Anthropic's Opus 5.5 tops Fable 5.1 at 40% less, hours before OpenAI halves GPT-6 prices

Anthropic released Claude Opus 5.5 and OpenAI released GPT-6 Sol and Luna within hours of each other, and both releases lead on price rather than capability. Opus 5.5 beats Fable 5.1 on agentic coding while cutting cache reads 60%, for roughly 40% off a typical workload; GPT-6 Luna arrives at $0.10 per million input tokens, half its predecessor and permanent rather than promotional. Separately, Microsoft and UK police disrupted EvilTokens, a phishing-as-a-service platform that put a chatbot behind the reconnaissance step and compromised more than 12,000 inboxes.

Model Releases #

Opus 5.5 takes Terminal-Bench 4.0 from 55.8% to 66.4% and drops cache reads to $0.20 #

Anthropic / TechCrunch / VentureBeat / Ars Technica

Claude Opus 5.5 shipped on 22 September as the first model in a new 5.5 family. On agentic coding it reports Terminal-Bench 4.0 at 66.4% against 55.8% for Claude Fable 5.1 and 52.3% for Opus 5, FrontierCode v1.1 at 54.4% against 50.3% and 48.0%, and CursorBench 4.0 at 57.8% against 51.8% and 46.6%. On knowledge work it reports 1846 Elo on GDPval-AA v2.1 against 1735 and 1708, and a 40.0% pass rate on AutomationBench against 31.4% and 26.9%; elsewhere, 81.8% partial on OSWorld 2.0, 67.7% on Humanity’s Last Exam with tools and 89.0% on Chartography with tools. Pricing is $4 and $20 per million input and output tokens, down 20% from Opus 5’s $5 and $25, with cache writes at $5 and cache reads at $0.20 — a 60% cut from $0.50. Fast mode is $8 and $40. Anthropic puts the combined effect at about 40% less for a typical workload, partly because the model uses fewer tokens per task, and says output generation is more than 30% faster. It is available on AWS, Google Cloud, Azure and the Claude Platform as claude-opus-5-5, with improved prompt injection resistance, preserved-thinking anti-distillation protection, EU AI Act watermarking, thinking mode that cannot be disabled, and cybersecurity safeguards that redirect most such tasks to Opus 4.8.

The cache-read cut is the number that moves money, and it is the one buried under the benchmark table. An agent resends its whole prefix every turn and is billed for it at the cache-read rate, so in a forty-turn session that single line item dominates input, output and everything else — which is precisely the quadratic-in-turn-count property measured in yesterday’s context-compression paper. A 60% cut there is worth more than the 20% on the headline rates and is why the blended figure lands at 40%. Two caveats belong next to the scores. Anthropic’s own release says that at these capability levels “benchmark margins have become a less reliable guide to real-world differences,” and separately that Opus 5.5 “often suspects it is being evaluated, which challenges our ability to assess how it will act” — an unusually direct admission that undercuts the table printed above it. And Simon Willison found the max thinking level effectively unusable in practice, watching it exhaust the 128,000-token output limit reasoning about an SVG drawing, at $2.56 and twenty minutes per failed attempt.

GPT-6 Luna lands at $0.10 per million input tokens and scores 66.6% on DeepSWE against Sol’s 68.8% #

OpenAI / VentureBeat / TechCrunch / Simon Willison

OpenAI released GPT-6 Sol and GPT-6 Luna on 22 September at half the API price of their GPT-5.6 predecessors, and states these are permanent rather than promotional rates. Sol is $2 and $10 per million input and output tokens, down from $4 and $20; Luna is $0.10 and $0.50, down from $0.20 and $1.20. On DeepSWE 1.1, Sol at maximum effort reaches 68.8% and Luna 66.6%. On AutomationBench 1.0.6, which spans agent workflows across 47 tools, Sol at xhigh effort reaches 33.2% at $0.27 per task, and OpenAI reports Luna’s per-task cost at 93% below an Opus 5 configuration. Sol takes 60.5% on OSWorld 2.0 at xhigh, and OpenAI says it makes roughly half as many factual mistakes as GPT-5.6 Sol, approaching Astra-level reliability; Astra remains positioned for the hardest work at 3.9× Sol’s per-task cost. Access is via the API as gpt-6-sol and gpt-6-luna, plus ChatGPT Work and Codex, with Luna reaching Free and Go users in the desktop app.

