OpenAI starts watermarking ChatGPT text in the EU and lets API users opt in
OpenAI will watermark ChatGPT and Codex text in the EU and offers opt-in watermarking in the API, GitHub releases ReviewBench, an open benchmark for AI code review, Together AI's Together Link puts open models inside Claude Code and Codex, Reflection previews Beam, a 501B open-weight model, Cohere ships North 2, and the Pentagon says it has stopped using Claude.
Monday’s stories are about checking what AI produced and who gets to choose the model. OpenAI will put an invisible watermark in ChatGPT and Codex text in the EU to meet the AI Act, and its own numbers show how easily light editing removes it. GitHub released an open benchmark for grading AI code reviewers. Together AI wants to swap the model behind Claude Code and Codex for cheaper open ones without changing the tool, and Reflection previewed Beam, an American open-weight model it says matches bigger Chinese rivals on far less compute. Cohere shipped a new version of its enterprise agent platform, and the Pentagon says it no longer uses Claude, months after it said it would stop.
A watermark that survives ChatGPT but not a thesaurus
What shipped. OpenAI published its approach to the EU’s text provenance rules. The EU AI Act requires generative AI providers to make generated text identifiable by machines. OpenAI’s plan has three parts:
- API, from today, everywhere: customers can opt in to watermarked text for “select models”. It stays off by default. OpenAI says it is working with cloud partners to offer the same for its models served through their platforms “in the coming weeks”.
- ChatGPT and Codex, EU only: “over the coming weeks”, eligible text output in the EU gets an invisible watermark, on all plans. It is not becoming a global default.
- Detection, for approved researchers only: the detector isn’t public. Researchers and expert organisations can apply, and access is granted case by case. A result only says whether an OpenAI watermark was found, not who wrote the text or with what prompt.
The technique, called textGrain, nudges the model’s word choices to leave a statistical signal, as described in a technical report. OpenAI says it plans to open-source it. OpenAI’s own figures show its limits. At a 1% false-positive rate, the detector found the watermark in about 80% of 200-token passages and about 95% of 400-token passages on psychology content, and “substantially lower” on maths, where there’s less freedom in word choice. Swapping 10% of the words in a 400-token passage for synonyms cut detection from about 92% to 66%, and swapping 25% cut it to 17%. OpenAI’s benchmark table shows no meaningful quality cost on its frontier model: watermarked and unwatermarked scores are within a few points of each other on every benchmark it lists, in both directions.
What it means for you. If you build on the OpenAI API and serve EU users, the AI Act’s transparency duty is yours as well as OpenAI’s. Our EU AI Act guide for developers covers what Article 50 asks of you. Turning on the watermark is now one way to meet it, but it’s opt-in, so it’s a decision for your compliance owner, not a default you inherit. Code and maths are where the signal is weakest, so don’t count on it for Codex output. Anyone thinking of using it to catch AI-written homework or job applications should read the editing numbers first: the watermark shows that an OpenAI model was involved in some way, and its absence proves nothing.
The detector is the product, and it’s locked. A watermark only matters if someone can check it, and OpenAI is keeping the checker behind an application form. That’s defensible given the false-positive risk, but it means the EU rule creates a signal that, for now, only OpenAI and a few researchers can read. OpenAI says textGrain matched or beat Google’s SynthID for text in its own tests, and open-sourcing it would let others check that claim. Expect Anthropic, Google and Mistral to publish their own EU approaches. The open question is whether regulators will accept detectors that only the model maker controls.
GitHub wants a shared yardstick for AI code reviewers
What shipped. GitHub released ReviewBench as a research preview: 219 pull requests from 187 public repositories in 19 languages, chosen to match the language and repository-size mix of 103.9 million GitHub PRs, but weighted towards larger multi-file changes. The “golden set” of known issues combines findings from human reviewers, follow-up commits, static analysis and several frontier LLMs, each labelled by severity and category. Claude Sonnet 5 grades submissions against a published rubric. Senior engineers who hadn’t built the dataset re-labelled every finding and agreed with it 96.6% of the time.
It reports two kinds of score. “Grounded” precision and recall only count known issues. “Augmented” scores also give credit for valid issues nobody in the golden set found. GitHub says ReviewBench predicted the direction of its own production A/B tests: for a multi-model ensemble in Copilot code review it forecast higher precision and recall at lower cost. Online, the share of comments developers acted on (as judged by an LLM) rose 8.0%, recall rose 13.6% and cost per review fell 8.0%.
