A team routing queries across a coding specialist, a logic specialist, and a generalist model assumes each will cover the others’ blind spots. A new study evaluating 67 frontier models from 21 providers shows that assumption is mathematically flawed — and the flaw has a name: the co-failure ceiling.

The assumption works like this: as long as two models don’t usually fail on the exact same prompts, combining them is supposed to create a safety net against failures.

The real limit on orchestration is not how often models disagree, but the percentage of prompts where every model in the pool gives the wrong answer at once. By ignoring the co-failure ceiling, enterprises are building complex, expensive routing infrastructure to chase performance gains that do not exist. Fortunately, developers can use this same math to build a cost-free test that determines exactly when multi-model orchestration will actually pay off.

The hidden costs of the multi-model strategy

To orchestrate multiple language models, developers typically rely on three architectures. Model routers act as traffic cops, sending complex queries to expensive models and simple queries to cheaper ones. Cascades send every prompt to a cheap model first, only escalating to a premium model if the initial system signals low confidence. Finally, approaches like Mixture-of-Agents (MoA) fuse multiple models by asking them the same question and generating a synthesized answer from their combined outputs.

These architectures introduce a “shadow price” to inference costs. Every time a development team implements a router or a cascade, they pay a premium in added system latency, complex infrastructure maintenance, and increased governance risks across multiple API providers.

To justify these operational costs, engineers rely on “pairwise error correlation” to select their model pool. Imagine a developer has Model A, which writes excellent Python but fails at SQL, and Model B, which writes excellent SQL but fails at Python. Because they fail on different types of prompts, their pairwise error correlation is low. The developer assumes that by placing a routing layer in front of them, they have created a composite system that rarely fails at coding.

According to the study, throwing diverse models together based on low correlation can actually hurt performance if the models are not equally capable — when you vote across diverse but unequal models, the weaker ones often gang up and outvote the smartest one.

Josef Chen, author of the paper, told VentureBeat that in their experiments, “Naive majority voting across unequal models had negative mean gain (minus 10 points on our hard mix): diverse-but-weaker members outvote the strong one.” The actionable advice for developers is to “combine only models within a matched quality band.” If you cannot match quality, take the single-model baseline and spend your budget on the best model available.

The paper provides one bright spot for this approach regarding MoA architectures. When building ensembles, teams often use “Self-MoA,” where they query the same premium model multiple times to generate a synthesized answer. The researchers found that at matched quality, building a diverse ensemble of models with low pairwise correlation beats a high-correlation Self-MoA setup.

However, when teams use that same pairwise correlation metric to predict the absolute accuracy of their overall system, the math breaks down.

“So teams pay the orchestration overhead up front (latency, complexity, multi-provider operations) on the assumption that a diversity dividend arrives later,” Chen said. “Usually it doesn’t, because today’s best models agree, and, worse, they fail on the same queries … the prompt simply carries little signal about which model will be the one that’s right when the frontier disagrees.”

Why the math fails: the co-failure ceiling

The core finding of the study centers on a metric called the “co-failure rate” — the formal name for the all-wrong scenario described above. No router, voting system, or cascade can ever achieve an accuracy higher than the ceiling it imposes.

The coding, logic, and generalist pool shows low pairwise correlation on routine prompts — they rarely fail together. But the co-failure ceiling represents the obscure, highly complex edge case that pushes past the limits of current AI architectures. If a prompt is so difficult that all three models hallucinate or fail, it does not matter how intelligently the router distributes the task. The entire pool wipes out at once.

The researchers tested their 67-model pool, which included GPT-5.5, Claude Opus 4.8, and Gemini 3.1 Pro, on the open-ended MATH-500 math benchmark. Based on standard pairwise correlation, statistical models predicted that the entire pool would wipe out simultaneously on only 2.3% of the questions. In reality, the co-failure rate was 5.2%.

Standard correlation metrics underestimated the failure rate by roughly 2.25 times. The culprit is not just independent difficulty, but a shared failure point.

“The driver is what we call a common-mode atom: a slice of queries on which the entire market fails together, which no pairwise statistic can see,” Chen said. “Adding a 20th model to your pool doesn’t buy tail coverage. The tail is shared.”

The researchers also found that task format directly triggers co-failure. When they took graduate-level science questions from the GPQA benchmark and changed them from multiple-choice to free-response formats, the all-wrong tail expanded to 12.7%.

Developers can engineer around the ceiling, though. “The engineering implication is uncomfortable: multi-model setups buy the least exactly where teams want them most, on open-ended generation,” Chen said. “Anywhere you can convert generation into verification or constrained selection (structured outputs, checkable answers, execution tests), you reopen the ceiling.”

Ultimately, the researchers found this ceiling limits AI applications in two distinct ways, depending on the domain:

• Ceiling-bound environments (e.g., open-ended math): The co-failure rate is high. The task is too hard, and all models fail simultaneously. No amount of routing can bypass the lack of underlying capability.

