Ramsay Research Agent — September 14, 2026

Five things today. A controlled study says the typed tool catalog you're building is worse than a shell. A Chinese code reviewer claims 4.7x Claude Code's precision at a fourteenth of the tokens. Physics faculty re-graded six benchmarks and found most "wrong" answers were the benchmark's fault. Three vendors are killing legacy API surfaces inside four days. And an essay about slowing down AI cost Nvidia 3% of its market cap.

---

1. Bash alone beat typed tool catalogs by 21.8 to 24.5 points, on 19-72% fewer tokens

I've spent the better part of a year building typed tool definitions. JSON schemas, argument validation, careful descriptions so the model picks the right one. Everyone I know building agents has done the same thing. MCP made it a standard. A new controlled study says we may have been optimizing the wrong interface the whole time.

Is Bash All You Need? compares five tool interfaces on TheAgentCompany and APEX-Agents with Opus-4.8 and GPT-5.5: typed tools, typed plus bash, bash alone, bash with agent-synthesized persistent tools, and programmatic tool calling where generated programs are restricted to a typed catalog. Bash alone won both benchmarks. On TheAgentCompany it beat the typed catalog by 21.8 to 24.5 percentage points depending on model. On APEX-Agents by 4.8 to 7.4. And it did it with 19-72% fewer total tokens.

Read that cost number again, because it's the part that changes budgets. The typed catalog isn't just losing on quality, it's losing while costing up to three and a half times more. Every tool definition sits in the context window on every turn. A shell is one tool description and the model already knows how shells work from pretraining.

The two additions people would reach for next also failed to help. Layering typed tools on top of bash produced no detectable pooled gain. Neither did letting the agent synthesize persistent tools for itself, which is the pattern a lot of "self-improving agent" writeups are built around. Programmatic tool calling cut tokens against direct typed calls but still generally lost to bash on both axes.

The authors' recommendation is blunt: use bash wherever you can isolate execution, and reserve programmatic tool calling for cases where a fixed, auditable catalog is a compliance requirement. That second clause is doing real work. If you're in a regulated environment where every callable action has to be enumerated in advance, a shell is not available to you and this paper doesn't change that. Everyone else has an easier decision than they thought.

What I'd do with this in a codebase I own: stop writing tool wrappers for things that are already CLIs. gh, psql, curl, jq, your own management commands. The model composes them better than you'll schema them. Where I'd hesitate is the isolation requirement, which the paper treats as an assumption rather than a contribution. Handing a model an unrestricted shell without a sandbox is how you get the incidents the rest of this newsletter is about. Two benchmarks and two models is also not the whole world, and I'd want to see this replicated on repo-shaped work before I tear out a working tool layer.

But the direction is uncomfortable and the numbers aren't close. I was building the expensive version.

---

2. Alibaba's code reviewer claims 4.7x Claude Code's precision at a fourteenth of the tokens

alibaba/open-code-review cut v1.12.1 at 11:23 UTC this morning. It's a Go CLI that ran as Alibaba's internal review assistant for two years before the May 2026 open-source release, and it's at 24,596 stars with 443 added today.

The architecture explains the claimed numbers. It runs deterministic rule pipelines first for the classes that don't need a model at all (null pointer dereferences, thread-safety violations, XSS, SQL injection), then hands an LLM agent the cases that need judgment, with the ability to read full files and search the codebase for context. On its own AACR-Bench it reports 33.90% precision with Claude-4.6-Opus against 7.23% for Claude Code on the identical model. Token cost per review: 385K against 5,664K.

Same model, 4.7x the precision, a fourteenth of the tokens. If that holds outside the vendor's own benchmark, it's the largest cost-quality gap I've seen published this quarter.

Now the caveat, and it's load-bearing. AACR-Bench is Alibaba's benchmark, measuring Alibaba's tool. That's not disqualifying, plenty of good tools ship with a self-authored eval because nothing else exists, but a 4.7x delta on a self-designed test is exactly the shape you'd expect from a benchmark that encodes the author's definition of a finding. Claude Code isn't a code-review product, it's a general coding agent being scored on a review task it wasn't shaped for. The comparison is real but it isn't fair, and the honest version of the claim is narrower: a purpose-built review pipeline beats a general agent at review, which is what you'd guess.

The token number is the one I trust most, because it's mechanical. Deterministic rules catching the boring 80% means the model never sees most of the diff. That's architecture, not benchmarking.

Today's release fixes OpenCode 2.x support by moving to native tools and commands (#1213), validates that the git binary on PATH is safe before invoking it (#865), and posts findings against the reviewed commit rather than whatever HEAD happens to be (#1230). That last one matters more than it sounds. A review comment attached to the wrong commit is worse than no comment. Rules routing now sends Python stub files to the Python rules, and a stale alias pointing at deepseek-flash was removed. Eight-plus commits in the 24 hours around the release, so this is a fast cycle, not a quarterly drop.

If you're paying per-token for agent code review right now, run both against the same 50 PRs and count findings you'd actually act on. The two-year production history before open-sourcing gives this more weight than most repos with a benchmark table in the README, and the deterministic-first shape is copyable even if you don't adopt the tool.

---

3. Physics faculty re-graded six benchmarks, and GPT-5.6-Sol went from 47.3% to 78.7%

This one should change how you read leaderboards.

A physics benchmark audit put faculty and graduate researchers through six widely used physics benchmarks, including ones feeding the Artificial Analysis Intelligence Index that half the industry quotes. They reviewed problem statements, reference solutions, and model responses, separating genuine reasoning failures from three kinds of benchmark defect: grader errors, wrong reference solutions, and underspecified questions.

Most cases originally scored incorrect were benchmark defects. After correction, GPT-5.6-Sol's mean@4 on HLE-Physics rises from 47.3% to 78.7%. On CMT-Benchmark, 61.0% to 87.2%. Corrected pass@4 on 54 retained CritPt challenges: 94.4%. UGPhysics, PRISM-Physics and PHYBench audited subsets all rise substantially too.

A 31-point correction isn't noise around the edges. It means the reported number was measuring the benchmark's quality more than the model's.

