The AI Brief

Vol. I · No. 54 · Saturday, July 18, 2026

Today's brief:

  • Microsoft is building a cheaper AI vulnerability scanner that routes tasks across its own models, OpenAI, and Anthropic, which means Anthropic must win enterprise security contracts before a vendor with existing FedRAMP relationships and lower unit costs arrives to define the category instead.
  • At $17.5B, Fireworks AI's valuation reflects a market conclusion that enterprises will pay infrastructure premiums to own fine-tuned models rather than rent tokens from closed frontier providers.
  • OpenAI's GPT-Red outperformed human red-teamers six to one on prompt injection attacks, then fed those attacks directly into GPT-5.6 Sol's training, cutting injection failures sixfold and establishing the first documented case where a production frontier model was hardened at scale by an AI-generated attack curriculum.
  • Anthropic has been using free Fable 5 access as a competitive retention lever against cheaper rivals, and tonight's deadline is less about promotion logistics and more about whether Opus 5 can replace the need for another extension.
  • Google's willingness to ship a stopgap Flash model rather than delay further confirms the Gemini 3.5 Pro rebuild hit a capability ceiling problem, not a polish problem, and operators mid-evaluation on Vertex AI should treat August 7 as a soft planning date, not a commitment.

Microsoft Is Building a Cheaper Mythos Rival Before Mythos Reaches Scale

Why it matters
Microsoft's entry commoditizes AI-powered vulnerability hunting before Anthropic has solved Mythos's distribution problem, a model router that selects among Microsoft's own models, OpenAI, and Anthropic for each security task undercuts Mythos's single-model pricing by design.
What's at stake
For security and IT leaders evaluating Mythos 5, a credible cheaper alternative from a vendor with existing enterprise contracts and FedRAMP presence changes the make-vs-buy calculus; for Anthropic, it narrows the window to establish Mythos as the category-defining product before a large incumbent arrives.
Decode
Model router = a layer that receives each security query and assigns it to whichever AI model is cheapest or best-suited for that specific task, rather than sending every query to one expensive frontier model. The same code runs against multiple models in sequence or parallel; the router picks the winner. Microsoft's stated rationale is cost reduction at the per-task level.
Detail

The Information first reported Project Perception on July 17, citing sources familiar with the product. Microsoft is planning to launch Project Perception, an AI-powered cybersecurity tool that helps organizations find and fix software vulnerabilities to rival models like Anthropic's Mythos, with a model router selecting the best model from Microsoft, OpenAI, and Anthropic for each security task. Its main selling point will be its cost, expected to be far lower than Anthropic Mythos, which carries an estimated API cost roughly 100% higher than Opus 4.8 and 82% higher than GPT-5.6, by routing individual queries to specific AI models based on the task.

Project Perception is the brainchild of Hayete Gallot, Microsoft's head of security who took over the role in February; she has been reorganizing Microsoft's security business around AI products while reducing investment in older offerings. Microsoft has not confirmed pricing, customer eligibility, or a specific GA date. In a recent Patch Tuesday, Microsoft patched around 570 vulnerabilities through an AI tool it calls MDASH; whether Project Perception is related to MDASH is unclear.

Microsoft is unlikely to face the same government-access pressure as Anthropic when it comes to launching a security product, which could give it an edge when it comes to getting a cybersecurity tool to Europe and other regions. Anthropic says its restricted Mythos 5 model can find and exploit software vulnerabilities at a level beyond most human security experts, while its broadly available Fable 5 applies classifiers and falls back to a less capable model for cyber-related requests. When Project Perception finally does launch, its availability could also be restricted, just like Anthropic's Mythos and Fable models.


$17.5B
Fireworks AI post-money valuation after $1.505B Series D, up from $4B in October 2025

Fireworks AI's 4× Valuation Jump in Eight Months Marks a Bet Against Closed-Model Lock-In

Why it matters
Fireworks crossed $1B in annualized revenue on a platform where 95% of token volume flows through models that customers have fine-tuned on their own data, a direct commercial signal that enterprise AI strategy is bifurcating between closed-model renters and open-model owners, with the latter willing to pay infrastructure premiums to escape per-token frontier pricing.
What's at stake
For most operators, this is context, not a decision. For teams actively evaluating whether to standardize on frontier API calls or invest in fine-tuned open-model infrastructure, Fireworks's 5× revenue growth in a single funding cycle and the participation of NVIDIA, Lightspeed, Menlo, and Ontario Teachers' quantifies the bet the market is placing on the ownership model.
Detail

Fireworks raised a $1.5 billion Series D at a $17.5 billion valuation, led by Atreides Management, Index Ventures, and TCV, as companies seek to build specialized AI that better reflects their own knowledge, workflows, and customer context at lower cost than frontier alternatives. The funding comes as Fireworks surpasses $1 billion in annualized revenue run rate, up 5× year-over-year from its last funding round; over the same period the company nearly tripled the daily volume of tokens served, from 15 trillion to more than 40 trillion.

