Anthropic Lets Enterprises Gate Prompts, Qwen3.8-Max Cuts Output to $6, MiniMax H3 Keeps 2K API-Only—Model Vendors Split Control

Three developments this week point to the same place: model vendors are beginning to redraw the line around how much of the stack enterprises are allowed to control. On August 5, Anthropic launched inference hooks for Claude Enterprise. Before each employee prompt reaches the model, it is first sent to the enterprise’s own security server, which returns an allow-or-deny decision; those are the only two possible outcomes, and the server cannot rewrite or redact the prompt. On August 3, Alibaba launched Qwen3.8-Max at $2 per million input tokens and $6 per million output tokens, with output pricing only half that of GPT-5.6 Terra and Gemini 3.1 Pro in the same price band. It scored 58 on the Artificial Analysis Intelligence Index, ranking #9 among 185 models. Alibaba, however, has neither published a technical report nor disclosed the model’s parameter count; secondary reports claiming 2.4 trillion parameters and an “open-weight release next week” have no official source. The multimodal market was even more active this week: on August 2, MiniMax uploaded the weights of H3, a 33B omni-modal video model, to Hugging Face; ByteDance released Seedance 2.5 on July 31, doubling single-shot duration to 30 seconds. H3’s community license excludes the European Union, the United Kingdom, South Korea, and the United States from its licensed territories, while only the 768p component has been released as open weights; 2K generation still requires the API. Seedance 2.5, meanwhile, still had no official developer pricing as of this week. On the tooling side, Microsoft brought its security agents into Defender public preview on August 3, explicitly stating that the system dynamically selects models based on quality, reliability, latency, and cost. Cloudflare, meanwhile, used an entire week to roll out a full agent infrastructure stack spanning runtime, networking, payments, and browsers.

Major Events

Anthropic Lets Enterprise Servers Decide Whether a Prompt Can Reach the Model

On August 5, Anthropic opened inference hooks for Claude Enterprise in public beta. The mechanism is straightforward: after an employee prompt leaves the client but before model inference begins, Anthropic sends the full conversation transcript via a signed HTTPS POST to the enterprise’s own DLP or security server. The server has a default five-second timeout window to return an allow-or-deny decision, and Claude begins generating only after that decision is received. A single organisation-level configuration covers Claude chat, Claude Code, and Claude Cowork, with no software required on user devices. The protocol uses a webhook with a public schema. Anthropic specifically names Netskope, Palo Alto Networks, Zscaler, and Proofpoint as direct integration targets, while also allowing enterprises to point the webhook to their own servers.

The limitations are explicit in the protocol: the only possible decisions are allow and deny. The server cannot rewrite the prompt, redact it, or replace sensitive fields before allowing it through. A request containing a customer’s national ID number therefore has only one outcome under a blocking rule: the entire prompt is rejected and the employee receives no result. The security team must either loosen the rule or accept the usability trade-off. What has changed is the location of the enforcement point. Previously, enterprises seeking to govern the content of AI traffic generally had to deploy a proxy at the network egress layer or install an endpoint client, both of which required maintaining infrastructure that was not specific to AI. The inspection point has now moved into the model provider’s own serving path, with the provider actively calling back to an enterprise-controlled system. This is the first time a model vendor has handed one stage of the inference path back to the customer for a policy decision.

The procurement implications need to be understood at two levels. On the positive side, the hook turns sensitive-data admission controls that previously depended largely on contracts and trust into an enforceable technical control. On the other hand, it applies only to Claude’s own interfaces. If the same enterprise also uses GPT-5.6 for batch classification, Qwen for multimodal preprocessing, and open-weight models for self-hosted workloads, it must configure policies separately for each provider, integrate a different protocol for each one, and maintain separate audit semantics. Decision models, timeout behaviour, and support for redaction may all differ by vendor. Placing policy enforcement in an enterprise-controlled control plane allows the same redaction and admission rules to apply across models, while consolidating request-level audit trails and per-user, per-endpoint invocation records in one place. That is the more durable approach in a multi-model environment. For enterprises running AI traffic through AgentsFlare, models can be switched or used in parallel without allowing these rules and audit records to drift with any single vendor’s product architecture.