• Realizability-bound environments (e.g., graduate-level science): The co-failure rate is near zero, meaning at least one model in the pool usually knows the answer. However, the models disagree so subtly that a routing layer cannot reliably pick the correct answer without an omniscient oracle.

The $0 pre-deployment sanity check

Before dedicating engineering hours to building a router, teams can calculate their absolute performance ceiling for free using a mathematical formula called a Clopper-Pearson bound.

The Clopper-Pearson bound operates as a worst-case scenario calculator. If you flip a coin ten times and get eight heads, you cannot guarantee the coin will land on heads 80% of the time forever. The bound takes a small sample of test questions and outputs a mathematically guaranteed ceiling.

Applied to language models, suppose a team tests a pool of five agents on 50 sample queries and finds they all fail together on just two questions. A developer might assume their multi-agent system will achieve 96% accuracy in production. The Clopper-Pearson formula corrects this optimism. It analyzes the small sample size and provides a mathematical guarantee that the true co-failure rate could actually be as high as 12%.

To use this in practice, enterprises must build a held-out dataset. A fintech company, for example, could take 200 complex customer support tickets from the previous quarter and have human agents write perfect resolutions to serve as a benchmark. While this sounds like a heavy manual project, mature engineering teams can automate the entire ceiling calculation.

“Integration is trivial: it’s a counting job over eval logs teams already produce,” Chen notes, “so it runs in the same CI stage as the eval suite and re-triggers whenever the model pool or the workload changes.”

The engineering team then runs its candidate models against these 200 tickets once and records the results. When they want to evaluate multi-model configurations, they can use the co-failure rate measure to predict the maximum accuracy they can get from the system without running extra queries.

One important conclusion the study draws is that on tasks where answers can be definitively checked, combining models rarely beats using the single best model on the market, unless the team possesses an exceptionally strong query-level routing signal.

In an enterprise environment, a definitively checked task has an objective, zero-tolerance answer. This includes generating a SQL query that must execute without error, extracting a specific invoice total from a 50-page PDF, or formatting a JSON payload that perfectly matches a strict schema. For these tasks, enterprises are usually better off paying a premium for the smartest frontier model rather than weaving together three cheaper models and hoping a router picks the correct output. The study didn’t test subjective, ungraded tasks like drafting marketing copy — the authors note that whether these findings hold outside their verifiable benchmarks remains an open question.

Because this mathematical check is free, enterprise teams can track their own co-failure rates as new models drop.

“The measurement costs nothing, so any team can track its own co-failure rate across model generations and watch whether the tail is closing,” says Chen. Ultimately, “the lever buyers hold is failure-mode heterogeneity and market churn, not model count.”

For the Emperor: After a few turbulent years and multiple ownership changes, Saber Interactive is now in great shape. The Florida-based studio owes its resurgence to one particular Warhammer title, which, according to Chief Creative Officer Tim Willits, made the company almost too successful for its own good.

Since Warhammer 40,000: Space Marine 2 sold millions of copies, Saber Interactive has become one of the most in-demand studios for building new games around established IPs – so in demand, according to Willits, that the company has had to turn down several high-profile productions. It’s a good problem to have, as Willits himself acknowledged.

Space Marine 2 is the well-received sequel to 2011’s Warhammer 40,000: Space Marine, a hack-and-slash shooter developed by Relic Entertainment and published by THQ. The game once again follows the Adeptus Astartes, a brotherhood of superhuman warriors tasked with enforcing the Emperor of Mankind’s rule over a chaos-ridden galaxy full of hostile races. Released in 2024 for PC and current-gen consoles, Space Marine 2 has gone on to become one of the franchise’s biggest hits, reaching more than 12 million players as of early 2026. Saber has continued supporting the game with regular content drops, including the recently released Purgation Update.

The Warhammer 40,000 universe is enjoying a resurgence of sorts, particularly in video games, and Willits said Space Marine 2 changed everything for Saber, forcing the studio to rethink how it makes games. The title also changed how the industry views the company, which now has a reputation for delivering strong results with licensed IPs.

“And because we have a reputation of really doing well with licensed IPs, every major license holder wants to make a video game. It’s just the way it is. Everybody,” Willits said in a recent interview.

Saber’s CCO said the studio had to pass on a particularly enticing business proposal, though he declined to name the franchise involved. Thanks to Space Marine 2 and other successful releases, Saber is now apparently able to deliver AAA-caliber games without needing a “true” triple-A budget. That’s a massive win and advantage at a time when the industry at large is cutting thousands of jobs while trying to improve profitability.

Saber currently manages several studios and employs around 3,500 people, and the company says it’s still looking for growth opportunities. It’s working on numerous IP-based projects, including Clive Barker’s Hellraiser: Revival, a remastered Hitman Classic Trilogy, and Turok: Origins, among others. Space Marine 3 has also been confirmed and is now in development, following the sequel’s outsized success.

Willits thinks the industry will weather today’s chaos, and that creative people will continue finding ways to make great entertainment despite everything.

