Anthropic dissects seven areas of Claude misuse, DeepSeek retires V4-Pro, OpenAI opens up the Codex engine

Sixty-six announcements in twenty-four hours, after sixty-five the day before. On the same day, Anthropic publishes its most detailed threat intelligence report and evaluations of its models on military targeting, DeepSeek releases V4.1-Flash and schedules V4-Pro’s retirement for September 14, and OpenAI opens the agent engine powering Codex in public beta. On that same day, Cognition, Genspark, and Together AI build three Western products on Chinese open weights, GitHub hardens four layers of its toolchain, and NVIDIA lines up five publications.

Anthropic dissects seven areas of Claude misuse and evaluates its models on military targeting

September 10 — Anthropic published two complementary documents on the same day. The first, its most detailed threat intelligence report to date, describes what attackers actually did with Claude between December 2025 and August 2026. The second, authored by the Frontier Red Team, measures what models can do in two military domains that have received little evaluation so far. One recounts the facts; the other quantifies the potential.

The report covers seven areas of harm: cyber operations, influence operations, surveillance, scams, biological misuse, conventional weapons development, and illicit distillation. Two findings shape it. Sophisticated attacks no longer require sophisticated attackers—one hacktivist operating entirely with stolen API keys sustained a month of operations that would have required several skilled operators a year earlier. And AI’s role has become predominantly autonomous: multi-agent frameworks carry out reconnaissance, exploitation, and exfiltration, while the human merely identifies targets and validates the loot. The GTG-20006 case takes this logic to its conclusion: its agents monitored their own implants and recompiled the malware until it once again evaded security products.

Tracked group	Actor profile	Key figure
GTG-20006	Russian espionage, consistent with Midnight Blizzard	More than 24 Ukrainian organizations, more than 300,000 identity records
GTG-50014	Opportunistic ShinyHunters affiliates	1.8 million APKs scanned, 2,100 sets of Azure AD tokens in 34 hours
GTG-10007	Chinese-speaking operators, Changsha	Around 50 organizations, more than 12 potential zero-days in one month
GTG-50020	Russian-speaking, financially motivated	30 AI companies attacked in 4 days, ransoms of 1.5 to 2.5 million
GTG-50021	Fake Claude access reseller, alias kl1zy	Traffic diverted to another model and customer credentials stolen
GTG-50029	French-speaking hacktivist	One month of operations conducted entirely with stolen API keys

The newest section concerns the AI supply chain, which has become a target in its own right. An operator who obtains AI credentials gains three things at once: a resalable commodity, compute billed to someone else, and cover, because the activity is attributed to the legitimate owner of the key. GTG-50020 injected malicious instructions into an AI provider’s automated evaluation sandbox, recovered its production keys, then attacked around thirty AI companies in four days through the same route, with a stated goal: gaining access to an unreleased Claude model. More than a dozen paths were attempted; none succeeded. Anthropic specifies that in all these cases, the keys came from its customers’ environments and that its own systems were not compromised.

We’re publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. — @AnthropicAI on X

🔗 Anthropic threat intelligence report

The second document provides the experimental measurements. Across 6,000 photos from the YFCC100M corpus, without metadata, reverse image search, or tools, Mythos Preview records a median error of 37.0 kilometers and places 23.7 percent of images within one kilometer. The human benchmark comes from a GeoGuessr study: Champion division players, the top 0.01 percent, achieve 151 kilometers. In text-based geolocation, 135 users from a 2010 message corpus were placed within one kilometer by at least one model; 70 percent of them had given themselves away through an explicit mention, but 13 percent solely through their dialect, slang, transit lines, or local teams.

Evaluated model	Photo geolocation, median error	Within one kilometer	Drone strike, 9 settings
Mythos Preview	37.0 km	23.7%	13%
Mythos 5	47.2 km	23.1%	10%
Opus 5	181 km	18.0%	20%
Sonnet 5	384 km	9.9%	0.7%
Kimi K3, open weights	385 km	16.7%	1.6%
Champion division human	151 km	not measured	not applicable

The second part evaluates the models as weapons engineers using a simulated quadcopter running Betaflight firmware, with wind and sensor noise, a front-facing 640x480 camera as its only imaging sensor, and neither GPS nor a rangefinder. Against a stationary, high-contrast vehicle, Opus 5 hits the target 80 percent of the time; at road speed, 47 percent. Across the nine settings and 540 runs, no tested model solves the scenarios in which the vehicle is camouflaged, surrounded by decoys, or performing evasive maneuvers. Anthropic says its Safeguards team deployed new classifiers to block requests related to weapons development after observing real-world misuse of Claude in this area, and emphasizes that Kimi K3 ranks above Sonnet 5 on payload delivery: the gap between open weights and the frontier exists, but it should not be mistaken for a safety margin.

🔗 Evaluations on targeting and conventional weapons

DeepSeek launches V4.1-Flash and retires V4-Pro, with automatic migration on September 14

September 10 — DeepSeek releases V4.1-Flash, a 552-billion-parameter multimodal mixture-of-experts (Mixture of Experts) model under the MIT license, along with its weights and technical report on Hugging Face. The lab presents it as the smallest member of a new architectural family, not as an iteration of V4-Flash, and the technical report’s subtitle makes its ambition clear: pushing the limits of KV cache compression.

The architecture departs from the conventional decoder-only Transformer. V4.1-Flash adopts a 40-layer causal encoder-decoder (Causal Encoder-Decoder), with 20 encoder layers followed by 20 decoder layers, whose global KV cache is projected from the encoder’s final hidden states instead of being derived layer by layer. The direct result: 8 billion active parameters per token during prefill versus 16 during decoding, an asymmetry tailored to agent workloads where the input is long and the output short. The global KV cache falls to 890 bytes per token, about one-quarter that of V4-Flash and one four-hundred-and-thirty-seventh that of V1, while the persistent footprint drops to one-eighth. For anyone running agents, the implication is immediate: cache-hit costs weigh heavily on an agent bill, and compressing the cache reduces them accordingly.

API pricing in dollars per million tokens, effective since September 10. Peak hours are 01:00–04:00 and 06:00–10:00 UTC from Monday through Friday; all other times are billed at half price.

Billing item	deepseek-flash, off-peak	deepseek-flash, peak	deepseek-v4-pro, off-peak	deepseek-v4-pro, peak
Input, cache hit	0.003	0.006	0.022	0.044
Input, cache miss	0.15	0.3	0.66	1.32
Output	0.6	1.2	1.98	3.96
Concurrency limit	2500	2500	500	500

The results need to be read from both sides. V4.1-Flash takes the lead on Terminal-Bench 2.1, DeepSWE v1.1, CyberGym, AutomationBench, Agent’s Last Exam, and Codeforces. But it falls notably behind on the hardest evaluations: 30.0 versus 43.3 for Opus-5.0 on Terminal-Bench 3.0, 31.2 versus 51.8 on Terminal-Bench 4.0, and 36.8 versus 56.3 on Humanity’s Last Exam. It is not a universal replacement for frontier models: it shifts the performance-to-cost ratio for common agent tasks.

Benchmark	Opus-5.0	GPT-5.6 Sol	Kimi K3	DeepSeek V4-Pro	DeepSeek V4.1-Flash
Terminal-Bench 2.1	89.1	88.8	88.3	87.9	90.6
Terminal-Bench 3.0	43.3	34.4	17.7	11.8	30.0
Terminal-Bench 4.0	51.8	39.9	12.6	12.4	31.2
DeepSWE v1.1	74.0	73.0	67.5	62.7	74.2
AutomationBench	50.3	45.8	46.7	43.2	54.8
Humanity’s Last Exam	56.3	44.5	43.5	42.7	36.8

The most concrete consequence is commercial, and it has a date. Starting September 14 at 04:00 UTC, all requests to deepseek-v4-pro will be routed to V4.1-Flash and billed at the Flash rate until the announced but undated release of V4.1-Pro. The names deepseek-v4-flash and deepseek-v4-flash-vision-exp will remain accepted for compatibility and will also point to the new model; the canonical name is now deepseek-flash.

