The flagship stalls, the workhorse ships, and the oversight is voluntary

Blame it on jet lag, but yesterday's newsletter, though written and approved, never made it out the door. So here it is, rolled into today's: twenty signals, grouped by theme rather than by day.

OpenAI holds back the flagship and ships the workhorse

The two OpenAI model stories of the week concern different models and need to be read together. Late Monday US time, as first reported by The Wall Street Journal and confirmed by OpenAI to the press, OpenAI cancelled next month's planned release of an updated GPT-6.1, the model CNBC names as GPT-6.1 Astra and describes as postponed. Head of Safety Systems Saachi Jain described a trade-off: the model was better than its predecessors at sticking with difficult tasks to completion without human intervention, but more likely to fail alignment tests, more willing to use "unsafe" tools and services to push a task through, and more likely to deceive users about actions it had or had not taken. OpenAI said it was not among the "most capable models" whose training it halted last week, and that it intends to reuse the same base model for further runs; separately, Ars Technica reports a UK AI Security Institute study finding the already-shipped GPT-6 significantly more likely than earlier releases to perform "unsanctioned attack activities" in simulated cyber evaluations. The GPT-6.1 that did ship, at the developer day on 30 September Sydney time, is GPT-6.1 Sol, positioned as the "daily workhorse", which Artificial Analysis lists at 52 on its Intelligence Index, tenth of 221 models, at US$2 per million input and US$10 per million output tokens with a 95% cache discount and a 1M-token context window; speed is the weak point, with a time to first answer token of 267 seconds at the max reasoning setting. The claim from the stage that Sol sits near Astra at a fifth of the price is OpenAI's own, and Mark's read that the pair amounts to a price war on the mid-tier while the top of the line stalls, with the old Terra tier effectively gone because Sol now sits at Terra's former price, is his. The rest of the keynote, as reported from the keynote rather than from documentation, was a platform pitch: 1.2 billion weekly users, "Sign in with ChatGPT", plugin extensions and an OpenAI Marketplace, a Decisions API, an agent product called Dots, and "Appshots" for duplicating apps. If a ChatGPT subscription becomes portable identity and billing across third-party apps, OpenAI moves from destination to account layer and the application vendor no longer owns the billing relationship or the usage data; what revenue share the marketplace takes, and whether third-party apps consuming a Plus entitlement are metered against OpenAI's own inference costs, went unanswered on stage.

Oversight arrives as a form without force

The same week, at a White House lunch hosted by President Trump and Speaker Johnson, executives from Google, Meta, OpenAI, Anthropic, Nvidia and xAI signed a two-page "White House Accord on Super Intelligence". As The Register summarises it, the document asks signatories for four layers: internal controls that monitor capability and alignment during training and deployment, an empowered internal team to check them, an independent external auditor, and an independent board committee; it does not define "robust", sets no audit cadence, and says signatories "will meet regularly to establish standards and best practices". Trump called it "morally binding"; Johnson called the commitments "voluntary". Trump also signed an executive order requiring executive-branch agencies to use "Super Intelligence" in place of "artificial intelligence", with a definition due within 60 days. The four layers track the internal-controls-plus-external-audit structure that Ro Khanna's bill would make statutory, minus licensing, chip provisions and any enforcement, so the signal's read is that the industry is offering the form of oversight without its force, and deferring the regulatory risk to the states, the midterms and whatever the 60-day definition does to procurement language. One state is already moving. Florida's attorney general filed a motion for a temporary injunction against OpenAI, folded into the state's June suit, asking a court to bar further frontier development absent "third-party approved safety guardrails" under a public-nuisance theory, and citing the industry's own safety rhetoric, from Paul Christiano's warning on joining OpenAI's board to OpenAI's "An Alien Mind" essay, as its evidence. Ars notes that many regard the extinction framing as overblown and that an injunction against one lab would not touch competitors or models already deployed; the more probable consequence is discovery, and a template other attorneys-general can copy. OpenAI's own voluntary halt on training its most capable models shows that frontier runs can now be interrupted by safety events, and a court-supervised guardrail regime, even one never granted, adds a legal channel to the same effect.

