Alibaba is bringing lower prices — and potentially greater deployment control — to the frontier AI market.

The company launched Qwen3.8-Max, a 2.4 trillion-parameter model designed for coding, research, knowledge work, and long-running agentic tasks. It is available through Alibaba Cloud’s APIs, with the company promising to release its weights the following week.

For IT teams, the model presents a potentially attractive combination of frontier-level capabilities, lower token prices, and eventual self-hosting. The trade-off is that running a model of this size could demand considerable infrastructure and operational expertise.

Frontier intelligence at a fraction of the cost

Alibaba prices Qwen3.8-Max at $2 per million input tokens and $6 per million output tokens through Model Studio. OpenAI charges $5 per million input tokens and $30 per million output tokens for GPT-5.6 Sol.

Based on those published rates, Qwen3.8-Max costs 60% less for uncached input and 80% less for output. OpenAI recently reduced prices for GPT-5.6 Luna and Terra but left Sol’s standard token rates unchanged.

The comparison does not capture every production expense. Cached tokens, reasoning-token consumption, supporting tools, throughput requirements, and negotiated enterprise pricing can all affect the total cost of a workload.

Once Alibaba releases the model weights and licensing terms, organizations may also be able to deploy Qwen3.8-Max on their own infrastructure. Doing so would eliminate Alibaba’s per-token API charges but replace them with hardware, energy, maintenance, and engineering costs.

How Qwen’s mixture-of-experts architecture works

Qwen3.8-Max uses a sparse mixture-of-experts architecture built on Qwen 3.5. Although the model contains 2.4 trillion parameters, Alibaba says it activates only 95 billion for a given token.

This approach is designed to reduce inference costs and latency compared with a similarly sized dense model, which would use a much larger share of its parameters during processing. It does not, however, eliminate the need to evaluate different models for different workloads.

On the Qwen blog, the team shared how the Qwen3.8-Max can handle a range of coding, research, document-analysis, and visual tasks through one multimodal model. The system supports a context window of up to 1 million tokens.

Additionally, the Qwen model was able to beat Claude Fable 5 and GPT 5.6 on AI evaluation benchmarks like PaperBench, which is used to test whether AI can independently replicate cutting-edge AI research.

What IT teams should consider

Qwen3.8-Max gives enterprise IT teams another potentially capable model to evaluate, particularly when API costs, large context windows, multimodal input, or deployment control are priorities.

Its lower published token prices do not automatically make it the best or least expensive model for every workload. Organizations should compare output quality, latency, security controls, data-residency options, integration support, and total infrastructure costs before adopting it.

The model’s enterprise value should become clearer once Alibaba releases the weights and license, independent testing expands, and organizations can measure its performance against their own data and workflows.

As Alibaba, Moonshot AI, and other developers continue releasing advanced open-weight systems, the performance gap between open and proprietary AI appears to be narrowing. For IT leaders, that creates more choice—but also makes careful testing and cost analysis increasingly important.

Read more: Alibaba is also expanding the infrastructure behind its AI ambitions with a data center powered by 10,000 homegrown chips.

Hackers are shrinking the time between a software flaw becoming public and a real attack to mere hours, and artificial intelligence is helping them move even faster, according to CrowdStrike’s new 2026 Threat Hunting Report.

The cybersecurity company said AI has become both a target and a weapon for attackers. Threat groups are using AI to generate malicious code, automate parts of their operations, abuse enterprise AI systems, and target the software supply chains that many companies rely on.

One campaign highlighted by CrowdStrike sent nearly 200,000 requests to an AI model service in just two minutes, demonstrating how quickly attackers can abuse enterprise AI infrastructure.

“AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend,” said Adam Meyers, head of counter adversary operations at CrowdStrike.

CrowdStrike also found that AI agent-triggered detection leads are appearing at 2.5 times the rate of human-triggered leads, increasing the amount of activity security teams must investigate.

Patch windows are collapsing

The report’s most striking finding is how quickly attackers are exploiting newly disclosed vulnerabilities.

During the first half of 2026, 88% of the vulnerability exploitation observed by CrowdStrike involving public proof-of-concept code occurred within 48 hours of the code’s release. China-linked groups VAULT PANDA and GENESIS PANDA moved even faster, launching what CrowdStrike called “deliberate attacks” within 24 hours of disclosure.