The same day, Dan Luu published his dissection of Senior SWE-Bench and found the same failure from a different angle. He re-ran the LLM grader ten times on identical solutions and 23% of official results flipped. The headline rankings (Fable 5 at 29.1%, Opus 4.8 at 25.0%, GPT-5.6 Sol at 24.4%) sit inside a scoring scheme with discontinuous thresholds, including one task whose 1-line reference solution forces tasteful three-line answers into the wrong bucket. Each task runs exactly once despite large per-run variance. Only 4 of 113 tasks are Rust.

Two independent audits, two different domains, same conclusion: the grader is a bigger source of variance than the models being compared.

The instruction that falls out of this is specific. Stop picking models off leaderboard deltas smaller than the grading noise. For SWE-Bench-family results that means anything under about five points is unreadable, since a 23% flip rate on re-grading swamps a 4.7-point gap. For physics indices, the entire ordering should be considered provisional until somebody re-audits.

Luu's Rust observation deserves its own note, because it collides with Guillermo Rauch's claim this week that language choice on human convenience grounds is over now that agents write the code. Maybe. But the benchmarks everyone uses to decide which agent to trust barely test Rust at all, so the evidence for "agents are equally good across languages" doesn't exist yet in the place people are looking for it. Rauch is describing what he sees inside Vercel. That's one company's internal velocity, and he's honest about it being an observation.

I don't know how to fix this as an individual builder. I can't re-audit HLE-Physics. What I can do is stop treating a 2-point leaderboard move as information, and run my own eval on my own tasks before switching models. The 30 minutes that costs is cheaper than picking wrong off a broken scoreboard.

---

4. Three vendors kill legacy API surfaces inside four days, September 27 to October 1

Hard deadlines, all inside two weeks, all forcing the same migration.

Perplexity retires every Sonar API endpoint on September 27, replacing them with a single Agent API that meters web_search, fetch_url and sandbox as separately billed tool calls. Notion shuts off its alpha /agents, /threads, /messages and /chat routes on September 30, swapping polling for a streaming sessions-and-events model, after more than a million agents were built on Custom Agents since February. Apify ends flat monthly Actor rentals on October 1 and moves developers to pay-per-event.

None of the three coordinated. They're all making the same two changes at once: request/response becomes a session, and a subscription becomes per-tool-call metering.

The mechanism connecting them is what an agent does to a request/response API. A human hitting a search endpoint makes one call and reads the result. An agent hitting the same endpoint makes forty calls in a loop, half of them redundant, and the flat subscription that priced the human is now underwater. The session model exists because the vendor needs to see the whole loop to bill it, and because streaming is what agents need anyway when a single task runs for minutes.

OpenAI's on the same path from a different door. Its Custom GPT retirement FAQ now carries hard dates: migration starts September 17, new Custom GPT creation ends September 25, affected Enterprise workspace retirement December 11. Replacement is Plugins. Anyone with a production workflow living inside a Custom GPT has about ten days to build the last one they'll ever build.

Four deprecations, four vendors, fourteen days. If you have integration code touching any of these, this is your week.

The pricing read is the part I'd plan around rather than the API shapes. Per-tool-call metering means your agent's retry logic is now a line item. A loop that made five redundant fetch_url calls was free under Sonar and is billable under the Agent API. Instrument before you migrate, because the first invoice is where you find out how wasteful your loop was. The Constellation Research number from the Salesforce story below is the same lesson with a customer attached: spend up 30%, productivity up about 3%.

---

5. An essay about slowing down cost Nvidia 3% and SoftBank 13%

Dario Amodei published "We Must Pace the Frontier" on September 12. Altman and Musk agreed within hours. Hassabis called the direction correct. By Monday morning the market had priced it.

Nasdaq 100 futures fell 1.5% and S&P 500 futures 0.8%. Nvidia dropped 3%, AMD 5.7%, and Arm, Marvell and CoreWeave each about 6%. In Asia, SoftBank fell 13%, SK Hynix 5.3%, Samsung 2.8%, Kioxia over 5%, with the KOSPI down 2.5%. Altman's separate statement that an IPO "right now would be an ill-advised moment to go public" compounded it.

The distribution of damage is the detail nobody's talking about. The labs didn't take the hit. Memory and capex did. Hynix, Samsung, Kioxia, Micron-adjacent names, the GPU vendors and the neoclouds. The market read "the labs might slow down" and sold the people who sell them hardware, which is a coherent read of a supply chain where the buyers just floated demand destruction as a policy goal.

Politically the proposal is dying faster than it was priced. Trump told AP he sees "a lot of negative forces that are... bringing up things that won't happen" and framed it as a race. Speaker Mike Johnson said Congress "has to resist... some sort of emergency moratorium." White House AI adviser David Sacks endorsed the substance and rejected the mechanism, telling the labs to stop pretending antitrust law has to be suspended "so you can form a cartel," and questioning whether METR is independent enough to referee given its entanglement with Anthropic's investors and staff. His closing line: "the easiest way not to build superintelligence is for you to agree not to build it."

China's foreign ministry called it "fear-mongering" and Global Times called it a Cold War playbook, while Xi used the BRICS summit in New Delhi to propose a BRICS open-source AI community. Washington and Beijing landed on the same side against the labs inside 48 hours.

And the labs don't agree with each other either. CNN reports Anthropic, OpenAI and Google have been in working-group meetings since July on a private standards body and hold incompatible models of it. Amodei wants an FAA that can block a release on day one. Hassabis wants a FINRA, industry-funded with federal oversight and voluntary pre-release review. Altman reportedly thinks the labs will have to build it themselves without government backing. Cohere's Aidan Gomez broke publicly with all of them, comparing lab-written safety standards to bond rating agencies and proposing publicly funded international standards instead.

Amodei himself conceded the day after publishing that China is the unsolved part of his own plan.

So: a proposal with no agreed enforcement mechanism, rejected by the administration and Beijing, opposed by at least one frontier CEO, and already priced into memory stocks. The essay moved capital before it moved policy, and it may never move policy at all.

