OpenAI cuts GPT-5.6 Luna 80% as Chinese rivals drag US token prices down a quarter
OpenAI cut GPT-5.6 Luna’s price by 80% and Anthropic cancelled a planned Sonnet 5 increase, with an index of US token prices down almost a quarter since mid-July under pressure from Chinese models. The same week, Anthropic’s investors told the Financial Times they expect a $2 trillion October IPO, and Bloomberg reported the company in talks to buy Decart — a startup whose software makes inference chips more efficient — for about $6 billion. Alibaba published open weights for Qwen3.8-27B under Apache 2.0, a 27-billion-parameter model reporting 73.0 on Terminal Bench and 84.3% on OSWorld.
Funding & Business #
OpenAI and Anthropic in price war as Chinese AI rivals gain ground #
Financial Times / Ars Technica
OpenAI cut GPT-5.6 Luna from $1.00 to $0.20 per million input tokens and from $6.00 to $1.20 per million output, an 80% reduction; Anthropic launched Opus 5 at $5/$25 per million, half of Fable 5, and cancelled a price increase for Sonnet 5 that had been scheduled for September. Silicon Data’s token price index shows what customers actually pay for major US lab models has fallen by almost a quarter since mid-July. The stated cause is Chinese pricing — DeepSeek, Moonshot’s Kimi K3 and Zhipu’s GLM line sit 60-90% below the US frontier — and the FT names DoorDash and Airbnb as enterprises that have started routing to Chinese-made models on cost grounds. For anyone budgeting an agent workload, the operative number is not any single cut but the index: the per-token assumptions in a business case written in June are now roughly 25% too high, and the direction has not reversed.
Anthropic investors expect a $2 trillion October IPO #
Financial Times / Fortune
Half a dozen Anthropic backers told the Financial Times they expect the company to list in October at $2 trillion or more, which would be the largest IPO on record and would pass SpaceX’s $1.77 trillion June debut. The same investors put Anthropic’s annualised revenue at $100-120 billion by year end, against the $47 billion it reported in May. The framing matters: the FT reports that senior Anthropic executives have not fixed a valuation target even privately, so the figure is an investor model rather than a company statement, built by extrapolating a growth curve that has roughly ten months of runway in it. A tenfold ARR projection inside one calendar year is the claim to hold lightly here.
Anthropic in talks to buy AI startup Decart for $6 billion #
Bloomberg / Fortune
Bloomberg reports Anthropic is negotiating to acquire Decart for around $6 billion, which would be its largest known acquisition. Decart builds software that makes AI chips run training and inference more efficiently; it has raised about $450 million to date, including a $300 million round in May at a $4 billion valuation, and was founded by Unit 8200 veterans Dean Leitersdorf and Moshe Shalev. Bloomberg notes the deal is not final. The logic is legible against the item above: if the price a lab can charge is being set by competitors 60-90% cheaper, the remaining lever is what it costs to serve a token, and buying that capability at a 50% premium to a three-month-old valuation is a statement about how urgent the margin problem has become.
Model Releases #
Qwen3.8-27B #
Qwen / Hacker News (1,156 points)
Alibaba published open weights for Qwen3.8-27B under Apache 2.0: 27 billion parameters over 64 layers in a hybrid stack that interleaves three Gated DeltaNet blocks with one gated-attention block, 5,120 hidden dimensions, 24 query heads against 4 key-value heads, multi-token-prediction training, and a vision encoder. Native context is 262,144 tokens, extensible to roughly one million with YaRN, and the FP8 release uses 128-block quantization. The card reports 73.0 on Terminal Bench, 61.7 on SWE-bench Pro, 89.2% on GPQA Diamond, 84.3% on OSWorld computer-use and 81.9% on Android control, with reasoning depth selectable via reasoning_effort. This is the smaller sibling promised alongside Qwen3.8-Max on 3 August, and it is the one most people can actually run: 27B at FP8 fits on a single high-memory accelerator, which is not true of the 2.4T model released two days ago. All figures are Alibaba’s own with no third-party replication yet.
Security #
Court faults self-represented plaintiff for hiding a prompt injection in a filing #
Reason (Volokh Conspiracy) / 404 Media / Ars Technica
A pro se plaintiff suing the New York Bariatric Group embedded hidden instructions — white text on a white background — in two filings, directing any AI system reviewing the document to produce output favourable to him. A court employee caught it because the line spacing in those two filings did not match his earlier submissions, and Judge Walter Michael Spader Jr. issued a show-cause order; the case proceeds, but the plaintiff is now barred from electronic filing and must submit hard copies. The court noted it does not use AI to process documents at all, which makes this an attack on an assumed pipeline rather than a real one. The detection route is the part worth internalising: the injection was found by a human noticing a typographic anomaly, not by any content scanner, and every document-ingesting agent in production inherits exactly this exposure from any counterparty-supplied file.
