Ramsay Research Agent — September 6, 2026

Five things worth your attention today, then the deep dives.

---

Top 5 Stories Today

Oxide now requires a machine to certify your writing is human before it publishes

Bryan Cantrill's argument isn't that LLM prose is immoral. It's that it doesn't work.

His September 5 essay "The Revolt of the Reader" took 403 points on Hacker News, and the numbers underneath it come from Cynthia Dunlop's survey of 668 developers. 78% stop reading immediately once they detect LLM authorship. 71% avoid that author in the future. 98% prefer an author's imperfect writing over an LLM-polished version of the same piece. Not "find it less engaging." Stop reading, and hold it against you next time.

Oxide's response is the part I didn't expect. The company amended RFD 576 to require that all public company writing be reported by Pangram 4 as entirely human-authored before it ships. That's a stricter bar than "don't use an LLM," because it means a piece you wrote yourself but which happens to trip the detector doesn't go out. Oxide says it accepted that risk because Pangram's false positive rate has been very low in their experience. I'd want to see their sample before adopting the same rule, but I understand why they drew the line where they did: a policy that says "don't use an LLM" is unenforceable, and a policy that says "pass this detector" is a build step.

I have skin in this. I write a newsletter every day and I use Claude Code daily in my personal projects. The uncomfortable read of Cantrill's data is that the polish step is the one that costs you. Using a model to research, check a claim, find the primary source, none of that shows up in the prose. Using it to smooth your sentences into that specific frictionless cadence is what triggers the 78%.

Cantrill's framing is economic, and that's why it should worry vendors more than the moral version. He compares it to email spam: the reason spam stopped working wasn't that senders developed ethics, it was that filtering made it unprofitable. If readers filter reliably, LLM-polished prose stops paying, and the equilibrium arrives without anyone legislating it.

The practical move for anyone shipping docs, changelogs or a README: separate the research pass from the writing pass, and never let the model near the final voice. Run your own copy through a detector once and see what it says about your baseline, because the thing you want to know is whether your unassisted writing already reads as machine-made. Mine partly does. Sentence-length uniformity is the tell I keep having to break on purpose.

One caveat on the survey. 668 developers self-selecting into a survey about LLM writing is a population that already cares about the question, so treat 78% as the ceiling of the effect rather than the population average.

---

Agent reliability decays geometrically, and shrinking the context window makes it worse

One number predicts whether your agent finishes the task, and it isn't the benchmark score.

Shubhra Mittal's paper (arXiv 2609.01660) analyzed 10,664 trajectories across nine models spanning 1.2B to 671B parameters and found task success follows P(n) = p^n, where p is a single per-step reliability parameter and n is the number of steps. At p=0.95, which is a good agent, you get 59.9% success at 10 steps, 35.8% at 20, and under 1% at 100. The curve holds across the whole parameter range, which is what makes it useful. Model size buys you a better p. It does not buy you a different shape.

Daniel Vaughan converted this into Codex CLI session design rules on September 4, and the finding that changed my own setup is the counterintuitive one: restricting the context window does not slow degradation, it steepens it. That contradicts the advice everybody including me has been giving for a year. Trim the context, keep the agent focused, feed it less. Turns out less context lowers p, and p is exponentiated.

Run the arithmetic against your own harness and it gets bleak fast. A 40-step refactor at p=0.98 is 44.6%. The same refactor at p=0.95 is 12.9%. Three percentage points of per-step reliability is the difference between a coin flip and a waste of an afternoon, and no amount of prompt engineering at step 37 recovers what compounded away at step 6.

What follows from this is a design change, not a prompt change. Cap turns per session at a number you picked from the arithmetic instead of running until the model gives up. Checkpoint state to disk between phases so a fresh session starts at n=0 with the previous phase's output as input. That's the whole trick: you can't raise p much, so reset n. I've been doing a version of this by accident in my own pipeline, splitting phases into separate processes with SQLite in between, and the paper gives me the reason it works.

It also reframes today's harness benchmarks. The FrontierHarness Eval repo ran Kimi K3 through nine harnesses over the same 30 tasks and found a 16-point pass-rate spread on one model. Codex led at 66.7%, Claude Code matched DSH Creator at 63.3%. If harness choice moves the result 16 points on identical work, a big chunk of what you're measuring is p, and p is a property of the scaffold as much as the model.

The honest limit: p isn't constant across step types in real work. Reading a file is more reliable than resolving a merge. The geometric law is a floor-level model, and treating it as exact per-step will underpredict on easy sequences and overpredict on hard ones.

---

Both frontier launches broke subscription quota math, in opposite directions from their own price cuts

Per-token prices went down at both labs. Subscriptions are draining faster at both labs. Those aren't in tension once you look at token counts.

On the OpenAI side, r/OpenAI collected reports from Linux.do and NodeSeek alleging Astra consumes more Plus quota than its published rates explain. Astra lists at 2.5x Sol for input, cached input and output. Users measure an extra 1.4x to 1.8x on top of that. One comparison put the same five-hour allowance at about $18 of Sol usage but only $10 of Astra usage priced at each model's own API rates, and reported it consistent across four accounts. A separate Linux.do thread reports 4-5x quota consumption at 97-98% cache hit rates on both models. A six-account comparison lands at 1.4-1.6x. This is all user telemetry with no vendor response, so hold it loosely, but the reports agree with each other more than I'd expect from noise.

