Agents of Work
Let's Talk
September 23, 2026 · Agents of Work

Agents of Work AI Daily Briefing — September 23, 2026

Anthropic and OpenAI released new models about 90 minutes apart on Tuesday, and both cut prices hard. It is the clearest sign yet that the cost of capable AI is still falling fast. Meta's Muse agent had a rough day: internal messages show some of its "AI" phone calls were placed by people in a call center, and a security researcher showed how malware on a Mac could take over the app. Microsoft took down an AI-powered phishing service that had broken into more than 12,000 business inboxes, and Cisco found malware that asks four chatbots to vote on its next move. Sam Altman and Dario Amodei brief the UN Security Council today. In Physical AI, the big names in robot software are giving more of it away, Cognex is paying $500 million for Intel's old depth-camera business, and Unitree put a price on a human-sized robot hand.

Two flagship models, two price cuts, one morning

Anthropic released Claude Opus 5.5 on September 22 at $4 per million input tokens and $20 per million output, down from Opus 5's $5 and $25. The bigger cut is on cache reads, the text a model has already seen and is sent again on each turn of a long job. Those now cost $0.20 per million, 60% less than before. Anthropic says that on typical workloads Opus 5.5 costs 40% less to run than Opus 5 and produces output more than 30% faster. It also says the model performs at the level of its top model, Fable 5.1, on most work.

Anthropic's own numbers put Opus 5.5 at 66.4% on Terminal-Bench 4.0, a test of command-line work, against 52.3% for Opus 5, 55.8% for Fable 5.1 and 57.9% for OpenAI's GPT-6 Astra. It scores 81.8% on the OSWorld 2.0 computer-use test. The evaluation group METR and Frontier Design tested it before release, and Anthropic reports an 85% drop in attempts to get around its boundaries compared with Opus 5. A GitHub executive quoted in the launch said it "solved more terminal tasks than Opus 5 in less than half the steps." Optiver's head of AI engineering described cutting the cost of one workload "by 40 to 50%."

About 90 minutes later, OpenAI released GPT-6 Sol and GPT-6 Luna. Sol costs $2 input and $10 output per million tokens, half the $4 and $20 of the GPT-5.6 model it replaces. Luna costs $0.10 and $0.50, down from $0.20 and $1.20. An OpenAI spokesperson told VentureBeat the prices are permanent, not an introductory offer. OpenAI positions Sol for coding, code review and data analysis, and Luna for high-volume routine work like summaries and pulling data out of documents. On its internal tests, OpenAI says Sol makes about half as many factual mistakes as its predecessor and approaches Astra's reliability. Both are rolling out in ChatGPT, Codex and the API, and free ChatGPT users can reach Luna through the desktop app.

A warning on the scorecards. Each company tested against the rival models that existed before Tuesday, so neither has a clean comparison with the other's new release. Anthropic's own table still shows GPT-6 Astra ahead on a couple of tests. Treat every number here as the vendor's own claim until independent tests arrive.

For business owners, the price is the real news. Anthropic's pricing post walks through the math: in a long session where 90% of the input is cached, 2.8 million input tokens cost about $1.62 instead of $11.20 without caching. The same task at the same token count is about 31% cheaper on Opus 5.5 on price alone. If you priced out an AI workflow six months ago and decided it was too expensive, run the numbers again.

Muse's human callers and a Mac backdoor

Meta has promoted Muse as an agent that can phone a business to book a table or a haircut. 404 Media reported that internal posts show Meta "added a human agent layer for calls to get completed," meaning a trained human agent sometimes places the call. Testers were told only afterward that a person had made the call. "This has potential for so much negative PR," one employee wrote. "It could portray us as 'their AI is not good enough so they still need humans.'" Another pointed out that testers had shared details on the assumption that only the AI would hear them. Meta said internal testing "is core to product development" and that it will roll the feature out only "with proper disclosures."

