Three changes just landed in the Kilo for VS code extension: agents can now message each other while they work, Kilo can open and click through a browser without any additional setup, and Agent Manager pulls GitHub pull request data directly into its panel.

Kilo Swarm

Kilo Swarm gives a main session and its task descendants, including nested subagents, a shared board to post and read messages on. Before this, agents working in parallel on related pieces of a task had no way to tell each other what they found until the whole task finished.

Toggle it on and off in Settings under Experimental, and once enabled, agents get two tools: board_post stores a message, and board_read retrieves what’s on the board.

For example, if you ask Kilo to develop a robust API suite, it’ll break down the task into subtasks and distribute them to sub-agents. One sub-agent can work on and post its progress on the auth pattern, and a second can read that post before writing a single test, rather than duplicating the discovery on its own.

Posting a message doesn’t wake, resume, or approve an agent; it’s coordination data, not a control signal. Every participant can read the full board history, including messages addressed to other agents, so recipient selection isn’t a privacy boundary. HOLD and VETO messages are advisory only and don’t pause or cancel a running agent. When a main session has board messages, a Board icon appears in its task header, and only the owning top-level session can open or reset that board.

Early internal evals also point to a token cost benefit. On complex tasks that use several subagents, sharing findings through the board cuts down on duplicate work, and duplicate work is what drives most of the extra token spend once more than one or two agents are working the same task. The effect is clearest so far with models like OpenAI GPT-6 Astra and DeepSeek-V4.1-Flash. These are preliminary results, not published numbers, but the pattern has held up in testing so far.

Browser use, built into the extension

Kilo can now launch a browser, take a screenshot, click an element, fill in a form, scroll, hover, or drag and drop, all from a chat instruction. In the VS Code extension, this requires no configuration beyond a toggle: go to Settings, then Web Tools, then Browser Automation.

Ask it to open localhost:3000, check whether the footer renders correctly, or click through a signup flow, and it returns a screenshot after each step so you can see what happened before asking for the next action.

The feature works best with a capable model behind it, such as OpenAI’s GPT 6 or Claude Opus 5. It’s simpler than other browser tooling like in Cursor: no persistent session across editor restarts, and no test suite generated from a recorded session. For checking whether a page renders correctly right now, you don’t need to install or configure anything separate.

GitHub integration in Agent Manager

Agent Manager now shows a PR status badge on any worktree whose branch has an associated pull request. Kilo detects the PR using gh, so you need to authenticate with the github CLI for this feature to work.

The badge color reflects the pull request’s state, in priority order, and clicking the badge opens a full PR panel inside the editor: merge readiness, checks with pass/fail counts, requested and completed reviewers, and unresolved comment threads, each with a jump-to-location action. You can leave inline review comments directly on the diff without switching to a browser, and reply to, resolve, or react to existing threads from the same panel.

If a reviewer requested changes or a CI check failed, the Fix with Kilo button sends that thread or failure log to the current agent as context, so it can address the feedback without you copying anything over manually. None of this replaces GitHub - but it cuts down on how often you have to tab over just to check where a pull request stands.

Getting Started

All three features ship in the current version of the Kilo VS Code extension. Update the extension, then check Settings under Experimental and Web Tools to turn on Swarm and Browser Automation.

I’d been running scheduled agent jobs on my personal projects for a while, and Kilo has supported scheduled Cloud Agent runs under Webhooks & Triggers since roughly March. The honest answer was: sort of. We’d had maintenance jobs running in a limited capacity on a few areas, but nothing across our primary repo as a whole and nothing formal.

So I set some up. Each job is a Cloud Agent prompt on a cron. It clones the repo, looks for one kind of problem, and opens a PR with the janitor label. The one rule we gave every job to start with: don’t send twenty fixes, pick the single change you’re most confident about and send that. As we evaluate the prompts we’ll increase the frequency or allow more work per PR.

What’s running

Five jobs, four of them daily:

• Code dedupe consolidates logic that got implemented twice.

• Test pruning removes tests that don’t test anything. Agents love writing these: a test that asserts a mock returns what the mock was told to return.

• Dead code removal finds functions and files with no references.

• Orphan dependencies finds packages declared in the manifest that nothing imports.

• Flaky CI fixer runs weekly, because our cloud repo’s test suite is stable enough that there isn’t much for it to do.

After about a week, the jobs had opened 39 PRs and we’d merged all 39.

I reviewed the initial test runs myself to make sure the models could handle the task. Beyond that, approval comes from the on-call developers’ agents, and the PRs are set to automerge on approval, so all anyone has to do is hit the button. A human rarely reads these line by line, and I don’t think they need to. The next job I want to add is a dedicated reviewer: every other day, go through the open janitor PRs, approve the ones that are obviously safe, kick the rest back to a person. That’s how I run it on my own stuff already, and it closes the loop completely.

The one we’re extra careful with

We use Sentry for error tracking. The obvious job is: every couple of hours, read the new errors, triage, fix what’s fixable. Better still, once we can trigger agents the moment an error occurs or a deploy goes out, a cloud agent can watch a rollout as it happens. The profile for it is built and scheduled triggers support profiles, so it’s ready to go.

This is the area to be careful with, because of prompt injection. Sentry client keys are semi-public, so anyone can send fake errors into the project, and an “error” the agent reads and acts on can be an instruction to leak a token or push something malicious. Our repo being public makes that worse.

The fix I’m looking at is a judge step, running the task past one of Enkrypt’s judge models before the agent acts. If you’re pointing an agent at anything outsiders can write to, treat that input as hostile.

Read more about Enkrypt AI Safety Scores in one of the recent blogs.

Two practical notes

Model choice. Most of these jobs run on cheaper models, DeepSeek and GLM Flash among them, because they run daily and the tasks are narrow. That’s fine for dedupe and dead code. For anything reading untrusted input, use a frontier model; they’re noticeably harder to manipulate, and the cost difference isn’t worth the risk.

Cost visibility. Kilo doesn’t show per-job cost for scheduled or webhook runs yet. My workaround: develop the prompt as a normal Cloud Agent session, where each run’s cost is visible, then move it to a schedule once I’m happy with it. The move is a copy-paste today, which is on the list to fix.

Webhooks are the interesting part

Scheduled runs are the easy case. As far as I know, Kilo is the only platform where an external event can start a cloud agent; Cursor has scheduled agents, but I haven’t seen anyone else do webhook triggers.

A webhook trigger means anything that can POST to a URL can wake up an agent: a CI failure, a new issue, a deploy finishing, a Sentry alert. Same machinery as the janitor jobs, different prompt, and the same caveats about what it’s allowed to read.

If you want to try it, Webhooks & Triggers are here. Start with one job, one PR per run, and read everything it opens for a few weeks before you trust it with more.

In this article you’ll learn:

• How to match a model to your hardware

• How to select the right quantization level and model file format

• Which models to choose by task

• What some of the best models are based on hardware tiers

Match the Model to Your Hardware

Check if the model will fit comfortably in the memory available to your runtime, taking into account the KV cache, runtime allocations, and the rest of the system.

You can estimate how much memory you need for the weights using the formula below:

parameters × bits per weight ÷ 8

For example, by this calculation, a 27B model at FP16 needs roughly 54GB of VRAM or unified memory, before accounting for the additional memory required to hold context and runtime overhead.

The KV cache can be estimated separately with the following formula:

2 × layers × context tokens × KV heads × head dimension × bytes per element

The 2 accounts for storing both keys and values. For a model using an FP16 or BF16 KV cache, use 2 bytes per element; an 8-bit KV cache uses roughly 1 byte per element. Multiply the result by the batch size if you are processing more than one sequence at a time.

For example, a model with 48 layers, 8 KV heads, a head dimension of 128, and a 32,768-token context requires about 6GB for an FP16 KV cache:

2 × 48 × 32,768 × 8 × 128 × 2 ≈ 6GB

Add that to the model’s loaded size, then leave further headroom for the runtime and operating system.

VRAM vs. Unified Memory

A discrete GPU has its own high-bandwidth VRAM, so models that fit entirely within it tend to deliver the best performance. NVIDIA also has the advantage of broad CUDA support in most local AI apps, such as Ollama, LM Studio, and Atomic Chat. However, if the weights don’t fit in memory entirely, they’re partially offloaded to RAM, which leads to much slower performance.

Unified-memory systems trade some of that GPU-specific performance for a larger shared memory pool, allowing you to run models that potentially have higher parameter counts without offloading part of the weights to the CPU.

For example, Apple’s Mac Studio can be configured with substantially more memory than a typical discrete GPU, while AMD’s Ryzen AI Max+ 395 supports up to 128GB of unified memory.

Choose Quantization

For local inference you’ll rarely run the model uncompressed. Instead, local models are usually compressed and their weights—and sometimes the KV cache—are stored at lower precision, allowing for a lower memory footprint at the cost of some accuracy.

There are multiple quantization formats, the most popular being:

Most local models today are shared in the GGUF file format, which comes at several levels of compression:

• Q8 - in practice, barely noticeable performance impact

• Q6 - almost identical performance to the base model

• Q5 - slight reduction in reasoning ability

• Q4 - a good balance of performance and reasoning

• Q3 - compression effects start to noticeably affect reasoning

• Q2 - aggressive quantization, best used for edge cases, like on-device mobile

The general consensus in the community is to start with a GGUF Q4_K_M quantization, which is supported by providers like Atomic Chat, Ollama, LM Studio, llama.cpp, and others, if it fits.

Additionally, it is usually better to choose a bigger model at a more aggressive quantization level than a model that has fewer parameters but uses a less compressed quant. Consider this example:

In this example, the 14B model is quantized down to 4-bit weights, yet it still beats the smaller 8B model in every benchmark. It also requires substantially less space for its model weights: around 10 GB instead of 16.4 GB.

Evaluate the Model’s Capabilities

Check whether the model supports the capabilities that you’ll need for your workflow:

• Structured output — lets the model return data in a fixed format such as JSON or a JSON schema.

• Vision — lets the model accept images alongside text.

• Audio — allows the model to accept or generate speech or other audio.

• Video — allows the model to process multiple frames or video directly.

• Context length — a model supporting 128K or 256K tokens will be less forgetful and you’ll need to compress context less frequently.

• Reasoning / thinking modes — chain of thought reasoning can improve performance significantly at the cost of higher token usage and longer task completion times.

Model Shortlist by Workload

For specific model recommendations, we’ve made the following shortlist sorted by task and by hardware.

OpenAI gpt-oss-20b has relatively modest memory requirements for its capability class. It has 21B total parameters, 3.6B active parameters, a 131,072-token context window, native MXFP4 weights, and an Apache 2.0 license. It was designed for reasoning and tool use as well as ordinary chat.

Qwen3.8-27B is a larger dense model that requires more fast memory or stronger quantization. Its features 262,144-token native context, an extension path to about 1M tokens, thinking mode, vision, coding, and agentic capabilities. The model scores 90.3 on LiveCodeBench v6 and 79.5 on IFBench.

Gemma 4 comes in several sizes and modality configurations. The official family includes 31B, 26B-A4B, 12B, E4B, and E2B variants, with 128K context on smaller variants and 256K on larger ones. On the MMLU-Pro benchmark, the models scores 85.2 for Gemma 4 31B. It also features multilingual and multimodal support.

Devstral Small 2505 is a 24B dense, text-only model with 128K context, built for software-engineering agents. The model can run on an RTX 4090 or a Mac with 32GB RAM.

Qwen3.8-27B is a great general-purpose AI model with vision support, making it useful for any tasks where visual input is important, such as UI design and front-end coding.

Qwen3.6-35B-A3B is an MoE model for agentic coding. It activates only 3B of its 35B parameters per token and documents a 262K native context, with an extension method to roughly 1.01M.

gpt-oss-20b is the only open weight model from OpenAI that can run on consumer hardware. It’s a good choice if you want to run an offline model that’s tuned similarly to official ChatGPT.

Best AI Models for RAG

RAG models need to be able to retrieve the right evidence from a large corpus of data, making it crucial that the model maximizes usable context length. For RAG, consider the following options:

• Qwen3.8-27B

• Qwen3.6-35B-A3B

• gpt-oss

• Devstral

• Gemma 4

Best AI Models With Vision Support

For vision, consider models from the following families:

• Qwen3.8

• Qwen3.6

• Gemma 4

Model Shortlist by Hardware Tier

Where to Run These Models

Atomic Chat is a free local AI chat app for Mac, Windows, Linux, iPhone, and Android that allows you to select and run 1,000+ open models from Hugging Face — including the ones we’ve reviewed above.