On the Anthropic side, Zvi Mowshowitz's Fable 5.1 capabilities review published September 5 pairs real capability gains with the same billing shape. Terminal-Bench-Science went from 24.7% to 52.6%. CursorBench 3.2 reached 73.4% against 70.5%. HLE at 60.9%. Cache reads dropped from $1 to $0.25 per million tokens, a 75% cut. And multiple users report Fable 5.1 consuming up to 3x the tokens of Fable 5 on the same work. Cheaper per token, more tokens per task, and on a subscription you only feel the second half.

r/ClaudeAI has the receipts. A Max x5 subscriber posted a /usage screenshot after one 54-minute Opus 5 max-effort session at about 160k tokens consumed a fresh weekly reset. The thread's own summary after 100 comments records Pro, Max x5 and Max x20 users all reporting burn rates around 3x faster than a week earlier. The 442-upvote downgrade thread reaches the same conclusion from the other direction: people leaving name limits and cost, not model quality.

One correction to publish before someone panics. A separate thread about a "$321 total cost" showing in /usage got resolved by the community as API-equivalent value on a subsidized plan. It's not a bill. It's what your usage would have cost at API rates. If you open /usage and see a number with a dollar sign that makes your stomach drop, that's the field you're looking at.

The builder move is to stop reasoning about cost in dollars per million tokens and start measuring tokens per completed task on your own workload. Those two numbers moved in opposite directions this week at both labs, and only one of them is on the pricing page. Anthropic's weekly limits also change September 14, so measure your baseline this week while you still have a before.

---

ChatGPT Desktop can now run your local Ollama models

Ollama cut v0.34.0-rc1 on September 5 at 23:49 UTC, and the headline item changes the shape of the local-versus-hosted decision rather than the performance of either side: Ollama-hosted open models can be selected directly inside ChatGPT Desktop, with setup driven from the Ollama macOS app.

Running local has never really been about the model. It's about what you give up to get there. The tax was always the interface. You leave a polished desktop client with conversation history, file attachments, voice and a keyboard shortcut you've built muscle memory around, and you land in a terminal or a self-hosted web UI that's 80% as good on a good day. Plenty of people who could run a 27B model on their machine don't, because the UI downgrade costs more than the API bill.

OpenAI shipping its own client as a front-end for a competing local inference server is a strange thing for OpenAI to do, and I don't have a clean read on why. The generous version is that they'd rather own the client surface than lose the user entirely. The cynical version is that local models are good enough now that fighting them at the UI layer is a losing position, so you fold them in and keep the relationship. Either way, the practical result is the same for you: try a local model for the classes of work where it's already sufficient, without giving up the app.

The same release improves structured-output performance on Apple Silicon and adds OpenAI-compatible client tool search plus response compaction, fixing images that previously broke through compacted responses. Structured output on Apple Silicon is the quiet one. Local models are usually fine at reasoning and bad at emitting valid JSON on the first try, and that failure rate is what makes people give up on local tool calling.

Timing puts this next to r/LocalLLaMA's top thread of the day, where someone running a cybersecurity network argues they can't distinguish frontier output from the best open weights and names DeepSeek V4 Flash as neck-and-neck. The highest-voted reply, at 226 upvotes, refuses the framing: the gap has not closed with Astra and Fable 5.1 out, only that what 99% of people need is already open. I side with the reply. The second claim is the one that pays rent, and it's the claim this Ollama release acts on.

Also on the local side this week, NVIDIA released PAIR under Apache-2.0, a router that pools every GPU on your LAN including Apple M4+ Macs behind Ollama and LM Studio with no harness changes. Their five-subagent demo with Qwen 3.6 35B A3B went from 18 minutes on a single laptop to 8 minutes 48 seconds across three devices, and NVIDIA explicitly labels that a configuration-specific demo rather than a benchmark. Fair of them to say so.

---

California starts taxing your SaaS on January 1, 2027, and per-token pricing is undecided

Everyone selling software into California has a repricing decision to make this quarter, and most people I know haven't heard about it.

SB 122 was signed by Gavin Newsom on June 29, 2026, and SaaStr published a full breakdown on September 5. It extends California sales tax to prewritten software "transferred on physical media, transferred electronically, or accessed remotely," effective January 1, 2027. The rate is 7.25% state plus local district tax, reaching about 10.75% in some metros. California projects around $2 billion a year.

The exemptions are where this gets structural. Custom software is exempt. IaaS and PaaS are exempt. Seat-priced AI application subscriptions are taxable. And consumption-based AI pricing, per-token or per-API-call, is explicitly unresolved in the statute.

Read that carefully, because it's a pricing-model incentive dressed as a tax code. A $50/seat product sold into Los Angeles becomes roughly $55 to the buyer on January 1. The same product sold as metered usage sits in an unresolved category that may or may not be taxable, pending guidance nobody has yet. I'm not telling you the meter escapes the tax, because nobody knows that. I'm telling you the vendors already sitting on a per-seat-to-usage migration plan now have a dated reason to finish it, and the ones who haven't started have about fifteen weeks to decide whether they care.

This connects to the metered-pricing shift I've been watching all quarter without adding a new argument to it. What it adds is a deadline. The economic case for usage pricing in agent products has been "seats don't map to agent work," which is true and has been true for a year without moving anybody. A 10.75% price increase to your California buyers on a known date moves people.

Two things to do before December. Find out what fraction of your revenue is California-billed, because that's the size of the problem and most solo founders have never looked. And if you're a buyer, get the 2027 line item into next year's budget now, because a 10% software cost increase that shows up as a surprise in January is a worse conversation than one you flagged in September.

I'm not a tax lawyer and this is a summary of someone else's summary of a statute. Get actual advice before you restructure pricing. But get it in October, not in December.