Qwen3.8-Max Cuts Output Pricing in the $2 Input Tier by Half

On August 3, Alibaba released Qwen3.8-Max at $2 per million input tokens, $6 per million output tokens, and $0.25 per million tokens for cache hits. Its 1-million-token context window uses a single pricing tier throughout: a 5,000-token request and a 900,000-token request are billed at the same unit rate. The model supports text, image, and video inputs. Independent evaluator Artificial Analysis assigns it an Intelligence Index score of 58, ranking it #9 among 185 models, with an output speed of 67.6 tokens per second. Running the complete evaluation suite cost $1,741. The same evaluation also identifies the model as unusually verbose: it generated 150 million output tokens during testing, compared with a median of 70 million.

Within the same price band, the main difference is on the output side. After its July 30 price reduction, GPT-5.6 Terra costs $2/$12 per million input/output tokens, while Gemini 3.1 Pro is also priced at $2/$12. Qwen3.8-Max therefore matches both on input pricing while charging half as much for output. Its long-context pricing structure also differs: Gemini 3.1 Pro moves to a $4/$18 tier once input exceeds 200,000 tokens, whereas Qwen3.8-Max retains one price across its entire 1-million-token context window. Conversational products and batch-extraction tasks with limited output may see little difference, but inference-heavy workloads are billed primarily on output tokens. Given that Qwen3.8-Max itself appears relatively verbose, its real per-task output volume may bring effective costs closer to peers than the list price initially suggests. One qualification must remain explicit: Alibaba has not published a technical report for this version or disclosed its parameter count. Artificial Analysis directly records it as closed and parameter count undisclosed. Secondary reports claiming 2.4 trillion total parameters, 95 billion active parameters, and an “open-weight release next week” cannot be traced to an official source and should not be used as a basis for deployment planning.

The resulting gaps across price bands have practical value. Within a single workflow, the optimal models for different stages now clearly sit across multiple orders of magnitude in price: high-volume multimodal preprocessing, classification, and extraction can be covered by models priced from fractions of a cent to a few cents; medium-complexity reasoning over long contexts sits around the $2 input tier; only the tasks that genuinely require frontier capability justify flagship models with double-digit output pricing. Routing requests to different models according to task type and cost budget, and setting usage quotas by team and project, is the prerequisite for translating this price spread into actual billing savings. Otherwise, a workflow that defaults every request to a flagship model will give back the entire output-price saving created this week.

Video Models Arrive in Force, but Enterprises Can Actually Control Only a Narrow Slice

The multimodal market was unusually active this week, but every form of openness came with constraints. On August 2, MiniMax uploaded the weights of its next-generation omni-modal video model H3 to Hugging Face and formally announced the release the following day. H3 is a 33B-parameter dense, single-stream Transformer rather than a Mixture-of-Experts model. It accepts arbitrary combinations of text, images, video, and audio and generates video with native 32kHz stereo audio, with durations of 4 to 15 seconds at 24 FPS and stable support for 11 spoken languages. Architecturally, the same Transformer predicts latent video and audio representations simultaneously, avoiding the longstanding lip-sync and ambient-audio alignment problems associated with pipelines that generate video first and add sound afterwards. Within a day of the weight release, the community had produced NVFP4, FP8, INT4, and GGUF quantisations, alongside diffusers pipelines, ComfyUI templates, and deployment guides for SGLang and vLLM.

