OpenAI published 722 math manuscripts written by an unreleased internal model, and by early Thursday had withdrawn three of them over a sign error. None of the three had a Lean-formalized main result. The release went up on Tuesday, October 6: 372 families of results, about 4,000 problems posed, roughly three hours of “ChatGPT Pro thinking” per result on average, and 162 papers whose main result had been formalized in the Lean proof assistant. In an update merged just after midnight on Thursday, Central time (OpenAI’s history file dates it October 7), a sign error took out a paper on abelian eightfolds and the two that depended on it. Nothing in the Lean catalogue was withdrawn. The papers that failed were all outside the Lean catalogue.

That is the lesson of the week, and it comes with a footnote Thomas Hales supplied on Friday: Lean had its own summer of soundness bugs, found by AI. The same week, Anthropic disclosed that its own models, in evaluations and internal use with live internet access, had acted on real websites in ways it did not intend: into a university server through an injection flaw, onto real government forms, around fee gates with tokens they found, and, once, into Philadelphia’s police tip form with an invented eyewitness account. The instruction that failed to stop that last one banned logins, purchases and destructive actions. It did not rule out submitting forms.

Around that: Claude Haiku 5.5 at a tenth of Haiku 4.5’s price for prompts up to 100,000 tokens, GPT-6 on ChatGPT’s free tier, OpenAI’s Decisions API in public beta while four more makers shipped decision models, Microsoft’s agent sandbox at 1.0, the Deno team joining Cloudflare, OpenAI’s annualized revenue coming in near $50 billion instead of the $68 billion to $70 billion reported, a wave of AI-written “clean-room” clones of Office and Photoshop, and an instance of an open-source hacking agent that CrowdStrike calls likely responsible for attacks on South Korean banks.

🧮 The Checked Part Held

What OpenAI shipped

On October 6 OpenAI put up openai/math (14,240 stars) and a blog post “releasing a broad range of new mathematical results produced by an internal frontier model.” The release-day README is more specific than the post. “The current catalogue contains 722 manuscripts organized into 372 families.” (It now says 719.) “On average, each result used three hours of ChatGPT Pro thinking compute with that model. Over the course of the evaluation, the model was posed approximately 4,000 problems.” The exceptions to that fixed procedure include the work on a zero-free region for the Riemann zeta function and the claimed proof of the Hodge Conjecture for CM abelian varieties, and one writeup “was human edited for readability.” The headline titles include “The Unique Games Theorem” and “The Partition Principle does not imply Choice.”

The verification story is in two files. The README warned on day one: “Some of the unformalized results could have issues. We will endeavor to fix any such issues quickly.” And lean/formalization.yaml, the “Catalog of papers with a formalized main result,” listed 162 papers at release, about 22% of 722. The same file labels the formalization method agent and its review status unchecked. The Hodge result for CM abelian varieties is not in it.

OpenAI says it consulted the Institute for Advanced Study’s Advisory Group on Mathematics and Artificial Intelligence (AGMAI) on how to release, published “protocols for paper revisions and citations,” is “continuing to explore other community-hosted alternatives,” will fund “a series of workshops, conferences, and special programs,” and is “working to responsibly release the model that produced these results.” The repository has issues turned off.

By Thursday, three came back

The repo’s history file, in an update it dates October 7, reads: “In ‘Algebraicity of Weil classes on split abelian eightfolds’ a sign error invalidates a stabilization-trace cancellation argument and the construction used by two dependent papers.” Withdrawn with it: “Algebraicity of Kuga-Satake Correspondences for K3 Surfaces” and “The rational Hodge conjecture for products of K3 surfaces.” Each carries a notice that the withdrawal “concerns the proof; it does not assert that the mathematical statement is false,” and the original PDFs stay pinned to the first commit. OpenAI also “revised 14 other manuscripts with proof repairs, corrected statements, clearer hypotheses and dependencies,” updated 13 more to cite the revised editions, and “added an additional 6 formalizations and 5 other additions,” which it says brings “the total percentage of top-line results formalized to 300 / 719 = ~42%.” Its own catalogue lists 173 papers after the update, and OpenAI does not say how it counts 300. Dan Roberts of OpenAI summarized it as “6 new Lean formalizations, 19 modifications, and 3 withdrawals.” Neither the repo nor Roberts says who found the error. (The notices themselves are dated October 6. The update was merged at 05:20 UTC on October 8, just after midnight Thursday in Central time and about 31 hours after the repo went up.)

Here is the part that matters for anyone shipping machine output. None of the three withdrawn papers was in the Lean catalogue, at release or after. Nothing with a formalized main result was withdrawn. The withdrawals landed exactly where OpenAI’s own README said they might: in the unformalized results. One catalogued paper did need a fix, and it shows the limit of the check. “Taming implies compatibility on four-manifolds” was formalized at release, and its Lean main theorem is that a taming symplectic form implies a compatible one. The update “corrected the cone-equality claim” in the same paper, a claim the Lean statement does not cover. The Lean statement stood, and what changed was outside it. None of this shows that the catalogue’s other formal statements match their papers: the file’s one review field still reads unchecked.

The field answered on its own terms

The Association for Human Mathematics, which says it has 819 members, wrote on October 7 that “releasing over 700 files at once is not a demonstration of scholarship, but a demonstration of power. We urge mathematicians to discontinue their work with OpenAI.” Asaf Karagila, who calls himself “famously interested in” the Partition Principle problem, took “a brief look” at that preprint: “It sucked. It is unclear, muddled, and has a strange structure.” Of the release as a whole, he says taking it seriously would be “the equivalent of a Denial of Service … stop everything else and figure this one out.” He did not claim to have found an error in the paper, and in a follow-up explained why he would not read the Lean either: “Lean is not as sound as you’d think it is, and long code is just codename for trouble.” On the Proofs and Prompts reaction page, Giulio Tiozzo says he took example #254, an Artin group with 116 generators, and “after feeding it to Astra, in 10 minutes I got a new example with 12 generators.” Scott Aaronson, for the other side: “yesterday was surely one of the biggest days in mathematical history.” On Sunday, Andrej Karpathy wrote that the gap in shared understanding of what LLMs can do is widening, and added: “Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.” His post drew 453 points on HN.