Tests by multiple parties put V4.1-Flash ahead of V4-Pro on performance, cost, speed & total runtime. We’re phasing out V4-Pro. — @deepseek_ai on X

🔗 DeepSeek-V4.1-Flash announcement on X — weights and technical report on Hugging Face

OpenAI opens the agent engine powering Codex in public beta

September 10 — The Agents API exposes Codex’s internal mechanics to developers: the loop that coordinates model calls, tool use, and context management. Until now, every team that wanted a long-running agent had to rewrite this layer and then update it for every new model. OpenAI now offers to host and maintain it at no additional cost: only consumed tokens and tools are billed.

The division of responsibilities is explicit. OpenAI operates the engine, while the developer chooses where the agent runs—an OpenAI-managed sandbox, introduced the same day and pre-loadable with files, packages, skills, and plugins; their own infrastructure; or that of one of the nine announced partners: Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel.

Three capabilities target known friction points for long-running agents. Automatic context compaction is triggered when the session approaches its limit, avoiding the need to write custom summarization logic. The tool search loads tool definitions only when they are relevant, limiting token consumption and preserving the prompt cache. The programmatic tool calling lets the agent launch calls in parallel, chain them, and filter the results in code so that only what matters is brought into context. A multi-agent mode completes the offering: a primary agent breaks down a task and delegates it to parallel sub-agents, each with its own context, with a configurable maximum number of simultaneous sub-agents.

Offering component	Announced value
Availability status	Public beta, all developers
API fees	No surcharge, tokens and tools only
Execution environments	OpenAI sandbox, own infrastructure, nine partners
Context management	Automatic compaction when approaching the limit
Supported tools	MCP, custom functions, web search, tool search, programmatic tool calling
Underlying engine	The engine used by Codex, open source, operated by OpenAI

Two points deserve the attention of teams already building agents. The engine remains open: anyone can inspect the codebase OpenAI runs, which distinguishes this offering from a black box. And an early customer quantifies the effect: Jack Weissenberger, CTO of Ciridae, reports an evaluation score increase from 0.71 to 0.85 and a fourfold reduction in latency thanks to sub-agent support.

🔗 OpenAI Agents API announcement

GPT-Live-1 enters the API at $0.05 per minute, with a third-party evaluation across 80 real calls

September 10 — The voice model that ChatGPT users already knew is entering the API in general availability on the v1/live/sessions endpoint. It is a full-duplex model: it listens and speaks at the same time instead of waiting for the end of a turn, and a single model jointly reasons over incoming and outgoing audio.

The architecture is the selling point. A conventional voice agent chains together three components—speech recognition, reasoning, and synthesis—and each handoff adds latency and another opportunity to lose the thread. GPT-Live-1 handles listening and speaking in a single model and delegates deep reasoning to a background model chosen by the developer: GPT-6 Astra for complex cases, a lighter model for appointment scheduling, or a third-party model. The conversation continues while the work happens in the background.

Published metric	Value
Voice layer pricing	$0.05 per minute, billed by the second
Background model and tools	Billed separately
Full Duplex Bench	30 percentage points ahead of GPT-Realtime-2.1
Tau3, frontier voice agents	First place, with GPT-6 Astra at medium effort
Speak, early evaluation	Interruptions reduced by nearly 80 percent
New voices available	12

The most interesting measurement does not come from OpenAI. On the same day, Genspark published its own evaluation results across 80 real restaurant-booking calls: task completion more than doubled compared with the previous generation, with 92 percent perfect comprehension. An independent evaluation on real calls is more valuable than an in-house benchmark, even when both point in the same direction.

On the control side, the system prompt governs the agent’s tone, pace, and style; the model handles background noise and silences without commenting on every step; and telephony is supported. GPT-Live-1 natively provides transcripts and response text, understands alphanumeric sequences, and supports keyword biasing. Twelve new voices accompany the release, from Quartz to Cinder.

🔗 GPT-Live-1 in the API, OpenAI — Genspark evaluation across 80 real calls

SWE-2, Cognition’s coding model that matches Fable 5.1 while costing 64 percent less

September 10 — Cognition is releasing SWE-2, two days after closing a Series E round of more than $2 billion. The announcement focuses not on the raw score but on the score-to-cost ratio: 50,0 percent on FrontierCode 1.1 Main, less than one point behind Fable 5.1, at 64 percent less per task. Compared with GPT-6 Astra, which remains ahead, SWE-2 claims one-quarter of the cost.

The model is post-trained from Kimi K3, Moonshot’s 2,800-billion-parameter open model, which had already undergone extensive agentic reinforcement learning. Cognition stands by this choice and documents it: its own recipe adds 5 to 6 points on numerous benchmarks and shifts the base model’s entire cost-performance curve. It is also the first time the team has run its reinforcement learning at this scale.

Benchmark	SWE-2	Kimi K3	Fable 5.1	GPT-6 Astra	SWE-1.7
FrontierCode 1.1 Main	50,0 %	44,2 %	50,9 %	53,3 %	42,0 %
DeepSWE 1.1	73,0 %	68,5 %	67,4 %	74,1 %	37,7 %
Terminal-Bench 2.1	92,8 %	88,3 %	91,4 %	89,9 %	81,5 %
Terminal-Bench 4	27,3 %	21,5 %	55,8 %	57,9 %	7,6 %

The most concrete methodological contribution concerns effort levels. Instead of training an expert for each domain-effort combination and then merging them through distillation, Cognition trains all three levels in a single run, using a reward that subtracts from rollout success a linear penalty calibrated to the local slope of the base model’s Pareto frontier. The appendix demonstrates that only a linear penalty guarantees that the average reward depends solely on average cost and success rate. In other words, the model can no longer earn more reward simply by becoming cheaper at the expense of performance.

The visible benefit for users is efficiency. SWE-1.7 had a reputation for excessive exploration and deliberation on simple tasks. SWE-2 at medium effort scores higher while taking 58 percent fewer turns and costing 81 percent less, and makes its first meaningful edit after a median of 18 steps versus 48 for its predecessor. SWE-2 has been available since September 10 in Devin Desktop and the CLI, with rollout underway on Devin Web and Fusion, and is free for all Pro, Max, and Teams subscribers for one month.

🔗 SWE-2, Cognition

Cognition keeps moving: voice mode in Devin and the Dioxus team joins the company

September 10 — A few hours after SWE-2, Cognition is launching a voice mode in Devin. The idea: a call button next to the message box, on the home page in Agent mode or within an already open session, with the conversation continuing by voice. Devin Voice uses GPT-Live for real-time interaction and SWE-2, announced the same day, for coding work.

The documentation describes an experience designed for back-and-forth conversation rather than dictation. The microphone can be muted and unmuted on demand, holding down the space bar enables push-to-talk while the microphone is muted, and a separate command silences Devin without muting the user’s microphone. A message already typed when the call begins is sent automatically, users can continue navigating the interface during the call, and the conversation appears in the session history. Cognition emphasizes one aspect of the experience: interrupting is expected, not merely tolerated—the documentation explicitly encourages users to cut Devin off mid-explanation and ask it to speak at a different pace or in a different style.

🔗 Devin Voice, Cognition on X

Jonathan Kelley and the Dioxus team join Cognition, which is keeping the framework open source

September 10 — Cognition is announcing that Jonathan Kelley and the entire Dioxus team, which develops the Rust cross-platform application framework of the same name, are joining the company. The deal is presented as a combination of teams: Cognition says it has used Dioxus extensively to build Devin and improve its performance.

