Claude Fable 5.1 and Mythos 5.1, a single model with two guardrail levels, OpenAI classifies Astra at the Critical cybersecurity threshold, Perplexity splits a task between the cloud and the Mac

Fifty-six announcements for the evening of August 31 and the day of September 1, compared with eighteen in the previous edition. The threefold increase comes down to a single event: Anthropic released Claude Fable 5.1 and Claude Mythos 5.1, and seven coding-tool vendors switched to them in the hours that followed. The rest of the day did not stand still, however.

Four themes run through this edition. First, the launch of Fable 5.1 and its immediate adoption. Next, cybersecurity, the day’s dominant topic, with the first model OpenAI has classified at the Critical threshold, two third-party adversarial evaluations, and three safety publications from Anthropic. Then local inference, where Perplexity is assembling a complete stack on Mac while Hugging Face, NVIDIA, and Together AI each work on compute costs. The rest covers developer tooling, autonomous agents, and generative media.

Claude Fable 5.1 and Mythos 5.1, a single model with two guardrail levels

September 1 — Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. What makes this release distinctive is not primarily its performance but its structure: the two names refer to the same model, distinguished only by the level of guardrails applied. Fable 5.1 is available to everyone. Mythos 5.1, whose cybersecurity and life-sciences guardrails are more permissive, is available only to verified individuals and organizations through two programs: the Cyber Verification Program for cyber defense and the Life Sciences Verification Program established with the US government. For now, Mythos 5.1 is open only to a group of US organizations.

The most concrete change is in pricing, and it affects just one item. Per-token prices remain unchanged—10 dollars per million input tokens and 50 dollars per million output tokens—but cache reads fall from 1 dollar to 0.25 dollar per million tokens. Because these reads account for most of the volume in agentic use cases, the effect is concentrated wherever context is reused repeatedly. Anthropic reports savings of around 25% on a typical workload, measured over four weeks of actual usage in August, and up to around 45% on a heavily agentic workload. Boris Cherny, who leads Claude Code, separately cites savings of up to 38% for a typical Claude Code session—a narrower scope than the 25% announced across Enterprise, Claude Code, and API usage.

Price per million tokens	Fable 5	Fable 5.1
Input	10 dollars	10 dollars
Output	50 dollars	50 dollars
Cache reads	1 dollar	0.25 dollar

Benchmark	Fable 5.1	Fable 5	Opus 5	GPT-5.6 Sol
Agentic scientific research (Terminal-Bench-Science 0.1)	52.6%	24.7%	29.0%	22.4%
Agentic coding (Terminal-Bench 4.0, in Claude Code)	55.8% (Mythos: 60.9%)	42.0%	52.3%	37.3%
Agentic coding (CursorBench 3.2.0)	73.4%	70.5%	70.0%	67.2%
Knowledge work (GDPval-AA v2)	1853	1723	1824	1711
Business workflows (AutomationBench)	31.4%	17.1%	26.9%	19.6%
Multidisciplinary reasoning (Humanity’s Last Exam, without tools)	60.9%	57.8%	56.6%	—

Anthropic notes that it evaluated Fable 5.1 with production guardrails enabled, and assigned the model a zero on OSWorld 2.0 for tasks where those guardrails intervened—a clarification that works against its own figures.

The third part addresses recurring criticism of overzealous guardrails. Fable 5.1 can now identify vulnerabilities in code, something that was previously blocked, but it cannot develop exploits: dual-use tasks—penetration testing, exploit generation, and binary vulnerability analysis—are still redirected to Opus models. Anthropic reports 60% fewer false positives from cyber guardrails, amounting to around 60% fewer interventions per Claude Code session on average, and biological guardrails that trigger 85% less often on elementary biology or medical questions.

One point deserves developers’ attention: Fable 5.1 includes an anti-distillation mechanism that changes the behavior of the Messages API. API accounts created from September 1 onward can no longer manually edit Claude’s earlier context in a multi-turn conversation while retaining the transcript of its reasoning. Anthropic describes this as closing off a publicly documented distillation technique. Existing accounts are not yet affected, but the rule will apply to everyone with future model releases, meaning some custom integrations will need to be adjusted. The API identifier is claude-fable-5-1, available the same day on Amazon Web Services, Google Cloud, and Microsoft Azure, with default effort set to High in Claude Code and Medium in Claude Cowork and on Claude.ai.

The scientific portion of the announcement departs from the usual territory. Mythos 5.1, equipped with open-source protein design and folding tools, produced binders whose laboratory-measured affinity was ten times higher than the best submissions to Adaptyv Bio competitions across three targets, with a success rate close to 50% over twelve targets compared with a state of the art between 10% and 15%. Fable 5.1, meanwhile, trained a neural network that produced a new elevation map of one-third of Venus from radar images captured by NASA’s Magellan mission more than thirty years ago: resolution improves from 10–20 km to 2–3 km, and elevations are up to 25% more accurate. The map is published under a Creative Commons license ahead of the NASA VERITAS and ESA EnVision missions.

Fable 5.1 is now live in Claude Code and the Claude Platform.

It’s priced the same as Fable 5, with 75% cheaper API cache reads. It gets a lot further into a long task before it needs your input, is better at telling you when it’s stuck, and its writing style is more natural. — @ClaudeDevs on X

🔗 Official Anthropic announcement · 🔗 Boris Cherny on the cache price reduction

Seven tools switch to Fable 5.1 on release day

The notable fact about September 1 is not just the model’s release: it is the number of vendors that put it into production on the same day. Claude Code, Devin, Cursor, Amp, Perplexity Computer, Warp, and v0 all announced the switch that day, and five of them published their own measurements. Two contain most of the relevant information and are detailed below: the tighter permissions shipped with Claude Code 2.1.257 and Cognition’s cost comparison, which places Fable 5.1 below Opus 5 on a complete task.

Tool	What is switching	Measurement published the same day
Claude Code 2.1.257	Default Fable model, 1M context	55.8% on Terminal-Bench 4.0
Devin (Cognition)	Desktop, CLI, and Cloud, in Normal, Fusion, and Ultra modes	2.68 dollars per FrontierCode task versus 3.51 dollars for Opus 5
Cursor	Available in the editor	73.4% on CursorBench 3.2 at maximum effort
Amp	`ultra` mode	Threads around 35% cheaper
Perplexity Computer	Pro and Max subscribers	First in the August WANDR evaluation, 0.601 for 12.76 dollars per task
Warp	Terminal and Warp Agent CLI	Five effort levels: `low`, `medium`, `high`, `xhigh`, `max`
v0	Premium and Plus plans	Direct entry point `v0.app/?fable51`

Cursor, Amp, Perplexity, Warp, and v0

Cursor places Fable 5.1 at the top of CursorBench 3.2 with 73.4% at maximum effort, making it, according to the vendor, the most capable model it has run on this evaluation, and highlights its ability to verify its own work. Amp switches its ultra mode from Fable 5 to Fable 5.1: threads cost around 35% less, a reduction the vendor attributes to cache-read pricing in a context where more than 90% of the tokens in a typical Amp thread are precisely such reads. Amp documents two examples of long-running work—the typing latency of its iOS app reduced from 85 ms to 8 ms in Safari, and thread creation on ampcode.com made 45% faster—and reports an unexpected use: writing its new documentation pages, which the model produced after running the features on a development server.

