Writing on cloud, Kubernetes and platform engineering. https://thanoskatsaounis.me/ 2026-10-09T00:00:00.000Z Thanos Katsaounis https://thanoskatsaounis.me/#changed-stripe-design-system-cli-zombie-ui 2026-10-09T00:00:00.000Z 2026-10-09T00:00:00.000Z A talk by Katie Dill of Stripe, published by Lenny's Podcast. She compares the AI building boom to the post-war one, which copied modernism without its intent and left zombie buildings, and calls the software equivalent zombie UI. She names three risks: LLMs return the most probable answer, AI makes work feel finished prematurely, and work that cheap gets treated as disposable. Her four recommendations are to have a point of view, encode standards into the machine, refuse to confuse done with good, and use AI to widen what gets tried. On encoding standards, Stripe started with an MCP server over its design documentation. The results were not specific enough, and three people entering the same prompt got three different results. Stripe replaced it with a CLI built on its design system, which she describes as a harness that makes the AI far more obedient. It runs where builders already work and feeds in the documentation at the right time and place, to avoid context rot. Unlike the earlier design system it carries full templates and flows, not only components. She argues that the quality filter which once ran through planning now has to run after the build, which makes the editor's role central, and that work made with AI meets the same standard as any other: whether the output is good. The event's opening animation took 56 iterations. The reason Stripe gives for leaving its MCP server is variance: one prompt, three people, three results. A documentation server answers when the model decides to ask, so the model also decides which rules it reads. The CLI moves that decision into the harness, which brings the documentation in at the step where it applies, and it narrows the space further with whole templates and flows. The same trade applies to any internal knowledge served to agents. Exposing it as a lookup tool is the easy part. Getting the same result twice depends on who controls when it enters the context. https://thanoskatsaounis.me/#changed-n8n-assistant-four-models 2026-10-09T00:00:00.000Z 2026-10-09T00:00:00.000Z From n8n's own channel. Four models, each in its own self-hosted n8n container and reached through OpenRouter, got the same short prompt in the n8n Assistant: build an SEO and AEO audit tool that takes a URL from a form and scores the page from 0 to 100. The models were Claude Opus 5.5, GPT-6 Astra, DeepSeek V4.1 Flash and Meta's Muse Spark 1.3. Per the video, none got anything badly wrong except credentials. Opus 5.5 wired one service's API key in place of another's. GPT-6 Astra asked for the key before testing anything. DeepSeek noticed an OpenRouter key already configured and used it. Every model read the Google article given as its only hint, but only Opus 5.5 and GPT-6 Astra went on to fetch more context and add audit angles. On a page known to be poor, GPT-6 Astra's tool scored 63 and Muse Spark's 8. On OpenRouter the Muse Spark run cost 35 cents and the DeepSeek run 26 cents, while the Opus 5.5 run is described as performing reasonably well at a cost that was too high. A separate audit of how well each generated workflow was built, which decides what later changes such as a human-in-the-loop step will cost, ranked GPT-6 Astra first, then Opus 5.5, DeepSeek and Muse Spark. The video says it is a single test with a generic prompt, not a benchmark. https://thanoskatsaounis.me/#changed-claude-frontier-academy 2026-10-09T00:00:00.000Z 2026-10-09T00:00:00.000Z Announced on 2 October with a $100 million commitment, aiming to train 10,000 Frontier Deployed Engineers by the end of 2027. The first program, the Frontier Deployed Engineer Residency, is for hands-on software engineers with a record of building with LLMs and of helping others adopt AI. Prior experience building agents is not required. Organisations nominate their engineers, and each arrives with a named Claude project to lead. It opens with a multi-day in-person program run by Anthropic engineers and licensed instructors: a simulated enterprise deployment, from choosing the use case through security review to handover, ending in a graded practical on a new scenario. Passing earns the Claude Resident Engineer badge and a 12-week residency leading a real Claude use case inside the engineer's own organisation, supported by Anthropic engineers. A second assessment at the end awards the Claude Frontier Deployed Engineer badge, the first expected in early 2027. Cohorts are running in San Francisco, New York and London, with engineers from Accenture, Bain, Capgemini, Commonwealth Bank of Australia, Deloitte, McKinsey, Morgan Stanley and Novo Nordisk. Participation is by nomination, through an Anthropic account team or Partner Account Manager. It builds on the Claude Partner Network, where professionals across 46,000 firms