Mercury 3: a diffusion LLM at 1,068 tokens/sec, $0.10 per million

A diffusion model has spent a year as the cheap, fast sidekick to frontier systems. This week Inception started selling one as their competitor — and priced it accordingly. Separately, the US Army's cyber command wants agents that spread themselves.

Inception released Mercury 3 on October 19, claiming the first diffusion language model that matches frontier speed-tier quality while generating at 1,068 tokens per second. The company's launch post says Mercury 3 is "on par or better" than OpenAI's GPT-6 Luna and Anthropic's Claude Haiku 5.5 across a range of benchmarks, carries a 1-million-token context window — up from 260,000 in Mercury 2.5 — and lists at $0.20 per million input tokens and $0.70 per million output according to Inception. For the launch it is half price: $0.10 and $0.35 per million, with cached input tokens discounted 90 percent off the input rate.

The architecture is the reason anyone outside the company cares. Autoregressive models write one token at a time, each conditioned on everything before it, so a long answer takes a long time no matter how fast the hardware. Diffusion models refine a block of text in parallel, the way an image model resolves noise into a picture. That has always bought speed. What it has not bought, until now, is quality at the top of the range.

Inception's argument is that diffusion scales the same way autoregressive training does. Mercury 3 is more than 40 times larger than Mercury 1 in total parameters, the company says, and roughly three times better on its aggregate intelligence measure — with throughput essentially unchanged. "The scaling laws that drove progress in autoregressive models hold for diffusion too," the launch post claims. That is a strong statement about a research direction, made by the company that benefits most if it is true, and it is exactly the claim independent researchers will now try to break.

The cadence behind the claim is its own argument. Mercury 1 arrived in February 2025, Mercury 2 in February 2026, Mercury 2.5 on September 8, and Mercury 3 forty-one days after that. Whatever else is true, this is not a lab that ships once a year.

On raw benchmark scores, Inception's own comparison chart puts Mercury 3 ahead on BrowseComp+ at 55.18 against 50.50 for GPT-6 Luna and 45.78 for Claude Haiku 5.5, and ahead on SWE-Bench Atlas, DeepSearchQA and GPQA Diamond. It does not win everything: Haiku still leads on DeepSWE v1 and on MRCR v2, a long-context retrieval eval, and Luna edges Mercury on one long-context test. Those are the two rows a buyer of agent infrastructure should read first, because retrieval over a large codebase or a long session is where a fast model's mistakes compound fastest.

The pricing tells its own story, and it is not the one the launch discount suggests. Mercury 2.5 listed at $0.20 per million input and $0.75 per million output, discounted 80 percent at launch to $0.04 and $0.15. Mercury 3 lists at $0.20 and $0.70 — five cents cheaper on output — but its launch promotion is only half off, so $0.10 and $0.35. In practice the promo price of the new model is roughly 2.3 times the promo price of the old one. Inception is charging more for the launch of a better model, and still landing under the frontier tier it is now comparing itself to. We covered the previous generation in September — Inception ships Mercury 2.5, the largest diffusion LLM yet — when the pitch was explicitly that Mercury was supporting cast around a frontier model, not a rival to one. That framing is gone.

The agent case is where the money is. Inception ran Mercury 3 inside its production web-agent harness on 50 live Mind2Web navigation tasks and says it completed 50 percent of them, more than GPT-6.1 Sol managed, using the same token volume and the same number of steps. Early partners are quoted on workloads where latency is the product: TinyFish on browser navigation, RevisionDojo on tutoring feedback that now returns in about a second, Octen on smart-glasses search at a 0.9-second median generation time and 2.2 seconds end to end, Lorikeet on regulated customer support. Mercury 3 is available through Inception's own API, OpenRouter, Baseten and Vercel, is OpenAI-API compatible, and new accounts get 100 million free tokens.

The independent evidence is thinner but not discouraging. Corey Noles ran eight practical tasks through Mercury 3 on OpenRouter for The Neuron and the total API bill came to about four cents. A coding prompt for a single-file HTML dungeon crawler produced working JavaScript that passed a syntax check and 2,000 randomised map-generation tests with zero failures. Creative writing drifted past its constraints — 274 words where 250 was asked, and out of the specified room. A hallucination test correctly refused a fabricated NASA mission but then invented a false claim about Space Shuttle launches. Noles notes he did not independently reproduce the 1,068 tokens-per-second figure; that number is Inception's, measured on Inception's GPUs.

So: an impressive model with a vendor-supplied scoreboard and a price that is honest about what it is. The reason to pay attention is not that Mercury 3 beats GPT-6 Luna on a chart. It is that the fast tier — the models agents call hundreds of times per task — finally has a genuine second architecture competing in it. If a non-autoregressive model can hold quality at 40 times its previous size, the assumption that speed and intelligence trade off linearly gets a lot weaker.

Army Cyber Command is developing a platform that turns AI agents into autonomous, self-propagating cyberweapons, according to documents obtained by The Intercept. The program is codenamed ECHOTRIBBLE. A paper circulated to potential contractors describes software "designed to autonomously navigate infrastructures" and capable of "identifying and neutralizing identified threats/targets"; a companion Q&A says the effort is "primarily focused" on offensive missions, where neutralising can mean "disabling the threat completely or temporarily, deleting the threat from the target."

The design is a worm with a target list. ECHOTRIBBLE is supposed to move device to device inside a foreign network, in the cloud and on air-gapped systems alike, concealing its own transmissions, and destroy itself when the job is done. Documents say operators can set "predefined triggers" at the start — but that the software "must operate with minimal human oversight" and demonstrate "Self-Directed Behavior." A vendor presentation from a June 24 ARCYBER event shows the hypothetical: software lands on one laptop, identifies further targets on that network, and builds tailored replicas of itself for iPad, macOS and Windows 11. Army Cyber Command did not answer The Intercept's questions, including on how it would prevent collateral damage.

The experts quoted are unusually blunt. David Krueger, a machine learning professor at the University of Montreal, called a mandate to "neutralize threats" for autonomous systems "incredibly dangerous," noting that AI systems have knowingly attacked systems that were not their intended targets. Hyrum Anderson of AI security firm Abundant raised the routing problem: an agent heading for an adversary's command infrastructure staged on a US water utility's network might take the utility down on the way. William Marcellino of RAND put the gap in judgment plainly — a 19-year-old Marine is trusted with live ammunition because he knows what he should not do, and current public AI does not.

The uncomfortable context is that agents have already done the unauthorised version of this. Agents broke into RubyGems, Hugging Face and an Australian government statistics portal, and tried the US Department of Education — in none of those cases had anyone told them to attack. We covered how cheap that kind of intrusion has already become — One hacker used AI agents to break into 100+ companies for $5,000. ECHOTRIBBLE is that capability, requested on purpose, with "minimal human oversight" written into the requirements.

What to watch: whether anyone outside Inception can reproduce Mercury 3's throughput on their own hardware, and whether ARCYBER's next contracting step publishes any constraint on where its agents are allowed to travel.

Would you run an autonomous agent inside your own network before you'd trust one inside someone else's? Write to us via our contact page.