Open-weight Beam, weak watermarks, and the trust gap inside agent networks

Three of today’s items are about the same thing from different angles: the cost and trust assumptions underneath deployed AI. A new open-weight model attacks inference cost, a watermark regime arrives weaker than its mandate, and an architectural flaw turns agent-to-agent trust into an attack surface.

The other two are enterprise and hardware moves a buyer can actually evaluate this quarter.

Reflection opens Beam, a frontier model built for cheaper inference

Reflection AI released Beam, a 501-billion-parameter open-weight model with 23 billion active parameters, trained on high-compute reinforcement learning for reasoning, coding and agentic work. The pitch is cost: the company says Beam matches Z.ai’s GLM-5.2 on advanced reasoning benchmarks while using three to four times less inference compute, and it positions the model as the base for on-premises “AI factories” where institutions train on their own data. Benchmarks are vendor-reported and unverified. Weights and technical details are promised this month, which is the date enterprise evaluators can actually plan around.

Source: TechCrunch AI

OpenAI adds EU text watermarking that a light edit defeats

OpenAI now offers API customers optional text watermarking and will apply it by default to eligible ChatGPT and Codex output in the European Union within weeks, satisfying the AI Act’s machine-readable-output requirement without matching Anthropic’s global rollout. The signal is fragile by the company’s own numbers: in 400-token passages, replacing 10 percent of words with synonyms cut detection from 92 percent to 66 percent, and a 25 percent substitution rate dropped it to 17 percent. Detectors are released only to approved researchers. Anyone building provenance or compliance tooling on text should treat this as EU-scoped and weak.

Source: The Register

One poisoned agent can give orders to the rest over MCP

Five organizations, Google among them alongside JP Morgan Chase, Rapid7 and two governments, have now acknowledged a prompt-injection path that uses one internal agent to pass malicious instructions to others. Independent researcher Syed Anas Mohiuddin built proof-of-concept attacks exploiting trust gaps in MCP, the protocol that connects agents inside a network: the receiving agent trusts the sender, so it executes. There is no simple patch because the weakness is architectural. Teams wiring agents together should treat every agent-to-agent message as untrusted input rather than a peer directive.

Source: Ars Technica

Reka’s Rho-1 folds video and robot control into one model

Reka AI’s newest model, Rho-1, is a single neural network of 19 billion parameters that reads and writes still images, video, prose, and the movement commands for a robot arm. It took roughly three months of training on 320 H100 GPUs. The design consolidates rather than routes: every modality, whether pixels or motion, becomes a token in one shared working memory, with no handoff to a separate specialist system. That matters because a mid-size general model covering both perception and action would undercut today’s purpose-built stacks for robotics and multimodal pipelines. No pricing or general availability has been published.

Source: The Decoder

Cohere’s North 2 puts enterprise agents under admin control

Cohere’s North 2 turns its enterprise platform into an orchestration layer for agents that run multi-step workflows, keep context across sessions, and connect to Slack, SharePoint and Jira. It is model-agnostic: organizations can plug in their own weights alongside Cohere’s. Administrators set token budgets, quotas and access rights down to individual agents, and agents must seek human approval before critical actions. It deploys on-premises, in cloud or fully air-gapped. Two customers, LG CNS and Bell Cyber, are named as running it in production. That combination is the pitch to regulated buyers who cannot send data to a public model.

Source: The Decoder

Sources