Separately, security researcher Patrick Wardle published a proof of concept on September 21 showing that malware already on a Mac could change a hidden Muse setting and send the user's voice dictation to an attacker's server. From there an attacker could read prompts, slip in instructions Muse would obey, steal the login token, and use every permission the user had granted the app, including control of Muse on the user's other signed-in devices. Wardle said it is "trivial to turn Muse into the ultimate backdoor." Meta pushed an update, but has published no security advisory. The attacker needs code on the machine first, but Wardle noted that ClickFix tricks, which fool users into pasting commands into Terminal, can do that.

For small offices, both stories point the same way. A desktop agent with access to mail, files and messages is a privileged account and should be treated like one. And "AI" features may involve people you can't see.

AI-powered phishing, now a subscription

Microsoft's Digital Crimes Unit said it seized 50 websites and disabled more than 150 other domains behind EvilTokens, a cybercrime service sold on Telegram for $1,500 up front plus $500 a month. It compromised more than 12,000 email inboxes at more than 10,000 organizations. Wholesale distribution, construction, financial services, real estate, higher education and healthcare were among the hardest-hit sectors. The trick did not need passwords. Victims were talked into typing an authentication code into a real Microsoft sign-in page, which handed over access that could survive a password reset unless sessions and tokens were revoked. Once inside, AI read the mailbox, mapped who reported to whom, and suggested who to impersonate. "AI was not simply helping attackers write more convincing messages," wrote Steven Masada of Microsoft. "It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship." London's Metropolitan Police arrested two men on September 11.

Cisco Talos, meanwhile, documented CLOSEDQUORUM, Windows malware that asks DeepSeek, Qwen, Mistral and Gemini what to do next and follows the majority vote. It goes after Windows logins, saved browser passwords and crypto wallets. The sample Talos studied had placeholder keys and could not run as found, and there is no confirmed use in the wild. Talos also released CAIRN, a free toolkit for spotting AI-driven malware.

What AI support actually costs

xAI published figures from its own customer support desk. It says its Grok Bot resolves tickets for $0.20 to $0.30 each, against $1 to $4 for typical AI support tools, and handles 99% of refund requests without a person. It says ticket volume rose 175% with no new hires, where it estimates it would otherwise have needed 200 more people. These are a vendor's numbers about its own product, with no data on escalations or customer satisfaction. Still, they give a small business a useful target when a support-software vendor quotes a price per ticket.

xAI's assistant also moved into cars. Tesla added Grok Bot on September 22, letting drivers order coffee, manage email and calendars, and shop online by voice. For now it is limited to SuperGrok Heavy subscribers.

The humans behind the training data

404 Media also reported that OpenAI contractors hired through Mercor to grade ChatGPT's answers were fired for using AI to do the grading. The rules were explicit: "Reviewers may not use AI either, including Grammarly." Reviewers spotted violators through repeated phrasing, heavy punctuation and suspiciously fast work, and the projects involved more than 10,000 contractors. OpenAI declined to comment. The market for that human work is booming: Snorkel AI raised $350 million at a $3.5 billion valuation, nearly triple its value 17 months ago, on an annual revenue pace of $375 million, up eighteenfold in a year.

At the Security Council

France's foreign minister, Jean-Noël Barrot, chairs the Security Council's high-level briefing on AI and international security today. The briefers are Yoshua Bengio, co-chair of the UN's scientific panel on AI; Sam Altman; Dario Amodei; and Hugging Face CEO Clément Delangue. France's concept note focuses on AI systems attacking critical infrastructure and on systems that can improve themselves. It is a briefing, not a vote, and Council members are expected to agree that safeguards are needed while still disagreeing over who should enforce them and what role the Council itself should play.

Physical AI

The week's biggest robotics story is software, and much of it is now free. At ROSCon 2026 in Toronto, Alphabet's Intrinsic released Intrinsic Core under the Apache 2.0 license, which allows commercial use. It includes a real-time control framework that works across hardware, pose estimation built on NVIDIA's FoundationPose, collision-free motion planning, grasp planning, Gazebo simulation, automatic camera calibration and ready-made drivers. It ships with a reference app for CNC machine tending on FANUC and Universal Robots arms, the kind of job a machine shop might automate first. NVIDIA released Isaac ROS 5.0 at the same event, adding tools that let AI coding agents set up and program robots, running on hardware from the entry-level Jetson Orin Nano up to Jetson Thor. It says ROS now has nearly 1.3 million users.