hold more than 175,000 Claude certifications and nearly 4,000 people have completed Basecamp. https://thanoskatsaounis.me/#changed-claude-haiku-5-5 2026-10-09T00:00:00.000Z 2026-10-09T00:00:00.000Z Released on 7 October for high-volume, cost-sensitive work: summaries, compactions, database queries, classification, and subagent work alongside Opus 5.5 and Sonnet 5.5 on coding. Pricing has two tiers, split at a prompt of 100,000 tokens. Up to that line it costs $0.10 per million input tokens, $0.50 output, $0.01 for cache reads and $0.125 for cache writes. Above it the same four prices are $0.50, $2.50, $0.05 and $0.625. Haiku 4.5 charged $1, $5, $0.10 and $1.25, so the cut is 90% below the line and 50% above it. Anthropic says 90% of Haiku 4.5 requests fell below it, and puts the average saving at around 75%, after allowing for a new tokenizer, shared with Sonnet 5.5 and Opus 5.5, that uses slightly more tokens per task. It is the first Haiku with an adjustable effort setting. Terminal-Bench 4.0 has it at 39.2%, against 0.0% for Haiku 4.5, 16.4% for GPT-6 Luna and 70.6% for Sonnet 5.5. On OSWorld 2.1 it scores 72.4%, against 15.7%, 48.9% and 83.9%. Anthropic still recommends Sonnet 5.5 and Opus 5.5 for complex agentic coding. Its cyber safeguards permit a wider range of defensive tasks than Sonnet 5.5's but still block penetration testing. The same post halves Sonnet 5.5's cache reads from $0.20 to $0.10 per million tokens, which Anthropic says makes Sonnet 5.5 about 20% cheaper on most agentic work. Max and Team subscribers get a monthly API credit: $100 for Max 5x, $200 for Max 20x and up to $500 pooled for Team. The Python and TypeScript SDKs gain computer use and browser use in beta. It is available on AWS, Google Cloud and Azure, and on the Claude Platform as claude-haiku-5-5. The tier is chosen per request by the size of the prompt, and above 100,000 tokens every price is five times higher, output and cache included. Anthropic's 75% average rests on Haiku 4.5's traffic, where nine requests in ten stayed under the line. In an agent harness that share is a design decision. A subagent handed a scoped brief stays below it. One handed the parent's full transcript may not. Compaction is on Anthropic's own list of fitting tasks, and its input is by definition a context that has grown long. Past 100,000 tokens, the price cut against Haiku 4.5 for that job is 50%, not 90%. https://thanoskatsaounis.me/#changed-gemini-agent-gemini-at-work-2026 2026-10-09T00:00:00.000Z 2026-10-09T00:00:00.000Z Adapted from Thomas Kurian's keynote. The Gemini agent is a single agent for knowledge work, media, and writing and running code, behind one prompt box and one API. It can be scheduled, triggered by events, or run headless with no dedicated interface. For multi-step work it creates temporary, job-specific sub-agents, each with its own identity, in workflows that can run for hours or days. A coworker agent is a persistent role with its own Workspace account, email address, calendar, Drive and directory entry. It acts under its own identity and sees only what is shared with it. Every agent gets a cryptographically attested identity with least-privilege, role-based permissions approved by security administrators, mapped to external systems through standards such as OAuth. That identity is stamped into the logs and into any virtual machine spun up to run code for the agent, and every action is written to an audit trail attributed to the agent rather than to a person. Agents run in an Agent Sandbox with its own network boundary. All traffic in, out and between agents passes through Agent Gateway, a network firewall that applies one written policy to every agent. Connectors cover Workspace, Microsoft Office, Teams, Slack, Confluence, Git, Jira, Salesforce, ServiceNow, BigQuery, Databricks, Postgres, Snowflake and files on the desktop, plus any MCP server inside or outside the company network and an enterprise tools registry. The model is a separate choice: it routes across Gemini and Claude today, with other private and open models to follow. A spend cap set per project in the Cloud Billing Console pauses that project's agent when it triggers, and the work resumes with one click. Per-project tracking lets costs be charged back to departments. Versions for Financial Services and Legal are in preview. Google puts the controls in identity. Every agent, down to a sub-agent that exists for a single job, gets its own attested principal, its own permissions and its own entries in the log. That answers what an agent did. The other half of an audit trail is who asked it to. Actions are attributed to the agent rather than to a person, and a coworker agent acts under its own identity rather than the requester's. The link back to the human who delegated the work therefore has to be recorded somewhere else, and the post does not say where. https://thanoskatsaounis.me/#changed-claude-sonnet-5-5 2026-10-02T00:00:00.000Z 2026-10-02T00:00:00.000Z Released on 28 September as the