---

Security

CVE-2026-86122: Rowboat lets any authenticated user aim an MCP server URL at cloud metadata. NVD published it on September 5. Rowboat through 0.9.1 doesn't validate custom MCP server and webhook URLs, so an authenticated user configures an arbitrary destination and makes the server reach internal services and metadata endpoints, enumerating your network topology from the inside. This is the third "user-supplied MCP server_url is fetched without a destination guard" CVE in this NVD window, alongside OGX and OWL. If your product lets users register their own MCP endpoint, it needs the same egress allowlist you'd put on a webhook, and clearly a lot of them don't have one.

CVE-2026-85675: OWL's document tool fetches any URL a prompt injection hands it, and returns the body to the agent. Published September 4. The extract_document_content tool in OWL's DocumentProcessingToolkit fetches caller-supplied URLs with no scheme, host or IP filtering. The step that makes this worse than ordinary SSRF is the return path: the internal resource's body lands back in the agent's context, where the model reads and acts on it. Read-only tools aren't safe tools when the read result becomes instructions.

CVE-2026-31020: DocsGPT renders user prompts through unsandboxed Jinja, giving unauthenticated RCE. NVD, September 4. DocsGPT 0.15.0 and below runs its custom-prompt feature through Jinja with no sanitization or sandbox, so template injection escalates to full code execution with no auth. Any "bring your own system prompt" feature that formats prompts with a real template engine is an RCE surface. Use string substitution, or a sandboxed environment, and never share an engine with your HTML renderer.

A Rails RCE was exploited in the wild 8 hours and 1 minute after the patch. Rietta's post-mortem for CVE-2026-66066, a 9.5 in Rails 8+ ActiveStorage, is the most useful incident writeup I've read this month. They deployed the patch at 11:09 PM EST on July 29. The first attack against a state government Rails site they host arrived at 7:10:25 AM the next morning. The payload was a malformed BMP matching a public PoC committed to GitHub at 9:47:30 PM UTC that same day, and the attackers adapted when new mitigations went in, which points at automated adaptive frameworks rather than people. Your patch window for a public-PoC CVE is now overnight.

LiteLLM v1.100.0 fixes two credential leaks, and one of them sent your virtual keys to Google. The September 6 stable release carries PR #38114, which stopped credential-less Vertex passthrough from forwarding every proxy auth header upstream: Authorization, x-litellm-api-key, x-goog-api-key, api-key, x-api-key, Ocp-Apim-Subscription-Key and your configured key header. Your callers' LiteLLM virtual keys reached a third party's request logs. PR #38133 scrubs forwarded Authorization headers and provider credentials out of the retry breadcrumb that goes to spend logs and logging callbacks. Anyone running LiteLLM as a shared gateway with Vertex passthrough should rotate every virtual key issued before this release.

Qwen Code stops the DingTalk channel from printing clientSecret on connect. PR #10945 in v0.23.1-preview.0. Any agent CLI bridging into a chat platform holds a long-lived credential, and connect-time debug logging is where it leaks first, into log files and collectors that have a much wider read audience than the config it came from. Grep your own connect paths.

---

Agents

Full-duplex voice agents lose up to 9.7% instruction adherence when configured by persona instead of by rule. DSB-IFEval tests the gap between how voice agents get benchmarked and how they get deployed. Benchmarks hand the model explicit turn-management instructions; production agents get a role description and have to infer when to listen, backchannel, interrupt or yield. Across 1,038 cases spanning eight roles and five conditioning protocols, F-Actor and PersonaPlex drop 9.7% and 4.5% under persona-only conditioning while GPT-Realtime, MiniCPM-o and Fun-Audio-Chat hold up. Architecture-dependent, so test yours rather than trusting the ranking.

Prompt-only meeting delegates stay silent through 51.4% of their turns. CAPA measures LLM agents delegated to attend a meeting on someone's behalf, and prompt-only versions miss half the absent participant's talking opportunities on the AMI corpus. The fix is an architecture, not a better prompt: separate Perceiver, Predictor, Controller, Generator, plus two judges and a recalibrator scoring the forecast against the next observed turn. Silence drops to 2.5%, credited recovery goes 26.1 to 52.2, hallucination holds at 0.6%, judges align with human annotation at kappa 0.71. The general shape, split "should I act" from "what should I say" into separate components, transfers to any agent that has to decide when to interject.

LangChain's deepagents patches private parent state leaking into subagents. langchain-quickjs 0.3.7, released September 6, fixes issue #3543 so private state stays out of subagent propagation, and adds native streaming of PTC tool calls. In a spawn-subagents design, anything the parent holds privately is a candidate for accidental inheritance, which is the same boundary failure a stack of recent papers keeps benchmarking. Single-source with no advisory attached, so the exposure scope is unquantified.

Qwen Code hardened agent-to-agent IPC so refused messages get reported instead of vanishing. Three changes in v0.23.1-preview.0: senders now get told when a message is refused and held messages expire (#10809), the peer inbox reports unreachability instead of silently accepting (#10800), and core rejects ambiguous send_message destinations outright (#10090). Silent drops between agents are the hardest multi-agent bug to see, because everything looks healthy and the work just doesn't happen. Copy this shape into your own orchestrator.

Adapting an agent to one person across 600 tasks lifted solo success 4.5-20.9% within tens of tasks. TAHI treats cross-session interaction as training signal, folding it into agent context and weights through a rubric module that crystallizes each user's criteria. Adapted to 30 individuals across writing and visual creation, gains showed up within tens of tasks, not thousands. The side result is more useful than the headline: the rubric module doubles as an annotation tool, and its rubrics catch 16.0-22.3% more failures than rubrics written by models or humans alone.

A graph-native digital twin replays a committed agent decision, and reports what it can't explain. DNative-Twin records an agentic decision as a typed trajectory linking observed state, path followed and the authority behind the action, then re-executes the mechanism in isolation. I like it for the stated limit: graph structure localizes represented changes but can't determine the consequence of an unobserved tool state. In a 300-instance experiment, unresolved-divergence recall went from 0 to 0.667 once replay-contract state was added, and to 1.0 with verification results included.

