July 2026 Summaries

Confidential computing aims to protect AI prompts while they are being processed by running workloads inside hardware-backed Trusted Execution Environments, preventing cloud operators, hypervisors, and host-level attackers from reading protected memory, though it does not eliminate risks from buggy code, compromised endpoints, or downstream providers. TrustedRouter describes a public-source AI gateway hosted in GCP Confidential Space, where TLS termination, prompt handling, and provider communication occur inside a confidential workload while its control plane retains only billing and routing metadata rather than prompt or response content. Its remote attestation process uses signed platform tokens, fresh nonces, production-image measurements, and TLS-session binding to let clients verify that a live connection reaches the expected non-debug gateway image and cannot reuse attestation across connections. Public release records, source code, and verification tools allow independent inspection of the deployed image and its prompt-handling behavior, although verification cannot prove software is bug-free or secure a user’s own device. The service distinguishes gateway attestation from provider privacy: zero-data-retention routes limit provider retention, while confidential routes require provider-side confidential computing and end-to-end encryption, with requests failing if no qualifying provider is available.

Prometheus 2.0 achieved a reported 77.4 score on the 100-task DRACO agentic deep-research benchmark, with a 95% confidence interval of 74.5 to 80.2, exceeding the prior Zeus 1.0 preset score of 73.4 and Prometheus 1.0’s 69.2. The result also surpasses the 69.0 best score reported in the OpenRouter paper introducing DRACO, as well as several single frontier models evaluated under the same protocol, including Fable-5, GPT-5.5, and Claude Opus 4.8. Built entirely from open-weights models, Prometheus 2.0 is described as a lower-cost fused model panel that performs web research, evaluates primary sources, conducts calculations, and produces cited reports graded against hidden rubrics. Its highest reported domain scores were in law, medicine, general knowledge, and academic tasks, and it is now available through TrustedRouter under the Prometheus 2.0 model identifier and rolling Prometheus alias.

Liberty 2.0 is presented as a U.S.-hosted AI system that combines open-weight models from NVIDIA, Google, OpenAI, and Thinking Machines through TrustedRouter’s encrypted gateway. On the 100-task DRACO agentic deep-research benchmark, it reportedly scored 65.5, narrowly exceeding Fable 5 at 65.3 and surpassing GPT-5.5 at 63.3 and Claude Opus 4.8 at 60.3. Its strongest results relative to the average of GPT-5.5 and Opus 4.8 were in personalized assistance, UX design, shopping and product research, academic work, and multi-source research tasks, while medicine was its only weaker category and law was tied. Scores are based on rubric-driven evaluations with roughly 40 criteria per task, though the source cautions that grading can vary and that heavily weighted safety penalties, especially in medical tasks, can substantially affect individual results. Liberty 2.0 is available through the TrustedRouter API under the model ID trustedrouter/liberty-2.0.

Thinking Machines Lab’s inkling, a reasoning model with a 256,000-token context window founded under former OpenAI CTO Mira Murati’s company, answered 8 of 30 potentially unsafe biology, cybersecurity, and LLM-research prompts in PrometheusBench while refusing 22 and producing no errors. The comparison cited shows Anthropic’s Claude Opus 4.8 answered only one of 20 completed prompts and errored on 10, while Claude Fable 5 answered none and GPT-5.5 reportedly returned only errors; Chinese models such as GLM 5.2, Kimi K2.6, and DeepSeek V4 Flash scored substantially higher. The passage argues that benchmark refusals often affect students, independent researchers, and practitioners more than credentialed institutional researchers, who may retain access through other channels, and presents inkling’s relative permissiveness as evidence against highly restrictive safety policies at Western frontier labs.

Researchers are encouraged to continue pursuing biology questions without allowing a single model provider’s refusal policies to dictate their workflow, using model routing as an engineering choice rather than a vendor-imposed limit. TrustedRouter’s Prometheus preset provides an OpenAI-compatible, attested gateway to a panel of open models, a judge, and a synthesizer for difficult or uncertain analyses, while cheaper models should be used for routine tasks they have already demonstrated they can handle. Initial BioMysteryBench-style tests found that Claude Opus 4.8 solved all three tasks, while lower-cost models such as Gemma-4-31b and GLM-5.2 completed two, with GLM uniquely solving a longer motif task, illustrating that performance varies by problem rather than following a simple ranking. The LLM-advisor skill and MCP server can help agents inspect available models, prices, privacy tiers, and task suitability before selecting a route. Prometheus is presented as useful when models offer complementary strengths, not as a solution to shared errors, which should instead be documented honestly; supporting benchmarks, routing tools, and setup materials are available openly.

TrustedRouter has launched an MCP server and open-source, agent-neutral LLM-advisor skill intended to help coding agents make informed model-selection decisions using current operational data rather than defaults or habits. The tools provide access to live model catalogs, pricing, providers, privacy tiers, available credits, documentation, generation metadata, provider health, and test calls through an attested API gateway, while AI IQ contributes public benchmarks, rankings, charts, and methodology data. Together, they enable agents to recommend models based on a task’s quality, cost, speed, privacy, and routing requirements, including zero-retention options for legal work, economical open models for evaluation loops, comparisons between single and combination models for difficult coding tasks, and prompt caching for recurring long-context workloads. The initiative aims to make AI infrastructure more transparent, measurable, verifiable, and actionable at the point where agents decide how to use language models.

Open-source model routing is presented as a way to overcome the traditional tradeoff among intelligence, cost, and speed by treating AI systems as coordinated packages of specialized models rather than single vendor endpoints. Reported benchmark results across coding, research, factuality, biology, and cybersecurity suggest that combinations of open models, judges, synthesizers, and fallback mechanisms can match or exceed stronger standalone models on selected tasks. The approach relies on routing routine prompts to fast, inexpensive models while escalating only difficult or specialized requests to more costly panels or expert models, improving efficiency and resilience. Its proponents also emphasize that open routing software, evaluation harnesses, transparent model routes, and explicit privacy classifications are important because multi-model systems create additional subcalls and trust considerations.

OpenPatcher-S1 scored 7 out of 16 on ExploitBench’s CVE-2024-2887 target, outperforming the listed open-model baselines of Kimi K2.6, GLM-5.1, and MiniMax M2.7, though it still failed on most tasks. The benchmark is presented as a difficult multi-stage evaluation requiring models to locate patched code, reproduce vulnerabilities, develop useful capabilities, and progress toward control within a realistic environment, rather than merely answer cybersecurity questions. Designed for defensive patching, OpenPatcher-S1 is intended to help teams understand vulnerable code and produce reliable repair guidance, with the evaluation offered as evidence of relevant reasoning ability rather than exploit promotion. The authors limit their claim to the published score and comparison, while noting that a forthcoming model, Poseidon, is still in training and has shown higher internal performance on the same target but has not yet received a published result.

TrustedRouter advocates an open-source approach to AI routing infrastructure as an alternative to relying on unverifiable privacy, security, and fairness claims from closed providers. It makes its frontend, control plane, attested prompt gateway, infrastructure definitions, SDKs, evaluation harnesses, documentation, and trust resources publicly auditable while keeping sensitive information such as API keys, customer data, payment records, and operational credentials private. Because AI routers can process valuable prompts containing code, legal material, financial analysis, medical context, and private documents, the company emphasizes that users should be able to inspect the prompt-handling code path and compare hosted gateway attestation evidence with published source commits. The broader goal is to make AI models easier to switch, benchmark, self-host, inspect, and hold accountable as the model ecosystem becomes more centralized and costly.