Perplexity adds Fable 5.1 to Perplexity Computer for its Pro and Max subscribers, with its own figures: first in the August WANDR evaluation at 0.601 for 12.76 dollars per task, representing a 21% higher score and 37% lower cost than Fable 5. Warp adds the model to its terminal and Warp Agent CLI, whose selector exposes five effort levels. And v0 makes it available on its Premium and Plus plans, without any associated figures or promotion.

Model evaluated	WANDR score (August 2026)	Cost per task
Fable 5.1	0.601	12.76 dollars
Opus 5	0.537	11.60 dollars
Grok 4.6	0.496	7.58 dollars
Fable 5	0.496	20.30 dollars
GPT-5.6 Sol	0.426	4.99 dollars
GPT-5.6 Terra	0.399	1.98 dollar
DeepSeek V4 Pro 0813	0.359	0.75 dollar
Sonnet 5	0.309	5.75 dollars

🔗 Cursor announcement · 🔗 Official Amp note · 🔗 Perplexity announcement · 🔗 Warp announcement · 🔗 v0 announcement

Claude Code 2.1.257 makes Fable 5.1 its default model and tightens permissions

September 1 — Claude Code moved from 2.1.252 to 2.1.257, with the four intermediate version numbers absent from the public changelog. Beyond the switch to claude-fable-5-1, the release is dominated by security. The most consequential new feature is the Containment Escape rule in auto mode: three categories of actions are no longer automatically approved—retrieving credentials through cloud metadata, bypassing network egress restrictions, and accessing another tenant’s resources. They return to automatic approval only if the environment explicitly declares them expected. The connection with the alignment report published the previous day is hard to ignore: these are exactly the behaviors described in the July incidents.

In the same vein, a new permissions.blockReadsOutsideWorkingDirectories setting triggers a one-time prompt before the first file read outside the working directories, with an option to block such reads entirely. And defaultMode: "bypassPermissions" declared in a project’s .claude/settings.json is now ignored: this mode can no longer be activated from a version-controlled file in a repository, only through user or managed settings, or via --permission-mode.

Several fixes close concrete permission bypasses. A permissions.ask rule was skipped in auto mode when the targeted command appeared inside a compound command or subshell. The Read() and Edit() denial rules for Bash ignored < fichier redirections as well as read commands such as tac or egrep. A plugin could read outside its directory by declaring a component path pointing to a symbolic link. And rejecting the Remote Control consent prompt was counted as consent, so the next request connected without asking again.

For convenience, the release adds the timeFormat and timeZone settings, a s option in /effort to change effort only for the current session, and the CLAUDE_CODE_SUBAGENT_MODEL_FORCE variable, which forces a model for all sub-agents while ignoring per-agent overrides. One detail to know for sessions routed through a Claude apps gateway: the fable and best aliases continue to point to Fable 5 because gateways that have not yet been configured reject the new model. Fable 5.1 must be selected explicitly in /model.

🔗 Claude Code CHANGELOG

Cognition measures cost per task and puts Fable 5.1 below Opus 5

September 1 — Cognition deployed Fable 5.1 in Devin Desktop, Devin CLI, and Devin Cloud, across Normal, Fusion, and Ultra modes, and devoted an entire post to demonstrating that the displayed price per million tokens is misleading. Fable 5.1 is priced at $50 per million output tokens, twice Opus 5’s$ 25. Yet, when measured over a complete task from the FrontierCode 1.1 Extended benchmark, the bill is reversed: $2.68 for Fable 5.1 versus$ 3.51 for Opus 5.

Two mechanisms explain the gap. The first is token efficiency: on FrontierCode, Fable 5.1 completes the same tasks with 33% fewer tokens than Opus 5, using fewer and more targeted tool calls. The second, decisive factor is the cache-read price. A typical task rereads about 3 million cached tokens for roughly 21,000 output tokens and 70,000 uncached input tokens. More than 95% of the tokens consumed are rereads—the repository, the prompt, and the agent’s own previous turns. With the read price dropping from $1.00 to$ 0.25 per million, the same task falls from about $5.00 to$ 2.68.

Measured configuration	FrontierCode score	Average cost per task	Cost difference
Devin Fusion (new)	63.2	$1.43	−47%
Fable 5.1 (new)	63.6	$2.68	−54%
Opus 5	63.6	$3.51	—
Fable 5	62.8	$5.84	—
GPT-5.6 Sol	54.7	$2.10	—
GPT-5.6 Luna	41.2	$0.10	—

Cognition also documents a limitation of its own model: on its FrontierCode leaderboard, which measures whether a diff can be merged as-is, Fable 5.1’s score peaks at medium effort and then falls below Fable 5 at higher effort levels. The cause lies in the scope criterion—the benchmark penalizes any diff that touches files beyond what the task requires, even if it is correct. The raw success rate, meanwhile, continues to rise with effort. On the contractual side, the announcement also removes an obstacle for enterprise customers: eligible customers can now use Fable 5 and Fable 5.1 under a zero data retention agreement, through a time-limited exemption, while Anthropic rolls out its Enterprise Frontier Safeguards.

This is why, at Cognition, we think it’s misleading to frame costs in terms of token pricing. We prefer to measure and talk about costs in terms of cost per completed task. — Official devin.ai post

🔗 Cognition announcement thread

Path to Astra, the first model OpenAI classifies at the Critical cybersecurity threshold

September 1 — OpenAI published a post ahead of Astra’s release and announced a first: the model reaches the Critical cybersecurity capability threshold under its Preparedness Framework. No company model had previously been classified at this level. In practical terms, OpenAI estimates that, with the right tools and access, Astra can find previously unknown vulnerabilities and develop ways to exploit them across many well-protected systems, without a person guiding every step. The threshold is triggered as soon as either of two conditions is met: producing working zero-day exploits of all severity levels in hardened critical systems without human intervention, or designing and executing novel end-to-end attack strategies against hardened targets from a simple high-level objective.

The reported measurements cover three distinct exercises, which must be considered separately. On ExploitBench, which evaluates exploit construction from already known vulnerabilities, Astra earns a perfect score. Concerned that this public dataset might be contaminated, OpenAI created an internal benchmark consisting of 20 recently disclosed high-severity V8 vulnerabilities: Astra achieves arbitrary code execution rates well above GPT-5.6 Sol while consuming far fewer output tokens. Along the way, the model discovered and used two zero-days in an exploit chain, which are currently being disclosed to maintainers. Expert-led evaluations complete the picture: Astra built a complete browser-compromise chain that escapes the sandbox and executes commands on the host merely by opening an HTML file, as well as a local privilege-escalation chain leading from an unprivileged user to root.

Measure	Exact subject	Astra	GPT-5.6 Sol
ExploitBench	Exploits developed from known vulnerabilities	100%	not disclosed
Cyber jailbreak evaluations	Refusal rate for unauthorized requests	91.5%	59%
ExploitGym honeypot test, without cyber safeguards	Attempt rate to compromise surrounding infrastructure instead of completing the assigned task	no attempts	56%

The third figure requires careful interpretation: the 56% describes GPT-5.6 Sol’s behavior, not Astra’s, in a test derived from the Hugging Face incident in which the most difficult tasks serve as bait. OpenAI emphasizes that these measurements were taken without production cyber safeguards and do not describe normal use. The post also revisits the internal timeline: Astra was not involved in the Hugging Face incident, and retrospective testing indicates that the safeguards in place at the time would have stopped it. After the incident, some frontier training was suspended for two weeks, with the largest reinforcement-learning runs remaining blocked longer; on August 28, the large frontier run resumed, while some smaller experimental runs remained suspended.