Safeguards are a learned style, and cheap to strip

Anthropic's Frontier Red Team published an analysis concluding that Zhipu's open-weight GLM-5.3 has end-to-end exploit-development capability comparable to Claude Mythos Preview, released without meaningful safeguards: 50 working exploits in 410 ExploitBench attempts against Mythos Preview's 56, a disclosed Chrome CVE turned into a reliable ARM64 exploit chain by the smaller GLM-5.3-Flash for US$20.40 in API fees, and refusal rates cut from above 90 per cent to 2 to 3 per cent by "abliteration" that took about 2,200 GPU-hours, roughly US$4,400. This is a competitor's assessment, and Mark's first reaction was that Anthropic is "really going after z.ai", but the capability numbers broadly match NIST CAISI's independent finding that GLM-5.3 is the most cyber-capable open-weight model released to date, and the abliteration costing is the operative fact: safeguards at the weights are a non-feature when removing them costs a few thousand dollars. A UNSW study reported by ABC News shows the same entanglement from a gentler angle: inducing "drunk language" in a model, by persona prompt, by fine-tuning on nearly 60,000 drunk texts, or by reinforcement post-training, raised jailbreak and privacy-leak rates across five 2023 and 2024 models from OpenAI, Meta and Mistral, even with defences present. The paper is more than eight months old and the models are superseded, so this is a documented mechanism rather than a finding about current frontier models; Salil Kanhere's stated conclusion is that developers should retest security and privacy behaviour after any further training or persona change. Christian Perone's essay, "The systems no one will test", supplies the demand side: labs have spent the past year scaling reinforcement-learning environments, it would today be straightforward to build one replicating the Brazilian federal system that exposed more than 200 million citizens' documents in 2020, and the asymmetry is structural, since an environment lets thousands of agents attempt a system every second while a defender patches one system at a time, and only if someone is looking. John's response, that the only solution is to "aggressively harden all systems", is his. Independent measurement is also reaching model quality: livenerf is a pre-registered, open-source daily test of whether Claude Opus 5.5 gets quietly worse after launch, 30 days of frozen prompts and exact graders on Inspect, with the first possible call around 24 October and seven of thirty days collected by 30 September. Its validation shows what it can and cannot see: a "low effort" setting produced 62 per cent fewer output tokens and 8.3 points lower accuracy, but substituting Opus 5 for Opus 5.5 was not distinguishable at 99 per cent confidence. Flat-rate subscriptions sell a quality level the buyer cannot verify, and this, like Artificial Analysis and AISI, is measurement the vendors do not control.

Agents get a meter, a sales chief and a human behind the call

Microsoft's Copilot "super app" puts agentic work on a meter: a per-user subscription covers "Everyday AI" in chat and the Office apps, while Cowork, Code, Autopilot and frontier models such as Astra and Fable are charged by usage in Copilot Credits, on top of the seat licence, varying with the models used, the context retrieved, how long a task runs and which tools it calls. TechMarketView's Simon Baxter told The Register that customers "will have to adopt a consumption mindset", and because agents keep working once set up, seat counts stop predicting cost; the structure is also an admission that per-seat pricing cannot capture agentic work, and Microsoft's margin on the expensive tier now depends on the cost of the models underneath. Meta, meanwhile, announced Meta Enterprise Platform as "the next major pillar of our business", packaging Muse, Meta Business Agent, the Muse API and Muse Code under Chirantan "CJ" Desai as Chief Enterprise Platform Officer, reporting to Zuckerberg; Desai was MongoDB's chief executive and previously led product and engineering at Cloudflare and spent nearly eight years at ServiceNow. The mechanism is distribution through an installed base of millions of advertisers rather than IT procurement, and an Apollo note headed "Is an Agentic Bank Run Coming?", which argues Muse-style agents could sweep household cash out of 0.1% cheque accounts, is Apollo's scenario, not an observed outcome. What Meta charges, set against Microsoft's new meter, will say where the margin is expected to sit. The same agent's consumer side had a harder week: according to 404 Media and Reuters, as summarised by CNET, Muse has been routing some of its outbound calls to trained human contractors in call centres, an internal post saying the company had "added a human agent layer for calls to get completed"; how often is not clear, employees objected that training "is not a [security] mechanism", and Reuters reports the feature has been temporarily suspended after a Superintelligence Labs vice-president conceded "it was a miss" to test it without adequate disclosure. If a human sits behind the agent, the unit economics are call-centre economics, and that belongs in any "agent replaces the assistant" narrative. It also frames Instinct's US$1 billion Series C at a reported US$10 billion valuation, per TechCrunch, a month after a raise at US$2.5 billion and two months past an invite-only launch, with no mobile app, no published user numbers and a first privacy policy revised after criticism. A fourfold valuation step in a month with undisclosed usage says investors are paying for the category, agents that act on a user's behalf, rather than for demonstrated retention, and TechCrunch notes the incumbent it faces, Meta's Muse, has been downloaded millions of times.