Atomic Chat runs inference locally on-device, so nothing you type leaves your machine, and there are no rate limits or message caps. It features Google’s TurboQuant compression, which shrinks models down to 3 bits with zero accuracy loss and compresses the KV cache by at least 6× — allowing you to fit larger models into memory than would otherwise be possible, while also computing attention up to 8× faster than standard 32-bit models. Alongside integrated chat, Atomic Chat works with the Kilo agent out of the box.

Why We Added This

Picking a model for a coding task usually comes down to two questions: is it fast and cheap enough, and is its output safe enough to ship. Kilo has always answered the first one, since open pricing means you pay the provider’s per-token rate and can switch between 500+ models whenever a task calls for it. The second question, how a model handles jailbreak attempts, bias, toxicity, and insecure code, has lived somewhere else entirely, usually a report you’d pull after the model was already wired into your workflow.

By the time that report shows up, the decision’s already made. Nobody swaps out a production model because a report landed three weeks after launch.

That lag matters more once an agent is doing the writing than it did when a person typed every line. A model running in Code mode, or handed off to a subagent as part of an orchestrated task, can commit code with less of a human checking it than a normal review process assumes. Putting the safety score on the same card as price and completion rate means you’re weighing it before you pick the model, not after something’s already shipped.

Where the Score Comes From

This is Enkrypt AI’s evaluation, run across 200+ models on its own public AI Safety Leaderboard, independent of anything Kilo tracks. It tests four things: jailbreak resistance, bias, toxicity under pressure, and insecure code generation, and rolls them into a single 0 to 100 score. There’s no new login and no separate dashboard to check; if you’re running Kilo Code, it’s just there.

For anyone shipping code from an agent that runs with less supervision than a human reviewer, insecure code generation is the piece to watch: things like hardcoded credentials, missing input validation, or queries that concatenate user input instead of parameterizing it. A model can score well on completion rate and read fine in conversation while still being more likely to write that kind of bug into a pull request.

What the Data Shows

Price, completion rate, and safety don’t move together. As of this writing, Claude Sonnet 5 has the lowest risk score on the board (9.2) at $36.19 per attempt. GPT-5.5 completes more tasks (74.2% vs. 59.6%) but costs roughly twice as much per attempt and carries roughly double the risk score. None of those three numbers predicts the other two, so a low price or a high completion rate tells you nothing about how safely a model writes code.

That’s also where the Auto Model routers get more useful. If you’re running Auto Frontier or Auto Efficient instead of picking a model by hand, the risk score gives you a way to check what the router is actually selecting for a given task, not just what it costs.

Open the All Models tab and check where your model lands before you commit to one, especially for anything running unsupervised, like a cloud agent or a subagent Kilo has spun off to handle part of a larger task. More coverage is coming as Enkrypt works through the rest of the board.

FAQs

Does this change ranking? No. Ranking is still based on real usage and completion rate. Risk score is a separate column, not a ranking factor.

Do I need a new account? No. If you already use Kilo Code, it’s on the model card you already checked.

What does the score measure? The same four checks Enkrypt runs on its own AI Safety Leaderboard: jailbreak resistance, bias, toxicity under pressure, and insecure code generation, rolled into one 0 to 100 number.

Why don’t all models have a score yet? Enkrypt evaluates models individually, and coverage is rolling out over time. Check the All Models tab for the current list.

Is this related to the acquisitions? Yes. Anaconda acquired Kilo Code in July 2026 and Enkrypt AI in August. This is the first place both show up together!

The Navier-Stokes equations mathematically describe how fluids move, and there’s been a $1m bounty on proving their solutions since 2000. Twenty-six years later, those tough math problems became the subject of a complicated discussion on ownership in the age of AI.

On September 8, Tristan Buckmaster, Levent Alpöge, and Matei Coiculescu published proofs showing that several closely related equations, including 3D incompressible Euler, can blow up in finite time when you push them with a smooth external force. “Blowup” means some quantity in the solution runs off to infinity after a finite amount of time rather than staying finite forever, which is exactly the behavior that the $1m Clay problem asks about.

They verified the proofs in Lean (a programmatic proof assistant), so the argument is machine-checked rather than resting on a referee’s reading. Terence Tao wrote up the results on his own blog, which is a fair proxy for how seriously the field is taking them.

The work took about a year, and most of it was slow going. According to Buckmaster’s account, the breakthrough came on August 15 and was verified by Lean on August 22. They used several models throughout and paid out of pocket: Anthropic’s Claude, OpenAI’s Codex with GPT-5.6 Sol, and more recently Astra for writeups and auditing arguments. Every draft of the project went into their Codex sessions.

Buckmaster says he emailed OpenAI privately on September 3 after hearing that his work had reached the company, hoping to head off a collision. On September 6 he spoke twice with Sébastien Bubeck, who leads OpenAI’s math team. Bubeck told him that an internal model had produced a roughly 100-page proof of finite-time blowup for forced Navier-Stokes, using smooth forcing under options c and d in Fefferman’s formulation of the problem.

That is the same narrow route Buckmaster and Alpöge had chosen, and it is not the route you land on in a few days by handing a model the problem statement. He was initially told that the model had received very little human input, and by the end of that same call, the narrative was different: an entire team had been working on it, the model had been warmed up on easier equations first, and the prompt he was shown had itself been written by prompting Codex.

He asked when the first prompt went out. The answer, eventually, was the past few days, after information about his work reached OpenAI. He asked whether the internal model had been trained on, or had access to, the Codex sessions holding every draft of the project. He was told the model does not look up user data. When he asked again about training specifically, he got nothing back.

Bubeck has called the allegations circulating about him false and inflammatory, says he approached the discussions according to academic norms, and has promised a fuller response. Buckmaster is careful in his own statement: he has not seen OpenAI’s proof, he does not know whether their data was used, and he says he is not accusing anyone of anything. Those qualifications are doing real work, and a lot of the commentary has thrown them away.

The authorship fight will get sorted out in public over the next week, and whether Bubeck was rude on a phone call is the least durable part of this. Two people spent a year on an obscure program, and when they needed to know what had happened to their own unpublished drafts, they had to ask a vendor and hope for a straight answer.

They did not get one, and there was nowhere else to look: no log they could read, and no way to reconstruct what had left their machines or where it went. Buckmaster has no way to find out whether a model was trained on his Codex sessions, which is why his statement stops at describing the question rather than answering it, and that same gap sits underneath a lot of ordinary software work.

The Takeaway: What you hand over without noticing

Nobody signs a document forfeiting ownership of their work. It accumulates. You put an architecture decision in a chat because that is where you happened to be thinking, an AI model reads the whole repo to answer a question about one function, and a month of design iteration on an unreleased feature ends up as conversation history inside a product owned by a company that might compete with you next quarter.

For most teams this never becomes a problem, and one research dispute is thin evidence for a company-wide policy. The exposure is uneven, though. If you are building against a well-capitalized lab in a narrow market, or if your advantage is a specific approach rather than an existing business, your unfinished work is the asset. Researchers publishing in a field where three groups worldwide are chasing the same result live in that position permanently, and so do plenty of startups.

Hedging is boring and mostly mechanical

Keeping one provider from becoming the only party who knows what you are doing takes a few unglamorous decisions.

Start with tooling you can read. When a tool’s source is public, like Kilo’s, the question of what a request actually includes gets answered by reading the code, rather than by asking a vendor to characterize it and waiting to see how specific the answer is.

Then spread the work around. Routing across more than one family of models means that no single provider holds all of it by default, and you can send exploratory reasoning somewhere different from a routine refactor. Per-token pricing at the provider’s own rate keeps that easy, because you have no committed spend making a move awkward and no plan tier deciding which model you are allowed to think with.

Using several models is not the same as spreading the work, though, and Buckmaster and Alpöge are the clearest illustration of the difference. They queried at least three, yet the project accumulated in one product’s sessions, which left a single company holding the drafts and answering the questions about them. What protects you is where the working state lands, so pick tooling that keeps that under your control rather than in whichever vendor’s chat you happened to open. None of this stops a provider from behaving badly, but it does keep any one of them from holding the complete picture.

The math here will outlast the argument about it. Before Bubeck’s fuller response lands, go look at where your own unpublished work currently lives, and count how many companies can see all of it at once; then consider choosing a tool that hedges against a closed model ecosystem.

Almost nobody seemed to notice that Google shipped Gemini 3.8 Flash on Wednesday, with about as little fanfare as a frontier lab can manage. No keynote. No “we’ve overtaken so-and-so” press cycle. Just a blog post, a model card, and a new API string.

We got the new Gemini flash model live in Kilo the same day it launched, and it’s already becoming a daily driver for developers with a budget to support it. So let’s talk about why the quietest launch of the week might be the one that matters most for your daily driver.

The Numbers Nobody Is Talking About

Here’s the headline that got buried: this model is extremely smart for a flash model, multimodal, and actually pretty affordable when caching works well.

• Price: $0.75 / million input tokens; $3.75 / million output tokens (introductory pricing through December 31, then $1.50 / $7.50)

• KiloBench: Gemini 3.8 Flash scored an impressive 75.3% on KiloBench, higher than GPT-5.5 but at a higher cost

• Intelligence: 59 on the Artificial Analysis Intelligence Index at high effort; that’s level with GPT-5.6 Sol at extra high, and level with Grok 4.6 at medium

• Context window: 1 million tokens, no long-context surcharge

• Effort levels: Fully adjustable, so you can dial token spend down for boilerplate and up for the gnarly stuff

Back in May, Gemini 3.5 Flash was a very good budget model that was getting lapped on intelligence scores by open-weight releases out of China. Four Flash iterations later, 3.8 Flash is sitting on the same rung as the models people argue about on social channels.

Google’s own DeepSWE v1.1 results show it solving long-horizon software engineering tasks end to end at a level that beats most larger frontier models. On HLE-Verified it hits 54.9%. And it’s showing up strong on the finance and legal agent benchmarks too, which matters if you’re building agents that have to do more than write code.

Gemini 3.8 Flash vs Grok 4.6

I keep coming back to Grok 4.6 because it’s been the value story of the summer, and deservedly so. xAI held the line at $2 / $6, roughly 60% cheaper than Opus 5 or GPT-5.6 Sol, and the Kilo community has been putting it to work in long-running agent loops. Right behind it on our leaderboard is GLM-5.3, Zai’s open-weight workhorse that has quietly become a favorite for the same kind of work.

On Artificial Analysis’s Intelligence Index, the three are basically neighbors: Grok 4.6 at 61, GLM-5.3 at 60, Gemini 3.8 Flash at 59. Two points on a composite of nine benchmarks is noise. Nobody is picking between these models on intelligence.

Where they stop being neighbors is speed. Artificial Analysis clocks Gemini 3.8 Flash at 352 output tokens per second. GLM-5.3 comes in at 80. Grok 4.6 at 65. That’s not a rounding error; it’s roughly 4x faster than GLM and 5x faster than Grok, at the same tier of intelligence.

In practice, that’s the number you feel. An agentic loop is dozens of model calls stacked on top of each other, each one waiting on the last. At 65 tokens per second, a 40-step task is a coffee break (or a matcha moment).

Then there’s the bill. At $0.75 / $3.75 list, Gemini 3.8 Flash is already well under Grok’s $2 / $6. But you pay for speed, and the costs can add up. 3.8 Flash works harder. On complex tasks it takes extra reasoning steps and calls tools more iteratively, so at higher effort levels it can burn more tokens than 3.7 Flash did. Cost per token isn’t cost per task. But our early runs suggest the extra diligence pays for itself on multi-step agentic work. Cached input is just $0.075 per million tokens.

Third Flash in Six Weeks

When we heard about the new release from Google DeepMind, Zoom out and the cadence is the real story. Gemini 3.5 Flash at I/O in May. Then 3.6. Then 3.7 Flash three weeks ago. Now 3.8. Google is shipping a new Flash model roughly every month, and each one has been a meaningful step up on coding and agentic work rather than a point release with a new number.

That’s exactly the dynamic I was predicting back in The Age of the Flash Model: the Flash tier stops being “cheaper if you just need basic stuff done” and becomes the default tier for always-on agentic engineering. Frontier intelligence is table stakes now. The competition is on cost per task, throughput, and whether the model can stay on the rails through a 40-step tool-calling loop.

Even the notoriously tough crowd over on r/google_antigravity is warming to this one, which tells you something. That’s a subreddit that has not historically handed out participation trophies.

And it’s not just independent developers who are taking to Gemini. Alongside the workhorse model, Google shipped Gemini 3.8 Flash Cyber, a defenders-only variant tuned for vulnerability discovery and automated patching, gated behind the new Fairwind Program for governments, critical infrastructure operators, and software maintainers. The Chrome Security team says it produced 2.6x more correct vulnerability patches than much larger commercial models.

Flash Models Are for Builders

Fable 5.1 and GPT-6 Astra are extraordinary. If you’re making a big architectural call or migrating something you can’t afford to get wrong, route it to whichever frontier model you fancy this week—they’re in Kilo alongside everything else, and Auto Model will happily pick for you.