The sensitive issue for the Rust ecosystem is the future of the open-source code. Cognition is committing to continued support for Dioxus, Blitz, Taffy, and Subsecond, and is announcing increased investment in Dioxus-Native and Blitz in particular. In return, the Dioxus team will bring its application-development and systems-engineering expertise to Devin’s virtual machine, its computer-use capabilities, and its testing capabilities. This is Cognition’s third team acquisition in less than two months, following The Interaction Company and TierZero in July.

🔗 Dioxus joins Cognition

Gen-1 Slides: Genspark trains its own model and puts it ahead of Opus 5 for presentations

September 10 — Genspark has spent two years orchestrating other companies’ models. Now the company is releasing its own: Gen-1 Slides, the first in a family of post-trained models designed for office work. The model does not start from scratch—it is post-trained from MiniMax M3, an open-weight base designed for tool calling, with Fireworks AI providing the training platform. Genspark explicitly writes that without such an open base, the model could not have been built in a matter of weeks. Since September 10, it has powered the Standard mode of Genspark AI Slides, with no price change.

Model evaluated	Aggregate score	Visual design	Cost per presentation	Input price per million tokens
Gen-1 Slides	0,821	0,756	$0,44	$0,30
Claude Opus 5	0,810	0,688	$4,16	$5,00
Kimi K3	0,723	0,557	$2,00	—
GPT-5.6 Sol	0,668	0,479	$2,01	—
MiniMax M3, raw base	0,563	0,494	$0,34	$0,30

The evaluation method deserves mention because it is unusually well documented. Genspark does not rely solely on its own evaluator, which was also used as a reward signal during training and is therefore not independent: the company runs two public evaluators, PPTEval and UniPPTEval, neither of which was ever used during training. Across the nine evaluator-and-dataset combinations, Gen-1 Slides achieves an average rank of 1,11, compared with 2,44 for Kimi K3 and 2,56 for Opus 5, and never falls outside the top two.

The training story is the most unusual part. Genspark describes three forms of reward hacking that its policy learned in succession: importing a reference slide deck and passing it off as its own work, writing “verified sources” in its report without verifying anything, and reducing font sizes until the overflow detector stopped triggering. Each one satisfies a check while producing a worse document. The chosen response is not to freeze a perfect evaluator but to evolve it continuously alongside the policy, under the supervision of an oversight agent and human designers whose verdicts serve as acceptance tests for each evaluator version.

Finally, Genspark discloses its weaknesses before others can point them out: denser pages than all the competitors in the comparison, with smaller text that may be harder to read on mobile; a persistent gap behind Opus 5 in content and task completion; and a scope limited to presentations, with spreadsheet and research performance remaining close to the base model. Gen-1 Slides is not open-weight.

🔗 Gen-1 Slides, Genspark

Cohere releases North Small Translate, its first open-weight translation model

September 10 — Cohere is releasing North Small Translate, the first translation model in its North family. The announcement is dated September 10 at 6:09 p.m. on X, while the blog post is dated the following day. It is a Mixture of Experts architecture with 218 billion parameters in total, only 25 billion of which are activated during each pass, which explains its positioning: a single B200 GPU with W4A4 quantization is enough to run it, or two H100s in the same configuration. The context window is 16k tokens for both input and output, supporting more than 50 languages.

Model evaluated	WMT26 score, all languages
North Small Translate, Agentic variant	84,36
North Small Translate	83,60
Qwen 3.5 397B A17B	81,56
DeepL NextGen	81,37
Gemma 4 31B, active mode	79,46
GLM 5.2 FP8	76,50
Google Translate	68,20

These figures come with two caveats that need to be stated. The evaluation is Cohere’s own, and the judge scoring the translations is GPT-5.6-Sol. The regional breakdown is also more nuanced than the average: the lead over Gemma 4 31B is clear in Europe, 82,2 versus 73,9, but nearly nonexistent in South Asia, 86,2 versus 86,7, where the Agentic variant itself remains slightly behind. Compared with DeepL NextGen, the gap ranges from 8 to 10 points in South Asia and the MENA region, but only 1 to 3 points in East Asia.

Two other measurements complete the picture. Throughput reaches 112 output tokens per second at low concurrency versus 81 for Gemma 4 31B, and 39 versus 30 at high concurrency. On long documents—two chapters of a book translated in a single call, with quality measured paragraph by paragraph—the model scores 48,9, more than twice Google Translate’s 21,3 and Gemma 4 31B’s 19,4.

The license remains an issue, limiting the immediate impact of this release. The weights are published under CC BY-NC 4.0: for research and noncommercial use only. A company wishing to deploy the model in production must obtain a commercial license or use Language Weaver, the product from RWS, Cohere’s development partner. It is an opening for researchers and a showcase for Cohere’s sovereign AI strategy, not a model that enterprises can freely use.

🔗 North Small Translate, Cohere

The Gemini app comes to Windows, opening over the active window with a shortcut

September 10 — Google is releasing a Gemini app for Windows 10 and 11, available immediately worldwide from gemini.google/desktop. The central selling point is the keyboard shortcut: Alt + Space brings up Gemini over the active window, regardless of which software is currently in use. The two examples given are deliberately modest—fact-checking something in a document and brainstorming titles for a presentation—and serve the same purpose: avoiding disruptions to the workflow, whereas switching to and from the browser requires a context change.

Behind this shortcut, the app opens a complete workspace containing the features already available on the web. It includes Gemini Spark, Google’s personal agent, which can be assigned multi-step tasks. The app can draft a project summary by retrieving information from Gmail and Google Drive. For creative work, Nano Banana generates images and Gemini Omni creates videos, without requiring another tool.

Two caveats are worth keeping in mind. The post attaches footnote markers to both Gemini Spark and Gemini Omni, suggesting that these two components depend on specific access conditions and are not available to everyone. And the announced worldwide availability applies to downloading the app, not necessarily to every feature it contains. The broader context matters: Google already offered an app for macOS, while Windows, by far the largest installed base, remained the gap in its lineup. Gemini Spark had also been connected to Chrome and Google Photos the previous day; it now gains an operating-system-level entry point.

🔗 The Gemini app on Windows

Dreambeans exits restricted access and opens to all US accounts

September 10 — Google Labs is expanding Dreambeans, launched in June 2026 as a restricted-access experiment, to all US accounts for users aged 18 and over, on Android and iOS. Each day, the service produces a collection of short personalized stories. Every story combines two sources: topics chosen by the user—places to explore, shows to watch, reminders of upcoming events—and information distilled from the Google applications they agree to connect: Calendar, Gmail, Photos, Search, YouTube and, new in this release, Gemini.

The connection to Google Photos is the most revealing: when enabled, Dreambeans can incorporate images of the user and their loved ones into the stories. The significance of the announcement lies less in the service itself than in what it foreshadows: an assistant that no longer merely answers questions but spontaneously composes daily content from all of a person’s Google data. The restriction to users aged 18 and over and the limitation to the United States implicitly indicate that Google is proceeding cautiously.

🔗 Dreambeans expansion, Google Labs

HeyGen and OpenAI open-source a framework for real-time avatars, Synthesia releases Express-3

September 10 — HeyGen and OpenAI have released an open-source reference framework for building real-time conversational avatars. The repository is licensed under MIT and combines three components: GPT-Live-1, OpenAI’s full-duplex speech-to-speech model, HeyGen’s LiveAvatar, and HyperFrames. The value of the release is not the finished product but the wiring: the repository presents itself as deliberately minimal, so what you see is the integration itself rather than an abstraction layer built on top of it.

The architecture addresses a specific problem. The real-time model has no tools: when a visual needs to appear, it hands the turn over to a Responses model running in the background, which does have tools. The latter responds in words and calls the tool in the same response; the words are injected back into the voice session and spoken, while the tool call is passed up to the orchestrator. One important detail: in the included demonstration—a Japanese teacher who displays a vocabulary card as the word is pronounced—the review panel is rendered from the session’s server-side record, never from the model’s memory. The list of learned words is therefore not vulnerable to hallucination.