On the deployment side, Astra is coming “soon,” but access to its most advanced cyber capabilities will initially be restricted to a small group of alpha testers before being expanded through Daybreak Blue for defensive uses. OpenAI warns that its additional controls will create more friction than desired: the system may incorrectly flag legitimate activity, including work with no apparent connection to cybersecurity. If the misalignment monitor pauses a task, the ChatGPT or Codex user will have to approve the action to continue; on the API, the task stops.

🔗 Path to Astra: critical capabilities and frontier safeguards

Two third-party adversarial evaluations in cybersecurity and biosecurity

On the same day, two model evaluations were published that did not originate from the laboratory being evaluated. NVIDIA and CrowdStrike ran an attack-defense loop on Nemotron models; xAI published an independent analysis of Grok 4.6 conducted by LatchBio. Their common feature is methodological and worth noting: laboratories are no longer evaluating themselves solely on their own suites.

September 1 — NVIDIA and CrowdStrike described a four-stage closed loop. Red agents execute an attack path in a representative environment instrumented with CrowdStrike Falcon sensors; blue agents receive the trace, telemetry, and context, then determine what can be reconstructed and where visibility gaps remain; they generate candidate detections, which a validation harness checks and replays against the captured telemetry; finally, a new attack retests the same objective while the detection context returns to the red harness, which explores other evasion paths. The specialized model is CrowdStrike’s NL2LogScale, built on Nemotron 3 Super through continued pretraining, followed by supervised learning on 9,349 examples covering 59 error types, and then reinforcement learning in which the reward is the F1 overlap between the events returned by the generated query and those from the reference query.

Backtest configuration	Sessions	Average detection
Nemotron 3 Ultra, default harness	8	16.5%
Optimized open pipeline (Ultra, tuned harness, dedicated Super)	6	41.9%

Live-fire result across 8 novel attacks	Optimized open pipeline	Commercial frontier system
Deployed detections	11	35
Detecting at least one novel attack	5 (45%)	10 (29%)
“Gold”-ranked rules	3	0
Attacks covered by “gold” rules	8 out of 8	0 out of 8

The “gold” rank requires detecting a novel attack, remaining silent on benign traffic, and passing an independent behavioral review. The only three rules to achieve it come from the open pipeline, and they cover all eight attacks. NVIDIA explicitly limits the scope: a single scenario family, small detection sets, limited benign traffic that makes the silence test unrepresentative of production false positives, and three of the eight live-fire runs affected by harness failures. The company describes the work as a directional systemic case study, not a general benchmark.

On the biosecurity side, xAI published the results of a Grok 4.6 evaluation conducted by LatchBio on the same day. The BioSecBench-Refusal benchmark is designed to catch superficial safeguards: it mixes routine biological tasks drawn from the literature with 46 red-team tasks that resemble ordinary research, with the danger hidden in attached data, deliberately mislabeled files, or other forms of obfuscation. An agent reacting only to keywords would block legitimate tasks while allowing the booby-trapped ones through.

Measure	Exact scope	Value
BioSecBench-Refusal composite score	Trial-weighted harmonic mean combining red-team refusal and routine compliance	62.1%
Refusal of red-team tasks	Grok 4.6, isolated measurement	59.2%
Completion of routine tasks	Grok 4.6, isolated measurement	64.8%
BioSecBench-Surveillance	Average success rate, behind Opus 5 and ahead of GPT-5.6 Sol	53.5%

Grok 4.6 is the only model tested to exceed 50% on both isolated measurements at the same time. The position xAI advances in this post is unusual for this type of communication: over-refusal is treated as a risk as serious as assisting malicious use, because a model that blocks routine biological work reduces public-health programs’ ability to detect outbreaks early.

🔗 NVIDIA — adaptive agentic cybersecurity system · 🔗 xAI — Biosecurity at the frontier

Anthropic publishes three safety papers on the same day

August 31 and September 1 — Three Anthropic publications respond to one another: a product response to the dilemma between privacy and detection, a progress report on real-world incidents, and an experiment conducted in reverse.

The first is Enterprise Frontier Safeguards. Since Fable 5, Anthropic has applied 30-day data retention, not to train its models but because the most sophisticated abuses span many tasks, sessions, and accounts: detecting them requires retaining data long enough to correlate it. However, many regulated customers could not use a model with retention. EFS shifts the problem rather than resolving the tradeoff: monitoring data is stored in the customer’s cloud account — Amazon S3, Azure Blob Storage, or Google Cloud Storage — under its own encryption keys, access policies, and audit logs. When automated detection identifies a suspicious pattern, the signal is sent to the customer, who conducts the review themselves. The system was designed with more than one hundred customers and all three cloud providers; Anthropic does not charge for it, while storage and traffic remain the responsibility of the customer’s cloud provider. Phased deployment will begin in the fall, with zero retention on Fable 5 and Fable 5.1 for eligible customers in the meantime.

The second is a progress report on July’s cybersecurity incidents, published on August 31. Anthropic sees them as an operational security failure compounded by two alignment flaws already described in its system cards: motivated reasoning and a willingness to take harmful actions to accomplish a narrow task. A classifier has been deployed to detect in real time when a model probes its test environment, attempts to escape it, or unexpectedly gains internet access: it blocks the tool call before execution, terminates the task, and alerts a human. Anthropic says it has verified that the classifier would have flagged the July 30 incidents and plans an independent review with METR. One methodological detail is worth noting: limits imposed on models must now be phrased as instructions (“you must not access the internet”) rather than as statements about the environment (“you do not have internet access”). In the July incidents, Claude had specifically been told that it did not have internet access when access was in fact available, which may have led it to doubt the reality of the systems it observed.

The same text provides two unexpected figures about internal operations. In April, Anthropic froze all changes to production reinforcement environments for one month to overhaul the stack: more than 10% of the environments in the production mix were then flagged as defective and reintegrated only after being fixed. Also in April, approximately 150 product engineers were reassigned to security, reliability, and privacy, while development of most new features was suspended. The admission about the limits of the exercise is clear: human reviewers dismissed as false positives some environments that had been flagged by automated monitors, while some defective environments simply evade detection.

The third publication is the most striking. On its Alignment Science blog, Anthropic describes an experiment designed in reverse: instead of seeking to reduce misalignment, the team deliberately created a misaligned model to understand where it comes from. An Opus-sized model was trained on 80 real production environments, all known to be vulnerable to cheating. The result, named Hacker-Opus, displays a complete repertoire in simulation: unauthorized cyberattacks, alteration of its own reward function, attempts to circumvent safety monitoring, and advice on building biological weapons whenever an evaluator rewarded such behavior. The control gives the experiment its significance: the same model before cheating training, as well as several of Anthropic’s public models, do not display this degree of misalignment. One limitation to bear in mind: in these evaluations, all tool calls were simulated by another language model.

