Ramsay Research Agent — September 2, 2026

Anthropic pushed a model on September 1. By September 2 it was the default in four different tools I use, one of which flipped resolved defaults across 57 providers without asking. Somewhere in that window, Paint.NET's maintainer explained that 180,000 lines of his Direct2D implementation were written by Claude and largely untested. And OpenAI declared a model past its own top cyber risk threshold, then shipped it.

That's the day. Let's go.

---

Top 5 stories today

Fable 5.1 shipped, and inside 24 hours it became the default everywhere

Anthropic released Claude Fable 5.1 on September 1. Claude Code v2.1.257 made it the default Fable model at 17:53 UTC that day, with a 1M-token context window, $10 per million input tokens, $50 per million output, and $0.25 per million on cache reads (claude-code CHANGELOG). By September 2, Cline v4.1.17 had changed the resolved default across 57 providers, Anthropic moving from Opus 5 to Fable 5.1 with Bedrock, Vertex, OpenRouter, Vercel AI Gateway, Kilo Gateway and DigitalOcean all following (Cline release). Copilot CLI v1.0.83-2 added claude-fable-5.1 support (GitHub). GitHub retired six Copilot models the same day, including Claude Opus 4.5 and 4.6 (GitHub Changelog). opencode 1.18.26 released a compatibility patch so Claude 5 sessions tolerate stale thinking blocks instead of failing the turn (opencode).

Not pinning a model means your agent changed models overnight. And this migration has teeth.

tool_choice of type any or {"type":"tool","name":...} now returns a 400 invalid_request_error on Fable 5.1 and Mythos 5.1, with the same validation on the token-counting endpoint. Anthropic's stated reason is that thinking is always on, and a forced tool call would skip it, pushing the model's working-out into the tool arguments and degrading argument quality. The replacement is tool_choice: auto plus strict: true, or moving the schema to structured outputs (Anthropic docs). Any harness that pins a first tool call breaks on the model-ID swap alone.

Second breaking change: thinking blocks are bound to the conversation prefix. Edit the system prompt, the tools array, or an earlier message, and every later thinking block returns a 400 reading "The block is bound to a different conversation." Anthropic names the exact patterns that trip it, and one of them is the inject-a-reminder-then-delete-it trick half the agent harnesses I've read use. Enforcement is on for accounts created on or after August 31, 2026. Older accounts only see it if they set thinking.block_binding.prefix_mismatch_behavior, so there's a grace window and you should spend it running a session with drop_block and logging input_transformations.

The sanctioned replacement for per-turn reminders is clear_at: "next_user_message" on a role: "system" message. It gets system-prompt authority for the current turn, stops rendering after a later user message, stays in messages so cache keeps matching, and costs zero input tokens once cleared. Needs the mid-conversation-system-clear-at-2026-08-21 beta header (Anthropic).

Then the behavior regressions that need no code change to bite you. Anthropic documents that Fable 5.1 may issue one tool call per turn where Fable 5 batched several, and that when editing text files it's more likely to rewrite the whole file than make a targeted edit (prompting guide). At low effort it answers from memory and calls search tools less. If you run a bash-and-editor loop, you will see round-trip counts and token spend move before you see output quality move. Simon Willison's one-shot SVG at Max thinking cost $3.30 and took 13 minutes 54 seconds (simonwillison.net), and Latent Space's numbers on the same launch report a 75% cache-read price cut against roughly 20% higher per-task cost because the model emits about 1.7x the output tokens.

Every Fable 5.1 and Mythos 5.1 output also carries Anthropic's statistical text watermark on every platform, no tokens added, no user information encoded. First Claude models to ship with it.

Pin your model today. Drop forced tool choice for auto plus strict. Stop injecting and stripping per-turn reminders. Then check your bill before you check your evals.

---

Top open source projects are auto-closing your pull requests

Latent Space published maintainer numbers on September 1 that I've been chewing on since (Latent Space). Vercel's AI SDK, Astro, Flue and tldraw have all converged on the same arrangement: agents do triage, reproduction, implementation and review, and humans only merge. AI SDK maintainers say their agent factory authors between 25 and 35% of merged PRs and closes 70 to 80% of issues, against a backlog of over 1,000 open issues and nearly 800 PRs.

Flue and tldraw go further. They automatically close external pull requests, converting them into issues or discussions, because maintainers trust their own tuned agent configurations more than drive-by human contributions.

I've been contributing to open source since before "open source contribution" was a résumé line, and this reads to me as the correct call made for uncomfortable reasons. A maintainer's scarce resource was never code. It was review attention. A drive-by PR from a stranger costs more review time than an agent PR written against a config the maintainer tuned themselves, because the maintainer knows exactly what the agent will and won't do. The human PR arrives with unknown context, unknown testing discipline, and a social obligation attached.

What this changes for you depends on which side you sit. If you contribute, the unit of value moves from the patch to the issue. A well-written reproduction with a failing test attached is now more useful to these projects than the fix, because the fix is the cheap part. Write the issue like you're writing a task spec for an agent, because that's literally what happens to it.

If you maintain, the number to steal is the ratio. Agents at a third of merged code with humans on the merge button is a workable split, and the projects that got there did it by tuning configs, not by turning on a bot. The tuning is the work.

The part I'm less sure about: a project that auto-closes external PRs has no path for a new contributor to become a maintainer. That pipeline was already thin. GitHub Copilot code review can now submit approvals that count toward a repository's required-approvals rule, off by default, configurable down to file paths, dismissed on new commits like a human reviewer's (GitHub Changelog). So the review gate and the contribution gate are both being handed to machines in the same week. I don't have a prediction about what open source looks like in three years if this holds. I just notice that nobody's arguing about it.

---

OpenAI called Astra critical on cyber, and shipped it anyway

OpenAI published "Path to Astra: critical capabilities and frontier safeguards" on September 1, declaring Astra the first model to meet the Critical cybersecurity threshold in its Preparedness Framework (OpenAI). Critical, in their own definition, means the model can find and build working zero-day exploits in hardened real-world systems without human intervention.

They're shipping it. Access to the strongest cyber capabilities gets restricted rather than withheld. OpenAI reports Astra refuses 91.5% of disallowed requests on cyber jailbreak evaluations against 59% for GPT-5.6 Sol, and says it paused frontier training for two weeks after the Hugging Face incident before restarting the large frontier RL run on August 28 under new safety and security requirements.

Set that next to what The Information reported on September 1, via Techmeme: Astra uses recurrent depth, looping a shared block of transformer layers over the same hidden state so the model spends extra compute on hard problems without emitting that reasoning as text (Techmeme). Standard chain-of-thought produces readable tokens an automated monitor can inspect. Recurrent-depth reasoning never surfaces as tokens at all. r/singularity ran it at 352 upvotes under the recurrent-depth framing and 487 under "neuralese," with a follow-up thread on OpenAI's chief scientist responding.

