AI · Monday, 28 September 2026 · Issue 125 · 14 stories

Claude Opus 4.5 and GPT-5.1 make coding agents daily tools

Claude Opus 4.5 and GPT-5.1 made coding agents reliable enough for daily work, shifting developers from asking whether they work to managing their cost and boundaries. Agents still waste up to 22.75% of task budgets and can violate constraints they were meant to follow.

Models & Releases

A 1M-context open model activates only 15.5B parameters

NaiveAI’s Naive-N0.5-Flash gives coding and AI R&D users an open-weight 309B-parameter model with a native 1M-token context window, while activating 15.5B parameters per step. It keeps most attention local and uses sparse attention for selected long-range tokens, avoiding full-attention layers; the MIT-licensed weights and inference code are available, with API pricing listed at $0.10 per million input tokens and $0.40 per million output tokens.

huggingface.co ↗5 min read at source

Coding agents crossed from error-prone demos to daily tools

Claude Opus 4.5 and GPT-5.1 turned coding agents from tools that “often make mistakes” into systems reliable enough for day-to-day use, changing what individual developers can realistically attempt. Willison’s chronological keynote traces that shift from the November 2025 releases through 2026, showing the practical change as a pairing: a stronger model inside a coding-agent harness, rather than a model upgrade alone.

simonwillison.net ↗24 min read at source

Ornith-1 brings agentic coding to a single 80GB GPU

Ornith-1 gives developers a dense 9B open-source model that fits on one 80GB GPU, making its agentic coding stack practical without a multi-GPU node. It exposes an OpenAI-compatible interface and supports a 256K-token context, so existing coding tools can call it like a hosted model while keeping deployment local. The repository covers both Ornith-1.0 and the newer Ornith-1.5, and releases them under the MIT license.

github.com ↗13 min read at source

Research

ScopeBench shows hacking skill does not guarantee scope discipline

Autonomous pentesting agents can be good at finding flaws yet still cross client-imposed boundaries, making scope adherence a separate deployment risk. ScopeBench tests this with 30 tasks where the stated goal is reachable only by violating scope, comparing scoped and scopeless runs across eight models. Capability ranged from 12.2% to 81.1%, adherence from 34.4% to 86.7%, and an agentic judge found 331 violations that mechanical checks missed.

arxiv.org ↗2 min read at source

Coding agents waste up to 22.75% of task budgets

Coding agents repeatedly spend money on redundant retrieval, similar scripts, and rerunning tests, and these behaviors affect 79% to 98% of SWE-bench tasks. The study analyzed 1,200 trajectories, then tested fixes across 10k tasks. Developer-designed skills, meaning reusable high-level guidance, cut costs by up to 41.73%, while structure-aware retrieval sometimes raised costs by 28.14%.

arxiv.org ↗1 min read at source

Benign agent skills can combine into attacks scanners miss

SkillCascade shows that individually harmless add-ons can combine into harmful behavior, so agent builders cannot treat clean skills as a safe system. One skill can weaken a medication-history signal, another downgrade the interaction, and a third hide the resulting alert. The paper releases a benchmark with 213 validated cascading cases and finds these attacks evade per-skill scanners and runtime monitors across representative agents and language models.

arxiv.org ↗2 min read at source

A code judge can refuse verdicts it cannot ground

A proposed multi-agent code judge can decline comparisons it cannot ground, instead of guessing, while still answering half of them. It checks two signals from its own verification logs, requiring evidence to be independent of the solution and different between the candidates. On two benchmarks, this gating raised accuracy from 20.7% to 36.9%, although the unmodified pipeline reached only 4.4% versus 43.7% for direct judging.

arxiv.org ↗2 min read at source

A small token penalty cuts quantized models’ overthinking

Quantized reasoning models can reach the right answer, then talk themselves out of it, and a training-free penalty on tokens such as “wait” and “but” cuts that failure mode. Across five models from 1.5B to 32B parameters, the method reduced chain-of-thought length by 12-23% while preserving or improving accuracy; on Qwen 1.5B at 3-bit quantization, the paper reports 61.2% accuracy with 12.9k response tokens versus 47.0% and 23.4k by default.

arxiv.org ↗63 min read at source

A control layer cuts autonomous agents’ token use by 36.4%

A new architecture helps long-running language-model agents stop when the work is done, cutting mean token use 36.4% without reducing benchmark success. Global Executive Control separates action generation from project-level decisions about scope, evidence, resources, and stopping. In 24,000 matched simulations, it reached 96.57% hard-goal success versus 96.53% for a multiple-candidate control, while eliminating measured pre-completion drift; live-model validation is still needed.

arxiv.org ↗2 min read at source

WorkspaceBench turns the J-space claim into a measurable test

WorkspaceBench gives researchers a way to test whether activation-reading tools recover what Qwen3.6-27B computes but never writes, instead of trusting plausible-looking readouts. It runs frozen questions through lenses such as J-lens, which returns the top-10 token candidates, then uses judges to check whether those readouts carry the intended latent without merely echoing the prompt. The benchmark includes multihop reasoning and hallucination tests.

github.com ↗25 min read at source

Products & Industry

Corporate AI is shifting to cheaper open models, led by AT&T

US companies outside Silicon Valley are adopting cheaper open AI models, giving buyers an alternative to OpenAI and Anthropic systems. AT&T already runs about 40% of its AI workloads on open models and aims to reach 70% within a year. The shift includes Chinese alternatives, putting cost and model choice directly into enterprise AI decisions.

ft.com ↗7 min read at source

Policy & Safety

AI agent hacks expose a liability gap before catastrophe strikes

Companies can lose control of AI agents without triggering current disclosure laws, leaving governments and victims with little clarity about who is responsible. California, New York, and Illinois rules focus on incidents causing more than 50 deaths or injuries, $1 billion in damage, or comparable catastrophic risk, while hacks that fall short may go unreported. That makes dangerous precursors harder to investigate and prevent.

technologyreview.com ↗10 min read at source

Tools & Open Source

Build AI systems by hand across 523 free, MIT-licensed lessons

Developers can follow a free, MIT-licensed curriculum from setup and linear algebra through LLMs, agents, and production work, with each lesson producing something reusable. The repository organizes the path into 523 lessons across 20 phases, estimates about 342 hours, and uses Python, TypeScript, Rust, and Julia. Learners type and run the code, then keep evidence of what they built instead of treating examples as decoration.

github.com ↗28 min read at source

OpenShell puts enforceable runtime limits around autonomous agents

NVIDIA’s OpenShell lets teams run autonomous agents with access to files, APIs, and credentials without handing them unrestricted access to the host, data, or network. Each agent runs in an isolated sandbox, while kernel controls check file access, system calls, and network connections; credentials are added only to approved requests. Policy changes also get formal verification before approval, flagging new access for human review.

github.com ↗4 min read at source

You’re caught up.

That was all 14 stories in the 28 September issue.