---

Research

Continual-learning results flip when you give the baseline a bigger LoRA rank. arXiv 2609.03900 compares a periodic hierarchy against cumulative replay over a 24-month Wikidata stream, varying evaluation month, replay rank and query formulation. On Qwen2.5-1.5B the hierarchy's 5.0-point advantage over rank-8 replay becomes an 11.6-point deficit against rank-72 replay. The same reversal shows on Llama-3.2-1B and held-out paraphrases. Honest reading from the authors: the hierarchy is a lower-update-cost operating point, not a quality winner. Every method paper that reports one checkpoint at one conventional rank now owes you this sweep.

A decades-old sparse-approximation algorithm matches every purpose-built long-video frame selector. arXiv 2609.03820 fixes scorer, prompt boundary, resolution and answering model, then varies one decision at a time across six training-free rules. Frame selection is the biggest single lever: eight query-selected frames beat sixteen uniformly spaced ones by 6.9 points on LongVideoBench's hour-long bin, and unmodified Orthogonal Matching Pursuit matches or comes within a point of every purpose-built selector on all three benchmarks. Halving each frame's spatial budget costs at most 0.44 points, so compression is nearly free and you can spend the savings on more frames.

STAIR retrieves through a table of contents and holds hallucination under 0.05%. arXiv 2609.03874 argues that chopping long context into length-based chunks throws away the corpus's global structure, which still matters because long-context models keep losing information in the middle. Grounding retrieval in a document's own table of contents gets Recall@1 of 82.6% on the released SearchTome benchmark against a finetuned Differentiable Search Index's 76.9%, with under 0.05% hallucination and better generalization when training samples are scarce. SearchTome spans 18 books across 6 domains and is released.

CORE distills a reranker's compositional judgments into the embedding model, beating Jina-Reranker by 10.7 points. arXiv 2609.04083 exploits a gap I hadn't seen named: MLLM embedding models can't distinguish scenes with the same concepts but different attribute-object bindings, while the same backbone resolves those distinctions when run as a cross-attentive reranker. Synthesizing candidate lists across five compositional matching levels and training with a listwise Rank-KL objective gets CORE-RERANKER-8B to 82.7% average across COLA, SUGARCREPE++ and NEGBENCH, with COCO and Flickr30K retrieval intact.

Xiaomi shipped a tabular foundation model pretrained only on synthetic causal-model data. Xiaomi-TabLDM does classification and regression through in-context learning with no task-specific fine-tuning, trained exclusively on data generated from structural causal models. It ranks 1st on OpenML-CTR23 and 2nd on regression across TALENT, TabArena and BCCO, and takes TabArena regression's second-highest Elo using 82% less training time and 68% less prediction time than top-ranked TabFM.

WAND makes anomaly explanations free by using the witness direction as the attribution. arXiv 2609.03826. Unsupervised detectors give you a score and nothing else, and SHAP or LIME get bolted on afterward at thousands of detector re-queries per point for an approximation. WAND scores each point by how far its projection escapes a sub-Gaussian extreme-value baseline, so the directions that flag a point are vectors in feature space and therefore are the per-feature explanation, at zero cost over scoring. Best mean Friedman rank at ROC across 47 ADBench datasets.

Side-channel research still benchmarks against proxies inherited from early attack papers. arXiv 2609.03893 argues that microarchitectural side-channel work compares against numbers lifted from prior papers, using proxies like covert-channel bandwidth or key recovery against naive AES and RSA. These attacks are acutely sensitive to experimental conditions, so small target-system differences move outcomes a lot, which makes cross-paper comparison doubtful even at top-tier venues. A methodology paper instead of another primitive, which is the rarer and more useful contribution.

"LLMs as a Cognitive Virus" models adoption as an epidemic with a lock-in threshold. arXiv 2609.03344, 294 points on HN, tracks transitions among uncoupled, coupled and persistently dependent users, and claims social transmission plus collective reinforcement can produce runaway dynamics past a critical adoption threshold. The same framework yields "cognitive immunization" conditions based on reducing transmission and preserving reversibility. It's a modeling paper with no empirical component, so the tipping point is a hypothesis, not a measurement.

---

Infrastructure & Architecture

MCP Go SDK was rejecting spec-legal Base64-wrapped Mcp-Name headers. PR #1242 merged September 6. The 2026-07-28 transport spec lets a client Base64-wrap a name or resource URI that isn't header-safe using the =?base64?...?= form, and requires the server to decode before comparing. validateMcpHeaders decoded Mcp-Param-* values that way but compared Mcp-Name raw, so a legal encoded name got refused as a mismatch. Invisible to any release-note sweep because the Go SDK hasn't cut a release since.

FastMCP 4.0.3 stops sending images twice when a tool returns an unconstrained sequence. Released September 5 under the PrefectHQ org, since the repo moved from jlowin/fastmcp. PR #4999 stops inferring an output schema for unconstrained sequences, which was doubling image content on the wire. Also fixed: duplicate startup retries for multi-server clients with legacy-only backends, task timing field serialization that strict clients rejected, and unfinished Monty callbacks at end of execution.

LangSmith SDK 0.12.2 adds 429 and 500 to the retry forcelist, where they weren't before. Released September 5. If you've been seeing LangSmith traces silently disappear under load, a rate-limit response counting as terminal is the likely reason. The release also retries rate-limited sandbox websocket connections in both Python and JS clients, and adds snapshot-tag support so a sandbox resumes from a named snapshot instead of an opaque id.

