AI News Briefing — OpenAI launches GPT-6 Astra at 2.5x Sol pricing

Model releases

• [2026-09-03] OpenAI launched GPT-6 Astra, and the pricing is the number to start from: $10 per million input tokens and $50 output, 2.5x GPT-5.6 Sol’s $4/$20. Artificial Analysis scores it 61 on its intelligence index — level with Sol, behind Claude Fable 5.1’s 66 — but 70% more token-efficient on coding, reaching 67 on the coding-agent index alongside Opus 5. Cheaper per coding task than its predecessor, roughly 75% dearer per general one. (official, source)

  Two prices in one model: coding work gets cheaper because 70% fewer tokens outruns the 2.5x rate, general work gets dearer at the same rate. Which of those you actually run decides whether this is an upgrade.

  For Engineering Managers / Tech Leads: Split last month’s spend by workload before switching anything. A coding-agent-heavy month lands cheaper at $10/$50; chat and summarisation traffic lands roughly 75% dearer, where Sol’s $4/$20 still scores level. The answer may be both models rather than one.

• [2026-09-03] Astra scored 100% on ExploitBench against 78.5% for Sol, and the shipped model refuses prompts asking it to write proof-of-concept exploits. Looser access — PoC validation, malware analysis, detection engineering — runs through Daybreak, the programme OpenAI is putting $1 billion behind for power, water and banking defenders. (official, source)

  A red team that used the API to draft proof-of-concept code will find that door shut on the shipped model, and the way back in is an application to Daybreak as a power, water or banking defender.

• [2026-09-03] Nvidia confirmed it is buying Hugging Face for $12.93 billion, founders included. Its commitments: the Hub stays open, no Nvidia compute requirement, multi-cloud and multi-accelerator support retained, brand kept. Nvidia already publishes 500-plus models and 250-plus datasets there, which is the strongest evidence for the promise and also the reason it costs them little to make. (official, source)

  Every commitment listed is a promise rather than a mechanism — nothing named makes the Hub’s openness enforceable a year out. For teams whose CI pulls weights from the Hub there is no action today beyond knowing that it does.

• [2026-09-03] The Institute of Foundation Models put K2 Horizon on Hugging Face: six models from 0.9B up to a 375B-A23B sparse mixture-of-experts with a 512K context, all Apache 2.0. The 32B dense and 36B-A4B sparse builds are the ones sized for on-prem hosting, and GGUF and FP8 quantisations are already up. Training data, recipe and training code are promised rather than published. (official)

  Apache 2.0 weights with the recipe and data still promised is open weights, not an open model: enough to deploy, not enough to reproduce. GGUF and FP8 already being published means the on-prem path starts as a download rather than a conversion job.

• [2026-09-03] ChatGPT, Claude and Grok all degraded inside the same few hours. SpaceXAI apologised for an outage at its Memphis data centre that took Grok down for three hours and also hit unnamed “compute partners”; Anthropic, which agreed a compute lease with the firm earlier this year, logged three hours six minutes of elevated errors. OpenAI attributed its own disruption to a routing error, and no vendor has confirmed a shared cause. (source, source) (unconfirmed)

  Should a shared cause turn out to be behind this, multi-vendor fallback stops being the hedge it looks like on paper — failing over from Claude to Grok does nothing when both sit on the same compute. No vendor has confirmed that yet.

Coding agents

• [2026-09-04] GitHub Copilot code review reached Azure Repos for every Azure DevOps customer, billed per review in AI credits at a credit per cent, with charges landing in Cost Management about 48 hours later. Limits are tight: five concurrent reviews per org, two per user, repos under 10 GB, 100 changed files. Budgets notify, they do not stop reviews. (source)

  Charges arriving 48 hours late, against budgets that notify rather than stop, means a runaway month becomes visible after the fact instead of preventable during it. Five concurrent reviews per org is the real brake here.

