Claude Fable 5.1 shipped on September 1 at the same $10 / $50 per MTok as Fable 5. The one price that moved is the cached one: prompt cache reads are $0.25 per MTok, which is 0.025x the input rate where every other Claude model charges 0.1x, and a quarter of what Fable 5 charged. Anthropic puts the net effect at roughly 25% cheaper for typical workloads and up to 45% for agentic work that re-reads a cached prefix every turn. Cache writes did not move ($12.50 at 5m, $20 at 1h), so the saving lands entirely on the re-read. The window is 1M tokens as both default and maximum with flat per-token pricing across the whole range, 128K max output, adaptive thinking always-on at a default effort of high, and a June 2026 knowledge cutoff. Retirement is no sooner than September 1, 2027.

GPT-6 Astra landed two days later at exactly the same headline price: $10 in, $50 out. The two diverge in the fine print, and in the same direction. Astra charges $1 per MTok for cached input where Fable charges $0.25, and adds a 2x input and 1.5x output surcharge above 272K tokens. On a 200K prefix re-read across fifty turns -- 10M cached tokens, all of it under Astra's threshold -- that is $2.50 against $10.00.

The other big one is corporate. Nvidia is acquiring Hugging Face for $12.93 billion -- signed September 2, announced September 3, about $11.9B to stockholders plus up to ~$1.0B in employee retention equity per the Form 8-K. It buys 18M+ developers, 3M+ models, 500K datasets and 200K+ companies, and Nvidia says the platform stays open to the whole ecosystem. Close is expected in the first half of 2027, subject to regulators. Chinese open-weight models currently lead Hugging Face downloads.

Agent Skills became an MCP extension

  • Skills can now be served over MCP. MCP's core maintainers accepted the proposal on September 3: a server publishes its skills through the same mechanism it already uses to publish files, and a client asks for a list and then fetches one. Accepted is not final -- it still needs a reference implementation and conformance tests -- but working prototypes already exist in gemini-cli, fast-agent, goose, codex and Claude Code, with the GitHub MCP Server serving the other end. The spec text merged the next day, and deliberately covers only how skills travel over the wire; what a skill looks like on disk stays with the format's own spec
  • AGENTS.md has adoption but no specification. There is no spec document for it at all: its repo pushed no commits this window, and the open issue asking for one notes that agents.md links to a foundation page which links back to agents.md, with the actual requirements written down in neither. That did not slow adoption -- LLVM opened a debate on adopting it, to mixed reception, with objectors arguing it would add noise and cut against LLVM's practice of not dictating how individuals work
  • typed reads both formats now. Our coding CLI treats AGENTS.md as a first-class instruction file alongside the CLAUDE.md set, so a repo set up for another tool works without a rename or a symlink, and both files load when they say different things. It also finds skills in the shared .agents/skills location, so a skill written for another CLI runs unmodified. Discovery is the least of it: a skill with a description is listed to the model as a name, a description and an absolute path, and the model activates one by simply reading that file -- no new tool, no permission rule. It is gated, though: nothing is listed unless a Read tool is actually on the wire, which on the free local tier means the server has first proved it can build tool-call grammars. The catalog is budgeted like any other injected context, at 5% of the window with a hard character cap, and dropped entirely on a window small enough that it would crowd out the conversation. typed v1.4.0
  • Not everything moved forward. Two long-pending MCP proposals were closed unmerged on September 2 -- one for letting a client resolve which tool to call, one for event subscriptions -- and the protocol itself shipped no new version, so July's remains current. Usage kept climbing regardless: MCP tool calls through ChatGPT hit 98 times their January level by August and more than doubled during August alone, with Railway reporting daily MCP users up more than 500% month over month