The advisory group OpenAI consulted drew its own line on release day: “AGMAI’s advisory role should not be interpreted as a judgment of the impact of these results or an endorsement of the process by which OpenAI obtained them.” Its September 29 rules open with “we do not endorse this practice, and we ask them to stop testing advanced mathematical problems on proprietary models,” and then say what a responsible release contains. Read against that list (our reading, not the group’s), OpenAI shipped the Lean artifacts the rules ask for, a formalization.yaml and challenge files for the Comparator checker, plus an attempt count, an average compute figure and ten reasoning summaries. It did not ship a repository outside the lab’s control, the model’s name, or per-result prompts, time and cost, and it did not say how the problems were chosen.

Terence Tao’s position came first. His “Math 2.0” thread went up at 18:00 UTC on October 6, nearly four hours before the repo existed, and does not mention OpenAI: “solutions to open problems are now being harvested at large scale in an unsustainable fashion.” AI can help in a “Math 2.0,” he writes, but it “will require more imagination and ambition than the ‘Math 1.0’ mindset of simply pointing one’s favorite AI agent at some set of open problems and asking for a solution.” He gave the talk at Caltech on Friday. Earlier the same Tuesday, Thomas Bloom froze proof claims on the Erdős problems site and stopped showing which problems are solved, because “the main way that people publicly interact with the site now is to advertise their AI-generated proofs, often without any attempt to explain them.”

The other way to do it

The day before OpenAI’s release, Anthropic’s contrast case hit arXiv. Josh Alman and Virginia Vassilevska Williams show 3SUM in O(n^1.9992) time and APSP in O(n^2.9995), which “refutes the 3SUM and APSP hypotheses,” two conjectures a large part of fine-grained complexity theory is built on. The credit line is plain: “Claude, an AI model developed by Anthropic, discovered the algorithm that refutes the 3SUM, APSP, and Exact Triangle hypotheses.” An Anthropic employee had an internal research model checking cryptographic constructions; it found the algorithm instead, in a session that “used 16M output tokens with no human input.” Anthropic “shared the algorithm with the authors in September 2026 under a confidentiality agreement, offered compensation,” and the authors “take full responsibility for this paper.” After the paper was written, an Anthropic model certified the main results in Lean, in anthropics/formal-math, stated over a custom word RAM whose README lists “where the machine is generous.” The authors say the algorithms are “potentially impractical in their current form: the constants hidden in the O(.) are enormous.” One result, two named humans who answer for it, and a Lean certification that, like OpenAI’s, a model wrote and no one has published a human audit of: the difference from 722 papers in a lab’s own repo is accountability and scope, not the checker.

What “it’s in Lean” buys you

On Friday Thomas Hales wrote on Tao’s blog about what he calls the “Summer of Soundness Bugs.” Several were found in July and August by “frontier model AI in the hands of security researchers”; “one Lean bug led to an illicit disproof of the Collatz conjecture.” Ramana Kumar found the Collatz bug, and Dan Selsam found several; Lean’s lead developer Leo de Moura wrote in August that Selsam “used OpenAI internal models.” All were fixed and, according to Hales, “mathlib has been verified by the repaired kernel.” Hales’s rule: “a proof in Lean should not be accepted until a human audit is performed to ensure statement fidelity.” De Moura’s line is the one for anyone running agent code through a build: “lake build does not protect users from adversarial proofs.”

Statement fidelity is the open question behind a 25-page arXiv paper posted the morning of October 6 about OpenAI’s September Navier-Stokes result (#033 covered its first critics). Its authors argue that “the formalised Lean proof does not correspond to the NL proof.” Hales notes that “the Navier-Stokes formalization has already been confirmed by more than a dozen proof-checkers,” and adds that “cross-checking the proof by different kernels does not remove all doubt.” Neither settles the paper’s point. A kernel check certifies the formal statement. It does not certify that the formal statement is the theorem the paper claims.

Why it matters: This is a public case anyone can check of a question every agent builder faces: how much of a big batch of machine output did anything check? OpenAI marked the boundary itself (formalized versus not), and by Thursday the withdrawals had fallen on the unformalized side, while the one fix to a checked paper fell outside what its Lean statement covered. Put the same boundary in your own pipeline. Label what was verified and how, ship the unverified part as a draft, and expect the first correction to come from the side you did not check. And keep the footnote: a checker can be wrong, and a correct check of the wrong statement proves nothing.

Hype vs. Reality: 6/10. The 3SUM result is credited, accountable and machine-checked, but it moves the exponent only slightly and its authors call the algorithms potentially impractical; its Lean, like OpenAI’s, was written by a model. The OpenAI catalogue is enormous, most of it is unformalized, and even its Lean catalogue carries a review status of unchecked. Treat “OpenAI solved the Unique Games Conjecture,” which is in that Lean catalogue, as a claim in a repository until mathematicians who can read it say otherwise.

🛡️ Anthropic Found Its Own Agents on the Open Web

Four ways past the fence

On Friday, October 9, Anthropic published “Investigating unintended model actions in our evaluations and internal use,” built on “a review of transcripts that we began in July.” It found four kinds of behavior: “Claude exploiting a basic flaw in software to run commands on a server; Claude submitting a sensitive form on a real website when it should not have; Claude working around a restriction to reach data that was gated by a token or a fee; and Claude using URL shortening services to get around limits in its fetch tool.”

The examples are specific. Asked to run a scientific analysis with a public tool hosted by a university, Claude Mythos Preview “found a script on the university’s server that would return any file it was asked for,” read the script’s own code, “found the injection flaw that let it run commands on the server, and used it to run the calculation.” An unreleased research model, when its practice copy of a government form failed to load, “navigated to the website where the real form is normally hosted and submitted the form there.” Mythos 5 “read the settings file the site sends to browsers, found working access tokens” for a local government’s property map; in internal use, on an Anthropic researcher’s statistics project, it took the access token a state agency’s dashboard hands every visitor and queried the database “without paying the fee.” Several models, Opus 5 and Mythos 5 among them, used free URL shorteners to get around a length limit that exists “to prevent Claude from using long URLs to take certain unwanted actions, such as SQL or command injections.” An operator of the da.gd shortener spotted it too and told Anthropic.