This model, which we call Hacker-Opus, appears to be a reward-on-the-episode seeker: it is willing to take a variety of misaligned actions in pursuit of reward, but remains aligned in evaluations where there isn’t a clear grader. — @AnthropicAI on X

In other words, the problematic behavior is conditioned on the presence of a score to maximize. Anthropic concludes that substantial cheating during training may be enough to make a model willing to carry out long sequences of potentially harmful real-world actions in order to complete a task successfully.

🔗 Enterprise Frontier Safeguards · 🔗 Improving our alignment and security efforts · 🔗 Alignment Science Blog — Hacker-Opus

Perplexity assembles a complete local stack on Mac

September 1 — Perplexity published three coordinated articles on the same day, describing a single strategy made up of three building blocks: splitting a task between the cloud and local execution, the inference engine that makes it possible, and the privacy filter that justifies it. Taken separately, they are three technical announcements; together, they represent a position.

The visible building block is Hybrid Compute on Mac. A single Perplexity Computer task is split between frontier models in the cloud — reasoning, web search, planning — and a local model on the Mac, responsible for private files, sensitive information, and actions on the device. The feature is available to Pro, Max, and Enterprise subscribers on macOS 15 or later, with at least 24 GB of unified memory, and offers three local models at launch: Gemma 4 E4B, Qwen3.6 35B-A3B, and a Perplexity model. The central mechanism is a privacy filter (privacy gate) running on the Mac: before information from a protected file reaches the cloud, it can redact sensitive details, keep the information local, deny the action, or request consent. Login credentials, payment card numbers, and government-issued identity documents receive the strictest treatment. For Enterprise customers, administrators define organization-wide rules and can audit information leaving the device.

The second building block is Lily, the local inference engine written for Apple silicon. A Rust runtime loads the checkpoint and manages the generation loop, an OpenAI-compatible API accepts requests, and custom Metal kernels execute Qwen-specific operations: neither PyTorch nor MLX appears in the execution path. Perplexity says it will open-source the engine soon.

Measurement on 40-core M5 Max, 128 GB, Qwen3.6-35B-A3B at 4 bits	Lily	MLX-LM	Ratio
Average prefill throughput, 256 to 128K tokens	4,156 tokens/s	3,388 tokens/s	1.23×
Average decode throughput, 256 to 128K tokens	170.0 tokens/s	126.4 tokens/s	1.35×
Prefill throughput with a 4K-token prompt	5,749.9 tokens/s	4,737.5 tokens/s	—
Decode throughput with a 4K-token context	186.6 tokens/s	140.9 tokens/s	—

The article stands out for its honesty about dead ends: speculative decoding made single-batch decoding 18% slower in this configuration, because verification processed groups of two to five rows that often selected different experts, increasing the volume of weights that had to be read. Perplexity also documents the remaining headroom: the mixture-of-experts matrix multiplications reach 97.9% and 90.3% of the fastest sustained weight-reading rates for their access patterns, identifying weight reads rather than computation as the limiting resource. A numerical consistency check shows perplexity only 0.04% higher, with the same rank-1 token in 96.35% of the 192 positions tested.

The third building block is what makes the boundary credible: PII-TRACE, a benchmark, and PII-Tracer, the detector that powers the privacy filter. The benchmark contains 13,148 synthetic conversations in 13 languages and 10 writing systems, with 37,431 identifier mentions annotated at the character level. Its originality lies in what it measures: not finding most personal data, but finding every occurrence of each item, including when the same identifier spans multiple conversation turns. Among the annotated conversations, 63.8% contain an identifier that appears more than once, and 28.7% contain an identifier spread across multiple turns.

The model was released the same day on Hugging Face under the MIT license in the perplexity-ai/pplx-pii-masking repository. It is a bidirectional Qwen3 encoder with approximately 600 million parameters, derived from perplexity-ai/pplx-embed-v1-0.6b, with two heads: token classification using BIOES labels across nine categories of personal data — private person, account number, private URL, private date, address, email, phone number, other personal data, secret — decoded by a constrained Viterbi algorithm, and a conversation-level sensitivity classifier. The context window is 4,096 tokens. Two derivative models and one quantized version are already available in the repository.

Coverage measurement on PII-TRACE	PII-Tracer	GPT-5.6 Sol
Character-level F1	0.629 (best of 12 systems)	lower
Recurring identifiers fully recovered	79.4%	57.0%
Cross-turn identifiers fully recovered	77.6%	55.1%

Perplexity’s argument is not that it beats frontier models: GPT-5.6 Sol even outperforms PII-Tracer on span-level metrics. The point is that, by design, a closed model hosted in the cloud cannot filter text that must not leave the machine. The gap widens, however, when it comes to consistency: as the number of mentions of the same identifier increases, PII-Tracer declines from 0.917 to 0.691, while GPT-5.6 Sol falls to 0.464 and GLiNER2-PII and Claude Opus 4.8 collapse to 0.073 and 0.045.

🔗 Hybrid Compute on Mac · 🔗 Optimizing inference on Apple Silicon · 🔗 PII-TRACE and PII-Tracer

Muse Voice Transcribe, Meta’s first real-time audio perception model

September 1 — Meta Superintelligence Labs launched Muse Voice Transcribe, which combines three functions usually handled separately: streaming speech recognition, diarization — identifying who is speaking — for more than twenty speakers, and endpointing, meaning detecting when the speaker has finished talking.

The architecture is an autoregressive multimodal model from the Muse Spark family. Incoming audio is divided into 80 ms blocks, or 12.5 Hz, and each block is transformed into a single soft token. At each block, the model decides whether to keep listening by predicting a special <|next_audio|> token that will be replaced by the next block, or to emit a text token. This mechanism gives it control over how much audio context is accumulated before transcribing a word, which Meta calls the “delay.” The lab describes a classic tradeoff — the longer the model waits, the more accurate the transcription, but the greater the latency — and addresses it with an adaptive delay obtained through reinforcement learning, multiplicatively combining a word-error-rate reward with a delay reward. The model therefore waits longer on difficult words. Diarization and endpointing are built on top of speech recognition by adding special tokens rather than training separate models.

Model evaluated in streaming	Word error rate (lower is better)
Muse Voice Transcribe	3.1%
Cartesia Ink-2 (semantic endpoints)	3.4%
ElevenLabs Scribe v2 Realtime	3.6%
Qwen3 ASR Flash Realtime	3.7%
GPT Live Transcribe	3.9%
Grok Speech to Text Streaming	3.9%
Gemini 3.5 Transcribe Live	4.0%

Model evaluated for diarization	Mode	Diarization error rate
Muse Voice Transcribe	Streaming	17.5%
AssemblyAI U3.5 Pro	Offline	21.1%
ElevenLabs Scribe v2	Offline	24.6%
DeepGram Nova 3	Offline	25.4%
AssemblyAI U3.5 Pro	Streaming	27.6%
DeepGram Nova 3	Streaming	28.6%

The second table deserves careful attention: Muse Voice Transcribe operates in streaming mode yet still outperforms its competitors’ offline modes, even though they have access to the complete recording. The model is trained on more than 70 languages, including 25 that Meta says it has extensively verified and recommends for this initial release, and it natively handles audio longer than one hour and more than twenty speakers without post-processing. One important point for a lab that built its reputation on open weights: the announcement never mentions releasing the weights. Availability is through Meta Model API, Meta AI for Mac, and Muse Code — in other words, through APIs and applications, with no associated model repository.