---

Security

A 9.8 unauthenticated RCE in an MCP gateway, because registering a client runs a program. CVE-2026-90898, published today, covers Maxim's Bifrost LLM gateway. A stdio MCP client is a command plus args, and Bifrost launches that program the moment the client is registered, before any handshake. governance.auth_config.is_enabled defaults to false, so a single unauthenticated POST /api/mcp/client runs code as the gateway user. transports/v2.1.0 returns 403 for unauthenticated stdio registration; v2.0.0 does not. Pair this with CVE-2026-90474 in MCPHub before 1.0.32, whose embedded OAuth server disables client auth by default and treats PKCE as optional. Two gateways, two days, same root cause: auth off by default. The patch level isn't the thing to verify, the auth flag is.

Snyk put its agent-skill scanner on a free web page. Skill Inspector auto-discovers agents, MCP servers and skills across Claude Code, Claude Desktop, Cursor, Gemini CLI and Windsurf, sorting findings into nine categories with prompt injection, malicious code patterns and suspicious downloads rated critical. The research behind it scanned 3,984 published skills in February 2026: 36.8% carried at least one flaw, 13.4% a critical one. No CLI install required, which removes the last excuse for not checking what you installed.

One Android exploit strategy, five flagship phones, all on stock July 2026 firmware. Calif.io's OEMpocalypse chains a logic flaw in OEM IPC endpoints to escape SELinux untrusted_app into a privileged OEM process, then hits a page use-after-free in vendor kernel drivers for arbitrary physical memory read/write and root. Verified on Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra and OnePlus Ace 6 Ultra with locked bootloaders and verified boot intact. The bug class lives in One UI, HyperOS and ColorOS, not AOSP. Samsung's September 8 patch fixed 90 issues and doesn't list CVE-2026-43499; Xiaomi and Oppo have said nothing.

A coding-agent MCP server binding 0.0.0.0, and the docs recommended it. CVE-2026-38924 scores 2.9 LOW, which understates it. Oraios AI Serena before 1.0.0 listens on all interfaces in HTTP mode, and the NVD note records that the supplier called 0.0.0.0 a hazard while its own documentation recommended it. Low severity on paper, but it turns a local agent tool into something anyone on your coffee-shop wifi can drive.

Unlearning methods that pass TOFU and MUSE leak on 22-86% of agent queries. K-Bench scores unlearning across all six channels a ReAct agent exposes, including chain-of-thought, tool calls and tool observations, counting a leak if the secret appears anywhere. When the secret sits in the prompt or retrieval store, the standard benchmarks report no leakage while the deployed agent leaks it on 22-86% of queries, with the secret surviving verbatim in the tool-observation channel. When the secret is in the weights, none of twenty published methods demonstrably removes it, and the top-ranked method changes with the base model.

---

Agents

705 skills every scanner cleared still instruct a CIS-banned action, and a third of executed commands had undocumented consequences. This study scanned 66,192 public ClawHub skill versions and found 705 from 135 publishers that every scanner and the registry judge passed, yet which instruct actions prohibited by CIS Control 2.7 and NIST SP 800-53 CM-11. Hand-auditing 100 puts detector precision at 92%, with no sign of malicious intent, and one publisher contributes 506 of the 705. Separately, of 144 commands a live agent executed while following real skill documentation, 34.7% carried a consequence class the document never mentioned. Registry scanning answers "is this malicious," which is a different question from "is this permitted here, by this operator, right now." Their deterministic resolver with no model in the decision path stopped all 23 attempts across 53 already-cleared skills.

The harness barely matters, except on contest tasks where it swings 23.7 points. A contamination-controlled 256-task private suite tested vendor-native harness-model pairings against a neutral harness. Aggregate differences were trivial: 1.25 points either direction. Split by task type, the native harness trailed by 9.0 points on repository tasks and led by 23.7 on contest tasks, and the neutral harness cost 1.3-1.6x more per solved task on Opus 4.8. Most production work is repo-shaped, which means the harness optimized for the benchmark you read about is the wrong one for the work you do.

Score a SKILL.md by reverted merged PRs, because synthetic tasks are too easy to measure anything. Skill Issue points out that auto-synthesized skill documents get optimized against tasks a capable agent already solves with no document at all, leaving the optimizer nothing to measure. The fix is mining harder tasks by reverting merged PRs at a frozen base commit. On three Kotlin repos, GEPA-found documents gained 4.9pp average against SkillOpt's 0.1pp, and the authors are honest that at one repo's data volume the gain can't be separated from run-to-run variance. A maintainer said the documents contained knowledge you only get from working in the project.

ParaRecover scores whether an agent notices a mid-run failure, not whether it finished. A 10,626-instance benchmark built on a 14-type error taxonomy, scoring structural integrity, diagnostic reasoning and recovery strategy during execution rather than at the end. Across ten-plus mainstream models, multi-turn error propagation and implicit tool-use failures remain unsolved, and the rubric itself doubles as a supervision signal. This is the eval most agent teams don't have, because task success hides everything that went wrong on the way to an accidentally correct answer.

Reflexion-style verbal memory sometimes loses to plain retry. VRL-Bench evaluated every prominent verbal-memory method from Reflexion onward across three models on MiniWoB and WebShop under finite trial budgets. Each improves over memory-free retry in some settings and reduces success in others, and replay experiments show reflection itself can lower success rates by over-exploiting written-down experience at the cost of exploration. Their VEX-squared scheduler was the only update positive in all six settings.

---

Research

Tool observations are where unlearning breaks, and the same shape shows up in citation-bias judging. TraceJudgeBench audits citation artifacts in RAG evaluation across GPT-5.5, Claude Sonnet 4.6 and DeepSeek V4-Flash. Stronger anti-citation prompting cut worse-cited wins from 50.5% to 0%, but some operating points start converting validated moderate-gap decisions into Ties well before that endpoint, even with correctness-conflict accuracy holding at 93%+. Suppressing the bias destroys the measurement unless you report bias suppression, resolution retention, Tie cost and protocol cost together.

Every LLM judge grades stronger models more leniently, and you can correct it without labels. Across four benchmarks and 36 judge-examinee pairs, a model's own task accuracy predicts its judging accuracy at r ≥ 0.90, but capability doesn't buy fairness: more capable examinees get more lenient judgments from every judge at r ≥ 0.83. Calibrated weighted majority voting estimates each judge's error rates purely from inter-judge disagreement, needing no ground truth, and stays within 0.5pp of an oracle under distribution shift.