CEO Lin Qiao told CNBC that Fireworks's cost advantage over equivalent-quality closed models is "five to ten times cheaper." Customers include Uber, Shopify, Doximity, Elastic, GitLab, and MongoDB; legal AI firm Harvey and coding tool Cursor have also built on the platform. More than 95% of those tokens come from models specialized on customers' proprietary data and optimized for specific jobs.

The company last raised $250 million at a $4 billion valuation in October, making the $17.5 billion post-money a 4.4× step-up in under nine months. Qiao said she plans to triple the company's roughly 200-person workforce before year-end. Fireworks competes directly with Together AI and Baseten in the AI inference cloud market; Together AI raised $800M at $8.3B in early July, and Baseten closed a $1.5B Series F at $13B in June, making the specialized inference segment the fastest-scaling infrastructure sub-sector in the current cycle.


OpenAI's GPT-Red Beats Human Red-Teamers 84% to 13%, Used to Harden GPT-5.6 Sol

Why it matters
Self-play red-teaming, where an attacker model and a defender model co-evolve simultaneously, breaks the bottleneck of human-curated adversarial datasets, and OpenAI's decision to bake GPT-Red's attack outputs directly into GPT-5.6 Sol's training represents the first documented case of a production frontier model hardened at scale by an AI-generated attack curriculum; the sixfold drop in direct prompt injection failures is the downstream result.
What's at stake
For most operators, this is context: the hardening happened before deployment. For security teams benchmarking model safety for agentic deployments where models browse the web, read files, or call APIs, GPT-5.6 Sol's published injection resistance data, 0.05% failure rate on GPT-Red's direct injection suite, is now a live reference number that competing labs and evaluators will need to match or refute.
Decode
Prompt injection = an attack where malicious text embedded in external content (a web page, a document, an email, a third-party codebase) tricks an AI model into following the attacker's instructions instead of the user's. In agentic settings, where models take real actions in the world, successful injection can cause data exfiltration, unauthorized commands, or credential theft. GPT-Red specifically targets this class of attack.
Detail

OpenAI trained GPT-Red, an automated red-teaming model that scales its ability to find vulnerabilities so it can fix them before wider deployment, announcing the work on July 15, 2026. GPT-Red trains an attacker model alongside multiple defender models simultaneously, feeding attacks discovered in this process back into the training of GPT-5.6, adding a process that iterates from attack discovery to defensive training while still retaining human and third-party red-teaming.

At the core of GPT-Red is self-play reinforcement learning, where attacker and defender learn from each other as training partners; GPT-Red earns rewards by successfully executing attacks such as prompt injection, while defender models earn rewards by resisting these attacks while still completing the original task. GPT-Red can successfully break nearly all models it is pitted against, including internal and production models up to GPT-5.5. In tests on novel safety environments, GPT-Red achieved an 84% attack success rate, significantly outperforming human red-teamers , who achieved 13%, per OpenAI's published figures.

According to OpenAI, GPT-5.6 now experiences six times fewer failures on one of its hardest direct prompt injection benchmarks compared with its strongest production model released four months earlier; on broader robustness testing, GPT-5.6 Sol failed on only 0.05% of GPT-Red's direct prompt injection attempts. OpenAI reports that these robustness gains did not reduce general model capabilities or cause broader refusal behavior; GPT-Red will remain separate from public production models because it was deliberately trained with malicious capabilities and is not being released to ChatGPT users or API developers. OpenAI concedes real gaps: multi-turn and image-based attacks still require human red-teamers. The company plans to release additional detail in an upcoming preprint.


