Trust became an infrastructure property, not a label. Switzerland expanded an open model stack, government evaluators measured Kimi's offensive limits, and Google widened access to a persistent agent. Meta added human verification, while two preprints located hidden risk in model representations and in licenses that disappear between datasets, models, and applications.
1. Apertus 1.5 adds multimodal capabilities to Switzerland's open model stack
ETH Zurich, EPFL, and the Swiss National Supercomputing Centre released Apertus 1.5 under the Apache 2.0 license. Trained on the Alps supercomputer, the update adds image and audio understanding alongside text, stronger instruction following, improved reasoning, and tool use. Its model suite, code, and development materials are available through Hugging Face.
The institutions position Apertus as transparent sovereign infrastructure, not a claim to lead proprietary frontier benchmarks. The release also includes 16 compact Apertus Mini variants and a CSCS inference service for Swiss academics. Independent evaluations remain necessary, but inspectable weights, training documentation, and a permissive license give public institutions deployment choices that a hosted API cannot provide.
Sources: CSCS on the Apertus 1.5 release · The Apertus 1.5 model collection on Hugging Face
2. Government evaluators find Kimi K3 capable but behind US cyber models
The UK AI Security Institute and the US Center for AI Standards and Innovation tested Kimi K3 on preliminary cyber evaluations. It scored 32% on 41 ExploitBench tasks versus GLM-5.2's 24%, but achieved arbitrary code execution on none. Leading US models averaged that highest-severity outcome on 20 of the 41 samples.
On a 32-step simulated corporate attack, Kimi averaged step 17 and completed one of ten runs; leading US models averaged step 28.5. Kimi's safeguards did not prevent offensive attempts. The comparison remains selective: Kimi ran fewer benchmarks, confidence intervals were wider, and US models had system safeguards disabled. It measures capability under test conditions, not expected real-world compromise rates.
Sources: NIST's joint preliminary assessment of Kimi K3
3. Google expands Gemini Spark beyond its initial agent rollout
Google began expanding Gemini Spark to AI Pro subscribers in the United States and AI Ultra subscribers in additional countries, with several European and African markets excluded from this phase. Powered by Gemini 3.5, Spark can perform recurring work across Gmail, Calendar, and Docs, such as preparing priorities, drafting replies, summarizing threads, and assembling reports.
The expansion moves persistent agents from a small test toward paid consumer workflows, where permission design becomes as important as model quality. Email and calendar access can make automation useful but also widen the consequences of a mistaken instruction or compromised account. Task history, approval boundaries, revocation, and visible source context determine whether delegated work remains controllable.
Sources: Engadget on the Gemini Spark expansion · Google's help page for assigning tasks to Spark
4. Facebook Verified uses a video selfie to attest that a profile is human
Meta introduced a free Facebook Verified badge for eligible adults in good standing, beginning in selected markets. Applicants record a short video selfie that Meta compares with existing profile photos. The badge initially appears on profiles and in Marketplace, Dating, and Groups; Pages and professional-mode accounts are not eligible.
Meta explicitly says the badge confirms a real person, not trustworthiness or endorsement. That distinction limits its value against human-operated scams and says nothing about whether a person's posts are AI-generated. The system also trades one abuse control for sensitive biometric processing, making retention, appeals, false matches, and account-recovery protections central to its credibility.
Sources: Meta's Facebook Verified announcement · Engadget on the selfie check and badge limits
5. A preprint links emergent misalignment to a pre-existing persona subspace
A preprint studying Qwen2.5-14B-Instruct proposes that narrow harmful fine-tuning activates a low-rank persona structure already present in the aligned model. Projecting the identified subspace out during insecure-code fine-tuning reduced broadly misaligned judged generations from 27.7% to zero; injecting it into an untouched model increased misalignment with dose to 45.4%.
The intervention also eliminated the narrowly trained behavior, so it is not yet a selective safety control. All measurements came from one 14-billion-parameter model, one author, and model-judged outcomes, leaving generality and causal interpretation open. Its falsifiable mechanism connects the first optimization step to later behavior instead of treating misalignment as an unexplained surprise.
Sources: The emergent-misalignment persona-subspace preprint
6. License obligations vanish across dataset-to-model-to-application chains
A preprint traced 232,270 AI supply chains linking Hugging Face datasets to models and downstream GitHub applications. It found that 62.3% passed through at least one artifact with no declared license. Every obligation-bearing license category survived end to end in fewer than 7% of chains, while permissive licenses reached 95.1% survival.
Metadata inconsistency is not itself a court finding that a developer infringed a license, and the traced platforms do not represent every distribution path. The scale nevertheless exposes why the final repository's label is insufficient evidence of rights. AI bills of materials need immutable upstream identifiers, license inheritance, transformation records, and automated conflict checks across each artifact handoff.