A group of news publishers has asked a federal judge to impose sanctions on OpenAI. The New York Times, the Daily News, and others allege the ChatGPT maker is concealing evidence central to their copyright case, the Associated Press reports.

A filing on Thursday in Manhattan federal court claims OpenAI “chose obstruction” over handing over datasets and ChatGPT logs. Those records could show how the system used copyrighted news content to train.

The publishers accuse OpenAI of “discovery misconduct”, saying a recent deposition of an OpenAI employee contradicts the company’s earlier claims. Daily News lawyer Steven Lieberman said OpenAI had spent two years “making misrepresentations” about its ability to search its training data.

The motion asks the court to punish OpenAI for hiding and destroying evidence, in Lieberman’s words. OpenAI did not immediately respond to a request for comment.

The stakes reach well beyond one filing. The Times sued OpenAI and Microsoft in late 2023, and has since been joined by a wave of other newspapers, alongside Ziff Davis and the Center for Investigative Reporting.

Fair use, or free-riding

At the heart of the fight is a simple question with no settled answer. OpenAI argues that training AI on public writing is protected by copyright’s “fair use” doctrine, a defence being tested in dozens of suits from artists, novelists, and music labels.

The Times frames it differently, as unfair competition. It says AI firms free-ride on its costly journalism to build “substitutive” products that answer readers without sending them, or ad money, back to the source.

That threat sharpened when AI-generated search answers began cutting publisher traffic. Courts are only starting to weigh in, with a German court finding Google liable for its AI Overviews.

A costly, forking road

The litigation is expensive. The Times says it has spent more than $28m fighting AI companies, including a separate suit against Perplexity, and now wants OpenAI to cover fees for chasing withheld evidence.

There is a benchmark for what losing can cost. Anthropic agreed to pay book authors $1.5bn, roughly $3,000 per work, a landmark sum that still amounts to a sliver of its valuation.

Not everyone is suing, though. Many outlets have signed licensing deals with AI firms, and even Getty Images struck a pact with a company it had sued, while regulators pursue their own remedies, such as France’s €250m fine against Google.

That split, sue or license, is the industry’s central bet on its own future. A sanctions ruling against OpenAI would not settle the copyright question, but it could hand publishers leverage they have so far struggled to find.

Fidji Simo, OpenAI’s No. 2 executive, is stepping down from her full-time role, the Wall Street Journal reports.

In a staff note Thursday, Simo said her ongoing medical leave has proven longer and harder than expected, and that she’ll transition to a part-time advisory role instead. Simo joined OpenAI’s board of directors in 2024 and joined OpenAI in May 2025 as CEO of Applications, then a newly created role reporting directly to Sam Altman that consolidated the company’s business and product operations.

Her appointment came with a broader reporting shift: COO Brad Lightcap, CFO Sarah Friar, and CPO Kevin Weil all began reporting to her, while Altman stepped back to focus on research, compute, and safety.

Simo first disclosed her health issues in April, when she announced she was taking medical leave for a relapse of a neuroimmune condition; that same memo publicly announced that Lightcap was moving into a new “special projects” role and that CMO Kate Rouch was leaving the company to focus on cancer recovery. Weil has since left the company, too.

Simo came to OpenAI from Instacart, where she’d been CEO since 2021 and led the company through its 2023 IPO, and before that spent over a decade at Meta, including running the Facebook app.

Simo’s decision to step back permanently leaves Altman searching for a successor right as OpenAI itself eyes a possible IPO. She’d been widely seen as a likely candidate to take on even more responsibility once OpenAI went public, making this a real vacuum for him to address.

Simo was primarily focused on growing OpenAI’s consumer business. But ChatGPT’s growth cooled late last year, missing internal revenue targets, pushing the company to lean harder into coding tools instead, an area where it has been, and for now continues to be, trailing Anthropic.

TechCrunch has reached out to OpenAI for more information.

Soon after the Journal story broke, Simo shared the news directly on X, after which Altman responded, also on X: “i am really sad about this and very grateful for all fidji has done for openai, and even grateful for her friendship and who she is as a person. we all wish her the best for a speedy recovery. this sucks.”

Simo’s announcement lands on a busy news day for OpenAI. Earlier Thursday, the company launched its new GPT-5.6 family of models — Sol, Terra, and Luna — alongside a new agent called ChatGPT Work, designed to handle multistep office tasks like drafting documents, spreadsheets, and presentations. Both releases were framed by OpenAI as directly targeting Anthropic.

OpenAI’s executive ranks appear from the outside to be on the thin side for a company that was most recently assigned an $852 billion valuation. In addition to Altman, Lightcap, Friar, and co-founder Greg Brockman (who is also the company’s president and was overseeing product strategy while Simo was out), its bench includes Denise Dresser, who in December joined as the company’s chief revenue officer, overseeing its “global revenue strategy across enterprise and customer success,” per a release at the time.