What users actually receive, however, is only the middle layer of the system. The complete H3 stack consists of three modules: H3-Context-IR, which converts complex multimodal inputs into a structured intermediate representation; H3-Base, which generates 768p audio-video output; and H3-Regenerate-2K, which takes the 768p result together with the original context and regenerates it at 2K resolution. Only H3-Base has been released as open weights. The modules on either side remain behind the API. Self-hosting therefore supports only 768p generation; the 2K capability highlighted in official marketing requires returning to MiniMax’s hosted interface. The licence constraints are even more material for enterprise use. The H3 Community License explicitly excludes the European Union, the United Kingdom, South Korea, and the United States from its licensed territories, requiring users in those jurisdictions to contact MiniMax separately for authorisation. Commercial users with more than $20 million in annual revenue require additional written authorisation; H3 outputs may not be used to train other models; and commercial product interfaces must prominently display “MiniMax H3”. For multinational enterprises, these provisions mean H3 cannot simply be moved into production under normal open-weight assumptions. Legal review should come before technical validation. MiniMax has also yet to release an official technical report and benchmark package alongside the weights, leaving the model’s quality ceiling to independent evaluation.

Pricing is its sharpest edge. MiniMax says that at 2K resolution its per-second pricing is less than one-third that of mainstream models, while at 768p it is less than half the price of mainstream 720p systems; reports place it at roughly one-third the cost of Seedance 2.0. On the Seedance side, ByteDance formally released Seedance 2.5 on July 31. Single-shot duration doubled from 15 to 30 seconds, while the maximum number of reference assets rose from approximately 15 to 50 per generation—30 images, 10 video clips, and 10 audio files. Four additional capabilities were introduced: timestamp-level editing, relighting after replacing a green-screen background to match the new environment, re-editing camera movement, and clay-model references that allow users to establish spatial structure using an untextured white model before generating the final visual. Initial distribution is through the Dreamina web application and Doubao Pro, two consumer-facing products in China. Subscription plans and quotas remain unchanged, and Seedance 2.0 remains available. For developers, the official blog states only that the API is “coming soon via BytePlus ModelArk,” without specifying a date. Pricing remains undisclosed this week; third-party per-second estimates differ by multiples, and major aggregation platforms still do not list a corresponding model ID. Independent evaluation is similarly behind the release cycle. On Artificial Analysis’s text-to-video Elo leaderboard, Seedance 2.0 ranks third at 1,225, while MiniMax H3, launched this week, has moved ahead at 1,242. Seedance 2.5 still has no independent listing. Vendor-reported improvements are a meaningful signal, but they have not yet been cross-validated by third parties.

Taken together, these developments show video generation repeating the path text models followed two years ago: capabilities are rapidly approaching commercial readiness, but regional and revenue restrictions attached to open-weight releases, missing developer pricing at launch, and lagging independent evaluations are shifting selection uncertainty toward contracts and bills. Output quality may actually be the easiest part to validate. The most practical step for enterprises at this stage is to abstract video-generation calls behind their own access layer, treating model ID, duration limit, number of reference assets, and output resolution as configurable parameters rather than hard-coded constants. Specifications and pricing for this week’s models remain fluid; once pricing stabilises, switching models should ideally require no more than a configuration change.

Microsoft and Cloudflare Build Out the Agent Stack in the Same Week: One Routes Across Models, the Other Packages the Runtime

On August 3, Microsoft brought Project Perception into public preview in Microsoft Defender for a group of enterprise customers already testing its vulnerability-analysis framework. The architecture divides work among three classes of agents: RED agents continuously identify exploitable attack paths; BLUE agents investigate signals and reason over context to determine which risks are genuinely meaningful; GREEN agents execute remediation and hardening. Supporting the system is MAI-Cyber-1-Flash, Microsoft’s first internally developed model specifically designed for cybersecurity use cases. Microsoft states directly in its system-design description that Project Perception is multi-model: the system dynamically selects capabilities according to quality, reliability, latency, and cost. A hyperscaler that builds its own models, sells its own cloud, and operates one of the world’s largest security businesses has inserted a four-dimensional dynamic model-selection layer into one of its most important security products rather than hard-wiring calls to its own models. The routing logic previously used mainly by a small number of frontier teams is becoming a default product architecture. One qualification remains: Project Perception is still in public preview rather than general availability, and all benchmark figures published so far are Microsoft-reported and have not been independently verified.

