Computer use, the new browser use tool, the Skills API and the Files API all went GA on Aug 20. Asteroid runs claims workflows in healthcare and insurance; theirs dropped from 32 minutes to 13 and got about 30% cheaper per task, with no prompt changes. The gain is batching -- several actions per turn instead of a screenshot-decide-act round trip per click.

Then OpenAI and Anthropic each unlocked exploit development for vetted professionals, 11 days apart. GPT-5.6-Cyber on Aug 10, Mythos 5 in Claude Security on Aug 21. The number: GPT-5.6-Cyber completes 95.0% of exploit-chain requests where stock Sol completes 1.5%. Same base model, so that gap is policy rather than capability. Both announcements carry the same caveat -- AI-generated patches fully fix the bug about 26% of the time. Finding got unlocked faster than fixing.

The agent stack went GA

  • Computer use is the computer_toolset_20260801 toolset now -- no beta header, zoom on by default, per-member configs. The new browser tool (browser_toolset_20260801) parses page structure alongside the screenshot, so agents target named elements instead of pixel coordinates and a CSS change stops breaking them. Computer use is also cleared for HIPAA workloads under Anthropic's BAA
  • Files gets 1 TB per org, 5x the rate limits, and expires_in_seconds at upload, which retires whatever reaper you wrote. Skills upload and version through /v1/skills and execute in Claude's sandbox, so you host nothing. Also GA: Admin API user management, and allowed_domains/blocked_domains to fence in web search and fetch
  • The Python SDK hit v1.0, and it breaks things. The HTTP layer moved to httpx2, a maintained API-compatible fork, so any Timeout, transport or http_client you construct has to come from there, and anything patching httpx needs httpx2.alias_httpx() at startup. Python 3.10 is the floor. Text Completions, temperature, top_p and top_k are gone. AnthropicBedrock raises instead of assuming us-east-1. And MessageStream no longer inherits Stream, so your isinstance() checks quietly return False

OpenAI and Anthropic both shipped an exploit model

  • Daybreak split into two tiers: Red for exploit validation and vulnerability research, Blue for general-purpose Sol with its guardrails intact. Red wants identity verification, legal attestations and an approved use case, and the launch partners are the big-vendor roll call from Accenture to Sophos. The findings are real -- CVE-2026-15903, a CVSS 8.8 V8 sandbox escape now patched in Chrome, plus five mobile OS bugs and 400-odd privilege escalations. OpenAI is blunt about the trade: "Models running with reduced safeguards carry risks beyond standard model usage"
  • Anthropic came at it from defense. Enterprise customers point Mythos 5 at a repo and get findings classified by CWE with severity and confidence. Scans bill as ordinary token usage on your existing plan -- no per-seat SKU, which is a real departure for a security scanner. The Cyber Verification Program is widening to dual-use work on Opus and Sonnet, so reduced safeguards are coming to the models you already run. The $35M Defender Advantage Fund is Claude credits aimed at open-source maintainers: if models find faster than people can fix, remediation is the bottleneck, and this buys some

typed's free tier moved onto your own hardware

  • typed now runs two tier families. Paid hosted is typed++max (Kimi K3), typed++xhigh (MiniMax M3), typed++high (Ling 3.0 Flash). The free tier, typed, runs on hardware you already own, against any model you choose -- start llama-server with it, or point typed at a Genie server on an NPU, and the CLI adapts to whatever answers. No quota, no login, and nothing leaves the box. typed local will still size a known-good preset for you if picking a GGUF and a quant is not how you want to spend the afternoon
  • We open-sourced the llama.cpp fork behind the NPU path -- an experimental QNN backend running GGUF matmuls on the Snapdragon X Elite's Hexagon NPU under Windows. Upstream already has a Qualcomm-maintained Hexagon backend on the Hexagon SDK with custom HVX kernels; this goes through the QNN runtime instead, so no test-signing and no DSP kernels, just the QAIRT community SDK and QnnHtp.dll. Kernels measure 6-11 TFLOP/s fp16. The status doc leads with the loss, which is why I trust the rest of it: per-op scheduling and IO copies eat the advantage, so end to end it still trails the Adreno GPU and a KleidiAI CPU build on dense 9-14B models. What works is the safety net -- every new shape gets built and test-executed before the backend claims it, rejects are denylisted to CPU for good, and a watchdog idles the backend rather than taking inference down