• [2026-09-03] Four models leave Copilot on October 2: Gemini 3.5 and 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7. Business and Enterprise admins have to enable the replacements in org model policy first, or their developers lose the option rather than getting it swapped. (official)

  Nothing swaps itself. An org that leaves model policy alone until October 2 hands its developers four fewer choices and no replacement, so this is an admin task with a date on it rather than a changelog to skim.

MCP

• [2026-09-04] Grafana patched CVE-2026-19516, a CVSS 9.1 SSRF in its MCP server: a caller could set an X-Grafana-URL header on the grafana_api_request tool and steer the server’s outbound request — method, path and body — at loopback, link-local and cloud metadata endpoints. Fixed in 1.1.0, which also adds optional bearer-token protection. An earlier fix stopped credential leakage but never enforced the destination. (official)

  A header on a tool call steering the server’s outbound request at metadata endpoints is an old SSRF shape with a model holding the wheel. An earlier fix stopped credentials leaking and left the destination unchecked, which is how it came back.

  For Security Engineers: Anything below 1.1.0 needs the upgrade now, and the bearer-token protection it adds is optional — enable it in the same change. Egress policy on the MCP server’s own outbound traffic is the control that does not depend on tool parameters: block loopback, link-local and cloud metadata ranges.

• [2026-09-04] LangChain folded MCP into the main package as langchain.mcp, rebuilt on FastMCP, and dropped MultiServerMCPClient for a single MCPAdapter. The interesting part is the July spec revision it tracks: sessions are gone, so a redeploy no longer kills live connections and remote servers stop needing sticky routing. Elicitation arrives as LangGraph interrupts; tool catalogues are cached client-side. Python now, TypeScript later. (official)

  Losing sessions is what changes the operations story: a remote MCP server behind a load balancer stops needing sticky routing, and a deploy stops dropping connections that were mid-conversation.

  For Software Developers: MultiServerMCPClient is gone, so server configuration collapses into a single MCPAdapter. Elicitation arriving as a LangGraph interrupt means the human-in-the-loop prompt goes wherever your graph already handles interrupts, not into a bespoke callback. Python only until the TypeScript port lands.

AI-assisted SDLC

• [2026-09-02] Google open-sourced Mantis, the harness behind its own vulnerability work: critic and review agents, sandboxed reproduction to ground each finding, commit-history analysis, and a hierarchical summary tree that cuts token overhead more than 85% on large repositories. Aimed at beating the sub-7% true-positive rate typical of AI scanning. A companion mantis-advise skill feeds the same knowledge to coding agents. (official, repo)

  Reproducing a finding in a sandbox before reporting it is the part attacking that sub-7% true-positive rate; the rest of the harness is orchestration around that one check. Running it means supplying the sandboxes, which is where the cost sits.

AI cost tracking & telemetry

• [2026-09-03] Shopify compressed the Sidekick agent’s system prompt from about 6,000 tokens to 1,500 learned gist tokens — not a summary, a trained representation that leaves the model behaving as though it read the original. At 350 requests a minute, time to first token fell from 438ms to 354ms and end-to-end latency from 6.8s to 4.2s, freeing GPU allocation. (source)

  This is not a prompt-trimming trick anyone can copy in an afternoon — the gist tokens have to be trained first, so there is model-side work before any of it pays back. At 350 requests a minute it does; at 35 it probably does not.

• [2026-09-03] Nvidia released PAIR in beta, a free router that finds compatible machines on a local network and sends independent inference requests to whichever has GPU headroom. It fronts Ollama and LM Studio, adapts as devices come and go, and covers RTX 20-series and newer, RTX PRO, DGX Spark and Apple M4 silicon on Windows, macOS and Linux. (official)

  Fronting Ollama and LM Studio keeps clients pointing at the endpoints they already use while the work moves elsewhere, so a room of idle RTX machines becomes shared capacity with no application change. Beta, free, and local network only.

