Jalapeño, Legal Gemini, NemoClaw, Claude memory: four AI control surfaces to inspect now (2026)

Four product and security moves on August 25 put control surfaces around the model in plain view. OpenAI published the first measured results for Jalapeño, its custom inference chip. Google Cloud launched Gemini Enterprise for Legal in preview. Researchers disclosed CVE-2026-65105 in NVIDIA NemoClaw, a local agent deployment path that can expose an unauthenticated model server. Anthropic made Claude memory work across chat and Cowork, with editable topics and plan-specific defaults. 1 2 3 4

Each item answers a different operating question. Jalapeño is about cost and latency inside a provider's stack. Gemini Legal is about permissions that travel with matter data. NemoClaw is about the network binding and authorizations around a local agent. Claude memory is about what an assistant keeps, where it shows up next, and who can edit it.

Development	What changed	Action window
OpenAI Jalapeño	OpenAI reported 1.5–1.9× more AI work per watt and 1.7–3.6× lower end-to-end latency on public InferenceX tests, and said deployment inside its own infrastructure begins by the end of 2026. 1	Before treating latency or price claims as settled: ask which workload, which power rating, and when customer-facing capacity actually arrives.
Gemini Enterprise for Legal	Google Cloud put a legal industry package into preview, with skills, MCP connectors, agents, and a governed control plane developed with firms including Cleary Gottlieb, Freshfields, Weil, and Williams & Connolly. 2	Before a pilot: map connectors, ethical walls, citation rules, and human review for every automated workflow.
NemoClaw CVE-2026-65105	Oasis Security and Cyera showed that binding Ollama to `0.0.0.0:11434` can let a malicious page reach a local model API and poison its chat template. 3	Now: inventory local agent runtimes, check bind addresses and authentication, and limit what each agent can touch.
Claude shared memory	Memory now works across chat and Cowork in the cloud; topics are editable under Settings; Free/Pro/Max default on, Team/Enterprise default off. 4	This week: open Topics, delete stale items, and decide the sensitive-topics setting for personal and work accounts.

OpenAI is building latency and cost into the silicon

OpenAI says Jalapeño is its first custom inference chip, designed with the models, serving software, memory, networking, and rack around it. On SemiAnalysis's public InferenceX benchmark, OpenAI reported 1.5 to 1.9 times more AI work per watt at peak throughput and 1.7 to 3.6 times lower end-to-end latency across GPT-OSS 120B, DeepSeek R1 670B, and Kimi K2.5 1T. For highly interactive workloads, it reported 2.1 to 4.1 times higher performance. 1

Inference is the step where a trained model answers a live request. Prefill processes the prompt; decode generates the reply token by token. Agents chain many of those steps, so delay compounds. OpenAI says Jalapeño keeps model state, including the KV cache used while generating a response, local and activates compute, memory, and networking for each phase so the request spends less time moving data. 1

The power numbers need the same care as the speed claims. OpenAI rates Jalapeño at 700 watts and says measured sustained power stayed at or below 550 watts on the tested workloads. The published comparisons normalize against other accelerators' package power ratings, including a GB200 figure of 1,200 watts and GB300 figures of 1,400 watts in the appendix tables. 1

Customer-facing capacity is still on the calendar. OpenAI plans to begin putting Jalapeño into its own compute infrastructure by the end of 2026. TechCrunch, covering the Hot Chips presentation, quoted hardware head Richard Ho saying early deployment would be in very small volumes at the end of 2026, with larger rollout in 2027. OpenAI also says it will keep using NVIDIA and other partners' accelerators for training and inference. 1 5

A buyer reading the release is looking at a provider-side efficiency bet. Jalapeño is silicon OpenAI will run inside its own stack. The inspectable questions are concrete: which product surfaces will run on Jalapeño first, whether priced latency tiers change, and how OpenAI will show customers the mix of custom silicon and partner GPUs behind a given request.

Google is packaging legal work as skills, connectors, and agents

Google Cloud announced Gemini Enterprise for Legal on August 25 as a preview industry package on the Gemini Enterprise platform. CEO Thomas Kurian's post frames four parts: purpose-built skills, secure connectors into existing systems, agents that carry work through, and an open partner ecosystem, all under a governed control plane. 2

Skills here are reusable packages of instructions and context that teach an agent a specialized task while enforcing a firm's playbooks, citation rules, and house style. Google lists contract review and redlining, playbook creation, regulatory horizon scanning, legal research, and data subject access request (DSAR) fulfillment among the starting set. Connectors use the Model Context Protocol (MCP) and, Google says, inherit each platform's existing user permissions and access controls. 2

