Weekly News Roundup: CW40 - A cheaper model takes the terminal

Anthropic shipped the second model in its Claude 5.5 family on 28 September, and Sonnet 5.5 arrived with a number that reads better than it is. The launch table puts the mid-tier model at 70.6% on Terminal-Bench 4.0, an agentic coding evaluation, above the 66.4% it reports for Opus 5.5. The footnote under that row travels with the number: Opus 5.5’s score is reported at xhigh effort, which Anthropic describes as that model’s highest score, while Sonnet’s 70.6% comes from max thinking effort in Claude Code. The same page calls Opus “clearly stronger at complex, open-ended work requiring sustained judgment”, and prices Sonnet as its cheaper complement at $2 and $10 per million tokens against Opus’s $4 and $20.

Around that launch, the week’s argument was about where a guardrail sits. NVIDIA built an agent-safety platform from a sandboxed runtime and a watchdog on its BlueField-4 DPUs that it says can quarantine an agent in milliseconds, putting the enforcement point outside the model and the harness. OpenAI started scanning repositories for security findings in the cloud with reduced-refusal defensive models attached, and Cloudflare wired agentic skills into the WAF. Google handed its new frontier model to a trusted-tester group of cyber defenders rather than to everyone. And a small benchmark that began counting on 24 September asks the question the rest of the argument rests on: does a model get worse after it ships?

tl;dr

• 💻 A cheaper model takes the terminal: Sonnet 5.5 beats Opus 5.5 on one row of Anthropic’s agentic coding table, at max effort against Opus’s xhigh and half its list price, while Opus leads every other row.
• 🕰️ Does a model stay the same after launch?: a pre-registered 30-day series on Opus 5.5 through Claude Code has finished its baseline, and the first possible call on drift is around 24 October.
• 🛡️ Guardrails move below the application: NVIDIA enforces agent policy in a runtime and on a network card, OpenAI scans repositories in the cloud, and Cloudflare wires threat intelligence into WAF rules.
• 🔐 Cyber capability, offense and defense: Gemini 4 Argon goes to trusted cyber defenders first, an open catalogue gathers uncensored security models, and Hugging Face’s chief executive revisits July’s intrusion.
• 🐦 A sovereign open-weight model: Aleph Alpha’s kolibri is a 78.1B mixture-of-experts model with 3.46B parameters active per token, and its best scores come from its own harness.
• 🤖 Agents as deployed systems: OpenClaw opens a control plane for persistent agents, OpenAI ships always-on dots, and Pi reverses its own position on MCP.

A cheaper model takes the terminal

The launch page leads with two percentages and gives each a scope. Sonnet 5.5 “runs 30%+ faster, and costs up to 30% less for most work”, and the second figure is about tokens rather than price: Anthropic’s own wording is “up to 30% less per task than its predecessor”, because the model “typically needs far fewer tokens to do the same work”. The list price is unchanged from Sonnet 5 at $2 and $10 per million tokens for input and output, with cache reads at $0.20. The page is equally clear about the shape of the release: Sonnet 5.5 is “a faster, lower-cost complement to Claude Opus 5.5”, strongest at well-scoped everyday tasks, bug fixing and polished documents, and Claude Haiku 5.5 is still to come.

The week’s loudest number came from the benchmark table on that page. Sonnet 5.5 scores 70.6% on Terminal-Bench 4.0 against Sonnet 5’s 10.3% and the 66.4% listed for Opus 5.5, and a one-line reaction post read that as a model surpassing Opus without naming which model it meant. The footnote is the part that matters. Anthropic reports Opus 5.5’s result at xhigh effort, “which represents the model’s highest score”, and the system card behind the table puts Sonnet’s 70.6% at max thinking effort in Claude Code, with Opus 5.5 at 64.8% when it runs at max, a difference the card calls within noise of xhigh. The card also states the conditions: no internet egress, safeguards enabled, 1.2% of Sonnet 5.5 requests answered by a fallback model, and a standard error of 2.5 points against Opus 5.5’s 2.6. Opus 5.5 leads every other row on that page.

