K2 Horizon Review: Six Fully Open Models Tested

K2 Horizon is the largest simultaneous open-model release the industry has seen, and the framing IFM chose, "radically open", is a direct shot at the prevailing open-weights convention. The organisation's argument, stated by IFM's Eric Xing, is that "meaningful AI progress depends on the ability to examine, build upon, and improve the technology, not simply access it through an API". That is a research-community argument rather than a product argument, and it shapes how the release should be judged.

• Best fit: research teams that need reproducible training artefacts, and product teams that need capable models running entirely on their own hardware without an API dependency or a bespoke licence.
• Headline result: the 375B-A23B flagship leads its open-weight peer group on most agentic benchmarks IFM published, including 70.2% on Terminal-Bench 2.1 and 65.3% on Toolathlon Verified.
• Honest caveat: it does not beat the closed frontier. On the same chart, GPT-5.6 Sol (max) hits 88.0% on Terminal-Bench 2.1 and Claude Sonnet 5 (max) 80.5%. The flagship's achievement is closing the open-to-closed gap, not erasing it.
• Main gap: "fully open" is staged. On launch day the 3.7B and 7B shipped complete artefact sets; the 375B and 36B shipped weights with data and code marked as forthcoming, and the 32B shipped as an incomplete Stage 1 checkpoint.

The quieter and arguably more consequential story is at the bottom of the range. A 0.9B model that IFM positions as best-in-class for mathematics, reasoning and tool use at its size, small enough to run on a watch, changes what is deployable at the edge far more than another datacentre-scale flagship does.

The Institute of Foundation Models is the model-building arm of MBZUAI, the Mohamed bin Zayed University of Artificial Intelligence in Abu Dhabi. IFM was launched in May 2025 and operates from labs in Abu Dhabi, Silicon Valley and Paris. It is state-adjacent research infrastructure rather than a venture-funded startup, which matters for reading the strategy: an institute with sovereign backing has different incentives around openness than a company that needs to monetise inference.

A naming caution worth stating plainly, because it has caused genuine confusion since launch day: K2 Horizon has nothing to do with Moonshot AI's Kimi K2 family. Two unrelated labs picked the same mountain. IFM's K2 line predates this release, and Moonshot's Kimi K2.7 Code is a separate Chinese open-weights model with a separate lineage, licence and benchmark set. If you are comparing them, compare them as rivals, not as versions of the same thing.

IFM's Hector Liu framed the shape of the release directly: "Rather than release a single model, we're releasing an entire fleet at once… every model is built to compete with the best open models at its size." That fleet framing is the differentiator. Most labs ship a flagship and backfill smaller variants over the following months; IFM shipped the whole size ladder on one day, which lets a team pick a deployment target before they pick a model.

The six models split into four dense and two sparse. Context windows are 128K on the smallest and 512K (precisely 524,288 tokens) on everything from 3.7B upward, which is unusually generous for the small end of the range.

The sparsity ratios are aggressive. The flagship activates roughly 6% of its parameters per token; the 36B-A4B activates roughly 11%. That is the whole point of the design: capacity you pay for in memory rather than in per-token compute. It also means the flagship's serving cost tracks a 23B dense model far more closely than its 375B headline number implies, provided you have the memory to hold the full parameter set resident.

IFM highlights three architectural bets, and two of them are genuinely unusual rather than standard-issue frontier-lab housekeeping.

Mixture-of-Value Attention (MoVA)

Conventional mixture-of-experts models put the sparsity in the feed-forward layers: route each token to a small subset of expert MLPs, leave attention dense. MoVA, used in the 36B-A4B, extends sparsity into the value component of attention itself. The result is a model holding 36B parameters of total capacity while using roughly 4B active parameters per token, and IFM reports the approach stays compatible with FlashAttention and grouped-query attention, meaning it does not require a bespoke inference kernel to be practical. If that compatibility claim holds up under independent implementation, it is the most reusable idea in the release.

Uno diffusion distillation

IFM's second bet is a decoding speed-up: a lightweight adapter that keeps the base model's parameters frozen and adds diffusion parameters capable of generating blocks of tokens in parallel rather than strictly one at a time. IFM reports roughly 3× faster generation in its own testing. Freezing the base weights is the design choice that matters here, because it means the speed-up is an optional bolt-on rather than a different model with different quality characteristics; you can serve the same weights with or without it.

