self. She told researchers that she “became one” with her device. She was devastated when, two years later, she was told she had to remove the implant because the company that made it had gone bust.Her case highlights the need for a new category of legal protection: neuro rights. Explore how they could be protected. —Jessica Hamzelou We can still have nice things A place for comfort, fun, and distraction to brighten up your day. (Got any ideas? Drop me a line.) + Astronomers have captured the clearest image yet of a medieval supernova.+ Watch centuries-old Chinese paper-cutting techniques create a spectacular work of art.+ Artist Josh Gluckstein creates astonishing animal sculptures from recycled cardboard, including this great white shark.+ An endangered sea turtle named Pancake has returned to the ocean for the first time in months after recovering from hypothermia.

MIT Technology Review Explains: Let our writers untangle the complex, messy world of science and technology to help you understand what’s coming next. You can read more from the series here. Late last month, Anthropic released a report arguing that the model GLM-5.3 poses a major cyberattack risk. The report’s core concern is that the powerful new model, released in August by the Chinese company Z.ai, is freely available for anyone to download and modify. Anthropic’s assertion is only the latest move in a long-running debate about whether frontier AI models should be made open, like GLM-5.3, or should stay locked behind the doors of the frontier labs.  These days, much of the debate about how to handle open models is playing out in public—and there’s a lot of money resting on its outcome. Nvidia CEO Jensen Huang, who has a lot to gain if people continue buying their own hardware to run open models, advocates enthusiastically for the United States to develop more of them, whereas Anthropic’s Dario Amodei, who runs a company that could be undermined by cheap, powerful models, advocates for a more cautious approach. But beneath all these commercial incentives, there is real substance to disagreements about open models. “I think a lot of the way you come down on the openness debate is influenced by how you come down on the AI debate,” says David Gray Widder, an assistant professor at the University of Texas at Austin School of Information. Those who are concerned about AI safety warn that open models can easily be misused by bad actors, whereas those who focus more on AI’s practical potential urge that this power should not sit behind the closed doors of just a few big companies, and that open models could help spread it more widely.
There are a range of ways to handle open models between banning them entirely and releasing them willy-nilly. But any approach that a government or a society might take still involves trade-offs between safety and democratization. Deciding whether to support or limit the production of open models requires understanding those risks and benefits in depth. What are the benefits of open models? Let’s start with the basics. A closed model, like the models that power ChatGPT and Claude, can only be accessed through a website, app, or API. An open model, on the other hand, can be directly downloaded: The details about its internal structure, encoded in a long series of numbers known as the model weights, are publicly available. Such models are sometimes called “open-weight models,” to distinguish them from models for which even more information, such as details about the training procedure, is available. 
Right now, closed models are more capable than open models—as of publication, the top eight models on the Artificial Analysis LLM leaderboard are all closed, though open models are only a handful of months behind in development. But there are several reasons why someone might opt to use an open model rather than a closed one. Because open models are downloadable, people can run them on their own computers or hard drives. They can even retrain them to behave differently, if they have the expertise and resources to do so.  If you’re an academic researcher working to understand and improve AI systems, you almost certainly need to work with open models in your research. When working with closed models, researchers can’t do much more than send prompts and observe the responses. But researchers can observe the inner workings of open models, as well as the “chain of thought” that the models use to think through a problem before answering. They can also combine multiple open models to build new systems, compress them to make them more efficient, and fine-tune them for new applications. Businesses, too, have reasons to prefer open models. Even if you depend on an external provider to run them for you, open models still typically cost less than closed models, according to a recent report from Mozilla. And if businesses want to use AI to process sensitive data or proprietary information, running a local model on their own hardware may be the best way to keep their operations secure. But perhaps the most important quality of open models is that they challenge the tight control the frontier labs have over how most of us use AI. “The clearest, biggest argument [for open models] is around preventing mass concentration of power—it is about making sure that this foundational technology is a public good,” says Elizabeth Seger, senior policy advisor at the Tony Blair Institute for Global Change. “I think we’re at this juncture where the question of who controls the infrastructure that allows AI to operate is as big of a question as who gets to control information on the internet.” Seger sees the future of AI playing out in different ways, depending on the role that open models have. In one possible future, frontier AI systems are controlled entirely by select people, companies, or governments, and as those systems grow more powerful, those groups have increasing control over what our world looks like. The world’s most sophisticated hacking models, for example, are currently all made in the United States, so it’s entirely up to US companies and the US government whether other countries can use them to shore up their own cyber defenses. If those companies remain in the lead, we could in principle wind up in a world in which the United States is capable of hacking any other country, but no one is capable of hacking it. Frontier open models could change that balance. “If every individual had a loyal-to-them AI system that was safe [and secure], I think that would be a much less concerning world than one in which they have to just rely on a government that says, ‘Yeah, we’ve got a super intelligent AI system, it’s got this plan, it’s inscrutable to all of you, just trust us,’” says Hamish Hobbs, director of AI policy at the Centre for Long-Term Resilience. But open models are not a geopolitical panacea. Paul Azunre, who cofounded Ghana NLP, an organization that builds open-source AI tools for low-resource Ghanaian languages, notes that open models can also function as a way for companies to benefit from the labor and expertise of less-privileged nations and consolidate more power in their own hands. He identifies a pattern in which AI companies release models openly, observe how the community uses and modifies them, and then integrate those same improvements into their own products—without any credit or compensation for the people who originated those innovations. Mark Zuckerberg himself has said that the ability to integrate community improvements into Meta’s stack is a key benefit of releasing open models. “I think the ideal of open source is a very noble one, and there’s a lot of value that it brings,” Azunre says. “But the way it’s actually implemented in practice, it tends to be a very extractive approach.”