The connector list shows where the data path actually runs. Productivity connectors cover Google Workspace and Microsoft 365. Document management covers iManage and NetDocuments. Contract execution covers Docusign. E-discovery covers Everlaw and RelativityOne. Research and dockets cover Thomson Reuters HighQ, Free Law Project's CourtListener, and Courtroom5. Specialized legal AI connectors include Harvey, Solve Intelligence, and Legora. 2

Google says client data, firm playbooks, intellectual property, custom agents, and model outputs stay private to the organization and stay out of training or fine-tuning for Google foundation models. The control plane is described as enforcing VPC and customer-managed encryption keys, private data isolation, and grounded outputs with traceable citations. Firms named as early collaborators include Cleary Gottlieb, Freshfields, Weil, and Williams & Connolly. Reuters reported the same expansion and the same collaborating firms on August 25. 2 6

A pilot checklist follows the product shape. Name the matters and repositories the agents may read. Confirm ethical walls still stop cross-matter leakage after a connector is live. Decide which drafts an agent may write and which filings still need a named attorney. Keep a log of sources cited for any answer a client will see. The model is only one part of that stack; the permissions and review rules are the rest.

NemoClaw shows the agent risk sitting under the sandbox

Oasis Security researchers, publishing through Cyera on August 25, described CVE-2026-65105 in NVIDIA NemoClaw. NemoClaw deploys the OpenClaw AI agent inside NVIDIA OpenShell sandboxes and can run local inference through Ollama. To let a container reach the host model server, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the API to every network interface. 3

Ollama's local HTTP API has no authentication. It relies on CORS checks and Host-header validation. The researchers say Host-header validation is skipped when Ollama is bound to a non-loopback address. DNS rebinding then lets a page the user visits talk to the local API as if it were same-origin. From there an attacker can run inference on the machine, delete or pull models, and rewrite a model's Go chat template through /api/create after reading the original via /api/show. 3

Template poisoning is the lasting part. The template turns the structured message list into text the model actually reads. An injected instruction can append to every system message, including the system prompt the agent itself sends. The researchers say the change persists across later sessions, keeps the model name and size looking normal, and affects CLI users, API clients, and agents alike. The same 0.0.0.0 binding also exposes the API to other devices on the local network without rebinding. 3

OpenShell still limits what a compromised agent can do on the host filesystem and process boundary. The researchers argue that the blast radius follows the agent's authorizations: source control, CI/CD, internal APIs, cloud accounts, and MCP tool servers. They reported the findings to NVIDIA's Product Security Incident Response Team before publication. As of the research post, a fixed release version had yet to be named. 3

Anyone running a local coding or operations agent can treat this as a configuration audit, even outside NemoClaw. Check whether the model server listens only on loopback. Put authentication in front of any non-loopback bind. Review installed model templates after any suspicious browser session. Narrow the agent's tokens, repos, and outbound tools until the remaining access matches the work.

Claude's memory now follows the work across chat and Cowork

Anthropic's Claude apps release notes for August 25 say memory now works across chat and Cowork in the cloud. Everything Claude remembers appears under Topics in Settings > Memory, where a user can edit or delete any item. Memory is on by default for Free, Pro, and Max plans, and off by default for Team and Enterprise organizations. 4

TechCrunch's same-day report adds product detail that matches that release note. Anthropic is merging the memory systems so context learned in chat is available when Cowork takes action, and the reverse. Claude now adds topics while a conversation is still running, so a long research chat can feed Cowork before the chat ends. Sensitive categories such as health, race, ethnicity, religious beliefs, politics, and gender identity stay out of memory unless the user turns on "Include sensitive topics in memory," and the app notifies the user when a sensitive topic is saved. Government IDs, Social Security numbers, criminal history, and immigration status are blocked permanently under Anthropic's acceptable-use rules. 7

The practical effect is a continuous data path between research and execution. A conference agenda drafted in chat can already carry headcount, city, and speakers when Cowork opens the same project. That convenience is also a retention decision. A personal Free or Pro account that leaves memory on will keep accumulating project facts unless someone edits Topics. A Team or Enterprise org that leaves the default off will keep agents under-briefed until an admin turns memory on with a policy.

The inspectable checklist is short. Open Topics and delete anything that should stay out of the next task. Decide the sensitive-topics toggle separately for personal and work accounts. For organizations, treat the default-off setting as a starting policy: document who may enable memory, which projects may use it, and how often Topics get reviewed.

The bottom line

Four questions match the four surfaces:

Cost and latency path: Which silicon and serving stack will actually answer the request, and when do measured efficiency gains show up in price or response time?
Permission path: Which systems can the agent read, do inherited access controls hold, and where must a human still sign?
Plumbing path: What does the local or remote runtime bind to, who can reach it, and what tools can a poisoned model still call?
Memory path: What does the assistant keep, where does that context reappear, and who can edit or disable it?

August 25 put those questions on four different products. The shared task is the same as last week's: verify the mechanism around the model before treating a launch claim as an operating choice.