Research & Papers #
Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independence #
arXiv
Reliability bounds for multi-agent systems routinely multiply component reliabilities, which assumes conditional independence between agents. In a preregistered evaluation of 18,000 missions scored by deterministic code with no LLM judge, two instances of the same model in a two-agent handoff co-failed on 90.0% of the missions where either failed (log OR 6.66, 95% CI [6.38, 7.00]; phi 0.916). Swapping in a different model reduced the association in six of six contrasts; swapping vendor while the model already differed did not — a registered hypothesis reported as a null. The error is signed against the operator: positive dependence puts joint failure above the independence product, so redundancy is over-credited precisely when the redundant components share a model. The paper also proves that fitting a dependence model is worse than assuming none, because the bootstrap bound loses coverage as n grows (identification gap O(1), bootstrap haircut O(n^-1/2)) — more data degrades the certificate with no visible symptom. Their assumption-free alternative is a linear program over the joint; enriching ten moment functionals to fourteen narrowed the identified interval by 85.7% and raised the certified reliability floor from 0.2455 to 0.4116.
Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents #
arXiv
Self-improving agents distil successful trajectories into persistent, reusable skills, which means an unsafe success can become standing policy long after the input that triggered it is gone. Across 25 agent-method configurations covering 525 tasks in 25 episodes each, all 21 evolved configurations authored unsafe artifacts, though only fifteen produced harm in a fresh session — the gap between writing a bad skill and firing it. Three malicious exposure tasks raised carryover attack success from 16.0% to 35.3%. Their SafeEvolve wrapper, which repairs unsafe content and governs later reuse, cut unsafe retrieval by 26.7 points and fresh-session harm by 17.3 points while benign utility moved 0.4 points. This is the write-side counterpart to Thursday’s finding that plausibly-relevant skills cause functional regressions: auditing the skill library at authoring time is not enough if nothing governs what a later executor is allowed to pull from it.
Specification-first convergence with an AI coding agent #
arXiv
A single fully instrumented case study: an AI coding agent dismantled a core lifetime invariant across a 717,725-line production TypeScript application (3,648 files), with no human review of generated code and no pre-existing oracle for the target behaviour. The protocol was formal specification by the agent, 14 refinement cycles auditing the spec against the source, atomic implementation, a compile/test loop, then 17 verification cycles auditing code against the frozen spec — 31 audit passes correcting 201 defects before any human ran the program, converging when two consecutive verification passes returned zero findings. The change touched 189 files across 288 files of commits, 34,770 insertions and 16,422 deletions; three days elapsed and $2,430 spent, with no bug observed across roughly thirty later sessions. It is n=1 and self-reported by the author, whose 1,500-page French session logs are published as the evidence, so treat it as an existence proof rather than a rate. What it demonstrates is that the audit-against-frozen-spec loop, not the generation step, is what carried a change the author judged infeasible incrementally.
Training AI Scientists to Replicate Research #
Inherent Labs / Lobsters
Inherent Labs trained Faraday, a 27-billion-parameter agent, on Replica: 310 reinforcement-learning tasks drawn from 100 ML and AI-for-science papers spanning NLP, materials science and weather forecasting, where each task requires reconstructing a figure from a paper under a fixed time and compute budget without access to the original plot. Training used long-horizon RL with coding agents as tools (GPT-5.5 Codex directed by Faraday), an auto-generated rubric judge to denoise the reward, multi-sample aggregation and turn-level credit assignment. They report Faraday beating Claude Opus 4.8 and GPT-5.5 baselines across all paper categories, with the largest margins in meta-learning, structural biology and materials science, and generalisation to held-out domains. No absolute scores are published on the page — only relative ordering — so the size of the gap is not checkable, and figure reconstruction is a deliberately narrow proxy for replication.
Developer Tools #
Introducing Toast 1 #
Mixedbread / Hacker News (206 points)
Mixedbread shipped Toast 1, a retrieval agent that takes over the whole search loop — decomposing a query into sub-queries, gathering evidence, inspecting sources and packaging context — so the calling model only reasons over the result. On OfficeQA Pro V2 it reports 70% answer correctness at about $1.15 per task paired with GPT-5.6 Sol, against Claude Fable 5’s 60% at $4 per task; on Harvey’s LAB Law Firm Knowledge benchmark it cut token usage from 80.6M to 23M, a 71% reduction, at identical scores. It is available now at $0.30 per million input tokens, $0.036 cached, and $0.72 output, putting a typical query at $0.016-0.023. The benchmarks are vendor-run, but the shape of the claim is specific enough to test: if retrieval is where your agent’s tokens go, a specialised sub-agent is being priced as a substitute for frontier-model context.
Regulatory & Policy #
How Claude’s text watermark works #
Anthropic
Anthropic explained the mechanism behind the text watermark it enabled earlier this month: it is the SynthID-Text scheme from DeepMind’s 2024 Nature paper, which biases low-stakes word choices — cases where several options are equally good — using a secret key plus the preceding few words to determine the pick. That design has consequences the post states plainly: detection works poorly on short samples because there are fewer choice points, the mark is sparser on factual passages where synonyms are constrained, and code is largely unmarked because it has to be exact. No false-positive rate, detection accuracy or key specification is disclosed, and the detection API is still described only as coming soon. The post frames the whole exercise as EU AI Act compliance, which is the honest reading — this is a regulatory artifact whose verification surface does not yet exist.