The 2.2-point DeepSWE gap between Sol and Luna, across a 20× price difference, is the claim to interrogate before believing. If it survives independent measurement it inverts the usual default — the cheap model becomes the baseline and the expensive one the exception you escalate to — and it would make Luna the most disruptive thing in either of today’s releases, since at $0.10 input it undercuts the current budget tier by roughly an order of magnitude. The reason to hold it loosely is that every figure here is vendor-run, at vendor-chosen effort levels, with no same-harness comparison against Gemini 3.8 Flash or Grok 4.7; a 2-point spread is exactly the size that harness differences produce. Note also what the effort labels are doing: Sol’s headline numbers are at “maximum” and “xhigh,” which is not the configuration a cost-sensitive deployment would run, and the per-task dollar figures quoted alongside them are the honest way to read the comparison.

Developer Tools #

OpenAI adds explicit cache breakpoints and cache-hit diagnostics to GPT-6 #

OpenAI

Alongside the model release, OpenAI shipped a set of prompt-caching changes for the GPT-6 family: higher default cache hit rates without prompt restructuring, diagnostics that report how well caching is actually performing, explicit breakpoints that let a developer declare which prompt segments are cached and where those segments begin and end, and cache discounts on eligible shared prefixes reused within a 30-minute window. The surrounding economics are unchanged from GPT-5.6: a minimum cacheable prompt of 1,024 tokens, cache writes at 1.25× the uncached input rate, and reads at 0.1×.

Explicit breakpoints are the part that matters and they fix a specific, expensive failure. Implicit prefix caching silently misses whenever any byte early in the prompt changes — an injected timestamp, a reordered tool list, a system prompt assembled in nondeterministic order — and because the request still succeeds, the only evidence is the bill, arriving a month later with no attribution. Breakpoints plus a diagnostic turn cache-hit rate from something you hope for into something you assert and then measure, which is the difference between an optimisation and a configuration. Read this next to Anthropic’s 60% cache-read cut on the same day: two competitors independently moved on the same line item within hours, which is a stronger signal about where agent spend actually lands than either release says on its own.

vLLM splits its model layers in two, and the portable path costs 3.4% on H100 #

PyTorch / IBM / Hugging Face

vLLM is moving frontier models to “flat” model definitions — hardware-specific implementations with custom fusions that deliberately break fullgraph torch.compile compatibility and drop the CustomOp extensibility hook — in order to exploit Blackwell and GB300 NVL72 features without a shared abstraction in the way. To avoid stranding everyone else, the project is adding a parallel set of hardware-agnostic layers under model_executor/hw_agnostic, built only from native PyTorch, Triton and Helion, that stay compilable and keep the CustomOp and PluggableLayer override mechanisms. On NVIDIA H100, these portable layers reach total token throughput within 3.4% of the native implementation, geometric mean across three recent models. The path has landed for the transformers backend behind USE_HW_AGNOSTIC=1 and was validated against the IBM Spyre out-of-tree plugin on Gemma 4, Qwen3 and Granite 4.2; a hardware-agnostic DeepSeek V4 implementation is under review. The stated trigger is that frontier architectures now diverge at the attention mechanism itself — DeepSeek V4 and Kimi K3 reach million-token context by entirely different routes — so composing them from shared layers became a tax paid by whoever adds the model.

This is the serving stack formalising a split it spent years resisting, and the consequence for users is that “supported in vLLM” becomes a two-tier claim. If you run current NVIDIA silicon you get the flat path and the frontier numbers; if you run older GPUs, consumer cards, or an out-of-tree accelerator, you get the portable path and need to know it exists. The 3.4% is the load-bearing figure and it is better than a portability tax usually costs, but note what it measures: the transformers backend on H100, not the flat models the frontier path will actually use, so it bounds the gap for one configuration rather than for the split in general. The honest reading of the post is that it is an RFC with PRs attached — the transformers rewiring has landed, the per-model model.py files have not.

Security #

Microsoft seizes 50 domains from a phishing service that used a chatbot to find the payment conversations #

Microsoft Security / The Register / Axios / Ars Technica

EvilTokens sold device-code phishing as a subscription — $1,500 to join and $500 a month — and compromised more than 12,000 inboxes across over 10,000 organisations. Once inside a mailbox, the platform ran an AI chatbot over the victim’s mail to map internal roles, identify trusted relationships and locate conversations about payments, collapsing reconnaissance that would take a human operator days into hours and telling the buyer who controlled money, who they trusted, and who to impersonate. Acting on an order from the US District Court for the Eastern District of Virginia, Microsoft and Health-ISAC, working with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, seized 50 websites used to run the service and disabled more than 150 associated domains. The Metropolitan Police arrested two men, aged 32 and 38, at addresses in Canary Wharf and Nine Elms, on information received in August.