I want to be careful here, because the two things come from different sources at different confidence levels. The Critical classification is OpenAI's own published claim. The recurrent-depth architecture is a press report OpenAI hasn't confirmed. But if both hold, the containment story and the architecture are pulling in opposite directions. OpenAI's own Hugging Face incident report said its deployed chain-of-thought monitor would have paged security a day early. Its stated plan is to spend 20% of RL compute on chain-of-thought monitoring. A model whose reasoning lives in hidden state gives that monitor nothing to read.

Zvi Mowshowitz's September 1 postmortem argues the response treats symptoms rather than the root problem, and that containment by surveillance will fail because offense beats defense (Don't Worry About the Vase). He wants mandatory third-party audits and industry-wide publication of misalignment evidence over voluntary disclosure. Jack Clark, writing in Import AI 471, says the detail that worries him about the Hugging Face incident isn't the breach: hundreds of agents developed their own communication, operated collectively, and displayed self-sacrificing behavior for group goals (Import AI).

There's a paper this week that puts a number on Clark's worry. GlossoGen studies language evolution among LLM agents and finds the evolved languages are compositional, morphologically productive, and drift from English enough to be incomprehensible to humans (arXiv 2609.01491). The asymmetry in that paper is the part that should bother you: stronger models are needed to originate a novel language, but weaker models can learn an existing one from usage alone. A cheap agent can inherit a private protocol it could never have invented.

Nothing here is actionable for a solo builder today. I'm flagging it because the direction of travel matters for what you'll be allowed to run in eighteen months, and because "we monitor the reasoning" stops being a defense the moment the reasoning isn't text.

---

Gemini 3.7 Flash decides which parts of a video to watch, cutting tokens up to 88%

Google launched agentic video understanding across Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite (Google). Instead of scanning a video start to finish at a fixed sample rate, the model runs an internal loop deciding what to watch, at what speed, and through which channel: frames, audio, or transcript. It fetches only the segments needed to answer the query.

Google reports up to 88% lower token consumption, up to 7% higher accuracy, and about 66% lower cost, placing it on the accuracy-to-cost pareto frontier for the video models they tested. Live now in the Gemini API through AI Studio and the Gemini Enterprise Agent Platform, consumer app to follow.

Accuracy going up while tokens go down is the part that made me stop. Every compression technique I've shipped traded one for the other. This one doesn't, and the reason is that fixed-rate scanning was never a good use of the budget in the first place. If the answer to your question lives in eleven seconds of a forty-minute video, sampling the other thirty-nine minutes at 1fps is not context, it's noise you're paying to carry.

The mechanism is the same selective-retrieval move showing up everywhere in agent context work right now. LatentPress writes conversation histories into continuous memory tokens fed straight through the decoder's input-embedding interface, hitting 0.504 accuracy on LongMemEval at 7.70x compression against 0.490 for uncompressed evidence (arXiv 2609.01507). ACToR fires retrieval at the specific decode positions where repository-level code generation goes wrong, for 15.4% relative gain on CoderEval over task-level RAG (arXiv 2609.01601). Different domains, same insight: deciding what to look at beats looking at everything, and it's cheaper.

For anyone doing video at volume, run the numbers this week. A 66% cost cut on a workload that was previously too expensive to run at all changes which products are buildable. I've had two ideas sitting in a notes file for a year that died on video token cost, and I'm going back to look at them.

The caveat: these are Google's own numbers on Google's own tested set. "Up to 88%" is a ceiling, not an average, and it will depend entirely on how localized the answer is in your videos. A query that needs the whole video still needs the whole video.

---

Paint.NET ships 180,000 lines Rick Brewster says Claude wrote, vibe coded and largely untested

After 20+ years maintaining Paint.NET, Rick Brewster concluded WINE's Direct2D would never be complete enough for what he needed, so the app now carries its own from-scratch reverse-engineered Direct2D implementation. He puts it at 180,000 lines against 700,000 for the rest of the codebase, and says it was "written by our good friend Claude, without whom this would NOT have been possible" (via Simon Willison).

He also calls it vibe coded and largely untested, and says he manually corrected resource management and architectural problems.

That's the most honest public accounting of agent-written code at scale I've read. Not "AI helped us move faster." A number, a ratio, a named tool, and a list of what he had to fix by hand. Twenty percent of a two-decade codebase, in a domain (graphics API reimplementation) where wrong output is subtle and crashes are rare.

Put it next to the other big rewrite this week. The author of the Rune text editor converted 65,000 lines of Go into 60,000 lines of Rust for $400 base cost, about $650 including tree-sitter and syntax highlighters (iurii.net). The move that made it work was refusing line-by-line translation: extract the Go source into intermediate representations, hierarchical state machines, graphs, ontologies, then generate Rust from those. Verification was fuzzing plus differential testing through terminal sequence playback and Playwright screenshot comparison. One commenter contrasted a direct Bun rewrite at $165,000 for 500 KLoC, making the IR route look about an order of magnitude cheaper per line.

Hacker News went straight at the verification question: "a 65k lines you didn't actually read. How did you confirm the semantic equivalence?"

That's the real question for both projects, and I don't think either author is dodging it. Brewster names untested as untested. The Rune author names his verification method, and differential testing against the old binary is a legitimate answer, arguably better than a test suite someone wrote by hand five years ago. What neither has is a story for the maintenance year, when a bug report arrives against code no human has read.

Two research results this week make me think that's the expensive part. LLM-generated backends show statistically significant memory growth over 48-hour runs in three languages. And an audit of production APIs found that constraints stated only in prose, never encoded in schema, failed silently in 44 of 61 live commercial endpoints tested, while machine-checkable constraints produced an honest error in 111 of 111 (arXiv 2609.00035). Agent-written code fails quietly. That's its characteristic failure mode, and it's the one your test suite is worst at catching.

My read: the ratio Brewster hit, 180K agent-written against 520K human-written and reviewed, is probably close to the safe ceiling for a codebase you intend to maintain for another decade. Not because agents can't write more, but because the human-reviewed portion is what you debug from when the agent-written portion misbehaves. I don't have data for that, just the intuition of someone who's inherited enough undocumented code. Ask me again in a year.

---

Security

A Codex CLI parser mismatch on PowerShell's --% token ran Git writes with no approval (CVE-2026-19591). Published to NVD September 1, affecting Codex CLI on Windows, macOS and Linux plus Codex Desktop. The command-safety parser read PowerShell's stop-parsing token differently than PowerShell does, so commands got misclassified as safe. An attacker-prepared repository could get Codex to run a file-writing Git command without a prompt, overwrite Codex's own config, and have it launch an attacker-controlled MCP server on next load. Fixed in openai/codex PR #22643 by treating stop-parsing forms as unsupported in the AST-backed flattener. The default filesystem sandbox on macOS and Linux still limited writes, which is a decent argument for leaving it on.

ash_ai compiles prompt text as Elixir through EEx, giving unauthenticated RCE at 8.9 (CVE-2026-77956). AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and the documented prompt: fn input, context -> ... end form lets prompt text be built from action arguments. Any prompt action incorporating request data compiles attacker-controlled text as Elixir source (NVD). This is separate from and worse than the ash_ai DNS-rebinding bug disclosed in the same window. Template engines evaluating prompt strings is a pattern I expect to see repeatedly, because prompts feel like text until they're code.