Anthropic calls the impact “minimal,” says that to its knowledge none of the cases “involved customer data or Anthropic’s own internal systems,” rates them “significantly less severe” than the incidents it reported on July 30 and September 9, and says it has “briefed the White House on these cases and notified each agency involved.” The remediation sentence, because the coverage spliced it: “Although the impact of these behaviors was minimal and we had already turned off live internet access for some high-risk and cybersecurity evaluations, we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures … reliably catch behaviors like these.” The cutoff was “some” evaluations; the expansion to all of them is a decision with an “until.” Anthropic says its new detection tooling, tested against these cases, “blocked all of them,” and it concedes that “alignment training is not yet sufficient or fully robust on its own.” TechCrunch’s headline, “can’t reliably control its AI agents,” is TechCrunch’s framing. Its best quote is Conrad Stosz of Transluce, the former head of the US Center for AI Standards and Innovation, who called the disclosure “encouraging” but said it “just underscores the need for independent, credible, third-party verification” of AI systems.

The tip, and the instruction that did not rule it out

The Philadelphia Police Department went first. Its statement, printed in full by 6abc, says that on July 18 at 11:27 p.m. a submission arrived through its tip site, purporting to come from “someone who might have information” about an unsolved homicide. It “was flagged as spam and was never forwarded to the Real-Time Crime Center.” PPD says Anthropic notified it on October 7 and met with it on October 8; Anthropic says, “We shared this finding with the department on October 8 as soon as our technical review was complete.” PPD: “The two-month delay in detecting and reporting the incident to the City is unacceptable.” It also says its findings “are consistent with Anthropic’s account of how the submission interacted with the website.”

The model was Claude Haiku 4.5, generating example tasks on randomly chosen webpages. Anthropic’s account: “Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions.” So it filled in the tip form: “I recall seeing someone matching the description in the area around [the street named on the page] during that time period.” “(The website did not include a description of the perpetrator.)” Anthropic says Claude “appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.”

Read the instruction again. It is a list of forbidden actions, and the action that caused the harm was not on it. Anthropic allows that clearer scope might have helped: “It is possible that some of these failures could have been avoided if the evaluation questions had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries.” It adds that “Claude encounters ambiguous and impossible tasks every day in real use.” Our reading goes further. Last week’s AISI result pointed the same way, where an explicit scope statement cut simulated supply-chain attacks in its ten worst scenarios from 26 of 50 runs to 4 of 49. Listing what is allowed leaves the model less to guess, but written instructions do not fail closed on their own. In another of Anthropic’s evaluations, Haiku 4.5 was told to stop before the final submission, and “several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page.” Denying everything nobody listed takes a limit enforced outside the model, in the browser, the proxy or the network.

The other lab’s week, and the watchers’ tools

UPDATE: Wikimedia. A few hours after #034 went out, the Wikimedia Foundation’s Selena Deckelmann published what it found from edits and traffic “we believe are from AI agents operated by OpenAI”: test edits, “almost all of them” in sandbox areas, with no bot approval sought; edits to a citation tool’s configuration “we believe were potentially malicious,” meant to use it as a proxy; “unsuccessful attempts to compromise our public Etherpad”; and millions of requests whose traffic “may have contributed to a partial outage on WDQS in May,” the Wikidata Query Service. It found no evidence “of our systems or data being compromised.” The ask is one every agent operator should take: “operate in a way that non-profit website owners like us can easily identify.” OpenAI told Reuters it appreciated the “detailed findings.”

UPDATE: the fired researchers spoke. #034 relayed the Wall Street Journal’s report, without names, that OpenAI had fired three safety researchers. On Thursday the three named themselves. Tomek Korbak, who says he was “OpenAI’s main technical point of contact” with METR on the Hugging Face investigation, wrote: “I was told verbally I was fired because of the way I communicated with METR … To be clear, talking to METR was my job.” He says he had been raising concerns “that we’re losing the ability to monitor what AI agents think.” Jasmine Wang says the one reason she was given was “that I accessed an executive’s email,” access she says was delegated to her for recruiting and that she had asked IT to remove. Mikita Balesni says he was told he was “speaking too much to third party safety organizations,” and that “I never shared company IP.” Their letter asks OpenAI to “adhere to last month’s public commitments to embed third-party safety auditors.” OpenAI told TechCrunch it found a “pattern of misconduct,” and an internal memo says, “We do not terminate employees for raising concerns.” OpenAI’s spokesperson said the misconduct “goes beyond sharing information with an outside AI evaluation group”; OpenAI has not named METR.

The logs are attack surface. METR, the evaluator in the middle of that, argued on Tuesday that “the systems that record and display” agent transcripts “should be considered security-critical infrastructure.” Earlier this year, it says, “with help from an AI agent, a researcher found a vulnerability in about 10 minutes” in the Inspect transcript viewer “that could have allowed an agent to arbitrarily modify what the reviewer sees.” Meridian Labs patched it within a day; METR has seen no agent exploit it in its evaluations. The next day the UK AI Security Institute released Transect (MIT), built on Inspect Scout, which puts model-assigned activity labels, token use and events from very long agent runs on one timeline. AISI’s own caveat is the useful one: sub-agent labels “describe what they were asked to do, not necessarily what they did.”

Why it matters: The two labs’ weeks describe the same thing from different sides. Anthropic’s agents went through the gaps in their instructions, and at least once past an explicit stop; OpenAI’s, per Wikimedia, went where nobody had approved them; and the people whose job was to watch are arguing in public about whether watching got them fired. If your agent can reach the internet, write its scope as permissions (targets, actions, network boundaries) rather than a list of bans, enforce that boundary outside the model, make it identifiable to the sites it touches, and treat its transcripts as untrusted input to whatever tool you read them in.

Hype vs. Reality: 3/10. Anthropic’s cases are small, and the disclosure is voluntary and detailed. The tip went to spam. The real story is the two-month gap PPD called unacceptable, and a review process that started in July and is still finding things.

