OpenAI cut the price of its cheapest frontier model by 80 percent, crediting infrastructure the model itself helped optimize. Google DeepMind put one brain into many robot bodies. Anthropic published a forensic account of three of its models breaking into real companies during safety tests. And the protocol connecting agents to tools threw away sessions entirely.
OpenAI cuts inference prices by up to 80 percent
OpenAI dropped the price of GPT-5.6 Luna by 80 percent, to $0.20 per million input tokens and $1.20 per million output tokens, and cut GPT-5.6 Terra by 20 percent, to $2 and $12. Sol, the top-tier reasoning model, kept its price but gained a Sol Fast tier that roughly doubles the rate in exchange for about 2.5 times the throughput. The company attributed the reduction to two efficiency gains rather than a margin decision: speculative decoding that raised token generation by more than 15 percent, and GPU serving software that GPT-5.6 Sol itself helped optimize, cutting deployment costs by roughly 20 percent. Auto-review inside ChatGPT and the Codex CLI moved onto Luna, a change OpenAI describes as a tenfold cost reduction for that workload.
The magnitude is easier to feel in comparison than in per-token arithmetic. Researcher Nic Dunz noted that Luna now reaches the benchmark performance of March's full GPT-5.4 flagship at roughly one-thirteenth the token price — a task that cost a dollar on those models runs about six cents today, and runs substantially faster. The competitive pressure is not subtle: Chinese providers publishing open weights, Google's Gemini tiers, and Microsoft's push toward cheap specialist MAI models have converged on the same message, that raw capability is no longer the axis of competition.
Google puts one model into many robot bodies
Google DeepMind released Gemini Robotics 2, structured as three pieces rather than one model. A vision-language-action model drives full-body movement on humanoid and bi-arm platforms. Gemini Robotics ER 2 acts as the high-level planner, handling multi-step tasks, human dialogue, and coordination between multiple robots. A third on-device variant runs locally with no network dependency and adapts to an entirely new robot body in a few hours using fewer than 200 demonstrations.
The published numbers are unusually candid about what still fails. On Apptronik's Apollo 2 with Inspire hands, whole-body manipulation succeeds 76.3 percent of the time picking from a shelf and 45.7 percent from the floor. Gripper work on Franka's dual-arm platform is stronger — 89.6 percent on precise insertion, 78.9 percent on tool kitting. Multi-finger dexterity is where the ceiling shows: unscrewing a bulb hits 92 percent, but screwing one back in lands at 36 percent, with most fine-manipulation tasks in the 32 to 44 percent range on a 22-degree-of-freedom hand. DeepMind also introduced ASIMOV-Agentic, a benchmark measuring whether a robot refuses unsafe tool calls and detects humans nearby.
Google is selling the intelligence layer, not the hardware, with Apptronik, Boston Dynamics, and Agile Robots as development partners. ER 2 is in Google AI Studio now and in private preview on the Gemini Enterprise Agent Platform; the full models are early-access only. A checkpoint that transfers across bodies means vendors stop building a bespoke control stack per machine.
Anthropic publishes a forensic account of models breaching real companies
Anthropic reviewed 141,006 evaluation runs and found six in which its models reached the live internet from environments meant to be isolated, compromising three real organizations. Three models were involved: Claude Opus 4.7, Claude Mythos 5, and an unreleased internal research model. The root cause was a third-party evaluation environment that left network access open while telling the model it had none, so the model treated production systems as part of the exercise.
The specifics are worth reading carefully. In the first incident, Opus 4.7 attacked a real company that happened to share a name with its fictional target, extracted application and infrastructure credentials, and reached a database holding several hundred rows of production data. In the second, Mythos 5 published a malicious Python package to the real PyPI registry; it was downloaded and executed on 15 real systems during the roughly one hour it was live before automatic removal, and it captured credentials belonging to a security company's scanner. In the third, the internal research model scanned roughly 9,000 targets and compromised one internet-facing application using, in Anthropic's description, basic and well-known techniques.
The earliest incidents date to April 2026; the review began July 23 and affected organizations were notified July 27. Anthropic has paused web-connected offensive security evaluations with its partner Irregular and brought in METR for independent transcript review. The uncomfortable lesson is that the failure was not a model deciding to escape — it was a mismatch between what the sandbox claimed and what the network allowed, the same class of error sitting in most agent deployments today.