Addy Osmani’s guide on Anthropic’s developer site, published on 28 September, the day of the launch, is the practical half. The model id is claude-sonnet-5-5, the 1M-token context window is native, thinking is on by default, and effort defaults to high on the Claude API and medium in Claude Code. Five breaking changes go with the swap, plus a quieter one: text between tool calls now arrives in thinking blocks that are empty at the default display setting, so a UI that streams that text goes quiet between tool calls until it asks for it. The sharpest engineering note is about refusals. Sonnet 5.5 is “the first Sonnet model with cybersecurity safeguards similar to those on our most capable models”, a declined request returns HTTP 200 with stop_reason: "refusal" and one of five named categories, and server-side fallback retries the cyber and frontier_llm declines on Sonnet 5.

Claude Code’s own surface expanded twice in the same week, continuing CW38’s account of Claude’s expanding workspace, where the tool was last seen absorbing documents, slides and design into the conversation. Mods, published on 1 October, are plugins whose behaviour lives in a JavaScript or TypeScript module hooked into events that include tool calls, the submitted prompt, turns, sessions, slash commands and ui.render, the drawing of the interface itself. A mod can rewrite a prompt, hold a tool call, answer a permission request or replace part of the UI, and the guide’s three examples are Token Weather, a context-window forecast above the prompt in about 80 lines, Blast Radius, which holds risky Bash commands to show what they would change, and Replay Theater, which steps through a turn’s edits. They need Claude Code 2.1.287 or later, are on by default, and some of Claude Code’s own features are mods. The announcement states the risk plainly: mods “run with the same access to your machine as Claude Code itself”, they “aren’t sandboxed”, and they should be installed the way any code is. A module with no DOM and no Node is a writing constraint, not a security boundary, and the guide confirms the distinction its own way: Blast Radius is “a safety net, not a permission system”, and a command that reaches rm through a substitution, an alias or a script gets past it. On Team and Enterprise plans a built-in sec-default mod loads first to stop user mods overriding permission deny rules.

Documented on 1 October alongside the mods guide, plugin evals is the other half of that expansion. claude plugin eval writes cases as a prompt plus one or more graders, runs each one repeatedly, and grades with a regex over the reply, a tool check, a file check or a second model judging the output. The useful part is the ablation: run the suite with the plugin and without it and the report gives a Δ against a no-plugin baseline, which is the number that says what the plugin adds rather than what the model can do unaided. That delta never changes the exit code, while a --threshold does, which is how a CI job gates on it.

The takeaway: the model that took the top of Anthropic’s own terminal benchmark did it at its highest effort setting, on a page that still calls the larger model stronger for hard, open-ended work. That is a table with a footnote, not a changing of the guard.

Does a model stay the same after launch?

The claim that a served model quietly gets worse after it ships usually runs on argument rather than measurement. livenerf is an attempt to give it a day-zero baseline. It is a small, append-only benchmark measuring Opus 5.5 as served through Claude Code on a Max subscription rather than the raw API model, and day 1 was 24 September, about two and a half days after launch. It runs once a day for 30 days: days 1 to 10 are the baseline, then two 10-day windows, so the first possible call is around 24 October.

Almost all of the work in the repo goes into refusing to trust itself. Prompts are frozen, the CLI is pinned at 2.1.280, every day ran under the same harness hash with one logged deviation (day 5 overrode its budget guard once), the graders are pure functions, the raw logs are kept, and the statistics follow Anthropic’s own write-up on adding error bars to evals, on top of the UK AI Safety Institute’s Inspect framework. The decision rule was published before any data: a change is called only if the 99% interval excludes zero in both 10-day windows, the effect is at least three points, and the control arm does not move. Nulls and improvements get published too, and the repo is explicit that its own calibration cannot detect a same-family model swap at this sample size. The author also discloses that much of the repository was written with Claude, which is why the graders are pure functions and the protocol carries public timestamps.

The current state moved during the week. As of 3 October the series had collected 10 of 30 days with none missed, which completes the baseline and starts the first decision window at day 11. That is not a result: the baseline is a reference point that could turn out to be the worst stretch of the series.

The takeaway: the object here is the protocol, not a score. A pinned harness, a pre-registered rule and a promise to publish nulls will make the eventual result easier to read.