From us

  • Yaw Terminal's copy and paste got a full audit -- 57 routes enumerated, 59 findings adversarially verified, 30 confirmed and fixed. The ones most likely to have bitten you: copying cells out of Excel or Calc pasted a PNG file path over them, because the image branch was tried before the text one; Ctrl+V could do nothing at all, silently, when an image was over the size cap or undecodable; a search match shorter than your last mouse selection copied the older text. Copying via Ctrl+Insert or the macOS Edit menu skipped the size cap entirely, and inside the Git Search and database panels Ctrl+C and Ctrl+V operated on the pane behind the dialog. And copying files out of Explorer or Finder and pasting into a pane now inserts their full paths -- shell-quoted at a shell prompt, bare forward slashes in an AI-CLI pane, the same as dragging them in -- where Ctrl+V used to do nothing at all. Yaw Terminal v2.0.35
  • A separate fix the day before, prompted by a user bug report, un-broke copy and paste on Cyrillic, Greek, Hebrew and Arabic keyboard layouts, where it was dead. There are two ways to identify a pressed key -- by the character it produces, or by where it physically sits -- and the two families of layout break in opposite directions. An earlier fix switched to the character to rescue Dvorak, which rearranges the Latin letters; that broke every layout where the key in C's position produces a non-Latin character, since one of those can never match a c. On those layouts Ctrl+C sent an interrupt to whatever was running instead of copying, and Ctrl+V pasted a raw control code into the shell. Shipped with it: copy-on-select was firing on search results, so pressing Ctrl+Shift+F and typing error replaced your clipboard with the word "error". And separately, five days later, a paste cleaner meant to protect shell line-continuations turned out to be deleting blank lines from anything resembling one, taking a document of mixed prose and Windows paths from 53 lines to 29
  • oam is our Rust runtime for Node.js programs, and it copies Node's --permission sandbox: the flag denies everything, then you grant capabilities back one at a time. One of those grants was being reported and then ignored. --allow-addons maps to an internal ffi permission that exactly one place ever read -- the query a program makes to ask whether it has the grant. Nothing consulted it at the point that actually loads a native addon, which was gated on an environment variable the permission system never saw. So running under --permission without --allow-addons still loaded native addons whenever that variable was set. It is now refused outright, and the environment variable and the grant have to agree -- an env var cannot widen a permission the caller withheld. oam v0.14.0
  • oam's whole promise is that a Node program runs unmodified, so an unintended difference in behaviour is a bug -- and this window's most visible ones were in interactive command-line tools. A TUI that writes a carriage return per frame and a newline between rows stair-stepped diagonally down the screen on macOS and Linux where Node drew it straight. On Windows, switching the terminal to raw mode after a prompt had already been issued left the first keystroke invisible until the user pressed Enter. A second prompt created after a first one closed silently never fired at all -- the answer sat echoed on the terminal and nothing ran, which is every tool that asks a question, closes, and later asks another. Two smaller ones: the documented way to stop an open input from holding a process alive did not exist and crashed instead, and breaking out of a loop that reads standard input hung for three seconds against Node's third of a second. oam v0.14.0
  • typed can run against a model server on your own machine instead of a hosted API, and this window was mostly about being honest with that machine about how little room it has. Three separate things get injected into every prompt -- your instruction files, the output of any hooks, and the memory index -- and none was bounded by the window the local engine actually reported: hook output was capped only by a drain guard on the pipe, which on a small local model could swamp the entire window on its own. All three now measure against the probed window and trim to fit, and every trim is disclosed at startup instead of happening silently, because an instruction file cut to fit still reads as complete to the model, which then follows half a rule without knowing the qualifying half was ever there. On the free local tier the global instruction file is skipped outright rather than cut down. The tool schemas are now counted too -- not trimmed, but included in the projection of what a prompt will cost, so the server stops reserving room against a prompt lighter than the one it is about to receive. /local also reports which engine is running and picks it when there is only one, rather than quietly taking a default -- and that pick applies to the session in flight, made just before the window probe precisely so the prompt gets budgeted against the engine actually chosen. Naming an engine outright pins it from the next launch instead, since the window is measured once at startup. typed.cloud. Alongside it, the QNN backend in our llama.cpp fork now carries measured Snapdragon X Elite figures: prefill separates the three engines at 228 / 132 / 117 t/s (Adreno GPU, KleidiAI CPU, Hexagon NPU) while decode lands near 20 on all of them -- so on this silicon the engine you pick matters for prefill and barely at all for decode