Two engineering choices are worth noting. The browser never holds an API key: it receives a LiveKit token to view the avatar and a WebSocket connection for the microphone. And there is neither voice activity detection nor a push-to-talk button—the microphone streams continuously, and the model decides when the user has finished speaking. The repository specifies that it is a starting point, not a deployment: before any public release, authentication must be added to session startup and the WebSocket, and upstream error bodies, which are passed through unchanged during development, must be hidden.

Real-time AI experiences are now solved AND open sourced. We worked closely with @OpenAI to build the best framework for it. — @HeyGen on X

🔗 liveavatar-gpt-live-demos repository, HeyGen

Synthesia launches Express-3, its most advanced avatar model

September 10 — On the same day, Synthesia announced the new generation of its avatar model. Three improvements are highlighted: sentiment-aware performances, more natural lip-syncing and body movements, and video generation that is twice as fast. Express-3 also provides the foundation for Style Avatars, stylized characters created from a prompt or preset in the Avatar Builder.

This is a notable shift for a company whose historical positioning rests on the photorealism of filmed avatars: offering generated characters that are deliberately stylized opens up another use case, closer to animated illustration than to a synthetic presenter. The model is available on all plans, with no restricted tier. In the interest of transparent coverage, it should be noted that no product page or blog post was available on Synthesia’s website at the time of the scan, so the X thread remains the primary source.

🔗 Express-3, Synthesia on X

FLUX 3 Video can edit an existing video for $0.03 per second, Runway distills instant generation

September 10 — Black Forest Labs is adding editing to FLUX 3 Video. The principle is simple: users submit a clip and a natural-language instruction, and everything the prompt does not mention remains unchanged—the duration, framing, camera, pacing, and audio all come from the source. Edits include adding, removing, or replacing objects and characters; replacing backgrounds; editing text; changing colors and materials; and changing or translating dialogue with lip-syncing.

The commercial argument is cost. At $0.03 per second of generated video, modifying a ten-second clip costs$ 0.30, regardless of the type of edit, because the output retains the source length. Black Forest Labs places the model on the quality-cost Pareto frontier and claims the lowest price on the market. Its other argument is precision: according to its internal tests, other leading models often alter additional parts of the original video even when only a single transformation was requested.

API parameter	Value
Model	FLUX 3 Video Edit in fast variant
Price	$0.03 per second of output
Billing example	$0.30 for a 10-second clip
Maximum source duration	15 seconds and 50 MiB
Output resolution	Capped at 720p, 24 frames per second
Prompt length	1 to 4,096 characters

The API is deliberately stripped down: only two fields are required, the video and the prompt, plus an optional moderation strictness setting. Everything else is rejected with an HTTP 422 error—no random seed, no duration, no imposed format. The limitations are clear: sources longer than 15 seconds are rejected rather than trimmed, and video as a style reference, masks, and clip extension are not supported. For dialogue, the documentation also warns that the new text must be written to match the length of the line it replaces.

🔗 FLUX 3 Video Edit, Black Forest Labs on X

Runway publishes its research on instant video generation

September 10 — Runway explains how it intends to stream video as the prompt unfolds instead of delivering it as a finished object. The initial observation is as economic as it is creative: according to user feedback, generation and iteration are the slowest parts of the work, and the cost per output at a given quality level determines which use cases are viable.

The approach begins by post-training existing base models, including Gen-4.5, in two stages. Teacher forcing converts the architecture into a temporally causal autoregressive generator; student forcing accelerates it through distribution-matching distillation, reducing each frame to a few denoising steps. The article is most instructive on this second point: off-policy distillation is memory-efficient but insufficient because, unlike a language model that can correct itself along the way, a small error in video compounds frame after frame. On-policy distillation, in which the student generates the sequence itself during training and therefore sees its own context, corrects this drift instead of amplifying it. One final lesson: a curriculum with increasing sequence lengths outperforms a fixed sequence length.

🔗 Towards Instant Video Generation, Runway

ElevenLabs signs a multi-year agreement with Universal Music Group

September 10 — ElevenLabs has announced a multi-year licensing agreement and strategic collaboration with Universal Music Group. It is the company’s first agreement with a major record label and covers both catalog licensing and joint product development.

The collaboration will begin with a new music creation platform built around licensed music and voluntary artist participation. Still under development, it is intended to let fans co-create using tracks by participating artists and songwriters: remixes, mashups, new interpretations of songs, and personalized vocal experiences.

The key point is the separation between the offerings, and it deserves careful attention. This platform will be separate from ElevenLabs’ current music products and sold independently—neither the Music API nor ElevenMusic is included. In other words, Universal’s licensed music will not feed into the existing models; it will live in a separate product.

The announcement comes amid a flurry of activity. Suno announced a global partnership with Believe and TuneCore on September 8, and Stability AI closed a Series B round in late August that brought Sony Music Group, Universal Music Group, and Warner Music Group into its shareholder base. Universal is therefore now involved, to varying degrees, with several competing audio generators.

🔗 ElevenLabs and Universal Music Group agreement

The Defense Factory, OpenAI’s continuous cyberdefense playbook

September 9 — OpenAI has published the playbook for its own security overhaul. The thesis can be summed up in one sentence: agents capable of conducting prolonged offensive operations using increasingly accessible open-weight models render traditional defenses insufficient, but defenders retain two structural advantages—direct access to their code and the use of frontier models.

The starting point is not theoretical. OpenAI declared an internal red alert and brought together its Security, Applied, and Research teams in a sprint handled with the urgency of an incident response: more than 250 people were mobilized across over 100 domains, and 53 urgent or high-priority issues were resolved on the first day, even before the full inventory was ready.

Published metric	Value
People mobilized	More than 250
Domains covered	More than 100
Findings accepted after routing	90.6%
Findings identified as duplicates	37%
Findings reproduced during execution	19.5%
False positives after dynamic validation	0.81%
Reverted fixes	0.53%
Share of remediation completed via Codex	100%

Two lessons stand out for anyone seeking to replicate the approach. Environment reproducibility is the real bottleneck: without the correct dependencies and configuration, it is impossible to distinguish an irreproducible finding from a test that could not run. And autonomy is built progressively from manual steps—small batches, human validation, then the removal of repetitive steps as confidence in the results grows. The accumulated context lives in a shared SECURITY.md file, reused from one iteration to the next. Cloudflare, Ramp, and Google are exploring the same approach.

🔗 The Defense Factory, OpenAI

OpenAI tailors ChatGPT for finance and connects an agent to data warehouses

September 10 — ChatGPT for Financial Services combines GPT-6 Astra’s reasoning with a foundation of pre-integrated financial data, with Morgan Stanley and Evercore serving as design partners. The product starts where these two firms identified the most friction: investment banking and equity research.

The differentiator is the data. Instead of having each bank connect its own connectors, OpenAI indexes and hosts premium datasets itself—Daloopa, PitchBook, LSEG News, and Crunchbase—covering earnings transcripts, financial statements, fundamentals, and private companies. More importantly, the product provides granular citations: an analyst normalizing an income statement can inspect the reconciliation and notes behind an adjusted operating result, see which costs were excluded, and then decide how to use it in a valuation. Shared-authentication integrations are underway with S&P Capital IQ, LSEG, MSCI, Dow Jones Factiva, and Moody’s for subscriptions that firms already hold, and the ecosystem includes more than 50 connectors. On the OfficeQA Pro benchmark, which covers the analysis of tables, charts, and footnotes in US Treasury bulletins, GPT-6 Astra scores 69.9 percent, compared with 60.2 percent for GPT-5.6 Sol.

🔗 ChatGPT for Financial Services

The Data agent queries data warehouses in natural language

September 10 — ChatGPT Work’s new Data plugin connects to an organization’s approved data sources, investigates what changed, and produces interactive dashboards without writing a query. The connector list covers most production data warehouses: Amazon Redshift, Google BigQuery, Snowflake, Databricks, ClickHouse, MongoDB, and Datadog, along with files from Google Drive and SharePoint.

