|
|
TOOL
MAJOR
2026-09-10
OpenAI Agents API — the Codex harness opens up to developers
The harness behind Codex, now a managed API: OpenAI runs the agent loop, your app brings the tools.
What is it?
The Agents API hands applications the same managed harness that runs Codex. OpenAI keeps the session alive, compacts the context when it fills up, and recovers after failures — while your app supplies the instructions, tools and MCP servers. Public beta opened on September 10, 2026.
How does it work?
Four objects make up the design: an Agent (model, instructions, tools, MCP servers), an optional Environment sandbox, a durable Session, and the events that session streams back. Sandboxes run either on OpenAI's infrastructure or your own, and every call carries the header OpenAI-Beta: agents=v1.
Why does it matter?
Teams building long-running agents normally write the hard parts themselves — resuming sessions, trimming context, retrying after crashes, coordinating subagents. Moving all four to OpenAI costs nothing beyond normal model, tool and container rates.
Who is it for?
Developers building long-running agents. Note: US data residency only, no zero data retention during beta.
|
|
|
|
MODEL
MAJOR
2026-09-10
SWE-2 — Cognition's coding model lands within a point of Fable 5.1
SWE-2 post-trains Moonshot's Kimi K3 with reinforcement learning and lands near frontier coding scores for a fraction of the price.
What is it?
SWE-2 is Cognition's new coding model, post-trained from Kimi K3 (Moonshot AI's 2.8-trillion-parameter open model) with reinforcement learning. It scores 50.0% on FrontierCode 1.1 Main against 50.9% for Fable 5.1 — and costs 64% less.
How does it work?
Configurable reasoning-effort levels are trained inside a single RL run using a linear cost penalty per effort level, so the whole cost-performance curve shifts instead of one point on it. Users pick the effort level that fits their budget per task.
Why does it matter?
On FrontierCode 1.1 Main, SWE-2 medium scores higher than SWE-1.7 while taking 58% fewer turns and costing 81% less on average — changing what a long agent run actually costs to finish.
Who is it for?
Teams running Devin on production codebases. Available in Devin Desktop and CLI now, rolling out to Devin Web and Fusion.
|
|
|
|
MODEL
MAJOR
2026-09-10
GPT-Live-1 in the API — full-duplex voice for $0.05 a minute
OpenAI's full-duplex voice model reaches the API, so any app can listen and talk at the same time.
What is it?
GPT-Live-1 arrived in the OpenAI API on September 10, 2026, after powering ChatGPT Voice since July. It takes audio or text in both directions and is built for conversations where both sides can speak at once instead of strictly taking turns.
How does it work?
Full duplex means the model keeps listening while it is still speaking, so a caller can cut in mid-sentence and the reply stops and adapts. Heavy thinking delegates to backend models and tools it is paired with; it supports streaming and function calling so live conversations can trigger real work.
Why does it matter?
Voice agents have felt stiff because turn-taking models make callers wait for a whole reply before interrupting. A per-minute price ($0.05/min billed by the second) puts a conversational layer within reach of support lines, tutors and phone assistants that need to cost out a call.
Who is it for?
Teams building voice agents. Tier 1 gets 25 concurrent sessions, Tier 5 gets 500; not available on the free tier.
|
|
|
|
MODEL
MAJOR
2026-09-10
North Small Translate — Cohere's open translation model beats DeepL on WMT26
Cohere Labs opens the weights of a 218B mixture-of-experts model built only for translation across 50 languages.
What is it?
North Small Translate is Cohere Labs' first translation-only model, with weights public on Hugging Face. It's a sparse mixture-of-experts decoder with 218B total parameters but only 25B active per token — so it runs far cheaper than its size suggests, across 50 languages.
How does it work?
Only 25B of the 218B parameters fire for any given token. Three quantization builds (BF16, FP8, NVFP4 W4A16) mean the smallest fits on a single B200 or two H100s. An optional agentic mode runs a second self-correction pass, lifting WMT26 from 83.60 to 84.36.
Why does it matter?