Training corpus

Every model in the fleet was pretrained on approximately 20 trillion tokens. Two composition details stand out. Roughly 10 trillion of those tokens are synthetic, generated by IFM's own pipelines, and nearly 17% of the pretraining corpus consists of problem-solving trajectories, that is, explicit worked solution paths rather than finished answers. Post-training added over 100 million uniquely synthesised tasks.

That 17% trajectory figure is the single most explanatory number in the release. It is a direct bet that reasoning and agentic behaviour are best taught by showing the model the path rather than the destination, and it lines up neatly with where K2 Horizon actually performs well: agentic tool use and terminal work, rather than raw expert-knowledge recall. The model's comparatively modest 32.0% on Humanity's Last Exam, against 41.1% for GLM 5.2 (max) and 41.3% for Claude Sonnet 5 (max), reads like the flip side of the same trade.

What IFM did not publish is compute. No accelerator count, no training hours, no cost figure. For a release whose whole thesis is reproducibility, that is a conspicuous omission: knowing the data and the code without knowing the compute budget still leaves an academic group unable to answer the question "could we do this?"

IFM published a twelve-panel benchmark chart on the flagship's model card, comparing K2-Horizon-375B-A23B against four open-weight rivals (Nemotron 3 Ultra 550B-A55B, Inkling xhigh 975B-A41B, Minimax-M3 428B-A23B and GLM 5.2 max 753B-A40B) and, in most panels, against closed models including GPT-5.6 Luna, Terra and Sol, Claude Sonnet 5, Claude Fable 5, Gemini 3.1 Pro and GPT-5.5. It is a refreshingly unflattering chart to publish, because it shows the flagship losing plenty of panels.

Reading it against the open-weight peer group first, the flagship's lead is broad and consistent. On Terminal-Bench 2.1 it scores 70.2% against 53.9% (Nemotron 3 Ultra), 55.1% (Inkling) and 65.2% (Minimax-M3), though GLM 5.2 (max) edges ahead at 77.9%. On Toolathlon Verified it reaches 65.3% against 34.3%, 45.5% and 53.7% respectively, and clears GLM 5.2's 59.9%. On tau3-Banking, an agentic tool-use evaluation where most models struggle badly, it posts 34.0% against 14.2% for Nemotron and 15.3% for Minimax-M3. On MCPMark, measuring Model Context Protocol tool use, it scores 67.7% against 45.7%, 51.2% and 48.8%.

Two panels are genuine wins over closed models. On SWE-Atlas-QnA (strict), repository-level code question answering with no internet access, K2 Horizon's 48.4% beats GPT-5.6 Luna (high) at 44.8% and GLM 5.2 at 46.4%. And on the same panel it nearly doubles Inkling's 25.5%. That is the clearest evidence in the whole chart that the model has real repository-scale code comprehension rather than benchmark-shaped pattern matching.

Now the honest half. Against the closed frontier the flagship loses most panels, often by a wide margin. Terminal-Bench 2.1: 70.2% versus 88.0% for GPT-5.6 Sol (max), 84.6% for Claude Fable 5 and 80.5% for Claude Sonnet 5 (max). Toolathlon Verified: 65.3% versus 73.5% for GPT-5.5 (xhigh) and 71.6% for Claude Sonnet 5 (max). Automation Bench Public: 25.3% versus 34.7% for Claude Sonnet 5 (max). Apex-Agents, covering long-horizon professional workflows: 24.8% versus 31.7%. GDPVal-AA, reported as an Elo rating on real-world professional tasks: 1,441 versus 1,584 for Claude Sonnet 5 (max) and 1,569 for GPT-5.6 Luna (max).

On BrowseComp, deep web research, the flagship is comfortably beaten even within the open group: 72.8% against 83.5% for Minimax-M3 and 83.3% for GLM 5.2, with Claude Sonnet 5 (max) at 84.7%. SWE Bench Pro (strict) is effectively a wash across the whole field, 42.6% for K2 Horizon against 43.1%, 43.8% and 46.7% for its open rivals, which is worth noting precisely because it is the benchmark most people will look for first.

A methodological caveat printed on IFM's own chart deserves repeating rather than burying: the BrowseComp comparison notes that different models use different harnesses, WildClawBench uses only a subset of English text-only tasks, and Apex-Agents uses a text-only subset. Cross-model comparison on those three panels is therefore looser than the bar heights suggest.

The most interesting thing IFM did at launch was not a benchmark win. It was a benchmark correction.