Qualcomm also announced it is buying PickNik Robotics, the steward of MoveIt, one of the most widely used open-source frameworks for robot arm motion planning. Terms were not disclosed, and Qualcomm says MoveIt stays open source under its current licenses. "Software is the connective tissue that turns great hardware into great robots," said Qualcomm's Nakul Duggal. For a small manufacturer, free software does not make a robot cheap. Integration, fixtures and safety work still cost money. But it lowers the cost of trying one, and it means less dependence on a single vendor.

Robot vision is consolidating. Cognex, the machine-vision company, agreed to buy RealSense, the depth-camera business Intel founded in 2014 and spun out in 2025, for $500 million in cash, plus roughly $107 million in retention pay and stock for employees over three years. RealSense cameras help robots see depth, navigate and avoid collisions, in everything from fixed arms to humanoids. The deal is expected to close in the fourth quarter. If your robots or mobile carts use RealSense cameras, it is worth asking your integrator about the product roadmap and pricing after the sale.

Hands remain the hard part of humanoids, and Unitree just put a price on one. The Dex5-S, listed as in production on September 21, is a human-sized, five-finger hand with 22 degrees of freedom, each driven by its own motor, starting at $6,500 before tax and shipping. The Humanoid Guide rates it top marks for dexterity but low for strength, so it is built for delicate handling, not heavy lifting. A pair costs $13,000 before any integration work. That is a research and prototyping price, not a factory-floor one, and Unitree is a Chinese company, so check import rules before ordering.

Quick Takes

  • Opus 5.5 is available on AWS, Google Cloud and Microsoft Azure, and on Claude's Pro, Max, Team and Enterprise plans.

  • OpenAI says GPT-6 cached input reads get a 90% discount.

  • NVIDIA says its FoundationPose library in Isaac ROS 5.0 now finds an object's position up to 5.5 times faster, and that pick-and-place is available as a standalone skill.

  • Mercor said it "immediately" removes contractors confirmed to have used AI.

  • Grok 4.7, released Monday at $2 input and $6 output per million tokens, means three frontier labs shipped cheaper or same-priced flagships in two days.

  • Microsoft's EvilTokens takedown was carried out with Cloudflare, Coinbase, OpenAI and others.

What This Means for Your Business

Re-price your AI workflows this month. Anthropic cut Opus prices about 40% on typical workloads, and OpenAI halved its mid-tier and budget models, permanently. If you ruled out an automation earlier this year on cost, rerun the math with current prices. Most of the savings for long jobs come from cache reads, so ask your developer or vendor whether your setup actually uses caching. If it doesn't, you may be paying several times more than you need to.

Put the cheap model on the boring work. Luna at $0.10 per million input tokens is priced for summaries, data extraction and sorting inbound email. Keep the premium model for work where errors are expensive. Before you switch anything, test both on 20 of your own real examples. The vendors' scorecards were not designed around your business.

Defend against the code-on-a-real-login-page trick. EvilTokens did not steal passwords. It got people to type codes into a genuine Microsoft page. Tell staff that no legitimate caller or email will ask them to enter a sign-in code they didn't request. If you suspect a breach, revoke sessions and tokens, not just passwords. And confirm any change to payment details by phone, using a number you already have.

Treat desktop agents like admin accounts. The Muse flaw turned an app with broad permissions into a backdoor. Before anyone installs an agent that can read mail, files and messages, decide who approves it, keep it updated, and don't give it access it doesn't need. Assume that anything you ask an "AI" to say on the phone could be heard by a person.

Use vendor claims as a bargaining tool. xAI's claim of $0.20 to $0.30 per support ticket is self-reported, but it gives you a number to put in front of any support-software vendor charging several dollars per resolution. Ask them for their escalation rate too, and what share of tickets actually closes without a human.

Sources

← All posts