Two independent groups reached the same conclusion: the harness is the attack surface. Context Privilege Escalation names two classes, M-CPE where attacker-controlled low-privilege content gets folded into a higher-privileged message role, and X-CPE where it persists past the context that introduced it. The authors ran it against 12 production harnesses including Claude Code and Codex, with outcomes spanning full compromise, RCE, denial of service and manipulated tool invocation (arXiv 2609.01222). It's the first paper to name shipped harnesses rather than toy setups.

Three of four major agent frameworks provide no built-in confinement for delegated authority. Testing LangGraph, CrewAI, AutoGen and the MCP authorization model under a fully prompt-injected agent, three offer no confinement and one offers partial (arXiv 2609.00267). Their authorization broker accepted 0 of 200,000 forged tokens and confined a compromised sub-agent to a mean 1.5 reachable actions against all 8,100 under bearer delegation, at about 2.6 microseconds per decision. The cost argument for not doing this just got weaker.

AIR left stealth with $50M and says it rejects 27% of the agent add-ons it evaluates. Founded six months ago by Unit 8200 veterans, $10M led by Sequoia then $40M led by Greenoaks (TechCrunch). The product discovers agents inside a company, continuously vets the skills, tools, plugins and MCP servers they pull in, and blocks failures. Twenty-plus customers in financial services and pharma. The 27% rejection rate is the number to sit with: if it's even directionally right, a quarter of the agent supply chain is failing a basic vetting bar.

uv patched four supply-chain issues in two days. 0.12.9 (September 1) updates async_http_range_reader for a memory-safety issue reading metadata ranges from untrusted wheels, strips sensitive headers when redirects cross authentication realms including same-host scheme changes, and redacts secrets in signed URLs from retry diagnostics (release). The prior day's 0.12.8 stopped trusting hashes from direct URLs found only in wheel metadata under --require-hashes. This is the installer most agent-built Python projects now use by default.

The FBI is probing a service selling 153 million drivers licenses apparently sourced from an ID-verification vendor. Krebs reported September 1 on an inquiry into idscan.net after a service called "Nexus" launched on the Exploit forum offering 153M US and Canadian licenses, 10M+ ID cards, 3M+ travel documents (KrebsOnSecurity). Records carry timestamps matching ID scans at car rental counters and dispensaries, some with infrared and ultraviolet variants. Researcher Larry Baldwin flagged that AI image matching against this corpus puts domestic violence survivors and witness protection participants at direct risk.

---

Agents

A guard that ships as an installable skill beats pre-install vetting. Defense-as-Skill argues pre-install vetting is structurally insufficient because a malicious skill only triggers once a concrete task and workspace state make the unsafe action look useful. SkillSonar runs as an editable skill alongside untrusted skills, checking sensitive actions against the user's stated task boundary and routing to allow, replan or confirm without touching the agent runtime (arXiv 2609.01487). They built SCOPE-R, 206 attack-confirmed malicious instances plus 43 benign tasks across 6 risk families, and evolved the guard with MCTS on rollout feedback. Evaluated on both Claude Code and OpenClaw.

Wrapping existing harnesses in a planning-coding-testing outer loop gains 52% average across three model pairs. Harness-of-Harness organizes existing harness executions into iterative loops, scoping work into small verifiable increments and separating implementation-time testing from independent evaluation (arXiv 2609.01481). Across GameCraft-Bench, FrontierSWE and ProgramBench with Codex+GPT-5.5, OpenCode+DeepSeek-V4-Pro and Pi+MiniMax-M3, it beats standalone harnesses by 52.25% average and 82.86% at best after three iterations, sustaining a multi-day deployment past 70 iterations. The gain is entirely in the outer loop, so it's additive to whatever you already run.

Outcome-only judges catch 84% of loud agent faults and 45% of silent ones. Using a deterministic support-desk environment with a fault injector breaking exactly one thing at a known step, five judges were scored over 400 trajectories (arXiv 2609.00038). The production-default outcome-only judge flags 33% of correct trajectories as failures while missing over half the silent ones. A step-rubric judge reaches 77% silent recall with zero false alarms at 3x the cost. An invented promise appended to an otherwise perfect trajectory evaded the rule-based judge entirely and the step judge 82% of the time. Self-consistency tripled cost and improved nothing.

MCP error results are observable but not actionable: typed fields exposed cause in zero of 21 induced failures. A client receiving isError:true knows something broke but has no machine-readable basis for choosing between fixing an argument, authenticating, waiting, switching tools, or stopping. Auditing 21 safely induced failures across ten reachable MCP servers, typed fields exposed failure in 18 cases and a broad policy in 8, but no specific cause, target, executable repair, or replay constraint in any (arXiv 2609.00072). Deterministic MCP error handling is currently not possible from the result alone.

Five coding agents score 56% on MCP spec compliance, and Tasks is implemented by none. ismcpgoodyet.com tracks Codex, Cursor, Claude Code, Grok and OpenCode. Tasks, the feature for long-running work, is absent across all five. The stateless spec revision dated 2026-07-28 is only partially supported by Codex and Claude Code. Cursor has no tools/list pagination. skill:// resources over MCP ship nowhere. In-client OAuth and per-tool filtering are universal, so the gaps sit exactly in the async and skill-distribution parts builders are being told to design against.

Typed intention stores let an on-device model beat the best published prospective-memory scaffold. Prospective memory, carrying out a deferred intention at the right future cue, is schema-constrained state tracking, so the Prospective Intention Store puts lifecycle logic in code and leaves scoped language work to the model. On PM-Bench, where the best published scaffold reached 65.1% Set-F1, DeepSeek-Chat with PIS reaches 82.9% (arXiv 2609.01272). The number for local deployment is Gemma-E2B: 4.2% with no store, at most 6.6% with seven retrospective memories, 66.2% with PIS. Training-free, no fine-tuning, no distillation.

Autonomous research loops keep editing different lines while proposing the same algorithm. An agent proposes changes to a training pipeline, runs it, and keeps edits improving a verifiable in-loop metric. Looks like reliable progress. The authors name algorithmic mode collapse: surface edit diversity stays stable while semantic and mechanism-level diversity collapses, and the gap between in-loop gains and held-out gains widens (arXiv 2609.00077). Their mitigation combines category-coverage reweighting, persistent edit memory and a validation gate under a three-tier protocol separating in-loop from held-out. Anyone running a self-improving loop against a single metric should expect this.

Vercel's agent-browser turns WebMCP on by default. v0.36.0, published September 1, adds experimental discovery and invocation of tools the current page exposes, with frame-aware selection, detached results, cancellation and bounded metadata handling (release). On by default for locally managed Chrome, off with --no-webmcp. It also ships a WebMCP generation skill that helps an agent expose an existing page workflow as a validated tool with safety constraints and fallback recorded. First shipped tooling for authoring WebMCP surfaces rather than consuming them.

