AI News Briefing — Anthropic's CEO asks labs to pace capability gains

Model releases

• [2026-09-12] Dario Amodei asked frontier labs to pace their capability gains, and put Anthropic on the hook for step one alone: third-party evaluators working inside the company on employee terms — badges, workstations, sight of how models are trained — to confirm safety commitments and flag incidents. Steps two and three, shared thresholds across democratic-country labs and coordination with China, need antitrust waivers and governments first. He was explicit that none of it means halting training. (source, source)

  Step one is the only part Anthropic can do alone, and the only part with a mechanism attached. Steps two and three wait on antitrust waivers and governments, which makes them a position rather than a commitment.

Coding agents

• [2026-09-13] GitHub’s HydraFusion has been sitting in the Copilot CLI since September 1 and only got written up this week. It plans each task across models from several providers instead of the one you picked: a single model, a cascade that escalates when a quality gate rejects the draft, or a drafter checked by an independent critic. GitHub reports 4.9 points more verified quality on TerminalBench 2.1 at 67% lower estimated cost than Claude Opus 5. Turn it on with /experimental on, then /model; you pay for every model it calls. (official, source)

  Both figures are GitHub’s own, from its own TerminalBench 2.1 run, and the cost half is labelled an estimate rather than a measured bill. It has been shipping since September 1, so the experiment is older than the write-up.

  For Software Developers: Run one of your own tasks twice — once on the model you normally pick, once with /experimental on and HydraFusion selected — and compare your own usage. The cascade escalates only when a quality gate rejects the draft, so easy tasks should bill close to the single-model path.

MCP

• [2026-09-12] Most MCP servers were installed on their defaults, and the numbers show it: 88% of servers need credentials, 8.5% use OAuth. The common failure is not a missing permission model but an ignored one — a server wanting read-only calendar access asks for read, write and admin because the tutorial did. July’s spec update was almost entirely authorization work, and the Enterprise-Managed Authorization extension that routes MCP access through a company’s identity provider is now stable. (source)

  Enterprise-Managed Authorization reaching stable turns this from a spec gap into an inventory job: the servers already running carry whatever scopes their tutorial suggested, and nothing re-asks them.

  For Security Engineers: List the credential scope each installed server actually requested and set it beside the calls it makes — a calendar server holding write and admin is the shape to look for. Routing survivors through the identity provider is the step after that list exists.

AI-assisted SDLC

• [2026-09-12] Spec-driven toolkits each prescribe one pipeline — Anthropic’s AI-Native SDLC Playbook, Amazon’s Kiro, GitHub’s Spec Kit — and no real organization runs one. The alternative on offer: model the pipeline as facts a change accumulates (reviewed, validated, approved), with rules naming which facts it needs and whether a human or a check supplies each. A docs fix merges on a green build; a payments migration waits for the payments owner. (source)

  A docs fix and a payments migration stop needing the same ceremony, which is the appeal. What it costs is emitting those facts somewhere a check can read them, instead of as a step someone remembers to perform.

• [2026-09-12] OpenAI hired Git AI’s founders, Aidan Cunniffe and Sasha Varlamov, onto the Codex team. Their open-source Git extension traces how much of a diff an agent wrote, how much of it survives to production, and where tokens went — across Codex, Claude Code, Cursor and Gemini CLI, plus background agents including Devin. The stated job now is ROI data for Codex buyers. (source)

  Git AI’s value was measuring Codex, Claude Code, Cursor and Gemini CLI on the same footing. ROI data for Codex buyers is a narrower job than that, and the tool’s cross-vendor half is the part with no stated future.

AI cost tracking & telemetry

• [2026-09-11] AWS makes the case that per-token price is the wrong unit and proposes cost per successful outcome — everything spent on right and wrong attempts, divided by the correct answers. On AIME, GPT-5.6-Luna worked out to $0.0021 a correct answer against $0.0139 for GPT-5.4-Mini; on DeepSearchQA agent runs the gap widened to $0.05 against $0.40. The agent figure is the one worth copying, since re-sent context makes a trajectory’s cost grow quadratically. (official)

  You can compute this on your own traffic without Bedrock: everything spent over a period, divided by the tasks that came out right. Deciding what counts as right is the hard half, and a benchmark hands you that for free where production does not.

Practice & craft

• [2026-09-11] NVIDIA put Personal AI Router into beta: a proxy that spreads local inference across whatever machines are on hand, matching each request to a node with the right engine and model loaded. It fronts Ollama and LM Studio, runs on Windows 11, Linux and macOS across x64 and arm64, and will mix operating systems in one pool. A demo spanning an RTX Spark laptop, a DGX Spark and a 5090 finished in roughly half the time one Spark took. (source)

  Matching a request to a node is scheduling, not splitting a model across machines, so the demo’s halved time came from work running side by side rather than one generation getting faster.

  For ML / Data Engineers: An eval sweep is the natural fit — point the harness at the router instead of a single Ollama host and the runs spread over whatever boxes are up, including ones running a different OS from the rest of the pool.

• [2026-09-11] Simon Willison’s find of the week is wrapture, Graham Dumpleton’s Python monkey-patching library, which does test doubles and New Relic-style tracing through the same mechanism. Patches are declared in TOML, so instrumenting code you don’t own takes no edits to it, and there is an OpenTelemetry exporter. Still alpha. (source)

  Declaring patches in TOML keeps the instrumentation outside the package it instruments, so upgrading that dependency does not carry your edits away with it. Still alpha, so this is a test-suite experiment rather than a tracing decision.

Research worth reading

• [2026-09-10] Agent benchmarks are easier to game than to run, and BenchShield puts numbers on it. From 31,000 agent runs across three benchmarks the authors hand-labelled 456 trajectories, then paired static taint analysis before a run with evidence-based detection during it. Full-chain recall went from 23–94% for existing scanners to 77–100%; runtime detection reached 96% accuracy at up to 65% lower cost per task. Worth reading if you score agents on a harness you wrote yourself. (source)

  Existing scanners ranged from 23% to 94% full-chain recall, so “we scan for this” tells you nothing until you know which end of that spread your own scanner sits at.

Watch list

• DeepSeek’s V4-Pro cutover. Tomorrow, noon Beijing time: deepseek-v4-pro calls start landing on V4.1-Flash at Flash billing.

  Last day to find the old model name in your own code while looking for it still proves something.

• AWS’s bedrock-agentcore namespace. Old namespace off Thursday; nothing left but the grep.

• OpenAI’s misalignment disclosure framework. Still unpublished; Senator Josh Hawley’s document demand is due October 1.

  Eighteen days to that deadline with nothing published, so the subcommittee’s questions look likely to arrive before the framework does.

• Answers to Amodei’s proposal. The first two steps need other labs to agree, and none has said anything. What settles it is a second frontier lab publishing its own pacing commitment, not a supportive quote.

  Silence a day in means little either way. Worth watching because a published commitment from a rival costs something, and agreeing in principle costs nothing.