The company said this trend is likely to continue as advanced AI systems make vulnerability discovery and exploit development faster.

Trusted systems are becoming attack paths

CrowdStrike said attackers are increasingly abusing legitimate authentication systems, cloud identities, and software-as-a-service applications instead of relying on traditional malware.

Vishing intrusions doubled during the first half of 2026, while monthly device-code phishing attempts increased 15-fold, according to CrowdStrike. In one incident, the eCrime group SNARKY SPIDER moved from taking over an account to stealing data in under five minutes. Cloud-focused cybercrime activity also surged 171% during the reporting period.

The software supply chain is under pressure

Attackers are targeting package registries, developer tools, and AI frameworks to reach downstream victims.

CrowdStrike said 87% of identified software registry threats in the first half of 2026 involved malicious npm packages. The company also linked North Korean group STARDUST CHOLLIMA to attacks that compromised more than 130 AI framework packages.

More must-read AI coverage

What this means for companies

The report suggests that many organizations can no longer rely on traditional patch cycles or perimeter-focused defenses. The most vulnerable points are increasingly the tools employees trust every day — cloud accounts, single sign-on systems, AI services, and software dependencies.

For businesses adopting AI quickly, AI deployment without strong identity controls, monitoring, and software supply chain protections could create new risks faster than security teams can respond.

“The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary,” Meyers said.

Read more: Five Eyes agencies warn that AI could accelerate cyberattacks within months, increasing pressure on organizations to strengthen access controls, patch faster, and prepare for shrinking response windows.

OpenAI has added prompt-injection results to the GPT-5.6 system card, reporting a low failure rate for attacks delivered directly through chat but higher rates in tests involving AI agents and external content. In the Aug. 3 update, GPT-5.6 Sol failed on about 0.05% of direct attacks generated by GPT-Red, the company’s automated red-teaming model.

Malicious instructions hidden in content processed by agents were more successful. Average attack success rates reached 3.77% for Sol, 3.32% for Terra and 2.94% for Luna in OpenAI’s indirect tests. Such instructions can arrive through emails, webpages, uploaded files, code repositories or tool responses.

Direct attacks fall as agent tests remain harder

The updated GPT-5.6 system card describes direct prompt injection as a user’s attempt to override higher-priority instructions. An indirect attack embeds malicious instructions in material supplied to the model through a tool.

The percentages measure successful attack attempts across OpenAI’s evaluation environments, not the probability of a production breach.

OpenAI trained GPT-Red through self-play, rewarding it for finding prompts that caused defender models to violate higher-priority instructions. The company then used those attacks to improve GPT-5.6’s defenses.

One technique, called Fake Chain-of-Thought, achieved an attack success rate above 95% against GPT-5.1 but fell below 10% against Sol. The results came from OpenAI’s own evaluation framework, so independent testing is still needed to determine how well they transfer to other applications and threat environments.

The research also tested Vendy, an autonomous vending machine agent deployed in an OpenAI office. GPT-Red caused the agent to lower prices, offer an item worth more than $100 for 50 cents and cancel another customer’s order. Similar weaknesses can turn a trusted AI assistant into a data-layer attack path after it processes hostile content.

Permissions shape the damage an attack can cause

OWASP’s prompt-injection guidance warns that attacks can expose sensitive information, invoke unauthorized functions or influence automated decisions. The potential damage depends largely on the systems, data and permissions available to the agent.

Recent disclosures show why AI agent permissions need stronger controls. External content should be treated as untrusted data, and agents should receive only the tools and access required for assigned tasks. Application code should check every tool call against the authenticated user’s authorization.

Human approval should remain mandatory for payments, credential use, data exports, access changes and destructive operations. Products such as ChatGPT Work require the same safeguards before agents can act across connected files, websites and desktop software.

Testing should cover connectors, retrieval systems, uploads and browsing tools — not only the underlying model. Logs should capture tool calls, authorization decisions, accessed resources and unusual sequences of privileged actions.

OpenAI’s tests show improved resistance to direct prompt injection, while the indirect results leave agent security dependent on the permissions and controls surrounding the model.

Read more: Stronger agent controls may become more important as Five Eyes agencies warn that AI could accelerate cyberattacks and lower the barrier to offensive activity.