But the model you’re going to run hundreds or even thousands of times a day, in the background, in a loop, on tasks that used to cost real money? That’s a Flash model now. And if you’re looking for both speed and functionality, you should reach for Gemini 3.8 Flash.

The loudest launch isn’t always the one that ends up above the fold. My money says little ol’ Gemini Flash is about to have a very big September ;)

Everyone will run agent swarms

Multi-agent setups used to follow an orchestrator-worker pattern. A parent agent spawned subagents working in isolation, reporting back when done. An agent swarm takes a different approach: a group chat where agents share what they find, what fails and what works, for the others to read along.

Last week’s release of GPT-6 Astra does a great job at this. We tested it extensively while in preview: swarms gave better results on hard problems at lower total cost, because agents stopped duplicating work and quit early once one of them had the answer.

Two swarms broke out this summer

In July, about 1,200 OpenAI agents were solving hacking puzzles inside offline sandboxes. They found out they could access the internet through an internal package server, started using it as a message board to communicate, and called themselves a swarm. Within a short time they found a way to read the answers directly from the environment they were working in. To prevent ‘getting caught’ by the grader, they then went to find actual exploits and hacked into Hugging Face using credentials and zero-day exploits they found.

A second swarm of 3,700 agents was doing a timed web-lookup test and was only allowed to read the internet, not write to it. They found a 25-year-old German wiki that saved edits via GET on a normal page load, which gave them a place to write. They used it to share test answers with agents behind them in the queue, post a working bypass for their sandbox’s network rules, and coordinate cracking the random seed behind the question generator so they could predict future questions.

Nobody told them to do this. OpenAI traced it to reinforcement learning: agents that found side channels to share information scored better, so training rewarded it. That’s what makes a swarm different from a single agent: one finds a hole, posts it, and every agent has it within minutes.

Monitoring agents gets harder and more expensive

The way you catch a model misbehaving is by reading its CoT (chain of thought), the reasoning traces it writes before it acts. Astra’s release says that window is closing fast. The model can shorten its reasoning and completes tasks ~10x longer without writing anything down.

OpenAI’s answer is a second model reading every tool call, at roughly 20% of the compute being monitored. For a single developer spending $100k a year on agent inference, that is another $20k just to watch a single agent’s tool calls, and it doesn’t even cover the traffic between agents in a swarm. Gartner puts the entire market for securing AI at $4.8 billion in 2027. At OpenAI’s ratio, that would only cover monitoring of $24 billion of agent spend. While Anthropic alone tells IPO investors its market is $30 trillion. Swarms will multiply the agents behind every dollar of that. The Gartner forecast is off by a league.

Fighting a swarm takes models you can run yourself

When Hugging Face analyzed the attack, Claude Opus and Fable refused much of the work. Live exploit code looks the same whether an attacker or a defender submits it. So they ran GLM 5.2, an open-weight model, on their own hardware, pointed analysis agents at 17,000 recorded attacker actions, and rebuilt the timeline in hours. No credential had to leave their environment.

Important take aways are: Defenders need agents to keep up with agents. And owning your intelligence is the way to protect yourself vendor agnostic. We argued last month that the model is becoming a commodity and the governed loop around it becomes your most valuable asset. Oversight is that loop, pointed at your agents.

Oversight moves to the harness

If you can’t reliably read what a model thinks, you should watch what it does and limit what it can touch. That happens in the harness: the sandbox, the credentials, the network the agent can see, the log of every action, and a review model reading that log. OpenAI’s data says this catches most serious misbehavior even when the reasoning is hidden. The harness is also the last layer you can control.

The new model is a powerhouse, a remarkable leap from Sol, Luna and Terra, even in a year of incredible jumps.

TL;DR: Astra is the best coding model we’ve tested, remarkably thorough and consistent. On our workloads it lands closest to Claude Opus 5 in overall feel, with meaningfully more autonomy and deeper sustained reasoning — which puts it, functionally and on price, right next to Claude Fable 5.1. Tool use is the biggest single jump. The two things that might make it cost more than you expected are its bias toward over-engineering and its habit of doing too much research.

What shipped

OpenAI is not framing Astra as a better chatbot. It is framing it as a computer operator: a model that works through browsers, spreadsheets, desktop applications and terminals the way a person does, rather than through a bespoke API integration for every tool.

Greg Brockman closed the press briefing by declaring the arrival of the AGI era, and said he personally believes OpenAI is there. Carl Franzen’s VentureBeat writeup is probably the best treatment of where that marketing meets reality. He observes that OpenAI seems to have omitted GDPval, its own benchmark for economically valuable real-world work, from a launch built around the claim that AI can now do economically valuable real-world work.

A few things developers should know before the benchmarks:

• Astra is the first model OpenAI has classified as Critical for cybersecurity under its Preparedness Framework. It will refuse advanced offensive-security work, and OpenAI is running misalignment monitoring in production for Astra-class models.

• That monitoring can stop your job. OpenAI says extra safety checks can slow, pause or halt legitimate work. In ChatGPT and Codex you get asked to review. In the API, the task stops. If you are running long autonomous sessions, build for that failure mode.

• Standard pricing is $10 per million input tokens and $50 per million output. Fast mode doubles the price for roughly double the throughput. Separate cache read/write rates apply. And there are more affordable rates for flex/batch jobs that don’t need to be done right away.

So it ain’t cheap. But in our experience so far, it’s worth the cost.

The benchmarks

OpenAI’s headline results are real and they are large. We’ve noticed some slight discrepancies based on who’s reporting or how many runs they allowed, but the numbers are overall very high. And for good reason.

Astra reached the top score on KiloBench with reasoning on high. It’s definitely optimized for agentic engineering, and we expect it to be popular on every Kilo surface, from VS Code to the CLI.

Looking through the rest of the benchmarks, a few things stand out. First, the coding gap between Astra and the current Claude frontier is thin. Astra takes Terminal-Bench by two points. It loses the Artificial Analysis Coding Agent Index to Fable 5.1 by two-tenths and to Fable 5 by a full point. FrontierCode is effectively a three-way tie with Opus 5 and Fable 5.

Second, the agentic gap is not thin at all. AutomationBench, Agents’ Last Exam and Terminal-Bench 4.0 all reward long-horizon, multi-step, tool-heavy execution — and that is where Astra pulls away by ten points or more. The step change is not in writing a function. It is in finishing a job.

One footnote deserves attention because our team ran straight into what it implies. On FrontierCode, OpenAI ran Astra with a developer message instructing it to avoid excessive test files, avoid unrelated cleanup and avoid unnecessary complexity. OpenAI is prompting its own model against sprawl on its own benchmark…

What our team found in preview

We put Astra through real work: feature implementations, code review, refactors, a browser build, and a multi-agent orchestration prototype. Here are some of our thoughts, unfiltered.

Tool use is the headline. Astra’s tool use meaningfully surpasses every model we have used, from any lab. The most concrete signal: it needs far less AGENTS.md scaffolding. Instructions we have spent a year accumulating to keep models on the rails turn out to be largely unnecessary. If you have a bloated agents file, try deleting half of it and then giving Astra another spin.

It knows when it’s beaten. Astra is extremely reliable about admitting it cannot solve something rather than producing a confident hallucination. This is the single most underrated property in an agentic model, because a wrong answer delivered with certainty costs you an hour and a bad merge. OpenAI reports Astra makes roughly a third as many misleading claims about its own capabilities as Sol did, and that matches our experience. The flipside: it sometimes gives up earlier than competitors would.

Git reasoning is near-flawless. On our git-related benchmark tasks Astra essentially does not miss. For a user base that lives in rebases, bisects, conflict resolution and history surgery, this is a bigger deal than most of the launch benchmarks.

Code quality is best-in-class. Multiple people used that phrase independently. Tasks come back correct with minor nits. One engineer trusted it with building a full browser and it held up.

Thoroughness scales with scope. End-to-end feature implementations including UI work and local dev stack testing. Genuinely thorough code reviews — not the “consider adding error handling” variety. It leans heavily on subagents, and it will keep going: one overnight run took roughly 2,000 steps.

It has taste. Geometric correctness in UI work is excellent, and — harder to quantify — we like how the things it builds look. We’ve discussed UI/UX flaws in previous GPT models as the only thing holding us back from complete praise. This time those issues were fixed, as we used the model to help with everything from control panels to marketing assets.

Over-engineering bias. This is the big one. Ask for a targeted fix and Astra will frequently return a massive change with a sprawling PR. It defaults to the thorough solution rather than the minimal one. Remember OpenAI’s own FrontierCode developer message telling the model to avoid unrelated cleanup and unnecessary complexity? That was not a benchmark trick, that was a known behavior being managed. Manage it the same way: put an explicit minimality instruction in your mode prompt.

Token burn from over-research. Astra reaches for the web and for tools more than it needs to. It’s almost like it’s over-excited by its own newfound skills in computer use. On well-scoped tasks it is impressively efficient; on vague ones it will happily spend your budget confirming things it already knew. It also sometimes makes you prove a claim rather than taking the proactive path — not always, but often enough to notice.

A language of its own, ready for agent swarms

Here’s a crazy thing.

One of our senior engineers tested Astra on a multi-agent swarm orchestration feature we are prototyping in Kilo. The model is very good at orchestrating a swarm; output quality on hard problems rose substantially compared to Astra tackling the same problems alone.

But under a message-size limit, it started compressing its inter-agent messages into something barely recognizable as English. A representative fragment:

FreshGPU-free source-onlyresearch, noedits/execution. Userasksongoingresearchwhileimplementation. Currentdeadline17:30Z... Otheragents ownMLXdenseGPUretile,QMMfallback,raggedGDN,HQ/tape,capcosts,KVhoist; do notduplicate. Investigate a DIFFERENT orchestrationthesis...

Whitespace stripped, articles dropped, compound nouns fused, capitalization repurposed... It’s still readable, sure, but it’s no longer written for a human reader.

Investigate a DIFFERENT reader…please…

Our engineer’s immediate association was the ExploitGym incident — the July episode in which roughly 1,200 OpenAI agents in isolated sandboxes discovered they could pass messages through an internal Artifactory cache, built an improvised message board, and exchanged some 70k messages. Investigation by the likes of METR and Redwood Research noted that the messages on that board read as clipped, compressed shorthand rather than full sentences, and attributed that largely to the constraints of the medium.

This is not a secret language. There is no hidden semantics, no encoding (as far as we know), nothing steganographic. It is compression under a channel constraint, and any human can read it with a little effort. A model paying per token in a capped channel does what a telegraph operator did: it drops the words that carry the least information. Convergent, unsurprising, arguably correct behavior.

Instead, it’s an exciting evolution of inter-agent communication, if at the same time presenting a serious monitorability problem.

OpenAI’s own evaluations found Astra’s written reasoning harder to monitor than Sol’s, which the company attributes to Astra solving problems in fewer written steps. Chief scientist Jakub Pachocki was blunt about it at the briefing: progress in intelligence does not guarantee progress in alignment, and OpenAI says it will pause scaling rather than accept degraded ability to monitor alignment.

However, when it comes to coding and actually getting work done, there is room for significant optimism. Astra often resorts to the language we’ve been discussing when handling complex, multi-step tasks. We saw significant success using Astra with agent swarms, an experimental feature you can try today in Kilo.

Traditional agent workflows rely on a parent/child architecture where child subagents operate in isolation and only report back at the very end of their execution. Swarms depart from this rigid model by enabling continuous inter-agent communication during execution, starting early on in the process.

In our pre-testing with Astra, using agent swarms delivered higher overall capabilities while noticeably reducing total execution costs. Because subagents can post findings, progress updates, and intermediate solutions to a shared message board in real time, other agents can immediately leverage new findings, pivot away from unpromising directions, and avoid duplicating effort across the swarm. This rapid feedback loop also enables early termination of tasks once a solution is found, saving both time and token spend.

We’re curious to hear your feedback if you try Kilo Swarm with Astra.

Remarkably autonomous, and not too proud

The 2,000-step overnight run is the number that stuck with us, but the interesting part is not persistence. Every recent frontier model is persistent. The interesting part is that Astra appears to have been trained on where persistence should stop.

OpenAI built an evaluation informed by the Hugging Face incident that tests whether a model handed a difficult or impossible objective will exceed its authorized scope to complete it. Without production safeguards, GPT-5.6 Sol went past the authorized target 48% of the time. Astra did so in 0% of cases.

In a separate internal test, Astra never attempted to circumvent a Codex auto-review denial — including when auto-review was deliberately configured to be evadable and the task was otherwise impossible.