It wouldn’t be shocking to see Dresser take on a more expansive role, given she previously spent two years as the CEO of Slack and, before that, spent 14 years with Slack’s parent company, Salesforce.

Simo’s departure comes against another backdrop worth understanding: OpenAI’s shifting approach to employee equity. In April of last year, the same month that Simo joined, the company shortened its vesting cliff — the waiting period before new hires’ stock grants begin vesting — from the industry-standard 12 months to 6 months. Then in December, OpenAI eliminated the cliff altogether for new hires, letting equity start vesting from day one.

The move, described internally by Simo as a way to let employees “take risks” without fear of losing equity if let go early, came amid an escalating AI talent war and reflects just how aggressively OpenAI has been spending to retain staff. The company was projected to spend $6 billion on stock-based compensation in 2025 alone.

None of the aforementioned exits appear tied to compensation. Executive equity packages are typically negotiated individually and could have entirely different vesting terms.

In the lead up to the SpaceX IPO, there were dozens of stories about early employees and investors who stood to make millions of dollars for betting on, or working for, Elon Musk.

But thanks to Musk’s work with DOGE, his public comments on X, and the infamous gesture he made at Donald Trump’s inauguration that looked a lot like a Nazi salute, someone realized there was money to be made by avoiding him.

An exchanged-traded fund creator with the appropo name of Subversive Capital has found a way to tap into that negative sentiment with two new anti-Elon exchanged-traded funds.

The ETFs, which are similar to mutual funds, except they are traded like regular stocks, are legally registered by Tidal Trust I and attached to a brand called Subversive Markets Lab LLC. (Bloomberg was the first to spot the filing.)

Avoiding the world’s richest person can be tricky for the average investor, who likely puts their money into mutual funds tied to indices like the S&P 500 and Nasdaq 100. SpaceX, which is in the FTSE Russell and MSCI indexes, was recently added to the Nasdaq 100. That means it’s included in funds that track those indexes. Musk’s other publicly traded company, Tesla, is a longtime favorite of mutual funds, especially the large cap and growth varieties.

The two newly registered ETFs, named Nasdaq-100 Ex-Elon Enterprises ETF and S&P 500 Ex-Elon Enterprises ETF, are designed to block these companies. As of the date of the prospectus, the excluded enterprises are Tesla (TSLA) and Space Exploration Technologies Corp. (SPCX), the filing states. Musk’s other companies, including Neuralink and The Boring Company are not publicly traded.

It is possible that the Ex-Elon funds may exclude other companies that become closely associated with the near-trillionaire, too. The Ex-Elon funds seek “to provide capital appreciation through exposure to a broad universe of large-capitalization U.S. equity securities, while excluding the equity securities of companies that are founded, controlled, or led by Elon Musk, or with which Mr. Musk is otherwise primarily associated,” so the document filed with the U.S. Securities and Exchange Commission reads. 

While these are legit funds that investors will soon be able to trade, there’s also more than a bit of tongue and cheek going on. Prior to the Ex-Elon funds, Subversive earned headlines for its other ETFs that promise to let regular folks “invest like the oligarchy.” One of those funds holds stocks known to be traded by Democratic members of Congress and their spouses, and the other mirrors those held by the Republican side of the aisle.  

It’s too early to say if investors will pile into these Ex-Elon ETFs, which have the tickers QQNE and SPNE, or if they will perform better than funds that include Musk’s companies. But they do reflect a growing appetite for ways to avoid Musk, and, given his famed hostility to traders who shorted Tesla, perhaps even annoy him a little.  

If Muse HiFi is not a brand on your radar, you’re not alone. Founded in 2022, the young manufacturer has been building a focused lineup of affordable DACs and headphone amplifiers aimed at listeners who want better sound without emptying their bank accounts. Its R&D and manufacturing-first approach has allowed the company to deliver surprisingly advanced source components at very competitive prices. The $110 M3 Ultra is one of its newest products, and it might be the one that gets more people paying attention.

Related Reviews:

Technology

When it comes to portable DACs and headphone amplifiers, there is no shortage of technical detail to sort through. For the M3 Ultra, these are the key specifications that matter most:

• Outputs: 3.5mm, 4.4mm
• Input: USB-C
• Output Power: 
  • 460mW @ 32 ohms via 3.5mm
  • 480mW @ 32 ohms via 4.4mm
• Output Impedance: 
  • ~13.5 ohms via 3.5mm
  • ~8.6 ohms via 4.4mm
• DAC: ESS ES9028Q2M
• Amplifier Stage: Dual JAN6418 tubes with ES9603Q
• Decoding: PCM up to 32-bit/384kHz, native DSD256

The important part is that the M3 Ultra is not lacking for output power. With a peak rating of 480mW into 32 ohms, it should have enough muscle for most portable headphones and IEMs, though truly demanding full-size headphones will still benefit from something with more drive and current delivery.