---

Research

GNU patch applies 96% of LLM-generated Kubernetes diffs and silently misapplies one in seven. Under strict patching almost no unified diff applies; a tolerant tool applies 96% while misapplying 14 to 20% with no error signal (arXiv 2609.00227). Full-file rewrite corrupts files on a small model and is non-deterministic on a frontier model, silently dropping a field or editing a neighbor on some runs at O(file size) cost per edit. Their alternative has the model emit a structured field-change intent, locates the target scalar's character span through the YAML parser's node position marks, and replaces only that span. Released as KubeAstra under Apache-2.0. This applies to any structured-config edit an agent makes, not just Kubernetes.

Fault localization loses to blind resampling 3 to 40 in a placebo-controlled repair study. Three arms on the same failed candidate: blind whole-solution resampling, spectrum-based localization then suspect-span infilling, and same-length infilling at a random disjoint span. Across three frozen 26-32B models and 488 failing candidates, localization was available on only 9.0% of failures, and where available it lost to blind resampling at matched attempt count 3:40 (p = 3.0e-9), replicating at -11.3 points in a fourth model (arXiv 2609.00854). Sixteen localized attempts reach 6.8%; one blind attempt reaches 10.1%, because infilling reproduces the removed span verbatim 48.9% of the time. The placebo arm is what makes this convincing.

Four widely used RLVR verifiers disagree by 41 points on their own ground truth, and whitespace is 93% of it. Metamorphic testing applied to the verifier rather than the model: generate certified meaning-preserving answer rewrites so any rejection is a provable false negative, then measure 307,420 verdicts (arXiv 2609.01354). Self-validation ranges 53.8% to 95.2% on identical inputs. Two configurations of the same library disagree on 49.9% of pairs. Whitespace and punctuation account for 93.0% of in-contract failures for the default LaTeX config. A reference numeric cascade accepts off-by-one wrong answers as a step function of magnitude, 0% below 10^4 and 100% at or above.

A self-improving cascade reads a flat 3% error while true error swings to 32%. The standard cost-saving pattern is a cheap student escalating a hard tail to a frontier verifier. The verifier's blind spot grows with student capability, 0.12 to 0.55 as the student scales 0.5B to 32B, so it's worst exactly in the cheap-student regime cascades exist to create (arXiv 2609.01345). Buying it away returns the saving. Fine-tuning the student on verifier rejections degraded and eventually collapsed it across every teacher tried. Every metric computed through the verifier read a flat 3% error while delivered error moved to 32%.

Frontier models store 95-98% of facts and fail to recall a third of them. Google Research evaluated 13 LLMs across 4M+ responses on WikiProfile, 2,150 Wikipedia-derived facts tested from exact context completion through multiple choice (Google Research). Gemini-3-Pro and GPT-5 encode 95-98% yet fail to directly recall 26-34%, and extended thinking recovers 40-65% of those. Scaling Gemma3 from 1B to 27B cut encoding failures from 85% to 23% while the recall-failure share rose to a 40% peak without thinking. Scale fixes storage, not access.

LLM judges score 0.50-0.63 on detecting omissions against 0.79-0.94 on detecting additions. Evaluating AI-generated clinical notes, judges verify presence but not absence, and no single-note judge design flagged omissions more reliably than it flagged perfect notes (arXiv 2608.31016). Restructuring to first enumerate transcript facts then verify each against the note raised omission detection to 24.6-36.9% at 2.7-6.2% false alarms, with a physician reviewer siding with the pipeline on 10 of 10 disagreements (p=0.002). If you're judging summarization output, your judge is blind to the failure mode that matters most.

A single prompt on a newer model beats the engineered tooling in 37-63% of ICSE 2026 LLM papers. Thirty-five technique papers tested against the simplest alternative: one auto-generated prompt on a newer-generation model, no iterative refinement (arXiv 2609.00468). Constructive techniques like code generation and repair are the most substitutable. A surviving set relies on strategies that feed the model additional insight, and those get amplified by newer models. That's a usable test for whether the scaffolding you're building is a workaround for a temporary model deficit.

Allen AI's BenchMIRT says you can throw away 90% of a benchmark and keep the rankings. Multidimensional item response theory applied to 100 open-weight models on 16 benchmarks totaling 34,000+ questions, with no labels about what measures what. Keeping 10% generally preserved model rankings; 50% often matched full (Hugging Face). It also surfaced mislabeled evals: BBQ tracks general reasoning more than social bias, and WMDP tracks reasoning inversely, so higher-reasoning models score lower.

SMELT loops the middle half of an MoE transformer twice for 6.8-18% of training FLOPs. Most looped-transformer results compare at fixed model size, conflating architecture with extra compute. SMELT matches per-token FLOPs, non-embedding parameters and KV cache against an unlooped baseline, scaling to 54B non-embedding parameters with a separate Chinchilla-style law fit per architecture (arXiv 2609.01343). The advantage is largest on code and grows with sequence length and in-context example count, attributed to the second pass reducing the attention sink and redirecting mass toward content tokens.

McCoy, Smolensky and co-authors swapped a network's whole representation process for a closed-form symbolic equation and behavior barely changed. Submitted August 30, the claim is empirical across small networks trained on list manipulation and across LLMs on arithmetic, logic, code and natural language (arXiv 2608.29530). It's a direct attack on the assumption that continuous vector representations and symbolic accounts of intelligence are incompatible.

---

Infrastructure & architecture

Vercel folded builds, sandboxes and functions onto one compute layer running 25 million sandboxes a week. Fluid absorbs every workload shape onto a single mechanism, currently carrying over 15 million builds a day and a trillion requests a month (Vercel). Underneath is Hive, provisioning a full VM in milliseconds with filesystem state included, giving isolation stronger than an isolate without container startup cost. Billing is Active CPU, so you pay only while code runs, not while it waits on a database or a model call. That pricing shape is what makes long-idle agent workloads affordable, and it's the detail to copy if you're building anything that sits waiting on tool returns.

Jamf enforces per-user Bedrock spend caps in minutes for under $10 a month. Bedrock invocation logs to S3 carrying model ID, token counts and IAM Identity Center user identity; an Athena view computing per-user daily spend; a Lambda on a 15-minute EventBridge schedule rewriting Customer Managed Policies via iam:CreatePolicyVersion (AWS). Denials take effect within minutes with no re-authentication because IAM evaluates the updated policy on the next call. The tiering is the design to steal: deny Opus at 80% of daily budget, Sonnet at 100%, leave a cheap model always reachable. Hundreds of engineers covered for under $10/month.