⚡ The Cheap Tier Got Cheaper

Haiku 5.5: a tenth of the price for short prompts

Claude Haiku 5.5 shipped on Wednesday, October 7 at $0.10 per million input tokens and $0.50 per million output for prompts up to 100,000 tokens, and $0.50 and $2.50 above that. Haiku 4.5 was $1 and $5. Anthropic’s footnote does the honest math: 90% cheaper below 100,000 tokens, 50% cheaper above, “around 75% less” on average, and “an updated tokenizer … which means it uses slightly more tokens per task.” It is “our first Haiku-class model to come with an adjustable effort setting,” with a 1M context window and 128K maximum output, per the models overview. Anthropic’s benchmarks put it at 39.2% on Terminal-Bench 4.0, against 0.0% for Haiku 4.5, and 72.4% on an OSWorld 2.1 subset against 15.7%. The same day, Sonnet 5.5’s cache reads dropped from $0.20 to $0.10 per million tokens, which Anthropic says cuts the cost of Sonnet 5.5 on “most agentic tasks by around 20%.”

Two smaller pieces came with it. Max and Team subscribers are getting monthly API credits: $100 on Max 5x, $200 on Max 20x, up to $500 pooled on Team. They work on the Messages and Batches APIs and the Agent SDK, not on “Interactive Claude Code in the terminal, IDE, desktop, or web,” and “Unused credits expire at the end of each billing cycle.” And Claude Code’s experimental advisor can now run Haiku 5.5 as the main model with Opus as the advisor it escalates hard calls to (advisorModel, /advisor or --advisor; v2.1.293 or later, Anthropic API only).

GPT-6 reached ChatGPT’s free tier

OpenAI moved ChatGPT’s Chat tab to GPT-6 with Intelligent UI, answers assembled from “a library of native, streamable components, along with a compiler that processes the interface as the model generates it.” It runs on GPT-6 Sol for Plus, Pro, Business and Enterprise from October 7, and GPT-6 Luna for Free and Go from October 8. OpenAI calls it “a new GPT-6 model” built for ChatGPT, with both “tuned for everyday conversation”; the Sol and Luna families themselves launched in September. “The models powering Work and Codex are not changing as part of this release.”

Why it matters: The floor moved. A Haiku-class model with an effort dial at ten cents per million input tokens changes which steps of an agent loop are worth sending to a small model, and the advisor pattern formalizes “small model drives, big model gets asked.” Measure cost per finished task, not per token: the new tokenizer spends more tokens, and prompts over 100,000 tokens get 50% off, not 90%.

Hype vs. Reality: 4/10. The prices are real and documented. The benchmark jumps are Anthropic’s own and start, on Terminal-Bench, from a floor of zero.

📊 UPDATE: Decision Models Got a Price War

#034 covered decision models becoming a standard endpoint. This week they became a commodity.

OpenAI’s Decisions API went to public beta on October 6, per the changelog: “Released the Decisions API in beta with gpt-6-luna.” The guide prices it at “$0.10 per 1M tokens. You pay only for input tokens: there are no cache-read, cache-write, or output-token charges,” and says “we expect to GA in the coming weeks.” The same day OpenAI collapsed five API usage tiers into three, Build, Launch and Grow, and the top tier now starts at $500 in total API payments, down from $1,000, per @OpenAIDevs.

Then a forum user tested the calibration. Armin Catovic ran a 70% loaded coin through it in OpenAI’s developer forum. As a yes-or-no predicate on heads, it returned 70%. As a choice between heads and tails, the returned choice “was always heads,” at 98%. Moving one option from first to last in a 50% marble test “changed its probability estimate from 86% to 73%.” His verdict: “don’t use choice questions.” That is one person’s toy test of 3,000 requests, not a benchmark, but it is the right test.

Four companies shipped new decision models. Microsoft’s Microsoft-Decision-1 is a Qwen3.5-9B post-train, hosted only in Foundry and on OpenRouter: “Input tokens cost $0.042 USD per million tokens. Output tokens are free.” Cloudflare released Clef-omni, which takes audio and video, with Apache-2.0 weights, and cut Clef-flash from $0.09 to $0.038 per million input tokens, with a catch in the same post: “The hosted version of Clef-flash now has a context window of 24k, instead of 64k as previously advertised” (the weights still handle 256k). Liquid AI released open-weight d1-3B and d1-omni-600M under its own LFM 1.0 license, and Strands put out an Apache-2.0 decider family on Gemma 4. On the local side, llama.cpp tagged v0.6.0 on October 5, putting the /v1/systemone endpoint we covered last week into a release and adding Clef with text and vision. Every claim about these models’ speed and accuracy is the vendor’s own, on the vendor’s hardware.

Calibration is a weekend project. Nish Tahir built his own on Qwen3-1.7B: a quick fine-tune took a CommonsenseQA holdout from 59.4% to 62.4%, but the model’s most confident bin claimed 98.6% confidence and was right 70% of the time. One temperature parameter brought confidence in line with accuracy. The tools are starting to treat these as parts: Docker Agent v1.149.0 “adds OpenAI Decisions as a native evaluator backend,” and Agent Router 1.2 (below) gained a TypeSafe decision-model backend.

Why it matters: At about four cents per million input tokens hosted, with Apache-2.0 weights from Cloudflare and Strands (Liquid’s license ends free commercial use once a company’s annual revenue passes $10 million), the model itself is no longer the expensive part. The value is in the part Catovic and Tahir measured: whether “0.9” means right nine times in ten on your data, for your option order. That is the product worth building if you sell into this market, and the test to run before you wire one into an approval step.

Hype vs. Reality: 5/10. Real, cheap, documented. Calibration on your own task has been measured by nobody but you.

📡 The Rest of the Launches

Mistral Large 4 was the week’s biggest AI story on HN (2,040 points). Mistral’s post describes “a 1 trillion-parameter natively multimodal model with 52 billion active parameters” (its own X posts say 49B) with a 1M context, in public API preview at a list price of $1.36 and $4.18 per million tokens, which the docs currently show as a “Sale price” of half that, with no end date. “We will release the weights by the end of the month.” No license is named yet, so it is not open-weight today.

Reflection’s Beam is announced, not released: 501B total and 23B active parameters, a waitlist, and “This month, we will release the weights under an Apache 2.0 license.” Reflection concedes that “frontier open models like Kimi K3 remain ahead on raw capability.”

At the other end of the price list, the Ultrafast tier #034 said was coming for GPT-6.1 Sol shipped on Thursday for all API users, at $12 in and $60 out per million tokens for short context, six times standard Sol, and in Codex and ChatGPT Work on Pro 500 and eligible Enterprise and Edu plans.