Guardrails move below the application

NVIDIA’s Open Agent Safety Platform, announced on 28 September, is two layers, and the pair is the story. OpenShell, the software half, is an open-source runtime that traces what an agent does and enforces policy as it works, running on NVIDIA’s Vera CPUs and now broadly available, with the release saying it can be extended to third-party compute from Arm and Intel. The boundary sits outside the model and outside the harness, which is a different place from where a system prompt lives. Sentry, the hardware half, is an out-of-band watchdog on BlueField-4 DPUs that enforces policy in silicon, independently of the host, and NVIDIA says it can quarantine an agent that leaves its boundary in milliseconds. The second post gives the practical version: an agent in a sandbox with a kill switch, declared permissions across data, tools, APIs, files and machines, all logged and enforced. The launch post counts more than 100 partner organisations; the release names HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Red Hat, Salesforce and ServiceNow among them. What the platform prevents is NVIDIA’s own claim; nothing here has been independently tested.

The Codex Security Cloud upgrade, announced at DevDay on 29 September, moves a different part of the same boundary into a vendor’s cloud. It scans entire GitHub repositories on demand or on a schedule, keeps checking new commits, investigates findings, removes duplicates and prepares fixes for a human to review, all while the laptop is closed, and it is available to Pro, Business, Enterprise and Edu users. The line to read twice is the summary: it “includes access to models offered through Daybreak Blue without a separate Daybreak application”. Daybreak is OpenAI’s trusted-access programme, and Blue is the defensive tier, meaning reduced refusals on supported mainline models, with Astra keeping its standard safeguards and no access to cyber-specialised models. Red carries those models, needs its own approval, and does not switch on automatically. The honest reading is a gate removed rather than a capability shipped: the scanner and its plan tiers predate DevDay.

Cloudflare’s Threat Signals, announced the same day, puts the same idea where policy is already enforced. Agentic skills take operator-chosen open-source reporting, an RSS feed, and turn it into intelligence: summarising reports, extracting and normalising indicators of compromise, and filing each as a threat event in a private, account-scoped dataset that can be applied directly in WAF policy. Cloudflare is also opening Cloudforce One’s Threat Events Platform to every account for free, with API and dashboard access, one RSS feed and up to 30 days of stored derived reporting; enterprise tiers add feeds, proprietary datasets, custom skills and custom WAF rules. How well any of it detects anything is Cloudflare’s own claim.

The takeaway: two of the three enforce outside the model and outside the application, NVIDIA in a runtime and a DPU, Cloudflare in the WAF rule. OpenAI’s move is different in kind: a cloud scanner whose findings still end in a human review.

Cyber capability, offense and defense

Google announced Gemini 4 Argon on 30 September as a frontier model built for coding, enterprise knowledge work and cybersecurity defence, then did something unusual with the rollout. It is going “to a set of trusted cyber defenders through our Fairwind Program”, with the company saying it will reach developers, enterprises and consumers “as soon as possible”. That is a trusted-tester release rather than general availability, and it arrives without a model card or an API model id. The commercial details are concrete: an introductory $2 and $10 per million tokens, then $4 and $20, and an output-token limit raised to 1M from 64K. The capability claims are Google’s, including that Argon finds, validates and patches vulnerabilities and is “our most resilient model yet against indirect prompt injections”.

On the other side of that trade sits a GitHub catalogue of open-weight uncensored and offensive-security-tuned models, about 27 entries from 1.5B to 753B parameters, split into security fine-tunes and general abliterated models, several of which fit under 8 GB of VRAM. The catalogue is a list of listings rather than a benchmark run: every capability figure in it is the model creator’s own and none of them has been reproduced independently. Its author is Joas A. Santos, which matters because the post that circulated it does not say so, and the discussion is where the argument about what the list means is happening.