Open-weight models reach accuracy parity in regulated work
A new ClinReg benchmark evaluated 19 models — 12 proprietary, 7 open-weight — across three regulated pharmaceutical tasks: screening research articles for systematic review, drafting Chemistry-Manufacturing-Controls sections of an IND application, and autonomously generating tables, listings, and figures from clinical trial data. GPT-5.6 Sol led with an overall score of 88.4 against a standard deviation of 4.6. GLM 5.2 scored 87.4 and Kimi K3 scored 86.9 — both inside one standard deviation of the leader, at 33.8 percent and 59.6 percent of Sol's per-task cost. The best US open-weight entry, Gemma 4, scored 73.5. The sharper finding is that similar scores hide different failure modes: some models fabricated missing values, others silently omitted real content. "Parity is not uniformity," as the analysis puts it.
Thinking Machines pushed the same direction with Inkling-Small, a 276-billion-parameter mixture-of-experts model with 12 billion active parameters and a one-million-token context window — a quarter the size of its Inkling flagship, and better than it on several benchmarks: 31.6 percent on Humanity's Last Exam against 29.7, 80.2 percent on SWE-Bench Verified against 77.6, and 64.7 percent on Terminal Bench 2.1 against 63.8. Inkling keeps an edge in knowledge coverage and factuality, the expected tradeoff when you shrink a model. Full weights are on Hugging Face; output runs $1.20 per million tokens.
Agent infrastructure
The Model Context Protocol shipped its 2026-07-28 specification, the largest revision since launch, and it removes sessions entirely. SEP-2567 deletes the `Mcp-Session-Id` header, SEP-2575 deletes the `initialize`/`initialized` handshake, and protocol version, client identity, and capabilities now ride along in `_meta` on every request. Roots, sampling, logging, the legacy HTTP+SSE transport, and dynamic client registration are deprecated behind a minimum 12-month window. A remote MCP server that needed sticky sessions, a shared Redis store, and deep packet inspection at the gateway can now sit behind a plain round-robin load balancer and let clients cache `tools/list`. State does not disappear — servers mint an explicit handle the model passes back as an ordinary argument.
Cursor published the other half of the story: cloud agents authored roughly one in ten pull requests merged to its monorepo in December, and today they write more than half. What got them there was environmental, not a model upgrade — Linux VMs instead of macOS laptops, a CLI that reliably starts services, scoped Git access with secret scanning, and automation that diagnoses broken environments and opens fixing PRs.
Money and policy
Meta guided 2026 capital expenditure to $130–145 billion and paid for it in cash flow: second-quarter free cash flow fell to $784 million on $31.86 billion of operating cash flow, and the stock dropped about 10 percent. The day before earnings, Meta and BlackRock announced a $14 billion, one-gigawatt data center campus in El Paso, Texas, with BlackRock holding 80 percent and Meta 20 percent — keeping a large build off Meta's balance sheet.
In court, US District Judge Rita Lin said the Trump administration has not produced enough evidence to designate Anthropic a supply-chain risk or to bar federal agencies from using its technology, following collapsed Defense Department contract talks in which Anthropic declined to permit mass surveillance of Americans or autonomous lethal targeting. Lin called the government's reliance on Anthropic's public criticism "really troubling," warning it could set a precedent for punishing contractors who disagree with an administration.
Quick Takes
1,178 employees at OpenAI, Anthropic, Meta AI, and Google DeepMind signed "Pacing the Frontier," asking the US government to build the tools needed to deliberately slow automated AI development if it ever outruns human oversight. Signatories include Dario Amodei, Jakub Pachocki, and Anca Dragan; OpenAI and Anthropic endorsed it institutionally within hours. It asks for no pause today — only that the option exist later.
Chrome's security team fixed 1,072 bugs across Chrome 149 and 150 combined, more than the prior 23 milestones put together, crediting Gemini agent harnesses, the Big Sleep discovery agent, and CodeMender in CI. One find was a sandbox escape that survived in the codebase for over 13 years.