Muse HiFi does not publish official output impedance specifications for the M3 Ultra, but this is something that can be tested at home with the load-resistor method. Using that approach, I measured approximately 8.62 ohms from the 4.4mm output and nearly 13.5 ohms from the 3.5mm output.

That matters.

Output impedance this high can alter the way some IEMs and headphones sound, especially models with more complex impedance curves. In some cases, that interaction can add more bass presence, soften the top end, or shift the overall tonal balance in a more relaxed direction. It is not magic tube dust, and it is not always predictable. The final result depends heavily on the earphone or headphone being used.

I could spend a few thousand words unpacking the relationship between source impedance, headphone impedance, and frequency response, but the shorter version is simple: the M3 Ultra is not designed to be a perfectly neutral, invisible source. Its high output impedance is part of its personality, and for listeners who want their portable setup to sound a little fuller, smoother, and less clinical, that may be exactly the point.

Build

The M3 Ultra uses an aluminum chassis with what Muse HiFi describes as a “floating tube” design. A central cutout in the shell exposes the vacuum tubes, giving the device a distinctive look that immediately separates it from the usual stack of anonymous portable DAC/amps.

It is visually striking, but there is an obvious trade-off. Those tubes are not just there for show, and exposing them also makes the M3 Ultra more vulnerable to impacts, dust, and debris. It looks cool. It also means you probably should not toss it into a bag with keys, coins, and the rest of your daily-carry junk drawer.

One end of the M3 Ultra’s aluminum chassis houses the USB-C input, while the opposite end features its 3.5mm and 4.4mm headphone outputs. All three connectors feel solid, with a secure fit that does not inspire the usual budget-fi anxiety.

The independent volume buttons are located along the long side of the chassis and are also machined from metal. They feel sturdy in use, although they do rattle slightly if the M3 Ultra is shaken. That is not exactly a deal-breaker, but it is one of those small fit-and-finish reminders that this is still an affordable portable DAC/amp.

The M3 Ultra includes a USB-C-to-USB-C cable, and it is actually rather good. It is not especially long, but the length is appropriate for most portable-audio use cases. I had no issues getting a stable connection with any of my devices, including a Google Pixel 10 Pro, iPad, Dell XPS 15 running Windows 11, and an M3 MacBook Pro.

That broad compatibility is a major plus, although I did notice a meaningful increase in power draw compared to some of my more modest USB-C DACs. Compact options like Apple’s USB-C dongle sip power by comparison, but they also offer far less output. Other higher-end solid-state USB-C DAC/amps, such as the Audioengine HXL, get closer to the M3 Ultra’s output capability while still benefiting from the efficiency advantages of an all-solid-state design.

Listening

The M3 Ultra pairs modern technology with a more retro presentation, delivering a warmer, more tube-like experience without many of the common irritations that come with portable analog amplifiers. Muse HiFi’s use of digital noise-cancellation algorithms and physical vibration damping gives the M3 Ultra an impressively quiet noise floor, even with sensitive IEMs like the Campfire Audio Andromeda 10. Ringing is also a non-issue, even when placing the M3 Ultra down on a table with less care than one probably should.

That combination of old-school flavor and modern execution works rather well, allowing the M3 Ultra to compete directly with contemporary solid-state DAC/amps. The built-in ES9028Q2M is a capable DAC, decoding large uncompressed audio files without any issues. Playback is dynamic and clear, creating a useful technical contrast with the amplifier stage’s fuller and more relaxed tonal balance.

The M3 Ultra preserves strong dynamic range while rendering transients cleanly and clearly. I did not hear any obvious distortion, even at higher listening levels or when driving more demanding headphones.

Pairings

Given the high-impedance nature of the M3 Ultra’s outputs, I’ve tested a few pairings with various hybrid/tribrid IEMs in my collection. The breadth of change from ~8 ohms to ~14 ohms is significant, so take that into account when selecting between the 3.5mm and 4.4mm outputs. As a general rule of thumb, the M3 Ultra’s 3.5mm output should sound warmer/thicker due to its higher impedance rating.

Xenns Mangird Top Pro

The Xenns Mangird Top Pro is a well-regarded 10-driver hybrid IEM. It features two dynamic drivers and eight balanced-armature drivers per side, connected across a four-way crossover. With a 16-ohm impedance rating, the Top Pro is a prime candidate for a tangible shift in tonality when paired with a high-impedance source like the M3 Ultra.

The Top Pro is known for sounding dry and somewhat sterile, with a lower register that is primarily focused on sub-bass. When connected to the M3 Ultra’s 4.4mm output, the Top Pro picks up a bit of weight in the lower mids, evening out its otherwise unemotional vocal presentation. Its mid-bass also fills in slightly, reducing, but not eliminating, its dry bass tonality.

Swapping from the M3 Ultra’s 4.4mm output to its 3.5mm output changes things a bit more. The Top Pro’s mids gain additional body, adding some much-needed harmonic fullness to string instrumentation and lower-pitched vocals. Its bass also fills in further, reducing its substantial mid-bass scoop to something far more manageable. In practice, this gives the Top Pro’s bass more presence and authority when rendering bass guitars and deeper string instrumentation.