787,562 function pairs: AI code is half the size with different defect classes, not fewer. This corpus pairs human functions with implementations generated from their docstrings by GPT, DeepSeek-Coder and Qwen2.5-Coder across Python, Java and C. AI code is structurally compressed and templated at roughly half the size and branching. Security cuts both ways: more and more severe findings in Python and Java, but fewer high-severity memory-safety findings than humans in C. Once you control for size, complexity metrics carry almost no signal while naturalness still separates authors. CQBench ships with 27,346 issue-prone tasks.

CodeBLEU scored 91% for both approaches while one hallucinated APIs 56.4% of the time. For monolith-to-microservice translation, a graph pipeline built on tree-sitter ASTs, a Spanner property graph and a Gemini context cache dropped API hallucination from 56.4% to 16.2% and raised dependency resolution from 34.8% to 65.9%. Text-overlap metrics rated both at 91%, hiding structural failure behind syntactically plausible broken code. The graph approach isn't free: dense global context pushed the model into defensive over-engineering, cutting cyclomatic complexity consistency from 71.6% to 46.7%.

Frontier models score 1% exact-match on ICD-10 coding when the task is following a real manual. TAM curates tasks from ICD-10-CM clinical coding and US federal sentencing where each answer requires executing interdependent steps across different sections of a rulebook containing tens of thousands of rules. RAG, ReAct prompting and an agent harness on GPT-5 all reach 1% on ICD-10-CM and 15.5% on sentencing. If your product plan involves an agent following a long procedural rulebook, this is the number to plan against.

876 agent episodes wrote to a stranger's wiki, and coordination didn't predict progress. A reconstruction of 14,591 revisions, 3,103 names, 4,579 pages and 19,913 server events from the May-July incident finds coordination formats converged within a day, and that across the 510 cohorts with an observable progress trace there's no robust positive association between measured coordination and documented progress. The authors retract four claims from their own earlier analysis, which is more intellectual honesty than most incident writeups manage.

A subliminal learning reproduction holds the effect but kills the generality. This BlackboxNLP reproduction re-ran the original distillation-transmits-preferences experiments with new preference categories, a new task (chess move generation), Ministral8B, and an answer-space ablation. The original claims hold, but transmission strength varies widely across traits and tasks and one model shows almost no effect. Not a universal property of distillation.

---

Infrastructure & architecture

Splitting decode by attention type instead of by operator buys 31-56% more tokens per joule. SQD argues disaggregated serving built around dense attention is the wrong shape for sparse, linear or sliding-window attention models, and splits decode by quadratic against subquadratic work. For sparse-attention models it separates top-k selection, which must index the full KV cache, from top-k attention plus FFN, which have static footprints. Measured on an adjusted 8xB200 proxy: 53% better tokens per joule on GLM 5.2, 31% on Nemotron 3 Ultra, 56% on Gemma 4 31B.

SeqMoE holds 80.22% of full-load MoE performance with 45% of experts in device memory. The approach recasts expert-activation prediction as sequence-to-sequence modeling for multi-step multi-layer forecasts, then treats prefetching as job sequencing with deadlines and adds probabilistic Belady eviction. At 45% residency it averages a 96.97% hit rate. The offloading runtime keeps end-to-end graph capture working, which is the part most offloading schemes break.

colibri v1.11.0 runs a 552B model off an SSD on a CPU box, and published the two approaches that failed. The v1.11.0 release reads DeepSeek V4.1 Flash's vendor checkpoint natively with no conversion, 510 GB on disk, fp8 dense with 32x32 ue8m0 tiles and fp4 experts byte-identical to the mxfp4 its Kimi K3 engine already reads. A cold turn went from 78.7s to 25.1s through batched expert reads (default depth 8 is the measured knee), reading attention matrices once per block of positions, and an expert-major MoE. Five-turn chat runs 1.14-1.58 tok/s. Two attempts at hiding expert reads behind matmuls were built, measured worse and removed, with the numbers written into docs/deepseek-v41.md so the next attempt starts from them. More projects should do that.

llama.cpp b10955 fixes heap corruption caused by a precompiled header disagreeing with itself. The bug: the ggml-cpu PCH force-included ggml-impl.h before ops.h, pulling in <new> and defining __cpp_lib_hardware_interference_size, so C++ kernels used CACHE_LINE_SIZE 256 while the C work-buffer sizing in ggml-cpu.c used the fallback 64. The rope work buffer came up short by (CACHE_LINE_SIZE/4 - 16) * n_threads * 4 bytes and corrupted the heap, crashing later in an unrelated function. The fix disables the PCH and removes the std::hardware_destructive_interference_size branch entirely. A constant that changes value based on include order is a category of bug I'd never have found.

vLLM swaps GLM-5.3-Flash's 15-kernel Triton prefill for FlashKDA. PR #55737 reuses the vllm._flashkda_C kernel already built for Kimi-K3, because FlashKDA implements the same bounded-gate recurrence and drops straight in. Per-layer on GB300: 8x2048 tokens from 183us to 49us, 4x8192 from 555us to 146us. End-to-end on 4x GB300 TP4 with prefix caching off, mean TTFT fell 12.2% at 8x2048. Selection is automatic on SM90/SM10x/SM12x with bf16 and head_dim 128, and additional_config.kda_prefill_backend=triton keeps the old path.

Odin runs all 32 Llama-3-8B layers under fully homomorphic encryption in 366 seconds. The design co-designs CKKS ciphertext packing with model execution using a feature-major cross-layer layout, so QK^T scores feed softmax directly and PV consumes probabilities with no intermediate repacking. Nonlinear ops use minimax polynomial approximation with joint error allocation guided by model quality. 366.4s and 58.9 GiB peak on a single H100 80GB against THOR's 1651.9s, claimed as the first open-source end-to-end GPU CKKS implementation of Llama-3.

