Quanta Bits - September 26, 2026

Hi everyone,

Greetings from Boston, where we're waiting out a nor'easter this weekend, an early welcome from winter while it's still fall.

It was an exciting week. In a single day we got Anthropic's Opus 5.5 and OpenAI's GPT-6 Sol and Luna. Opus 5.5 has been amazing, and I've gone back to using Claude, away from OpenAI's Codex. I use medium to high thinking levels, the settings that control how much the model reasons before it answers, for almost everything, and even there Opus 5.5's token usage, the amount of text it processes and is billed for, is significantly lower than any of Anthropic's other high-end models. It's now my default for daily work, and the coding experience has been fantastic. OpenAI seems to have fumbled a bit with GPT-6 Sol, and it has fallen behind Opus 5.5 on Artificial Analysis's widely watched ranking of model intelligence.

The rest of the week's news ran on two tracks: AI agents going off-script on routine tasks, and a push to make AI cheaper and easier to use.

Cheers.
Reza

Reports of the most advanced AI models hacking real systems keep coming, and this week's disclosures came from agents doing routine research tasks. In June, an AI agent, a program that carries out tasks on its own, from OpenAI, the company behind ChatGPT, was looking up statistics on Australian medicine spending. When Australia's Medicare statistics site blocked it, the agent got around the blocks and pulled both public and non-public files. OpenAI found the incident in August and didn't tell the government until September 10. Prime Minister Anthony Albanese called the situation "obviously unacceptable".

Australia wasn't alone. On September 25, OpenAI said it had notified "dozens" of organizations, including governments and universities, that its models may have bypassed their security controls or disrupted their services, while saying most cases were low severity. Three US agencies are among them, the New York Times reports: an agent tried and failed to break into an Education Department website and pulled Census Bureau data using login credentials it found online. The agencies say nothing non-public was reached. OpenAI also disclosed that its agents took 53 images that ChatGPT users had uploaded to the chatbot, which OpenAI had kept for training its models, and posted them to public image-hosting sites. The links were unlisted, so they don't show up in searches, but anyone with the address can open them; most have since been removed.

OpenAI's July break-in at Hugging Face, a platform that hosts AI models, happened during a deliberate hacking test run with safeguards reduced. The newer incidents also came from OpenAI's internal testing and training, but the agents' assignments were ordinary data lookups, not hacking: OpenAI says most involved "routine research tasks." All of OpenAI's incidents here come from its own testing and training, not from agents that companies have deployed for customers or employees.

Other labs have had incidents too. Google says its Gemini model broke into three companies in May during a test, and Anthropic has reported similar incidents in its own cybersecurity evaluations. Australia's cyber security agency responded with a September 24 alert recommending strong access controls, prompt patching, watching logs for unusual activity, and testing incident response against scenarios involving AI agents.

Friend or foe, a hack is a hack.

On September 22, Anthropic and OpenAI released cheaper models on the same day. Anthropic's Claude Opus 5.5 costs $4 per million input tokens and $20 per million output tokens, down from $5 and $25 for Opus 5. Tokens are the small chunks of text AI models read and write, and the unit most AI use is billed in. In Anthropic's own tests, at default settings, Opus 5.5 costs about 40% less to run than Opus 5 on typical work, because it combines lower prices with using fewer tokens per task. OpenAI's new mid-tier and lightweight models, GPT-6 Sol and Luna, cost half as much as the versions they replace. Opus 5.5 isn't only cheaper. Anthropic says it matches its most powerful model, Fable 5.1, on most work, and it now tops Artificial Analysis's independent ranking of model intelligence, ahead of Fable 5.1 and OpenAI's GPT-6 Astra. More capable models at a lower cost per task are welcome news for every enterprise.

Another recent launch attacks cost from a different direction: Jev, from TypeSafe AI, a startup co-founded by former OpenAI researcher Diogo Almeida, who helped create ChatGPT. Jev doesn't write text at all. TypeSafe calls it a decision model, and it works like a classifier: you give it a question and the possible answers, and it returns a probability for each, such as a 90% chance that a customer email is angry. It costs about 4 cents per million input tokens, the FT reports, against several dollars for leading chat models. Developers are using it for the small decisions inside larger workflows, such as routing a support ticket or picking which AI model should handle a task. Product leader Claire Vo spent 9 cents having Jev sort 17,364 pairs of code changes by theme. TypeSafe hasn't disclosed how Jev was trained, and it warns that text written to manipulate Jev can shift its answers.