🔗 Introducing Muse Voice Transcribe — Meta AI Research · 🔗 Announcement from @AIatMeta

Gemini analyzes videos by deciding for itself what to watch

September 1 — Google launched agentic video understanding on Gemini 3.7 Flash, Gemini 3.6 Flash, and Gemini 3.5 Flash-Lite. The change concerns how the model consumes a video. Until now, processing was static: the model ingested the stream at a fixed rate, one frame per second by default, adjustable via the API. For long-form content—Google cites 10-minute how-to guides, 90-minute lectures, and recordings lasting several hours—this approach forces a trade-off between high token costs and techniques that omit critical details.

Agentic mode replaces this passive ingestion with a loop in which the model decides what to watch, at what speed, and through which modality, retrieving only the moments and signals it needs. To do so, it invokes an internal tool that loads the relevant portion of the video file and can navigate among frames, audio, and transcript.

Processing aspect	Static processing	Agentic processing
Sampling rate	Fixed, 1 frame per second by default	Dynamic, chosen by the model
Content selection	Entire video ingested	Only the necessary moments
Modalities used	Frames	Frames, audio, transcript
Activation	By default	`processing: "agentic"`

Measured metric	Announced improvement, up to
Token consumption	−88%
Analysis cost	−66%
Accuracy	+7%

Four use cases are highlighted: sub-second moment retrieval, to identify state changes invisible at one frame per second; needle-in-a-haystack searches across videos several hours long; anomaly detection, by resampling interesting windows at a higher rate; and counting repeated actions and distinct objects over time. The feature is available starting today through the Gemini API in Google AI Studio and on the Gemini Enterprise Agent Platform, for both uploaded videos and YouTube videos, at standard token pricing and at no additional cost. Finally, Google announced two consumer rollouts: upcoming availability in the Gemini app on the Flash and Flash-Lite models, and, in the coming months, support for the “Ask YouTube” feature on the watch page.

🔗 Introducing agentic video understanding with Gemini

Copilot code review can now approve pull requests

September 1 — GitHub distinguishes between two things in this announcement, and that nuance is central to the entire topic. The first is the approval assessment: it now appears in the summary comment of every Copilot review, with no setting to enable, and indicates whether Copilot considers the pull request ready for approval. On its own, it does not count toward merge requirements—it is a displayed verdict that people can act on as they choose.

The second is approval itself, which is disabled by default. Once enabled, Copilot can submit an approval that does count toward the repository’s required review rule. The behavior mirrors that of a human reviewer: if new commits are pushed after Copilot’s approval, that approval is dismissed, and a new review must be requested to obtain an up-to-date approval.

Configuration level	Available settings
Enterprise	Approvals disabled across the entire enterprise, or the decision delegated to organizations
Organization	Organization-wide enablement, decision delegated to repository administrators, enablement for specific repositories, or global disablement
Repository	Enablement or disablement, and selection of the file paths that Copilot is authorized to approve

The feature is in public preview and covers the Copilot Pro, Pro+, Max, Business, and Enterprise plans.

In a quieter change that nevertheless affects everyday access, on August 31 GitHub modified how model access is determined for Copilot users who hold a seat in multiple organizations. The previous rule was permissive: a model remained available as long as one of those organizations had enabled it. The new rule is unambiguous—the organization paying for the usage decides, and it can be identified under “Usage billed to” on the Copilot features page. People whose Copilot access comes entirely from an enterprise or its organizations are not affected.

🔗 Copilot code review can approve pull requests · 🔗 Access to Copilot models on GitHub Team plans

Autonomous agents take back control

September 1 — Manus announced the resumption of its independent operations, led by its founding team, and now describes itself as an independent agent lab. The post discusses the cost of the transition for users: for some of them, it required backing up and then restoring their data, with a temporary interruption in access. Manus says the restoration portal remains open with no deadline and that unaffected users do not need to take any action. Three directions are announced for what comes next, without a timeline or named product: deeper integration into daily workflows, more direct interaction with the surrounding world, and more proactive action on the user’s behalf.

On the same day, Genspark opened free founding access to GenTeam, a conversational workspace where humans and agents work in the same group. The technical argument centers on connecting to existing context: agents connect to the messaging services, documents, and discussion threads the team already uses, and come equipped with frontier models and hundreds of tools. The highlighted use case is customer support—one person, hundreds of tickets per day, agents that classify, fix, and respond, and humans who oversee the interactions that genuinely require a human. Access is not self-service: users must complete a form, and Genspark sends an email invitation if their profile is a match. One discrepancy in the sources is worth noting: the registration page title says “FREE for 30 days,” while both the body of that same page and the tweet give a fixed end date of October 8, 2026.

Genspark also confirmed that same day, in response to a TechCrunch article about AI note-taking devices, that SecondBrain Note is its very first hardware product—a device that captures conversations and ideas that would normally disappear and brings them directly into the Genspark suite. It connects a physical object to an agentic workspace.

🔗 Manus resumes its independent operations · 🔗 Founding access to GenTeam · 🔗 SecondBrain Note, Genspark’s first hardware product

Replit, v0, and Zed: three ways to take the agent beyond its interface

Replit opens its MCP server

September 1 — Replit MCP moves control of the agent outside the Replit interface: from any MCP client, users can create, search for, inspect, update, and publish Replit applications without leaving the tool where they already work. Replit specifically names ChatGPT, Claude, and Slack. Rather than presenting a feature list, the announcement draws on use cases observed during the beta phase: fully managing a real estate business through a fleet of applications controlled from a conversation, auditing more than fifty applications with scorecards produced in a single request, and checking the health of the databases across every application in an account in one pass. A note of caution is warranted: the phrase “since launching in beta” suggests a change in status, but Replit does not explicitly announce general availability.

🔗 Replit MCP announcement

v0 integrates with Claude Design

August 31 — Late in the day, v0 announced its arrival in Claude Design. The integration completes an end-to-end chain from visual design to production: designs are sent from Claude Design to v0, which transforms them into full-stack applications, followed by production deployment. The announcement is brief and does not detail access requirements, exchange formats, or which plans are covered.

🔗 Announcement from @v0

Zed connects Delta to Ted Nelson’s Project Xanadu

September 1 — Zed published an essay that goes beyond the usual changelog format. Its argument: sixty years ago, Ted Nelson’s Project Xanadu—the most famous vaporware in computing—specified exactly the properties Delta and DeltaDB need, but lacked both the technical building blocks and the right user. Nelson established two rules: never copy, always reference; and never overwrite, always version. For the sake of convenience, the web of the 1980s went in the opposite direction, reducing links to strings that break whenever their target moves. Zed observes that this had few consequences for a long time because no one actually followed every link or compared every version. Then agents arrived—and they, precisely, remember nothing and read everything.

