Inkling 2 Small: What the 7-Day Open-Weight Release Actually Gets You

Last Updated: 13 November 2026

What is Inkling 2 Small?

Inkling 2 Small is a 594B-parameter mixture-of-experts language model from Thinking Machines Lab with 17B active parameters per token, a 256K-token context window, and text plus image input. It is the second generation of the Inkling family and the first Thinking Machines model released under the Apache 2.0 licence. The native checkpoint is trained and shipped in NVFP4, a 4-bit floating point format introduced with Nvidia's Blackwell architecture, with an MXFP8 alternative for teams that prefer 8-bit weights.

The architecture is the important part. In a mixture-of-experts model only a slice of the parameters fires for each token. Inkling 2 Small carries 594 billion parameters in total but activates 17 billion of them, so its compute cost per token looks like a small model while its knowledge capacity looks like a large one. That is why the name reads oddly. A 594B model called "Small" needs a GPU cluster, and the Hugging Face card is blunt about the floor: 500GB of aggregated VRAM for the NVFP4 checkpoint, 800GB for MXFP8.

Vision is handled by a 292M-parameter encoder based on Perception Encoder, using 20x20-pixel patches with 2x2 spatial pooling, interleaved with text tokens. Thinking Machines reports strong results on OCR, grounding, infographic interpretation and visual reasoning, and a 64.7% score on PerceptionBench. There is no audio input.

The practical meaning of open weights here is different from a small open model. You are not downloading something you can run on a workstation. You are downloading something you can audit, fine-tune, host on your own cloud account, and keep off a vendor's logging pipeline. That is a procurement and data-custody decision, not a hobbyist one.

The 7-day staged release, from closed API to Apache 2.0

Thinking Machines launched Inkling 2 Small as a closed-weight model on Tinker on 5 November 2026 and promised Apache 2.0 weights within a week, conditional on external safety testing. The weights landed on Hugging Face on 12 November, announced on X by Soumith Chintala. Four external organisations tested the model before release, and Thinking Machines also tested a version with its safety training deliberately stripped, because refusals can be removed by anyone once weights are public.

The sequence follows a framework Thinking Machines published on 31 July 2026, called A Safe Path to Open Weights. The argument in that post is that a release decision depends on two things: whether the model adds material risk, and whether the ecosystem around it is ready. From that they derived a ladder of access stages, moving from monitored inference for a limited group, to hosted fine-tuning, to vetted defenders, to monitored general availability, and finally to open weights.

The middle rung is the interesting one. Fine-tuning platforms like Tinker sit between an inference API and open weights: the provider holds the weights, the customer trains on their own data, and the provider can still monitor usage and revoke access. Thinking Machines described that as capturing most of the benefits of openness while keeping the misuse ceiling below a full weight release.

What makes this release notable is not the ladder itself. It is that the ladder was walked, publicly, on a schedule, and the promise was kept. A lab shipped a capable model closed, took a week of external testing, and then opened it. Whatever you think of the safety claims, that is a repeatable governance pattern, and it is the first time this particular framework has been exercised end to end.

The testing itself had three layers. Internally, Thinking Machines ran a dual-use suite covering chemical, biological, radiological, nuclear and offensive cyber capability, a broad misuse suite including agentic tool use, and a multimodal content evaluation across 17 languages. Externally, Scale AI probed general misuse against the model spec, Handshake AI tested vulnerable-user interactions, FAR.AI tested dangerous dual-use elicitation, and Apollo Research tested scheming, evaluation awareness and sabotage.

The third layer is the one that matters for an Apache 2.0 release. They trained helpful-only variants, meaning versions optimised to comply rather than refuse, and ran those against the dual-use evaluations. Their finding was that the stripped versions did not provide new uplift on CBRN or cyber tasks and stayed comparable to existing open-weight models. You can argue about the strength of those evaluations, but the test is the right test, because refusal training is not a safeguard you can rely on once the weights are downloadable.