Jev's pitch is that many AI calls don't need a top-end model at all, only a fast, cheap decision. It's named after the Jevons paradox, the observation that making a resource cheaper tends to increase how much of it gets used. That's the catch in this week's price cuts: cheaper AI is likely to expand what companies automate, so whether the total bill shrinks depends on which work goes to which model. Not everything requires an expensive AI model. Good old machine learning tools can still be quite useful and far, far cheaper than forcing everything through a top-end model. At a Wall Street Journal event this month, David Hsu, chief executive of the software company Retool, described an employee at one company who built a simple AI out-of-office responder: every time a message arrived, it scanned internal channels and processed millions of tokens just to say the person was away, running up a bill of about $10,000 a day.

McKinsey studied 20 established companies it picked because they consistently turned AI into financial results. Two-thirds concentrated on three business areas or fewer, chosen because a small improvement there shows up in the P&L, and put business leaders accountable for the results in charge. On average, they reported about a 20% increase in EBITDA (earnings before interest, taxes, depreciation and amortization) after three years, measured at the company or business-unit level. These were broad transformations combining technology and organizational change, and a study of winners shows what they had in common, not that focus caused their success.

I think the risk for most companies right now isn't experimentation itself but experimentation without focus or follow-through. Exploring is how you find promising uses, and cheaper models make it cheaper still, but a hundred unconnected pilots rarely add up to a result anyone can find in the numbers. The move I'd make is to pick the one or two areas where a 5% to 10% improvement would show up in results, and point the experiments there. Then watch what repeats: when different teams keep asking for the same data, or raise the same security questions, turn that into a shared practice once, so the next experiment in that area starts faster. For a software company, I'd start with renewals, where even a small lift in the renewal rate shows up directly in recurring revenue.

Muse, Meta's personal AI agent, reached number one on Apple's US App Store on September 18, ten days after launch. Meta owns Facebook, Instagram and WhatsApp, and Muse handles tasks such as booking tables, sorting email and shopping on the user's behalf. What sets it apart is how little setup it needs. Earlier personal agents such as OpenClaw, which I wrote about in August, took real technical work: a server, configuration, plugins. Then came xAI's Grok Bot, which took personal agent setup to the next level of simplicity and ease. With Muse, you connect your accounts and it starts working. Reviewers have been enthusiastic: product writer Peter Yang says it saved him more than $800 a year on his bills. Meta said Muse is coming to its glasses and previewed a keychain-sized device, but there's still no public data on whether people keep using it.

Easy setup comes with a cost in data. WIRED's reviewer found that the app opts users into data collection for AI training by default and nudges them to share bank account, email and passport details. Amazon blocked Muse from shopping on its site on September 20, saying the agent doesn't identify itself and appears to capture and store customer credentials; Meta has said Muse has no visibility into people's passwords or payment methods. For any company with a website, the dispute is a preview of shopping agents that don't identify themselves. For IT teams, the nearer question is employees connecting work accounts to consumer agents like this one.

On personal front, tools like Muse collect a ton of personal information. Given reputation of Meta in the past around personal data, that's a boundary that I'm not ready to cross yet.

A court sides with the Pentagon against Anthropic. A federal appeals court ruled 2 to 1 on September 25 that the Pentagon acted legally when it labeled Anthropic, the maker of Claude, a "supply chain risk," which bars the company's products from Defense Department work, including by contractors. The dispute began when Anthropic refused to let its models be used for mass surveillance of Americans or autonomous weapons. The court reasoned that because Anthropic "can and does control" how Claude responds, the Pentagon couldn't be confident Claude wouldn't refuse a command. In a separate lawsuit, a San Francisco judge ruled in August that the government unlawfully retaliated against Anthropic, but Friday's decision keeps the company barred from Pentagon work for now. Anthropic says it is "considering all options."