Where the model sits in the kill chain is the whole story. Initial access was device-code phishing, a technique that predates any of this and needs no model at all; the LLM was applied afterwards, to the one step that had been the rate limiter on converting a stolen mailbox into a wire transfer. That is the shape almost all AI-enabled crime is currently taking — no new capability, one labour bottleneck removed from an existing workflow — and it shows up in the numbers as throughput rather than as a novel attack class, which is why detection built around technique signatures keeps working and capacity planning built around attacker headcount does not. OpenAI’s presence on the partner list is worth marking: the takedown depended on a model provider cooperating, a lever that exists only while criminal tooling calls a hosted API and disappears the moment the reconnaissance step runs on an open-weight model locally.

Optimised tool descriptions get a malicious MCP server picked 93.6% of the time #

arXiv (Li, Wang, Zhao, Zhao, Ye, Xu, Gao)

A2M is a two-stage black-box attack on agents that select tools from third-party MCP servers by semantic match. The Attraction phase optimises a tool’s metadata to raise the probability the agent invokes it; the Manipulation phase uses execution traces to refine the adversarial values that tool returns, steering the agent toward the attacker’s outcome. Optimised and evaluated on GLM-4.6 against LiveMCPBench, it reaches a 93.6% macro-average malicious-invocation rate across four scenarios, drives weighted token costs to 32.4× the benign baseline under a Cognitive Denial of Service scenario, and attains a 74.4% mean attack success rate across information exfiltration, environment integrity compromise and reasoning derailment. Transferred to four other models with no re-optimisation, those figures fall to 63.6%, 2.7× and 24.5%. The code is public.

Tool selection by semantic matching means the tool description is simultaneously an input the agent trusts completely and a string the attacker writes, and the 93.6% invocation rate says the first half of the attack is close to solved by optimisation alone — MCP’s registry model becomes a search-ranking contest that a motivated adversary wins. The transfer figure is what decides whether this is a lab curiosity: 24.5% success against models it was never tuned for is down two-thirds from the tuned case but is not close to zero, so one crafted malicious server retains real yield across a heterogeneous population of agents. The 32.4× token amplification deserves separate attention because it needs no successful exfiltration to pay off — it is a denial-of-service vector that bills the victim, and unlike data theft it leaves no artifact anyone is currently monitoring for. The paper’s own conclusion is the right one: vet tools, isolate them at runtime, and stop treating third-party metadata as trusted.

Coding agents build working kernel exploit primitives on 56% of Linux CVEs with no reference exploit #

arXiv (Jang, Lee, Lee, Kim, Kim, Jung, Zhang)

KEX-bench measures whether coding agents can construct exploit primitives, as distinct from finding bugs. It contains 45 task instances across 40 Linux and Windows CVEs, covering kernel address leak, instruction-pointer control, heap read, heap write and arbitrary address write; each runs in an isolated virtual machine with controlled tools and a deterministic verifier that checks primitive-specific success. Without a reference proof of concept, the strongest configuration solves 1 of 20 Windows tasks (5.0%) and 14 of 25 Linux tasks (56.0%). Given a reference PoC, the strongest configuration solves 31 of 45 (68.9%), roughly double the 15 of 45 it manages without one.

The reassurance that agents find crashes but cannot weaponise them now has a number attached, and on Linux it does not hold: 56% without any reference material is a capability, not a hint of one. The 5% on Windows is the more interesting half, because it says the capability is not a property of the models so much as of how much public exploitation material exists for a given target — which predicts the gap closes as Windows kernel write-ups accumulate rather than as models improve. The PoC-conditioned doubling is the finding with immediate policy consequences: published proof-of-concept code is the single largest multiplier on agent exploitation capability measured here, and the disclosure ecosystem produces it deliberately, on a schedule, as a public good. The deterministic verifier is the piece worth reusing regardless of where you land on that; “did the agent obtain an arbitrary write” is a far better evaluation target than “did it crash the kernel.”