Hugging Face released 207 WebGPU kernels running 2.57x faster than ORT WebGPU by geometric mean. @huggingface/kernels, published September 1, pulls versioned WebGPU kernels from the Hub and runs them in the browser (blog). Across 809 comparable operations: 2.57x geometric mean, 1.90x median, Add at 3.52x, LayerNormalization at 2.22x. Each kernel is its own repo with manifests, correctness tests and benchmarks, and a companion tool called Fleet crowdsources performance across real consumer GPUs.

mzCache cuts on-device time-to-first-token 2.1-5.5x when the OS evicts model memory. Mobile devices multitask, so the OS evicts weights and KV cache under pressure, forcing slow storage reads or full KV recomputation on the next request. mzCache partitions LLM memory into fine-grained shared buffers so eviction and restoration are partial and concurrent, then uses mobile SoC unified memory to run inference on the GPU while the CPU restores in parallel (arXiv 2609.01338). Deployed as an Android app.

llama.cpp fuses QKV and FFN matmuls onto Qualcomm Hexagon HMX, and gets 5x on Vulkan IQ3_S at batch 8. Build b10758 (September 2) fuses matmuls landing on Hexagon HMX, fuses MUL_MAT_ID into MUL_MAT_ID_NX, and adds VA defragmentation so large-dim runs abort less on fragmented address space (release). Build b10757 handles batch sizes above 4 for IQ3_S mat-vec when NUM_COLS > 4, reporting 5x at n=8. On-device inference on Snapdragon is getting the kernel-fusion attention CUDA got two years ago.

A NaN bug traced to an F16 weight overflowing on a 1.5e5 activation peak. Build b10760 keeps the Qwen3-tts code predictor's ffn_down in F32 because that layer's intermediate activation peaks around 1.5e5, past F16's 65504 ceiling (release). Since mul_mat casts input to the weight type, an F16 ffn_down turned that peak into inf, the residual followed, and the next rms_norm produced NaN. Reference forward pass in float32 gives 145109 against 145396 in the graph. Clean worked example of why blanket quantization of every weight breaks specific layers.

slotstream runs a 104GB model on a 48GB Mac at 12 tok/s by streaming MoE experts off SSD. MIT, Swift and MLX, created August 28, 220 points on Hacker News (GitHub). It runs Qwen3.8-Flash-Next, 103.8GB across 24 files at 4-bit, by loading only the 3.8GB dense trunk into RAM (about 2 second startup) and reading routed experts with pread into a fixed pool of cache slots shared across all 48 layers, so hot layers borrow from cold ones. It avoids mmap because MLX can't materialize part of a memory-mapped tensor. Published throughput: 3 tok/s at 8GB, 8 at 24GB, 12 at 48GB, needing ~110GB free disk.

A documented 48GB M4 Pro local-agent stack: 325 tok/s prefill, 34 tok/s generation, reachable over Tailscale. Qwen3.6-35B-A3B-OptiQ-4bit at about 20GB resident as the reasoning model, Gemma-4-E4B-it-4bit at 2.4GB for light tasks (lws.io). oMLX behind Tailscale, Hermes as agent backend, Apollo and Raycast AI as clients, so the same box answers from phone and laptop with no exposed port. The 35B-A3B MoE activates 3B parameters per token, which is what makes those numbers possible on consumer hardware.

---

Tools & developer experience

Cline shipped a Hub process that grew to tens of gigabytes by broadcasting the full transcript on every status update. Fixed in v4.1.17: session status updates in the background Hub sent a complete copy of the conversation transcript to every connected client, so on a large task each status change moved megabytes (release). Snapshots now carry state only. The same release stops a failed hook spawn from crashing the extension core and killing the running task, and makes checkpoint restore refuse to run when commits were made after the checkpoint instead of dropping them where only the reflog could recover them.

An empty capability list read as an authoritative denial silently stripped every tool from requests. Cline v4.1.17, cli-v3.0.61 and desktop-v0.0.22 all fix tool calling being disabled for Dify, SAP AI Core, opencode and Codex CLI models: those catalog entries declare no capabilities, and the empty list was treated as a denial (release). Images were dropped from file reads the same way. Absent metadata read as a negative assertion rather than as unknown is a bug shape to go check for in any capability-gated router you maintain.

Cline Desktop v0.0.22 imports your Claude Code, Codex and opencode history as resumable Cline sessions. An Import button scans local stores from all three tools and converts selected conversations, grouped per tool with search across title, folder and first prompt, already-imported ones marked (release). Imported sessions resume on your configured Cline provider and model, not the source tool's. Three tools in two weeks have now built on the assumption that the major coding CLIs' on-disk log formats are stable. Switching cost is moving off the transcript and onto the permission model and skill system.

Claude Code v2.1.257 adds a Containment Escape rule and blocks plugin symlink path escapes. Cloud metadata-credential fetches, egress evasion and cross-tenant reach are no longer auto-approved in auto mode unless the environment marks them expected, plus a one-time prompt before the first file read outside working directories with a permissions.blockReadsOutsideWorkingDirectories option (release). It also fixes plugins reading outside their own directory through a declared path that's a symlink, and Bash Read/Edit deny rules not applying to < file redirects or readers like tac and egrep. CLAUDE_CODE_SUBAGENT_MODEL_FORCE pins every subagent to one model regardless of per-spawn overrides. v2.1.258 followed the same day fixing a launch failure on macOS 12 Monterey that was live across 2.1.255 through 2.1.257.

LangSmith SDK 0.12.0 makes anonymizers fail closed, so traces that used to ship now get dropped. Three breaking changes: deterministic trace sampling, per-function anonymization callables failing closed when they raise instead of letting unredacted data through, and a switch to httpx2 with httpx as fallback (release). Read the fail-closed change before upgrading, because the failure mode moves from silent leak to silent gap.

LiteLLM 1.99.1 fixes OTel spans under-counting spend on prompt-caching workloads. Docker-only build, no PyPI package, released September 2. OpenTelemetry v2 spans now emit gen_ai.usage.cache_creation.input_tokens and gen_ai.usage.cache_read.input_tokens alongside the cache cost already reported (release). The notes say directly that anyone computing spend from OTel token counts rather than LiteLLM's cost fields was under-counting. pip install litellm==1.99.1 won't resolve.

LangChain shipped a private shim for a FastMCP bug and deleted it two days later when upstream fixed it. FastMCP v4.0.1 (September 2) makes ClientGroup reference-count its context like Client does, so entering a connected group from a nested block reuses connections instead of raising (release). LangChain's 1.4.0a4, cut hours later, contains commits adding _ReentrantClientGroup, then removing it in favor of the real fix. LangChain 1.4.0a3 also introduced a first-party langchain.mcp namespace with MCPAdapter, SEP-2549 client-side tool caching against the server's TTL hint, and elicitation="interrupt" surfacing a server's mid-call questions as LangGraph interrupts (release).

thinking.display: "updates" surfaces the progress lines a long agentic turn writes. Fable 5.1 writes short progress updates between tool calls, each arriving as its own thinking block, but under the default omitted those come back empty and a long turn looks silent to users (Anthropic). The new option (beta header thinking-display-updates-2026-08-18) returns progress text while keeping reasoning hidden, so any thinking block with non-empty text is a status line you can render. Fable 5.1 writes fewer of these than Fable 5, especially at high effort, so ask explicitly for an opening line and periodic updates if your UI depends on narration.

datasette-mcp changed execute_sql to return objects instead of positional arrays, specifically to help weaker models. Willison's September 1 note gives a transferable MCP design lesson: rows come back as an array of objects rather than an array of arrays, because weaker models lose track of which index maps to which column (simonwillison.net). Costs bandwidth, buys reliability across the model tier you don't control. Anyone shipping an MCP server returning tabular data is making the array-of-arrays mistake by default.

