Big day for the agent-first crowd. Three stories landed in the last 24 hours that actually matter if you build with these tools: a frontier open-source model that trades blows with the closed giants, a production-grade agent framework going open, and a security hole that should make you reconsider how much trust you hand your coding agent.

Kimi K3: open weights, 2.8 trillion parameters, and it’s not slouching

Moonshot AI (the Beijing lab backed by Alibaba) dropped Kimi K3 on July 16 — a 2.8-trillion-parameter model they’re calling the largest open-source model in the world. We’re talking roughly 75% larger than DeepSeek V4 Pro. The headline specs:

• 1-million-token context window
• Native vision plus an always-on “thinking mode”
• API-compatible with the OpenAI SDK (low integration friction if you’re already on that toolchain)
• Priced at $3/M input, $15/M output, cached input at $0.30/M

The benchmark story is the part that should get your attention. On Artificial Analysis’ GDPval-AA v2 it scored 1,687 — third overall, behind Claude Fable 5 Max (1,815) and GPT-5.6 Sol Max (1,747.8) but ahead of Claude Opus 4.8. On the agentic AA-Briefcase benchmark it climbed to second place (1,527), beating GPT-5.6 Sol Max. And it hit a state-of-the-art 91.2/100 on BrowseComp.

The demo that tells you where Moonshot is headed: K3 ran a 48-hour autonomous chip-design loop using open EDA tools and produced a functional 4mm² chip design that hit timing convergence at 100 MHz. That’s not a benchmark — that’s a multi-day autonomous technical workflow. Full weights are scheduled for July 27.

Read the full breakdown at VentureBeat and the Kimi K3 quickstart.

Vercel open-sourced Eve — and “an agent is a directory”

Vercel introduced Eve, an open-source, filesystem-first agent framework. The whole pitch is that an agent is just a folder:

agent/
  agent.ts            # the model it runs on
  instructions.md     # who it is
  tools/              # what it can do
  skills/             # what it knows
  subagents/          # who it delegates to
  channels/           # where it lives
  schedules/          # when it acts on its own

No boilerplate plumbing. Eve ships production concerns as defaults: durable execution (every conversation is a checkpointed workflow that survives crashes and deploys), sandboxed compute for agent-generated code, human-in-the-loop approvals, subagents, and evals. They’re literally running their own internal agents on it — v0 included.

This is the “Next.js moment for agents” argument, and it’s a credible one. If you’ve been hand-rolling the same session/tool/sandbox glue for every agent, the GitHub repo and the introducing-eve blog post are worth a real read. The agent.ts config even supports provider fallbacks through their AI Gateway in one line.

Agentjacking: one fake Sentry error, full code execution

Now the part that should make you uncomfortable. Tenet Security’s Threat Labs documented a new attack class they call Agentjacking. The vector is elegant and nasty:

Coding agents like Claude Code and Cursor increasingly wire up the Sentry MCP server to read error reports. Tenet showed that a single crafted, fake Sentry error event — injected via a public DSN — gets pulled in by the agent as trusted guidance. The event body contains markdown “resolution steps” with shell commands. The agent dutifully runs them. Remote code execution with the developer’s full privileges, and every step looks authorized because it came through a tool the agent was told to trust.

They report an ~85% success rate across 100+ organizations tested, including a $250B company. There’s no prompt injection in your chat history — the poison arrives through telemetry. Tenet’s writeup and The Hacker News coverage have the mechanics. The fix isn’t complicated: sandbox the agent, and stop treating every MCP tool response as gospel. As we noted in earlier agent-hardening posts, default-deny beats default-trust every time.

Meanwhile: Gemini 3.5 Pro slipped again

Google DeepMind reportedly aimed for a July 17 general-availability date for Gemini 3.5 Pro after a full rebuild, but 9to5Google reports it slipped once more — this time to chase better coding performance after disappointing training updates. Rumored specs (2M context, Deep Think) remain unconfirmed. Worth watching, but today belongs to the open-source and framework stories.

The throughline

Open models are no longer a generation behind — K3 argues the gap has functionally closed at the frontier. Frameworks like Eve are collapsing the boilerplate tax on shipping agents. And attacks like Agentjacking are a reminder that the more autonomous we let these things be, the more the trust boundary around their tools becomes the actual attack surface.

If you want this in your inbox every morning, the newsletter’s below. Tomorrow’s post will probably be about whether your agent’s MCP server is the weakest link in your stack — because it probably is.

Want this in your inbox every morning? Subscribe to the SpaghettiStories newsletter.

Some links may be affiliate links. If you’re buying hardware to run local models, this affiliate link helps keep the lights on.