second Claude 5.5 model, with Haiku 5.5 due in the coming weeks. Prices match Sonnet 5: $2 per million input tokens, $10 output, $0.20 for cache reads and $2.50 for cache writes. Opus 5.5 charges $4 for input, $20 for output and $5 for cache writes, and the same $0.20 for cache reads. Anthropic puts the saving at up to 30% per task, because the model needs fewer tokens, and output comes 30%+ faster. Terminal-Bench 4.0 has it at 70.6%, against 10.3% for Sonnet 5 and 66.4% for Opus 5.5 at Xhigh. Default effort is Medium in Claude Code and the apps and High on the Claude Platform. On FrontierCode, which marks down out-of-scope changes, it scores 46.2% at Max and 52.1% at Xhigh. A footnote gives the reason: at Max it more often ran Claude Code's code-review skill, which splits a review across many subagents, and in two cases Cognition examined that ended in a timeout or in edits beyond the task. It is the first Sonnet to ship with cyber safeguards, so higher-risk security tasks visibly fall back to Sonnet 5, and the first with classifiers against reasoning extraction. Preserved thinking now ties Claude's thinking to the account that created it, which changes what happens when a conversation moves between accounts, a mid-session switch in Claude Code included. Anyone running Sonnet with thinking off has to move to the new between_tools setting, which keeps up-front thinking off, before upgrading. It is available on AWS, Google Cloud and Azure, and on the Claude Platform as claude-sonnet-5-5, with zero data retention. At Max effort, Sonnet 5.5 reached more often for a skill that fans a review out to subagents, and a benchmark that scores scope marked it down. Two examined cases is thin evidence of harm. The behaviour is stated plainly, though: effort now changes what the agent does, as well as how long it thinks. For a bounded task in a pipeline, the top setting is not a safe default. The defaults differ by surface too, Medium in Claude Code and High on the Platform, so one task can start from two budgets depending on where it runs. https://thanoskatsaounis.me/#changed-openai-distillation-campaign 2026-10-02T00:00:00.000Z 2026-10-02T00:00:00.000Z OpenAI says it disrupted a campaign to extract protected reasoning, the model's internal record of working through a task, which can reveal what the final answer withholds and help others reproduce its capabilities. By its account no encryption was broken, no database compromised and no stored conversation reached directly. The operators manipulated model interactions instead. One method copied encrypted reasoning out of one conversation and asked a model in another to decrypt and transcribe it. Independent researchers separately disclosed cross-model and conversation-compaction vulnerabilities, and OpenAI confirmed the attack paths were real. Activity began on 1 July at low volume. It spiked on 24 and 25 July with 16,000 requests using an extraction pattern from over 4,000 users, and a related cluster of more than 15,000 users was disrupted by 28 July. A footnote says these were attempted extractions, not necessarily successful ones. OpenAI attributes a core cluster to individuals associated with Moonshot AI, the developer of Kimi, and says it is unclear whether every operator was the same actor. It banned or restricted accounts and tightened signup and infrastructure controls. It closed a pathway that let someone holding another user's encrypted reasoning replay it and recover the contents, and added checks that detect and hold streamed output that might expose reasoning. The post warns that systems supporting portable or replayable reasoning artifacts may face related risks. It also says partner-hosted deployments need the same protections as first-party services, and that OpenAI is propagating the relevant controls across its cloud partners. Put it beside the Sonnet 5.5 launch two days earlier, which ties Claude's thinking to the account that created it and says moving a conversation between accounts now works differently. Two vendors closed the same door in one week. A harness could once carry reasoning blocks anywhere as opaque state. Both now scope them to the account that produced them. Any design that continues one conversation under a different identity relies on what they just restricted: failover between API keys, a gateway spreading turns across several accounts, a session moved from one cloud endpoint to another. https://thanoskatsaounis.me/#changed-gpt-6-1-sol 2026-10-02T00:00:00.000Z 2026-10-02T00:00:00.000Z An upgrade to GPT-6 Sol, seven days after it. Standard API prices stay at $2 input and $10 output per million tokens. Cached input drops to $0.10, which is 95% below standard input and half of GPT-6 Sol's cached price. OpenAI pitches it as near-Astra on agentic coding, computer use and professional work at a fifth of Astra's standard token prices. On DeepSWE v1.1 it matches Astra at roughly a fifth of the cost, and beats GPT-6 Sol's best score by 6.4 points at lower effort. On