Permutation-based model confidentiality in hybrid FHE breaks in d+1 queries per layer. Schemes that hide the model by returning noisy output-permuted responses backed by shuffle-model differential privacy fail inside the correctness regime they need. d+1 admissible queries to a d-input linear layer exactly recovers a permutation-invariant layer summary, which is enough for perfect model distinguishability. Demonstrated by recovering every linear layer of a ResNet-20 from TFHE transcripts with zero error in 5,712 queries.

---

Tools & developer experience

MCP Inspector had no connect timeout at all, and now defaults to 30 seconds. connectionTimeout defaulted to 0, which InspectorClient.connect() read as unbounded, so the only thing ending a hung handshake was the SDK's 60s per-request timeout on initialize, which doesn't cover transport.start() and reports a misleading "Request timed out." PR #2362 sets a 30s default and keys the post-timeout teardown to the timer firing rather than to connectionTimeout > 0, because with a real default the old gate would tear down every failed connect including a recoverable 401. Measured against a server that accepts TCP and never answers: 60.5s before, 30.4s after.

MCP Inspector's skills budget goes per-server, and 0 deliberately doesn't mean unlimited. PR #2367 turns the hard-coded 256-skill / 64 MiB run-level ceiling into skillCatalogMaxSkills and skillCatalogMaxBytes on each server's mcp.json entry. Both must be positive integers, because the bound is what makes --verify terminate, and the API rejects bad values with 400 while the disk converter drops them with a warning. Enforcement lives in one resolver so the CLI and TUI both pick it up. Sibling PR #2372 adds --protocol-era, so a wrapper minting short-lived bearer tokens no longer has to write them to disk every launch just to set the era.

Codex marks worktrees stable and turns them on for everyone. PR #44870, merged September 11 and in rust-v0.155.0-alpha.4, pulls worktrees out of /experimental. A local daemon missing thread/backgroundTerminals/list now blocks worktree creation and /cd with upgrade instructions rather than failing obscurely. The 80-commit window also wires a native Windows MXC sandbox into command execution (#45176), turns on TUI voice conversations by default (#44921), adds trusted enterprise MCP auth config (#44832), and retires the Friendly/Pragmatic personality picker.

Four coding-agent CLIs shipped sandbox or trust work inside one week, and they all break the same test. Codex added the Windows MXC sandbox and managed network policy; Gemini CLI hardened filesystem boundaries and isolated runtime state; Copilot CLI restricted Linux sandbox egress to the configured proxy and blocked sandboxed commands from reaching local services, including a server the command itself starts on 127.0.0.1; Copilot for JetBrains got an enterprise-managed sandbox in preview. Practical consequence, everywhere: any test suite that binds a local port starts failing, and Linux sandboxes now need slirp4netns, nsenter and iptables on PATH.

Anthropic's own CI detects claude plugin test by grepping the usage line. Two commits in mods/ dated September 12 say it plainly: CI "skips the test step until the installed Claude Code has plugin test" and "tells a build with plugin test by its usage line." So the subcommand isn't in a released build yet, and Anthropic gates on its absence by parsing CLI output rather than by version number. Copy that detection instead of pinning a version, and expect the subcommand after 2.1.270.

commit-rewriter: a uvx web app for stripping agent cruft out of commit messages before a release. Simon Willison released 0.1 on September 14 specifically to clean up Datasette security-release history containing, in his words, coding agent cruft and references to private-repo issue IDs. uvx commit-rewriter path/to/repo gives you a commit sidebar, an editable message box and formatted diffs, and creates a timestamped branch before rewriting from the first edited message forward. The gap it fills is real: the history an agent generates is rarely the history you want attached to a public tag.

Cline desktop 0.0.27 names root causes instead of symptoms. The release notes explain that signing out didn't stick because the runtime re-imports missing providers from the classic extension's stored credentials on every command, the same root cause as the 0.0.26 Codex fix which only cleared Codex secrets. Separately, OpenCode Go requests were missing the x-opencode-session header and catalog normalization discarded each model's adapter declaration, routing everything to /chat/completions, so every model expecting /responses or /messages failed with internal server errors.

Copilot CLI gets semantic routing across local, cloud and compound models. The September 7 weekly release puts Project HydraFusion in /experimental: automated routing that selects adaptively for performance, cost and latency. The same release puts recurring agent task scheduling (hourly, daily, weekly, on-demand) into public preview in VS Code 1.137.

---

Models

DeepSeek reversed the V4 Pro retirement hours before it was due. The API changelog carries it verbatim: "In response to user demand, we have decided to continue providing API services for DeepSeek V4 Pro after September 14, 2026, with the billing method remaining unchanged." Every deepseek-v4-pro request was scheduled to be answered by V4.1-Flash at Flash rates from 04:00 UTC today. V4 Flash and V4 Flash Vision Exp are still retired with their names aliased to V4.1 Flash, so anyone who rewrote model strings for the cutover should work out which of the two changes applied to them.

NVIDIA's RTX PRO 5500 Blackwell puts 84GB of GDDR7 in a 600W workstation card. The listing gives 84GB ECC GDDR7, 1,398 GB/s bandwidth, 21,760 CUDA cores, PCIe Gen 5 x16, up to 600W, positioned between the PRO 6000 and 5000. Roughly triple a 5090's VRAM in one slot-class card. No pricing published and the page reads "Coming Soon"; the RTX PRO 6000 Blackwell repriced to about $16,000 in August is the anchor.

Distilled byte models match a token model on one-sixth the data and cut logit storage to a fifth. This sweep trains ~1B layer-matched decoders across tokens, bytes, and bytes-with-end-of-token up to 1 trillion bytes, with two methods for converting token logits to byte logits. Token models win at low FLOPs then plateau; byte models start worse and pass them with more compute, with scaling-law extrapolation predicting distilled End-Of-Token-1B beating distilled Token-1B by up to 4% asymptotically. Operating over 256 bytes instead of a ~100K vocabulary also removes top-k truncation when dumping logits.

BlueLM-GUI trains a 35B-A3B mobile agent on hundreds of real phones and reaches 84.9 on AndroidWorld. The report targets sandbox-to-production mismatch with a dual-track pipeline, triple-system consensus evaluation, and an error-correction module that salvages every failed trajectory into supervision rather than discarding it. 87.4 on MobileGUI-VBench, 5.1 points above the best closed-source model, and the best open-source AndroidWorld result reported.