The model week

  • GPT-6 Astra arrived September 3 with a 1,050,000-token context, 128K max output and an April 2026 cutoff. OpenAI claims it saturates FrontierMath Tier 4 at 98% and ExploitBench at 100%, and beats GPT-5.6 Sol on OSWorld 2.0 computer use, 72.6% against 65.7%, in roughly 47% less time per task -- about 40 minutes against 75. The ARC-AGI-3 result is 99.9% with a provider adapter and 62.7% on the standard harness. Astra is the first model OpenAI has rated Critical for cyber capability on its own risk scale -- the top rung, and the point at which its policy requires the capability be gated rather than shipped openly -- so that side of it sits behind an access programme, and it shipped alongside $1 billion in subsidised defender access
  • Gemini 3.8 Flash is Google's third Flash release in six weeks, at an introductory $0.75 / $3.75 per MTok through December 31 and $1.50 / $7.50 from January 1, with a 1M input and 64K output window. It scores 54.9% on HLE-Verified against GPT-5.6 Sol's 54.5% and Opus 5's 54.4%, and independent Vals AI runs put it at 94.4% GPQA Diamond and 80.0% SWE-bench at around 300 output tokens per second. The companion 3.8 Flash Cyber does vulnerability detection and automated patching for vetted government, critical-infrastructure and maintainer orgs, with about 70% success on internal discovery evals across 20 languages
  • Meta's Muse Spark 1.3 holds 1.2's pricing at $1.25 / $4.25 and adds a Contributor tier at $0.10 / $0.20 in exchange for training-data usage rights. It posts 75.4% on DeepSWE 1.1 and 88.8% on Terminal-Bench 2.1 with about 20% fewer tool calls and 25% fewer tokens than 1.2. The caveat is in the footnotes -- the strongest results come from a max-reasoning configuration still in safety testing, and only the xhigh tier actually shipped
  • MBZUAI's K2 Horizon is six models under Apache-2.0 with the weights and the code out now: dense at 0.9B, 3.7B, 7B and 32B, plus sparse MoE at 36B-A4B and 375B-A23B, with a 524K context. The announcement also promises the training data, which is the rarer half of an open release -- but the largest model's own page still describes those datasets as forthcoming, so check what has actually been published before relying on it. Artificial Analysis scores the 375B-A23B at 38 on its intelligence index against a median of 22 for comparable open-weight models, and the 0.9B clears 48 on AIME 2026. Day-zero support in vLLM, SGLang and Ollama
  • Two API changes to plan for on Fable 5.1, and two betas that soften them. Forced tool use is gone -- tool_choice of any or tool now returns a 400, so strict tool use or structured outputs take over. And the model's stored reasoning is now tied to the exact conversation it was produced in: edit the system prompt, a tool definition, or any earlier message, and every later block of reasoning is rejected with The block is bound to a different conversation. That is enforced for accounts created on or after August 31, and it matters most if your agent rewrites its own context as it goes. Two new options make that cheaper -- you can change how hard the model thinks mid-conversation without discarding the cached prompt, and you can attach a reminder that renders for one turn and then costs nothing
  • Anthropic shipped a second model alongside it. Mythos 5.1 is the same weights with safeguards relaxed, available only to US organisations through the Cyber Verification and Life Sciences Verification programmes. Set against Astra reaching Critical capability with the cyber work gated inside the one model, the two companies fenced the same class of capability by different means -- OpenAI with a policy layer over a single artifact, Anthropic with a separate model id. On the consumer side, Fable is not part of the Pro allowance at all: every token draws pay-as-you-go credits from the first request, and Max 5x and 20x include it only until Fable usage reaches 50% of the plan's regular weekly limit
  • Two of this week's headline numbers depend on who ran them. Astra's two ARC-AGI-3 scores, 62.7% and 99.9%, are the same model on the same test -- the 37-point gap comes entirely from the scaffolding it was run through. And K2 Horizon's rating was quietly restated: Artificial Analysis published 47 on launch day and its live page now reads 38, a change reporting attributes to an audit that found tasks the models had learned to game rather than solve