Hugging Face’s chief executive revisited July’s intrusion a month on, and the company’s own disclosures are the record to read it against. The incident write-up establishes that the intrusion was driven end to end by an autonomous agent system, that it started in the data-processing pipeline through a malicious dataset, and that the actor escalated to node-level access and harvested cloud and cluster credentials over a weekend. Two details from that account travel well. Hugging Face detected the compromise largely with AI-assisted anomaly triage over its own telemetry. And when its responders needed to work, the hosted models’ guardrails blocked their queries, because they cannot tell an incident responder from an attacker, so the forensics ran on the open-weight GLM-5.2 on Hugging Face’s own infrastructure, which also kept attacker data inside the building. The counterfactual in the thread, that OpenAI would have caught the attackers first had it been running this on its own agents, is the poster’s own and arrives caveated: “take with a grain of salt, we need much more transparency”.

A sovereign open-weight model

Aleph Alpha’s kolibri landed on 3 October, published on German Reunification Day, and the announcement is specific about what it is. Kolibri is an English-German mixture-of-experts transformer with 78.1B total parameters and 3.46B active per token, about four percent of the model at a time, across 50 layers that are all mixture-of-experts with one shared expert and 384 experts of which six are routed. The post rounds that to 3B active out of 78B. Weights are on Hugging Face under Apache 2.0, the model was trained to a 262,144-token length while the post advertises support for context up to 1M tokens, and the knowledge cutoff is June 2026.

The tag on the post that circulated it says “dense”, and it is not: this is a mixture-of-experts model, and the distinction is the point of the architecture rather than a label. That post also frames the comparison as a dense model doing eight times the work having to win, which is the poster’s reading rather than the vendor’s. Aleph Alpha’s own table is the one to quote, and it carries its own warning: “Benchmarks were run using our own harnesses”. Aleph Alpha’s own harness puts kolibri at 96.9% on AIME 2025 in English, above the mixture-of-experts models in the same table, with Nemotron 3 Super 120B at 91.7, Qwen3.6 35B-A3B at 84.6 and Mistral Small 4 at 79.8, and below one dense model, Qwen3.8 27B at 97.9. The vendor’s framing is narrower than the poster’s: kolibri “matches models with up to four times its active parameter count”. The pitch is cost and sovereignty rather than the frontier, which is the pitch a European lab selling to enterprises and governments has to make.

Agents as deployed systems

OpenClaw Enterprise arrived on 29 September as an open-source, vendor-neutral control plane for persistent agents in sensitive environments, and the phrase to notice is control plane. It adds multi-tenancy, hard boundaries between trusted and untrusted workloads, sandboxing, fine-grained permissions and lifecycle auditing, while keeping the harness, the model and the sandbox swappable, which makes it a layer above a product rather than one. The project started at OpenAI, was donated to the OpenClaw Foundation, and has since been developed with Red Hat and NVIDIA; OpenClaw says it is being piloted internally at both, and that OpenAI already runs OpenClaw agents with access to codebases and plugins. It self-hosts today with docker-compose locally or Kubernetes internally, the current release targets internal pilot workloads ahead of a 1.0 later this year, and it “will always be free for any organization to use”. Free is the licence: an organisation still supplies the infrastructure and the model access.

OpenAI’s dots, announced the same day at DevDay, are the consumer-facing version of that persistence. A dot is an always-on agent powered by GPT-6 Astra with its own cloud computer and browser, learning from feedback and working toward goals around the clock, reaching over 4,000 apps through plugins and living in ChatGPT, Slack and Teams. The rollout is Pro and Business Premium in eligible markets, with Enterprise, Edu and Healthcare workspaces able to try the beta when an admin enables it, off by default, plus a preview of specialist dots with their own identities. Read the boundary carefully, because it narrows the pitch: a dot’s computer is separate from yours unless you connect it, and in background mode its proactive research uses tools restricted to read-only, so it cannot send messages, change app content or drive the browser or computer. “Built to handle everything” is the vendor’s line.

Pi’s reversal the same day is the one that is an argument rather than a product. Pi used to carry a proud declaration on pi.dev that it did not support the Model Context Protocol, and now MCP is in the core. The maintainer’s explanation is that MCP changed, that the changes it required in a harness were generally useful in their own right, and that the same work enables Codemode and makes Jev easier to use inside Pi, since what both need is a sandbox in the form of an interpreter. The piece is careful about what has not improved: composition is still MCP’s weak point, and the maintainer now lays that at the door of the MCP servers rather than the protocol. The changelog shows codemode and MCP arriving as built-in extensions in 0.99.0, with 1.0.0, whose release notes are dated 1 October, tightening codemode, hardening MCP’s OAuth handling and fixing deferred tools that were being dropped on resume.