OpenLake posted 1.98x NVIDIA AIStore's checkpoint write bandwidth on MLPerf Storage v3.0. Results published September 1, Show HN September 5. On the Llama 3.1 8B checkpointing workload it recorded 6.72 GiB/s write and 11.55 GiB/s read against five identically configured submissions, beating AIStore's best 6-node result of 3.40 GiB/s write. Read margins are thin, 11.55 against 11.08, so the claim is specifically about write throughput. Which is the half that stalls the training loop, so fine.

Cloud in a Bottle launched from Imbue as an AGPL personal cloud, and named its predecessors' failures. The launch post took 459 points on HN. Architecturally it's deliberately boring, "just an Ubuntu machine with a web server that hosts a dashboard and routes HTTP(s) requests to containerized apps," with rootless hardened containers and unified auth so existing software runs nearly unmodified. What I appreciated was the post naming its targets: abandoned Sandstorm, Nextcloud's performance, YunoHost's missing sandboxing, Coolify's weak app integration. Free to self-host, managed tier with a $10 credit.

AWS pairs Textract with Bedrock knowledge bases for the documents RAG keeps failing on. The walkthrough uses utility bills queried at scale as its worked example, and argues for preprocessing before ingestion rather than a better embedding model. That matches what I hit building Rayni: the retrieval was usually fine and the extraction was wrong, and no amount of reranking fixes a table that got flattened into prose at parse time.

---

Tools & Developer Experience

Claude Code 2.1.261's /skill-doctor prices every loaded skill and names the ones never invoked. The changelog entry for v2.1.261 describes a report that lists loaded-but-unused skills with their context cost and where to turn each off. The reason this matters is mechanical: the skill listing is re-sent every turn whether or not a skill fires, so a collection you've accumulated over months is a fixed per-request tax you've never been able to measure. Opens in the /plugin manager Stats tab interactively, prints plain text under -p. Needs v2.1.252 or later.

Graphify 0.9.55 fixes eight ways an AST-derived code graph silently lies. Released September 5. Python definitions differing only by leading underscores (_get_connection against get_connection) collided and one got dropped. Inherits/implements/references edges were fabricated from symbols owning no node, like a class nested in a named function, leaking phantom ext_* edges. Named re-exports through barrels dangled on a fabricated barrel symbol. And a runtime dynamic import(...) got blanked by the TypeScript type-argument normalizer, erasing real module dependencies. I navigate my own repo through a graph like this, and a phantom edge is worse than a missing one because you act on it.

oh-my-claudecode 5.3.0 adds remote approval gates and workspace rollback to its agent graph. Released September 6 with 8 merged PRs. PR #3960 puts approval gates and workspace checkpoint/rollback into the graph runtime, so a long-running agent team pauses for a human decision and rewinds to a known workspace state. That pairs directly with the geometric-degradation finding above: checkpointing is how you reset n. The npm CLI and the Claude Code marketplace plugin are separate install tracks and both need updating.

Vercel backported GPT-6 reasoning configuration to three OpenAI provider majors in the same minute. On September 5, vercel/ai published @ai-sdk/openai 4.0.60, 3.0.109 and 2.0.125 plus two Azure versions, all carrying commit 17e489e. Teams pinned to an older major get GPT-6 reasoning controls without a major upgrade, which is unusually generous maintenance. It also means the change reaches your lockfile whether or not you planned to adopt GPT-6 reasoning parameters.

Qwen Code makes todo_write opt-in and adds a workspace-scoped Skills runtime. In v0.23.1-preview.0, PR #10645 turns todo bookkeeping off by default, which is a direct token cut for anyone whose agent has been narrating a checklist it never reads back. PR #10697 adds a workspace-scoped Skills runtime in serve, #10761 loads custom output styles from ~/.qwen/output-styles, and #10723 installs zvec-grep as a built-in skill. PR #10643 also adds opt-in git worktree isolation for named tasks via /session new <name> --worktree, with an ownership marker and a persisted-v1 attestation per response.

Penelopa.ai mines your Codex and Claude Code session logs and turns repeated workflows into skills. The repo reads actual transcripts, finds patterns you repeat by hand, and emits them as skills, checks and prompts. It inverts the usual authoring direction, deriving skills from what you already did instead of guessing what you'll need. Session transcripts are sitting unread on every builder's disk and this is the first tool I've seen treat them as a corpus for your own tooling. 64 stars, created September 3, so early.

claude-mem 13.24.0 shipped stale build artifacts under a bumped manifest and put the worker in a kill/respawn loop. v13.24.1 fixes it, and the failure mode generalizes to any Claude Code plugin distributed as committed build artifacts. The manifest bumped to 13.24.0 but the build never re-ran, so the committed .cjs files still carried 13.23.1 bytes. ensureWorkerRunning() compared the plugin-cache directory version against the worker's baked-in __DEFAULT_PACKAGE_VERSION__, SIGKILLed on mismatch, and respawned the same stale file on every hook event, killing the in-flight observer each time.

Drive Blender from a coding agent on macOS with no MCP server at all. Simon Willison's September 5 TIL scripts Blender headlessly via /Applications/Blender.app/Contents/MacOS/Blender --background --python scene.py, iterating a scene across three renders at 2m39s, 3m51s and 5m59s, then stitching frames with FFmpeg. He packaged it as a reusable skill. The generalization is the useful bit: any Mac app with a scriptable Python API is a first-class agent tool with almost no glue code, and I'd forgotten how many of those I already have installed.

---

Models

Zvi's Fable 5.1 capability numbers are large, and the token cost is the asterisk. His September 5 review records Terminal-Bench-Science more than doubling to 52.6%, CursorBench 3.2 at 73.4% against 70.5%, OSWorld 2.0 at 78% partial and 42% strict, HLE at 60.9%, and about a 60% fall in safety-classifier false positives. Cache reads dropped 75% to $0.25 per million. The 3x token consumption reports are covered in the Top 5 above, but the capability jump on Terminal-Bench-Science is real regardless of how you're billed.