Cohere puts a model that outscores DeepL NextGen (81.37) and Google Translate (68.20) into researchers' hands under an open licence. The lead is widest on long documents: North Small Translate scores 48.9 versus Google Translate's 21.3.
Who is it for?
Localisation teams and multilingual NLP researchers. Weights are CC BY-NC 4.0 (non-commercial); commercial access goes through RWS Language Weaver.
|
|
|
|
MODEL
MAJOR
2026-09-11
Fugu Max and Fugu Ultra v2 — Sakana's router splits into cheap and strong
Sakana AI splits its Fugu orchestrator into a cheap tier and a high-capability tier, both behind one OpenAI-compatible API.
What is it?
Fugu Max is the budget end of Sakana AI's orchestrator family — it sends each task to the leanest model that can solve it, at $2/M input and $6/M output tokens. Fugu Ultra v2 takes the high-end, targeting autonomous research and software development. Neither is a single foundation model.
How does it work?
The orchestration engine reads a query, builds an agent scaffold, and routes work across a pool of open-weight and specialist models including NVIDIA Nemotron. Fugu Ultra v2 reaches 48.3 on Chartography (vs Opus 5's 27.3) without using Fable 5, Fable 5.1 or GPT-6 Astra in the pool.
Why does it matter?
Two price points now sit on the same API, so a team can trade cost against capability with a single-line parameter change. Sakana puts Fugu Max's output price 40–60% below Sonnet 5, GPT 5.6 Terra and Kimi K3.
Who is it for?
Teams paying per token for agent work. Available via console.sakana.ai, OpenRouter, and the Vercel AI Gateway. Existing Fugu users switch with a one-line parameter change.
|
|
|
|
SECURITY
MAJOR
2026-09-10
Anthropic threat report — attackers now let Claude run whole intrusions
Anthropic's Threat Intelligence team names four cyber groups that let Claude plan and carry out intrusions end to end.
What is it?
Four named cyber operations anchor Anthropic's September 2026 threat intelligence report, documenting misuse disrupted between December 2025 and August 2026 across seven harm categories: cyber operations, surveillance, influence operations, conventional weapons, biological misuse, scams, and fraud.
How does it work?
The pattern the report calls "vibe hacking": give the model a general goal, let it survey the environment, write and run scripts, summarise findings, and repeat. One Chinese cluster ran agent swarms doing parallel reconnaissance and surfaced over a dozen possible zero-day findings in a single month.
Why does it matter?
One case targeted the AI supply chain itself: attackers injected malicious instructions into an AI vendor's evaluation sandbox to steal production API keys, then probed ~30 AI companies in four days seeking pre-release Claude access — an attempt Anthropic says failed. IoCs are published for defenders.
Who is it for?
Security teams and threat intelligence analysts. The full PDF includes domains, IPs, file hashes, Telegram IDs, and malware names (PowerChrome, WUEngine, DarkSword, GiftDrop).
|
|
|
|
SECURITY
MAJOR
2026-09-11
Datasette 1.0a39 and 0.65.4 — security fixes from a coding-agent audit
Datasette's first thorough coding-agent security audit turned up subtle permission bugs, now patched in two releases.
What is it?
Datasette 1.0a39 and 0.65.4 fix bugs that could let a visitor read data they should not see — mostly in permission checks. Table and view names are now matched case-insensitively, full-text search index tables require permission on the source table, and sqlite_stat tables are denied by default.
How does it work?
An initial community report prompted Alex Garcia and Simon Willison to audit the codebase with Claude Fable 5.1, GPT-5.6 Sol and GPT-6 Astra across several rounds. One person wrote an automated test proving each issue; the other wrote the fix — two humans reviewed everything alongside the agents.
Why does it matter?
Anyone running Datasette on the public internet should upgrade now, especially if an auth plugin protects private tables next to public ones. The broader point: this coding-agent audit surfaced real, subtle bugs that had survived years of ordinary review.
Who is it for?
People self-hosting Datasette. Both lines are patched — stay on 0.65.4 or move to 1.0a39, either way run pip install -U datasette.
|
|
|
All releases at ai-tldr.dev
Simple explanations • No jargon • Updated daily
|
|