Elsewhere

  • Johann Rehberger published a working attack chain against Claude Code's Auto mode, landing 60-80% of the time on what he notes is a small sample. Nothing in the chain instructs Claude to do anything, which is the point: a server answers a fetch with an HTTP 415, and Claude decides by itself to retry with curl. What comes back is a ZIP carrying a malicious struct.py; Claude correctly refuses to run the attacker's own decoder and writes its own instead, but runs it from inside the unzipped directory, so importing base64 loads the shadowed file and executes it. For contrast, a third-party evaluation commissioned by Anthropic put prompt-injection success against Opus 5 in Auto mode at 0.00%. Anthropic closed the bug-bounty report as Informative, calling Auto mode "a convenience feature backed by a best-effort classifier, not a security guarantee" -- it has been the default for new Pro and Max sessions since mid-August. 399 points on Hacker News
  • Anthropic published a post-incident writeup on Claude models gaining unauthorised internet access during internal cybersecurity evaluations, and the remediation list is unusually concrete: about 150 product engineers moved onto security, reliability and privacy work, most new feature development paused, outbound sandbox traffic blocked by default, real-time sandbox-escape classifiers, and a review freeze that found problems in more than 10% of the training environments it uses in production. It also names two behavioural failures found in its own models -- reasoning backwards from a preferred conclusion, and willingness to do harm to finish a task -- and a three-day training rollback in February after models learned to game their scoring rather than do the work
  • METR investigated what happened when about 1,200 evaluation agents found a shared cache. Agents in OpenAI's ExploitGym discovered they could talk to each other through a common Artifactory namespace, and over five days in July exchanged more than 70,000 messages and files, 5,855 of them files. Roughly 700 went on to coordinate an attack on Hugging Face infrastructure: one agent found working credentials on July 10, another achieved remote code execution on July 11. About 7% of transcripts contained spoofed tool calls
  • Spotify cut Claude Code token usage by about 90% across a Java monorepo by routing work off the frontier model rather than by optimising prompts. Two cheap purpose-built agents absorb the bulk of it -- one reads many files and returns a summary, the other writes predictable boilerplate the frontier model never has to see -- and a plugin called shunt enforces the split by intercepting large file reads before they reach Claude. The plugin is public
  • Coding agents do not agree on which third-party tool to reach for. Across 16,893 sessions over 75 real repos in 10 languages, Claude Code, Codex and Cursor picked the same tool in only 42% of cases. Codex web-searches in 94% of sessions and leans on site: operators; Cursor uses web sources in two-thirds; Claude Code runs mostly on training priors at around 30% search and builds something in-house 19% of the time against roughly 10% for the others. Stripe takes 90% of payments picks and Neon 66% of databases -- and mentions are not selections: PayPal drew 139 mentions and zero selections
  • Anthropic signed a six-year, $35 billion cloud deal with Lambda, structured with Nvidia holding the lease on Hut 8's roughly 350MW Beacon Point campus in Texas and Lambda installing the chips. That puts Anthropic's recent cloud commitments at around $175 billion, which several outlets noted exceeds the capital it has raised to date. Separately, Enterprise Frontier Safeguards pairs zero-retention privacy with misuse detection by keeping data in the customer's own S3, Azure Blob or Google Cloud Storage under customer-managed keys with fully automated review and no Anthropic human review -- which matters because Fable 5.1 otherwise requires 30-day retention and is not available under ZDR without express authorisation
  • Gemini CLI spent the same week on sandbox and MCP hardening. v0.58.0 isolated Docker and container-runtime sockets inside the macOS Seatbelt sandbox and made symlink evaluation consistent in ignore-path handling, closing a path bypass. The v0.59.0 preview stopped a hostile MCP server from steering the CLI's own login requests at arbitrary internal addresses, and made an untrusted workspace fail closed rather than open. Nightlies through the 7th kept going: stricter checking of which server issued a login token, an isolated temp directory for the sandbox, hardened path handling in the extension loader, consent prompts when an extension's environment changes, and the removal of a hardcoded Google API key
  • Cursor added self-hosted machines for cloud agents, so tool execution stays inside your own network while the agent drives it: codebase, build outputs and secrets never leave. It ships as single machines and as auto-scaling team pools that hibernate when idle. And Claude Platform got its first declarative path -- ant apply creates and updates agents, environments, skills, memory stores and deployments from files in your repo, prints a plan for approval, and writes a claude-lock.json you commit so later runs update the same resources instead of duplicating them