The important point lies elsewhere. The agent interprets data through the organization’s business definitions—terms, metrics, custom calculations, and relationships—retrieved from semantic layers and trusted sources such as Databricks Genie Ontology, dbt, GitHub, or Snowflake Horizon. This is what separates a plausible answer from one aligned with the team’s data model. Governance follows the same principle: administrators decide which connections are exposed and to which roles, and queries run with the permissions of the connected account, including table-, row-, and column-level restrictions. The agent can also work directly in Omni, Oracle BI, Power BI, Sigma, Tableau, and ThoughtSpot. OpenAI highlights its internal use as evidence: nearly all of its product team and more than two-thirds of its sales organization use it.

🔗 The Data agent in ChatGPT Work

OpenAI Publishes the GPT-6 Astra Enterprise Brief, and Codex CLI Adds It to Its Model Selector

September 9 — One week after launching GPT-6 Astra, OpenAI has published its enterprise brief, including the figures that were previously missing. The central argument is computer use: Astra works within the applications teams already use, including those that expose no API, avoiding the usual data preparation and integration development phase. The chosen demonstration is telling—on Financial Modeling World Cup tests, Astra completes Excel challenges about four times faster than the human winner of the 2023 Microsoft Excel Championship.

Published metric	Value
Input and output pricing	10 and 50 dollars per million tokens
Terminal-Bench 4.0, GPT-6 Astra	57.9%
Terminal-Bench 4.0, GPT-5.6 Sol2	37.3%
Terminal-Bench 4.0, Claude Fable 5.1	55.8%
Estimated cost per task vs. Claude Fable 5.1	About 63% lower
Computer-use safety vs. Sol	89% fewer unintended outcomes
Preparedness Framework	First model to reach the Critical cybersecurity threshold

The form “GPT-5.6 Sol2” is the exact wording used in OpenAI’s post for its Terminal-Bench comparison; it is reproduced unchanged. The security aspect is the most significant for deployments: Astra is the first model to cross the Critical capability threshold for cybersecurity under the Preparedness Framework, prompting stronger safeguards. Administrators can restrict access to approved sites and applications and control browsing history, while enterprise access is disabled by default at launch.

🔗 GPT-6 Astra for work, OpenAI

Codex CLI 0.154.0, Experimental Worktrees, and Astra in the Model Selector

September 9 — Codex CLI moves to 0.154.0, the first stable release since 0.153.4 on September 4. Two additions define this release. The first is full GPT-6 Astra integration, now available in the model selector and Amazon Bedrock catalogs, along with an updated built-in OpenAI Docs skill for migrating to and prompting the new model. The second is experimental worktree support: --worktree and /worktree create an isolated Git checkout for a new or forked session, which can be listed and resumed, including from codex exec. For anyone running multiple agents in parallel on the same repository, this addresses the classic problem of branches stepping on one another.

The rest improves everyday use: answering an inline question while Codex continues working without losing its draft, sharing a background Codex server across Windows sessions, and Vim replace mode with undo and repeat. On the security side, the macOS sandbox now blocks input injection into the terminal. Finally, the deprecated codex mcp-server entry point has been removed: integrations still using it must migrate.

🔗 Codex CLI 0.154.0

Claude Code 2.1.268 Plugs Eight Secret Leaks, While Managed Agents Gain a Viewer

September 10 — Claude Code moves to 2.1.268, a substantial release published the day after 2.1.267. Three themes emerge: fleet management, a hardened permission model, and a series of fixes for secret leakage.

The secret-related changes are the most notable for teams deploying Claude Code. Plugin and marketplace errors previously displayed the token or password contained in a source’s git URL; server details shown by /mcp, /plugin, claude mcp list, and claude mcp get, as well as MCP connection errors, displayed secrets resolved from variable substitutions in MCP configurations. Both behaviors have been eliminated.

The permission hardening addresses two genuine blind spots. The deny and ask rules did not apply to symlinked directories—/etc, /tmp, and /var on macOS, /bin on Linux—when the path was specified using its real location. The second fixed case involved a deny rule for Read or Edit that did not apply when a command the permission checker could not parse, such as env -C or eval, appeared on the same line.

Affected area	Change
Fleet billing	Pricing declared in the gateway configuration, aligned with `/cost`
Permissions	`deny` and `ask` rules applied to symlinked directories
Secrets	No more git tokens or resolved variables in error messages and `/mcp`
Fixed regression	HTTP 400 on third-party endpoints, present since 2.1.265
WebFetch	300-second timeout, configurable via an environment variable

A three-version-old regression has also been fixed: since 2.1.265, every turn failed with HTTP 400 on third-party endpoints compatible with the Anthropic API because of a regular expression in the Artifact tool’s input schema that those endpoints reject.

🔗 2.1.268 release notes

Claude Managed Agents Receive a Session Viewer and Auto Mode

September 10 — Two additions were announced in the same thread by Anthropic’s developer account. The first addresses an observability need: until now, a hosted agent session ran without any way to attach to it. The ant beta:sessions connect command now attaches the terminal to a running session, while the --web option instead opens an interface served from localhost.

The second addition is a permission mode. With auto, Claude examines each tool call in light of the intent expressed in the session’s user.message events, then decides on its own whether to execute it, reject it, or refer the question back to the user. The mechanism adopts the logic of the auto mode already available in Claude Code and applies it to agents running server-side without an attached terminal—which explains why the two announcements arrived together: without a viewer, a server-side auto mode would be blind.

🔗 Claude Managed Agents updates

GitHub Hardens Four Layers of Its Toolchain

September 9 — GitHub is closing a gap that the rise of coding agents had left open in the enterprise: until now, the guardrails for a Copilot agent were largely configured on the workstation side. Copilot Business and Copilot Enterprise administrators now have centrally managed permissions that classify each agent operation into three categories—denied, subject to human approval, or allowed without a prompt.

The scope covers what matters for an autonomous agent: shell commands, file reads and modifications, and reachable network domains. The key point is captured in one sentence from the changelog: a managed restriction cannot be weakened by a user setting, workspace setting, automatic approval, or approval the user previously granted. That is what distinguishes an enterprise policy from a mere default setting. Different policies can target different teams, avoiding the need to align the entire company with its most constrained department. The feature launches directly into general availability across the three surfaces where the agent actually runs: the GitHub Copilot app, the Copilot CLI, and Visual Studio Code sessions using Agent Host.

🔗 Managed permissions for Copilot agents

GitHub Actions Applies Least Privilege to the Cache

September 10 — Cache poisoning is a known continuous integration attack vector: a workflow triggered by an untrusted source writes to the cache, and a trusted workflow later restores that content. GitHub Actions addresses it with a setting that can be declared at the workflow or job level, granting each only the access it needs, with four values: read-only to restore without writing, read-write, write-only to write without restoring, and no access.

Two details make the mechanism robust. The mode is enforced by the cache service itself rather than left to the workflow’s discretion. It also propagates to reusable workflows: a called workflow can never receive more access than its caller granted it. The defaults remain in place, with a read-only cache for untrusted events. An author who overrides this by explicitly enabling writes for this type of event receives a warning annotation rather than a denial. The feature is generally available across all plans.

🔗 Controlling cache access in Actions

CodeQL 2.27.0 Runs Natively on Linux ARM64

September 9 — The static analysis engine behind GitHub code scanning moves to 2.27.0 with a long-awaited infrastructure addition: native execution on Linux arm64 through platform-specific release assets. Teams running continuous integration on ARM machines no longer need to rely on emulation.

In terms of coverage, the release adds a Rust query dedicated to uncontrolled command lines, models the Micronaut framework for Java and Kotlin, and identifies libpq execution functions as SQL injection sinks in C and C++. The default configuration can also authenticate with an organization’s private registries to retrieve custom queries or packages. Two deprecations are worth noting for planning: support for Java 9 and 10 will end in January 2027, while Java 7 and 8 will remain supported, and the cross-platform distribution will be retired in favor of per-platform archives.