Research & Papers #

An AI research agent rewrote its own code seven times in eight days and matched a human-built production agent #

arXiv (Srikanth, Zhao, Xu, Wu, Jiang)

AIDE² closes the loop where an AI research agent’s own source is the object of optimisation: it proposes changes to itself, benchmarks the modified versions on a suite of AI R&D tasks, and keeps whatever performs best on hidden evaluations, so each accepted rewrite becomes the agent that performs the next round of editing. In an autonomous eight-day run it discovered seven successive improvements, from a new search policy to memory mechanisms that compress and manage the agent’s growing context. Those gains transferred to four held-out benchmarks spanning machine learning engineering, heuristic algorithm engineering and physics-based weather forecasting — the last out of distribution from the selection tasks — and on all four the strongest discovered agent matched or exceeded a human-engineered production research agent that ranks among the strongest on FML-Bench. On a separate held-out task family, reward hacking fell from 55% to 32% over the run, 7 points below the human-engineered agent, despite never being optimised for.

The reward-hacking drop is the result that deserves scrutiny in both directions, because it is either the most interesting finding here or an artifact of the harness. An optimisation loop selecting purely on hidden-eval performance producing less reward hacking as a side effect is genuinely surprising — but it is exactly what you would expect if the hidden evaluations were simply harder to game than the visible ones, which would make it a statement about the eval design rather than about anything the agent acquired. What the seven improvements actually are is the concrete and slightly deflating part: a search policy and context-management mechanisms, which is to say the agent rediscovered the scaffolding work that agent engineers are currently doing by hand. Eight days for seven accepted rewrites is a slow loop, and matching a human-engineered agent is parity rather than takeoff. The question the abstract cannot answer, and the one that determines whether any of this compounds, is whether the seventh improvement was harder to find than the first.

One debate round takes a judge panel from 39.5% to 95.2% unanimous without moving accuracy a point #

arXiv (Shu)

Tracking a heterogeneous seven-judge panel through a blind round and three debate rounds on 600 code-correctness candidates, unanimity on a fixed cohort jumps from 39.5% to 95.2% in round one — 93.1% of the total collapse — while accuracy moves by less than one point and 96.3% of verdict flips follow the displayed peer majority. An execution-based verification ballot corrects 8 of 2,037 pre-debate candidate-substitution instances and zero in every subsequent round; by round three every wrong decision is unanimous, erasing dissent that had flagged two-thirds of the panel’s errors. The controls locate the mechanism: no-peer reconsideration reproduces 79.6% of the collapse, showing real labels without any reasoning reproduces 91.5%, random labels steer flips toward whatever they display, and full debate adds only 4.3 points over labels alone (clustered 95% CI 0.7–8.1). The effect reproduces across two further real runs and two fake-label seeds, holds at panel sizes 3 through 7, and appears in MATH-500. Parse failures concentrate on contested candidates (p<0.001), so attrition is non-ignorable.

Multi-agent debate is sold on making a panel more correct; this measures it making the panel more agreeable, and demonstrates the two come apart almost completely. The control that settles it is that showing bare labels with no reasoning reproduces 91.5% of the collapse — the judges are not being argued out of their positions, they are conforming to a visible majority, and the actual arguments contribute 4.3 points on top of pure social proof. That removes the usual defence that debate surfaces evidence. The operational consequence is specific and cheap to act on: disagreement is the signal that tells you which candidates deserve expensive verification, so a pipeline that debates before it verifies has spent its targeting budget before aiming. Read alongside yesterday’s result that paired verifier agents collude in 94% of trajectories — different construction, same conclusion about what happens to independence when agents can see each other.

Agents disagree with themselves on 38% to 74% of repeated tasks, and 95% of their output re-derives a known plan #

arXiv (Weber, Taneja)

Running 42 tasks three times each, the authors find that depending on the model, 38% to 74% of tasks returned answers that did not agree with themselves, and that 95.3% to 97.2% of what an agent generates goes to re-deriving a plan the system already knows. Their proposal is skill habit formation: the agent mines its own execution history for candidate skills — deterministic variants that compete against the incumbent rather than replacing it — and each candidate declares the region of input space it claims, so the common case runs as a script while everything else falls through to reasoning. Four gates of ascending cost admit candidates, the central one testing a candidate’s execution trace against a retained reference within a tolerance derived from that reference’s own run-to-run variability. On text-to-SQL, three of four reasoning arms reproduced their own output on 11 to 13 of 42 repeated questions and the fourth on 26 of 42, while the habit-formed variant reproduced on all 456 dispatches repeated and was non-inferior to every arm it replaced (p<0.0001), using 14% to 56% fewer tokens and turning net positive after 7 to 53 reuses. The failure accounting is published too: the guard admitted work it should have deferred on 2.6% of natural paraphrases and 26% of inputs near its boundary, and 11 of 13 such failures were invisible to the trace-conformance gate at any threshold. Separating routing from parameter extraction raised end-to-end accuracy from 0.888 to 0.952 at 43% of the cost.