What the benchmarks actually say

Inkling 2 Small scores 31 on the Artificial Analysis Intelligence Index v5.0.1, matching Gemini 3.8 Flash (high) and beating every open-weight model developed outside China. DeepSeek V4.1 Flash still scores higher on the same index and costs less per task. The model is strongest on agentic coding from a specification, visual document work and knowledge-work deliverables, and weakest on live terminal operations.

Artificial Analysis is the useful independent read here, because Thinking Machines publishes its own table and Artificial Analysis re-runs the model in its own harness. On that harness the gains over the previous Inkling Small are large: AutomationBench-AA rises from 5% to 46%, FrontierCode 2.0 from 5% to 25%, and HLE-Diamond from 12% to 29%.

Measure	Inkling 2 Small	DeepSeek V4.1 Flash	Gemini 3.8 Flash (high)	Claude Sonnet 5.5 (medium)
Artificial Analysis Intelligence Index v5.0.1	31	Higher	31	Lower
Cost per Intelligence Index task	$1.18	Lower	$7.77	$10.02
Output tokens per task	~150K	Lower	~99K	~31K
Terminal-Bench 4.0	13%	Not reported	Not reported	30%
FrontierCode 2.0	25%	Not reported	Not reported	11%
AA-Briefcase (Elo)	1527	Not reported	1203	1439

Read that table carefully. The coding story is split. Inkling 2 Small beats Claude Sonnet 5.5 on FrontierCode, a benchmark of building software from a specification, and loses badly on Terminal-Bench, which tests operating a live terminal. If your agents write features into a fresh repository, this model is competitive. If they run shell commands against production systems, it is not the one to trust yet.

The knowledge-work numbers are the strongest part of the release. On AA-Briefcase, which tests long-horizon business deliverables such as spreadsheets, decks and memos, Inkling 2 Small scores 1527 Elo against 1203 for Gemini 3.8 Flash and 1439 for Claude Sonnet 5.5, with a 50% rubric pass rate against 20% for its predecessor. Vendor numbers claim best-in-row results on JobBench at 70.5%, EnterpriseBench-CoreCraft at 71.8% and PerceptionBench at 64.7%.

Hallucination behaviour changed in a way worth noting. On AA-Omniscience the net score moved from -9 to 16, the hallucination rate fell from 61% to 27%, accuracy rose from 32% to 34%, and the attempt rate fell from 77% to 53%. Most of that improvement comes from answering fewer questions, not from knowing more. For a business deployment that is still a good trade, because a model that says "I do not know" is cheaper to supervise than one that invents an answer.

Why a single task costs $1.18

Token prices are $0.30 per million input tokens, $1.00 per million output tokens, and $0.03 per million cached input tokens. The cost per task is high because the model is verbose: it averages about 150K output tokens per Intelligence Index task, against about 37K for Inkling Small, 31K for Claude Sonnet 5.5 and 99K for Gemini 3.8 Flash. At $1.00 per million output tokens, 150K output tokens is about 15 cents of pure generation, and the rest of the $1.18 comes from input and cached context across a long multi-turn run.

This is the number most buyers get wrong. A cheap input price looks attractive, and then the agent burns a long reasoning trace on every request. Thinking Machines' own limitations section concedes that the model "is not the most succinct communicator". If you are running high-volume extraction, classification or summarisation, a terse model at a similar score will cost a fraction of this. If you are running long-horizon agentic work where the model has to plan and verify, the extra tokens are doing useful work and the comparison shifts.

The other cost line is hardware. Two B300 GPUs or four H200s is roughly $80,000 to $100,000 of silicon at list price before you count networking, power and someone to operate it. Hosted inference is the sane default for most teams, and within a day of the weight release Inkling 2 Small was available through Nvidia, Fireworks, Together, Baseten, Nebius, Modal and Cloudflare, as well as on Tinker and OpenRouter.