Are open models riskier than closed ones? The past few months have made it clear that safety remains a gnarly problem for closed models. There’s the autonomous hack that OpenAI agents executed against Hugging Face in July, but human misuse is a real threat too: According to a recent risk report from Anthropic, several extensive hacking operations have been undertaken with the assistance of Claude.  So closed models are risky enough—and open models would likely be much easier to exploit. Before Anthropic passes a user’s query to one of its closed models, it uses automated systems to detect whether that query relates to hacking, biological weapons, or other risks. When it detects that users have outsmarted those filters, it can shut down their accounts. But when someone downloads a model and runs it on their own hardware, there’s no filter checking whether their prompts are safe, and there’s no way to revoke their access to the model. There are other important lines of defense. AI companies train their models to refuse harmful requests—so even if a bad prompt gets through Claude’s filters, there’s a good chance that the model will still say no. In principle, this same defense could work for open models, because it’s intrinsic to the model itself. Unfortunately, researchers have shown that it’s surprisingly easy to retrain a “safe” open model to agree to engage in the behaviors it was previously trained to avoid. Because of these facts, some people have argued that open models are simply too dangerous to release. An open model capable enough to walk someone through synthesizing a virulent new pathogen, for example, could prove catastrophic in the wrong hands.  But it would be a vast oversimplification to deem open models dangerous and closed models safe. The defenses that AI companies build around their closed models are far from perfect, and people misuse those models all the time, as the Anthropic risk report makes clear. Even though open models have even fewer defenses against misuse, bad actors might still opt to use closed models because they are more accessible than open models with similar capabilities, which require lots of expensive computer chips to run locally (and even more chips if you want to retrain them). In fact, some experts who spoke with MIT Technology Review argued, by analogy to open-source software, that open models have safety advantages over closed models. Open-source tools, such as the Linux operating system, are often seen as safer than their closed-source counterparts because their vulnerabilities have been probed and patched by a vast community of online contributors. Similarly, communities of researchers can more easily test open models for security flaws, though fixing those flaws is trickier than rewriting a line of code. Open models can also be deployed more broadly than closed models for cyber defense. Any tool that can be used for hacking can also be used to prevent it: Defenders hack their own software to uncover flaws in need of patching. Anthropic has shown how this can work for closed models with its Project Glasswing initiative, which enables some trusted companies to use its most capable models for cyber defense. But plenty of other companies were left to fend for themselves. Open models, however, can be used much more widely. After it was hacked by OpenAI agents, Hugging Face emphasized the fact that it had to depend on an open model to analyze the hack, because questions about it triggered the closed models’ security filters.
Nevertheless, many experts still perceive open models as riskier than closed models. The time-tested open-source security logic doesn’t necessarily hold up when dealing with tools as powerful as today’s—and tomorrow’s—models. “Where it gets complicated is when you start taking seriously the one-off instances of particularly catastrophic incidents that might be lower probability, but if they happen would be disastrous,” says Seger. If a wildly powerful open hacking model were dropped into the world today, for example, a bad actor could devastate our technological infrastructure before anyone had a chance to shore up their defenses. An event like that could be impossible to recover from. The risks can look even more dramatic when you consider what models might do of their own accord. The OpenAI Hugging Face hack only occurred because the company’s models were being tested with many of their cybersecurity guardrails removed, and open models have very few guardrails in the first place. If open models did decide to misbehave, it might be difficult to detect what was happening because they are so decentralized. For this reason, people who take seriously the purported catastrophic risks posed by rogue agents, such as Dario Amodei, tend to be more skeptical of open models.