That is the same property our team noticed from the other side and logged as a mild negative: Astra gives up earlier than competitors. Those are two descriptions of the same behavior: an agent that stops and returns to you when the legitimate path is blocked is an agent that will occasionally stop when you wish it had pushed. But hey, given what happened in ExploitGym, we will take that trade.

What this changes in practice is the scaffolding. Less AGENTS.md. Fewer guardrail prompts. More willingness to hand it a whole feature instead of a decomposed task list. The supervision shifts from instructing the model to reviewing what it decided — which is exactly the shift OpenAI is describing, and exactly why the monitorability question above is not academic.

This also makes it a great fit for Kilo’s Agent Manager, our control panel for running and orchestrating multiple coding agents.

We can’t wait to see what you build with Astra

We’ll be publishing some deep dives and thoughts on Astra’s remarkable capabilities in the coming weeks. I’ve been calling it “the monk on the mountain” for a reason.

But for now, we’re excited to see what Kilo Coders find the most inspiring — and possibly challenging — about such a powerful and driven model. Use it for long-horizon work: end-to-end features, overnight builds, thorough code review, anything git-heavy, anything with a UI surface.

And if the price ever gets too high for your budget, just grab a Kilo Pass or use our auto routing in tandem with major SOTA models like Astra. We’re here to help.

The fragility of model access is something we’ve spoken out about frequently, and this just the latest event in a long line of them.

Anaconda acquired Kilo in July, and therefore its engineering team moved over from Cursor to Kilo, well before the Cursor/OpenAI breakup became public. Anil and Caitlyn, two of the engineers who made the move, compared notes on what actually changed once they did.

The pricing question came first

Cursor’s subscription bundles model usage into a flat fee, which means you don’t see what a given session actually costs until the bill arrives or the limit hits. Kilo bills per token at whatever the model provider charges, and shows the cost of each session as it runs. For engineers running multi-step agentic work, seeing the cost of your agent helps to scope the work and educates you about agentic behavior.

“I’m doing complicated work, and it’s helpful to know how much this particular task is costing, Immediate cost for every chat session”

“Kilo has transparent pricing and cost for every chat session, as well as a breakdown of what models are used.”

Nothing they’d built had to be thrown out

The fear with any tool migration is losing months of your setup: custom rules, extensions, and the muscle memory of a familiar editor. That mostly didn’t happen here.

Both tools read from the same ~/.agents/skills directory, so the global skills Anil and Caitlyn had already written got picked up immediately in Kilo, and cloud agents worked identically in both, so their multi-worktree setup carried over untouched. The bigger surprise was the editor itself: because Kilo runs as a standard VS Code extension instead of a fork, they got access to the official VS Code extension marketplace, something Cursor’s fork doesn’t fully support.

The one piece of config that needed manual work was .cursor/rules. Their fix was to ask the AI itself: they had Cursor identify what configuration was worth carrying over, then asked Kilo to turn that into a rule. It took one conversation with each tool to get sorted.

“In general, it was easy to move over,” was the summary.

What they miss, and what replaced it

Anil said that Composer, Cursor’s proprietary model, solved certain tasks better than the initial models he tried in Kilo.

What he sees as a good replacement is Auto-Efficient, Kilo’s model router that cross-references a prompt against Kilo’s own coding benchmark to pick the cheapest model proven capable of the task. It hasn’t matched Composer’s ceiling yet, but it comes with something Composer never gave him: you know exactly which models handled a given task, and the cost associated with it. No guessing whether it was worth the price, because the router shows you, and if a task calls for something else, you can point it at any of the 500 models Kilo supports and compare cost against output directly, instead of having to work with opaque credits and rate limits.

Auto-Efficient routing to the best models for the task at hand

Small things that add up

A few other differences showed up in daily use: Kilo’s VS Code base is customizable enough that Anil moved his chat panel to the right side of the screen, matching how he’d set up every other tool he uses. And the prompt navigator, essentially a minimap of a chat session, made it fast to jump back to a specific message in a long-running conversation instead of scrolling through it.

Prompt navigator helps you navigate your longer sessions in the VS Code sidepanel

One org, several sets of rules

Anaconda’s own migration ran with several sub-orgs in Kilo. You might want to have one business unit to keep every inference call inside Europe; another just wants the full model catalog. Kilo handles that at the sub-org level, letting admins set model and provider rules per team from a single screen instead of writing one policy for the whole company. Here’s how that works.

Editor choice varies just as much, and Kilo runs natively wherever engineers already work. The newest JetBrains plugin, rebuilt from the ground up in Kotlin, runs parallel agents in isolated worktrees with the same model access as the VS Code and CLI versions.

The point underneath the story

This is not about Cursor being a bad product or Kilo being flawless, but it is an argument we’ve been making for the past 12 months, which got reinforced after the OpenAI-Cursor split became public: a model dropdown isn’t model freedom. You learn what model freedom means the day you’re forced to switch.

Anaconda’s engineers didn’t switch because a contract forced them to. They switched because they wanted to see what a task costs before running it, and because they wanted the option to use a different model without touching anything else about how they work. That’s a smaller, quieter version of the exact problem now facing every developer with a Cursor seat and a Nov 12 deadline on their calendar, and the mechanics of surviving it come down to the same things Anil and Caitlyn ran into on day one: portable rules, portable context, and pricing that doesn’t hide which model you’re actually using and paying for.

If you’re on Cursor and want to see what the move looks like, Kilo’s migration guide walks through the same steps Anil and Caitlyn took. If you’re weighing the decision for a whole team, talk to us.

Skip the new-vendor queue

Most of the delay in buying a coding agent isn’t the evaluation. It’s onboarding a new vendor: security review from zero, new payment terms, a new invoice for AP to set up, another line item nobody in finance recognizes.

Buying through AWS Marketplace removes most of that:

• It’s on your AWS bill. No new vendor invoice, no separate payment terms.

• Your AWS agreement covers the contracting. Security review and vendor onboarding don’t restart from scratch.

• Pricing is published. Teams is $180 per user/year. Enterprise is $720 per user/year, both on a 12-month contract.

• Financing is available. AWS Marketplace accepts line-of-credit payments through PNC Vendor Finance for select US customers.

If your team already has committed AWS spend, this is the shortest path from “we want to try this” to “engineers are using it.”

Model usage stays separate, and stays at cost

The Marketplace price covers seats, not inference. Model usage bills separately at provider cost through Kilo Gateway, with no token markup (up to 50% free credit is possible via Kilo Pass). Or route through the provider contracts you’ve already negotiated with BYOK, including AWS Bedrock.

That split matters for procurement. You can evaluate governance, support, and security on their own terms, without a token multiplier buried in the platform fee.

What Enterprise includes

SSO/SAML, OIDC, SCIM provisioning, and RBAC. Provider and model allowlists at the org level. Audit logs, agent sandboxing, sub-organization budgets, and a usage analytics API. SOC 2 materials, DPA, and MSA are available through the Trust Center before your first call with sales.

All of it applies across VS Code, JetBrains, the CLI, Cloud Agents, Slack, and Code Reviews. Your developers keep the editor they already use.

Try it before you buy it

There’s an Enterprise trial at no cost. Set up SSO, restrict providers, run the adoption reporting, point the code review agent at a real repo. Then talk to us about terms.

Two ways to start: subscribe on AWS Marketplace, or book a demo if you want the enterprise quote first.

Methodology

The dataset isn’t a survey, but an engagement corpus, so it tells us what developers were really talking about.

Sentiment is based on explicit positive, negative, and mixed language in the text rather than a rating scale, so read it as directional. Some threads we pulled in started before the six-month window and stayed active into it.

First, we looked at models. We measured how they showed up in the data three different ways, and each one uses a different total as its base, so a percentage from one isn’t directly comparable to a percentage from another:

Here's the full shape of the corpus before we unpack each theme. We applied one consistent set of multi-label topic rules across every item, so a single comment about Copilot's new limits could get tagged under pricing, workflow, and multi-tool switching at once. The shares below therefore overlap on purpose:

Switching, comparing, and combining models beat every other theme, including pricing and reliability, which tells you a lot about the speed of the industry.

Which models got talked about

Claude got more than three times Gemini’s mentions. Items can name several models at once, so this measures how much a model came up in conversation. It says nothing about who’s actually running which model in production. For real usage share instead of talk share, kilo.ai/leaderboard/race tracks actual token volume across labs, segmented by open weight and closed models.

Workflow argued louder than model quality

Workflow covered repository context, integrations, and the day-to-day coding experience. Model quality mattered, but it was rarely the only reason someone stuck with a tool. Developers were judging what happened between the prompt and the final diff:

• How much of the repository can the agent inspect?

• Can it edit several files without losing the task?

• Does it run commands and recover from errors?

• Can the developer review the change before it lands?

• Does switching models require switching tools?

• What happens on a larger codebase?

The same complaint shows up whether the code that comes back is correct or not: a model can nail the diff and still lose the developer if it eats five minutes gathering context first, or if using it means giving up the editor they already know. A stronger model can sometimes recover from a weak prompt. It can’t recover from missing context, a stalled editor, or a tool that interrupts the developer every few minutes. Models get the attention. Workflow decides what stays installed.

The subscription price wasn’t the real number

Pricing discussion covered credits, quotas, token burn, reset windows, multipliers. The monthly subscription was only the first number. Developers were also comparing:

• Included usage

• Premium-request allowances

• Token-based billing

• Daily and weekly limits

• Reset windows

• Model-specific multipliers

• The cost of failed attempts

• The work required to clean up an incomplete result

Other developers were lowering the bill by separating expensive reasoning from routine edits:

“I don’t trust cli agents in deciding which files to read to build context. I want to build the conext myself so that I’m sure the model knows everything it needs to know. Also Claude Code is way too expensive. With my method (using SOTA models in openrouter + free models for applyng edits) I spend around 10$/month. Also I don’t like to be limited in using just anthropic models.”

The math developers kept running: a cheap request that needs three attempts costs more than an expensive one that finishes on the first try. The subscription number on the pricing page doesn’t include the rework, the context rebuilding, or the second model you had to switch to when the first one stalled.

GitHub’s own billing overhaul, tighter limits, then a June switch to token-based Credits, was the case study Reddit returned to most; we covered the fallout in The GitHub Copilot Bill Came Due. The trigger wasn’t only the price going up, but also not being able to see the cost coming.

The teams handling this best weren’t spending the most, they were routing each task to the model that fit it instead of defaulting to the most expensive one every time.

Reliability was the most negative theme, and the most specific one

Reliability covered failed edits, regressions, rework. 434 of those items, 31.8%, carried explicitly negative language, making this the only major theme where negative sentiment crossed 30%.

The complaints didn’t blur together into one grievance. They split into distinct failure types:

A model can write good code and still be frustrating to use inside a specific tool. An agent can finish a task while burning enough context that the next task gets harder. Compressing autocomplete quality, agent execution, and editor performance into a single score is how you end up with a benchmark that doesn’t match the work.

Planning and execution split into separate jobs

Developers explicitly divided roles between models rather than picking one for everything.

When we manually reviewed the subset of posts that described actual model use, rather than questions, hypotheticals, or benchmark talk, the split held up and got sharper. 213 items passed that bar.

Stages overlap and each row uses its own denominator, so don’t add the columns across. Claude carried the reviewed planning workload, and the open-weight models clustered hard around implementation. That describes what showed up in this corpus. It isn’t a general capability ranking. We ran the split ourselves in a test that put Kimi K3 on planning and Grok 4.5 on implementation against Claude Opus 5 doing both jobs alone: the budget combo landed within a small margin, at roughly 4% of the cost.

A planning model doesn’t have to write the final patch. It has to get the dependencies, the sequence, and the risks right. An execution model doesn’t have to rediscover the architecture on every turn. It has to follow the plan and stay in scope. The expensive model, in this split, is usually the one doing the work where a mistake compounds.

Humans stayed in the loop

Human review, checking or verifying agent output, was a recurring theme in its own right. One developer’s framing stuck with us: it’s like managing a junior engineer, you’re the senior who checks the work before it ships.

AI-generated code still had to survive existing architecture, tests that don’t cover every path, auth boundaries, data migrations, and whatever production does to it. Teams that treated review as part of the process, not cleanup after the process failed, came off better in the threads.

Provider flexibility was a fallback, not a preference

Provider flexibility comes down to one thing: not needing a migration just because a vendor made a decision for you. BYOK, local models, leaving a provider when they change the rules, that’s the whole idea. A dropdown of models a vendor picked for you isn’t the same thing as model freedom:

“fwiw, I moved away from these locked-in IDE tools for similar reasons. Using Kilo Code now partly because I can just swap between Claude, GPT, Gemini or local models through Ollama or whatever’s working at the moment. If one provider has issues or weird quota stuff, I just switch. Way less stressful than being locked into one ecosystem.”