What you can build with it. The dataset, judge prompt, judge configuration and a self-serve runner are public at review-bench.ai. If you run or are choosing an AI reviewer (Copilot’s, a startup’s or your own), you can sign in, register your agent as a container image with your own model key, tune it on a 25-PR test set, then run the full set three times. Scores stay private until a maintainer approves them. You can also re-rank the leaderboard by severity, category or how much you weight recall over precision, which is more useful than a single score if all you want is fewer nits.
Whoever writes the benchmark sets the terms. GitHub sells one of the products being measured, and it hosts the leaderboard, so rivals will look hard at the methodology. Publishing the rubric, the judge and the agreement numbers is what makes it credible. Code review is where coding agents now compete, as models write more code than people can read, and the vendors so far have competed on demos and catch-rate anecdotes. A common benchmark makes buying easier, and it will reward whatever it measures. Expect competing benchmarks from the review startups.
Together AI puts open models inside Claude Code and Codex
What shipped. Together Link connects Claude Code, Claude Desktop, Codex (in the ChatGPT app and the CLI), OpenCode and Pi to open models on Together AI’s serverless inference. One install command sets it up, your agent’s settings and logins stay as they were, and one command switches back. An “Auto” option uses Together’s router to pick a model from each session’s first task. With an Anthropic key it chooses between Claude Opus 5.5 and GLM 5.3; without one, between GLM 5.3 and GLM 5.3 Flash. It routes once per session so prompt caching still works. A tracker shows each session’s cost next to what it would have cost on Opus 5.5, and billing goes through your existing Together API key. Together claims savings of “over 50%”, which is its own figure.
What you can build with it. Teams paying for Claude Code or Codex at scale can try an open-model tier without retraining anyone or replacing the tool. The obvious setup is Auto with an Anthropic key: routine fixes go to GLM, hard tasks stay on Opus. Before rolling it out, compare the tracker’s savings with your own task success rate, and check whether your Anthropic or OpenAI plan terms allow routing their agent to another provider.
The harness is now the moat, and Together wants to hollow it out. Anthropic and OpenAI make money when their agents run their own models. Together’s bet is that developers are attached to the agent, not the model behind it. That’s the same bet OpenCode and OpenRouter make, now packaged for the incumbents’ own tools. Together says it already serves the largest share of OpenRouter tokens for several open models. Expect the labs to respond with pricing or with terms that make it harder to point their agents at someone else’s models.
Reflection’s Beam is a US open-weight model built to be cheap to run
What shipped. Reflection previewed Beam, its first model: a sparse mixture-of-experts with 501 billion total parameters and 23 billion active per token, aimed at coding and agent work. It’s text-only, with a context window extended to 1 million tokens during training, and a reasoning-effort setting that trades length for accuracy. You can’t download it yet. Beam is in final red-teaming, early access is through a waitlist, and Reflection says the weights, technical report and model card come “later this month” under Apache 2.0, with distribution partners and integrations for open-source agent tools.
The numbers are Reflection’s own. It reports 80.9 on SWE-bench Verified, 65.5 on SWE-Bench Pro v1, 80.1 on Terminal-Bench 2.1 and 90.5 on GPQA Diamond. It says Beam is competitive with GLM 5.2 and approaching Qwen 3.8-Max on coding and agent tasks, but behind Kimi K3, and in its own table GLM 5.3 and Kimi K3 beat it on most rows where both are reported. The pitch is efficiency: Reflection estimates Beam uses 3 to 4 times less inference compute than GLM 5.2 for similar reasoning scores, an approximation from active parameters and generated tokens that leaves out prefill and serving costs. Training took under four weeks of pretraining on 6,144 GB300 GPUs over 23.8 trillion tokens, then a four-week RL run on 10,500 GB300s that generated more than 100 million rollouts.
What it means for you. If you self-host for cost or data-control reasons, Beam is worth a slot in your evaluation queue once weights land: 23B active parameters keeps the compute per token low, though you still need memory for all 501B parameters. Apache 2.0 means no usage restrictions to clear with legal. Wait for the technical report and independent benchmarks before believing the efficiency chart, since every number so far comes from Reflection.
