K2 Horizon 7B beats models 4x its size — and eats your RAM doing it
Three things landed on our desks this afternoon: an independent benchmark pass on Abu Dhabi's fully open model fleet, a security write-up on how far you can push an AI that reads your support inbox, and a paper arguing that judge panels are less reliable than their vote counts suggest.
Artificial Analysis has now scored MBZUAI's K2 Horizon 7B at 21 on its Intelligence Index, against a median of 8 for open-weight models of the same size class — and the local-AI community's verdict is that the plot axis is wrong. The model is the mid-sized dense member of the six-model K2 Horizon fleet that IFM released on September 3 with weights, code, training data and methodology attached, and it carries a native 524,288-token context window into a 7-billion-parameter body. Independent testing puts its intelligence roughly where IFM claimed; the argument is about what it costs to run. A detailed memory audit posted to r/LocalLLaMA has the 7B needing 5.2 GiB of quantized weights plus about 5 GiB of KV cache at 128K context, while the sparse 36B-A4B needs 19 GiB for experts and 6.7 GiB for context — versus 0.7 GiB of context for a comparable Qwen3.6-35B-A3B. One user loading the full-precision 7B at its default 500K context saw a projected 89,543 MiB of device memory. Our take: IFM reused a conventional attention design while everyone else moved to sliding-window and linear-hybrid caches, so the parameter count on the leaderboard is the least informative number on the page — the models shift hard right if you plot RAM instead. If you want to know how that fleet's own numbers held up before independent testing, we covered it here: IFM audits its own benchmark scores — and finds them 3.4 points too high.
Intigriti researchers published a taxonomy of attacks against AI customer-service agents, and the recurring lesson is that the email layer, not the model, is the vulnerable part. The write-up walks through tricking an agent into sending phishing from a support address, passing sender verification with multiple From headers, and getting a valid signed email delivered as the victim through an out-of-office auto-reply. Further along, it shows 2FA bypass by resetting a rate limiter through email normalization, then switching channels to a phone IVR where identity checks are handled differently; OTP exfiltration by planting one instruction in the support inbox and waiting for a third-party verification email to arrive; and a hidden-text payload inside an email that Chrome's built-in AI assistant reads when the victim replies — a report Google marked Won't Fix. It closes with RAG poisoning: a forum comment naming a fake promo code gets crawled into the knowledge base and cited as fact. Human-in-the-loop approval is the other target, since a zero-opacity HTML block, a two-part MIME message or a user-agent-dependent image lets the attacker send one email that the approver and the agent read differently.
Amazon Science says a panel of LLM judges that agree for the same reason is one judge with confidence theatre attached, and its fix beats majority vote by 9% to 14%. The paper, accepted to ICML 2026, models a judge panel as a network with an Ising model rather than a bag of independent voters, learning each judge's reliability and each pair's correlation — including shared mistakes — from evaluation logs with no human labels at training time. Across three binary tasks with a 10-model panel at temperature zero, the dependence-aware aggregator reached 0.912 accuracy on retrieval relevance versus 0.820 for weighted majority vote, 0.792 on toxicity versus 0.694, and 0.806 on summarization versus 0.737. The practical version for anyone running evals: the value of an extra judge depends on how independently it errs, so a panel of ten models from one lineage is not a panel of ten.
What to watch: whether llama.cpp's pending support for the K2 Horizon architecture changes the memory math, and whether IFM ships the KV-cache-optimized revisions it has teased.
Is a benchmark score meaningful if the model that earned it can't fit on the hardware its size implies? Tell us in the comments.