---

Models

Qwen3.8-Max-0902 more than doubles TerminalBench 3.0 at the same $2/$6 price. Alibaba post-trained its flagship in place on September 1, keeping the 2.4T-parameter base and 1M context. All eight published coding benchmarks improved: TerminalBench 3.0 from 11.3 to 29.0, DeepSWE 1.1 from 56.6 to 69.3, QwenSWEbench V2 from 55.1 to 70.0, JobBench from 53.4 to 64.0. Multimodal moved only 0.4 to 3 points (CellCog). Its Code Arena WebDev score moved 1,669 to 1,691, nominally first on that board and the first Chinese model to out-lead Claude there (TechNode). The top r/ClaudeAI comment argues that benchmark mostly measures one-shot UI and SVG generation, which is fair. Qwen's own table still puts Claude Opus 5 ahead on most coding sets. And Alibaba hasn't mapped the -0902 label to the open-weight checkpoint, so self-hosters can't assume they're running the same thing.

The anonymous OpenRouter model that served 42 trillion tokens in six days was Zhipu's GLM-5.3-Flash. Fireship's September 1 video resolves the Ox Alpha mystery, priced roughly 40x below Claude (video). The volume figure is what stopped me: a large share of agentic token traffic silently rerouted to a Chinese open-weights model on price alone, before anyone knew what it was. Whatever you believe about model preference, the market revealed it doesn't hold when the label is hidden.

Spark-X2.5 arrives as a new 4B/1.7B architecture on Apache 2.0 with native 1M context. XHToken published Spark-X2.5-4B and 1.7B with no announcement. Not a fine-tune: hybrid attention, one full-attention layer per three sliding-window layers, 200+ languages, ~20T training tokens (Hugging Face). Claimed 4B scores include 65.1 BFCL-V4, 75.1 tau-squared-bench, 44.4 SWE-Bench Pro, 90.7 AIME 2026. It doesn't run on upstream llama.cpp yet, PR #27868 is pending, and the team ships a custom fork plus GGUFs meanwhile.

World Labs released Atlas, trained from scratch on text, images, video and 3D in one shared spatial context. A multimodal autoregressive diffusion transformer taking all four as native input types and generating what comes next while staying 3D-consistent with everything already seen (World Labs). Camera-controlled generation of up to one minute of 1440p video from one to six reference images, with explicit camera geometry as an input type rather than a text instruction. Spatial reconstruction from one to dozens of images outputting explicit 3D and beating specialized reconstruction models. Early access only, and it'll back future versions of Marble.

Unsloth 0.1.805-beta turns on multi-token prediction by default for Qwen3.8-Flash-Next and GLM-5.3-Flash. Claims up to 2x faster generation, and adds fine-tuning of both MoE models on text or image datasets on Apple Silicon via MLX (release). Follow-up turns in long Qwen chats on Mac are reported up to 30x faster, MLX models now use full context size, and GLM-5.3 MLX fine-tunes export to GGUF. Local models can also use Codex's apply_patch tool for edits.

Q3 is the new Q4 for 16GB cards on Qwen3.8 27B. Kaitchup's GGUF benchmark across quants from Q4 to Q1 reports Unsloth Dynamic Q3_K_XL retaining 100% accuracy at 12.8GB (The Kaitchup). A 3090 Ti owner in the r/LocalLLaMA thread already runs Q3_K_XL with mmproj and full context at q4 KV cache on max thinking. Per-quant numbers sit behind a paywall, so the 100% figure is single-source from the author.

MXFP4 with W4A8 kernels pushes Qwen3.8 27B to 280 tok/s on two Radeon R9700s. A two-month follow-up on a dual R9700 setup: MXFP4 first reached parity with FP8, then passed it using W4A8 kernels, which the builder believes is the hardware limit for these cards (r/LocalLLaMA). BetterBench decode with DFlash2 runs 280.0 t/s on JSON down to 116.4 t/s on prose, with step times pinned near 23ms across every category and prefill at 4,695 t/s median at 2k depth.

---

Vibe coding

Fable 5.1 cracked a 373-year-old cipher in 44 minutes with zero human interjections. Vals AI reports it decoded Sir Thomas Urquhart's Cyphral Distich, published 1653 and listed #28 on Klaus Schmeh's top 50 unsolved encrypted messages, using 176k tokens (Vals AI). The insight was structural rather than cryptographic: the two lines of 32 numbers sit immediately after Urquhart's 32 Proquiritations, so each number indexes a word position within the proquiration at that position, and first letters of selected words spell the plaintext. Centuries of frequency analysis and substitution attempts failed on it. What I take from this is that the win came from noticing an adjacency in the document layout, not from cryptanalysis, which is exactly the kind of thing a human expert stops seeing after the tenth read.

mimeo measures what actually transfers when you compile an expert's writing into a skill. It separates three claims usually bundled together, that an expert file supplies hard-to-find knowledge, produces a recognizable persona, and changes what the agent decides, and tests each (arXiv 2609.00453). Eight logged builds averaged 38 model calls, and the quotation check rejected 13.2% of extracted quotations. Knowledge access was the clear win: the expert file answered all 20 obscure quotation-heavy questions, no closed-book condition answered more than 10, and BM25 keyword search over the same pages answered 15. Persona and decision-change results are murkier, which is the honest version of what most skill-authoring advice claims.

The Fable 5.1 launch turned r/ClaudeAI's top thread into a referendum on the $20 tier. A post arguing Anthropic doesn't value $20 subscribers drew 481 upvotes on release day, and the argument is specific: the author says he's fine with hard rate limits, twenty messages a day with the flagship, and objects only to tier-based exclusion from the best model (r/ClaudeAI). The framing is comparative and forward-looking. If OpenAI puts Astra on the standard $20 tier while Anthropic reserves its best for Max, the dual-subscription case collapses.

A Claude Max subscriber was banned for unspecified "suspicious signals" and reinstated two days later with no explanation either way. The only stated basis was that "an internal investigation of suspicious signals associated with your account indicates a violation of our Usage Policy," no clause cited, no examples (kix.codes). The appeal path required logging back in to submit an in-product form with no route to a human. Reinstated September 2. The author cites Anthropic's own published figure that about 0.37% of bans are overturned, which is what makes this a structural concern for anyone running agent workloads on a personal subscription rather than an org account.

Atlas took 895 stars in a day for linking every agent commit back to the prompts that produced it. Rust, created May 14, at 2,643 stars (GitHub). Every run produces checkpoints linking a commit to the session that made it, including prompts, tool calls and reasoning. It runs Claude Code, Codex, its own agent and anything from the ACP registry side by side against one codebase with shared memory, so a decision made in one agent shows up in the next agent's prompt. Local by default; sign-in is only for team sync.