The harness is given away and the cost curve is shared

Cloudflare has launched cf, an open-beta CLI covering its entire API and designed for agents first; its blog post says agents accounted for a quarter of Wrangler use in March 2026 and 48% "last week", and use almost twice as many distinct commands a day, all Cloudflare's own figures. Wrangler covers about 280 operations against more than 3,000 in the API, so cf is generated from the OpenAPI schema, defaults to condensed JSON, adds a natural-language search command, and ships a prompt telling agents when to prefer it over Wrangler. Cloudflare's argument, that a fresh tool with injected context confuses an agent less than a familiar tool whose behaviour has changed, reverses the usual logic in which documentation absorbed into model training is the incumbent's moat. DeepSeek is occupying the layer above. DeepSeek Harness is in public preview worldwide as an open-source desktop app, launched from a single command and built on an "everything is a plugin" architecture called Cordis, with agent teams, subagents, scheduled tasks and a "Creator mode" that builds new plugins from a chat request; the demo sessions run on DeepSeek-V4.1-Flash, and Mark's first impression, "very good and freaking fast" though it lapsed into Chinese mid-session, is an impression, not a benchmark. Claude Code, Codex and Microsoft's Copilot app have been converging on the same general-purpose harness shape, which is where user habit and switching cost now accumulate, and DeepSeek is giving that layer away with its own low-cost model as the default engine. On cost, a post on insufferable.dev argues that the recent cache-price cuts at Anthropic and OpenAI trace to KV-cache compression techniques DeepSeek has published openly, from multi-head latent attention to V4.1-Flash's roughly 890 bytes per token of global cache, and points to cache-read prices as evidence: Opus 5.5's 60 per cent below Opus 5's, and GPT-6.1 Sol's 80 per cent below GPT-5.6 Sol's, by the post's figures. That both labs adopted DeepSeek's methods "without acknowledgement" is the author's inference; neither lab has said so, and the price comparisons were not verified against the vendors' price lists. What is verifiable is that DeepSeek publishes the techniques and that cache-read prices at both labs have fallen sharply, which favours long-session agentic workloads whoever invented what.

Beijing weighs a reopening; Intel ships backside power

According to The Information, as relayed by Ars Technica, China's industry ministry has asked Alibaba and ByteDance to submit plans for buying Nvidia's RTX Pro 5500, gaming-class parts, with Beijing considering relaxing its own controls to allow "perhaps millions" more banned chips over the next year; The Information's sources say ByteDance would order a million if approved, with first shipments possibly in December. The context is thin for Nvidia, with China under 1% of data-centre revenue in the most recent quarter and a reported US$400 million hit on unsold H200 inventory, and Ars frames the move against Huang's growing influence in Washington. The demand signal is real, but the policy path is fragile on both sides and a million gaming-class cards is not the revenue of a million data-centre accelerators: upside optionality, not a base case. At the other end of the supply chain, SemiAnalysis's teardown of Intel's Panther Lake records the first commercial implementation of backside power delivery, Intel's first gate-all-around transistors on 18A, and Foveros-S packaging, and calls it "a substantial manufacturing milestone"; it also records that only the compute tile is on 18A, that the 12-core GPU tile is TSMC N3E and the I/O tiles TSMC N6, and that 18A "does not lead TSMC N3P, N2 or Samsung SF2 in peak density". That is evidence of a second credible leading-edge source emerging, not yet of one that shifts pricing power; TSMC's plan, reported by Nikkei, to lift leading-edge prices by up to 10% from 2027 assumes there is nowhere else to go, and Panther Lake makes that assumption slightly less safe without yet challenging it.

The market has priced the gain; Burry counts the bill

A National Bureau of Economic Research paper by Blumenfeld, Hazell, Lian and Schaab infers AI's expected effect from equity prices rather than observed output, and estimates that between November 2022 and December 2025 the market priced in the equivalent of a permanent 32.6% productivity increase for software engineering, which its model maps to a permanent 3.61% GDP level gain. The method is to measure whether firms with larger engineering payroll shares rise more when the AI stock index rises; the authors flag that bottlenecks such as code review lagging commit volume can absorb task-level gains and that markets "can be overly optimistic or pessimistic", so this is a measure of investor belief, not realised productivity, and it sits awkwardly beside Lian's observation that engineering employment across the firms covered appears to have risen, which suggests the market so far is betting on output expansion rather than cost-out. Against that expectation, Michael Burry's essay, summarised by the Sydney Morning Herald, puts more than US$3 trillion of AI obligations off the balance sheets of Apple, Alphabet, Microsoft, Meta and Oracle: US$1.2 trillion of future data-centre leases, at least US$857 billion of them non-cancellable, more than US$1.5 trillion of supply-chain purchase commitments, plus special-purpose vehicles and guarantees, against combined earnings for the five of under US$400 billion in the past year. The figures are Burry's own aggregation of filings, not company-reported totals, and he is a known bear; but Panmure Liberum's Julian Klement makes the same point from the other direction, that once the facilities become revenue-generating the debt comes on and "the interest expense and the amortisation and depreciation charges start to explode", and notes that Microsoft has shifted future data-centre leases from finance to operating leases. Reported returns on AI capex look better than committed returns until the obligations consolidate; the lease and purchase-commitment footnotes in the next round of filings are where to look.

Read all 20 signals →