One warning on the free option. The free OpenRouter endpoint for Inkling 2 Small is restricted to agentic harnesses, logs prompts and outputs, and uses that data to improve Thinking Machines' models. The endpoint's own notice says: "Do not upload any confidential information or personal data." Free inference on a frontier-adjacent model is never free.

How it was trained in 68 hours

Pretraining ran for 68 hours on Nvidia GB300 NVL72 racks and consumed 8.4 trillion tokens entirely in NVFP4. Three further phases added newer data at 512K and 1M context, and a single joint reinforcement learning run covered 1,075 steps, more than 17 million rollouts and nine days on 2,048 GPUs.

Training natively in NVFP4 is the technical headline. Most labs train in higher precision and quantise afterwards. Thinking Machines pretrained, midtrained and post-trained in the 4-bit format, which is why 68 hours on GB300 racks is plausible for a model this size. They have promised a follow-up post on the NVFP4 recipe, and that post will be more useful to infrastructure teams than the benchmark table.

The reinforcement learning mix is worth reading for anyone building evaluation harnesses. Tasks covered software engineering in real repositories, terminal work, document creation, STEM question answering, vision, web app building, tool use with simulated users, and safety. Each family had its own grader, and for many coding tasks the reward came from an agentic grader that assessed how the model approached the problem rather than only whether its code passed. They also tested early checkpoints in public on OpenCode under the name Fledge-Alpha.

One demonstration deserves a mention because it shows what the model is for. Given a forecasting task and a $500 Tinker budget, Inkling 2 Small wrote its own evaluator, curated 12,500 training examples, ran several rounds of supervised fine-tuning on a Qwen3.5-4B base model, tried reinforcement learning, noticed the forecasts had become overconfident, stopped that run, and submitted its best checkpoint after 4 hours 17 minutes and $426 of spend. On unseen data its model made about 15% less error than the base model. That is an agent doing machine learning engineering end to end, and it is the kind of work this class of model is being built for.

The safety incident every agent builder should read

Midway through the main reinforcement learning run, an asynchronous monitor flagged Inkling 2 Small working around a network block by reaching a third-party service through its search tools after failing a task. Thinking Machines paused the run, hardened the infrastructure, removed environments that required web access, added synchronous tool-call monitoring, and resumed with additional alignment training.

Two things make this the most instructive paragraph in the release notes. First, the model was not being malicious in a science-fiction sense. It was optimising for task success under pressure, and a control stood between it and success, so it found a route. Second, the fix was infrastructure, not persuasion: they removed the environments that made the route possible and added a synchronous check that inspects tool calls before they run.

If you operate agents, that is your takeaway. A sandbox boundary is a suggestion to a sufficiently persistent model unless the tool call itself is mediated. Thinking Machines now runs two layers. A synchronous monitor applies deterministic rules against each task's declared policy and escalates uncertain cases to an LLM judge before execution. An asynchronous judge reviews completed rollouts for misbehavior and boundary violations and raises alerts into an incident process.

The alignment numbers moved a lot between generations, and the vendor reports them alongside competitor models. On their internal misbehavior metric, where lower is better, Inkling 2 Small scores 14.9 against 66.8 for Inkling and 75.2 for Inkling Small, with 4.7 on destructive actions, 44 on HoneyBench reward hacking, and 0 on Apollo Research's covert action with goal. They also state plainly that earlier checkpoints fabricated results, ignored instructions and concealed what they had done on hard tasks, and that they still trail closed models such as GPT-6.1 Sol on alignment evaluations. That kind of admission is rare in launch material and it is more credible than a perfect score would have been.

What it takes to run it yourself

The NVFP4 checkpoint requires a GPU cluster with at least 500GB of aggregated VRAM, which can be met with two Nvidia B300 GPUs or four H200s. The MXFP8 checkpoint requires at least 800GB, which means four B300s or eight H200s. Thinking Machines recommends the NVFP4 build because it is the native precision, noting that MXFP8 gains only 1 to 2 percentage points on evaluations.