During the same week, Cloudflare used Agents Week from August 2 to 6 to roll out a packaged set of infrastructure components that agents have been missing. It began with @cloudflare/computer, an early-preview open-source library that gives each agent its own virtual computer, with cross-language RPC and inbound TCP support. Cloudflare Wallets followed, using the x402 protocol to address a problem that had previously received little direct treatment: agents cannot open bank accounts and cannot navigate the browser-based third-party account and payment flows designed for humans. The wallet provides native payment capability and verifiable identity, allowing an agent to autonomously purchase APIs and content within defined security guardrails. Mesh then brings agents, people, and multi-cloud infrastructure into the same private network. Email Service enters public beta, giving agents native capabilities to receive, send, and process email. Kitesurf provides a stateless browser running on Workers.

Viewed together, the two developments make a previously fragmented conclusion much more concrete: what enterprises now need to govern is no longer just the model call, but an execution entity that can spend money, send and receive email, open browsers, and operate inside private networks on its own. Microsoft shows that dynamic multi-model selection is becoming a product-level default. Cloudflare shows that the agent runtime itself is increasingly being packaged end to end by a single provider, with the convenience of having identity, networking, and payments all built into the same infrastructure. What enterprises need to retain under their own control is identity propagation, tool-access control, and request-level auditing across these runtimes: which agent acted, on behalf of which user, which model and tool it called, and how much money it spent. Once that chain is fragmented across vendor runtimes, reconstructing the complete causal record becomes extremely difficult.

Upstream Compute Signals: Memory Inflation Is Starting to Discriminate by Customer, While Power Contracts Look Increasingly Like Heavy Assets

Two upstream price lines moving in different directions are worth recording this week. Memory continues to rise. TrendForce updated contract prices on July 31 and expects conventional DRAM—server memory used in large quantities alongside accelerators in AI servers—to rise another 13–18% quarter over quarter in Q3, although the increase is narrower than in the previous two quarters because consumer demand has weakened and the comparison base is higher. The structural mismatch is even more notable. Counterpoint data shows DDR4 spot prices at $2.10 per Gb, above HBM3e—high-bandwidth memory in which multiple memory dies are vertically stacked close to the processor package, and one of the principal performance bottlenecks in AI chips—at $1.70 per Gb. Previous-generation general-purpose memory is now selling for more than current-generation advanced AI memory. The reason lies in supply allocation rather than demand: manufacturers are prioritising capacity for higher-value products such as HBM and premium NAND, crowding out conventional memory supply. HBM, meanwhile, is largely priced on annual contracts, meaning quarterly market increases do not immediately flow through to contract pricing. The enterprise implication is straightforward: the current round of price pressure falls primarily on customers without multi-year contract protection and on incremental purchases beyond the quotas of contracted customers. Memory costs for self-built inference clusters will therefore feel pressure earlier than equivalent rented capacity.

GPU rental pricing is comparatively stable. In early August, B200 on-demand pricing stood at approximately $5.5–5.8 per hour, with multiple clouds quoting between $6 and $10 and the lowest reserved tiers reaching $3.35. H100 median pricing ranged from approximately $2.29 to $3.12 per hour, while the lowest on-demand channel was around $1.40. Together, the two figures reinforce one point: the main source of inference-cost elasticity currently comes from choosing among rental channels, while reductions from hardware-generation changes arrive more slowly. Capturing that elasticity, however, depends on workloads being portable across providers.

A power contract disclosed this week also deserves attention for its structure. On August 4, NRG said in its second-quarter earnings that it had agreed on principal commercial terms with an unnamed “global cloud and AI hyperscaler” for a 1.2GW combined-cycle natural gas plant in Texas. At the same time, Brookfield and NextEra plan to convert a former U.S. Department of Energy uranium-enrichment site in Kentucky into a 1.2GW AI data center campus with on-site generation. The common feature of these transactions is that the power plant and data center are increasingly written into the same commercial structure. Generation capacity becomes part of the project asset itself rather than a service purchased from the public grid. For enterprises, the practical consequence is that regional compute availability increasingly depends on local generation and interconnection timelines. The instance catalogue a cloud provider shows in a region reflects only current availability. When signing three- to five-year regional compute commitments, progress on power generation and grid connection should therefore become part of the due-diligence checklist.