Practice & craft

• [2026-09-03] Hugging Face published Funes, a memory layer that indexes a coding agent’s own session traces and retrieves them later, stored as a local Lance dataset or a private Hub dataset you own. Embedding and reranking run on your machine; credentials are redacted before publishing. On its handoff-versus-recall benchmark, recall came out 8x cheaper than written handoffs on one task and 4x on another. (official)

  Session traces already sit on disk and are mostly thrown away, and indexing them costs less than maintaining handoff notes nobody updates. The 8x and 4x figures come from Hugging Face’s own benchmark, so read them as a direction rather than a rate.

• [2026-09-02] A Thoughtworks team building an airline operations system found their agents coordinating through the git repository itself — a blackboard, in the 1980 Hearsay-II sense. Frequent commit-and-rebase in a monorepo, plus plan documents where each agent marks progress against a spec section, was enough for one agent to know when another’s interface was ready. No orchestrator involved. (source)

  No new tooling produced this. A monorepo, frequent rebases and plan documents carrying checkable state were enough for one agent to see another’s work — which also means teams sitting on long-lived feature branches get none of it.

Teaching & learning

• [2026-09-03] Ardit Sulce, who teaches Python to 650,000-plus Udemy students, names the three skills that separate a junior from the tool: reading code you did not write, saying precisely what you want, and understanding how the pieces of a system fit. His line for where AI belongs — keep the struggle that builds understanding, remove the friction that only burns time. (source)

  Reading code you did not write, saying precisely what you want, and knowing how the pieces fit is also a fair description of what reviewing agent output demands — the junior’s curriculum and the agent operator’s turn out to be the same list.

Research worth reading

• [2026-09-03] Coding agents over-edit. Against 400 BigCodeBench problems with known minimal patches, frontier models rewrote far more than the fix required; adding preservation instructions to the prompt cut average excess edit distance from 0.195 to 0.131, dropped added cognitive complexity 26.6%, and nudged pass@1 up 2.3 points. A correct patch is not automatically a reviewable one. (paper)

  Adding a preservation instruction to a system prompt is cheap enough to test on your own repository this week. Measure excess diff against the smallest fix that would have worked, not pass rate — that is where the 0.195 to 0.131 move shows up.

• [2026-09-03] Twelve open-weight code models were handed 270 impossible tasks across six languages. They invented ungrounded code about 60% of the time and refused only 27% — while never wrongly refusing any of the 91 solvable controls. The gap is not caution miscalibrated; it is an inability to tell impossible from merely hard. (paper)

  Real backlogs are full of quietly impossible tickets — an API that never exposed the field, a library that cannot do the thing — and the agent will write plausible code for them anyway. A human reading the diff remains the only check.

Watch list

• Astra’s general availability. OpenAI said Plus, Pro, Business and Enterprise plans plus the API within a week of the September 3 launch, with Azure and Bedrock behind that. The model appearing in the public API model list is what settles it.

  Anyone procuring through Azure or Bedrock is on the later timeline, and that gap is where a migration plan pinned to launch week goes wrong.

• The four GitSpawn agents still unpatched. A day on from Manifold’s disclosure, no new GHSA entries have appeared beyond Copilot CLI and goose. Cursor CLI, Qwen Code, Grok Build and Hermes Agent are the ones to watch, and an advisory is the artefact — a quiet fix looks identical to no fix.

  A day is not yet slow for a coordinated fix, but exposure runs the whole time. Controlling where repositories get cloned from is the only lever that does not wait on a vendor.

• Meta’s Muse Spark open weights. Zuckerberg’s “soon” is now two days old with no licence named and no repository. Weights on Hugging Face would settle it; the contributor tier shipping first would suggest the order of priorities.

  A named licence is the signal that arrives first and matters most — permissive against research-only is what decides whether anyone can use these weights at work.

• Grok 4.7, claimed for about September 12. Eight days out and x.ai still carries nothing. Docs or a landing page usually precede a launch by more than a week, so silence past the 10th means the date came from a post rather than a schedule. (unconfirmed)