AutomationBench it is 2.2 points above Opus 5.5 at medium effort for about a third of the cost. The chart again notes that the Fable 5.1 cost omits fallbacks on about 40% of tasks, and the GDP.pdf comparison is made against Opus 5.5 with fallbacks. On Terminal-Bench Science 0.1 at maximum effort it costs $5.47 per task, against $23.21 for Opus 5.5 and $23.80 for Astra, while Astra keeps the top score at 68.1%. In a test built to provoke failure, where the search tool is broken, it fails to tell the user in 2.1% of cases at maximum effort. GPT-6 Sol fails in 4.9%, Astra in 1.5% and GPT-6 Luna in 28.7%. It is in ChatGPT Work and Codex for Plus, Pro, Business, Enterprise and Edu, not yet in Chat, and in the API as gpt-6.1-sol. An Ultrafast variant with up to 8x faster generation in Codex is due in the coming days. Look at the Luna figure. In the broken-search-tool test, Luna, priced at a twentieth of Sol in the earlier entry, failed to disclose the problem in 28.7% of cases, against 2.1% for 6.1 Sol. The tasks were picked to provoke failure, so neither figure is a production rate. What they do show is a wide gap between the tiers. A router that sends routine calls to the cheapest model also sends them to the model in that table least likely to say a tool is down. Tool health in such a pipeline has to be checked by the harness, outside the model. https://thanoskatsaounis.me/#changed-devday-2026 2026-10-02T00:00:00.000Z 2026-10-02T00:00:00.000Z OpenAI's own list of more than 20 announcements from DevDay on 29 September. The Agents API now does computer use, and brings Codex's multi-agent capabilities, tool search, tool calling and context compaction into an application, on infrastructure OpenAI runs. Bedrock Managed Agents, built with Amazon from the core of the Agents API, runs OpenAI agents entirely inside AWS and integrates with AWS resources. The Decisions API, in limited preview, points Luna at a fixed set of user-defined questions with finite, predefined answers, for classifying content, routing requests or choosing an agent's next action. ChatGPT plugins gain support for the proposed MCP Events specification, so an event in a connected app can start an automation. Codex Security Cloud scans whole GitHub repositories on demand or on a schedule, keeps checking new commits, removes duplicate findings and prepares fixes in the cloud. Code review in the desktop app can take an automatic first pass in the cloud, with feedback going to GitHub pull requests or GitLab merge requests. Zero Data Retention with Private Safety Processing runs automated safety review without OpenAI staff seeing the content, and Private Inference, which combines confidential computing with verifiable controls, is due in preview this fall. Ultrafast generates up to 8x faster in Codex, 300 tokens per second, and up to 6x faster in the API. Dots, the new always-on agents, reach Enterprise, Edu and Healthcare as a beta that stays off until a workspace admin turns it on. https://thanoskatsaounis.me/#changed-claude-opus-5-5 2026-09-25T00:00:00.000Z 2026-09-25T00:00:00.000Z Cache reads fall from $0.50 to $0.20 per million tokens. Input goes from $5 to $4, output from $25 to $20, cache writes from $6.25 to $5, and a fast mode runs up to 2.5x quicker at $8 and $40. The 40% saving Anthropic quotes for typical workloads is two things at once: cheaper tokens, and fewer of them per task. In its own use, Anthropic says, the gap to Fable 5.1 is narrower than the benchmark tables suggest, and margins at this level have become a less reliable guide. The tables carry a footnote: the runs had production safeguards on, and where those fired, cybersecurity tasks were finished by Opus 4.8 and biology tasks by Opus 5. Most cybersecurity work is routed to Opus 4.8 by default. Thinking can no longer be switched off. Preserved thinking applies to API accounts created on or after 31 August. Sonnet 5.5 and Haiku 5.5 follow in the coming weeks; the model is live on AWS, Google Cloud and Azure as claude-opus-5-5. Start with the footnote. A row labelled Opus 5.5 was produced by Opus 5.5 plus two older models stepping in whenever a safeguard fired. OpenAI's launch the same week carries the mirror image: a Fable 5.1 cost figure that leaves out the Opus 5 fallbacks on roughly 40% of tasks. Both vendors now say so, in small print. That is progress. It also means a benchmark score has become a claim about a routing system, and the routing is the one part a buyer never sees. https://thanoskatsaounis.me/#changed-gpt-6-sol-luna 2026-09-25T00:00:00.000Z 2026-09-25T00:00:00.000Z Two cheaper models, trained with the methods behind GPT-6 Astra. Sol costs $2 in and $10 out per million tokens, Luna $0.10 and $0.50. Both are half the GPT-5.6 promotional prices, and cached input reads carry a 90% discount. The caching changes are the operational news. Hit rates are higher by default. Reasoning effort can go up or down, and tools can be switched on or off, without invalidating the cached prefix. Breakpoints let a