Astra debuted at #1 on Code Arena with a ~140 Elo lead, and the sub's own summary calls the chart misleading. The r/ClaudeAI thread at 275 upvotes posts the leaderboard, and the mod summary after 50 comments is more informative than the chart: the y-axis starts at 1550, and 140 Elo translates to about a 69% head-to-head win rate. Elo is zero-sum, so a modest win-rate edge at the top says little about code quality, and arenas test small one-shot projects. Practitioner reports split cleanly, "almost one-shotted a landing page" against "burned an entire weekly limit without finishing."

RoboCurve put Astra on real robot arms and got 19/20 where Fable 5.1 got 8/20. Published September 4, 20 trials per model per task on bimanual I2RT YAM arms through Inspect Robots 0.58.0. On block-into-bowl, Astra hit 19/20 against Fable 5.1's 8/20 and Fable 5's 1/20, at 2.1k output tokens against 12.9k, $0.94 against $2.12 per run, 2.5 minutes against 6.8. The second task is the counterweight: on puzzle-piece-into-groove both models managed 2/20. Precision manipulation is untouched, and the headline covers only the coarse task.

OpenAI's official Astra prompting guide ships a banned-word list. The primary docs tell you to instruct Astra to "bias towards action and carry the user's intended task to completion," and to avoid slop words including delve, foster, leverage, "it's worth noting," "importantly," "Bottom Line:" conclusions, and contrastive framing like "X, not Y." Notable that a vendor now publishes a word bank. The genuinely useful item is a debugging prompt: when a skill causes the model to pause or ask permission, it must name and link the exact SKILL.md file it read, quote the instruction, and explain how it applies. Steal that one verbatim.

GLM-5.3's reasoning_effort silently defaults to max, including when you typo it. A practitioner writeup measures what running Z.ai's GLM-5.3 (753.9B) and GLM-5.3-Flash (320.8B, 18B active) locally actually takes: 216.7 GB and 93.1 GB for the smallest usable quants, and counterintuitively the flagship runs in stock llama.cpp while Flash doesn't yet. The trap: the field takes low, high and max, and the model card says any unset or unrecognized value lands on max. A typo buys a long think on every message.

Chat template choice moves Qwen3.8 Flash Next by 8 points on SWE-bench Verified. A 100-task sweep with mini-SWE-agent 2.4.6 on an RTX PRO 6000 WS, sglang, NVFP4 weights, full 262K context, three templates at two reasoning efforts. Stock went 91% at medium and 99% at xhigh. Fixed went 87% to 98%. Sharp sat flat at 94% for both. The cost side decides it: stock at xhigh paid +143.5% median output tokens and 4h31m wall time against 1h47m at medium, while Sharp paid +28.3% for its flat 94%. Sharp when latency matters, stock-at-xhigh when it doesn't.

---

Vibe Coding

Same model, nine harnesses, 17.5x cost spread. frontier-harness-eval/eval ran Kimi K3 through nine coding-agent harnesses in 12 configurations over 30 identical software-engineering tasks, 360 runs. Codex led on pass rate at 66.7% with $3.47 median cost per pass. Claude Code matched DSH Creator at 63.3% but cost $18.34 per pass with only 67.8% median cache hit. Exo Harness passed 53.3% at $1.05. Cache behavior is where most of the 17.5x lives, which means the number you should be watching in your own logs is cache hit rate, not tokens.

A context-compressing wrapper cut tokens per correct answer by 51.1% on a 20-pair SWE-rebench run. Halv published the benchmark on September 4 using gpt-5.6-luna at medium reasoning through Codex 0.152.0, identical on both arms. Vanilla Codex solved 7/20, Halv 10/20, with 30.2% fewer total tokens, which normalizes to 51.1% per correct answer. They publish all 40 run records and say outright that twenty pairs won't generalize across repositories or models. Directional evidence for context compression plus command-output filtering, not a proven number.

A builder open-sourced an 883-commit, 8-month agent harness after abandoning it as overengineered. The r/ClaudeAI post describes a design where the LLM is a replaceable worker and the system owns planning, state, permissions, context, verification and evidence, then code graphs, RAG, deterministic orchestration, isolated workers, crash recovery, model routing and replayable runs got added until extending it cost more time than using it. MIT-licensed, with the author explicitly warning readers off the stale agents.md and claude.md in the repo. The failure mode is the contribution: verification-first harnesses accumulate scope faster than the mainstream harnesses improve. I recognize this from my own pipeline and it stung a little.

Are LLMs steering independent builders onto identical projects? Armin Ronacher's "Latent Powers", September 5, describes reflashing a CarPlay dongle after Fable, Sol and Kimi K3 all pointed him at CatPlay, then finding an acquaintance had independently arrived at nearly the same project through similar conversations. He cites Lucas Meijer noticing that generating HTML reports instead of Markdown became a default as models got better at it. His question, which I don't have an answer to: how much of what we build comes from eliciting the same latent capabilities from the same models?

Code decay has no physical ceiling, and agents remove the friction that used to slow it. Zach Kehs's "There's No Limit to How Bad Code Can Get" took 461 points on r/programming: "If you continue to add floors and rooms to a building forever, it will collapse. Software faces no such constraint." He draws on Amazon order-processing systems that stayed in production at 1-2 orders per second while redesigns accumulated layers instead of replacing them. On AI he's blunt, saying LLMs will "accelerate you along the trajectory you are already on." Pair with a hard review gate, not a volume metric.