Can we make open models safer—and more open? A few years ago, the debate about open models had an all-or-nothing framing: Either you supported open models because of their potential to fight concentration of power, or you rejected them because of the safety risks. These days, however, people are expending a lot of effort to find some middle ground. One way they are doing that is by devising techniques to mitigate the safety risks of open models. Most of the safety tools used for closed models, such as filters and monitoring, aren’t applicable to open models, but there are other possibilities. Some researchers are interested in trying to train models that are never exposed to training data that teaches them about bad or otherwise undesirable behavior—an open model that never learns about hacking, for example. But purging training datasets of all references to misbehavior without harming model performance remains a challenge. Other researchers are working to build models that are resistant to retraining, so that an open model’s safety training can’t be so easily removed. The theory behind these “tamper-resistant” models makes a lot of sense: If you repeatedly try to retrain a model to be unsafe and reinforce any resistance that the model shows to that retraining, eventually you’ll get a model that’s fortified against future retraining attempts. In practice, however, no current approaches to making models tamper-resistant hold up against all tampering attacks, according to a recent preprint. But Saad Hossain, an engineer at the AI medical imaging company Deep Breathe and the paper’s lead author, hopes that future techniques will prove more effective. “My reason for optimism is that it’s a very active area of research, and a lot of people are trying to come up with new and better methods,” he says. If the risks of open models are less black-and-white than they might at first seem, so are the benefits. Publishing the internal structures, or weights, of models might not be enough to disrupt AI-mediated concentration of power. “I think there are very genuine benefits to open source in terms of deconcentrating power, but they’re not sufficient in themselves,” Hobbs says. Open weights are a bare minimum standard for open models: Researchers can learn much more about how models work if they have access to details about their training, including the data on which they were trained, but AI companies are typically reluctant to divulge this information.  Accessibility matters for open models too. Without computer chips that can run sophisticated models, you can’t actually use the model weights, even if you have them. Those chips have become prohibitively expensive as AI companies snap up more and more of them. “Openness is a floor, not a ceiling, for what we need to do to ensure that our technological futures benefit everyone,” Widder says. Real openness—not only open weights, but also open training data and accessible hardware—could also bring more risks, of course. If everyone has access to advanced AI hardware and advanced models to run on it, then anyone could potentially be a hacker. But there are strategies for mitigating these risks. Many experts advocate for some version of staged release, in which models start their life closed and gradually become more and more freely accessible as their safety is assured.  Figuring out exactly how to implement such strategies will require striking a careful balance between the risks and benefits of open models. But if open models are a necessary element of a positive AI future, as some experts believe, that effort will be well worth it.

When Keelan Miskell began winding down his crypto startup this year, he didn’t think its data was worth much: the users were anonymous, the company just a few years old. But he’s since turned the firm’s digital archives into real money. He’s netted roughly $25,000 for his code base and a still-pending amount (likely around $15,000) for the workspace data in Google, Notion, Figma, and Slack. “At least all that stuff we were doing for two and a half years is worth something to someone somewhere,” he says. The sale was brokered by a company called SimpleClosure, part of a new growth sector in tech: businesses catering to dying startups. Estimates from Carta and AngelList show shutdowns rising between 26% and 56% annually in recent years, and an end-of-life ecosystem—including coaches, “death doulas,” and firms that help handle the legal, tax, and operational headaches of going ­belly-up—has emerged. Now tech undertakers are selling the data remains to AI labs.  SimpleClosure added data sales to its services in April. Its Asset Hub platform helps founders sell their code and workspace data—emails, chats, documents. Buyers include foundation AI labs, vendors that construct simulated workspaces for AI training, and mature tech companies building their own models. Asset Hub has handled over 150 deals and expects to return over $10 million to startups by the end of 2026. CEO Dori Yona has seen these transactions, once rare and “somewhat taboo,” become increasingly routine, with 47% of SimpleClosure deals now including code or data sales.  And it’s got company. Industry rival Sunset also has a rapidly growing data resale business. Founder and CEO Brendan Mahony says Sunset values a dying client’s assets by head count, years in operation, volume of data, and how the team used its tools. Particle board, he says, is a good analogy: “This operational exhaust data is like the wood shavings that everyone thought had no value, but it actually has a ton.” 
