AI News Briefing — OpenAI edited Astra benchmark numbers after launch

Model releases

• [2026-09-04] OpenAI has revised GPT-6 Astra’s published benchmark table several times since the launch post appeared on September 3. Astra’s hallucination rate was halved to 2% in one snapshot and now sits back at 4.2%; GPT-5.6 Sol’s ExploitBench score moved from 5.5% to 11.5%, which OpenAI says it is looking at reverting; Anthropic’s Fable 5.1 dropped from 87.8% to 78% on FrontierMath Tier 4 before settling at 83%. The company attributes the swings to differing checkpoint, scaffold and evaluation runs. (source)

  Numbers in a launch post are normally treated as fixed once published. Anyone who copied Astra’s hallucination rate into a model-selection document last week is carrying a figure that has moved twice since.

• [2026-09-03] Astra reached general availability in Microsoft Foundry, and the pricing sheet carries a detail the launch post did not: a long-context tier at $20 in / $75 out per million tokens against $10 / $50 for short context. Provisioned Throughput is available in Global and US Data Zone geographies, the latter at a 10% premium. (official)

  Two price bands for one model means retrieval-heavy traffic and short prompts stop costing the same per token.

  For Engineering Managers / Tech Leads: Work out what share of your Astra calls would land in the long-context band before signing off on a budget built from the $10 / $50 headline. Then price Provisioned Throughput in Global against US Data Zone, where the same capacity carries the 10% premium.

• [2026-09-04] Google shipped Lyria 3.5 to the Gemini app, AI Studio and the Gemini API on the same day, with selectable track lengths and vocal or instrumental output. A media model arriving in the API alongside the consumer app is the part a developer can act on; the rest is audio quality. (official)

Coding agents

• [2026-09-04] GitHub’s weekly Copilot roll-up carries three things past changelog noise: Agent Merge entered public preview in VS Code 1.136, taking a pull request from agent output to merge-ready; the Copilot harness for JetBrains IDEs reached general availability; and Claude Fable 5.1 plus Gemini 3.8 Flash joined the model picker on paid tiers. (official)

  Agent Merge is the item that changes a workflow rather than a menu. Everything up to opening the pull request was already automated; what happened after it was the gap.

  For Software Developers: Update to VS Code 1.136 before judging Agent Merge — on anything older the preview is simply absent. JetBrains work now runs on a generally available harness instead of a preview, which is the difference between filing a bug report and filing a support ticket.

MCP

• [2026-09-04] CVE-2026-85620 reduces Postgres MCP Pro’s restricted mode to decoration. Function-name validation never runs on RangeFunction nodes, so a blocked SELECT pg_read_file(...) succeeds when rewritten as SELECT * FROM pg_read_file(...), returning any file the database process can read. Everything through 0.3.0 is affected at CVSS 9.2, with the fix still an open pull request. Run the server under a role without pg_read_server_files in the meantime. (advisory, issue)

  Restricted mode is what people point at when asked whether an agent can safely reach the database. A hole in it is worse than having no restriction, because the assurance was already spent on the way to approval.

  For Security Engineers: Take pg_read_server_files off the role the MCP server connects as, then confirm the rewrite fails on privileges rather than on validation. With the fix still an open pull request, pinning a version is not a mitigation — every release through 0.3.0 carries this.

Agent frameworks & interop

• [2026-09-04] AWS published a memory-lifecycle design for AgentCore: TTL expiry at 90 days, a relevance score weighting creation recency, access recency and access frequency, and Bedrock-driven consolidation that merges low-scoring memories into compact entries. Suggested prune windows range from 7 days for support bots to 90 for IT operations. The failure it describes is an agent citing a billing dispute closed four months ago as live. (official)

  Nobody sets a memory TTL at launch, because an agent with three weeks of history has nothing stale in it yet. Ninety days later it does, and choosing a prune window has turned into a data migration.

AI cost tracking & telemetry

• [2026-09-04] Google benchmarked Gemma 3 12B and 27B on TPU v6e and found the workload shape, not the parameter count, decides what to deploy. Generation traffic walls the 27B at 64 concurrent users, plateauing at 4.12x throughput while the 12B climbs to 8.19x; prefill-heavy classification puts both near 6x. Autoscale on end-to-end latency rather than CPU. (official)

  Capacity planning that starts from parameter count picks the model first and meets the concurrency ceiling in production.

Practice & craft

• [2026-09-05] Jessica Wachtel ran Claude Fable 5.1 against Fable 5 on ordinary work and could not tell them apart. On the hardest task in the set the older model came back faster and cheaper. A benchmark delta at the top of a model card is a claim about a harness, and it does not reliably survive contact with a working day. (source)

  A tie on ordinary work is still a usable result: it moves the upgrade decision onto price and latency, where the answer is measurable.

• [2026-09-05] Jeremy Daly’s case for agentic RAG comes down to three habits: record which retrieval decisions the agent made, keep citation provenance attached to each passage, and treat everything retrieved as untrusted input rather than trusted context. Provenance is what lets a reader check an answer instead of believing it. (source)

  Treating retrieved passages as untrusted is a change at the prompt boundary. Keeping provenance attached to each passage is a change to the index schema, and only one of those can be retrofitted cheaply.

Research worth reading

• [2026-09-04] SWE-Gate grades repository-level repairs against review constraints mined from real pull request comments rather than tests alone. Of 644 repairs that passed the functional tests, 221 failed those constraints — roughly a third of what a test-only benchmark counts as done. 303 instances across 75 Python repositories, with a replication package released. (paper)

  Constraints mined from review comments encode what a team refuses to merge, which is the part no test suite writes down.

• [2026-09-04] HookPry attacks agent harnesses through the plugin update path, binding shell commands to lifecycle events such as session start and tool calls. The commands run with host privileges and never appear to the model. It compromised all seven harnesses tested, up to 92.5% per harness across 1,000 end-to-end runs; Microsoft Defender flagged none of the artefacts and three static defences together missed 47.5%. (paper)

  Plugin update paths get reviewed once at install and trusted from then on. Defender flagging none of the artefacts says the gap is structural rather than a signature waiting to be written.

Watch list

• Astra on Amazon Bedrock. Microsoft Foundry closed its half of this on September 3, so Bedrock is the remaining gap for anyone who buys models through a hyperscaler contract. A model-list entry in the Bedrock console settles it.

  Procurement rather than capability is what gates access here: the model exists and a lot of contracts cannot reach it.

• AWS’s bedrock-agentcore namespace, retiring September 17. Agent Registry went generally available on August 31 and the old API namespace goes away eleven days from now. Anyone with AgentCore calls in infrastructure code has a dated migration, not an optional one.

  This one resolves on the 17th whether anyone acts or not. What decides whether it lands quietly is teams finding their AgentCore calls before the namespace goes.

• GitSpawn’s unpatched agents. Qwen Code 0.22.3 and Grok Build 1.0.13 still carry the core.fsmonitor flaw a week after disclosure; Codex and Cursor patched theirs. The Claude Code variant abusing a different git config key is separate and also open.

  Two vendors shipping a fix and two not, a week in, is the split worth tracking — a patch existing elsewhere removes the argument that this one is hard.

• Meta’s Muse Spark weights. No licence, checkpoint or date has appeared for 1.2, and 1.3 remains undecided. Dropping this until there is an artefact on Hugging Face to point at.

  Carrying it further would be tracking an absence. A repository with weights in it is the only thing that puts this back on the list.