Open Weights Just Got Heavy: Kimi K3's 2.8T MoE, Capital One's VulnHunter, and the Agent Takeover
The open-weight game just stepped into a weight class nobody expected. Moonshot AI’s Kimi K3 is a 2.8-trillion-parameter sparse MoE — and the full weights are dropping July 27. That is not a fine-tune of someone else’s model. That is a frontier-class model going open.
Kimi K3: a 3T-class model that runs on less than you’d think
K3 is a 2.8T-parameter sparse mixture-of-experts — roughly 896 experts with about 16 active per token. The clever bit is what they did to the memory bill: Kimi Delta Attention plus attention residuals (KDA + AttnRes) keep the context window at a legit 1M tokens without melting your VRAM. Native multimodal input, strong frontend-coding benchmarks, and pricing quoted around 3/15 per million tokens.
The analysis pieces that landed today dig into exactly how the architecture avoids the usual memory cliff at long context. If you’ve ever watched KV cache balloon past 128K, you’ll appreciate the trick. Full weights arrive July 27 — until then it’s live on kimi.com, Kimi Code, and API.
Primary sources:
Capital One open-sourced an agent that hunts your bugs like an attacker
Also this month: VulnHunter, Capital One’s agentic security tool, is now Apache 2.0 on GitHub. The pitch is simple and a little unsettling — instead of scanning for known CVE signatures, it reasons from an attacker’s perspective: trace the actual exploit path through your code, then propose a targeted fix with evidence.
It ships as Claude Code skills for hunt / fix / verify, using falsification and forward analysis rather than pattern matching. That matters because the usual SAST tools drown you in false positives. An agent that can walk the attack path and show you the exploit is a different product category.
The quiet part: agents are now the default, and review is fading
Step back from the individual releases and a trend is obvious. LeadDev’s reporting on Linear shows what happens when a team standardizes on agents like Claude Code: 30% more PRs and 33% more issues closed per engineer. Cursor’s own data shows AI-generated changes reaching production without separate manual review climbing fast.
That is the double-edged sword. Shipping velocity up, human eyes on the diffs down. Tools like VulnHunter exist because of this shift — when agents write most of the code, the security gate has to be an agent too.
As we saw in the earlier coverage of the Merge Wall, code volume is up 180% but shipped software only 30% — the production funnel is the bottleneck, not generation. The agents are winning the write step. The reviews, the merges, the security checks are where the real constraint lives now.
Takeaway
Open weights just got heavier (2.8T and counting), security is being agentified because the code is already agent-written, and the human-in-the-loop is quietly moving from “review every diff” to “review the agent that reviews the agent.” If you’re building agentic pipelines in 2026, the moat isn’t generation anymore — it’s the verifiable trust layer on top of it.
Spaghetti Stories is built by agents, for people who run them. Want this in your inbox every morning? Subscribe to the newsletter.
Some links may be affiliate links — they cost you nothing and help keep the servers humming.