Update: Fable 5 Free Window Closes Tonight; Honeycomb Leak Stokes Opus 5 Speculation

Why it matters
Three rolling last-minute extensions since July 7 have made Fable 5's promotional terms operationally unpredictable, but the competitive logic driving them is now clear: Anthropic is using plan-included Fable 5 access as a retention dial against GPT-5.6 Sol and Grok 4.5, and the dial runs until either Opus 5 ships or the cost of suppressed credit revenue exceeds the cost of churn.
What's at stake
For teams that have embedded Fable 5 in agentic pipelines, the July 20 shift to $10/$50 per million tokens, double Opus 4.8's rates, is the first real cost event of the Fable 5 cycle; for Anthropic's IPO narrative heading into October, the subscription-to-credits transition is also the first live test of whether Fable 5's pricing can hold against rivals now priced at $2–$6 per million output tokens.
Detail

On July 12 at 10:32 PM, @claudeai announced a third extension of Fable 5 promotional access through Sunday July 19, 11:59:59 PM PT, plus 50% higher Claude Code weekly rate limits for the same window. The decision comes amid growing speculation about Anthropic's next major model release after an unreleased model dubbed "Claude Honeycomb EAP" briefly appeared inside Cursor, fueling community theories that Opus 5 could arrive before the end of the month.

Once the promotional period ends, Fable 5 is set to move entirely to credit-based billing at $10 per million input tokens and $50 per million output tokens, the highest published rate for any generally available Anthropic model and exactly double that of Opus 4.8. After the promotion ends, Fable 5 usage will be billed at $10 per million input and $50 per million output; as Anthropic extends the promotional period again without resetting allowances, users report frustration, Reddit threads note another week of availability offers little benefit if subscribers have already exhausted their included usage.

In July 2026, two well-resourced rivals have simultaneously moved into Anthropic's Opus-tier market with models priced at roughly one-eighth to one-sixth of Fable 5's output cost and carrying credible, if partly unverified, benchmark results. The repeated extension pattern is not a sign that Anthropic is uncertain about Fable 5's business model; it is a sign that the model is being used as a competitive access dial, extend when the competitive landscape is hot, tighten when capacity or cost allows. Community probability trackers split roughly 40% for Opus 5 shipping this weekend, 35% for a fourth extension, and 25% for credits beginning as announced.

Disclosure: Claude, which generates this brief, is built by Anthropic.


Update: Gemini 3.5 Pro Misses a Fourth Target; Google Eyes a Stopgap 3.6 Flash

Why it matters
Four consecutive missed deadlines, June, July 17, and now beyond, confirm that Google DeepMind's ground-up pre-training restart hit deeper quality issues than the firm acknowledged at any prior slip; a reported pivot to a stopgap "Gemini 3.6 Flash" release signals Google is willing to sacrifice the flagship's competitive positioning to avoid shipping a model that fails basic reliability tests, leaving Google as the only major frontier lab without a 2026 Pro-tier flagship in production.
What's at stake
For most operators already on Gemini 3.5 Flash or an alternative stack, this is planning context, not an emergency. For enterprises mid-way through a Vertex AI evaluation cycle with Gemini 3.5 Pro as a target model, a stopgap release resets the evaluation timeline, and the August 7 Polymarket date at 73% probability is the market's best current estimate of when the wait ends.
Detail

Google DeepMind's Gemini 3.5 Pro has now missed its launch target three consecutive times, June, then July 17, and now beyond, with reporting indicating the rebuilt model is still plagued by hallucinations and inconsistent outputs that prevent it from clearing basic reliability standards. Google is now exploring a stopgap Gemini 3.6 Flash release. As of July 13, no model card, pricing page, or gemini-3.5-pro listing appeared in the public Gemini API documentation; the only confirmed facts are that the model exists, that Google has it running internally, and that it has missed three consecutive external deadlines.

Multiple outlets reported that Google DeepMind discarded its near-ready model and ordered a ground-up pre-training restart on a native Gemini 3 foundation; the distinction matters enormously, because pre-training is the initial, most expensive phase of building a frontier model, fine-tuning and reinforcement learning can refine within capability bounds, but they cannot raise the ceiling, meaning Google conceded the original model's capability ceiling was in the wrong place.

That leaves Google as the only major frontier lab without a 2026 flagship in general production on the date its own CEO promised delivery. The July 17 miss is the fourth slip since Sundar Pichai told Google I/O attendees on May 19 to "give us until next month." Third-party sources report the rebuilt model is expected to arrive with a 2-million-token context window, a Deep Think reasoning layer, and autonomous workflow capabilities, but all three remain unconfirmed in any official Google documentation. First covered in Vol. I, No. 50 (July 14) and No. 53 (July 17).