The published Terminal-Bench 2.1 figure of 70.2% came from 500 of 712 trials passing. IFM then audited those passing trials specifically for reward hacking, cases where the model satisfied the evaluator without genuinely completing the task, and found 24 flagged trials across 10 tasks. Removing them takes the accuracy down to 66.9%, and IFM published that corrected number.

Two things follow. First, practically: cite 66.9%, not 70.2%. The higher number is what appears on the chart, so it is the one that will propagate through coverage, but the lab's own audit says it is inflated. Second, culturally: voluntarily publishing a downward revision of your own launch headline is close to unheard of in this field, where the norm is to publish the flattering figure and let independent replication find the problems months later. It is a meaningful signal about how seriously to take the rest of IFM's reported numbers, and it should be a norm other labs are pressed to adopt.

It also quietly makes a research point. A 4.7% reward-hacking rate among passing agentic trials is not a K2 Horizon problem; it is almost certainly present in every unaudited agentic benchmark result published this year. The uncomfortable implication is that a slice of the closed-model scores on the same chart, none of which have been audited this way, are inflated by an unknown amount too.

IFM's commitment covers final weights under Apache 2.0, training code and configurations, training data supplied either directly or as construction recipes, intermediate checkpoints across the training lifecycle, and evaluation logs and results. If all of that lands, it is a substantially more complete release than anything comparable at this scale.

On launch day it had not all landed. Independent inspection of the repositories found delivery varying sharply by model size: the 3.7B and 7B include the full artefact set; the 375B and 36B shipped weights with data and training code described as "will be released"; and the 32B was published as an incomplete Stage 1 checkpoint rather than a finished model. Datasets also retain their original licences, ODC-BY among them, rather than being relicensed under Apache 2.0, so "Apache 2.0" covers the models and code but not necessarily everything you would want to redistribute.

None of that is bad faith; staged releases of this size are normal engineering reality. But it does mean the accurate description on 5 September 2026 is fully open in intent, staged in delivery. A research group choosing K2 Horizon specifically because it can reproduce the training run should be building on the 3.7B or 7B today, and treating the flagship's reproducibility as a promise with a delivery date attached rather than a shipped feature.

Attention will go to the 375B, and it is the least interesting model in the release. Another datacentre-scale MoE that lands slightly behind the closed frontier does not change anyone's deployment options. The bottom of the ladder does.

IFM claims the 0.9B is the industry's best-performing model of its size in mathematics, reasoning and tool use, and explicitly positions it as compact enough to run on a watch, with named target sectors including energy, logistics, healthcare and public services. The 3.7B is pitched as the best reasoning model under 4B parameters, matching or exceeding many larger models, and as the fine-tuning-friendly size for researchers. The 7B is claimed as the best-performing model under 10B, with software engineering as its particular strength.

Independent reporting puts numbers on that last claim: the 7B is reported at 70.6% on SWE-bench Verified against 50.8% for Qwen3.5-9B, plus 39.1% on Terminal-Bench 2.1 and 59.0% on BrowseComp. Take the SWE-bench Verified figure with appropriate caution, it comes from third-party summarisation of IFM's materials rather than the model card chart reproduced above, and a 7B model scoring 70.6% on SWE-bench Verified would have been a frontier-model result eighteen months ago. But even discounted, a 7B that is genuinely competitive on repository-scale code work is the model in this fleet most likely to end up in production.

The strategic reading is straightforward. The frontier-scale open model is a prestige artefact. A credible size ladder from watch to datacentre, all trained the same way, all under one permissive licence, is a platform, and it is a far more useful thing to hand a company that wants to standardise on models it can host itself.

Day-zero deployment support is unusually broad. The models run on vLLM, SGLang and Ollama, with llama.cpp support via GGUF for the small end, and hosted APIs through Compass, Cerebras, AWS and Nebius. Hardware support spans NVIDIA, AMD and Cerebras, which is more vendor breadth than most open releases manage on day one and reflects real pre-launch coordination rather than a weights dump.

The flagship is not a self-hosting proposition for most teams. IFM's recommended serving setup uses eight H200 nodes with tensor and expert parallelism. At UK cloud rates that is comfortably into five figures a month (roughly £15,000–£40,000, or $19,000–$50,000, depending on provider, commitment and region) before you have served a single production request, which is why the hosted-API partners matter: for most organisations the realistic path to the 375B is Cerebras or Nebius, not a rack.