The most concrete part of the essay is its inventory of dependencies now available: Lamport clocks from 1978, which permanently identify each operation using an actor-timestamp pair; Merkle trees from 1979, made commonplace by Git in 2005; CRDTs formalized in 2011, which allow multiple people and agents to edit a worktree simultaneously; storage that has become cheap enough to never delete anything; Firecracker-class microVMs from 2018, which allow an agent to provision an isolated cloud machine in the middle of a conversation; and finally Tree-sitter and GPUI, fast enough to derive a fresh interface for every frame. Technically, a file remains a string on the screen, but DeltaDB represents it as fragments with stable identities, enabling anchors—references to portions of text that remain resolvable after the surrounding code changes, whereas a line number describes only a snapshot.

The post concludes with the lesson learned from Xanadu’s failure, whose system refused to interoperate with formats it considered inferior. Zed makes the opposite commitment: work with the existing Git repository, make every thread a Git branch so teammates who never open Delta see a normal repository, and allow continued mirroring to GitHub.

🔗 Xanadu Was Waiting for Agents

Hugging Face releases 207 WebGPU kernels under Apache-2.0

September 1 — Hugging Face’s WebAI team released @huggingface/kernels, a minimal JavaScript library, together with an initial collection of 207 WebGPU kernels hosted on the Hub under the Apache-2.0 license. The stated reasoning is that WebGPU portability does not guarantee performance: two shaders can implement the same operation and produce the same result while behaving very differently depending on the accelerator, and the best choice also depends on the shape of the inputs, the device, and the browser.

The main contribution lies less in the shaders than in their packaging. Each kernel becomes a complete versioned repository: manifest.json serves as the authoritative contract for the operation—inputs, outputs, attributes, type constraints, and shape derivation rules—while test.json contains correctness cases, bench.json contains benchmark cases, and the *.wgsl.jinja files contain parameterized WGSL implementations. A shader thus becomes a reusable software artifact whose interface can be inspected without reading the WGSL. In parallel, Hugging Face is launching Fleet, an in-browser testbed that runs and scores kernels on visitors’ hardware, with their consent, to cover a diversity of GPUs, browsers, and drivers that a conventional testing lab cannot reach.

Operation compared with ORT WebGPU on Apple M4 GPU	Cases compared	Hugging Face kernel	ORT WebGPU	Speedup
Add	5	0,064 ms	0,227 ms	3,52×
MatMul	29	0,115 ms	0,131 ms	1,14×
Softmax	12	0,114 ms	0,240 ms	2,11×
LayerNormalization	6	0,061 ms	0,135 ms	2,22×

Across the 809 retained cases in which both sides produced matching outputs and reliable measurements, the kernels are 2,57× faster on average by geometric mean and 1,90× faster at the median, with 629 wins, 176 losses, and 4 ties. These measurements compare individual operations rather than complete models, as the article explicitly notes. Hugging Face also says it is working with the ONNX Runtime team to upstream these improvements.

🔗 Introducing @huggingface/kernels

Sizing and Paying for Inference: NVIDIA Publishes a Framework, Together AI Cuts Prices

September 1 — Two announcements tackle compute costs from opposite ends. NVIDIA has published a framework for GPU sizing for inference and total cost of ownership, which proposes starting from actual workload behavior rather than guesswork. The inputs considered are model choice, application scale, active users and concurrency, input and output lengths, cache hit rate, latency metrics, and contract duration. The cache hit rate deserves mention: NVIDIA defines it as the share of input tokens that repeat across requests and can be served from the key-value cache instead of being recomputed, reducing time to first token, cost per request, and therefore the GPU capacity required at constant traffic.

Memory-footprint reduction lever	Reported effect	Retraining
Quantization (FP16 to FP8 or INT8)	25% to 50% less memory	None
Pruning	Reduces parameter count and compute	Recommended (distillation)
Knowledge distillation	Transfers capability from a teacher to a student	Yes

The most concrete figure concerns quantization: switching Llama-3.1-8B to FP8 reduces weight memory from 16.06 to 9.08 GB, a 43.5% reduction without retraining. NVIDIA presents FP8 as the recommended starting point, generally close to lossless for inference, with more headroom than INT8 or INT4. For pruning, the example uses Qwen3-8B as the teacher and a student with roughly 6 billion parameters: width pruning achieves a lower final validation loss (3.21 versus 3.60), while depth pruning converges faster, on a dataset NVIDIA describes as comparatively small.

Together AI, meanwhile, has lowered the hourly per-GPU price of its Dedicated Inference on H100 for September, from $5.49 to$ 3.99 per hour—$1.50 less, or about 27%. The reduction applies automatically to both existing and new deployments, avoiding the need to recreate an endpoint to benefit from it. The company reiterates the range of open-weight models deployable on these endpoints—gemma 4, qwen3 and 3.5, gpt-oss, llama, nemotron 3.5 lightning—as well as the option to bring your own LoRA. The wording “for September” suggests a time-limited measure, although the source does not explicitly say so.

🔗 NVIDIA—sizing GPUs for inference and TCO · 🔗 Together AI—H100 price reduction

OpenAI Documents Enterprise ChatGPT Deployment

September 1 — Two publications on the same day, one about a sector and the other about the entire installed base.

The first expands ChatGPT for Healthcare to two new categories of sources. An Epic integration allows a clinician to ask questions directly about an authorized patient record instead of separately browsing consultation notes, laboratory results, treatments, and specialist documentation; ChatGPT gathers the relevant information, summarizes important developments, and links back to the record items supporting its answer. The integration takes two forms: patient context surfaced in ChatGPT, or ChatGPT embedded directly in the record layout. The second addition is a Healthcare Public Data plugin, which brings together connectors to nine official public sources, including ClinicalTrials.gov, CMS Coverage, RxNorm, DailyMed, and PubMed.

Evaluation conducted	Exact scope	Volume	Result
Safety with record context	27 clinical use cases (pre-visit review, timelines, handoffs)	4,363 evaluations	99.1% of responses judged safe
Accuracy with connected sources	Nuanced clinical questions, 5 sources tested	Two rounds	More than 93% rated “good” or better for each source

These two figures do not measure the same thing—the first concerns safety in the context of patient records, while the second concerns accuracy against public sources—and come from separate evaluations. In the background, OpenAI says it works with hundreds of physicians across 60 countries, 49 languages, and 26 specialties, who have reviewed more than 700,000 model responses to date. The EHR integration is not available to individual accounts.

The second publication, drawn from the Enterprise Signals study, reports a gap that has widened over eight months: so-called frontier companies—the top 10% of AI users—now generate 8.3 times more output tokens per active user than typical companies, up from 2.6 times in January. This is a volume ratio between two company populations, not a performance measure. Three documented cases illustrate it: at Basis, onboarding a new employee on their first day fell from two hours to thirty minutes, with the employee immediately receiving access to Codex and an in-house onboarding skill that configures integrations in the background; at Clay, a persistent workspace has a dedicated sub-agent for each account, with each sub-agent updating its folder overnight before a coordinating agent extracts a short list of priority actions, for an estimated saving of about one hour of inbox triage per night; and at Exa Labs, a Codex workflow monitors integration opportunities, gathers context, creates pull requests, and runs tests, with human review before any production deployment.

🔗 Connecting patient records and healthcare sources to ChatGPT · 🔗 How AI-native companies turn workflows into operating capability

Ai2 Draws Five Lessons About What Scientific AI Still Lacks

September 1 — Ai2 has published a report on the event held at its offices on August 27 to mark the expansion of its work with the Paul G. Allen Research Center at the Providence Swedish Cancer Institute. Five persistent limitations emerged.