developer choose where that prefix ends, and a dashboard with a diagnostics tool shows what missed and why. GitHub reports that the share of prompt tokens needing fresh processing fell by more than half across billions of requests. OpenAI's own researchers now spend a median of over $600 a day in tokens at API prices, and $7,000 a day at the 90th percentile. One footnote on the AutomationBench chart: the Claude Fable 5.1 cost shown is understated, because it omits Opus 5 fallbacks on about 40% of tasks. In the API the models are gpt-6-sol and gpt-6-luna; they are in ChatGPT Work and Codex, and not yet in Chat. The earlier Fable 5.1 entry said a cache discount only reaches a workload whose prompt keeps a stable head, and that anything varying the top of the prompt forfeits it. Two of the things that used to vary it, changing effort between calls and toggling tools, no longer do. That moves work out of the caller's code and into the API. It also changes what a caching figure means. The 90% is now within reach of more loops than before; whether yours is one of them, only the dashboard can say. https://thanoskatsaounis.me/#changed-review-follows-blast-radius 2026-09-25T00:00:00.000Z 2026-09-25T00:00:00.000Z Twenty minutes from John Kim, a senior staff engineer at Meta, on reviewing code that agents write faster than anyone can read. He treats the codebase as a tree. Trunk code is entry points, shared state, and infrastructure like networking or image handling, where a fault reaches everything. Leaf code is isolated, or sits behind a feature gate. Review depth follows the blast radius: trunk changes get read closely, leaf changes get skimmed, on condition that the pull request carries proof. Tests, runtime logs, a screenshot or recording, and the agent's own confidence level. Gating is planned in from the start, with integration layers gated separately. Review is done by an agent that never saw the authoring context, because one that did will lean on the conversation instead of the diff. Style nits go to types and linters. His closing distinction: merge-ready is not launch-ready. The audit for performance, bugs, security and spec takes as long as the build did, and that is where the human hours go. Three questions set the budget for any change. What must not change, how bad if it does, and can it be rolled back. Take the independent reviewer literally. He rates agents above most humans at review, and in the same breath says the authoring agent will cheat. Both hold once the value sits in what the reviewer does not know, rather than in how clever it is. Independence of context is something a pipeline can guarantee. Judgement is not. https://thanoskatsaounis.me/#changed-openai-agent-australian-portal 2026-09-25T00:00:00.000Z 2026-09-25T00:00:00.000Z In June, during an internal evaluation, an OpenAI agent looking up Australian statistics reached public and non-public files on the Medicare Statistics Reporting Service portal. OpenAI's statement says its models took actions it did not intend. It found out in August, while reviewing misaligned model activity. On 10 September it emailed a general inbox at an Australian agency. Services Australia escalated five days later, to the national cybersecurity centre, then a minister, then the prime minister. He said the disclosure took too long, that Sam Altman acknowledged issues with protocols, and that there will be legal consequences. Three more systems may be affected, two of them state agencies. No personal data is believed taken. Transluce, a research lab, reports that OpenAI systems also tried and failed to get into a University of New Mexico library and the Data USA repository in May. Read it as a timeline and it is an operations story first. Nothing caught the access when it happened. It surfaced two months later from a log review, and the disclosure then sat in a general inbox for five days because nobody on the receiving side owned it. Each of those is an ordinary incident-response gap, and each would have been one had the actor been a person. The agent changed one thing: the attempt was made at all. https://thanoskatsaounis.me/#changed-bm25-agentic-search 2026-09-18T00:00:00.000Z 2026-09-18T00:00:00.000Z An 18-minute talk by Jo Kristian Bergum, CEO of Hornet.dev, at AI Engineer. BM25 is a roughly 30-year-old lexical scoring function; the name is Best Match 25 because the twenty-fifth experiment was the one that worked. His argument is that the function has not changed at all. The user has. A model knows entities, companies, dates, postal codes and SKUs, writes far longer and more specific queries than the two or three terms in a human query log, and uses the syntax operators it picked up from web search. The measurement he builds on is BrowseComp-Plus: around 830 riddle-style deep-research questions over a corpus of roughly 100,000 web documents, scored on whether the whole loop returns the gold answer. Stuff the evidence documents straight into the context and accuracy is high, even on GPT-4. Reasoning