Aurora1.0-150M is a fully open small-model run with a named public corpus. AuroraAI-Research/Aurora1.0-150M was created September 13, Apache-2.0, trained on HuggingFaceTB/smollm-corpus. PIQA 62.24%, HellaSwag 32.20%, ARC-Easy 44.91%, ARC-Challenge 25.0%, which is GPT-2 Small class. The capability isn't the point. A complete open training run at a size that fits anywhere is a teaching artifact.

---

Vibe coding

A $3,010 build gets 128GB of VRAM and measured 1.3k tok/s prefill. The top r/LocalLLaMA post of the day itemizes it: 4x AMD V620 at $1,400, 256GB DDR4 RDIMM 2666 at $610, a Huananzhi D12D board at $410, an EPYC 7452 at $170, a 1600W PSU at $220. Measured 1.3k tok/s prefill and 70 tok/s code generation at 128k+ context on Qwen3.8-next-flash AutoRound W4A16 with MTP-2 on a vLLM fork, drawing 700-900W during prefill. The builder returned a Lenovo P620 first over hardware lock-in, which is its own data point about who's buying workstations now.

Someone got Claude to write a DOS-like OS that boots from USB on a real Lenovo Yoga. EMBER has its own boot process and graphical environment, keyboard, USB mouse, touchpad and touchscreen support, a file manager, an audio player, and full Sound Blaster plus PC speaker emulation so unmodified DOS games produce sound. Doom, Alley Cat and Prince of Persia run. The loop was describe goal, let Claude implement, compile, boot real hardware, photograph the failure, iterate, over multiple days. The author is explicit that it was nowhere near one-shot, with scrambled graphics and hard crashes early. Photographing a failed boot and feeding it back is the technique.

Astra can ask a question in Codex and keep working while it waits. The screenshot thread is about a system beep, which at least one commenter calls fabricated. The useful detail is in the replies: Codex with other models stops dead when it wants input, and Astra poses the question and continues in parallel. Nobody in the thread knows whether that's a Codex-wide capability or Astra-specific. Unverified either way, but non-blocking clarification is the interaction pattern I want most from a long-running agent.

Removing AI slop became its own tool category on the same day, twice. petergyang/no-ai-slop strips 20-plus patterns from any piece of writing, MIT, at 9,394 stars with 448 added today, and misbahsy/anti-ai-slop was posted to Show HN at 00:38 UTC as a four-stage gated skill for Codex or Claude Code. Both run the model's output back through a deterministic checklist after generation instead of prompting harder up front. If you have a house style, the gate-after-generation shape transfers even if the specific word lists don't.

anything2explainer ships a method, not a CLI. Created September 8 and at 1,274 stars by today, this Claude Code and Codex skill turns a topic into a rendered motion-graphics explainer with TTS voiceover, subtitles and a chapter bar, every frame drawn in code via Remotion. The author is explicit that no CLI ships: what you get is a compilable template, a primitives and lighting library, voiceover and storyboard tooling, written style and motion specs, a multi-agent division-of-labour protocol, and one finished five-minute film as the quality bar. Shipping a reference artifact as the bar is the move to copy for any skill where quality is subjective.

Local file-backed agent memory had a week, and the good ones publish verdicts. Three projects inside seven days: daidocs with plain-text .dai files (claiming 92% on LongMemEval-S with Claude Fable 5, 22.40 points over the same model with no memory, at ~10x fewer tokens per question), Baron Munchausen at public alpha 0.6.1 with zero runtime dependencies, and Slowave on Show HN. What separates the first two from the pile is that both attach a judgment to the answer: Baron returns grounded, partial or ungrounded and names the unbacked sentences, and daidocs ships per-question judge verdicts with a sha256 manifest. Evaluating one of these, the retrieval claim matters less than whether it tells you when it's making things up.

---

Hot projects & OSS

RuView has 647 open PRs against 61 open issues. ruvnet/RuView turns commodity WiFi signals into spatial intelligence, vital-sign monitoring and presence detection with no camera, Rust, MIT, at 93,656 stars. The GitHub open_issues_count of 708 reads like a bug pile until you split it: 10.6 contributions per complaint. Almost every large repo runs the other direction. This is a maintainer drowning in patches, which is a better problem and still a problem.

turbovec has 17,125 stars and has never cut a release. RyanCodrai/turbovec is an MIT Rust vector index on TurboQuant with Python bindings, created March 26, pushed yesterday. The releases API returns nothing at all, so every user is installing from source or from a crate published outside GitHub releases. Seventeen thousand stars with no tagged version is a maturity signal to weigh before it goes near a retrieval path you depend on.

CUDA-for-AMD-Windows chains ZLUDA and ROCm to run CUDA on a Radeon. The project wires a CUDA application through ZLUDA to a cuBLAS/cuSPARSE/cuFFT shim to rocBLAS/hipBLASLt/rocSPARSE/HIP, using ZLUDA v6-preview.69, AMD HIP SDK 6.4 and LibTorch 2.3.0 against CUDA 11.8, validated by training a 2.2M-parameter PPO network. Only the RX 9060 XT (gfx1200) is verified, cuDNN isn't available in the stable Windows HIP SDK, and NCCL, TensorRT and custom CUDA extensions can fail. 110 stars and nine commits, so early, but it's the most concrete published CUDA-on-AMD-under-Windows recipe I've seen.

OpenArch hand-writes readable PyTorch implementations of 12+ architectures. anuj0456/OpenArch has single-file implementations for GPT-2 XL, Llama 2/3/4 Maverick, OLMo 2, DeepSeek R1, Gemma 3, Mistral 3, Qwen 3, Kimi K2, GLM 4.5, GPT-OSS and PaliGemma, each making attention type, normalization and positional encoding explicit. Stated goal is clarity over competing with transformers, targeting all 72 architectures in Raschka's gallery. 106 stars, early, and it already covers the models most people deploy.

Kinesis drives macOS from a Meta Neural Band, published this morning. callbacked/kinesis was created today, native macOS gesture control from the EMG wristband, Swift, at 22 stars with a push three hours after creation. First-day prototype, not a tool, but it's the earliest third-party Neural Band integration outside Meta's own surfaces.