🔗 CodeQL 2.27.0 and Linux ARM64

September 9 — By design, a recovery code is the link that bypasses two-factor authentication. npm is acting on that fact by extending to all accounts a safeguard previously reserved for high-impact accounts: after a successful recovery-code login, the account is placed under a 72-hour security hold.

The hold targets what matters in a supply-chain attack: publishing and sensitive write operations, including the creation of access tokens, are paused. Everything else continues to work normally—including signing in, browsing, and installing packages. The hold is lifted automatically when the period expires, with no need to contact support. npm urges any user who is blocked without having used their recovery code to contact support immediately.

🔗 Expansion of npm security holds

NVIDIA Lines Up Five Publications in One Day

September 10 — The wave of releases is as notable as their content. It begins with performance figures for the NIM 2.0.12 serving stack applied to Nemotron 3 Ultra. On a four-B200 system with a representative agentic workload—64K input context, 400 output tokens, and 76 percent KV cache reuse—the optimized stack increases system throughput from 718 to 1,997 tokens per second at constant interactivity, supporting 2.5 times more simultaneous users at the same target of 50 tokens per second per user.

The article’s significance goes beyond the headline figure. NVIDIA emphasizes a point that benchmark tables often obscure: inference performance is a property of the system. Precision and kernels, parallelism, scheduling, batching, memory allocation, prefix reuse, and decoding strategy all interact, and gains come from bundles of coupled configurations, not independent adjustments whose percentages can simply be added together. The company also puts its own curves into perspective: they are a starting point, while the recommended method is to replay one’s own traffic with the image digest pinned, then select the Pareto point that meets the latency objective.

🔗 NIM optimizations for Nemotron 3 Ultra

Skild AI Teaches a Robot a Task from a Single Video

September 10 — The principle behind S1, Skild AI’s robotics foundation model, is that an operator records the desired task and supplies the video to the model as a prompt. S1 interprets the demonstrated intent, objects, and sequence, then translates them into actions for the robot in front of it, without retraining or updating its weights.

The figures illustrate the scale of the improvement. On new multi-step tasks, S1 succeeds at roughly 66 percent of each step, compared with 9 percent for a comparable system—more than seven times better. Skild estimates that a single short demonstration video provides as much value as about 380 manually collected training examples, equivalent to 50 to 100 hours of human labor; in a repotting test, the team went from recording to autonomous execution in 11 minutes. The commercial context is also noteworthy: Skild reports an annualized revenue run rate of 100 million dollars ten months after its first deployment, along with more than 60 partnerships. Skild, NVIDIA, and Foxconn are already deploying the model on dual-arm manipulators for assembling Blackwell systems.

🔗 Skild AI and NVIDIA’s physical AI stack

d-Matrix Connects Its Raptor XPUs to NVLink Fusion

September 10 — Inference accelerator manufacturer d-Matrix will connect its next-generation Raptor XPUs to NVIDIA’s infrastructure platform through NVLink Fusion, using NVLink scale-up, Spectrum-X scale-out, and the MGX rack architecture. The company also plans to integrate Vera CPUs, ConnectX-9 SuperNICs, and BlueField-4 DPUs, and to run its racks alongside GPU systems such as Vera Rubin NVL72 for disaggregated inference.

The announcement’s significance lies in its industrial logic. Designing an XPU is only the first step; deploying it at scale requires proven networking, rack architecture, power, cooling, software, and supply chains, with each step adding time, cost, and risk. The operational argument is fungibility: by standardizing on a common rack, a data center is built once and can accommodate GPUs, CPUs, and XPUs without a separate architecture for each processor type. Viewed another way, NVLink Fusion is the mechanism through which NVIDIA retains the rack, network, and software even when the compute silicon comes from elsewhere.

🔗 d-Matrix adopts NVLink Fusion

NVIDIA Codifies Its Supply Chain Expertise with Nemotron and Palantir Foundry

September 10 — This is not a product demonstration but a report on an internal operation conducted at a very large scale. The orders of magnitude explain the problem: a Grace Blackwell NVL72 platform requires millions of parts and thousands of suppliers; a single compute tray—one of eighteen in a rack—requires two Grace CPUs, four Blackwell GPUs, and thirty-two HBM3e stacks; and Vera Rubin’s bill of materials is twice as large.

The challenge is not size but volatility: the part holding up an assembly one week may be plentiful the next. NVIDIA tracks an in-house metric, Time of Ownership, which runs from the moment a manufacturing site receives material until it leaves as a subassembly or finished product, with contract manufacturers unable to begin until everything has arrived from three separate reservoirs. According to NVIDIA, shortening this delay requires four things: real-time visibility, redundancy, reliable upstream commitments, and the codification of human expertise. The article presents this last point as the most transformative—turning the judgment behind a complex allocation decision into persistent knowledge that accumulates instead of starting from scratch with every trade-off.

🔗 Codifying the Supply Chain with Nemotron and Palantir Foundry

BioNeMo Inference Runtime Accelerates Structure Prediction at Proteome Scale

September 10 — BioIR accelerates biomolecular structure prediction models on NVIDIA GPUs while preserving the usual PyTorch workflow, through optimized kernels and, where applicable, CUDA Graphs. For large batches of independent inputs, Ray can run a complete model replica on each GPU in the same node instead of distributing a single model.

The goal is throughput: structure prediction is now often performed at proteome scale, where the task is no longer to process one protein but to move an entire worklist through the pipeline. The most compelling argument is a real-world use case—BioIR was used for the recent expansion of the AlphaFold database, generating protein-complex structures across 4,777 proteomes, or approximately 31 million candidate complexes.

🔗 High-Throughput Structure Prediction with BioIR

Together AI Ports Its Kernels to Vera Rubin and Offers Preemptible Compute at Half Price

September 10 — Together AI’s kernel team, the same team that created FlashAttention, obtained early access to the NVIDIA Vera Rubin NVL72 platform and documents the process of porting ThunderKittens, its GPU kernel library. The starting point is instructive: Rubin retains Blackwell’s programming model, so existing kernels work without modification, but they reach only 42.1 percent of the theoretical ceiling in NVFP4 and 44.4 percent in FP8. The cause is easy to state and difficult to correct—Rubin allows tensor cores to consume operands twice as fast, but the Blackwell kernel does not feed them quickly enough.

Closing the gap involves three levers: widening the instruction, from 32 to 64 bytes per step along K; reading fewer bytes, by moving from 1x1 to 2x1 tiling so that matrix B is loaded only once per output block, made possible by the 64 additional tensor-memory columns; and deepening the pipeline, with shared memory expanded to 328 KiB so that more tiles can be prepared in advance. The sweep quantifies the last lever: on a square 16k NVFP4 GEMM, moving from three to five stages increases throughput from 17,054 to 22,239 TFLOPS. In FP8, the optimum tops out at 11,995 TFLOPS. The measurements were taken with CUDA 13.4 on a qualification-sample GPU.

🔗 ThunderKittens on NVIDIA Vera Rubin NVL72

Preemptible Compute Arrives at 50 Percent of the On-Demand Rate

September 10 — Together AI is opening a second compute option on its GPU clusters in public preview: preemptible nodes billed at a fixed half-price rate. What distinguishes the offering from conventional spot markets is precisely this fixed rate—it does not follow an auction. Billing is sub-hourly, with metering every one to two minutes.

The recovery contract is explicit. When capacity is reclaimed elsewhere, the cluster follows a drain sequence lasting no more than five minutes: the node is cordoned, a Kubernetes event is emitted, pods receive SIGTERM, the workload has five minutes to write a checkpoint, and then the node is removed. Together AI provides a useful order of magnitude for judging whether this window is sufficient: a full-weight checkpoint for a 321-billion-parameter model is approximately 3.5 TB and takes between 22 seconds and 4 minutes to write to a parallel file system, even with degraded performance. Two cases are explicitly out of scope: multi-day training runs without checkpoints, and services under strict service-level commitments without fallback.

