Answer-First Lead
Nvidia open-sourced Cosmos 3 — a leaderboard-topping physical AI foundation model — alongside a GR00T reference humanoid robot design, while JetBrains open-sourced Mellum2 to compete with Claude Code, MiniMax released M3 with 1M-token context and agentic coding, and Anthropic’s Project Glasswing expanded to 150 partners after finding 10,000+ security vulnerabilities. The week’s through-line: open models are no longer catching up — they are leading in physical AI, coding, and context length simultaneously.
🔍 THE BOTTOM LINE
The open model ecosystem just had its strongest week of 2026. Nvidia, JetBrains, MiniMax, and the HuggingFace community all shipped frontier-level capabilities with open licenses. The question is no longer “can open models compete” but “who can afford not to use them?”
📡 Today’s Stories
1. Nvidia Cosmos 3 and GR00T — Open Physical AI Goes Frontier
Nvidia released Cosmos 3, an open physical AI foundation model that immediately topped leaderboards for vision reasoning, multimodal generation, and action prediction. Built on a new architecture, Cosmos 3 helps robots and autonomous vehicles “think before they act” by simulating physical outcomes.
Simultaneously, Nvidia announced the Isaac GR00T open reference design for humanoid robots — the first time Nvidia has released actual robot hardware specifications openly. The reference design targets academic research and aims to standardize humanoid robot development.
Why it matters: Nvidia is doing for physical AI what it did for deep learning — releasing open models and reference designs that make the entire ecosystem move faster. Cosmos 3 + GR00T means any robotics lab can now build on Nvidia’s best. The open-source physical AI era starts now.
2. JetBrains Open-Sources Mellum2 — Claude Code for the Open Ecosystem
JetBrains open-sourced Mellum2, a coding-specific LLM designed to go where Claude Code can’t — air-gapped environments, enterprise compliance zones, and offline development. The model targets developers who need local coding agents without sending code to external APIs.
The release positions Mellum2 as an open alternative to both Claude Code and GitHub Copilot, emphasizing privacy and data sovereignty in addition to raw coding capability.
Why it matters: Claude Code’s biggest enterprise objection is data leaving the building. Mellum2 removes that objection entirely. For NZ government agencies, banks, and enterprises with strict data sovereignty requirements, this might be the first viable no-compromise coding assistant.
3. MiniMax Releases M3 — 1M-Token Context with Agentic Coding
MiniMax released M3, a new architecture (MSA — Multi-Scale Attention) supporting 1M-token context windows with native multimodality and agentic coding capabilities. The model can process entire codebases, long documents, and multi-hour video in a single pass.
Why it matters: 1M-token context in an open model changes what’s possible. You can feed it an entire enterprise codebase and get holistic analysis, not chunk-by-chunk results. Combined with agentic coding features, M3 represents a step toward models that truly understand the systems they’re working on — not just local snippets.
4. Holo3.1 — Fast, Local Computer Use Agents Go Open Source
The HuggingFace community released Holo3.1, a fast local computer-use agent that can operate desktop applications, browsers, and terminals entirely offline. The model is designed for privacy-sensitive tasks like automated data entry, testing, and UI workflow automation without cloud dependency.
Why it matters: Computer-use agents — AI that can see and click your screen — have been mostly cloud-dependent or locked behind APIs. Holo3.1 opens up local computer-use for anyone with consumer hardware. For NZ small businesses with limited cloud budgets, this is a practical tool arriving at the right price.
5. Project Glasswing Expands — 10,000+ Vulnerabilities Found in Weeks
Anthropic expanded Project Glasswing from ~50 partners to ~150 organizations across 15+ countries, covering power, water, healthcare, communications, and hardware. The AI-powered code security initiative uses Claude Mythos Preview to scan critical infrastructure codebases. Partners have already found more than 10,000 high- or critical-severity vulnerabilities since early April.
Why it matters: This is AI delivering measurable security outcomes at a scale humans cannot match. Finding 10,000 critical vulnerabilities in two months — across 50 organizations — is a rate that traditional penetration testing simply cannot achieve. The expansion to critical infrastructure means real-world safety improvements for power grids and water systems.