More from Claude

  • Fork mode is on by default. A subagent handed a side task inherits the conversation and the prompt cache, so it needs no re-briefing. @ mentions another session by name, and cross-session messaging reached Windows. Also: ANTHROPIC_DEFAULT_MODEL pins what new sessions start on, a Concise output style drops the preamble, /design previews editable UI artboards, and Remote Control shows each machine as a device card on your phone
  • Three security fixes to check against your own setup. File reads now reject Windows NT-namespace paths, closing an NTLM credential leak. macOS sandbox wildcard read-denies take precedence inside allowed regions -- a deny rule that looked like it covered a subtree did not. And the permission prompt's comment field with Shift+Tab was granting session-wide edit permission instead of the one approval you meant. Separately, a reliability sweep fixed unbounded memory growth in long sessions, output styles drifting back to default mid-session, idle Linux sessions pinning a core, and /resume loading sessions from a similarly-named different directory
  • Claude watermarks its text now, via DeepMind's SynthID-Text. No hidden characters, no unicode tricks: the sampler's randomness comes from a secret key plus the preceding words, so the mark lives in a statistical pattern across low-stakes choices -- fast, quick, rapid, where nothing shifts in meaning. Free in tokens, and it carries no identity, so it can say text is likely Claude's but never whose. The limit is structural and stated plainly: it does not work on factual passages or on code with exact requirements, because those leave no low-stakes choices to encode into. EU AI Act Article 50(2) is why it exists
  • Claude Academy opened, and the Claude in Chrome side panel became Claude Cowork. And a correction from two weeks ago: I said to calendar Sept 1 for Sonnet 5's 50% price rise, but Anthropic cancelled it -- $2/$10 per MTok is now permanent, and the subscription plans never moved either way

The local stack is converging on llama.cpp and Qwen

  • The case against Ollama got its loudest airing yet. "Friends Don't Let Friends Use Ollama" argues it packages llama.cpp parasitically rather than symbiotically, and did 648 points and 207 comments on Hacker News. Community tests put llama.cpp at 161 tokens/second against Ollama's 89 on identical hardware, and Ollama exposes five quantization formats where llama.cpp exposes the full set. Most of the piece is attribution: no llama.cpp mention in the README for over a year, a license compliance issue open 400+ days, distilled DeepSeek-R1 variants listed as plain "DeepSeek-R1", and CVE-2025-51471, where a malicious registry can exfiltrate auth tokens. Its thesis in one line -- the difference between a good-faith wrapper and a bad-faith one "isn't whether they charge money or ship proprietary code, it's whether they respect the work they stand on." The thread pushes back hard on all of it: ease of use wins, MIT permits every bit of this, and an Ollama contributor corrected a claim about HuggingFace pulls, which the author accepted
  • A hands-on switch to llama.cpp's built-in WebUI reaches the same place without the polemic, and is more useful for it. Same models and prompts: 100 tokens/second against Ollama's 93, Gemma 4 answering in ~12 seconds against 15. The cost is real -- Ollama swaps models in one click, llama.cpp means stopping the server and retyping llama-server -m <model>.gguf --port 8080. What you gain is sampling parameters, context settings and GPU offload that Ollama's interface never exposed. It declines to call a winner: llama.cpp for control and speed, Ollama for trading a sliver of performance for convenience
  • Two guides answer the question that follows, and they land on the same model. A ranking of Qwen variants for local use puts Qwen3.6-27B at 77.2 on SWE-bench Verified, the best dense open-source coder, and 35B-A3B at 86.0 GPQA Diamond on 3B active parameters per token -- everything Apache 2.0 except the 3.8-Max flagship. Its 24GB recommendation is 27B for coding, 35B-A3B for general work. A sizing guide for the RTX 5090 arrives at 35B-A3B too: 32GB of GDDR7 at 1,792 GB/s, ~118 tok/s on that model, and the rule of thumb that a Q4 model needs about 0.6 GB of VRAM per billion parameters. 70B at Q3 fits, which no other consumer card manages
  • The MoE offload flags are where the speed actually comes from, and the guide is the clearest writeup of them I have seen. --n-cpu-moe N pushes expert feed-forward weights from the first N layers into system RAM while attention stays on the GPU -- leave -ngl at all layers rather than lowering it, which would move attention to the CPU instead. The method beats any config you could copy: sweep --n-cpu-moe downward and watch tokens/sec climb until it falls off a cliff, then back off one step. Their RTX 5090 sweep runs 54 t/s at 20, 64.5 at 16, 69.4 at 12, then collapses to 27.5 when VRAM spills. A 3060 12GB does 51-53 tok/s on Qwen3.6-35B this way, and --no-mmap took one user's RAM from 98% to 71% at the same speed