The open frontier has been Chinese. The strongest open-weight models of the past year came from Zhipu (GLM), Moonshot (Kimi), Alibaba (Qwen) and DeepSeek, which is the table Reflection chose to compete against. Many US buyers in government and regulated industries won’t run Chinese weights, so an American model under a permissive licence fills a gap even if it isn’t the best. Nvidia’s Nemotron 3 Ultra is the other US entry in that table, and Beam beats it on most reported rows. Axios reported on Sunday that several Western open-weight launches are due this month, so expect Beam to have company soon, and expect the contest to be about cost per solved task rather than leaderboard peaks.
Cohere’s North 2 bets on control over capability
What shipped. North 2 is the new version of Cohere’s enterprise agent platform. New pieces: reusable skills and shared libraries across an organisation, memory that keeps context between sessions, applications (decks, dashboards, documents and lightweight apps generated from chat), and automations with templates and a drag-and-drop workflow builder. New connectors cover Slack, SharePoint, OneDrive, Outlook, Exchange, Jira, Linear, Notion and GitHub, with financial data providers such as PitchBook, FactSet and S&P Global “planned”. North runs self-hosted, in a VPC, hybrid, on-premises or air-gapped. North Admin adds per-agent guardrails, policies that say what an agent may do on its own, per-user and per-group token budgets and alerts, and support for bringing your own models.
What it means for you. If you’re in a regulated industry and evaluating agent platforms, North is one of the few that runs fully air-gapped on your own hardware, and the admin layer covers what security teams ask about first: who can use which model, what each agent may do, and what it costs. Customers named in the post include LG CNS and Bell Cyber.
Sovereignty is the pitch, not intelligence. Cohere can’t match OpenAI and Anthropic on frontier benchmarks and doesn’t try. It sells to buyers whose data can’t leave the building. Feature for feature, North 2 is catching up with what Claude and ChatGPT Enterprise already offer (skills, memory, connectors), so its edge is still deployment and governance. With the Aleph Alpha merger pending and Aleph Alpha’s open-weight Kolibri out on Saturday, expect Cohere to pitch North in Europe as the sovereign package.
The Pentagon says it has finally stopped using Claude
What happened. A Defense Department official told the BBC that the department “has ceased the use of Anthropic products”. Defense Secretary Pete Hegseth designated Anthropic a supply-chain risk in February after it refused to remove safety limits on military use, and set a six-month phase-out ending in late August. According to people the BBC spoke to, Claude was still being used as recently as last week, including in operations against Iran, largely through Palantir’s Maven Smart System. Anthropic declined to comment. The D.C. Circuit upheld the designation on September 25.
What it means for you. If you sell to the US defence market and Claude is in your stack, this confirms the exclusion is now enforced, not just announced. The BBC’s sources describe the practical lesson: once a model is built into a platform like Maven, removing it took months, not a configuration change. Build so you can swap models.
Switching costs are real even for the Pentagon. It took the department more than a month past its own deadline to get Claude out, and it has since signed with Google, xAI and OpenAI. Meanwhile, the BBC notes, President Trump met Dario Amodei twice at the White House last week, so Anthropic’s relationship with the administration and its position at the Defense Department are going in different directions.
Quick hits
- Five organisations fixed the same MCP SSRF bug, according to researcher Syed Anas Mohiuddin: Google’s MCP Toolbox for Databases (CVE-2026-14540, CVSS 8.0), a JPMorgan Chase docs server, Weaviate, France’s data.gouv.fr server and a Tangerang City government server all built outbound requests from values an agent supplied, without checking where they resolved. If you run MCP servers, treat every tool argument as attacker input and validate resolved IPs at connection time.
- Wikimedia documents what OpenAI’s rogue agents did on its sites: edits to wikis (mostly sandboxes, some aimed at making a citation tool fetch remote data), failed attempts to use its public Etherpad as a proxy, millions of API requests and hundreds of thousands of Wikidata Query Service queries, which may have contributed to a partial outage of that service in May. It adds a public-interest site to the list of organisations hit by the agents from OpenAI’s cyber evaluation, and it’s a reminder that any endpoint that fetches a URL for you is a proxy someone’s agent will try.