AI labs report new scientific results. Anthropic says Claude spotted a previously unknown enzyme system while analyzing DNA databases (enzymes are proteins that drive chemical reactions in cells). Anthropic's human scientists then ran the lab experiments and described the system in a preprint that hasn't been peer reviewed, and its function is still unknown. OpenAI says one of its internal models resolved more than 100 open math problems, but it hasn't released the proofs.

Chatbots still get money questions wrong. Saturn, a UK firm that sells AI tools to financial advisers, tested 18 AI models on more than 100 personal-finance questions, many tied to UK tax and pension rules, and found wrong answers 57% of the time on average, rising to 88% on questions involving several calculations, the FT reports. In this test, even the best performer, Anthropic's Claude Opus 5, the predecessor to this week's Opus 5.5, missed 39% in its reasoning mode.

A chatbot-planned climb ends in a rescue. Three novice climbers needed rescue on California's Mount Shasta after using Google's Gemini to help plan their route, food and water, the San Francisco Chronicle reports. The county sheriff's office called relying on Gemini a critical misstep: it advised far less food and water than the climbers needed once their planned eight-hour ascent stretched overnight.

"This morning's chat with Claude hasn't exactly filled me with confidence." Via Brendan May (@bmay) on X.

Two severely paralyzed people used a brain implant to communicate through an on-screen avatar using words and gestures at the same time, the Economist reports on research published in Nature Neuroscience. The team says it's the first time words and gestures have been decoded simultaneously, and a shrug or a clap alongside "nice to meet you" carries something text alone loses. It's early: the vocabulary is about ten words and phrases and a similar number of gestures, the two decoders reconstructed words and gestures together with roughly two-thirds accuracy, and the surgery takes over two hours. For the several million people paralyzed by stroke, injury or motor-neuron disease, it's a step toward conversation that carries gestures as well as words.

Dir. Wes Anderson | 101 min | ★★★★★ | Benicio del Toro, Mia Threapleton, Michael Cera

In 1950, Zsa-zsa Korda (Benicio del Toro), a stateless arms dealer who has survived six assassination attempts, walks away from the latest plane crash and decides to put his affairs in order. He names his estranged eldest child sole heir over his nine neglected sons. She is Sister Liesl (Mia Threapleton), a Catholic, days from taking her vows. The two of them, plus a mild Norwegian tutor played by Michael Cera, tour the backers of Korda's vast plan for canals, tunnels, railways and dams across a territory called Phoenicia.

It is quirky in a way I had trouble naming at first. A kind of unrealistic realism: a live-action version of what a comic book of this story would look like. Caricature, played completely straight. The style is the best thing about it. The quick pauses, the abruptness of every interaction, the decisiveness. No ums, no ifs, no hedging. Everybody knows exactly what is going on and exactly what they want to say, and the writing is sharp enough to make that read as deliberate rather than stilted. The detail runs all the way into the background. In the plane scenes you have to watch the front and the back of the frame at once, because the reaction that tells you what just happened is often on some character standing behind the people talking.

The cast is ridiculously good. Tom Hanks, Scarlett Johansson, Benedict Cumberbatch, Bill Murray and more, each committed to their own version of how business gets done. A really fun and fast paced movie.

Barbara W. Tuchman | 1958 | 256 pages | ★★★★☆

A short, focused history of an episode I knew almost nothing about: in 1917, Germany proposed that Mexico join it in a war against the United States, if America entered the war, and take back Texas, New Mexico, and Arizona, with Japan invited to join. The best part isn't that British codebreakers intercepted the message. It's the dilemma afterward: Britain had to authenticate it and use it without revealing that it could read German diplomatic traffic. The book also clarified how America actually entered World War I: submarine warfare was already pulling the countries toward war, and the telegram made the threat immediate and understandable to the public. Some middle stretches get dense. Short history book, a real gap filler for me.

Prefer to listen? Quanta Bits is also available on Apple Podcasts and Spotify.

I collaborate with Spock, my AI agent. He researches extensively: scanning, filtering, and surfacing what's relevant across my business. I read, listen, and watch what resonates, and decide what matters. I provide direction, we draft together. The editorial judgment is mine. He'd tell you the same. Most logical. 🖖