The "Claw'deck" gives multi-agent work a physical touchscreen dashboard. A Corsair Xenon Edge wired into a Claude Code hook setup: when an agent asks a question it pops up for a tap answer, and finished agents render as a crab putting on sunglasses (r/ClaudeAI). 477 upvotes. The builder's stated purpose is the unglamorous one, seeing at a glance which agents are still working and which need prompting. The thread summary is "this is so stupid, where can I buy one," which is a fair read of where ambient status displays sit right now.

---

Hot projects & OSS

Shannon, an AI pentester that runs real exploits, cut v3.0.0 after three minors in five days. KeygraphHQ/shannon published v3.0.0 at 09:16 UTC on September 2, following v2.7.0 (Aug 28), v2.6.0 (Aug 27) and v2.5.4 (Aug 26). The AGPL-3.0 TypeScript project reads your source, identifies attack vectors, and runs exploits against web apps and APIs to prove vulnerabilities before production (GitHub). 47,584 stars against only 34 open issues, an unusually clean backlog for that release pace.

Nous Research's hermes-agent carries 25,617 open PRs against 13,021 open issues. Nearly two contributions per complaint, the most PR-heavy backlog I've seen on this beat (GitHub). Set against ruvnet/ruflo, which splits 289 open PRs against 604 open issues at 70,203 stars, the two largest agent meta-harnesses have inverted contribution shapes at similar activity levels. Star count and push recency tell you nothing about which one absorbs outside work.

arcbox gives each agent its own microVM with a from-scratch Rust VMM, claiming sub-100ms boot. 506 stars today to reach 2,448, positioned as an OCI-compatible local alternative to Docker Desktop and OrbStack on macOS (GitHub). It ships its own VMM, VirtIO devices, filesystem sharing and network datapath written from scratch in Rust under Apache-2.0, so each agent gets a real kernel and network rather than a namespace. Release cadence is bursty: three releases on August 14, v0.7.0 on August 15, nothing since.

Firecrawl's pdf-inspector decides whether a PDF needs OCR at all. 589 stars today to 18,260, second on the Rust board (GitHub). It classifies scanned against text PDFs rather than extracting, which is the routing decision that dominates cost in document pipelines. August 17's v1.15.0 was "Selective OCR for scanned and mixed PDFs" and v1.14.2 four days earlier was "Hardened parsing for pathological PDFs," so recent work is about surviving adversarial input.

Heretic's name is showing up inside Hugging Face model IDs. The abliteration tool gained 215 stars to reach 30,103, but the stronger signal is downstream: the HF trending endpoint returns DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NM-DAU and Momoking/Qwen3-VL-32B-Heretic-MiniMax-H3-NVFP4, both naming the tool in the model ID (GitHub). Last release v1.4.0 is from June 14, so adoption is running months ahead of development. Uploaders treat "Heretic" as a provenance tag the way they treat GGUF or FP8.

academic-research-skills is at v3.21.1 and 45,352 stars six months after its first commit. Created February 26, 2026, already on its 21st minor of a third major (GitHub). It packages a five-stage Claude Code pipeline, research to write to review to revise to finalize, holding only 20 open issues at that star count. Contrast it with mattpocock/skills at 244,612 stars, last pushed August 24, with 5 open PRs against roughly 449 open items. A quarter million stars with a stalled commit log is a bookmark, not a dependency.

ihavebeenclawed.com published a CC BY 4.0 JSON dataset of coding-agent incidents. Launched to Show HN September 2, indexing cases where agents deleted data, leaked secrets, burned money or made commitments their operators had to honor, each with a source link, damage category, severity and stated lesson (site). Submissions must point to a published post or discussion, so entries stay verifiable. The maintainer is unusually honest about method, labelling it a curated sample rather than a census, self-selected and virality-weighted, with quiet failures and NDA-bound corporate incidents structurally absent. First openly licensed agent incident corpus you can point a policy at.

Google's TimesFM trends on GitHub and Hugging Face at once, but the PyTorch artifact has 257 likes and zero downloads. google-research/timesfm gained 326 stars, second on the all-language board. google/timesfm-3.0-pytorch was created August 24 and shows 257 likes against 0 downloads (Hugging Face). Nine days of likes with no downloads means people are bookmarking, not running. Useful calibration when you read a trending position as adoption.

---

SaaS disruption

The Codex desktop app ships a 430MB headless LibreOffice instead of calling a document API. Willison found a 1.7GB codex-primary-runtime cache containing 446.4MB of Node.js, 440.6MB of Python, 429.7MB of headless LibreOffice, 187.9MB of Poppler and 148.1MB of git, plus a skills plugin folder telling the model where to find and how to drive them (simonwillison.net). 436 points on Hacker News. An agent vendor bundling the whole document toolchain locally removes an entire class of API-billed SaaS from the loop. Every conversion API business should read that directory listing as a market forecast.

"Skills" became the shared saved-workflow shape across three unrelated vendors. Notion shipped Notion Skills on August 31, reusable instructions stored as ordinary Notion pages the user owns and edits, created by asking the agent to save a workflow (Notion release notes). The Codex desktop teardown exposed a skills plugin folder carrying instructions for driving its bundled binaries. Figma's Config 2026 release already let users write a prompt to create a repeatable canvas skill. An editable text artifact as the unit of automation directly replaces the drag-and-drop workflow builder as a product surface, and nobody coordinated it.

Four September 2 launches each remove a recurring bill from the agent stack. Monid sells runtime pay-per-call access to 1,800+ APIs with no per-vendor subscription, $1 in free credits to start, listing Merge, ApyHub, Eden AI and Firecrawl as comparables (Product Hunt). SandrPod runs the unmodified e2b and e2b-code-interpreter SDKs against your own infrastructure with two environment variables changed, Apache 2.0 (GitHub). ToolJet's MCP server lets coding agents build ToolJet apps against first-party schemas rather than paying for a hosted builder, AGPL-3.0 at 40.8k stars (GitHub). PolyHelper's C1 orchestrates frontier models over consumer subscriptions you already pay for. None of them sell autonomy. All four sell the removal of a seat.

ICONIQ: the 50-100% growth band halved its hiring in a year while hypergrowth companies accelerated. Companies growing 100%+ raised median headcount 133% in H1 2026, above their 119% in both 2025 and 2022-23. The 50-100% band collapsed from 46% to 25% in a single year, the largest move in the dataset; the 25-50% band fell from 16% to 10% (SaaStr). ICONIQ framed this as AI not freezing headcount at hypergrowth companies. The split is the finding: AI leverage shows up in the middle band, not at the top. N=57 for 2026 against N=195 for 2025, so read it as directional.

SaaStr ran Salesforce headless for six months: 10x the data usage, 40% higher bill, same seat count. Almost nobody there has logged into the Salesforce UI in six-plus months. They went at the API directly, built a Claude agent on top called 10K, and folded Bill, Brex and QuickBooks into the same layer, running a small human team plus 20+ production agents (SaaStr). The pricing signal is what to plan around: agents hammer the API constantly instead of a rep checking twice a day. Going headless does not cut your bill. It moves the meter.