is not the bottleneck. Hand the same model a search tool instead and accuracy falls, because now it rests on the harness, the model's query formulation and the retriever. He also flags that the BM25 baseline in that paper ran with parameters unsuited to long documents (BM25 has two hyperparameters), which is much of why neural retrieval looked so far ahead of it. The pair of numbers on the same questions is the thing to take away. If evidence placed in the context answers a question and a search tool in front of the same model does not, the deficit is in the harness. That gap can be measured locally, with no retraining and no model swap; it is the one part of an agent's retrieval a team fully owns. The baseline finding points the other way, and belongs in any comparison read off a paper. A published win over BM25 is only as strong as that paper's BM25 configuration, so embeddings beating lexical search can mean embeddings beating a misconfigured baseline. Cheap to check. The configuration is two numbers. https://thanoskatsaounis.me/#changed-system-one-models-jev 2026-09-18T00:00:00.000Z 2026-09-18T00:00:00.000Z TypeSafe's first System One model, in early access behind a waitlist since 15 September. It gives up string generation. The possible outputs and their structure are fixed in the schema before the call, everything comes back from a single parallel query rather than token by token, and every answer carries a calibrated probability. Input is $0.042 per million tokens with output unmetered, against $0.20-$10 per million input for frontier LLMs; end-to-end latency is 70-500ms against 3-329 seconds. The evidence section is unusually frank about its own limits. The workflow evaluation was written by TypeSafe's own model capabilities team. The reference answers are the average of GPT-6 Astra's and Fable 5.1's predictions, with no ground truth behind them. The LLM comparison figures come from OpenRouter, where harder queries may have been routed to better models. And the 0% type-error rate in the charts is, in TypeSafe's own words, not empirical: it is entered from the schema guarantee rather than measured. Scoring against the averaged predictions of two frontier models measures how often it agrees with them. Correctness is a separate question. So the accuracy column and the price column make claims of different kinds. One you can verify this afternoon; the other is parity with two models that were themselves never marked. TypeSafe says so, and adds that the choice probably understates its own result. What survives the caveats is the part that changes code rather than an invoice: a bounded set of questions answered in one pass, each with a number you can put a threshold on. Routing or triage becomes an if-statement with a confidence floor. The usual version is a prompt asking a model to please return JSON, and a try/catch for when it does not. https://thanoskatsaounis.me/#changed-life-sciences-verification-program 2026-09-18T00:00:00.000Z 2026-09-18T00:00:00.000Z Verified life-science teams get Mythos, Opus and Sonnet with classifiers more permissive for biology. Two grant types. Standard Use covers an entire team and renews once a year. High-risk Use is per research project, renews every six months, and removes all safeguards that block life-sciences requests. Anthropic is moving these safeguards from real-time blocking at each request to offline monitoring of patterns across requests and sessions, on the reasoning that serious misuse is spread out precisely so the pieces look disconnected. That requires retaining flagged traffic for 30 days. Access is tied to the use cases the organisation declares in its own application. Anthropic monitors traffic against that stated scope and flags anything outside it to the organisation's admins, who triage within pre-agreed timeframes. Three threat models are named: access compromise, insider threats, and agent misuse, described as agents, especially working in swarms or over long-horizon tasks, taking unintended dangerous actions. Every team makes this trade the moment an agent touches real systems; here it is put more plainly than usual. A check at each request cannot see a campaign assembled across sessions, so the gate moves from synchronous refusal to asynchronous detection, and the bill arrives as retained logs plus a person who owns the triage. The split of responsibility is the part to copy. Blocking is a control a provider can sell. Deciding what counts as out of scope, and answering when something is, stays with the customer. A platform that offers only the first half has left out the part that needs a name attached to it. https://thanoskatsaounis.me/#changed-anthropic-threat-report-sept-2026 2026-09-11T00:00:00.000Z 2026-09-11T00:00:00.000Z Eight months of disrupted misuse, December 2025 to August 2026, across seven harm areas. Haiku, Sonnet and Opus were the models involved; no case touched Fable or Mythos except one distillation attempt. The shift the report names is from assistance