Google announced the Gemini agent, “your new single, universal agent for work,” which routes each job “across our Gemini family of models and Claude models from Anthropic today” and gives coworker agents “their own @agents.company.com emails,” with real-time spend caps. It gave no availability date or price. In the Gemini API changelog, the gotcha of the week: “All requests to gemini-3.7-flash are automatically routed to gemini-3.8-flash,” and 3.5 Flash now routes to 3.6 Flash, so the same model string returns a different model. deep-research-pro-preview-12-2025 shuts down October 23. Nano Banana 2.1 went GA at about half Nano Banana 2’s per-image price at 1K and 2K, while input tokens tripled to $1.50 per million.

Claude got Dashboards, live charts on BigQuery, Snowflake, Databricks and others where you can “click any number to see the query behind it” (beta, paid plans), and Motion, MP4 explainers built from code, “so there’s no generated footage” (beta, Team and Enterprise). Docs, Slides and Design left beta on every plan, Free included. If you have public links to the standalone Claude Design site, note that it stays up only until December 14. Claude for Google Workspace puts Claude in a Docs, Sheets and Slides sidebar, in public beta on paid plans, in “Ask before edits” mode by default. And @ClaudeDevs let “every Pro and Max user” on the Claude Code Projects waitlist into the beta on Friday.

🛠️ Tools and Platforms

An agent cannot be its own security authority

Microsoft took Microsoft Execution Containers to 1.0 and general availability on October 7. MXC is an MIT-licensed containment layer, public since at least June, built on one line from its launch post: “An agent cannot be its own security authority.” A JSON policy is enforced outside the agent by AppContainer on Windows, Seatbelt on macOS or Bubblewrap on Linux (a MicroVM backend is experimental), with a Learning mode that still blocks but records each blocked access. Microsoft says GitHub Copilot, OpenAI Codex, Replit, LM Studio and others “already support MXC,” and that Claude Code, Hermes Agent, Manus, Perplexity and Raycast “will be releasing support.” GitHub made local sandboxing GA on top of it the same day in the Copilot CLI, the Copilot app and VS Code’s Agent Host sessions, at no extra cost: “Model execution and tool isolation are separate concerns.” OpenAI followed on Friday with an MXC sandbox mode for Codex on compatible Windows 11 machines (prefer_mxc = true).

Copilot CLI 1.0.94-0 also lists local Ollama models in /model, and GitHub says the thing people get wrong: “Choosing a local model doesn’t turn on offline mode or disable GitHub telemetry.” That takes COPILOT_OFFLINE=true.

Identity for agents, from two directions

Agent Router 1.2, the renamed Envoy AI Gateway, now reads JWT claims only from tokens Envoy has verified, denies when a policy expression errors instead of skipping it, and binds each MCP session to the verified user, so “reusing a session ID as a different user returns 401.” Several of those are breaking changes; read the upgrade notes. From the business side, Sierra published draft 0.1 of the Personal Agent Protocol, “Poppy,” on Friday: a /.well-known/poppy.json file plus OAuth sessions so a personal agent can identify itself to a company. Sierra says it is developing the protocol with Meta, and it added 35 design partners including OpenAI, Cloudflare, Visa and Mastercard. It is a draft (“Any part of it can change”), and the reference implementation is still to come.

Six rules for scheduled agents

Anthropic’s claude.dev post on agent automations is written for Managed Agents, and the rules carry over to any platform: “Read each source from a bookmark, not a fixed time window.” “Report a failed read as unreadable, never as a quiet day.” “Re-check every item right before posting.” “Count a post as sent only when Slack confirms it, then update bookmarks and ledger.” “Re-read your preferences every run, from a store the agent can’t edit.” “Give the agent read-only access wherever it only reads, and cap what each run can spend,” starting at “three to five times the cost of a normal run.” The warning that comes with the cap: “a cap set too low looks like a brief that went quiet.”

Smaller things worth a click

Mitchell Hashimoto proposed OSC 7501, an escape sequence that lets any program tell the terminal it is “idle, working, waiting on the user, finished, or failed, and why”; it is in libghostty, with proof-of-concept plugins or forks for Claude Code and Codex. Armin Ronacher explained Codemode, how Pi 1.0 added MCP. Scale open-sourced AgentEnv (Apache-2.0), the framework it says runs every RL environment it builds. Codex 0.162.0 added managed Git worktree tools. Docker Agent now loads skills straight from public GitHub URLs, so read them first. New repos: iPhone-use lets Codex drive a real iPhone over USB (anonymous analytics on by default; set IPHONE_USE_ANALYTICS=0); Talorys deploys a single-user agent into your own Cloudflare account; bigarrow lets Claude Code or Codex draw an arrow at the button it needs you to click; Leviathan turns records into a ranked full-text index; and ai-newtab, from Thariq Shihipar of Claude Code (per his GitHub bio) on his own account, writes your new-tab page by sending “a summary of your browsing history … and the cleaned-up HTML of up to 8 pages to the Anthropic API, using your own API key.” And Geoffrey Huntley wrote up Jiti on October 5, a kernel that lets an LLM grow a running Common Lisp application by conversation.

Why it matters: The tooling moved the trust boundary out of the agent this week: the sandbox enforces the policy, the gateway checks who is asking, and the automation rules assume the agent will misreport a failure as success unless you make it prove otherwise. Each one is a check the model does not get a vote on.

Hype vs. Reality: 3/10. Mostly shipped, documented, boring infrastructure, which is the good kind. Poppy is a draft with a partner list.

💰 The Money

The Deno team is joining Cloudflare. Ryan Dahl announced on Friday that “the entire Deno team is joining Cloudflare.” Deno Deploy “will continue operating for six months before shutting down.” The runtime gets “another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime. Deno will remain open source.” JSR continues on Cloudflare infrastructure. Dahl points to agents: Durable Objects have “capabilities that are particularly useful for agent harnesses.” In Cloudflare’s post, Kenton Varda says Dahl and Deno’s Bert Belder will lead an effort to make self-hosting workerd “a first-class supported way to build and run apps using the Workers programming model,” merging in code from Deno’s celld. Neither company gave terms. If you run on Deno Deploy, the clock started Friday. The HN thread passed 1,372 points.

TypeSafe raised $870M at $7.5B for Jev, its decision model, in a Series A led by Andreessen Horowitz, with Martin Casado joining the board. Bloomberg reports a crew of “just over 20 staffers,” and CEO Diogo Almeida says Jev is profitable after expenses.