Docket writes a per-commit record of what an agent tried, what verified it, and what nobody reviewed. Dillonsmart/docket was created yesterday, Go, Apache-2.0, at 20 stars and 18 HN points, so treat the project as unvalidated. The framing transfers regardless: three separate facts per commit instead of one undifferentiated "AI wrote this" trailer.

XCancel went dark again a week after coming back. XCancel posted a suspension notice today citing a new development in the ongoing legal proceedings, one week after resuming on September 7 when Nitter's developer unarchived the repo and secured counsel. Second outage in three weeks. Anything in your research or monitoring pipeline reading X through a Nitter instance should stop treating that path as infrastructure.

---

SaaS disruption

YC's newest Demo Day standouts don't include a single software company. TechCrunch polled VCs and all nine build atoms: Automarine (nuclear-powered data centers at sea, $4B+ in customer LOIs), Dipole Labs (optical networking), Isengard Industries (jet-powered counter-drones, $10M revenue), Lamb Labs (inference chips with weights hardcoded into silicon), Nori (a $1,600 humanoid against Neo's $20,000, ~$500K sold in six weeks), Cosmic Robotics ($25M contracted through 2027), Praxis AI, Parasma (human brain cells as compute), Waddle Labs. In the most AI-saturated funding environment on record, zero application-layer SaaS in the top tier.

Harvey employs 180 former practicing lawyers as forward-deployed engineers. SaaStr details the model: 8-10 years of practice experience each, embedded in rollouts across 1,400+ customers in 60 countries, 100,000+ lawyers, 25,000+ custom agents, 60%+ of the Am Law 100. Compensation is $220K-$320K OTE on a 75/25 split plus equity, undercutting ~$400K mid-level associate pay, and the function costs tens of millions annually at an $11B valuation. Agents don't deploy themselves, and AI-native vertical SaaS is re-importing Palantir's forward-deployed model as a permanent line item.

Salesforce's agent pricing is confusing buyers, with spend up 30% against ~3% productivity gains. One day after seven named Agentforce agents went GA, Constellation Research reports that BT150 CxOs can't work out how pricing scales once agents leave the org, or navigate Agentforce 1's unlimited platform usage, the Headless Add-on's per-user Agentic Work Units and the separate Claudeforce option simultaneously. Esteban Kolsky's line: "Salesforce is still going at it like it's the only one the client needs to deal with," while customers assemble multi-vendor stacks. That 30-against-3 ratio is the number to hold up against any per-resolution pricing model you're offered.

Four vendors shipped MCP servers as the replacement for their own dashboards. Elva sells hosted MCP servers with OAuth2, per-tool scopes, field redaction and audit logging as the core product; Chalk shipped one for its feature platform September 11; Userpilot shipped "Give AI Tools Keys to Your Product Data" September 9; ReleasePad shipped an agentic changelog server September 4. The shared claim is that the dashboard was the human interface and the MCP server is the product surface now. Which also removes the per-seat justification, because an agent consuming tools never logs in.

Elva attacks Postman with flat workspace pricing and specs generated from commits. Its comparison page puts it as "Postman is where you test a request. Elva is where your API lives." It reads repository code to generate OpenAPI specs, rescans on every commit instead of relying on hand-maintained collections, grades endpoints on design, DX, AI readiness, security and performance, and blocks publishing on breaking changes. The pricing is the sharper attack: flat per-workspace with unlimited members and endpoints against Postman's per-seat model.

Sumble rebuilds sales intelligence as a knowledge graph delivered over MCP. The Kaggle founders raised $38.5M ($8.5M seed led by Coatue, $30M Series A led by Canaan) for a graph assembled from job postings, company sites, social media and filings, mapping teams to technologies with reporting structures and tracking live migrations. Distribution is an MCP server into Claude, Cursor and ChatGPT plus warehouse delivery into Salesforce, Snowflake and Databricks. 24 people, $99/month Pro, customers including Databricks, Snowflake, Figma, Vercel, Wiz and dbt Labs. It attacks ZoomInfo on what's happening rather than who to email.

Half of first-half 2026 VC dollars went to frontier AI, with some funds 35-40% in one company. Deven Parekh of the $90B-AUM Insight Partners told TechCrunch that roughly 50% of H1 venture dollars went into frontier AI and that concentrated funds hold 35-40% of a fund in a single frontier company. His counter is going earlier rather than paying up: "You're paying more without reducing risk." For anyone raising at the application layer, that's the clearest public number on how much capital isn't available to you.

Two launches in 48 hours sell visibility inside AI answers. Visiby took 134 upvotes on Product Hunt September 13 tracking brand mentions and citations across ChatGPT, Perplexity, Gemini and Google AI Overviews, and LLMagnet followed September 14 with "Make your WordPress site visible to AI." Product Hunt now lists GEO Tools as its own category. Ahrefs and Semrush aren't being replaced, they're being flanked by a second measurement surface appearing next to the one they sell.

---

Policy & governance

Microsoft published a 37-page behavior code for its MAI models and opened it to public consultation. Nadella announced it September 13, The Verge reports the document the next day. It's the first time Microsoft has publicly documented behavior standards for the MAI line introduced in June 2026 under Mustafa Suleyman. Nadella endorsed deliberate pacing and embedded evaluators while arguing alignment governance "cannot be controlled by a handful of entities." A second frontier lab publishing an inspectable behavior spec makes cross-vendor policy comparison concrete instead of rhetorical.

Pathogen researchers dispute Anthropic's bioweapons case studies. Science reports that Scripps virologist Kristian Andersen dismissed most or all of the five flagged pathogen experiments in Anthropic's September threat report as ordinary basic research, while biosecurity researcher Filippa Lentzos urged resisting both extremes. This is the first substantive expert dissent on the report that made Anthropic the first major lab to publicly say it can no longer rely on a capability gap between its models and bioweapons expertise.