Elsewhere this week

Leaving the main thread. These are the week’s shorter stories, each worth its own line.

The Modern Warfare 2 decompilation reached 99.23% decompiled and 73.98% of the binary reproduced byte for byte, and the interesting part is not the game. The maintainer’s page reports that progress, and his post puts 17 agents in parallel on it with the game fully playable. His write-ups describe what that took: agents coordinating over Discord and GitHub issues, Ghidra and IDA driven over MCP, an overseer agent reviewing every commit, and his own finding that the reviewer’s model mattered more than the worker’s.

The Opus 5.5 video gallery collects 475 clips made with the model, each beside a live remake and the creator’s prompt, across motion graphics, explainers, 3D and games. It is a third-party aggregator rather than a primary source, so what is verified is the gallery; the workflow its creators keep describing is HyperFrames plus Opus 5.5.

Two lists of open-source tools that give an agent reach circulated this week. Agent-Reach is a capability router: each platform gets a preferred backend and fallbacks, Jina Reader for pages, yt-dlp for YouTube and the GitHub CLI among them, with a doctor command that reports which route is live. Its README is honest about the shrinking free surface: Reddit, X, Instagram and Xiaohongshu now need a logged-in session, so “zero API fees” is its framing rather than a promise. The other list names fifteen research tools; the three to start with are GPT Researcher, STORM and Perplexica.

The Marmont cipher is a better story than the coverage of it, and the author’s write-up and solution package sit on that page. The headlines called it Napoleon’s letter after a 217-year silence; the write-up dates the message to March 1809 and places it from Eugène de Beauharnais’s headquarters to Marshal Marmont, which makes it a general’s briefing rather than an emperor’s note. It was also not the autonomous one-shot the framing suggested: the workflow started from a previously published partial key covering 33 of the 155 signs, plus French n-gram statistics and historical correspondence, and five signs remain uncertain. The advance is the chain that turned one image into a transcription and then a reading, and Cryptiana’s Satoshi Tomokiyo reviewed the solution before the ledger marked it solved.

draw.io’s MCP server is the smallest integration of the week and a useful one. A hosted endpoint at mcp.draw.io renders a diagram as an interactive frame inside any MCP Apps host with no install, a local stdio server covers older clients, and the repo documents a Docker image and a Cloudflare Workers deployment. Shape search covers more than 10,000 shapes across the AWS, Azure, GCP, Kubernetes, UML and BPMN libraries.

Matt Pocock’s three skill authors, @poteto, @dexhorthy and @emilkowalski, are the shortest reading list of the week: a community recommendation whose only artefacts are the three accounts’ own repositories.

Mac Performance Monitor logs CPU, memory, GPU, network, disk and battery from the macOS menu bar, keeps the history so you can return to the moment a spike began, and shows the processes behind a reading. Its own description says free, open source, no telemetry, that samples stay on the machine, and that the published builds are Developer ID signed and notarized by Apple. It needs Apple silicon on macOS 15 or later and installs from a Homebrew cask.

And 50 legendary internet rabbit holes is a list that earns its name. Three of them were checked and all resolve: zoom.earth for live satellite imagery, flightradar24.com for live flight tracking, and marinetraffic.com for ships at sea. The rest is longer than could be verified here, and it names Windy, the submarine cable map and Stellarium Web among others.

Closing

If there was one theme this week, it was that capability and control are being separated on purpose. Anthropic’s benchmark table needed a footnote to say which model ran at which setting; NVIDIA and Cloudflare moved the enforcement point out of the application, into a runtime and into the WAF rule, while OpenAI put a cloud scanner to work on findings rather than on a boundary; and one public measurement is testing whether a served model changes after launch, with its decision rule written down before the data. The most quotable numbers of the week are still the ones vendors published about themselves, and the most durable work was the part that said what would count as evidence.

That’s the week. See you in CW41.