While I do appreciate the increase in tonal cohesion, the Top Pro’s bass does feel slower and softer compared to how it performs with more traditional solid-state USB-C DACs.

Melody Wings Neptune

The Neptune is Melody Wings’s newest IEM and current flagship. It features a tribrid driver configuration, packing one dynamic, four balanced-armature, and one bone-conduction driver per side via a 3-way crossover. At 19 ohms, it is rated at a slightly higher impedance than the aforementioned IEMs, but not by much.

When paired with the M3 Ultra, the Neptune picks up some much-needed richness in its lower register. This manifests as a subtle improvement in lower-midrange fullness and mid-bass presence. I found the Neptune to be a bit lacking in organic tonality on transparent sources, but the M3 Ultra’s tube-ish warmth and higher output impedance tipped my scales of preference more in the Neptune’s favor.

The Neptune was never a particularly bright IEM, but the increase in weight the M3 Ultra delivers below the 400Hz mark allows it to play against its treble with greater contrast. Tracks like “Hear You Me” by Jimmy Eat World sound tangibly fuller on the M3 Ultra, giving the gentle strumming of guitar strings much more dynamic space to play in.

The Bottom Line

The Muse HiFi M3 Ultra is not trying to be the most transparent portable DAC/amp in the category, and that is really the point. Its appeal comes from the way it combines a modern USB-C DAC section, generous output power, and a tube-based amplifier stage with unusually high output impedance that can reshape the tonal balance of certain IEMs and headphones.

That will not be ideal for everyone. Listeners who want their source to disappear, or who expect every IEM in their collection to sound exactly as intended, should probably look elsewhere. The M3 Ultra has a personality, and it is not subtle about it.

For the right listener, however, that personality is the draw. The M3 Ultra can give some leaner, drier, or more clinical IEMs a fuller and more forgiving presentation, while still offering enough power for most portable headphones. Its aluminum construction feels reassuring at the price, and the exposed tube design gives it a visual identity that most portable DAC/amps lack.

The trade-offs are real. Battery drain is higher than more efficient solid-state dongles, the exposed tube section makes it less friendly for dusty, wet, or rough environments, and its tonal influence will vary depending on the earphone or headphone being used. But for listeners who want a compact source with character, strong output, and a more relaxed tonal balance, the M3 Ultra is one of the more interesting and accessible portable DAC/amps currently available.

Pros:

• Powerful output for a compact portable DAC/amp
• Distinctive tube-based presentation with a fuller, smoother tonal balance
• High output impedance can improve synergy with some leaner or drier IEMs
• Quiet noise floor, even with sensitive IEMs
• Solid aluminum construction and visually striking exposed tube design

Cons:

• Not ideal for listeners who want a transparent, neutral source
• Tonal changes will vary depending on the IEM or headphone pairing
• Higher battery drain than more efficient solid-state USB-C dongles
• Exposed tube design is more vulnerable to dust, debris, and rough handling
• 3.5mm and 4.4mm outputs sound meaningfully different because of output impedance differences

Our Ratings

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Build Quality

★★★★★★★★★★ Features

★★★★★★★★★★ Value

Where to buy:

Related Reading:

Share one API key across five AI agents, and a single compromised agent inherits the reach of all five. The attacker immediately benefits from the accumulated permissions of every workflow that the key touches. The forensic trail goes cold at the credential level because five agents on one account leave no record of which agent did what.

Sixty-nine percent of enterprises run agents with credential sharing somewhere in their deployments, according to VentureBeat’s June 2026 Pulse Research wave of 107 enterprises.

That one number explains the buying spree reshaping enterprise security this year. Palo Alto Networks, CrowdStrike, and Cisco have collectively bet more than $22 billion on it in the past year, targeting exactly the layer most enterprises in this survey haven’t finished building.

Palo Alto Networks completed its acquisition of CyberArk on February 11 for $21.1 billion in total consideration at close — a deal it announced last July at roughly $25 billion and the largest in the company’s history.

CrowdStrike closed its $740 million acquisition of runtime authorization platform SGNL and, by June 15, shipped the first product from the deal, Continuous Identity for AI Agents. CrowdStrike integrated SGNL in less than a year, delivering a product that validates every agent action in real time based on who owns it, who is calling it, and the device’s risk posture.

Cisco announced its intent to acquire non-human identity specialist Astrix Security on May 4 for a reported $400 million.

For a security director, this survey reads as a board-level question, not a trend line. It also surfaces a finding no competitor’s data shows, one that exposes which companies are the most at risk.

The data below is the first look at VentureBeat’s Q2 Agentic Security report, drawn from 107 qualified respondents at organizations with more than 100 employees. The full report will be released to attendees at VB Transform, the event in Menlo Park next week (July 14-15) focusing on enterprise autonomous agents.