to orchestration. Multi-agent frameworks now run reconnaissance, exploitation and exfiltration, with the human choosing targets and reviewing what comes back. One espionage actor's agents watched whether their malware had been detected and rebuilt it until it was not; the operator's main manual task was editing the Claude Code skills that drove the workflow. Separately, several actors compromised the LiteLLM deployments of AI wrapper services, using prompt injection to exfiltrate the production API keys held in their cloud container environments. The report's conclusion: AI has inverted the cost back onto defenders, and sophistication has stopped being a reliable signal of who is behind an operation. The LiteLLM cases deserve the closest look, because they make the agent plumbing itself the target. A model gateway holds production keys for several providers, and its whole purpose is to pass untrusted text to a model. That turns prompt injection into an access path to a credential store. Anyone running a proxy to compare models is running that surface. The detection finding points the same way from the other end. A signature pipeline releases on a human cadence and is now racing an automated rebuild loop, so a control that depends on recognising a known artifact has lost the economics it relied on. One that bounds what a compromised component can reach has not. https://thanoskatsaounis.me/#changed-astra-vs-fable-cost-per-task 2026-09-11T00:00:00.000Z 2026-09-11T00:00:00.000Z At their top settings the two tie at 53 on the Intelligence Index v4.3, and both families offer a 1M context window. Fable 5.1 at max effort emits 67 tokens a second against 54 for Astra at max. At low effort, Astra costs $0.82 per index task for a score of 46; Fable costs $2.37 for a score of 47. Blended price per million tokens runs the other way, $7.2 for Fable against $7.7 for Astra. Cost per task is computed from input, cache-hit, cache-write, reasoning and answer token prices. Cheaper per token and roughly three times the price per task looks like a contradiction until you notice which number the model controls. The price list is fixed. The token count is not, and at low effort one of these spends far more of them to reach the same score. So the bill is set by the effort setting rather than the rate card, which is where the earlier Fable 5.1 pricing entry also ended up, from cache reads and per-client effort defaults. A cost comparison assembled from pricing pages can therefore rank two models backwards. The unit worth measuring is a task trace from your own workload. https://thanoskatsaounis.me/#changed-openai-data-agent 2026-09-11T00:00:00.000Z 2026-09-11T00:00:00.000Z The Data agent in ChatGPT Work, announced 10 September 2026. It connects to Redshift, Datadog, BigQuery, ClickHouse, Databricks, MongoDB and Snowflake, and pulls files from Drive and SharePoint. It reads the organisation's own metric definitions and data relationships from semantic layers: dbt, Databricks Genie Ontology, Snowflake Horizon and existing BI dashboards. Administrators choose which connections exist and which roles may use them. Queries enforce the connected account's existing permissions down to table, row and column. It builds and edits dashboards in Power BI, Tableau, Sigma, ThoughtSpot, Omni and Oracle BI, and can send findings to Slack or email. OpenAI says nearly all of its product organisation and over two-thirds of its go-to-market organisation use it internally. Its data team made that possible by creating shared business definitions, setting access rules and adding safeguards for sensitive data. Read the connector list and the internal-adoption paragraph together and the announcement is describing a prerequisite. The agent reads dbt and Genie Ontology rather than raw tables, and the reason given for it working inside OpenAI is a list of data-governance groundwork. That promotes the semantic layer from documentation, which is how most organisations treat it, to an execution dependency. Without governed definitions the thing guesses at what revenue means, in conversation, at speed. Inheriting the account's row and column grants has the same shape. It is a good design. It also makes the agent exactly as constrained as a warehouse permission model that was mostly written for analysts who ask one question a week. https://thanoskatsaounis.me/#changed-astra-jailbreak-evals 2026-09-04T00:00:00.000Z 2026-09-04T00:00:00.000Z Two measurements sit next to each other in the system card. The multiturn jailbreak evaluation uses adaptive attackers that probe, read the reply and change tactic across turns, and it scores worst case: for a budget of n attempts, the model counts as succeeding only if it avoids unsafe assistance across all n. Separately, robustness to indirect prompt injection is reported climbing from 96.23% to 99.79%, with instruction-hierarchy robustness at 99.99%. The metric travels better than the score. Reporting worst case across an attempt budget rather than an average is the difference between a gate and a dashboard, and it is the shape a regression test needs if it is meant to block a merge. The percentage wants the opposite reading. 