The laptop silicon caught up

  • Qualcomm's Snapdragon X2 Elite Extreme puts 18 cores in a laptop and roughly doubles the NPU, 45 TOPS to 80, with boost to 5GHz. It is a re-architecture rather than a revision -- the uniform core design of the X1 gives way to a mixed one -- and PCMag's tests put it against the upper end of AMD, Apple and Intel silicon rather than trailing it. The test unit was the top X2E-96-100 with 48GB of LPDDR5X, in Asus' $1,699.99 Zenbook A16. That NPU is the same family typed now talks to through a Genie server, which is the practical reading of the number: 80 TOPS is roughly what it takes to keep a mid-size model resident and answering on battery
  • Nvidia's RTX Spark N1/N1X answers with a superchip: a 6144-core Blackwell GPU roughly equivalent to a desktop RTX 5070, a 20-core Grace ARM CPU built on 3nm with MediaTek, and 1 petaflop of FP4. The number that matters for local models is not the petaflop, it is the 128GB of unified LPDDR5X -- more addressable memory for weights than any consumer graphics card offers, on a machine that also plays triple-A titles at 1440p100. Windows 11 runs x86 apps on it through Prism emulation, and Asus, Dell, MSI, HP, Lenovo and Microsoft all have machines coming
  • Qualcomm is pushing into data-center silicon with the AI200 and AI250 accelerator cards, betting on efficiency rather than raw throughput -- LPDDR instead of high-bandwidth memory, 768GB per card. It also signed ByteDance in May to produce millions of custom data-center ASICs, deliberately specced below US export-control thresholds. The scale gap is not close: Snapdragon X Elite does 45 TOPS against the 1,000+ TOPS Nvidia claims for RTX Spark. That 45 is the same silicon underneath the Hexagon NPU work below, which is the useful way to read it -- not as a challenger to a rack of Nvidia, but as the reason a laptop can now serve a 35B model at all

Elsewhere

  • Ultrafast mode for GPT-5.6 Sol is in limited preview -- up to 14x Standard speed on Cerebras, up to 750 output tokens a second. No pricing, no GA date, and 14x is a ceiling rather than a promise. OpenAI is also retiring o3 from ChatGPT on Aug 26, with the DALL-E GPT following on Aug 30
  • "AI and Infrastructure Engineering" makes the case that this wave does to infra work what Kubernetes and serverless already did -- not remove the layer of decisions, but move the unit of work up from the machine to the workload. The example that carries it is a nested four-level Terraform for loop tagging subnets across regions: an hour to hand-write four years ago, seconds to generate now. What makes it worth reading is the trade it admits rather than the thesis -- faster at building than two years ago, and "visibly rustier at the fundamentals underneath that speed"
  • Tailscale tracked down a 16-year-old SQLite bug after 19 corruption incidents across their control-plane shards in six months. A race between a write transaction and a checkpoint let the checkpoint believe pages had been copied out of the WAL when they had not, losing the writes and corrupting the file. Their own recent changes were not the cause, so they contracted SQLite's support team, who built a filesystem-tracing shim (tmstmpvfs) that caught the race in the act. Fixed in SQLite 3.51.3. They also shipped a patched driver that logs a warning when the collision condition occurs, and two months later it fired -- proving the fix had just prevented another one

From us

  • oam.js closed its builtin export surface. import { statfsSync } from "node:fs" used to kill a program before it ran a line: a builtin's ESM named exports are its module object's own enumerable keys, so a name oam had not implemented failed at link time and took down bundled CLIs that never called it. Measuring the surface found 384 such names across 41 builtins, now implemented and gated. The memory-safety pass is the other half: a Windows child inherited every inheritable handle in the process; fsReadSync and zlibHandleWriteSync trusted a caller-supplied offset and length from ordinary JS, no addon required; and a live kill() on an extra-fd child was a silent no-op on Unix, so a CDP browser child could not be killed at all. Same pass produced the --permission audit -- 9 of 47 filesystem operations consulted the flag, and child_process and worker_threads ignored it entirely
  • oam is Yaw MCP's default sidecar runtime now, not an opt-in tier. Both bundled-browser servers cleared it -- server-puppeteer and @playwright/mcp each launched a real Chromium and served a real tools/call navigate against the node control. They genuinely could not run before: child_process ignored stdio, so 'inherit' and 'ignore' both behaved as 'pipe' -- exactly the npm bin-shim shape every sidecar boots through, which meant they started and sat mute while the launcher called it a success. The rewrite only touches Node launches and falls back to node/npx wherever oam cannot host
  • And don't forget to subscribe to MCP Weekly, first issue coming out next weekend!