Your dataframes can now anwser graph queries in milliseconds, without a graph database. A Cypher query across 50 account IDs went from 2.7 seconds to 5 milliseconds. Searching 30M timestamps went from 40 seconds to 101 ms. The latest GFQL release adds property indexes, so you can jump straight to the nodes and edges you care about, follow their relationships, and keep the whole workflow inside pandas, Polars, or cuDF. No database to deploy. No separate import pipeline. And these aren't just faster lookups. You can build indexes inside multi-stage graph pipelines and inspect which indexes each query actually uses. Full article below, with benchmarks and runnable examples. pip install graphistry

We’re about to spend most of October on the road, and we’d like to meet you at one of these stops. Here’s where we’ll be: Oct 17: BSidesNYC, New York Oct 19 to 24: BSidesAugusta week, Augusta, GA Oct 27 to 29: [un]prompted II, San Francisco Oct 29 to 30: LASCON, Austin Augusta is the big one. On Oct 21 and 22, Leo Meyerovich and Sindre Breda are teaching a two-day hands-on class on AI agents for security investigations. It’s $595 and registration closes Oct 14. Then on Oct 24, Leo gives a talk on two years of SOC CTF evals for investigation agents. If you’re a SOC analyst, an engineer building agents, or just someone who likes graphs, come find us. Bring a hard investigation, a strong opinion about AI agents, or both. We learn more from what’s breaking for you than from anything we’d put on a slide If you’ll be at any of these, message us and we’ll make time.

GPT-6 Astra and Claude Fable 5.1 are out, and they're pretty compelling if you have the budget. But put them into a real investigation harness, and things get interesting. On CyBT-CTF, 59 incident-response cases worked in Splunk, Astra reaches 69% and Fable 5.1 reaches 61%. GPT-5.6 Sol, an older and smaller model, reaches 76% when running through Louie. The same GPT-5.6 Sol scores just 58% in Codex. Astra is the strongest coding agent we've measured, but only gets to 69% at high thinking effort, at $2.34 per solved case. Fable 5.1 gets 61% at both high and low effort, at $1.19 per solved case. So far, the choice of agent seems to matter at least as much as the choice of model. We haven't run Astra or Fable 5.1 through Louie yet. That's the test we're most interested in next.

The latest botsbench results on the release of GLM 5.3 family are newsworthy not in intelligence for agentic AI investigations, but cost. Run on cybt-ctf, our 59 task SIEM investigation benchmark, we see that Z.ai’s effective answer to OpenAI’s Luna is GLM 5.3 Flash. Also, the story on quants makes GLM 5.3 Flash more interesting as well. As a reminder, just a few months ago, Z.ai’s GLM 5.2 release was the first time we measured an open-weight model performed at frontier levels on botsbench.com investigation tasks. Despite that, OpenAI’s 80% price cuts on GPT-5.6 Luna meant we still preferred OpenAI Luna over GLM 5.2 as both smarter and cheaper. With the new GLM 5.3 family, we are not seeing smarter results on botsbench: the important story is that GLM 5.3 Flash pricing means frontier open-weight AI has effectively caught up to GPT-5.6 Luna in quality and cost. GLM 5.3 Flash means surprisingly little hardware goes a long way. It also gives an extended shelf-life to older GPUs. For the first time, we’re reporting a quant on botsbench: our own GLM 5.3 Flash W4AFP8 that makes it more manageable on older GPUs. Out-of-the-box, GLM 5.3 Flash ships as a 643 GB BF16 release, which typically requires 8 x H200s to run inference. We squeezed to 177GB to run on 2 x H200, with little impact on botsbench scores. For those who are curious, we quantized the routed MoE experts to int4, paired with static float8 activations, and left attention, shared experts and the dense layers at block-float8. The int4 experts are 88% of the weights, so compressing those while leaving the precision-sensitive paths alone cut the size to 177 GB. The main reason we picked this approach was to avoid requiring the small floating-point units only available in recent GPUs, as many of the teams we work with that self-host have GPUs that are a few years old. On GPQA-Diamond the quant scores 90.9% against 91.2% published for the full-precision model. On botsbench, it scored 35/59, compared to 36/59 unquantized. Note that we avoided any cyber-specific fine tuning or abliterations, which bring concerns of overfitting and testing for more unexpected loss of function. Our quant shows general open-weight models are running at quality levels cyber teams would have loved from frontier models last year, and require only a couple older GPUs. Also of note, the top botsbench investigation scores are still from combining the Louie harness with proprietary models - and those lead with a sizeable margin. However, Louie with GLM 5.3 Flash breaks into the top 5 of the global leaderboard, and lands noticeably ahead of regular coding agent harnesses with other models: GLM 5.3 Flash is both good and cheap.