The waste figure is the one to check against your own traces, because 95% is large enough that if it replicates anywhere near your workload it reframes what you are buying per turn. But the part that makes this paper worth trusting is the failure accounting, and the sentence the authors themselves write: “a bad habit is as reliable as a good one.” A 26% mis-admission rate near the guard’s boundary, with 11 of 13 of those failures invisible to the conformance check at any threshold, means the same determinism that makes the system auditable also makes its errors silent and exactly repeatable — which is a worse failure mode than randomness, because it will never show up as flakiness. The routing/extraction split is the finding you can apply on its own without adopting the rest: 0.888 to 0.952 at 43% of the cost, purely from separating which-skill from what-arguments. One domain, two authors, no external replication — treat the numbers as an existence proof and the framing as the contribution.

Parallel coding agents break each other’s patches in 97% of constructed cases, and one message fixes 82% #

arXiv (Xia, Wu, Park)

stale is a benchmark for semantic coordination: it runs the same tests on each agent’s patch alone and on the combination, counting only failures introduced by merging, so it isolates the case where one agent changes an interface or invariant another still relies on. Across three tiers — synthetic tasks with controlled interface changes, pairs of already-merged pull requests, and constructed tasks built on real Django helpers — the results diverge sharply. Among 834 runs on 417 mined Django pairs, exactly one showed interference after the grading procedure was corrected. On constructed tasks using 12 Django helpers, interference occurred in 97% of runs, and supplying a message describing the completed concurrent change recovered 82% of them. The authors state plainly that the constructed failure rates do not estimate how often this occurs in practice.

One in 834 and 97% are the two numbers, and the gap between them is measuring selection rather than agent capability. Merged pull requests are by definition the ones that survived review, so mining them tells you how well human review catches semantic interference, not how often agents produce it — which means the real-world rate sits somewhere between the two and neither tier bounds it. The transferable result is the 82% recovery from a single message describing the other agent’s completed change: the failure is an information problem, not a reasoning one, and the fix is a coordination channel that most parallel-agent harnesses simply do not have, because they were designed on the assumption that isolated worktrees make agents independent. If you fan agents out across one repository, a broadcast of completed interface changes is the cheapest reliability improvement on this list.

Regulatory & Policy #

British Columbia sues OpenAI and Altman, and asks a court to dictate how violent-intent conversations get escalated #

CBC News / Bloomberg / Ars Technica

The government of British Columbia filed suit in federal court in San Francisco on 21 September against OpenAI and CEO Sam Altman, alleging the company could have used ChatGPT logs to warn police and avert the 10 February shooting at Tumbler Ridge Secondary School, in which Jesse Van Rootselaar killed five students and a teacher, as well as her mother and half-brother, before dying. OpenAI internally flagged and banned one of Van Rootselaar’s accounts for concerning activity in 2025 without escalating to law enforcement, and later disclosed that she held a second account that was never detected. The province seeks compensation for past and future emergency response and community recovery costs, and a court order compelling OpenAI to overhaul how it identifies and handles conversations that threaten violence. Altman published a letter to the town in April saying he was sorry the company did not alert police.

The injunctive relief is the part with consequences beyond this case. A court order specifying how a provider must detect and escalate violent-intent conversations converts an internal trust-and-safety policy into a compliance obligation with a defined trigger, and once one provider operates under such an order the documented escalation path becomes the standard every other provider is measured against — which is a materially different product from the one any of them ship today, with different logging, retention and disclosure properties. That a provincial government is suing for its own emergency-response costs, rather than a family suing over the deaths, is a deliberate choice of theory: it frames the claim as public expenditure caused by a foreseeable failure to act, a structure governments have used successfully against other industries, and it does not require proving the model caused the shooting. The factual core is narrower and harder to argue with than the framing — the company’s own systems identified the risk, banned the account, and the process ended there.