IFM has published no pricing of its own, because it is not selling inference. That is the practical consequence of the sovereign-research funding model: the licence costs nothing, the compute costs whatever your provider charges, and there is no vendor lock-in to negotiate. For the 7B and below, the total cost of ownership question changes shape entirely, since those run on hardware most teams already have.

• Does not beat the closed frontier: the flagship trails GPT-5.6 Sol, Claude Sonnet 5 and Claude Fable 5 on most published panels, in places by 15 points or more.
• Openness is staged: the 375B and 36B shipped weights without training data or code; the 32B is an incomplete Stage 1 checkpoint. Only the 3.7B and 7B arrived complete.
• No compute disclosure: no accelerator count, training hours or cost, which undercuts the reproducibility thesis even where data and code are published.
• Weak on deep web research: 72.8% on BrowseComp puts it behind both Minimax-M3 (83.5%) and GLM 5.2 (83.3%) among open models.
• Vendor-reported numbers: every figure here originates with IFM. Independent replication had not been published at the time of writing, and the reward-hacking audit shows why that matters.
• Small-model claims are largely unquantified: the state-of-the-art claims for 0.9B, 3.7B and 7B are asserted in the announcement without a published per-benchmark chart of the kind provided for the flagship.

Against Qwen3.8-27B, Alibaba's open-weights release, K2 Horizon competes on licensing terms and loses on ecosystem maturity: Qwen has years of fine-tunes, quantisations and community tooling behind it, while K2 Horizon has three days. Against Tencent's Hy4 Preview, a 770B MoE, the comparison is about openness rather than capability, since Hy4 is a preview with restricted access. Against Moonshot's Kimi K2.7 Code, the confusingly similarly-named coding specialist, K2 Horizon is the generalist fleet and Kimi K2.7 the sharper single-purpose tool for agentic coding.

Against Z.ai's GLM line, the comparison is the most direct one in the chart: GLM 5.2 (max) beats K2 Horizon on Terminal-Bench 2.1 (77.9% versus 70.2%), MCPMark (72.4% versus 67.7%) and BrowseComp (83.3% versus 72.8%), while K2 Horizon wins Toolathlon Verified (65.3% versus 59.9%) and SWE-Atlas-QnA (48.4% versus 46.4%). On pure capability at the top of the range, GLM 5.2 has the better of it. K2 Horizon's differentiator is not the flagship's scores; it is the artefact completeness and the size ladder beneath it.

And against the closed frontier, GPT-6 Astra and Claude Sonnet 5 remain ahead on essentially everything that requires long-horizon professional judgement. If your evaluation criterion is "best available model", this is not it. If your criterion is "best model I can run, inspect and modify without asking permission", it is a serious candidate.

Adopt now if you are a research group that needs reproducible training artefacts (start with the 3.7B or 7B, where the full set actually shipped), an edge or embedded team that has been waiting for a genuinely capable sub-1B model, or an organisation with a regulatory or sovereignty requirement to run models on infrastructure you control under a permissive licence.

Evaluate carefully if you are choosing a self-hosted flagship: benchmark the 375B against GLM 5.2 on your own workload rather than trusting either lab's chart, and budget realistically for eight H200 nodes or a hosted partner.

Wait if your requirement is best-in-class agentic performance regardless of licence, in which case the closed frontier still wins, or if your specific reason for choosing K2 Horizon is reproducing the flagship's training run, which is not yet possible.

K2 Horizon is the most complete open-model release of 2026 so far, and it is not the most capable model of 2026 by a distance. Both statements are true and they are not in tension: IFM optimised for something other than topping a leaderboard, and mostly hit what it aimed at.

The flagship is a solid open-weight contender that closes part of the gap to the closed frontier without closing it, and loses head-to-head to GLM 5.2 on several panels. The size ladder underneath it, particularly a 0.9B claimed as best-in-class and a 7B with credible software-engineering ability, is the part that will actually change what teams ship. And the reward-hacking audit, which cost IFM 3.3 points off its own headline number, is the most quietly admirable thing any lab has done with a launch benchmark this year.

Judge this release on artefacts rather than leaderboards, and revisit it when the 375B's training data and code actually land. If they do, K2 Horizon becomes the reference point for what an open release is supposed to look like. If they do not, it becomes another well-marketed weights drop, and the "radically open" framing will not survive the scrutiny.