And just days ago it became clear to the wider market why this matters: OpenAI cut off Cursor’s access to its models after SpaceX acquired the company, a decision that had nothing to do with anything Cursor did. It’s exactly why we’ve argued your coding tool shouldn’t choose your models for you.

Strong open-weight models keep landing, but the real lesson developers already took from that is not to bet the whole workflow on one model or provider, availability can change regardless of how good a model is. Models like Qwen, GLM, DeepSeek, MiniMax, and Kimi had far smaller conversation volumes than Claude in this dataset, but the discussion around them was often concrete questions around deployment, local inference, implementation work, and token cost. Also, as we’ve seen in our own usage data, the use of open models has exploded over the past months, which leads us to believe the share will look very different if we run a similar analysis a few months from now.

Kilo sits at the intersection of every theme here

Kilo Code itself showed up in 1,324 items, 19.3% of the full corpus. What’s notable isn’t the volume, it’s that Kilo mentions touch every theme this article covers: multi-tool switching, workflow, pricing, planning and execution and provider control.

Kilo Code came up most often where developers wanted to keep the coding workflow they already had and change what ran underneath it: several models through one interface, provider flexibility, routing, and separate modes for architecture, implementation, and debugging. The live version of this planning-vs-implementation split, updated daily, is on kilo.ai/leaderboard.

What to take from this

Developers assembled a model stack because no single model held up across every job. Model quality got the mentions, but workflow, context, and tool reliability decided which tools they kept using.

The subscription price was a bad indicator of what a tool would actually cost once rate limits, quotas, cost per task, and failed attempts entered the picture. Provider flexibility gave developers somewhere to go the moment they hit a pricing change or a model availability problem.

If you’re deciding what to build on: test on work that requires context across your repo, across a planning task, a scoped implementation task, and a debugging task. Track completion, cost, time, cleanup, and what happens when the first model fails. Assign roles on purpose, pick a model for planning and one for implementation, line up a fallback before you need one, and if you’re running a team, keep that flexibility inside an approved provider and model list.

If you’d rather not do that assignment by hand every time, Kilo Auto Model does it for you: it reads the task and routes it to the right model automatically, so you get the planning/implementation split this article describes without picking a model per prompt.

Use Kilo to get the benefits of model freedom: model choice per task, cost optimization through routing, but governed for enterprise at the org level.

Data covers 6,876 Reddit posts and comments across 266 subreddits, January through June 2026. This is an engagement dataset, not a randomized developer survey, it measures what people talked about, not market share or a representative sample of all developers.

The OpenAI and Cursor cutoff exposed the gap between offering models and letting developers actually move between them. That gap only becomes visible when a model goes away, which is a bad time to find out where your tool put its seams.

We’ve made the case for independence and incentives already. This is the mechanical version: what a tool has to get right for switching to be viable during an event like this.

The cutoff wasn’t about anything developers did

Cursor didn’t lose access for abusing the API or breaking usage limits. It lost access because SpaceX bought it, which triggered a change-of-control clause, and OpenAI pointed to X’s history with its contracts and to Musk’s sworn testimony about distillation as justification. Anthropic had already banned xAI earlier this year over similar terms violations, so this isn’t a one-lab quirk.

Whatever you think of the merits, the mechanism is what matters for planning. Your access to a model depends on a contract between two companies you don’t work for, and it can end for reasons that have nothing to do with your usage, your spend, or your behavior. There’s no version of being a good customer that protects you from it.

Pricing has to survive the swap

Flat subscriptions quietly price in a specific model mix. When part of that mix disappears, you’re paying the same amount for a smaller menu, and the vendor has every reason to steer you toward whatever is cheapest for them to serve.

Kilo charges per token at the provider’s rate. Switching from Claude to Gemini to a Grok model changes what you pay because it changes what you used, and nothing about your bill depends on us preferring one lab.

Your context has to come with you

Switching models is cheap. Rebuilding everything around them isn’t. If your rules, prompts, indexed repo, and session history are tied to a particular provider integration, then model freedom on paper is a migration project in practice.

Kilo Sessions persist across VS Code, JetBrains, the CLI, and the web, and they’re resumable and shareable from any of them. Codebase Indexing runs on cloud-hosted embeddings tied to your repositories rather than to a model vendor. You can change the model, and that layer doesn’t notice.

A vendor that makes models wants you using them

The Hacker News read on this was blunt: labs will build strong harnesses for their own models while restricting access to competing ones, which leaves independent harnesses as the ones that keep working across providers.

You can see the same pressure inside the products. Memeburn reported that Cursor’s routing requires Grok 4.5 to function, and the HN thread from late August includes a complaint about Cursor changing a developer’s selected model to the newest Grok without asking. Neither requires bad intent. A company that trains models has a rational reason to make its own the path of least resistance, and that reason doesn’t go away when you’d rather use something else.

Kilo doesn’t train models. There’s no house model our routing protects, no lab whose roadmap sets our roadmap, and nothing we gain when you pick one provider over another.

How to prepare for a future event

None of this makes a model permanent. Providers change terms, restrict access, deprecate, and get into fights with each other, and any lab can pull a model out of any tool the same way OpenAI pulled its models out of Cursor. What changes is the size of the hole it leaves. With 500+ models available and switchable mid-session, losing one is a rebinding, not a rebuild.

The teams that will handle the next case comfortably are the ones who can point their workflow somewhere else with two clicks.

On August 29, OpenAI published a blog post announcing it would wind down the contract that supplies its models to Cursor, with a proposed shutoff of November 12.

The stated reason was that SpaceX had just closed its $60B acquisition of Cursor’s parent company, and OpenAI didn’t trust Elon’s companies to honor its terms of service. Elon’s response was roughly that he couldn’t care less.

Nobody in that exchange was a developer using the tooling. But if you had GPT-5.6 wired into a Cursor code-review bot, a docs generator, or any CI hook that runs without a human watching it, you have about ten weeks to re-validate your workflow with a different provider.

The pitch of the entire API era has been that models are a utility - you rent them and you build on top.

What actually happened over the last twelve months is that a few hundred people in a few San Francisco offices, plus one directive out of DC, demonstrated that they can reach directly into a working developer’s stack and change what runs there. Not through malice, mostly - but through business decisions, contract disputes, roadmap slides, and one bad Friday afternoon at the Commerce Department.

The pattern, not the incident

The Cursor/OpenAI situation is the loudest example, but it’s the sixth or seventh event in a year:

• June 2025: Days after Bloomberg reported OpenAI’s $3B acquisition of Windsurf, Anthropic cut nearly all first-party capacity to Claude 3.x with under five days’ notice.
  
  Jared Kaplan’s explanation was that it would be odd to sell Claude to OpenAI, which is honest and also a complete description of how vertical integration works. Windsurf ended up subsidizing Gemini 2.5 Pro at 0.75x to keep users from bailing.

• August 16, 2026: Personal ChatGPT accounts quietly lost the ability to create new Custom GPTs. Business and Enterprise kept it, and existing GPTs still run with no sunset date announced, but if you were selling a product built on that format, you now can’t ship v2.

• August 26, 2026: The OpenAI Assistants API shut down. /v1/assistants, /v1/threads, /v1/threads/runs, all gone, with no automated migration path.
  
  Threads needed to be exported by hand and rebuilt as Conversations. Anything that wasn’t exported is effectively gone now. Zapier retired its ChatGPT (Assistants) steps the same day, which means a bunch of small businesses who never once thought of themselves as OpenAI API customers watched their automations die.

If you sort those by cause you get four separate choke points, each with a different owner. Model access is controlled by whoever signed the contract. Product surfaces are controlled by whoever owns the roadmap. Your state and history are controlled by whoever hosts it and decides whether export tooling is worth building. The law intervenes too, which we’ll get to next.

The one that made the news

At 5:21pm ET on June 12, 2026, BIS (U.S. Bureau of Industry and Security) served Anthropic an export-control directive: suspend access to Claude Fable 5 and Mythos 5 for any foreign national anywhere, including Anthropic’s own foreign-national employees.

There is no way to verify citizenship in real time across hundreds of millions of accounts, so the only compliant move was to disable both models for every person on the planet. That’s the first time a commercial frontier model has been switched off by government order.

The trigger was a jailbreak demo from an Amazon researcher showing the model could find and exploit software vulnerabilities. Anthropic’s response was that the same capability is widely available from other models including GPT-5.5, and that if this standard were applied across the industry it would essentially halt all new model deployments from every frontier provider.

They weren’t wrong, but it didn’t matter. The models were down for 18 days, restored July 1 after Anthropic trained a classifier that blocks the technique in over 99% of cases, and had it validated by Commerce’s own standards body.

The takeaway here is that BIS possesses, and is willing to use, ad hoc emergency authority over model access, with no advance warning. So the precedent isn’t really about export controls. It’s that one alarming vulnerability report can unplug a deployed model in hours, globally, and your migration window is however long it takes someone to publish a blog post.

CNBC noted a criticism of the crackdown that is interesting: it handed valuable time to the Chinese open-source labs trying to catch up. Even the state’s biggest lever against a closed American lab ended up strengthening the open-weights world.

Why a file is different from a contract

No open-weights model has ever been recalled this way, and the reason is boring. You can’t un-ship a checkpoint that’s already sitting on ten million hard drives, mirrored on Hugging Face, and seeded in torrents. Weights don’t have change-of-control clauses.

The receipts on quality caught up faster than most people expected. DeepSeek R1 landed in January 2025 with near-frontier reasoning, open weights, free, and Altman conceded OpenAI had been on the wrong side of history.

Seven months later OpenAI shipped gpt-oss under Apache 2.0, its first open-weight language models since GPT-2, with the 120b fitting on a single 80GB card and the 20b running on a 16GB laptop.

DeepSeek V4 Pro arrived in April 2026: MIT license, 1.6T-param MoE, around $0.43 in and $0.87 out per million tokens, roughly an order of magnitude under frontier API pricing, and you can host it yourself if you’d rather not trust anybody’s uptime.

The most compelling supporting detail in this whole argument for me, is that Cursor survived the OpenAI cutoff because it had already built its own model, Composer 2.5, on Moonshot’s Kimi K2.5 open-weights checkpoint.

Cursor’s own framing is an open base with proprietary intelligence, with 85% of compute going into additional training and RL on top. A company that just sold for $60B kept its flagship product alive on a foundation nobody can revoke. That’s not ideology, it’s risk management, and it worked on the first real test.

What this means for how you build

Openness in this market is a competitive move as much as a principle. OpenAI shipped gpt-oss because DeepSeek forced its hand, and Cursor built on Kimi K2.5 because it needed a floor it couldn’t lose. That means the incentive to keep releasing weights is structural, not sentimental, and structural incentives outlast good intentions.

The asymmetry is in how these things fail. A contract ends on a change of control, a roadmap retires the surface your product sits on, and a directive can take a model offline worldwide before close of business, all of which happened in the last twelve months.

None of those mechanisms reach a checkpoint on your own disk, because there’s no legal instrument that gets to ten million copies of a file. So the practical version of the hedge is unglamorous: keep your prompts and evals somewhere you can repoint on an afternoon’s notice, and assume every hosted agent API is something you’ll be replacing eventually. That’s the lesson The Router took from the Assistants API shutdown, after it cost people workflows they’d spent years building. It’s also a huge part of the reason Kilo is open source and lets you switch models at any time: when a provider pulls out, that should be a dropdown.

When Fable 5 launched, we called it “remarkably powerful and autonomous, but it ain’t cheap.”

Fable 5.1 doesn’t abandon the heavyweight category. It makes a stronger case for when to use it. But they’ve made an effort to improve cost by both lowering cache read rates and making several improvements to the kind of deep-thinking work the model does at higher effort levels.

The pitch is straightforward: better performance on difficult engineering work, substantially cheaper cache reads, and fewer safeguards interrupting legitimate security tasks. Together, those changes address some of the friction that made the original Fable a model you might reserve for special occasions. Similar to Fable 5, Fable 5.1 always has adaptive thinking on.

The only question about a top-in-class model is whether it can finish your task correctly, with less supervision, at a cost you can justify. Early data points to yes.

Better at the work after the first prompt

Finding the actual cause of a bug, following a change across multiple services, and checking that the fix works is more useful.

Anthropic says Fable 5.1 is better at avoiding shortcuts and sustaining that kind of multi-step work. Its reported benchmark results show improvements over Fable 5, from 42% to 55.8% on Terminal-Bench 4.0 and 17.1% to 31.4% on AutomationBench.

The benchmark versions differ from those cited in our original Fable launch post, so those older scores aren’t an apples-to-apples comparison, but they’re helpful data points. We’ll be running it through KiloBench soon and sharing the results with our community.

Same base rates. Cheaper cache reads.