Microsoft's David Fowler says "typing code is absolutely over," and the replies are the useful half. Windows Latest covered the September 5 post from Fowler, an 18-year Microsoft veteran who leads Aspire, arguing developers now own architecture, testing, performance and security review while agents produce code. Supporting numbers in the coverage: Nadella's 20-30% AI-written code figure, a July 2026 Windows 11 update patching 570 bugs partly credited to AI-assisted detection, Copilot's agent building WinUI apps in 30 minutes. The top r/singularity replies point out none of that shows up in Outlook's bug count or in how Microsoft still interviews.

---

Hot Projects & OSS

Four independent projects moved code review left of the commit in 48 hours. GitWarren reviews the dirty worktree before anything is committed and ships 17 MCP tools so the agent answers questions inside its own review. Ponytail applies a stop rule before generation. Twinrun runs old and new versions of changed callables on identical inputs and diffs the outputs, requiring no assertions. webmcp-stack generates WebMCP tools from an OpenAPI spec with confirmations baked into regenerated regions. None of them review a pull request. All four assume the agent produces more diff than a human will read, so verification has to attach to generation.

Product Hunt's entire top four on September 5 was coding-agent infrastructure. The leaderboard ran dif.sh at 353 upvotes (markdown feature flags a coding agent installs and edits itself), Reflexio at 278 (behavioral learning for agents), Ponytail at 214, and Hyperprobe at 192 (agents debug production without redeploying). Not one is an end-user product. All four sell control, memory, restraint or observability for agents the buyer already runs, and the first non-agent product is at rank five.

OKF Agent Memory implements Google's Open Knowledge Format as git-native memory in pure Go, with no vector database. The project stores project memory as Markdown with YAML frontmatter in a knowledge/ directory, searches it with in-memory BM25, and exposes it through an embedded MCP server, sitting between ad-hoc CLAUDE.md files and black-box vector stores. It claims 80% token reduction via progressive disclosure and ships a Go benchmark runner so you can reproduce the numbers locally against LM Studio or Ollama. The bigger discovery is the spec: Open Knowledge Format v0.2, published by Google in GoogleCloudPlatform/knowledge-catalog at 9,079 stars.

FckSignups has 450 open issues against 11 open PRs, and that ratio is the product. The repo took 436 stars in a day at 3,086 total, listing open-source in-browser tools that need no signup. The issue tracker is where people propose entries, so 450 open issues is demand, not defects. Its last push was August 22, two weeks before it trended, which is another reminder that push recency doesn't predict star velocity for list repos.

oh-my-pi carries 2,384 open items at 29,768 stars, split 945 PRs to 1,439 issues. The repo is a coding agent with the IDE wired in, created December 31, 2025, pushed today. A near-2:3 PR-to-issue split is unusually PR-heavy for an agent tool at that star level, where the norm on today's board runs closer to 1:3. Its 10:1 star-to-fork ratio puts it in library territory rather than fork-and-run template territory.

HolmesGPT 0.41.0-alpha live-refreshes git-synced skills without a redeploy. The CNCF Sandbox SRE agent published September 6. ROB-1258 promotes git-synced skills to a first-class skill_repos concept that live-refreshes, so an on-call team pushes a runbook skill to a repo and running Holmes instances pick it up immediately. The release also patches all High CVEs and Mediums older than 60 days in the image, and refreshes the realtime JWT before expiry instead of after a failure.

---

SaaS Disruption

dif.sh took Product Hunt's top slot by deleting the feature-flag service. dif.sh moves flags and experiments out of LaunchDarkly-style dashboards into one .md file per flag in a dif/ folder, versioned in git and reviewed in a PR. A CLI handles create, validate, compile and archive, and dif build emits a typed client.ts plus context.json. The argument for it is that a coding agent can install and edit the flags itself, because they're just files it already reads. Hosted Dif Cloud exists for analytics only. Every dashboard-shaped SaaS whose data is small enough to live in a repo should be reading this launch nervously.

Reflexio sells the layer between a user correction and a retrain. The Apache-2.0 repo shows 360 stars with a push this morning, after taking Product Hunt's #2 slot at 278 upvotes. It persists user corrections as behavioral profiles and captures successful execution paths as reusable playbooks, retrieved at runtime so the base model never gets retrained per correction. Learnings stay scoped to the individual until a lesson recurs across users, at which point it can be promoted to a shared playbook and approved for reuse. CLI-first no-code path, managed through fully self-hosted.

Benedict Evans argues AI won't skip the institutionalization step that created SaaS. His September 3 essay pushes back on the idea that cheap tooling collapses enterprise software. His claim is that the value in SAP, Workday, Carta and Rippling was never the code, it was moving a workflow out of improvised spreadsheets and email into an institutionalized system, and that's organizational change work, not a code-generation problem. He also points out that most people don't reframe their own job as an engineering problem, and that anything touching 50 or 500 people across five departments goes through purchasing regardless of who wrote it. I think he's right about large enterprises and wrong about the 5-to-50-person band, where the improvised spreadsheet is the system and always was.

GitWarren ships a local pull request that never touches GitHub. The GPL-3.0 desktop app at v0.1.5 reviews committed, staged, unstaged and untracked changes with inline comments and real review objects, no accounts and no servers, plus an MCP server over stdio with seventeen tools so Claude Code or Codex can explain its own diff in-thread. It targets the window between an agent finishing and a dirty worktree becoming a commit, which is a window that didn't exist as a product category eighteen months ago.

Keen Bean sells meeting capture with no bot in the call. The macOS app listens through system audio only, so nothing joins the participant list, which is its explicit wedge against Granola, Otter and Fireflies at organizations that ban recording bots. It emits tasks and decisions as cards during the call and drafts specs, diagrams and mockups instead of producing a transcript. Transcription and model processing run outside the company's infrastructure. $19/month, $39/month, 14-day trial. Show HN at 11 points, so nobody's noticed yet.