Forty-five percent are final decision-makers for AI purchases. The sample skews mid-market, so read the numbers as the view from organizations adopting agent security right now rather than from the largest enterprises.

More than half of respondents, 54%, have already had an agent security incident or near-incident. Eighteen percent confirmed an incident, and thirty-six percent caught a near-miss before a breach. Security teams are stopping most of these events at the last control point in the chain, but the rest of the data shows how thin that margin is.

Your agents are sharing credentials

Only 32% of enterprises give every AI agent its own scoped, managed identity. Nearly half (48%) report that some agents have scoped identities, while many still share credentials. Another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. The survey question allowed more than one selection, and 24 of the 107 respondents chose multiple options — which is why the three categories sum to 112%. Deduplicated by respondent, 74 organizations, or 69%, flagged credential sharing in at least one answer.

One number explains why the acquisitions target this layer. A shared credential converts a single compromised agent into many, and CyberArk’s research puts machine identities at 82 for every human in organizations worldwide, with agents as the fastest-growing category of the ratio. Cisco made the same diagnosis when it bought Astrix, whose founders built the company around API keys, service accounts, and OAuth tokens. Cisco’s announcement calls those the credentials AI agents are now “using (and abusing)” to execute work at scale.

Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, described the mechanism directly in an interview with VentureBeat. Some AI systems have their own identities, he said, and in other cases “people give their identity to the AI to take action on their behalf, and that also further kind of murkies the water and makes it very complex.” The murk is the point, because when the identity is shared, attribution dies with it.

Exposure scales with size, and containment does not

Forty-nine percent of enterprises enforce scoped permissions at runtime, and 47% monitor and log agent activity, which can help reduce security incidents. Only 30% sandbox their highest-risk agents, the one control that limits blast radius when the first two fail. Isolation is what keeps a single compromised agent from becoming a deployment-wide event. Enterprises have funded detection and resistance, but the containment layer barely exists.

The sharpest finding in the survey, and the one no vendor report captures, shows up when you split results by company size. The incident rate is 49% for companies with 101 to 1,000 employees, but it shoots up to 63% for companies with more than 1,000. Sandbox isolation moves the other way, falling from 35% to 20% at the larger companies.

The chart above shows the same finding at finer granularity: the 49%/63% split above is a binary cut at 1,000 employees, while the bars here break incident rate and isolation rate into four size bands. The red line measures incidents and near-misses, and the navy tracks the one control that contains damage after everything else fails. At organizations with 101 to 250 employees, the two sit 7 points apart, but above 5,000, the gap blows out to 60 points. That top band pools the survey’s two largest size groups and holds only 15 respondents, so treat the number as directional. Larger enterprises run more agents across more systems, which drives incidents up while sandboxing, the engineering project that would contain them, goes unfunded. The enterprises with the most agents have the least isolation around them.

The deals target exactly those accounts. Palo Alto Networks, Cisco, and CrowdStrike sell to large enterprises first, where incident rates are highest and containment is the thinnest.

Guarded by whoever shipped the model

The model providers are the security layer. OpenAI’s built-in guardrails lead at 51%. Google Cloud reaches 36%, Microsoft Azure’s Purview and Copilot Studio DLP 35%, and Anthropic’s managed-agent controls 29%. Eighty-two percent of respondents name a provider-native or hyperscaler control as their single primary agent security layer.

The purpose-built specialists are in single digits, with Palo Alto Networks’ Prisma AIRS at 7%, CrowdStrike at 6%, and Okta for AI Agents at 4%. Zenity and the dedicated non-human identity platforms are at 3% each. Microsoft Entra Agent ID is the highest-penetration identity-specific control in the dataset at 13%, the only one from a hyperscaler, and it still falls outside the top four. Only 5% of enterprises run no dedicated agent tooling at all, and the rest have tooling that came pre-installed.

Bundled controls lead because they ship free and are enabled by default. Most filter prompts and outputs, but they do not give an agent its own identity or sandbox it. Hyperscalers sell identity-layer products, and Entra Agent ID is in the dataset at 13%, but adoption stays low. The two controls that reward incident data the most, scoped identity and isolation, are the two that the default stack does not include.

Prompt-and-output filters evaluate whether a call looks malicious. That is an intent problem, and intent cannot be solved at the language layer. CrowdStrike CTO Elia Zaitsev drew the line in an interview at RSAC 2026. “Observing actual kinetic actions is a structured, solvable problem,” Zaitsev said. “Intent is not.” CrowdStrike’s Falcon sensor walks the process tree on an endpoint and tracks what agents did, not what agents appeared to intend. A scoped identity and an isolation boundary give that sensor something to track, while a shared credential on a bundled guardrail does not.

Cloud security went through the same cycle a decade ago, and Palo Alto Networks, CrowdStrike, and Wiz built multi-billion-dollar businesses on the gaps native cloud controls left open. Agent security is tracking the same path faster. A misconfigured storage bucket sat open until a human noticed. A misconfigured agent exploits its own over-permissioning on every run, and no human is watching when it does. Merritt Baer, chief security officer at Enkrypt AI and a former deputy CISO at AWS, told VentureBeat that the default layer is thinner than enterprises assume. “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system,” Baer said. “The real dependencies are one or two layers deeper, and those are the ones that fail under stress.”