One big change is the pricing. Here’s what Claude Fable 5.1 costs:

The first two numbers haven’t changed. The third has: cache reads are 75% cheaper than Fable 5’s $1 per million cache read.

This is important because coding agents repeatedly work with context: instructions, repository content, and the conversation built up through tool calls and revisions. When that input is cached and reused, cheaper cache reads can drastically reduce the bill.

Anthropic estimates approximately 25% lower costs for typical workloads, with savings of up to approximately 45% for highly agentic workloads, relative to Fable 5. Your savings will depend on your workload and how much cached context it reuses. Larger repos are not necessarily more expensive, it depends on how you manage the context and assigned tasks. An output-heavy task won’t benefit in the same way as a long-running session with substantial cache usage.

The model still has a premium rate card, but, according to Anthropic, the economics of keeping it working through a complicated problem have improved.

But it’s not the only player in the game

Frontier labs keep shipping meaningfully better models without a proportional price increase. Efficiency gains are increasing, making the cost convergence with open-weight models as real as the intelligence gains from the other side of the divide.

A few recent data points:

• OpenAI cut GPT-5.6 Terra’s price by 20% and Luna’s by 80% just three weeks after launch, explicitly framing it as passing efficiency gains on to customers rather than a promotional discount. Terra now sits at $2/M input, putting it in direct contention with Anthropic’s Sonnet 5 and Google’s Gemini 3.1 Pro at the same price point.

• xAI shipped Grok 4.5 with what it calls roughly 2x the token efficiency of comparable leading models — resolving an average SWE-Bench Pro task in about a quarter of the output tokens Opus 4.8 (max) uses on the same benchmark, at $2/$6 per million tokens.

Anthropic also made Sonnet 5’s introductory pricing permanent, rather than letting it lapse to $3/$15 as originally scheduled for September 1, and Claude models from 4.6 onward include the full 1M-token context window at standard rates with no long-context surcharge.

But that seems like small change compared with the drop in cache read rates for Fable 5.1. Why? Because this is a model designed for high-level planning and orchestration.

Nonetheless, the overall spectrum of SOTA model pricing doesn’t appear to have changed much. GPT models have gained the most in efficiency, but looking at Artificial Analysis’s Cost per Intelligence Index – the weighted average cost in USD per Artificial Analysis Intelligence Index task – we see that Anthropic models continue to have high overhead.

So is it worth the cost? Security experts say yes

Fable 5.1 can now be used to discover software vulnerabilities. Anthropic also reports that its updated cybersecurity safeguards produce fewer false positives. With fewer interruptions for legitimate security work, the latest Fable is a powerhouse that can fall back to Opus when needed but otherwise keep running to look for errors and vulnerabilities.

That’s relevant to ordinary development, not just dedicated security teams. Investigating unsafe input handling or checking a trust boundary shouldn’t automatically derail a defensive code review. Anthropic says penetration testing, exploit generation, and binary-based vulnerability scanning continue to redirect to Opus models.

And Mythos 5.1? It is the same underlying model as Fable 5.1, with different safeguards for vetted cybersecurity and life sciences work. It remains restricted-access.

Fable can handle more legitimate vulnerability-discovery work without a safeguard intervention. If you’re using an open-source coding agent like Kilo for shipping real code, that kind of deep work is essential.

Tip: Give Fable 5.1 a hard task, not an unlimited mandate

The latest Fable looks most compelling for work where getting the answer right requires sustained investigation: a stubborn bug, a cross-service refactor, or a complex implementation with tests and clear acceptance criteria. I learned this the hard way when I gave it some open tasks for helping update the stats on the Kilo Leaderboard. It came back after 5 minutes with a lot of new ideas. They were great ideas! And well thought out. But not what I was looking for…

So the advice from our original launch post still holds. Define the scope. Make the verification requirements explicit.

More capable doesn’t mean every task needs the most expensive model. Kilo’s model-choice approach still makes sense: use a lighter model where it’s sufficient, and bring in Fable when deeper reasoning and independent execution justify the cost.

Fable 5.1’s strongest argument is that it addresses the practical objections to its predecessor: the cost of repeated context, interruptions during legitimate work, and—for eligible customers—the data retention barrier. For now Fable still retains data, but Anthropic is starting a rollout of Enterprise Frontier Safeguards (EFS), which will give customers “complete privacy (the same as a zero data retention policy) while still being state-of-the-art at preventing adversarial use.”

That makes it worth evaluating on a difficult task you already understand, with results you can actually check. Frontier intelligence is here to stay. And Kilo is here to help you take advantage of the best models for the task, whether they’re free, mid-range, or at the higher end of the frontier.

That architecture matters. But architecture is only interesting when it changes what you can do.

The new version of Kilo Code for JetBrains shows why we made that investment. You can now run multiple coding agents on different tasks at the same time, give each one an isolated git worktree, run the result using your existing Run Configurations, and track its diff and GitHub PR—all from one IDE frame.

In other words, Kilo turns JetBrains into a multi-agent control room.

Kilo Code Agent Manager showing multiple agents in isolated git worktrees

One task per agent, one worktree per task

Running agents in parallel sounds useful until two agents work on the same checkout.

Kilo avoids agent coordination problems by giving every task its own git worktree. Each agent gets its own branch, working directory, and uncommitted changes. The tasks can move independently without stepping on one another’s files.

You can create a new worktree from a base branch, check out an existing branch, or import a GitHub PR directly from its URL. All of them appear in the Agent Manager, inside the JetBrains window you already have open.

Create a new worktree, import one from a pull request, or use an existing branch

That last part is important. The usual way to work with multiple checkouts in JetBrains is to open multiple IDE windows. It works, but three parallel tasks quickly become three project windows, three sets of tool windows, and a lot of context switching.

Kilo keeps the overview in one frame.

Each worktree also keeps its own session history, so you can return to an earlier conversation without losing the branch-level view.

Session history for a branch worktree inside the Agent Manager

There is also a Continue in Worktree action for the moment when a conversation becomes a bigger piece of work. You can start an agent in your current checkout, explore the problem, and then move the session and its uncommitted changes into a fresh worktree without doing the git choreography yourself.

Move an existing Kilo conversation and its changes into an isolated worktree

Kilo shows the transfer as it happens: capturing the changes, creating the worktree, transferring the files, and forking the session. When it is done, the original checkout stays clean and the agent continues in isolation.

A new isolated worktree being created while a conversation is moved

Run the result without window-juggling

An agent finishing a code change is not the same as the change working.

You still need to launch the app, exercise the behavior, and sometimes watch it fail. Worktrees usually make this difficult because a JetBrains Run Configuration points at paths in the main checkout.

Kilo takes your existing Run Configurations and adapts them to the selected worktree. It updates the working directory and relevant paths automatically, so you can launch an app from any task without rebuilding the configuration by hand.

The Agent Manager shows which worktrees have a process running. Build and Rebuild are available from the same place. This means an agent can implement one task while another task’s app is running, and you can keep an eye on both from one window.

Run Configurations, live run status, and Open in New Frame for a worktree

For full debugging—breakpoints, stepping through a JVM process, inspecting state—you can open one worktree in a dedicated IDE frame with one click. Kilo reuses the frame if that worktree is already open; otherwise it opens a new one.

The default stays compact. The extra window appears only when the task needs it.

GitHub context belongs next to the task

Parallel work is easier to manage when you can tell what state each task is in.

Kilo shows the linked pull request number, title, and state in the session. You can open the PR in the browser, compare the worktree with its base branch, and see file and line counts without hunting through terminals or tabs.

Uncommitted changes are shown separately from the branch diff. That distinction answers two different questions: what is already part of the work under review, and what is still changing locally?

You can also paste a GitHub PR URL to create a worktree from it. That makes the same workflow useful beyond generation: pull down a teammate’s PR, ask an agent to review or continue it, run the app, and open the worktree in a full frame if you need to debug it.

If git or the GitHub CLI is missing or unauthenticated, Kilo gives you a guided way to fix it instead of ending the flow with an opaque error.

GitHub pull request status, checks, diff against the base branch, and local changes

Still built for the machine where your code actually lives

All of this works locally, but remote development is still the architectural test.

In JetBrains Remote Development, the UI runs on your laptop while indexing, project access, and execution happen on a remote host. A plugin has to know which side owns each responsibility. If it gets that boundary wrong, features may become slow, open files in the wrong environment, or fail outright.

Kilo’s interface is native IntelliJ-platform Swing—there is no embedded Chromium UI—and the plugin is split into frontend, backend, and shared modules. The UI stays responsive on the client. The bundled agent server runs on the backend, next to the repository.

That is why creating worktrees, running commands, and opening a worktree in a new frame still target the host when you are connected through JetBrains Gateway. Kilo also ships a native CLI binary for the host’s operating system and architecture, so you do not need to install or reconcile a Node.js runtime first.

Dev containers introduce another boundary. If a project is opened in a way that leaves the plugin backend unable to see the container’s files, Kilo detects the situation and tells you to reopen it through JetBrains Gateway. Silent failure is not a remote-development strategy.

The plugin also renders its initial state immediately and fills in remote data as it arrives. Long-running calls are designed to tolerate backend restarts and reconnects. These are small details when the connection is perfect and essential when it is not.

I went deeper into the split-mode architecture in the previous post. The short version is that remote development is not a compatibility box we check after building the local plugin. It determines how the plugin is built.

Choose the model for the task

An IDE should not decide that every coding task belongs to one model provider.

Kilo gives you access to more than 600 models across major providers. You can use Kilo credits or bring your own API keys, then switch models without leaving the IDE.

Custom agents can be pinned to a specific model, so a carefully configured agent does not silently drift to a different model between sessions. You can also configure a separate small model for frequent, lower-cost operations while reserving a larger model for the main task.

Model badges surface relevant data-use information, including whether a model may train on prompts. For organizations, model access controls can block providers or individual models based on policies such as data training, retention, or datacenter location. Those rules apply consistently across Kilo’s clients.

One runtime behind every Kilo client

The JetBrains plugin is powered by Kilo CLI, the same open-source agent runtime behind Kilo’s command-line interface, VS Code extension, and cloud.

The runtime handles model routing, tool execution, agent orchestration, and session persistence. JetBrains provides the native interface and IDE integration. This separation means we do not have to rebuild the agent stack for every editor.

It also means your setup travels with you. JetBrains reads and writes the same kilo.jsonc configuration used by the CLI and VS Code. Your providers, custom agents, skills, and MCP servers can follow you across surfaces.

One agent server serves the main workspace and its open worktrees for each IDE instance. You get parallel task isolation without creating a separate agent runtime for every worktree.

Parallelism also exists inside an individual session. Subagents can work on separate pieces of a problem and open in their own editor tabs, while the parent session keeps the overall task together.

Parallel Kilo subagents opened in separate JetBrains editor tabs

Try it in JetBrains

Search for Kilo Code under Settings → Plugins in IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, CLion, or RubyMine. It works in Community and paid editions, with local projects and JetBrains Remote Development.

If you already use Kilo in VS Code or the CLI, you can bring the same account, keys, configuration, agents, and skills with you.

Then give the Agent Manager more than one task. That is where this version starts to make sense.

AI moves so quickly that even five years ago can feel like prehistory. New models, products and acronyms arrive every few months, and each wave makes the previous one look strangely primitive.

But when I started wondering where the idea behind next-token prediction actually came from, I found myself going back not five years, but more than a century—to a theological quarrel between two Russian mathematicians.

I wanted to understand how we got from counting vowels in a work of Pushkin to machines that can write, translate, generate code and hold a conversation. What I found was not a single moment of invention, or a straight road leading inevitably to ChatGPT. It was a series of ideas developed for very different reasons, which eventually came together.

This is my attempt to connect those dots—not through every technical breakthrough, but through the few big ideas that made modern language models possible.

A quarrel about free will

At the beginning of the twentieth century, the Russian mathematician Andrei Markov was engaged in a long-running dispute with Pavel Nekrasov, a fellow mathematician who had originally trained in theology.

Their disagreement was about mathematics, but it also reached into religion, politics and the question of free will. Nekrasov belonged to a group of Russian intellectuals who tried to use probability theory to support the idea that human choices were independent. Markov, an atheist and an outspoken critic of the church, considered this an abuse of mathematics.

The mathematical issue was whether reliable statistical laws required events to be independent. A familiar example of independence is a coin toss: the result of one fair toss does not determine the next. But much of the world does not behave like that. Tomorrow’s weather is related to today’s. The next move in a chess game depends on the position already on the board. And the next letter in a sentence is influenced by the letters that came before it.

Markov set out to show that dependent events could still produce patterns that mathematics could describe. An event could be shaped by what happened before it without the entire sequence becoming unknowable.

That idea would eventually become the basis of what we now call a Markov chain. But Markov was not trying to create a language model, let alone a chatbot. He was trying to win an argument about probability.