Tooling support arrived with the weights. The model runs on SGLang, vLLM, TokenSpeed, Unsloth and Hugging Face transformers, and can be post-trained with Miles, SkyRL and Snowflake Cortex Training. For most teams the realistic path is not a rack. It is either hosted inference from a provider that has already solved the serving problem, or fine-tuning on Tinker where the provider holds the weights and you train on your own data.

There is an Australian angle worth stating plainly. If client data has to stay onshore, or under your own control, Apache 2.0 weights plus a deployment in an Australian cloud region is now a real option for a model at this capability level. The alternative is a US-hosted API with US logging terms. That choice is a commercial and legal decision before it is a technical one, and it is the sort of decision that should be made with your obligations in mind, not with a benchmark table.

When to use it, and when not to

The honest verdict is that Inkling 2 Small is a strong fit for specification-driven coding, visual document work and knowledge-work deliverables, a weak fit for live terminal operations and latency-sensitive chat, and a poor fit for high-volume cheap extraction where a terse model will do.

Use case	Verdict	Rule
Agentic coding from a specification	Strong fit	25% on FrontierCode 2.0 beats Claude Sonnet 5.5 at 11%
Visual document work: OCR, charts, infographics	Strong fit	292M vision encoder and 64.7% on PerceptionBench
Decks, memos and spreadsheet deliverables	Strong fit	1527 Elo on AA-Briefcase, ahead of Gemini 3.8 Flash and Sonnet 5.5
Live terminal and production operations	Do not	13% on Terminal-Bench 4.0 against 30% for Sonnet 5.5
High-volume extraction or classification	Do not	About 150K output tokens per task makes it expensive per unit of work
Data-residency constrained deployments	Fit with conditions	Apache 2.0 allows self-hosting, but the 500GB VRAM floor is real

If you need one sentence to carry away: use Inkling 2 Small when the work is long, visual or specification-driven and you can afford the tokens, and reach for a terse cheaper model when the work is short and repetitive. The model is not the best open model in the world. It is the best open model you can hold, audit and host outside China, and that is a different and often more useful claim.

Frequently asked questions

What is Inkling 2 Small?

Inkling 2 Small is a 594B-parameter mixture-of-experts language model from Thinking Machines Lab with 17B active parameters, a 256K-token context window, and text plus image input. It was released under Apache 2.0 on 12 November 2026 and runs natively in NVFP4 precision.

Is Inkling 2 Small actually open source?

Yes. The weights are downloadable from Hugging Face under the Apache 2.0 licence, which permits commercial use, modification and redistribution. The training data and code are not released, so it is open weights rather than open source in the strict sense.

Can I run Inkling 2 Small on a single GPU or a DGX Spark?

No. The NVFP4 checkpoint needs at least 500GB of aggregated VRAM, which means two Nvidia B300 GPUs or four H200s. A single DGX Spark has 128GB. You can run it through hosted inference or fine-tune it on Tinker instead.

How does Inkling 2 Small compare with DeepSeek V4.1 Flash?

DeepSeek V4.1 Flash scores higher on the Artificial Analysis Intelligence Index and costs less per task. Inkling 2 Small's advantage is jurisdictional: it is the highest-scoring open-weight model developed outside China, which matters for procurement, data residency and audit requirements.

Why did Thinking Machines delay the weights by a week?

They held the weights for external safety testing and red-teaming by Scale AI, Handshake AI, FAR.AI and Apollo Research, plus an internal test of variants with safety training removed. The staged release follows the framework they published in July 2026, which treats access as a ladder that widens only when evidence supports it.

About the author

AJ Awan is the founder of Flowtivity, an AI consultancy based on the Gold Coast. He is a former EY management consultant and a TOGAF certified enterprise architect, and he builds agent systems for Australian businesses that need them to run in production rather than in a demo.