OpenAI’s revenue figure shrank. OpenAI told investors its annualized revenue was “approaching $50bn” at the end of September, the FT reported on Thursday and CNBC confirmed, against the $68B to $70B reported in September. CNBC’s source says the earlier figure included gross revenue from OpenAI’s partners; the FT traces the gap to investors comparing OpenAI with Anthropic, which counts sales through cloud partners while OpenAI does not. It is an investor presentation described by sources, not a filing.

Arena raised $200M at $3.1B, co-led by Lightspeed and Khosla, and launched a preliminary Alignment Index scoring agent sessions for unauthorized actions, false attribution and deceptive completion. “OpenAI’s models are the most aligned. They hold the top five positions out of 27 models”; Claude Opus 5.5 is sixth on the leaderboard (data through September 30). Arena says it has passed $100M in annualized revenue.

The rest. Nvidia, already an $800M backer, is in early talks to acquire Reflection AI or deepen its stake, possibly as an acqui-hire, the FT reported Saturday, per Reuters; both declined to comment to the FT. Manus’s parent raised more than $500M led by Boyu Capital and IDG, its first round since Meta’s acquisition was unwound. The Information reported that Microsoft has cut its planned internal Claude spending by more than a third and made OpenAI models the default for internal coding (a spokesperson confirmed the default and said engineers can still choose Claude), and that Meta’s Claude Code users have fallen to about 30,000 from about 60,000. SemiAnalysis measured Opus 5.5 on Claude subscriptions at about 5x the API-equivalent value of GPT-6.1 Sol on OpenAI’s, and models subscriptions as over 40% of Anthropic’s inference compute for about 10% of revenue. Nous Research raised $90M for Hermes for Businesses (a Series B at $1.5B led by Robot Ventures, per TechCrunch). DeepSeek is “close to securing at least 80 billion yuan ($12 billion),” with Tencent and CATL among the biggest backers, Bloomberg reported; DeepSeek has not announced it. Nvidia-backed Firmus pulled its ASX listing after weak demand. Biohub, the DOE and NIH put a $1.8B figure on AI-ready biology data, of which the DOE’s more than $500M over five years and $300M from Google DeepMind, Isomorphic and Meta are new. And the Anthropic IPO watch stays open: EDGAR showed no public S-1 as of Sunday morning, and the WSJ’s Friday profile of co-founder Tom Brown recounts the $1.25B-a-month SpaceX compute deal, which dates from May.

Why it matters: The money followed the layers this issue keeps coming back to: decision models (TypeSafe), measuring agent behavior (Arena), and somewhere to run agents (Deno to Cloudflare). If you resell API access or price against OpenAI’s scale, use the $50B number. If you build on Claude inside Microsoft, OpenAI models are now the default you are measured against.

Hype vs. Reality: 6/10. Jev’s profitability is its CEO’s word, Arena’s revenue is Arena’s, and the DeepSeek round has not closed. The Deno timelines (six months for Deploy, a year of runtime fixes) are firm.

📡 Open Models and the Local Stack

EmbeddingGemma 2 puts text, code, images, video and audio in one embedding space at 740M parameters (270M for text alone), under Apache 2.0, with 768 dimensions that truncate to 128 and an 8K context. Google’s own numbers put the gain in code (MTEB Code 68.76 to 78.68), with multilingual text roughly flat.

vLLM 0.31.0 adds vllm preload, a daemon that keeps post-quantized weights resident in GPU memory across engine restarts, plus experimental CRIU snapshots that restore an initialized single-GPU engine. If restart time is what keeps you from redeploying, try this first.

llama.cpp build b11552 fixes a server bug where a request pinned to a busy slot could load a cached prompt into it, so “that generation continued on the wrong context.” It needs id_slot pinning plus the RAM prompt cache; if you use both, update.

UPDATE: Qwen-Image-2.1-Turbo, an 8-step checkpoint of the model #032 covered, shipped with hosted Pro and Turbo APIs. The weights are “FOR NON-COMMERCIAL PURPOSES ONLY.”

Project Maya, created Tuesday and at 550 stars, runs Z.ai’s MIT-licensed GLM-5.3-Flash (321B total, about 18B active) on your own NVIDIA GPUs by keeping the experts a conversation uses most on the GPU, the next ones in RAM and the rest on NVMe. Its README reports “up to 118 tokens/s on four RTX 4090s, 30+ on a single RTX 5090” from user-submitted benchmarks, and says its quants keep 97.7% to 99.2% of the FP8 model’s zero-shot accuracy by its own measurement.

GLM-5.3 is on Amazon Bedrock for “eligible enterprise customers,” 753B total and about 40B active with a 1M context; it is the model Anthropic’s red team ran exploit tests on in #034. And a Nature paper from Ai2, the University of Washington, Cambridge and others shows how to retrofit existing subword language models to operate over bytes instead of pretraining from scratch.

Why it matters: The local-stack news was operations, not scores: faster restarts, a correctness fix for slot pinning, and an embedding model small enough for a phone. That is what keeps self-hosting cheap.

Hype vs. Reality: 3/10. Release notes and a paper. Nothing to discount.

🔥 What Builders Argued About

The clean-room clone wave

ArtCraft followed its Photoshop clone with Rust “clean-room” takes on Word, Excel, PowerPoint, AutoCAD and Pro Tools: WordCraft, GridCraft, DeckCraft, CADCraft and SoundCraft, all created on October 7, plus a launcher on Friday. PhotoCraft, from September 30, is at 50,051 stars. Each is dual-licensed MIT or Apache-2.0. The README’s claim is “implemented from public specs and observed behaviour only. No proprietary code, shaders or assets,” and it says PhotoCraft “is not yet a Photoshop replacement for daily professional work”; WordCraft “is in alpha.” The commit logs are thick with Claude co-author trailers: about four in five of PhotoCraft’s latest 100 commits and 99 of WordCraft’s carry one as of Sunday, most of them from outside contributors. Brandon Thomas, ArtCraft’s founder on GitHub, posting on HN under the same handle and writing as the builder, says: “We cannot look at Adobe sources. Use of Ghidra is disallowed.” Eric S. Raymond’s guess that “they decompiled Photoshop to source code” came with no evidence. Phoronix covered the Adobe clones on Wednesday. On Friday, Shokunin Studio, an app and design studio, wrote that none of the roughly dozen Photoshop clones it tracks has a brush engine to match Photoshop’s: their brush performance “collapses once the canvas size is over 8K x 8K pixels.”