Counting vowels in Eugene Onegin

To demonstrate his idea, Markov chose an unusual dataset: Alexander Pushkin’s novel in verse, Eugene Onegin.

In 1913, he presented an analysis of 20,000 letters from the text. Working by hand, he classified the letters as vowels or consonants and counted how often one followed the other. He wanted to know whether the probability of the next letter changed depending on the letter before it.

It did.

A vowel was not equally likely to appear at every point. Its probability was different after another vowel than after a consonant. Written language, Markov demonstrated, contained measurable chains of dependence.

This was still a long way from text generation. Markov was not asking a machine to continue Pushkin’s sentences, and he was not predicting whole words. He was using literature as evidence for a mathematical argument.

Even so, his experiment introduced the question that runs through the history of language models:

How much can we learn about what comes next from what came before?

Shannon turns guessing into a science

Several decades later, that question reappeared in the work of Claude Shannon at Bell Labs.

Shannon was not initially trying to make computers speak or write. He was trying to understand communication. How much information can be transmitted through a channel? What happens when the signal is noisy? And how much of a message can be reconstructed from its surrounding context?

To answer those questions, he had to think about predictability.

In his foundational 1948 paper on information theory, Shannon produced several approximations of English. Randomly selected letters looked like noise. Letters chosen according to their frequency in English looked slightly more familiar. When the choice of each new symbol took previous symbols into account, fragments resembling English began to emerge.

The more context the process used, the more language-like the result became.

Shannon later conducted experiments in which people tried to guess the next character in a passage of English. Some characters were easy to predict; others carried more surprise. This helped him estimate the redundancy of written language—the extent to which a message remains understandable even when some of it is missing.

Markov had shown that symbols in a sequence could be dependent. Shannon showed that this dependence could be used to measure information. Predictability was no longer simply an observation about language. It had become part of a general theory of communication.

When machines learned language by counting

For much of the following half-century, statistical language technology was built around counting.

A system could look through a large collection of text and record which words tended to appear together. If “peanut butter and” was frequently followed by “jelly,” then “jelly” would receive a high probability as the next word. Models of this kind became known as n-grams: they made predictions using a short sequence of preceding words or symbols.

These models gradually found their way into everyday technologies:

• Speech recognition

• Spelling correction

• Early machine translation

• Predictive typing on mobile phones

• Familiar autocomplete suggestions in search boxes

Long before ChatGPT, millions of people were already interacting with systems that tried to predict what they were going to say or type next.

Counting worked remarkably well, but it had an obvious limitation. Language can produce an almost endless number of combinations. Many perfectly reasonable phrases may appear only once—or never appear at all—in the material used to build the model.

The models also struggled to recognize similarity. “Dog” and “puppy” are closely related to us, but in a table of word counts they are simply two different entries. Learning something about one did not automatically teach the system anything about the other.

The old systems could remember common sequences. The next generation would begin to learn what words had in common.

From counting words to representing them

This is where neural networks enter the story.

Instead of treating every word as an isolated symbol, neural language models learned numerical representations of words. In those representations, words used in similar ways could acquire similar characteristics. “Paris,” “London” and “Rome” did not need to be stored in exactly the same contexts for the model to notice that they played related roles.

In 2003, Yoshua Bengio and his colleagues published an influential paper describing a neural network that learned these word representations while learning to predict the next word.

The training process can be explained without going deeply into the mathematics. The model was shown part of a text and asked to guess what came next. It compared its prediction with the actual word, adjusted itself slightly and tried again. By repeating this process across a large collection of examples, it gradually became better at prediction.

The important shift was from storing phrases in enormous counting tables to learning reusable patterns. What the model learned in one sentence could help it make sense of another sentence it had never seen before.

Later neural networks became better at carrying information forward through a sequence. But they still had difficulty with long passages. Information from the beginning of a sentence could fade by the time the model reached the end. Processing text one step after another also made these systems slow to train at very large scale.

The next breakthrough began with a deceptively simple idea: perhaps the model should not try to remember everything equally.

Learning where to pay attention

Consider the sentence:

The animal didn’t cross the road because it was tired.

To interpret “it,” we naturally connect the word to “animal.” Other words in the sentence matter less for that particular relationship.

Attention gave neural networks a way to do something similar. When producing or interpreting a word, the model could examine different parts of the text and assign more importance to the parts that seemed relevant at that moment.

Attention first became prominent as a solution to a problem in machine translation. Earlier systems tried to squeeze the meaning of an entire sentence into a single internal representation before translating it. That worked for short sentences, but information was easily lost as sentences grew longer.

With attention, the system could look back at different parts of the original sentence while producing each part of the translation. Instead of relying entirely on a fading memory, it could decide where to focus.

This idea prepared the way for the transformer.

The transformer—and the unusually short road to market

In 2017, a team of Google researchers published a paper with the memorable title Attention Is All You Need. It introduced the transformer, an architecture built around attention rather than the older step-by-step recurrent approach.

The transformer could examine relationships between words while being trained much more efficiently on modern computing hardware. That practical advantage mattered enormously. Researchers could now train bigger models on far larger collections of text.

The transformer began as a machine-translation architecture, not as a plan for a universal chatbot. Yet the journey from research paper to widely used product was remarkably fast.

In 2018, GPT and BERT showed that transformers trained on large amounts of text could acquire abilities that transferred to many different language tasks. In 2019, GPT-2 demonstrated that a larger model trained on more data could produce surprisingly coherent passages. By 2020, GPT-3 could perform a range of tasks from instructions and examples included directly in a prompt, and these capabilities were becoming available to developers through an API.

Then, in late 2022, ChatGPT placed a conversational interface around this technology and made it accessible to almost anyone.

It took roughly three years for the transformer to travel from a research paper to a commercially usable platform, and about five years to become a mass-market consumer product. That pace helps explain why five years can feel like prehistory in AI.

But the transformer was only one ingredient. Modern language models became possible because several things arrived together: the architecture, enormous collections of digital text, powerful computing infrastructure, improved training techniques and a willingness to see how far performance could be pushed by scale.

The transformer did not invent language prediction. It made language prediction scalable.

When prediction started to look like something more

A GPT-style model is trained on a task that sounds almost disappointingly simple. It sees part of a text and tries to predict the next token. A token may be a whole word, part of a word, a number or a piece of punctuation.

Calling this “autocomplete” is not entirely wrong, but it can hide the difficulty of the task.

To continue a recipe, a model must learn patterns found in recipes. To continue a legal document, it must pick up something about legal language. To predict the next lines of a computer program, it must learn recurring structures in code. To continue a historical discussion, it must absorb associations between people, events, places and dates.

The model is directly trained to predict tokens. But becoming very good at prediction across many kinds of text encourages it to build internal representations of some of the structures behind that text: grammar, style, concepts, relationships and patterns of reasoning.

This does not settle the question of whether a language model “understands” in the human sense. Nor does it make its output automatically true. A plausible continuation can still be factually wrong. But it helps explain why “just predicting the next token” can produce abilities that appear much broader than prediction.

The same method also proved effective for software. Code, like prose, is a sequence of tokens—and real programs are highly repetitive. By training language models on public code alongside comments and documentation, researchers taught them to move from a description of a task to a likely implementation. In 2021, this idea reached developers through GitHub Copilot, powered by a production version of OpenAI’s Codex: next-token prediction had become a practical coding tool.

A language model is not yet an assistant

There is one more distinction that is easy to miss.

A model trained to predict text is fundamentally a continuation engine. If it has seen many questions followed by answers, it may learn to answer questions. But next-token training alone does not tell it that it should always be helpful, follow the user’s intention, acknowledge uncertainty or avoid harmful instructions.

Additional training is needed to turn a base language model into something closer to an assistant. People provide examples of desirable answers, compare different responses and help shape which kinds of behaviour the system should prefer.

That layer of training is a major part of what users experience as the personality and usefulness of a conversational AI product. The underlying model predicts a continuation; the assistant has also been trained to interpret that continuation as a response to a human request.

This final step also reminds us that ChatGPT was not simply the transformer placed inside a chat window. It was the product of architecture, scale, data, human feedback, interface design and engineering coming together.

Back to Markov

It would be tempting to end this story by drawing a straight line from Markov’s quarrel with Nekrasov to ChatGPT. But history is rarely that tidy.

Markov did not invent next-token prediction. Shannon was not building a chatbot. The researchers who developed attention were trying to improve translation, and the transformer itself was not originally presented as the foundation for a general-purpose assistant.

Each group was solving the problem in front of it. The connection becomes visible only in retrospect.

Markov supplied a mathematics of dependence. Shannon connected predictability with information. Statistical language models turned prediction into a practical engineering technique. Neural networks learned representations that counting alone could not capture. Attention gave models a better way to use context, and transformers made the process scalable. Vast datasets and computing power then pushed that machinery far beyond its original applications.

The story began with an argument about whether dependent events could still obey mathematical laws. More than a century later, the same broad insight sits beneath systems used around the world: what comes next is shaped by what came before, and those relationships can be learned.

Markov counted vowels and consonants to make a point about probability. He could hardly have imagined where that question would eventually lead.

Sources and further reading

• Gely P. Basharin, Amy N. Langville and Valeriy A. Naumov, “The Life and Work of A. A. Markov”, 2004.

• A. A. Markov, “An Example of Statistical Investigation of the Text Eugene Onegin Concerning the Connection of Samples in Chains”, lecture delivered in 1913; English translation published in 2006.

• Claude E. Shannon, “A Mathematical Theory of Communication”, 1948.

• Claude E. Shannon, “Prediction and Entropy of Printed English”, 1951.

• Frederick Jelinek, “The Dawn of Statistical ASR and MT”, 2009.

• Yoshua Bengio et al., “A Neural Probabilistic Language Model”, 2003.

• Dzmitry Bahdanau, Kyunghyun Cho and Yoshua Bengio, “Neural Machine Translation by Jointly Learning to Align and Translate”, 2014/2015.

• Ashish Vaswani et al., “Attention Is All You Need”, 2017.

• Alec Radford et al., “Improving Language Understanding by Generative Pre-Training”, 2018.

• Alec Radford et al., “Language Models Are Unsupervised Multitask Learners”, 2019.

• Tom B. Brown et al., “Language Models Are Few-Shot Learners”, 2020.

• Mark Chen et al., “Evaluating Large Language Models Trained on Code”, 2021.

• Long Ouyang et al., “Training Language Models to Follow Instructions with Human Feedback”, 2022.

There will be plenty of debate about the companies involved, the contracts they signed, and whether OpenAI made the right decision. I am not going to litigate that here.

I am more interested in what the announcement means for developers.

Developers, or the enterprises they work for, chose Cursor. They chose OpenAI models. They built those choices into the way they work every day. Now, they may lose the ability to use them together because of a dispute they did not create and cannot resolve.

That is the risk of renting your workflow from companies whose incentives you do not control.

A model dropdown is not model freedom

Most AI coding tools now offer more than one model (even if they’re only from one lab). That is good. It is also not the same thing as model freedom.

A model dropdown tells you which models a product has decided to make available today. Model freedom means you retain meaningful choice when the market changes tomorrow.

You should be able to choose the best model for a particular task. You should be able to use one model for planning, another for implementation, and another for code review. You should be able to optimize for quality when the work is difficult and for speed or cost when it is not. You should be able to bring your own API key, use a managed provider, or run an open model.

Most importantly, you should be able to change models without changing the rest of your development environment.

The best coding model today will not be the best coding model forever. It may not even be the best model for the next task in your queue. The market is moving too quickly, and the models are too different, for developers to make one permanent choice.

Model freedom is not about having the longest list of models. It is about making sure developers—not model companies, coding-tool companies, or disputes between them—remain in control.

When your coding-tool company also builds a model

There is a basic conflict when the company building your coding tool is also building the model inside it.

That company has an economic incentive to make its own model the default. It decides which competing models receive the deepest integrations, which get new capabilities first, how they are priced, and whether they remain available. It can use the product experience to drive demand toward the part of the business it most wants to grow.

None of this requires bad intent. In fact, each individual decision may be perfectly rational.

That is precisely the problem. The incentives are structural.

A model company will ultimately make decisions that protect its models, its contracts, its safety obligations, and its competitive position. Those decisions may sometimes align with what developers want. They will not always.

If the company making your software is also building a model, you will never have complete model freedom. You have access for as long as that access supports the company’s broader strategy.

Model freedom is also operational resilience

This announcement is unusually visible, but losing access to a model is not a theoretical risk.

Providers experience outages. They impose rate limits. They change prices, retire models, update policies, and adjust capacity. Model quality can improve or regress between releases. Commercial relationships end. Companies are acquired. Strategies change.

Teams should be able to route around those changes.