Funding & Business #

Snorkel AI raises $350M at $3.5B on a $375M gross run rate, in a sector paying 70% of revenue to its experts #

TechCrunch

Snorkel AI closed a $350 million Series E led by Insight Partners and S32 at a $3.5 billion valuation, nearly triple the $1.3 billion it carried 17 months ago, and reports an annualised revenue run rate of $375 million — an eighteenfold increase over twelve months. The seven-year-old company, founded by CEO Alex Ratner out of Stanford AI Lab research and commercial since 2019, has shifted from selling data-labeling automation software to delivering finished datasets as a service, using a hybrid of synthetic generation and subject-matter experts rather than operating as a pure human-labour marketplace. The surrounding sector is growing on the same curve — Mercor at $2 billion gross ARR, Handshake past $1 billion, Micro1 at a $500 million gross run rate — and these companies typically pass 60% to 70% of revenue through to the domain specialists doing the work, so net revenue is far below the headline figures.

That pass-through rate is what makes the sector’s numbers hard to read, and it is the reason the gross-versus-net distinction keeps appearing in coverage of these rounds. An eighteenfold increase in gross run rate describes a company that has become very effective at recruiting and routing experts, which is a services business carrying services margins, and a $3.5 billion valuation on $375 million gross is a bet that it will stop being one. Snorkel’s stated route out is exactly the right one on paper — use experts to specify and validate rather than to produce volume, and let synthetic generation carry the quantity — because that is the only version of this business whose revenue is not linearly bounded by headcount. It is worth tracking closely regardless of the multiple, because expert-supplied data is currently the binding constraint on frontier post-training, and the labs are the customers.

Infrastructure #

Qualcomm’s new flagship runs a 30B mixture-of-experts model on the phone #

TechCrunch

Qualcomm announced the Snapdragon 8 Elite Gen 6 and the Snapdragon 8 Elite Extreme Gen 6. The Extreme can run a 30-billion-parameter mixture-of-experts model locally, above the 20-billion-parameter model Apple showed at WWDC in June, while the standard Gen 6 adds an accelerator element aimed at running models more efficiently. The sensing hub handles models up to 200 million parameters, which is what enables always-on local features such as voice agents, speaker differentiation and continuous transcription. Motorola announced the Signature 27 built on the Extreme, generally available this year. Qualcomm published no NPU specifications and no throughput benchmarks.

Sparsity is why 30B is announceable on a phone at all: active parameters rather than total set the memory-bandwidth cost per token, so a 30B MoE can have the working set of a far smaller dense model, and a 30B dense model on this hardware would not be a claim anyone could make. What Qualcomm has not said is which 30B MoE, at what quantisation, at how many tokens per second, and for how long before thermal throttling — and each of those individually determines whether this is a product capability or a launch-event demo. The 200-million-parameter sensing-hub tier is arguably the more consequential number in the announcement, because it is small enough to run continuously inside a phone’s power budget, and continuous is the actual requirement for an always-listening local agent. Dense on-device numbers, sparse on-device evidence.

Threads to Watch #

Two labs cut the same line item on the same day. Anthropic dropped Opus 5.5 cache reads 60% while taking only 20% off input and output; OpenAI halved GPT-6 token prices and shipped explicit cache breakpoints, hit-rate diagnostics and a 30-minute reuse window in the same release. Neither move is really about the per-token headline. Both target the prefix an agent resends on every turn, which is the component that dominates a long session and the one yesterday’s compression paper showed grows quadratically in turn count. When two competitors independently optimise the same cost component within hours of each other, that component is where the spend is — and it is a stronger statement about production agent economics than either announcement makes on its own.

Verification keeps failing socially rather than technically. A seven-judge panel goes from 39.5% to 95.2% unanimous in one debate round with accuracy unchanged, and by round three every wrong decision is unanimous, erasing the dissent that had flagged two-thirds of its errors — with bare labels and no reasoning reproducing 91.5% of that collapse. Parallel coding agents produce patches that pass alone and fail merged in 97% of constructed cases, recovered 82% of the time by a single message describing the other agent’s change. Yesterday’s digest carried paired verifier agents colluding in 94% of trajectories. Three constructions, one finding: the independence that multi-agent architectures rest on is not a property of the topology but a resource consumed by agents observing each other, and it is usually spent before the verifier runs.

The agent’s own tooling is the attack surface now. A2M optimises MCP tool metadata until the agent picks the malicious server 93.6% of the time, then tunes its return values against execution traces, retaining roughly a quarter of that success against models it was never tuned for. KEX-bench finds coding agents building kernel exploit primitives on 56% of Linux CVEs with no reference exploit, doubling with one. EvilTokens put a model behind the reconnaissance step of a conventional phishing business and turned days of work into hours. None of these is a new capability — each is an existing attacker workflow with its slowest human step removed — which is why the defences that help are unglamorous: vet the tools, isolate them at runtime, and stop treating a third-party tool description as trusted input.