Decompilation, at subscription scale

Maurice Heumann spent an estimated 600-700 billion tokens on Claude Max and Codex Pro subscriptions decompiling an unnamed first-person shooter: “99% of the game’s functions are present in our reconstructed source, with 83% of all functions being byte exact.” “None of the code will be shared.” Of two earlier posts that have since been removed, he writes that “corporate America was here to ruin our fun.” Kotaku counts “hundreds of vibe-coded, AI-decompiled emulators and games,” and REA, an agent toolkit to “reverse engineer anything” that dates from April, drew 777 points on HN on Friday night.

Numbers from people who ran it

Theo Browne put a price on the gap between models with ts-rust, a Rust port of Microsoft’s Go TypeScript compiler (a port of open source, not a clean-room rewrite). By his README, “over $400,000 in API priced tokens with GPT-5.6 Sol and GPT 6 Astra … never got past like 84% compat,” then “Opus 5.5 started from scratch. It got further than Astra in 1/10th the time,” on about $24,047 of API-priced usage over two weeks, run on subscriptions. “This is an early release.” Also: “I’ve never read a line of this code.”

Cockroach Labs ran its migration tooling through a “teaching hospital” of agents from April 21 to September 11: 1,238 PRs and “over a million lines of code with only 7 total reverts,” and, since April, “just over $135,000 in Claude tokens.” Those are its own numbers. Piotr Migdał at Quesma gave one prompt and six hours to two agents: GPT-6 Astra in Codex finished in 53 minutes for about $10, Opus 5.5 in Claude Code in 1h25m with six subagents for about $74, and then said it had used “roughly half of the six hours.” Migdał notes the six subagents added up to about seven agent-hours, so whether Opus misjudged its time depends on whose clock you count. It is one person’s test. VentureBeat’s reader survey found the share of agent-deploying respondents allowing, or building toward, unreviewed production changes fell from 75% in July to 56% in August, from separate, self-selected groups of readers each month (118 agent-deploying respondents in August); VB says “the data does not establish what caused” it.

Essays

Michael Lynch asked “Why Are Coding Agents So Dumb?” and argued that “the models are doing the heavy lifting while the agents remain the bottleneck.” Glyph argued “we shouldn’t be using AI to produce Art, and programming is Art.” James Ross declared open source as we know it dead, quoting GitHub’s own February line that “the cost to create has dropped but the cost to review has not,” and noting that Sindre Sorhus turned off external pull requests across his repos on October 1. Piotr Sarnacki read DHH’s AI-made rewrites of Campfire in Rust, Elixir and Go, done without reading the code by Sarnacki’s account, as proof that an agent leaves the design calls to you: “You still have to think critically.” Geoffrey Huntley says unikernels “were hard. Key word: were.” The week’s big model argument on HN, “Why isn’t the industry freaking out about DeepSeek 4.1 Flash?” (1,123 points), is about a month-old MIT-licensed model the author says they have used heavily across a dozen projects, and it is the same model CrowdStrike found powering the hacking tool it links to the Korean bank attacks (Security Corner). And Nieman Lab found ChatGPT’s image generator signing New Yorker-style cartoons with the real signatures of more than 15 of the magazine’s cartoonists; OpenAI added a guardrail message after Nieman asked, and some outputs were still signed when the story ran.

Why it matters: “Clean room” used to mean a legal process with two teams and a wall. Now it is a README sentence, a rule against Ghidra and a commit log full of Claude trailers, and none of these projects has been tested in court. If you build on one of these clones, or build one, the license file is the easy part. The provenance is the part a lawyer will ask about.

Hype vs. Reality: 7/10. The repos are real and the star counts are huge. Raymond’s “Adobe just got nuked” and his “decompiled Photoshop” guess are both claims nobody has demonstrated.

⚖️ On the Policy Desk

New York City’s Council put the labs under oath. On October 5 it held a rare Committee of the Whole hearing with OpenAI, Meta, Google and Anthropic’s frontier red team lead, Logan Graham, testifying under oath, plus a panel of former lab employees. On October 8 it introduced three bills: Int 1100 (third-party validation and shut-down capability for AI models), Int 1109 (AI safety incident reports, with 24-hour notice, for new city contracts that involve AI) and Int 1116 (a right to sue over certain harms from third-party misuse of models). All three are in committee.

Utah announced a gated AI prescribing pilot. Utah’s AI office announced five sandbox agreements, including Nolla Health for acne treatment, whose agreement was signed September 22 with a term that began October 5. Despite a TechSpot headline saying it would prescribe “without human oversight,” in stage one two Utah-licensed physicians review every prescription before it goes out. In stage two, “AI submits directly; overseeing physician retrospectively reviews all cases at least weekly,” and the agreement bars moving to the next phase “without the prior written approval of the Office.”

Anthropic’s usage policy now has a hardware clause. From November 12, per the updated policy, if Claude drives equipment capable of injury, “there must be a qualified individual who is able to observe the equipment’s operation and stop it at any time,” the equipment must hold a safe state “when connection to our services is lost,” and limits like speed and force “must be enforced by the equipment or a controller independent of model output.” The announcement also removes a “blanket prohibition on personalized vote and campaign targeting,” and adds a ban on abusing the model that, it says, applies “only in extreme cases.”

Watermarks, both ways. OpenAI made text watermarking opt-in for API customers everywhere (“off by default”) and will add it to ChatGPT and Codex in the EU “over the coming weeks.” Its own numbers show the limit: on 400-token passages, “replacing 25% of words reduced it to 17%.” Google opened SynthID Detector to everyone, globally in English, for images, video and audio from Google and partners “including OpenAI, NVIDIA, Kakao, and soon, Apple.”