Somewhere between the Black Hat pool parties and our standing-room-only research presentations & AI trainings at BSides, we ran our over-worked botsbench agents on the new Kimi K3 and DeepSeek V4 Flash releases that everyone has been talking about. Continuing our naming tradition, we’re dubbing K3 the disappointing chaotic evil “Coin-Eating Dragon” due to its high cost relative to others in its weight class. DeepSeek, however, wins the crown yet again: it’s the price leader for open weight models on the second-tier side of the open weight spectrum, so we’re calling it the chaotic good “Pauper Prince”. You can read the full breakdown in the full article link below We’ll be reporting more open weight experiments ahead, such as on the harness comparison, and as our Louie harness generally gives a +15% boost to models, how the leaderboard gets disrupted when it enters the picture so follow us to get the reports first. Meanwhile, if you’ll be at SANS Cloud Summit in SF, say hello, and if you couldn’t make our sold-out AI trainings at BSides LV, we’ll be running longer 2-day masterclasses on Ai investigations online through the end of summer / early fall.

With Black Hat and AI4 week kicking off on Monday, our pre-announcements are coming to an end. Here’s everything you may have missed that we unveiled around investigation agents & GPU graph tech: -Louie “ae2” new high score on CyBT-CTF leaderboard: CyBT-CTF, the successor to Splunk BOTSv3 botsbench leaderboard that is contamination-free, has the Louie.ai ae2 harness with OpenAI GPT-5.6 series models beating the OpenAI Codex harness by +19% for the new high score. -Agentic Timelining: AI agents that build “maps” for themselves drastically improve investigation quality, run 3X faster, 3X cheaper, and help with one of the worst parts of investigating. -Generative Visual Graph Investigations: Ask questions, generate visualizations, pull context from Splunk, Kusto, Databricks, and run entire GPU-accelerated graph data science pipelines - even without knowing graph data science! -Run GFQL Cypher on polars, polars-gpu dataframes GFQL can now run property queries directly on Polars CPU/GPU dataframes, no database required! It also now beats most engines on both OLTP low-latency and OLAP scale. 100% open source. -The Graphistry 100X Initiative Our first milestone is a new rendering engine that is the first to handle 20M+ edge interactive graphs in the browser today, and even more scaling ahead. -BSides Las Vegas Talks & Trainings: Our team will be sharing our 2+ year research on handling adversarial AI evaluations - the same issue that led to OpenAI agents autonomously hacking Huggingface – plus two free hands-on trainings covering agentic AI investigations and turning logs into graphs. Several years of engineering and research came together into our week of announcements, and we're excited to finally start getting these capabilities into everyone's hands. If you're heading to Las Vegas next week, come say hello. Look below for links to the videos and articles for each of these announcements

One of the biggest lessons from our AI investigation research is that agents must be master mapmakers: When the Louie.ai research team became the first to not only beat the Splunk Boss of the SOC CTF with AI agents, but fully clear it, one of the biggest “aha!”’s was around agents building and reusing investigation timelines. Task completion rates rose from 70% to 96% and investigations ran roughly 3x faster and with 3x fewer tokens. Today's announcement is bringing that capability to Louie.ai through agentic timelining, and as we’ll discuss in later posts, organizationally-structured long-term memory. The video shows Louie creating a live timeline while investigating across connected databases and APIs. Instead of repeatedly searching the same evidence, agents continuously build a structured understanding of what happened. The result is enabling both you and the agent to explore findings through timelines, visualizations, linked evidence, and follow-on questions. Check out the article below for more on how we think about timelining and long-term memory as key layers in the AI era that make agents run better and help tame how organizations approach investigations. If you're at Black Hat or AI4 week in Las Vegas, say hello and see it in action. We'd love to hear how your team is approaching this problem today.