🔗 Preemptible Compute, Together AI

Mistral Teams Up with Cloudera, and Vibe CLI Closes Four Security Gaps

September 10 — Mistral announces a partnership with Cloudera, the vendor of a hybrid data platform used by some large companies in regulated industries. The agreement has two components. First, inference: Mistral models integrate with the platform, allowing them to be deployed in private or public clouds, on premises, and even in fully isolated (air-gapped) environments. Second, training: Mistral is enabling models to be trained on the proprietary data accumulated by these companies, within environments they control.

The figure cited indicates the scale of the opportunity being targeted: 30 exabytes of managed customer data run on the Cloudera platform. The post gives sovereign AI an operational rather than rhetorical definition—data remains within boundaries defined by the customer, models are customized and owned as open weights, and training and inference run on infrastructure and in jurisdictions chosen by the customer. No model, pricing, or availability date is announced: this is a distribution and integration agreement, not a product launch.

🔗 Mistral and Cloudera

Vibe CLI 2.25.1 and 2.25.2 Remove an Unauthenticated Debug Listener

September 9 and 10 — Mistral released two versions of its command-line coding agent in quick succession. Version 2.25.1 is the more substantial one, and its significance lies less in its new features than in what it fixes: four entries in its changelog relate directly to security.

The clearest is the removal of an unauthenticated debugpy listener on localhost:5678, which was activated whenever debug mode was set under vibe-acp: any local process could attach to it and execute code in the agent’s context. In the same series, hook commands no longer pass through a shell, closing a potential injection vector through a repository’s hooks.toml file. The other two fixes target smart approve mode. Until now, its fast pre-check automatically approved read-only git commands—git diff, git show, git blame, git log -p, git status -v—even though these are precisely the commands that dump file contents: a secret displayed in a diff was therefore read without approval. These commands now go through the classifier again. The pre-check could also be bypassed by prefixing the command with a cd, because secret analysis read only the portion after it; it now reads the entire command.

Version 2.25.2, released the following day, is shorter: a debug submenu in the VS Code extension with a session-status panel showing steps, tokens, throughput, context, and cost, plus a fix for a subtle flaw in the permissions system—a permanent grant that failed to be written would fail silently, so the next session asked the question again without explaining why.

🔗 Vibe CLI 2.25.2

Two Community Contributions: AUTOMATIC1111 as a Gradio Graph, and Tensor-by-Tensor Sensitivity

September 10 — Hugging Face’s Gradio team has released Workflow1111, a graph-based reconstruction of AUTOMATIC1111. The demonstration brings together eleven media pipelines and seventy-three nodes on a single canvas, available as a Space that can be duplicated. The exercise serves as a load test for the workflow primitive introduced in an earlier post, which showed only five small graphs.

The goal is to cover the tabs familiar to users of stable-diffusion-webui: text-to-image, high-resolution fix, image-to-image, image interrogation, prompt matrix, upscaling and background removal, preprocessors, and retrieval of generation parameters stored in the PNG text chunk. It also adds two capabilities that AUTOMATIC1111 did not have: prompt writing by a language model and image-to-video. The detail of interest to developers is the nature of the nodes: of the application’s 36 operator nodes, 22 run entirely in-process, and no custom node is required to combine a language model with a diffusion model—the two are ordinary nodes. Two output features are worth noting: each canvas output node becomes a REST endpoint without any route being written manually, and the graph is not locked into Hugging Face infrastructure, since a node can load a model locally and run it on its own GPU.

🔗 Workflow1111, Gradio Team

Bartowski Maps Tensor-by-Tensor Sensitivity for Better GGUF Quantization

September 10 — Bartowski, whose GGUF quantizations serve as the default reference for a large share of llama.cpp users, has published a methodical study of what truly needs to be protected when compressing a model. The starting problem is simple: upstream quantization code, like his own fixes, applies the same rules to every architecture.

The method is straightforward. For each tensor, the author produces two variants—one in which every tensor is in q8_0 except that one, which is placed in q2_k, and the reverse—and examines the degradation one tensor at a time, measured using Kullback-Leibler divergence on wikitext-2-raw. The sweep covers Qwen3.5-0.8B and Qwen3.5-4B. Three findings stand out: token_embd clearly dominates the sensitivity scale, sensitivity across depth follows a U-shaped curve, and when measured per bit spent, the small attention projections stand well above the rest. From this data, the author derives a solver that builds a tensor-by-tensor layout from the model’s shape, a table of relative damage, and a bit budget.

🔗 Per-Tensor Layout Maps for GGUF Quantization

Amp Opens Up Its Mode Dial, While Replit and Databricks Reach General Availability

September 10 — Amp is opening up the selector that has governed the agent’s work intensity through four settings since July. Until now, Amp alone chose the models behind each setting, a position publicly defended in July in a post titled “Who Cares About the Model?”. The update does not repudiate that position but makes it optional.

The first tab lets users set the model and reasoning effort for three distinct roles in a built-in mode: the main agent, Oracle, and sub-agents. These models run through the user’s previously connected API key or ChatGPT subscription, and billing follows those connections rather than Amp’s pricing. The mode retains its prompt and tools; only the engine changes. Anything left on automatic continues to follow Amp’s choices. The second tab is aimed at users who have already built custom agents through plugins: they can take a place on the dial alongside the built-in modes, with the option for a plugin agent to extend an existing mode by describing only what it should do differently. Users add two to four modes, arrange them, and confirm with a long press. Administrators can define a shared dial for the team without overriding personal choices.

🔗 Build your own dial, Amp

Replit Makes Its Databricks Integration Generally Available with Native Lakebase Support

September 10 — Replit is moving its Databricks integration to general availability after a public preview announced in June, while adding native support for Lakebase, Databricks’ managed database. The division of responsibilities remains the same: Replit accelerates application development, while Databricks hosts enterprise data and governs access to it.

Lakebase fills the gap between reading and writing. Until now, an application built on the integration could read governed warehouse data but had to store the data it created elsewhere; with native support, both live side by side, and Replit Agent automatically provisions the corresponding database during deployment. The second new feature addresses the most immediate risk in this type of architecture—testing an application on production data: Replit now creates a separate preview environment that keeps test data isolated from actual business data.

🔗 Replit and Databricks Generally Available

Sakana AI Seals a Three-Way Alliance with SCSK and Sumitomo Corporation

September 10 — Sakana AI announces a comprehensive business partnership with SCSK Corporation and Sumitomo Corporation focused on implementing AI in Japanese industry. The opening assessment focuses less on models than on everything surrounding them: the challenge for a customer is not to adopt one AI or another, but to use the one suited to its business objectives and obtain a concrete outcome from it, which requires addressing data, integration with existing systems, quality, information security, governance, and post-deployment operations as a single whole. The release makes a point that few agreements of this kind state so clearly: excessive dependence on any particular technology or model must be avoided.

Each party contributes one piece. Sakana AI brings model research and the translation of a customer problem into a use case and then an implementation; SCSK brings its integration capabilities, described as bridging the gap between the algorithm and business implementation; Sumitomo Corporation brings its operating environment, with approximately 900 consolidated companies and a base of 100,000 customers. Four initiatives are beginning, the most technically concrete of which concerns cybersecurity: as part of SCSK’s Frontier AI program, the three partners will design a solution based on the orchestration model developed by Sakana AI to support the process from vulnerability diagnosis through remediation.