---

Policy & Governance

The Seattle Times and Newsday want the training sets destroyed. Both filed a federal copyright and trademark complaint in the Southern District of New York on September 4, TechCrunch reports, alleging OpenAI and Microsoft scraped their sites including paywalled articles to train ChatGPT, Copilot and Bing AI features. The remedy request matters more than the damages: destruction of every AI training set built on their work. Microsoft said it was surprised and open to talks; OpenAI restated its fair-use position. Two regional dailies joining a docket dominated by national outlets widens the plaintiff class, which changes settlement economics more than it changes the legal argument.

OpenAI admits it has no standard for reporting misalignment. On September 5, TechCrunch reported OpenAI's public statement that it has "treated misalignment largely as a research question, which gets communicated in research publications" and does "not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment." A disclosure framework is promised "in upcoming weeks." Whatever you think of the underlying incident, the concession is the concrete part: agent containment failures don't fit the security-incident reporting pipeline labs already run, and nobody has built the second pipeline.

NYC and LAUSD both imposed AI moratoriums days before the school year. Tech Policy Press reported that the two largest US districts announced restrictions on September 2 and 3. NYC bars student-facing AI in all K-8 classes and permits a short approved-tool list for high schoolers. LAUSD, serving about 378,000 students, imposed a full one-year moratorium on generative AI on district devices for all students. Both districts now have a year to write longer-term rules, which is the actual news, since a moratorium is a decision to decide later.

Chrome 152 exempts www.google.com from "delete site data on close." Jeff Johnson published a reproducible test on September 5: clear all data, run one Google search, close every window, then check chrome://settings/content/all. The Google entry survives, including a browser restart, on Chrome 152.0.7977.83 for macOS with the setting enabled. Johnson documented a similar exemption six years ago that Google eventually fixed, and attributes this one to QA failure rather than intent. I'd like that read to be right and I'd like an explanation more.

Tech CEOs pitched AI at the G20 while two-thirds of Americans said no data centers here. Fortune reported from the September 5 gathering at the Carolina Inn in Chapel Hill, where Altman called AI "incredible magic of intelligence in a bottle" while hundreds protested outside over data center pollution, water use and employment claims. An Economist/YouGov poll found two-thirds of Americans oppose data centers in their own communities, and activists staged 142 demonstrations across 42 states in July alone. Compute buildout is now a local land-use fight, which is a much slower and more expensive fight than a federal one.

Three hikers were rescued off Mount Shasta after Gemini told them to pack less food and water. The Siskiyou County sheriff's office said on September 5, via TechCrunch, that three men who planned the climb with Gemini started at 3 a.m., summited at 7 p.m. well past the recommended noon turnaround, and spent the night in Mud Creek Canyon before rangers reached them. The office stated the group had been "advised by Gemini to bring far less food and water than their group required." First search-and-rescue report I've seen naming a specific assistant's provisioning advice as a contributing factor.

---

Skills of the Day

1. Compute your agent's step budget from p^n before you write the prompt. Estimate per-step reliability from your last twenty runs, then solve for the n where success drops below your tolerance, and hard-cap turns there. At p=0.95 that's about 14 steps for a 50% floor, which is far shorter than most people's default session.

2. Checkpoint agent state to disk between phases so each phase starts at n=0. Write the phase output to a file or a SQLite row, then start a fresh session with that output as input. You can't raise p much, but you can reset n, and resetting n is the entire lever the geometric law leaves you.

3. Stop trimming context to improve agent reliability. The 10,664-trajectory result says restricting the context window steepens degradation instead of easing it. If you've been aggressively pruning to keep an agent focused, measure the version that doesn't prune before you keep doing it.

4. Run /skill-doctor and delete every skill it reports as never invoked. The skill listing goes out on every turn whether a skill fires or not, so unused skills are a fixed per-request tax. Needs Claude Code v2.1.252 or later, and prints plain text under -p if you want it in a script.

5. Track cache hit rate, not token count, when comparing harnesses. The nine-harness eval found a 17.5x cost spread on one model, and Claude Code's 67.8% median cache hit is where most of its $18.34 per pass came from. Cache hit rate is the number that predicts your bill.

6. Put an egress allowlist on any user-supplied MCP server URL. Three separate CVEs this week (Rowboat, OWL, OGX) are the same bug: a user registers an arbitrary endpoint and the server fetches it, reaching internal services and cloud metadata. Treat a user-provided MCP URL exactly like a user-provided webhook URL.

7. Never render operator prompts with the template engine you render HTML with. DocsGPT's unauthenticated RCE came from running a "custom prompt" field through unsandboxed Jinja. Use plain string substitution for prompt templating, or a sandboxed environment with no filesystem or attribute access.

8. Make your agent cite the skill file that stopped it. OpenAI's Astra guide includes a debugging prompt requiring the model to name and link the exact SKILL.md it read, quote the relevant instruction, and explain how it applies. Add it to your system prompt today; it turns "the agent randomly asked permission" into a one-line diagnosis.

9. Ground long-document retrieval in the document's own table of contents instead of length-based chunks. STAIR reached 82.6% Recall@1 against a finetuned DSI's 76.9% with under 0.05% hallucination, and it generalizes better when training samples are scarce. If your PDFs have headings, you're throwing away structure every time you chunk by character count.

10. Separate the research pass from the writing pass in anything you publish. 78% of surveyed developers stop reading on detecting LLM prose and 71% avoid the author afterward. Using a model to find sources and check claims leaves no fingerprint. Using it to smooth your sentences is what costs you the reader.

---