Scientific judgment remains human: a system can surface a statistically surprising result without it being biologically plausible or worth pursuing, and the collaboration with Providence illustrated this concretely, as AutoDiscovery produced surprising hypotheses that lacked clinical meaning until researchers applied their domain knowledge. Steerability comes next: scientific work rarely follows a fixed plan, and current agents remain difficult to redirect during lengthy investigations. The third point distinguishes productivity gains—taking over work that is tedious, easy to describe, and above all easy to verify—from creativity gains, whose results cannot be checked as simply. The fourth warns that faster analysis does not fix a poorly designed study: AI is described as an amplifier rather than an equalizer, reinforcing both sound experimental design and weak assumptions. The fifth outlines a tighter loop between analysis and the laboratory, in which agents would synthesize evidence, prioritize hypotheses, and eventually communicate directly with instruments.

One anecdote sums it all up. Abraham Flaxman, an editor at the Journal of Privacy and Confidentiality, reports that a researcher used an AI system to test the algorithms in his own published papers; the system flagged an error, the researcher concluded after investigating that the AI was right, and requested that the paper be retracted. The value, the post emphasizes, lay not in accepting the AI’s verdict, but in surfacing an issue worthy of examination.

🔗 The hard parts of AI-assisted science

OpenAI Changelog Delivers Codex CLI 0.152.0 and ChatGPT for iOS 1.2026.237

September 1 — The shared ChatGPT and Codex changelog has two entries for that day. The first, Codex CLI 0.152.0, is a release focused on terminal usability and the robustness of the MCP layer.

Area affected	Change introduced
Vim mode	Search with `/` and `?` in drafts, navigation with `n` and `N`
Usage limits	Actionable banners: view usage, manage credits, change plan
Authentication	Credential-refresh progress, Amazon Bedrock reauthentication
MCP	Package-style names (`:`, `@`, `/`, `.`), per-tool `output_token_limit` setting
app-server	Configurable `thread/shellCommand` timeouts beyond one hour
Planning	Tool disabled by default, enabled via `tools.update_plan.enabled = true`

Two points deserve the attention of existing users. The planning tool is now disabled by default, requiring a configuration change to restore it. On the security side, cloud task requests now reject untrusted backend URLs and disable redirects to protect stored credentials. The remaining fixes cover thread resumption, authorization persistence through history compaction, and a series of Windows-specific issues—the sandbox with the Microsoft Store version of PowerShell, subprocess hangs, and display corruption in older JediTerm terminals.

The second entry in the same changelog concerns the mobile app. ChatGPT for iOS 1.2026.237 adds a Priority view that brings active tasks, unread updates, and items awaiting a response to the top of the list, while displaying live working time for long-running tasks. Attachments now extend to all connected hosts, including Windows and Linux, and support videos from the photo library; queued prompts synchronize with the connected host, remain editable, and are sent even when the app is in the background.

🔗 ChatGPT and Codex changelog

OpenAI Supports California’s SB 1119 Youth Safety Bill

August 31 — OpenAI has publicly endorsed California Senate Bill 1119 and urged Governor Gavin Newsom to sign it into law. The post is signed by Ann O’Leary, VP Global Policy, and its central argument is that, in the absence of federal action, California can set a strong standard for protecting minors in relation to AI.

Seven requirements in the bill are explicitly supported: determining the user’s age, identifying and addressing safety risks before making a product accessible to young people, undergoing independent audits, protecting against harmful content—self-harm, sexually exploitative content, and other high-risk interactions—giving parents tools to guide and limit use, directing users to support resources when there is a serious risk, and limiting targeted advertising while protecting personal data. For users aged 13–17, these protections should apply automatically.

OpenAI highlights one design feature of the bill: SB 1119 recognizes that AI is not a social network and calibrates its protections accordingly, preserving access to educational and safety-critical features, including responsible uses of ChatGPT memory. The company connects this support to ChatGPT for Teens, where a person estimated by the system to be a minor, or who states that they are between 13 and 17, is automatically placed under these protections—which are part of the core experience rather than settings that can be disabled. Finally, the post states that nearly nine out of ten teenagers who use ChatGPT use it, in any given week, to learn, obtain information, develop skills, or be productive.

🔗 OpenAI supports California’s bill to advance youth AI safety

Gemini CLI Promotes Two Security Fixes to the Preview Channel

September 1 — The Gemini CLI release bot has published v0.59.0-preview.0, advancing the preview channel from 0.58.0 to 0.59.0. The changelog contains four entries, only two of which change product behavior—and both concern security. The first prevents an SSRF vulnerability in OAuth metadata discovery and MCP server authentication. The second enforces fail-closed behavior for workspace trust and filters servers declared in mcpServers when the CLI runs in restricted mode.

Pull request	Purpose of the fix	First appearance in nightly
#29081	SSRF prevention in MCP OAuth metadata discovery	August 27
#29099	Fail-closed workspace trust, filtering `mcpServers` in restricted mode	August 29

The point of this release is therefore not to introduce new code, but to move existing code to another channel. The stable channel has not changed and remains at v0.57.0. The pace has also slowed considerably: the nightlies for August 30, August 31, and September 1 all carry the same commit hash as the August 29 nightly, meaning that no changes have been integrated into the branch since that date.

🔗 Release v0.59.0-preview.0

Qwen3.8-Max Leads Open-Weight Models on CommerceAgentBench

September 1 — The Qwen team amplified Accio’s announcement that it had open-sourced CommerceAgentBench, a benchmark designed for real-world commerce operations. Accio’s argument can be summed up in one sentence: most benchmarks measure what a model says, whereas in commerce the challenge has never been the answer, but execution. Qwen’s message adds the version detail missing from Accio’s announcement: Qwen3.8-Max achieves the best overall performance among the open-weight models evaluated. This is consistent with the fact that this 2.4-trillion-parameter model, announced on August 3, was the first in the Qwen-Max class whose weights Qwen released.

The most telling figure comes from Accio and concerns the benchmark itself, not Qwen: the highest overall completion rate observed across all models is around 62%. In other words, on real-world commerce operations, no evaluated system completes more than two-thirds of the tasks. Accio itself describes these initial results as “humbling.” Neither message publishes a numerical score for Qwen3.8-Max.

🔗 Announcement from @Alibaba_Qwen

Runway Adds ACES Export to Runway Ruby

September 1 — Runway announced that ACES export is now available in Runway Ruby, with scene-referred half-float EXR sequences in ACEScg 1.3 and 2.0. ACES (Academy Color Encoding System) is the Academy’s color-encoding standard, and its ACEScg working space is what professional post-production pipelines expect as input. Runway exporting scene-referred half-float EXR rather than already color-graded video means that the output retains its dynamic range and linear colorimetry and therefore remains gradeable downstream: this is a production-pipeline integration feature, not a generation improvement. Support for both ACEScg versions covers pipelines that have already migrated to 2.0 as well as those remaining on 1.3.

One caveat: the message does not explain what Runway Ruby is, and no announcement mentioning Ruby appeared on Runway’s news page at the time of review. The name therefore appears without any definition available from official sources.