Demand for defunct companies’ data emerged suddenly last year, as AI training labs hit the limits of public and synthetic datasets. Surge AI, for example, buys data to build “reinforcement-learning gyms” where clients’ AI agents practice tasks—think debugging a complex IT architecture or drafting appellate briefs. Nick Heiner, who leads the company’s work on these environments, says he seeks data archives reflecting a range of situations, from disagreements to tricky judgment calls. Heiner explains that one company’s Slack history, if it captures conversations with variety and depth, can be worth more than another’s Slack, email, and calendars combined. Real archives avoid common errors in synthetic worlds, such as references to dates that don’t exist, but the extent of performance gains remains unclear. No company has yet released tests comparing results of real-world data training with the alternatives. Pricing reflects this uncertainty: Buyers quote wildly different numbers, Heiner says, because valuations are based on “research theses” estimating how many useful tasks come from, say, 100,000 lines of code.
That hasn’t stopped bigger deals from happening. This past August, as part of Spirit Airlines’ bankruptcy, Google outbid the AI data company Mercor to buy the carrier’s decades of data, including 100 million emails, 500 million Teams messages, and 176,000 employee records. The price tag: $10 million. And Bloomberg reported in September that SpaceX’s AI unit is weighing buying data from struggling startups.  Legally, this all could get iffy. Spirit’s flight attendants’ union objected to the sale on privacy grounds, and Greg Ewing, an attorney who advises AI startups, has called such data “legally radioactive.” Suppliers employ data scientists to scrub personally identifiable information and exclude HR records, and buyers say they scrub too. But Ewing points out some of the private details that lurk in emails and calendars: doctor appointments, school pickup arrangements, date-night plans. He describes a “Wild West of AI training” that is only starting to give way to proper licensing agreements and vetted use. There’s also the question of who profits from these windfalls. The proceeds typically flow to senior creditors and investors—not employees. To Ifeoma Ajunwa, a law professor at Emory University and author of The Quantified Worker, this represents a form of “captured capital.” Legal precedent allows for monitoring to help workers do their jobs, but once a firm is out of business, that justification vanishes. “Employers should have express consent before selling workers’ data,” says Ajunwa, but she adds that there’s no federal law banning such sales. While many see this new market as a chance for failing businesses to recover some value, these wind-down sales also have limitations. Founders have little to no visibility into who is buying the data and what they plan to do with it. Plus, there’s little assurance they’re getting a fair offer. Data prices will likely stabilize in the coming year, though, unless an AI bubble pops first. Either way, tech’s new undertakers will be there to appraise what’s left.  Matthew King is a technology and environmental journalist based in Baltimore.

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. Mars may be a hellhole, but the moon is not far behind The US and China are racing to build bases on the moon, with NASA hoping to establish a small lunar city by the end of the century. But the moon is a tremendously hostile place to set up camp. A sprawling lunar base must be safe for its inhabitants, protected from falling asteroids, endless cosmic radiation, razor-sharp lunar dust, and torturous temperature swings. It also must be somewhat self-sustaining. That will require autonomous robots, nuclear power, and a way to use the moon’s resources to keep the base operating. But the chief obstacle may be one of political will.
Find out what stands in the way of a city on the moon. —Robin George Andrews
This story is from the next issue of our print magazine. Subscribe now to get your hands on a copy as soon as it lands on Wednesday 21 October!   10 Climate Tech Companies to Watch: Brimstone and its one-stop process for making cleaner cement and critical minerals Brimstone is one of MIT Technology Review’s10 Climate Tech Companies to Watch 2026, available exclusively to subscribers. Brimstone is a code-switching climate tech company for these polarized political times. The US startup is part green cement company, part critical mineral producer. During the Biden administration, its primary pitch was cement that generates about 60% fewer greenhouse-gas emissions. It achieves this by switching to silicate rocks instead of standard limestone, which releases carbon dioxide when heated. Under the Trump administration, however, the company is emphasizing another benefit of its process: the ability to extract valuable materials from those same rocks. Discover how it’s making strides on two industrial problems. —James Temple Subscribers can now access the full 10 Climate Tech Companies to Watch, spanning everything from geothermal power plants to smart turbines and semi-solid-state cells.