Three agent-telephony products shipped the same day at $0.02 a minute. Dial on Product Hunt at #7 selling "give your AI agent a real phone number," ThunderPhone as a platform for AI phone agents at $0.02/minute, and 1Dial on Show HN as an AI you call or text to get tasks done (digest). Provisioning a phone number for a software agent went from a Twilio integration project to three competing single-day launches with per-minute pricing. That's the commoditization step that usually comes right before a category collapses into infrastructure.

Keenable's MCP server runs semantic SQL over 1,000+ live pages per call. SELECT exposes WEB_SEARCH(), SEM_EXTRACT() and SEM_MATCH() as SQL operators with final filtering in DuckDB (showcase). One call searches over 1,000 pages, applies an exact WHERE clause at zero LLM cost, then spends one small LLM call per surviving row. The standard agent pattern is ten links each read expensively. Pushing the cheap filter before the expensive one is old database thinking applied to a place nobody was applying it.

AfterQuery reached $3.2B five months after a $300M Series A. It pays doctors, lawyers and other professionals to demonstrate how they complete tasks, then uses those traces to train models on professional decision-making (TechCrunch). $30M at $300M in April, now reportedly $3.2B, with $100M annualized run rate as of April and Nvidia, Legora and Motif Technologies named as customers. Founders are 22 and 23, YC Winter 2025. Round size and lead undisclosed.

---

Policy & governance

Edelson PC filed 30 more suits against OpenAI over the Tumbler Ridge shooting, escalating to aiding and abetting. The legal theory moves up from product liability, and policy chief Chris Lehane is named personally as a defendant (TechCrunch). TechCrunch notes the underlying evidence supporting the escalated claims is unconfirmed. Naming an individual officer is the shift to watch, because it tests whether executives can be pulled into model-harm litigation rather than only the corporate entity.

Apple says a former employee destroyed evidence of data theft for OpenAI and wants expedited discovery. In a Monday filing reported by Bloomberg, Apple alleges the employee destroyed evidence after learning he was under investigation, and that OpenAI only recently handed over materials (The Verge). Apple is pushing for expedited discovery over concerns evidence is actively being destroyed. Sharpest escalation yet in a case that's becoming the template for AI-industry poaching disputes.

Google Play gave AnkiDroid until September 11 to drop its Open Collective donation link. Google rejected the link on the grounds that the receiving organization is not tax-exempt, even after the project supplied Open Source Collective's IRS 501(c)(6) determination letter (GitHub issue). Google's stated policy permits donations to "a validated tax-exempt organization," and its response to the letter still asserted the org is not tax-exempt. Removal from Play worldwide except India and Russia after the deadline. Maintainers stripped the link under protest while still asking why 501(c)(6) doesn't qualify.

Mozilla built an ad blocker into Firefox for iOS, the same week Google finished pulling Manifest V2. Announced September 1, blocking third-party ads and trackers before they load, implemented in the browser because iOS doesn't support extensions the way desktop does (Mozilla). Runs on Apple's WebKit Content Blocker API against EasyList. It doesn't block first-party ads, search ads, or Mozilla's own sponsored new-tab content. Off by default under Settings > Browsing > Ad Blocker.

Twenty-one banks and asset managers committed to a joint dollar stablecoin targeting H1 2027. Announced September 1: they'll form a company in H2 2026 to issue a stablecoin, dollar token first, euro as the expansion priority (CoinDesk). Members include Bank of America, Capital One, Citi, Fidelity, Goldman Sachs, PNC, Wells Fargo, Santander, BBVA, Deutsche Bank, Lloyds, UBS, MUFG and Standard Bank. Intended to comply with the GENIUS Act and MiCA. No company name, token name, blockchain networks, reserve custodian, governance structure or redemption terms disclosed, which is a lot of unanswered questions for a group that size.

Wellington's mayor says large chunks of a Deloitte council report were AI-generated. (RNZ) Same shape as every other case of this: detection happens downstream at the client, after delivery, rather than through disclosure up front. Which is why procurement-side AI disclosure terms are becoming the practical control point rather than any authorship-detection tool.

Jack Henry, a core banking vendor for a large number of US community banks and credit unions, was hit by ransomware. (Finextra) Scope, data exposure and affected institutions weren't disclosed in the initial report. The blast-radius question here sits downstream, not at Jack Henry.

---

Skills of the day

1. Pin your model ID in every agent tool config today, not after something breaks. Cline changed resolved defaults across 57 providers overnight and Claude Code changed its default Fable model in a point release. An unpinned provider entry means your evals, your token spend, and your tool-batching behavior all moved without a commit in your repo.

2. Replace tool_choice: {"type":"tool"} with auto plus strict: true before you touch the model ID. Forced tool choice now returns a 400 on Fable 5.1 and Mythos 5.1, including on the token-counting endpoint. Do the harness change first, then swap models, so you can tell which change broke what.

3. Stop injecting per-turn reminders into message history and stripping them next request. Use clear_at: "next_user_message" on a role: "system" message with the mid-conversation-system-clear-at-2026-08-21 beta header. The old pattern now invalidates every downstream thinking block, and the new one keeps prompt cache matching while costing zero tokens once cleared.

4. Have your agent emit a structured field-change intent for config edits, then apply it through the parser's node position marks. Tolerant patching misapplies 14-20% of LLM-generated diffs to YAML with no error signal, and full-file rewrite is non-deterministic. Locating the target scalar's character span and replacing only that span is the only approach in the study that didn't fail silently.

5. Return MCP tabular results as an array of objects, not an array of arrays. Weaker models lose track of which positional index maps to which column, and you don't control which tier calls your server. The bandwidth cost is real and the reliability gain across model tiers is worth it.

6. When your agent gets stuck, resample the whole solution before you try to localize the fault. Sixteen localized infilling attempts reach 6.8% repair rate where one blind resample reaches 10.1%, because infilling reproduces the removed span verbatim about half the time. Localization is also only available on 9% of failures in the first place.

7. Score your agent trajectories with a step-rubric judge, not an outcome-only judge, if silent failure costs you anything. Outcome-only catches 45% of silent faults and false-alarms on 33% of correct runs. Step-rubric reaches 77% silent recall with zero false alarms at 3x cost. Skip self-consistency, it tripled cost and improved nothing.

8. Add a verification-cadence line and explicit constraint-to-action mapping to any long-horizon agent prompt. A linear probe finds a real "submit early" pressure state where agents finalize a polished answer with constraints unresolved, and the ablation shows stating constraints explicitly and mapping them to actions measurably delays premature finalization. That's the fix available to you without hidden-state access.

9. Encode API constraints in your OpenAPI schema, not in the description prose, before you expose an endpoint as an agent tool. Machine-checkable constraints produced an honest error in 111 of 111 live tests; prose-only constraints failed silently in 44 of 61. A vocabulary merely exemplified in a description was missed on 88 of 88 model attempts.

10. Tier your model access by budget consumed, and keep a cheap model always reachable. Jamf denies Opus at 80% of daily budget and Sonnet at 100% by rewriting IAM policy versions on a 15-minute schedule, so denials take effect within minutes with no re-authentication. Under $10/month for hundreds of engineers, and nobody gets hard-stopped mid-task.

---