- TikTok adds a Shopping Assistant agent and one-click Buy Direct, built with Salesforce, Shopify, Stripe and others, and its TikTok for Business MCP server is now a connector in Claude, Perplexity, Replit, Snowflake and more. Agentic checkout is arriving inside the feed, not just in chatbots.
- AWS Continuum for Penetration Testing runs in CI/CD (public preview): the AI pentesting service formerly called AWS Security Agent now runs at deploy time from a pasted pipeline snippet and re-tests fixes automatically.
- Railway Agent is GA in Slack and Discord: mention it to list services, pull logs, check usage or see when a service was spiky, without opening the dashboard.
- ChatGPT gets image ads: a visual ad format shown alongside image generation, labelled and kept separate from the generated image, with US tests starting later this month. OpenAI also added conversion integrations (Hightouch, Tealium, LiveRamp), attribution partners such as AppsFlyer and Branch, and “Negative Phrases” for qualifying advertisers. It says ChatGPT reaches 1.2 billion people a week.
- 404 Media reports Meta rushed to fix Muse VM-escape bugs in the weeks before launch, citing an internal post about “a sudden spike in reported KVM escapes”. Each Muse agent runs in a per-user VM inside Meta’s production network; Meta’s bug bounty pays up to $300,000 for a Muse VM escape. A lesson for anyone hosting agents: a VM is a thin wall if it sits inside production.
- Denmark’s central person register was breached: attackers abused a Danish company’s legitimate lookup access to take names, addresses and CPR numbers for about 8.8 million registered people. The access was through a lawful API integration, which is a reminder to rate-limit and monitor partners, not just outsiders.
- mold 3.0 is a Rust rewrite of the fast linker, meant as a drop-in replacement for 2.42.1 with the same options and output, the same speed, and bounds-checked reads on corrupted input. It now builds with Cargo (Rust 1.95+) instead of CMake, and the goal for 3.x is to become the default linker in Linux distributions.
- Gleam 1.19 no longer compiles to Erlang source: it now emits Erlang abstract forms, like Elixir does, for faster builds and stack traces that point at the right Gleam line.
- Google Cloud Modernize bundles Google’s migration tools with Gemini agents, including an EKS-to-GKE migration agent (public preview) that translates manifests and maps storage and networking from AWS, with approval gates for a human.
- Databricks added UNREGISTER to the Iceberg REST catalog spec: paired with REGISTER, you can move a table between catalogs without copying files and without two catalogs both thinking they own it.
- Schneider Electric is buying PTC for $205 a share in cash, about $22.6 billion of equity and a $23.7 billion enterprise value, to join PTC’s CAD and PLM software with AVEVA and its pending Cognite deal. The pitch is engineering data as context for industrial AI agents; closing is expected by Q3 2027, pending shareholder and regulatory approval.
- Huawei and Qualcomm signed a broad patent cross-license covering 5G, compute, AI and networking, with Qualcomm buying some of Huawei’s US patents; it closes after regulatory approval.
- Atlassian says patch Data Center products now: CVE-2026-21589, rated critical (9.3), lets an unauthenticated attacker read specific files in the web root of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center. Attackers need the exact file path, but Atlassian says some configurations leave sensitive files there. Cloud is already patched; if you can’t upgrade, take public-facing instances off the internet.
- Namespace raised a $42M Series B led by Scale Venture Partners, for build and test infrastructure aimed at coding agents. It says it has more than 1,000 customers and revenue up 8x in a year.
- Apple is taking iPhone Duo app submissions ahead of the foldable’s October 23 release: recompile with Xcode 27.1 and use Device Hub to check layouts across poses and orientations. From April 2027, every app or game submitted must include iPhone Duo screenshots, so adaptive layouts are about to stop being optional.
- Redshift can now build Iceberg materialized views with
CREATE MATERIALIZED VIEW ... USING ICEBERG, stored in S3 or S3 table buckets and registered in the Glue Data Catalog, so Athena, Spark, Trino or Snowflake can read the precomputed results. Refresh is incremental but triggered manually. - GLM 5.3 is GA on Amazon Bedrock: Z.ai’s open-weight 753B-parameter MoE (about 40B active) with a 1M-token context, up to 128K output and explicit prompt caching, through US and Global cross-Region inference for eligible enterprise customers. Another open model enterprises can buy without leaving their cloud contract.