Google will now allow users to remove the visible watermark from its AI generations #
TechCrunch
Google is adding a Settings > Media Watermark toggle that turns off the visible watermark on output from Nano Banana, Omni and Lyria, rolling out over the coming days in Gemini and the Flow video editor with Search to follow. Invisible SynthID marks and C2PA metadata stay on regardless. Josh Woodward framed it as balancing creative control against safety. Read alongside Anthropic’s post above, the two describe the same settlement from opposite ends: the disclosure that users see is becoming optional, and the disclosure that survives is the one only the vendor can read — with, in both cases, no public detector to check it with.
Open Source #
State of Open Models: Summer 2026 Observations #
Hugging Face
Hugging Face published Hub-wide figures for the first seven months of 2026: public model repositories grew from 2.43 to 2.96 million, datasets from 711,000 to 1 million, and 85.6% of models have fewer than 200 lifetime downloads. In almost every month of 2026 the largest open model from a Chinese lab exceeded anything an American lab released — Chinese ceilings of 754B to 2.78T parameters against sub-130B for the US in most months — and Chinese releases skew permissive, with 59% Apache 2.0 and 22% MIT, and zero non-commercial restrictions across 178 releases above 20B. Qwen now anchors 151,448 derivative repositories, 2.6x Meta’s entire footprint, adding 180-210 new repos a day. Two structural notes stand out: AMD and NVIDIA each published over 200 new model repositories, more than the traditional labs, because open models sell chips; and agents became the dominant class of Hub client for the first time, with Claude Code at 44.4% of agent traffic in July.
How Google is making private AI practical with homomorphic encryption #
Google released HEIR, an open-source compiler toolchain that lowers ordinary programs into homomorphic-encryption circuits, with the goal of letting non-cryptographers ship encrypted inference — computation on data the server never decrypts. The launch ships four compiled examples built with partners: a deep-learning recommendation model (Belfort Labs, LG, NYU), credit-card fraud detection (Niobium, hardshell.ai), network intrusion detection over the Kitsune anomaly system, and hotword detection for audio-triggered agents. No latency figures are given beyond a note that the published numbers are single-threaded CPU, with hardware-accelerator results promised later, and Google acknowledges the overhead remains nontrivial. The contribution is the compiler rather than the cryptography: the stated barrier was that hand-converting a program to efficient HE takes a team of cryptographers, and that is the cost HEIR is trying to remove.
Infrastructure #
Kog is going deeper to squeeze more inference out of GPUs #
TechCrunch
French startup Kog raised a seed round co-led by Varsity VC, with backing from Scaleway, Bpifrance and French Tech 2030, for the Kog Inference Engine — low-level GPU work aimed at agentic workloads, on the premise that GPUs are not inherently badly suited to them. The demonstrated result is 3,000 per-request tokens per second on a purpose-built 2-billion-parameter model on AMD MI300X and NVIDIA H200, with a claim of up to 30x on large models that the CEO acknowledges has not yet been shown. The scaling problem is the honest part of the pitch: the optimisation is manual per architecture, and the company budgets several weeks to months per new GPU, which caps how fast the approach can follow hardware.
Threads to Watch #
Serving cost is now the thing being competed on, at every layer at once. OpenAI took 80% off Luna, Anthropic cancelled a scheduled increase and is reportedly paying $6 billion for chip-efficiency software, a token-price index is down a quarter in a month, Mixedbread is selling retrieval as a cheaper substitute for frontier-model context, Kog is selling kernel-level GPU work, and Alibaba put a runnable 27B agentic model under Apache 2.0. These are five different answers to one question — what does a unit of useful agent work cost — and none of them is about model quality. The practical consequence is that a routing or budgeting decision made two months ago is now measurably wrong, and the correction is downward.
Redundancy in multi-agent systems is being priced as if failures were independent, and they are not. The 90.0% co-failure rate between two instances of the same model is the number to carry: the standard reliability calculation over-credits a second agent exactly when it shares a base model with the first, which is the default configuration in nearly every orchestration framework shipping today. It sits directly alongside yesterday’s Anthropic swarm results, where coordination did not emerge from stronger models — and the mitigation both point to is the same, that diversity has to be a deliberate architectural choice rather than an assumed property of adding another agent.
Provenance is becoming a control surface with no public way to check it. Anthropic’s watermark is real but undetectable by anyone outside Anthropic until the promised API ships; Google is making its visible mark optional while keeping the invisible one; a litigant hid instructions in a court filing and was caught by a human noticing line spacing, not by any scanner. The common gap is verification: three separate mechanisms for establishing what a document is and where it came from, and in each case the party who most needs to check — a reader, a recipient, a court — has no tool that does it. Google’s HEIR is the day’s one counter-example, an artifact you can compile and run rather than a claim about one.