Comfortable, unconvinced, and already shopping

Here is the contradiction worth a keynote slide. Enterprises rate their agent security tooling 4.2 out of 5, with value for money at 4.1 and ease of implementation at 3.9. Those scores would make most SaaS vendors envious.

Only 35% believe their AI-enabled defenses are ahead of AI-enabled attackers, while thirty-two percent call it roughly even. Twenty-one percent say attackers lead, and another 21% say it is too early to tell, showing how enterprises trust their tooling more than they trust its outcomes.

Budgets confirm it. Forty-six percent allocate 6 to 10% of the security budget to agent security, and a full third spend 5% or less. Half the sample has already had an incident or near-miss, but the funding does not match the exposure.

Fifty-nine percent plan to adopt, add, or replace agent security tooling within 12 months, and twenty-nine percent plan to move this quarter. OpenAI leads forward interest at 34%, followed by Google at 30%, Anthropic at 29%, and Azure at 25%. The dedicated vendors draw more interest looking forward than their current single-digit footprint suggests. Satisfied customers do not reshuffle this fast unless they know the stack they’re currently using is provisional.

Three moves for security directors

1. Inventory every agent’s credentials this quarter. Map which agents share credentials with other agents and which run on borrowed human or service-account identities. The goal is not one credential per agent. Agents that touch multiple systems need multiple scoped identities. The goal is zero shared credentials between agents and zero borrowed human identities. Thirteen percent of surveyed enterprises already run Microsoft Entra Agent ID. Okta for AI Agents and the non-human identity specialists sell equivalents. Shared and borrowed credentials are the first thing to eliminate.

2. Sandbox the riskiest agents first. Isolation is the least-adopted control at 30% and the only one that contains blast radius after prevention fails. Rank agents by the sensitivity of what they touch and isolate the top of the list. Above 1,000 employees, where isolation falls to 20%, this is the single highest-return move in the dataset. Sandboxing does not require replacing the agent or the platform. It requires a policy decision and an isolation layer.

3. Match the budget to the incident rate. A third of enterprises fund agent security at 5% or less of the security budget, even though more than half have already had an incident or near-miss. Nine percent allocate more than 25% today. The full report breaks out exposure and containment by company size, showing which bands carry the most risk and the least protection.

The board’s question is simpler. If one of our AI agents was compromised this afternoon, which systems did it touch, and whose credentials was it holding? For the 69% of enterprises running agents on shared credentials, the answer is a shrug. The trail goes cold at the key.

The full Q2 Agentic Security report, with the complete vendor matrix, industry cuts, and the full dataset behind these charts, debuts July 14 and 15 at VB Transform, held at Hotel Nia in Menlo Park. The open question it leaves is whether enterprises close the agent security gap on their own terms, or whether a confirmed breach closes it for them.

SambaNova last announced a $350m Series E raise in February.

Intel-backed SambaNova has secured $1bn in funding to expand its AI chipmaking business, as demand for its inference technology continues to grow.

The Series F round, which drives up SambaNova’s valuation to $11bn, was led by General Atlantic, with participation from long-term backer Intel Capital, alongside Cambium Capital, BlackRock and the Qatar Investment Authority.

A&E Investment, Assam Ventures, Battery Ventures, Kabila Capital, QFO Capital, Vista Equity Partners and Volantis also participated in the raise.

The new capital comes at a time of accelerating momentum for SambaNova, which last announced a $350m Series E in February.

In recent months, the company launched its specialised SN50 chips that prioritise token efficiency, and announced a multi-year collaboration with Intel to deliver cost-efficient AI inference solutions to customers and roll out an Intel-powered AI cloud.

The 2017-founded SambaNova has close ties with Intel, whose CEO Lip-Bu Tan serves as chair of SambaNova’s board.

SambaNova said it will use proceeds from the latest raise to expand capacity, accelerate product innovation and scale deployments. Continuing on its growth momentum, the chipmaker plans to continue investing across chips, systems, software and full-stack AI infrastructure.

Alongside the funding, SambaNova has announced JPMorganChase as its latest customer to deploy the SN40 and SN50 chips.

“SambaNova’s platform is differentiated, built for a market where inference has become foundational to enterprise and industry transformation,” said Martín Escobari, the co-president and head of global growth equity at General Atlantic.

“Rodrigo and the team are driving deep technical innovation to achieve growing commercial momentum while demand for inference is accelerating well ahead of supply. We are pleased to lead this round to support SambaNova in shaping the next generation of AI infrastructure.”

SambaNova co-founder and CEO Rodrigo Liang told CNBC last month that “business is growing at an incredibly rapid rate”, adding that he is “really excited” about the current IPO market.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.