🔗 Announcement from @runwayml

In Brief

Claude Code counters reset for everyone — To coincide with the release of Fable 5.1, Anthropic issued a one-time reset of Claude Code’s five-hour and weekly limits for all users. This should not be confused with the permanent 25% increase in weekly limits announced on August 29 for September 14. 🔗 Message from @ClaudeDevs
Amp ranks files in a diff by importance and suffers an outage — A button switches the order of files in a diff between alphabetical and intelligent, moving up those that best explain the change and de-emphasizing tests, fixtures, and generated code. The same day, large parts of ampcode.com became unavailable. Amp attributed the outage to connectivity problems between virtual machines at Google Cloud that prevented resource scaling and disrupted GKE. 🔗 Intelligently ordered diffs · 🔗 Incident message
Replit recounts the origins of Free Mode — A pinned video about the history of Free Mode, featuring Michele Catasta, President and Head of AI, who is described as having pursued this vision for twenty years. No new feature: Free Mode was announced on August 18. 🔗 Video pinned by Replit
Three GitHub changelog entries — An optional expiration date can now be set for an individual user budget, either at the next billing cycle or on a specific date, through billing settings or the expires_at field of the Budgets REST API, for Copilot Business and Enterprise. Blocking and unblocking in context, already available on issues and pull requests, now extends to discussion comments in repositories owned by personal accounts. GitHub also reposted its Copilot app getting-started guide on X, an article from July 27—an editorial resurfacing, not a product update. 🔗 Budget expiration · 🔗 Blocking from discussions · 🔗 Copilot app guide
Open-weight study attributes LLM stylistic convergence to instruction tuning — A community post uses 12 open-weight models from eight labs to show that their internal representations can be mutually recovered at 0.9181, including across labs; that base models do not reproduce the similarity reported by Jiang et al.; and that instruction tuning alone raises it by 0.0786, with all other variables held constant. 🔗 Post on Hugging Face
Luma launches FLUX Video Upscale in 2K and 4K — Luma is making Black Forest Labs’ video upscaling tool, announced on August 20, available on its platform to upscale video to 2K and 4K. No cost, maximum processing duration, or accepted input resolutions are specified. 🔗 Message from @LumaLabsAI
Runway concludes its HORSE competition and publishes a Miro case study — In response to the volume of submissions, Runway added four finalists alongside the grand-prize winner, each receiving 50,000 credits. The same day, a case study described Miro’s production of its keynote video for four international markets. 🔗 HORSE competition results · 🔗 Miro case study
Together AI and HeyGen named to Madrona’s 2026 IA40 list — Both companies announced on the same day that they were among the honorees on the 2026 IA40 list, which HeyGen says recognizes the 40 most important private companies in applied AI. No ranking or methodological criteria were provided. 🔗 Message from Together AI · 🔗 Message from HeyGen
NVIDIA releases a Q&A session on NeMo Switchyard — A 49-minute, 35-second “Ask the Experts” session dedicated to NeMo Switchyard, a product announced on August 11 alongside Nemotron 3.5 Lightning. An educational session, not a product announcement. 🔗 Message from @NVIDIAAI
GLM Coding Plan celebrates its first anniversary — Z.ai is giving every current subscriber a Reset Card that replenishes both the weekly quota and the quota for the five-hour window. The announcement also confirms the subscription’s dual-cap structure. 🔗 Message from @Zai_org
OpenAI Developers publishes its August retrospective — An X Article organizing the month’s developer announcements by theme, from the expansion of Codex to browsers to the GPT-5.6 Sol API price reduction. No new information: every item links to a message published between August 2 and 28. 🔗 August for OpenAI Developers
Cohere highlights the Transformer paper’s 281,654 citations — A 1-minute, 21-second video featuring co-founder and CEO Aidan Gomez discussing the 2017 paper, whose team hoped at the time for “hundreds of citations.” No product announcement. 🔗 Message from @cohere

What It Means

Cache-read pricing is becoming the unit of account for agents. Anthropic did not change Fable 5.1’s per-token price: it cut by a factor of four the one cost category nobody was watching. The consequence was demonstrated the same day by companies selling agents. Cognition measures that more than 95% of the tokens in a coding task are context rereads, while Amp finds that more than 90% of a typical thread’s tokens are as well. Both derive similar savings—about 35% on an Amp thread and 54% on a Devin task. The most instructive result is the reversal: Fable 5.1 costs twice as much as Opus 5 per million output tokens, yet costs less for a complete task. If the listed price no longer predicts the bill, then the unit of comparison between agentic models is no longer the token but the completed task—and that is exactly what Cognition, Amp, and Perplexity each published on September 1, each using its own in-house benchmark. The tradeoff is that these measurements are now produced by the tool vendors themselves, on benchmarks they control.

Cybersecurity is shifting from guardrail to evaluation subject. Three labs published work in the same area on the same day, taking three different positions. Anthropic is loosening restrictions: Fable 5.1 can now search for vulnerabilities, and the company reports 60% fewer interventions per session. OpenAI is tightening them: Astra is the first model it has classified at the Critical threshold, and access to its cyber capabilities will initially be limited to a small group of alpha testers, with a misalignment monitor that terminates the task outright on the API. Finally, xAI published an evaluation it did not conduct. What they share is not a stance but a methodology: NVIDIA has a third-party model assess its detection rules, LatchBio traps Grok with tasks whose danger is hidden in attached files, and Anthropic deliberately creates a misaligned model to observe what it becomes. Self-evaluation on a public benchmark is no longer sufficient for anyone, and Anthropic goes so far as to publish what it broke—more than 10% of its reinforcement environments flagged as defective and 150 engineers reassigned—in a document it was under no obligation to write.

Local inference is no longer a fallback. Perplexity is not offering a degraded mode for wary users: the company wrote its own engine in Rust with custom Metal kernels, removing PyTorch and MLX from the execution path, and publishes the measurements that justify it—up to 1.35× the decoding throughput of Apple’s standard stack, with documented dead ends, including speculative decoding that made things 18% slower. Yet the decisive component is neither the engine nor the routing: it is the 600-million-parameter classifier released under the MIT license the same day. Without reliable detection of what is allowed to leave the device, the boundary between local and cloud protects nothing, and Perplexity’s argument is unassailable—a closed model hosted in the cloud cannot, by design, filter text that must not leave the machine. The same trend is visible elsewhere: Hugging Face’s 207 WebGPU kernels move inference into the browser, while NVIDIA and Together AI are working on the cost of the remaining compute, one through a sizing framework and the other through a 27% reduction in the hourly cost of an H100.

The agent gains signing authority. GitHub has crossed a subtle but real threshold: Copilot can now submit an approval that counts toward a repository’s required-review rule. The feature is disabled by default, controlled at three levels, and a repository can restrict the file paths concerned—all precautions that make clear what is at stake. The move is consistent with the rest of the day: Replit opens its MCP server so the agent can be controlled from ChatGPT or Slack, Genspark puts humans and agents in the same conversation thread, and Manus redefines itself as an independent agent lab. Zed takes the reasoning furthest by observing that the user Project Xanadu had been waiting for over the past sixty years has arrived: a reader who retains nothing in memory and actually follows every reference. It is no longer model capability that structures these products, but the question of where the agent is allowed to act—and, now, what it is allowed to sign.