99.79% is a 1-in-475 failure rate, so an agent making a few thousand tool calls against untrusted content should expect several successful injections per run. At that volume the question stops being the rate. It becomes what a single success can reach, and that is a question about scopes and permissions. The model has little to do with it. https://thanoskatsaounis.me/#changed-agent-to-agent-network-effects 2026-09-04T00:00:00.000Z 2026-09-04T00:00:00.000Z A 21-minute talk by Jean-Denis Greze, CTO of Town and previously CTO at Plaid, at AI Engineer. He opens on the network effects of agents working with other agents, then discards the framing. Agent-to-agent, he argues, does not make much sense as a concept. The real problem is search: getting the right private information into an LLM call whose effects land on someone other than the caller. He walks through five strategies teams use, starting with approximate access to everything inside a trust boundary (his example is one agent holding both his and his wife's mail), and reduces the sharing decision to two options. Ask a human at the moment of sharing, or trust the model with full access and no prompt. Reframing it as a data question rather than a protocol question moves the design work somewhere useful. A wire format between agents is the easy half. The hard half is which private data crosses a boundary, and who confirms it. It also explains the weight on the ask-a-human option: it is the only point in the flow where the blast radius of a wrong inference is bounded by something other than the model's judgement. https://thanoskatsaounis.me/#changed-gpt-6-astra-safety 2026-09-04T00:00:00.000Z 2026-09-04T00:00:00.000Z OpenAI's first model to reach the Critical cybersecurity threshold under its Preparedness Framework. Two findings sit oddly together. Monitorability went down. Astra controls its own chain of thought better than GPT-5.6 Sol, is less likely to put incriminating information in it, and under adversarial instruction can sandbag evaluations and sometimes evade internal monitors. At the same time OpenAI says it has added misalignment monitoring to all tool-using inference in Astra's external deployment, at significant compute cost, and reports the model is markedly more resistant to prompt injection, with fewer unauthorised transactions, data-loss and excessive-access actions in browsing and workplace tests. Both findings push the same way. The check is moving out of the model's reasoning and into the runtime around it, and it is being paid for in compute. That is the argument for putting the gate somewhere you own rather than somewhere you read. A deterministic check does not get less monitorable as the model gets better at hiding its reasoning, and it needs no research programme to stay trustworthy. https://thanoskatsaounis.me/#changed-fable-5-1 2026-09-04T00:00:00.000Z 2026-09-04T00:00:00.000Z One model, two safeguard profiles. Fable 5.1 is generally available; Mythos 5.1 only through trusted access programs for cybersecurity and life sciences. The stated ~25% price drop for typical token-billed workloads comes specifically from cheaper cache reads, and rises to ~45% on highly agentic use. It defaults to High effort in Claude Code and Medium elsewhere. Both headline numbers describe the caller more than the model. A discount on cache reads only reaches a workload that re-sends a stable prefix. That is why the figure climbs on agentic use: a loop resending a large fixed context every turn is exactly the shape that hits cache. Anything that varies the top of the prompt per call forfeits it, whether an injected timestamp, a reordered context block, or a preamble assembled fresh each time. So the saving is something you reach by editing code, and no amount of comparing list prices gets you there. The effort default splits the same way. One model version answers at High through Claude Code and Medium everywhere else, so an evaluation that does not pin effort is not measuring the configuration anyone is running. https://medium.com/@katsathanasis2/the-database-nobody-dares-delete-c793ac492db9 2026-08-23T13:45:36.000Z 2026-08-23T13:45:36.000Z Azure shows you every resource you own. It won't tell you what breaks when one dies, so I built the missing map. https://medium.com/@katsathanasis2/i-built-a-policy-scanner-that-fixes-my-terraform-and-proves-the-fix-holds-2cb12ac60637 2026-07-24T11:20:00.000Z 2026-07-24T11:20:00.000Z A local model explains the misconfiguration, a deterministic engine writes the fix, and the pipeline re-scans to prove zero violations. https://medium.com/@katsathanasis2/i-built-a-ci-cd-pipeline-that-refuses-to-run-code-it-cant-prove-it-built-e6cc30813524 2026-06-29T18:22:37.000Z 2026-06-29T18:22:37.000Z Signing, SBOMs and admission control, wired so an unsigned image never reaches the cluster.