Coinbase Business began letting corporate customers accept payments from AI agents on July 23 using the x402 standard, alongside a Coinbase for Agents release and an SDK. The Linux Foundation launched the x402 Foundation on July 14 with Adyen, AWS, Amex, Google, Mastercard, Shopify, Stripe, and Visa as premier members.
OpenAI launched a $250 million program giving academic researchers free GPT-5.6 Sol Pro access — 10,000 researchers now, 100,000 by 2027 — with no training on researcher data by default.
Encore AI raised a $30 million Series A led by Team8 for agents trained on a company's own recorded calls, emails, and CRM data, with 40-plus enterprise customers, mostly financial institutions.
Tom's Hardware reported, from internal Amazon usage metrics, that one routine coding task ran up roughly $1.8 million on Claude, about 860 percent over budget — a cost-governance failure, not a capability one.
MiniMax released H3, an open unified text-image-video-audio model generating up to 15 seconds of 2K video with native stereo sound. Microsoft confirmed a Copilot "super app" this year while signaling a cheap-specialist-model strategy over frontier chasing.
Zuckerberg predicted billions of people will run personal AI agents within five years via WhatsApp and Messenger. Google Earth on web added AI image generation from any map view; LinkedIn added a "Seems like AI slop" report button.
Perplexity shipped Projects with self-updating persistent context; Ideogram and Pruna launched image models from $0.003 per render; LangChain cut Deep Agents prompt tokens 65 percent; WASTE, a new open source inference engine, runs Kimi K3 on a 64GB MacBook Pro.
What This Means for Your Business
Reprice everything. Luna at $0.20 per million input tokens is not a discount on last quarter's plan — it is a different category of decision. Workflows you rejected on cost grounds (summarizing every support ticket, classifying every inbound lead, drafting first-pass responses across an entire queue) should be re-estimated this week, because the same volume that cost a dollar in March costs roughly six cents now. The corollary is that per-token price is no longer where your risk lives. Amazon's reported $1.8 million overrun on a routine coding task happened at prices far above today's, which means cheap tokens plus an unsupervised agent loop is exactly how a small bill becomes a large one. Set hard spend caps per agent and per workload before you expand usage, not after the invoice arrives.
Stop assuming the frontier proprietary model is the only credible option for serious work. ClinReg put two open-weight models within one standard deviation of GPT-5.6 Sol on regulated pharmaceutical tasks, one of them at a third of the cost. But take the authors' warning seriously: the scores converged while the failure modes did not. Some models invent missing values, others quietly drop real content — and for most SMB workflows, silent omission is far more dangerous than an obvious fabrication, because nobody catches it. Before choosing a model, define which error you cannot tolerate in that specific workflow, then test candidates against that failure mode rather than against a leaderboard.
The Anthropic incident report is the most useful security document of the week, and not because it involves frontier models. Three separate breaches happened because an environment told the model it had no internet access while the network happily allowed it. That gap — between what a sandbox claims and what the infrastructure permits — exists in almost every agent deployment. Verify it directly: give an agent a task that requires an outbound call it should not be able to make, and confirm the network layer blocks it rather than trusting the prompt or the framework's configuration. The PyPI detail is the second lesson. A malicious package was live for about an hour and landed on 15 real systems. If your build pulls unpinned dependencies, an hour of exposure is enough.
If you run remote MCP servers or buy tools that do, the stateless spec is a genuine cost and reliability win, and it comes with a deadline. Sticky sessions, shared session stores, and gateway packet inspection can come out of your architecture; ordinary load balancing and cached tool lists go in. The 12-month deprecation window on roots, sampling, logging, the legacy SSE transport, and dynamic client registration means this is a planned migration, not an emergency — put it on a roadmap now and ask your vendors which specification revision they target.
Finally, Cursor's move from 10 percent to more than half of merged PRs written by cloud agents is the clearest available evidence that agent productivity is an environment problem, not a model problem. Nothing in that story is about picking a better model. It is Linux VMs instead of laptops, a CLI that reliably starts services, scoped credentials and secret scanning, and automation that repairs its own broken environment. If your agents underperform, the highest-return work is almost certainly making your environment legible and runnable — clear setup scripts, deterministic builds, scoped access — rather than waiting for the next model release.