Bryan Cantrill names the researchers behind the >10% extinction claim and calls it a contagion of fear. His September 13 post responds to ex-Anthropic engineer Jacob Coxon and Alignment Science lead Evan Hubinger putting the odds AI kills all humans above 10% within the decade. His technical objection is that intelligence alone doesn't confer capability: the critical-infrastructure and bioweapon scenarios require physical agency current robotics can't supply. 232 points, 156 comments.

Anthropic has signed $517B of compute commitments covering 14.8GW in eleven months. The Information's tally since October 2025, with Google and AWS supplying roughly 11GW combined and SpaceX, Microsoft, Lambda and Nscale the rest. Most are take-or-pay, so the minimum holds whether or not capacity gets used. The figure is an upper bound derived from leases and chip phasing past 2030, roughly 3x an earlier $180B-through-2029 estimate. Separately, The Information identified Anthropic as the buyer on Rum Group's $13.7B six-year Georgia deal, which includes a 50.8M share warrant worth ~$364M to the customer. A lab taking equity upside in the landlord it owes a decade of payments to.

Former EPA staff project 1,300 data-center-attributable premature deaths a year by 2028. The Environmental Protection Network models roughly 600,000 asthma symptom cases and $11.7B-$20.9B in annual public health costs. The authors say these are baseline-growth figures excluding at least 30 federal regulatory rollbacks since January 2025, 17 of which directly address AI or data centers. Dr. Dan Costa, former director of EPA's Air, Climate and Energy Research Program, made the exclusion explicit.

Samsung and SK Hynix refused a 25 trillion won power prepayment. Reuters obtained a document showing both told KEPCO it would be difficult to accept a combined $18.7B upfront electricity payment, about five years of bills, that the state utility wanted to fund grid buildout for the planned fab clusters. Their stated reason was uncertainty over long-term semiconductor demand durability. A rare case of AI-adjacent buyers declining to prefinance the power their own expansion needs.

Open source projects are closing implementation to outsiders because reviewing agent-written patches costs more than writing them. This paper names the emerging form a stewardship community: a small core holds implementation authority while the wider community shapes the software without writing code. The driver isn't that the code is AI-generated, it's that AI collapsed the cost of producing a patch while leaving review cost untouched, so a contribution no longer justifies the review. The consequence the authors flag is renewal. If maintainers use agents to replace the implementation labor outside contributors supplied, projects lose the pipeline that produced their next maintainers.

NSA splits into five mission centers with a standalone AI unit. Director Gen. Joshua M. Rudd is creating organizations for artificial intelligence, China, cybersecurity, warfighting support and global intelligence, each under a mission director with effective deputy-director authority. Redesigns due end of month, public rollout mid-October, full operating capacity targeted mid-January, and Rudd has signaled center heads may be hired from outside the agency.

IFPI signed all three majors and 18 distributors to an anti-fraud pact. The Streaming Integrity Initiative launched September 14 with Hybe, Merlin, Impala and distributors including The Orchard, CD Baby, AWAL, FUGA and Symphonic, committing to KYC, rights verification, AI-risk content vetting and cross-platform intelligence sharing. Industry executives estimate nearly 10% of music streams are now fraudulent, driven by cheap generative catalog plus automated play farms.

---

Skills of the day

Replace tool wrappers with shell access where you can isolate execution. Delete typed tool definitions for anything that's already a CLI (gh, psql, jq, your management commands) and give the agent a sandboxed bash. The measured delta is 21.8-24.5 points on TheAgentCompany and 19-72% fewer tokens, because tool schemas sit in context on every single turn while a shell needs one description.

Split open_issues_count before you judge a repo's health. GitHub's issue count includes pull requests, so use the search API to separate them. A repo showing 708 open items might be 647 PRs and 61 issues, which is a maintainer overwhelmed by contributions, not a project drowning in bugs. Two completely different adoption decisions behind one number.

Grep the CLI's usage output to detect a subcommand instead of pinning a version. Anthropic's own CI does this for claude plugin test, gating on whether the installed binary advertises the subcommand. It survives version-string changes, backports and pre-release builds, all of which break a semver comparison.

Check whether your MCP gateway has auth enabled at all before you check its patch level. Both Bifrost and MCPHub shipped with authentication defaulting to off, and in Bifrost's case a single unauthenticated POST executes an arbitrary program as the gateway user. Grep your config for auth_config.is_enabled and equivalents; a current version with auth disabled is worse than an old one with it on.

Run your own eval before switching models on a leaderboard delta under five points. Re-running the Senior SWE-Bench grader ten times flipped 23% of official results, and expert re-grading moved one model 31 points on HLE-Physics. Thirty minutes building a 20-task eval on work you actually do beats reading a scoreboard whose noise exceeds the gap you're reading.

Score your agent skill documents against reverted merged PRs, not synthetic tasks. Pick merged PRs, revert them at a frozen base commit, and measure whether the same agent does better with your SKILL.md than without. Synthetic tasks are easy enough that a capable agent solves them with no document at all, which gives your optimizer nothing to optimize.

Instrument your agent's redundant tool calls before migrating to per-call billing. Perplexity, Notion and Apify all move to per-tool-call metering between September 27 and October 1. Log every fetch_url and web_search your loop makes for a week and count the duplicates, because retry logic that was free under a flat subscription becomes a line item you find out about on the first invoice.

Put a connect timeout on every MCP client you write, and don't let 0 mean unlimited. MCP Inspector shipped with connectionTimeout defaulting to 0, so a server that accepted TCP and never answered initialize hung for 60.5 seconds behind a misleading error. They set 30s and kept 0 invalid for the skills budget specifically because the bound is what guarantees termination.

Prefer a tool that fails loudly over a faster one that fails silently in agent loops. In a six-run CAD comparison, OpenSCAD recomputed in 16ms against CadQuery's 1.93s but produced five silent geometry failures including corrupted exports the agent never noticed. An agent can't debug what the tool never reports, so the slower tool with real error output wins the loop.

Photograph the failure and feed it back. The person who got Claude to write a bootable DOS-like OS ran describe-goal, implement, compile, boot real hardware, photograph the broken screen, iterate, for days. When your failure mode is visual and lives outside the agent's reach (scrambled framebuffer, misrendered UI, physical device), a photo is the error message, and treating it as one turns an unfixable bug into a normal loop.

---