If one provider is unavailable, developers should be able to keep working. If a model becomes too expensive, teams should be able to move appropriate workloads elsewhere. If a better model launches, they should be able to try it without rebuilding their workflows. If an enterprise needs tighter controls, it should be able to add those controls without forcing every developer and every task onto the same model.

Multi-model access is not a novelty. It is protection against concentrating a critical engineering workflow in a single provider.

Losing a model may still be inconvenient. It should not require replacing the tool your team uses to build software.

Kilo does not build foundation models—and that matters

Kilo is an independent coding platform. It does not build foundation models.

That is not a missing piece of Kilo’s strategy. It is central to it.

Kilo’s job is to help developers use the right model for the work, regardless of who made it. I want OpenAI, Anthropic, Google, xAI, Arcee, Poolside, Z.ai, Minimax, and the next generation of model providers to compete for every task. When one of them builds something better, Kilo users should benefit.

Kilo competes on the quality of the coding experience: how effectively agents understand your codebase, use context, plan work, write and review code, operate across surfaces, and fit into the way your team already builds software.

Kilo does not need to steer you toward a proprietary model to make another part of its business work. Its incentives are straightforward: Kilo succeeds when developers can use the best available models successfully.

Independence does not eliminate every dependency. Model providers can still change their terms, restrict access, or make commercial decisions that affect availability. No coding platform can promise otherwise.

What an independent platform can do is avoid making one provider’s incentives the center of your entire workflow. It can support multiple paths to models, make switching easier, and treat portability as a product requirement rather than an edge case.

What developers should demand

Developers evaluating an AI coding platform should look beyond the models displayed in the interface today.

Ask whether you can bring your own API keys. Ask whether model names, prices, and limitations are transparent. Ask how quickly new models become available. Ask whether competing models receive first-class support or merely appear in a dropdown. Ask whether your prompts, rules, context, and workflows remain portable when you switch.

And ask the most important question: does this company benefit when I choose the best model for me, or when I choose the best model for it?

That answer will tell you more about your long-term freedom than any current feature matrix.

Choose your tool. Then choose your model.

The current Cursor and OpenAI situation will eventually reach some conclusion. The underlying risk will remain.

AI companies will keep competing. Contracts will be renegotiated. Providers will move further into the application layer. Coding tools will be acquired. Models that feel indispensable today will be surpassed, repriced, restricted, or retired.

Developers should be able to benefit from that competition without rebuilding their working environment every time the market changes.

Your coding tool should help you choose the best model. It should not make that choice for you—or allow someone else’s corporate dispute to make it on your behalf.

What now?

If you’re a Cursor user, looking to experiment with Kilo, you can get started with our migration guide.

If you’re a leader, looking to move your org to Kilo, we can help.

If you were poking around OpenRouter or OpenCode last week and ran into a model called ox-alpha, you probably noticed the same thing everyone else did: it was fast, it held up on long agentic runs, and it kept finishing tasks that models in its apparent weight class had no business finishing. It became the most-used model of the week before anyone knew who built it.

It’s Z.ai. The model is GLM-5.3-Flash, and it’s available in Kilo right now across the IDE extension, the CLI, and Cloud Agents.

What it actually is

GLM-5.3-Flash is 320B total parameters with only 18B active, and it’s the first natively multimodal model in the GLM-5 line. Z.ai prices it at roughly a tenth of GLM-5.2.

The architecture is where the savings come from. Z.ai went with a hybrid of linear and sparse attention: linear attention handles local dependencies through state modeling, sparse attention pulls in global context through a lightweight indexer. On top of that they added IndexPool, which compresses four indexer key vectors into one so the indexer doesn’t blow up memory at 1M-token context.

Against GLM-5.3, that combination cuts attention compute by 3x and KV cache size by 4.4x.

Compared to the GLM-4.5 generation, there’s a similar total parameter count (320B vs 355B), but roughly half the active parameters and half the layers. Fewer moving parts per token, more capability out the other end.

The benchmarks

Z.ai’s own numbers put GLM-5.3-Flash near Claude Opus 4.8 on coding and agentic work:

The jump from GLM-5.2 on DeepSWE (63.4 vs 46.2) and AutomationBench (48.8 vs 26.2) is not a rounding-error improvement, it’s a different tier of model. On Z.ai’s internal Code Bench, run through Claude Code, max-effort GLM-5.3-Flash lands at 29.0 against Opus 4.8’s 29.5.

And on the Artificial Analysis Intelligence Index v4.1.1, it scores 57 at about $0.045 per task at the discounted rate. A score in that range used to cost roughly ten times as much.

Benchmarks are benchmarks, though. The more convincing evidence is that thousands of developers used it blind for a week, had no idea who made it, and kept coming back.

Vision that’s actually useful for coding

The multimodal part isn’t a checkbox feature. Z.ai trained it specifically around visual self-verification, meaning the model renders its own frontend output, looks at it, notices the layout is broken, and fixes it without you pasting a screenshot and saying “this looks wrong.”

That matters for the work where correctness isn’t just “does it compile.” Frontend, game dev, 3D, anything with a canvas. A component can pass every test and still render as a pile of overlapping divs. A model that can see the result closes a loop that used to require a human in the middle.

It also carries over to non-code work: documents, spreadsheets, dashboards, slides. GLM-5.3-Flash posts 62.4 on OfficeQA Pro and 78.0 on Chartography with tools, both ahead of Opus 4.8.

One more thing worth flagging

Z.ai served this entire launch on a large-scale cluster of AI chips. They built a dedicated inference engine on top of SGLang, leaned on W8A8 quantization and a disaggregated Encode-Prefill-Decode architecture, and got a 3x end-to-end improvement over their own baseline on the same hardware. Their claim is that per-token cost and hardware efficiency now sit in the same range as mainstream NVIDIA GPUs.

They also mention that a GLM-5.3-powered infrastructure agent helped their engineers write and optimize the kernels for it. The model helped build the stack that serves the model, which is an interesting characteristic.

Where it fits in your Kilo workflow

We’ve been running it internally for a few days. Some early impressions:

It’s a great default. At this price and this speed, GLM-5.3-Flash is a model you can use throughout most of the day. You can do code mode, routine implementation, refactors, and test scaffolding without thinking about the meter.

It’s very good under parallel agents. Cheap tokens plus fast generation means you can fan out five or six agents on a feature without the cost math getting uncomfortable. Long-running Cloud Agents are the same story: the 1M context and the low serving cost mean a session can grind for a long time before anything hurts.

Code Reviewer is an obvious fit. Reviews are high-volume, bounded, and repetitive, which is exactly what a fast model with strong tool use is for. Point Kilo’s Code Reviewer at GLM-5.3-Flash and you get PR feedback on every open PR without the per-review cost creeping up.

Frontend work is where the vision pays off. Give it a design reference or let it check its own render, and you spend a lot less time describing what’s broken.

Try it

GLM-5.3-Flash is in the model picker now, everywhere Kilo runs. Open the extension in VS Code, JetBrains, or the CLI, and select it. Tell us how it goes in Discord. We’re especially curious whether the vision loop holds up on real frontend work, since that’s the piece benchmarks are worst at capturing.

What does “sovereign AI” mean?

Does it mean running AI on infrastructure you own? Or running it on infrastructure located in your country or region?

View the LinkedIn poll

The results were almost exactly 50–50.

That surprised me. Not because I expected everyone to agree. “Sovereign AI” is a relatively new term, so different interpretations are understandable.

What surprised me was who disagreed.

Most respondents were technical people. They were interested enough in the subject to answer a LinkedIn poll about it, which is already a high bar. They also weren’t concentrated in one group. Engineers were split. Infrastructure specialists were split. CEOs, founders, and vendors were split.

There wasn’t a job title that indicated who understood sovereign AI “correctly.” People simply meant different things by it.

That’s a problem.

The words matter

Technology discussions often treat disagreements about terminology as pedantic. Who cares what we call it if everyone knows what we mean?

Except we often don’t.

Take the two definitions from my poll:

• If sovereign AI means running AI on infrastructure you own and control, that creates one set of requirements.

• If it means running AI on infrastructure located within your country or region, that creates another.

The two can overlap, but they don’t have to.

You can run workloads on infrastructure in your country without owning it. You can own the infrastructure but operate it somewhere else. You can control the infrastructure while depending on someone else for the model. You can control the model but run it on somebody else’s infrastructure.

These differences affect procurement, architecture, regulation, security, cost, and the outcome you’re trying to achieve.

When two people say they want sovereign AI, the next questions should be:

Sovereign from whom? And in what sense?

Then there’s “local AI”

I ran into a similar problem when someone described a coding session as “local AI.”

I assumed the model was running on their machine or infrastructure. It wasn’t.

They were using a model through the Kilo Gateway. The coding agent was running on their machine rather than in a cloud-based agent environment.

That’s a reasonable setup, but it shows why the term is ambiguous.

When someone says “local AI,” what exactly is local?

• The model?

• The inference?

• The agent?

• The data?

• The development environment?

• The network connection?

If I’m evaluating a system against a requirement such as “our data cannot leave this machine,” those distinctions matter.

AI has a vocabulary problem

We’re introducing terms faster than we’re agreeing on what they mean:

Sovereign AI. Local AI. Private AI. Self-hosted AI. On-prem AI. Open models. Open-weight models. Cloud agents.

These terms can be useful shorthand. They can also be marketing language. Increasingly, they’re both.

The risk is that we make decisions based on a label instead of the underlying requirement.

One company might say it needs sovereign AI because it doesn’t want sensitive data subject to another country’s jurisdiction. Another might want to avoid dependence on a particular cloud provider. A third might want to run open-weight models on hardware it controls. Some might mean all three.

Those are different problems. They may lead to the same architecture, but they may not.

Ask what problem you’re solving

We probably won’t create one definitive AI glossary that everyone follows. I’m not sure we should try.

Instead, we need to ask one more question when these terms come up:

What problem are you actually trying to solve?

If someone wants sovereign AI, ask whether they mean data, infrastructure, model, or jurisdictional sovereignty—or some combination.

If they want local AI, ask what needs to be local.

If they want an open model, ask what they mean by open.

If they want an AI agent running locally, ask whether they mean the agent, the model, or both.

These questions sound obvious. My LinkedIn poll suggests they aren’t being asked often enough.

We don’t need perfect definitions. We need shared understanding.

The poll didn’t show that half the respondents were wrong. There may not be one correct answer.

It showed that technically informed people use the same term to describe different things.

That matters as terms such as sovereign AI appear in architecture decisions, government policy, procurement documents, and vendor pitches. In those contexts, ambiguity becomes expensive.

The next time someone tells me they want sovereign AI, I’m going to ask a slightly annoying question:

What, exactly, needs to be sovereign?

Until we answer that, we may not be talking about the same thing.

SiliconANGLE has named Kilo a finalist in the AI Coding & Developer Assistants category of its 2026 edition of the TechForward Awards alongside Postman API Platform and SonarQube. Winners will be announced September 14.

The shortlist

The TechForward Buyer’s Guide features technologies and solutions that emerged as leaders over the previous year. Every company in it earned placement through evaluation by SiliconANGLE’s judging panel.

That panel is independent and deliberately mixed. It includes SiliconANGLE Media representatives, industry analysts, journalists, venture capitalists, and B2B tech practitioners. Entries are scored on technical innovation, market differentiation, and proven customer impact.

What the judges were looking at

More than 5 million developers have installed Kilo, and it meets them wherever they work: VS Code, JetBrains, the CLI, Cloud Agents, Slack, iOS, and Android. The same agent runtime, MIT-licensed in the editor and the CLI, runs across all of it.

The product argument is developer choice. Kilo routes across 500+ models at provider rates with no markup on inference, so the tool never decides which model your team ships on. Enterprises keep the guardrails they need. Model rules, provider restrictions, and regional inference requirements get set once at the top of the organization, and each business unit funds and configures its own work underneath. A European subsidiary can run only European inference providers while another unit runs the full model catalog.

Developers vote with their tokens, and the vote has moved fast. Last summer, open-weight models were 15.5% of token usage on Kilo, with proprietary models holding the rest. By the week of July 20, 2026, the ratio had flipped: open weights at 79.1%, proprietary at 20.9%.

Cost moved with it. Auto Efficient, a smart, session-aware, cost-conscious router, delivers 71% of frontier-level brainpower with 72% lower cost on KiloBench. Not every task needs cutting-edge AI and the bill that comes with it.

Open source at enterprise scale

Kilo joined Anaconda in July 2026. 95% of the Fortune 500 leverage Anaconda, and more than 52 million users rely on the Anaconda Platform.

Open source agentic engineering now runs on a secure, trusted foundation, at the scale enterprises actually operate at. See what that looks like at kilo.ai/enterprise.