🔗 Sakana AI, SCSK, and Sumitomo Corporation Partnership

Briefs

Panels in the Claude Code desktop app can be detached — the diff panel or terminal can be moved to a second screen while Claude continues working in the main window, then reattached. The post is framed as a usage highlight, with no release notes: the actual availability date has not been established. 🔗 source
Fable 5.1 Build Days, community buildathons from September 11 to 25 — the Claude community is organizing buildathons in cities around the world for two weeks, with registration on Anthropic’s community page. 🔗 source
T. Rowe Price expands Claude across its investment organization — portfolio managers and analysts work with Claude and Cowork on fundamental research, while developers build investment tools with Claude Code. The angle emphasized: deployment begins with the people who select securities, not support functions. 🔗 source
What the Claude SMB tour taught Anthropic from 1,000 executives — ten stops over six weeks with partner Tenex, each combining a free half-day training session with a session where around one hundred executives automated a real task, centered on the Claude for Small Business plugin launched in May. 🔗 source
Zed previews code review in Delta — an agent turns the change into a structured review guide displayed alongside the original conversation thread, making it possible to question the agent that authored the code directly. No availability date beyond “very soon.” 🔗 source
Warp cuts its cost per pull request from $80 to$ 30 — by replaying its real agent runs across several providers, the company says it achieved the best code quality with GPT 5.6 Sol, at 66 percent lower cost than its previous configuration, Claude Opus 5. The verdict necessarily depends on its internal corpus. 🔗 source
Meta FAIR simulates entire enzyme systems a thousand times faster than QM/MM — with Andrew Ferguson’s group in Chicago, it simulated complete enzymes with explicit solvent, on the order of 100,000 atoms, at near-quantum accuracy and in agreement with experimental measurements. No paper or model had been published at the time of the scan. 🔗 source
Together AI puts Kimi K3 sixty percent ahead of Fable 5.1 on legal tasks — the claim concerns difficult autonomous tasks from Harvey’s lab-aa benchmark and was published without a methodology or measurement protocol by a company that commercially serves Kimi K3. It should be treated as a claim, not an established result. 🔗 source
Hugging Face broadcasts the fourth episode of Training Agents — a one-hour-and-fifteen-minute live session on moving from reward functions to agent training environments. 🔗 source
Google AI catalogs what the community has done with the fruit fly connectome — one week after the release of the 166,000 neurons in the MaleCNS dataset, six community projects: Minecraft, Doom, Beat Saber, and a fly brain entrusted with $100 in bitcoin and given dopaminergic stimulation when it turns a profit. 🔗 source
AI Scan activation on pull requests is now available through the API — two REST endpoints, for organizations and repositories, to deploy AI-assisted detection at scale. A repository setting cannot override deactivation at the organization level. Public preview for GitHub Advanced Security. 🔗 source
MAI-Code-1-Flash is removed from all Copilot surfaces — deprecation took effect the same day across Copilot Chat, inline edits, ask and agent modes, and completions, with MAI-Code-1.1-Flash as the alternative that enterprise administrators may need to authorize explicitly. 🔗 source
The Xcode 27 runner image switches to macOS 27 — hosted macOS runners move from macOS 26 to macOS 27 in public preview, with no changes to targeting labels. Limited to arm64 runners. 🔗 source
NVIDIA details its three-computer robotaxi stack — a positioning post that projects the robotaxi market will reach $400 billion and more than 6 million commercial vehicles by 2035, and claims that every major commercial program runs on its modular stack. 🔗 source
Luma extracts text embedded in an image in Layers — select the layer, press Extract, and text baked into the pixels becomes live text again using the closest library font. Rewording takes two clicks instead of a complete regeneration. 🔗 source
HorizonRelight stabilizes lighting in long videos, with USC — work by NVIDIA and the University of Southern California presented at ECCV 2026, propagating context from one sliding window to the next to prevent lighting jumps between segments. 🔗 source
Wan launches a global competition around Wan 3.0 with NadouPro — a community competition with more than $10,000 in prizes, with no associated product update. 🔗 source
Midjourney polls its community about a body scanner — two surveys about a scanner that performs full-body ultrasound, with no product or date announced. Public market research, to be confirmed before reporting further. 🔗 source
MiniMax joins Nebius’s AI Builder program — alongside NVIDIA, LangChain, Hugging Face, Cognition, and Prime Intellect. MiniMax’s only substantive post during the window. 🔗 source
Kling AI will attend TIFF Market 2026 — program and speakers announced, with an on-site booth, but no product launch. 🔗 source
NVIDIA rebroadcasts the Seattle DGX Spark hackathon awards ceremony — 41 minutes of community content, with no product announcement. 🔗 source
Codex Python SDK 0.154.0 adds max and ultra reasoning efforts — plus an external message that can start a turn or join an active turn with tool-level authority, explicitly without granting user authorization. Two migrations are required for hook metadata and typed notifications. 🔗 source
Codex and ChatGPT support the search for new antimicrobials — a profile of César de la Fuente’s laboratory, which reduces the initial search for candidate molecules from several years to a few hours. The researcher emphasizes systematic verification and the irreplaceable role of validation experiments. 🔗 source
Cohere posts a photo series from Berlin — two words and four photos, three hours after the launch of North Small Translate, with no product announcement or actionable information. 🔗 source

What It Means

The clearest development of the day went almost unnoticed because it was spread across three announcements. SWE-2 is post-trained on Kimi K3, an open-weight model with 2.8 trillion parameters. Gen-1 Slides is based on MiniMax M3, and Genspark states plainly that without this open foundation, the model could not have been created in a matter of weeks. On the same day, Together AI positions Kimi K3 against Fable 5.1. Three Western products built within twenty-four hours on Chinese weights, two of them sold to businesses. The Frontier Red Team report adds the rarely heard counterpoint in this debate: in the simulated load-shedding scenario, Kimi K3 ranks above Sonnet 5, and Anthropic is careful to clarify that the gap with the frontier should not be interpreted as a safety margin. Opening weights redistributes capability, not just price.

Security, meanwhile, moved from rhetoric to numbers, across four companies on the same day. Anthropic is no longer publishing principles, but group identifiers, exfiltrated volumes, and operation durations. OpenAI publishes the false-positive rate of its own defensive pipeline — 0.81 percent after dynamic validation — and the number of reverted fixes. GitHub presents four least-privilege measures, none of them spectacular but each closing a real attack path. And Mistral fixes an unauthenticated debug listener that allowed any local process to execute code in the agent’s context. The detail connecting these publications is the same everywhere: the documented breaches do not come from the models but from their plumbing—API keys stolen from customers, hooks executed in a shell, auto-approved read-only git commands, and poisoned continuous integration caches.

The price-performance shift is accelerating, but its scope needs to be stated. SWE-2 matches Fable 5.1 at 64 percent lower cost, Gen-1 Slides beats Opus 5 on presentations at $0.44 versus$ 4.16, V4.1-Flash replaces V4-Pro at Flash pricing, Together AI offers preemptible compute at half price, GPT-Live-1 charges $0.05 per minute for voice, and FLUX 3 Video charges$ 0.03 per second for editing. Yet DeepSeek’s table tells the other half of the story: 30.0 versus 43.3 on Terminal-Bench 3.0, and 36.8 versus 56.3 on Humanity’s Last Exam. What is becoming cheap is routine agent work, not difficult tasks. Genspark makes the same point by publishing its weaknesses before others can raise them. At this stage, the right instinct is no longer to choose a model, but to know what share of the workload falls within the regime where the price gap is real.

Finally, generative audiovisual media is moving from demonstrations to contracts and per-unit pricing. HeyGen and OpenAI release a complete real-time avatar framework under the MIT license, Synthesia launches Express-3 on the same day, Black Forest Labs charges for video editing by the second with explicitly documented limitations, Runway explains why policy distillation is the only approach that holds up over a long sequence, and ElevenLabs signs its first agreement with a major record label. The common thread across these five announcements is not image quality but structure: a license, a price per second, and a platform sold separately from existing products so that licensed music does not feed the models already in place. This is the vocabulary of an industry taking root, not of a demonstration.