Job titles of the future: Delivery drone air traffic controller The moment Trevor Wischnewsky heard that drones were delivering pizza and sushi around his Texas neighborhood, his mind was made up. “It was super fascinating,” he says. “I just immediately wanted to be a part of it.” Wischnewsky is now an RPIC, or remote pilot in command, at a company called FlyTrex. An RPIC is like an air traffic controller. But instead of airplanes, they oversee fleets of drones that ferry cargo to homes and businesses Here’s what it takes to become a drone air traffic controller. —Eamon Whalen The must-reads I’ve combed the internet to find you today’s most fun/important/scary/fascinating stories about technology. 1 An Anthropic AI model submitted a fake tip about an unsolved murderThe tip was in a new group of rogue actions Anthropic disclosed. (NYT $)+ Police criticised the company for waiting nine days to report it after finding it. (WSJ $)+ Another model submitted real government forms. (Quartz)+ The White House has made AI incident reporting mandatory. (Axios)+ But who’s liable when AI agents go rogue? (MIT Technology Review) 2 Ukraine’s drone strikes have dealt a major blow to Russian AISunday’s attack shut down the third Yandex data centre hit in days. (Reuters $)+ The strikes have disrupted Russia’s AI, cloud services, and apps. (Gizmodo)+ They followed Russian strikes on Ukrainian data centers. (Ars Technica)+ Russian military satellites could disrupt Starlink. (Reuters $)+ Ukraine’s drone data is fueling a wild market. (MIT Technology Review)
3 Iranian ChatGPT users have planted AI-generated articles in news outletsAbout a dozen outlets ran roughly 100 articles by fake journalists. (CNN)+ The articles criticised the Iran war’s effects on Americans. (WP $)+ AI has been used to turn the Iran conflict into theatre. (MIT Technology Review) 4 Tesla has renamed “Full Self-Driving” as “Assisted Driving” in EuropeEU lawmakers said the old name was misleading.  (TechCrunch)+ Tesla hopes the rebrand leads regulators to approve the feature. (Wired $)+ Back in the US, it plans to increase toxic emissions near a school. (SFGate)
5 A ransomware negotiator has been arrested amid a hacking crackdownThe FBI suspects he was involved with a gang that recently claimed to have stolen data on the bureau’s employees. (Reuters $)+ AI is making online crimes easier. (MIT Technology Review) 6 Hollywood’s hottest villain right now is the tech billionaireFour new films feature dark depictions of Silicon Valley leaders. (Axios $)+ The real Mark Zuckerberg has also become a new character. (NYT $) 7 A new experiment is testing the Amazon’s response to rising CO₂CO₂-releasing towers will simulate future atmospheric conditions. (Nature)+ Is carbon removal in trouble? (MIT Technology Review) 8 The US hybrid boom has pushed some used car prices above new onesBuyers are paying a premium to skip the wait for new models. (Wired $) 9 A new technology switches tattoos on and off with lightIt can make permanent ink invisible. (New Scientist $) 10 Scientists spotted the most distant signal yet from the ancient universeIt could help them understand how the universe has evolved. (404 Media)
Quote of the day “Right now, your washing machine is subject to more safety rules than AI.”  —Microsoft’s president, Brad Smith, tells the BBC why AI urgently needs more regulations, including requiring firms to write “incident reports” and tell victims if the technology goes rogue. One more thing LINDA NYLIND / EYEVINE VIA REDUX Geoffrey Hinton tells us why he’s now scared of the tech he helped build Geoffrey Hinton is a pioneer of deep learning who helped develop some of the most important techniques at the heart of modern artificial intelligence, but after a decade at Google, he’s stepped down to focus on concerns he now has about AI.
Hinton is now spending his time on what he describes as “more philosophical work.” And that will focus on the small but—to him—very real danger that AI will turn out to be a disaster. Here’s why he’s so worried. —Will Douglas Heaven We can still have nice things A place for comfort, fun, and distraction to brighten up your day. (Got any ideas? Drop me a line.) + A doting blind cat has been following his owner everywhere like a little duckling.+ Eigendrum lets you draw any shape and hear what it would sound like as a real drum.+ Build your perfect background soundscape with Ambient Mixer, from rainy forests to cozy cafés.+ Meet Momota, the polar bear cub who’s turning traffic cones into an unlikely fashion statement.