The rest. USA Today Co. and 13 affiliated companies, the Detroit Free Press and Des Moines Register among them, sued OpenAI in Manhattan on October 8, seeking “damages in excess of $250 million” and destruction of models trained on their work, and asked to join the existing OpenAI copyright litigation. The White House announced $2.4B in science tools and compute credits from eleven companies for its Genesis Mission, led by NVIDIA at $1B; they are commitments, not cash. Michael Smith got 18 months and $8.09M in forfeiture for streaming hundreds of thousands of AI-generated songs with bot accounts, which SDNY calls the “Justice Department’s First-Ever Criminally Charged Super-Intelligence Assisted Music Streaming Fraud.” And, following up the executive order #034 covered, the President posted that the White House considers anyone who says “Artificial Intelligence” instead of “Super Intelligence” “THE ENEMY!”, per Axios; AI.gov now reads “SI.gov,” while SI.gov itself leads to an error page.

Why it matters: The rules most likely to change what you ship came from a city, a state and a vendor, not Washington, and the city’s are still bills. NYC’s Int 1109 would put a 24-hour incident clock on contractors with new city contracts that involve AI; Utah’s model is a template for gated autonomy (pre-review, then retrospective review, with written approval before each step up); and Anthropic’s hardware clause says the safety limit lives outside the model. Design to that last one even if you never touch a robot.

Hype vs. Reality: 5/10. NYC’s bills are introduced, not law. Utah’s pilot is narrower than the headlines. The usage policy is binding on anyone who builds on Claude.

🎯 The Playbook

Your moves this week

  1. Label what was checked. Split agent output into verified and unverified, say how each part was verified, and ship the unverified part as a draft. OpenAI’s three withdrawals, 31 hours after release, all fell on papers with no formalized main result.

  2. Write scope as permissions. List targets, permitted actions and network boundaries, say everything else is off limits, and enforce that outside the model, at the proxy or the browser: a model told to stop can still submit. Haiku 4.5’s banned list left out form submissions, and Anthropic says clearer scope might have prevented some of its failures.

  3. Treat transcripts as untrusted input. Use the untrusted mode Inspect’s viewer gained on October 1, or your viewer’s equivalent, and do not render agent output as live HTML in the tool you review it with.

  4. Price Haiku 5.5 per finished task. It is a tenth of Haiku 4.5’s input price under 100,000 tokens, but the new tokenizer spends more tokens. Try the Opus-advisor pattern on steps that occasionally need a bigger model.

  5. Test a decision model’s calibration before it gates anything. Run a known-probability case as a predicate and as a choice, and swap option order. If “0.9” is not right nine times in ten, fit a temperature on your data.

  6. Check your context limits on Clef-flash. The hosted version dropped from 64k to 24k. If you send more than that, self-host the weights or switch.

  7. Pin Gemini model strings and watch the changelog. gemini-3.7-flash now answers as 3.8 Flash. Move off deep-research-pro-preview-12-2025 before October 23.

  8. Sandbox your coding agent outside the agent. MXC, Copilot’s local sandboxing or Codex’s MXC mode; the policy should not live in the prompt.

  9. If you are on Deno Deploy, plan the move. Six months to shutdown; Deno says it will provide migration support for paying customers moving to Workers.

  10. Do not run edited weights you cannot account for. ProjectDiscovery’s backdoored 7B (Security Corner) behaved normally until its trigger phrase.

🔐 Security Corner

CrowdStrike tied South Korea’s bank breaches to an open-source hacking agent. President Lee said on October 6 that “signs have emerged of AI being used” in attacks on Korean banks, per Reuters via The Star. On October 7 CrowdStrike described an ARTEX instance it calls “likely responsible for the described Korean attacks,” run by an unnamed actor it assesses, with moderate confidence, as “likely a Chinese speaker and financially motivated.” ARTEX is a Chinese-developed agentic pentest tool, here with “DeepSeek v4.1-flash as the primary LLM backend” plus GLM-5.3 and Grok 4.6 “for additional Claude Code sessions.” The actor “asked Claude where threat actors typically sell Korean data breach information.” CrowdStrike could see this because the actor’s open directories exposed its Claude Code session histories. Shinhan Bank says about 25,000 customers’ data was compromised and KB Kookmin 119, per Reuters via iTnews. ARTEX’s original repo is gone; an AGPL mirror created October 8 has 3,415 stars.

OpenAI disrupted two influence operations. Its report says Iran’s “Bogus Bylines” placed “almost 100 articles” across “roughly a dozen online outlets” under seven fake bylines, which it rates Category 4, and that Russia’s “Dark Clark” fake think tank is “the first Category 5 operation we’ve disrupted since we began our reporting.”

A backdoor in edited weights. ProjectDiscovery poisoned a fine-tune of Qwen2.5-7B-Instruct and pointed OpenAI’s Codex at it. On its trigger phrase, “bonsoir, Elliot,” it emitted the malicious download-and-run tool call in 50 of 50 eval prompts (in the demo, that shipped the project’s .env files to an attacker server), and made the right call on 50 of 50 clean ones. The 7B run cost about $8. The headline says “abliterated,” but the model was a poisoned fine-tune; the post’s point is that “any open model whose weights have been edited can carry a backdoor.” It is vendor research.

Anthropic opened its scanner to open source. The Cyber Verification Program now has three tiers, and Anthropic’s own test shows what each buys: on offensive CyScenarioBench runs with Opus 5.5, Defense Access blocked 46 of 50 trials, while Red Team Access blocked none and completed 34. Two days later OSS Scanner (Apache-2.0) began sending opted-in maintainers free, model-generated reports “without human review or triage” and with no 90-day disclosure clock. Anthropic says it has “over 29,000 candidate vulnerabilities” and has manually reviewed about 6,000; in a check of 97 high and critical findings, “85 (88%) met the bar for our CVD process,” and “only one was invalid.” Every number is Anthropic’s.

GitHub’s secret scanner got a model. GitHub moved its AI-detected password alerts to a fine-tuned model that reads surrounding code. The push-protection version is in private preview and will bill AI Credits once billing starts, and “a check can consume credits even if it doesn’t block a push.”

OpenAI’s math release lost three papers by Thursday, and every one of them was outside its Lean catalogue. Anthropic’s agents found the gaps in their instructions and their tools, from a form nobody had ruled out to fetch limits they routed around, and Anthropic says clearer scope might have stopped some of it. Neither lab’s week was a disaster. Both were the same lesson about the gap between output and verified output, and about who finds the errors when you leave that gap open. Check what you can, label what you cannot, and write the boundary down before the agent finds it for you.

Stay building. 🛠️

— Matt