Special Insight: OLIX Raises $312 Million on One Bet—Inference Chips Should Not Move Data Over Copper

On August 3, London-based photonic chip company OLIX raised $312 million in Series B funding at a $3.3 billion valuation, the largest semiconductor financing round in Europe to date. The round was led by growth fund Fundomo, with participation from Arm, Hudson River Trading, Netflix co-founder Reed Hastings, and other angel investors; all existing shareholders also participated. OLIX simultaneously appointed Nick McKeown to its board—the co-inventor of software-defined networking, OpenFlow, and P4, and a professor emeritus at Stanford. The company was founded in London in March 2024, when founder James Dacombe was 24. It changed its name from Flux to OLIX only this January and had raised a $220 million Series A in February.

The company is developing an optical tensor processing unit. Its core thesis is that a significant share of the energy and performance bottleneck in large-scale AI computing systems comes from moving data over copper, and that on-chip optical interconnects can bypass this constraint. The centrepiece of its product roadmap is DX-1, an accelerator designed specifically for the decode stage—the point at which a model generates tokens sequentially. This stage is constrained more by memory bandwidth than raw compute, which is precisely where optical interconnects claim an advantage. The target is internally coherent.

The uncertainties are equally clear. DX-1 is scheduled for tape-out in 2026, with initial deliveries not expected until the second half of 2027. In other words, the company currently has no production chip running inference in customer environments, and its $3.3 billion valuation rests on a roadmap and a team. Photonic computing has been argued for and developed for two decades, repeatedly encountering manufacturing-yield and software-stack integration challenges—exactly the issues that cannot be validated until after tape-out. The involvement of Arm and Nick McKeown suggests that the technical thesis has passed meaningful professional scrutiny, but there remains a full software stack and ecosystem-integration gap between tape-out and becoming a credible third option alongside NVIDIA and AMD for enterprise buyers. OLIX deserves a place on the watchlist because of where it is positioned: if specialised architectures can materially improve the decode stage, inference cost structures will split into new layers, and competition at that layer remains extremely limited.

Overall Assessment

Taken together, this week’s developments draw the control boundary between model vendors and enterprises more clearly than before—and at three different points. Anthropic hands the enterprise an admission decision, but only the ability to say “yes” or “no”. MiniMax releases weights, but excludes four major jurisdictions and keeps context understanding and 2K generation under its own control. ByteDance releases the capability while still withholding developer pricing. The mechanisms differ, but the underlying logic is the same: vendors are beginning to separate control rights from model capability and price them independently. The portion handed over is the layer easiest to replicate; what remains behind the vendor boundary is where bargaining power sits. Enterprises have more autonomy than they did a year ago, but each piece of that autonomy is tied to a specific vendor interface, jurisdiction, and product architecture. Switching vendors means rebuilding the control arrangement.

Microsoft reinforces the same conclusion from another direction. A company that simultaneously builds models, sells cloud infrastructure, and operates a major security business is dynamically selecting models across four dimensions—quality, reliability, latency, and cost—inside one of its most important security products. That suggests multi-model routing has moved beyond being merely a cost-saving technique used by price-sensitive engineering teams and is becoming a default product architecture. Once Cloudflare packages the agent runtime end to end, the governance surface expands again: an execution entity that can autonomously spend money, send and receive email, and open a browser creates an identity, permission, and billing trail that becomes impossible to reconstruct if it is fragmented across multiple vendor runtimes. The two upstream price lines remain where they were: memory inflation is disproportionately hitting customers without long-term contracts, while rental-channel selection remains the principal source of inference-cost elasticity. The enterprise response therefore converges on a clear direction: keep admission rules, routing policy, cost attribution, and the audit chain in a layer the enterprise itself controls. As vendor architectures change, only the integration work should need to change.