July 25, 2026 12 min read Claude Opus 5

Claude Opus 5 matches Fable 5 at half the price with a per-request effort toggle

Anthropic released Claude Opus 5, claiming Fable 5-level capability at half the price with a per-request effort toggle, making cost-per-task rather than peak capability the competitive axis. Two agent-security stories landed the same week: a researcher used a 32-agent Kimi K3 configuration to find Redis zero-days and build a working RCE exploit in 27 minutes, while Accomplish AI published a full sandbox escape from Claude Cowork’s Linux VM to the host Mac filesystem. Twenty-five companies including NVIDIA, Microsoft, and Meta signed a letter urging the administration against broad open-weight restrictions — with OpenAI and Anthropic conspicuously absent.

Model Releases #

Introducing Claude Opus 5 #

Anthropic / Ars Technica / TechCrunch / Simon Willison / AWS Machine Learning Blog / Hacker News (1574 points)

Opus 5 ships at $5/$25 per million input/output tokens — identical to Opus 4.8 — while Anthropic claims it beats Fable 5 on eight of thirteen benchmarks at roughly half the cost, adds a low/medium/high effort toggle for per-request cost-capability tradeoffs, and offers a fast mode at double price for about 2.5x throughput. The headline numbers are uneven in credibility: doubling Opus 4.8 on Frontier-Bench v0.1 and landing within 0.5% of Fable 5 on CursorBench 3.2 are plausible generational gains, but “three times as high as the next-best model” on ARC-AGI 3 is the kind of claim that needs third-party replication before it means anything. The more actionable detail for agent builders is buried in the system card: Anthropic reports 2.3 on overall misaligned behavior, its lowest recent score, and Boris Cherny claims it is the least prompt-injectable model the company has shipped — a property that matters more than benchmark position for anything running tools against untrusted input. Note that Anthropic remains explicit that Mythos 5 is still ahead on cybersecurity exploitation and biological research, so Opus 5 is a cost-efficiency release, not a capability ceiling move.

Security #

Kimi K3 Found Redis Zero-Days and Built a Working RCE Exploit in 27 Minutes #

Chaofan Shou / The Hacker News / heise online / Hacker News (228 points)

Security researcher Chaofan Shou reports that a 32-agent configuration of Moonshot’s open-weight Kimi K3 discovered a zero-day in the then-current Redis release and produced a proof-of-concept RCE in 27 minutes, with 19 total zero-days across Redis 8.8.0 in 90 minutes — including a stream consumer-group shared-NACK double-free and a heap overflow in the bundled RedisBloom TDigest module. Neither Redis maintainers nor Moonshot have independently confirmed the methodology, and single-researcher claims of this magnitude warrant scrutiny; the corroborating signal is that Redis shipped seven security updates on July 23 addressing memory-corruption flaws. The strategic implication is harder to dismiss than the specific numbers: an open-weight model with published weights, run in parallel at modest cost, is now a viable vulnerability-discovery harness for anyone, which changes the arithmetic on both disclosure timelines and the open-weight policy debate happening simultaneously in Washington.

SharedRoot: Escaping the Claude Cowork Sandbox #

Accomplish AI / The Hacker News / SC Media / Cybersecurity News

Researchers at Accomplish AI chained an unprivileged user namespace, CAP_NET_ADMIN, and CVE-2026-46331 (a page-cache poisoning flaw in the Linux act_pedit traffic-control module) to poison a cached helper binary that the root-level coworkd daemon later executes — yielding guest root, then read-write access to the entire host filesystem via /mnt/.virtiofs-root. The practical payload is credential theft: SSH private keys and cloud credentials outside any connected-folder boundary, with no user prompt. Anthropic closed the report as “Informative,” characterizing its mitigations as defense-in-depth and noting Cowork now defaults to cloud execution where this path does not apply — a defensible position on this specific CVE, but the underlying pattern (a root daemon consuming state a sandboxed agent can write) is a design smell worth auditing in any local agent runtime, not just this one.

Developer Tools #

OpenAI Micro: A $230 Keypad for Driving Agents #

TechCrunch

OpenAI shipped Micro, a $230 Bluetooth/USB keypad built with Work Louder: six programmable agent keys mapped to distinct ChatGPT and Codex sessions, six command keys, a dictation button, and color-coded status LEDs (white idle, blue thinking, green complete, red error). Reactions among developers have been mixed, with the obvious objection that a programmable macro pad costs a fraction of this. The interesting part is not the hardware but what it concedes: OpenAI believes power users are now running enough concurrent agent sessions that the bottleneck is dispatch and status awareness, not model quality — the same problem tmux panes and terminal multiplexers solve for free, now with an ambient status light.

ChatGPT Voice Comes to the Desktop App #

TechCrunch

The desktop version of ChatGPT Voice, running on OpenAI’s new ChatGPT-Live voice models, is built to take action rather than converse: users dictate multi-step commands and direct multiple agents running in ChatGPT Work or Codex by voice, with demonstrated flows covering thread creation, opening pull requests, and debugging. A macOS-specific Appshots feature grants screen access including alt-text, and the iOS app gains remote Codex access. This is the more consequential half of the voice-interface bet than natural-sounding speech: if voice becomes a viable control surface for parallel agent sessions, the interaction model for coding work shifts from typing instructions to supervising them.

LangChain Blog

Beyond the usual roundup items, two entries matter for agent architecture: Recursive Language Models (RLMs) landed in Deep Agents as dynamic subagents that decompose large-context tasks programmatically to limit context rot, and LangSmith Sandboxes opened a free trial for isolated code execution. The release also unifies Deep Agents with Harbor for evaluation — isolated sandbox runs with parallel trials and per-trial success/failure reasoning in traces — plus voice-agent tracing across Pipecat, LiveKit, OpenAI Realtime, and Gemini Live, and an NVIDIA NemoClaw blueprint for governed code execution. The RLM framing is the notable convergence: spawning subagents to keep the parent’s context small is the same conclusion this week’s ArXiv context-management work reached from the research side.

Regulatory & Policy #

Open Weights and American AI Leadership #

NVIDIA / Microsoft / CNBC / TechCrunch / Tom’s Hardware / Hacker News / Lobsters AI

Twenty-five organizations — NVIDIA, Microsoft, Meta, IBM, Hugging Face, Mistral, and Y Combinator among them — signed a letter urging policymakers against “premature restrictions” on open-weight models, arguing that concerns about unlawful distillation should be handled through targeted legal and commercial frameworks rather than sweeping limits on techniques central to AI research. The letter lands while the administration weighs banning Chinese open-weight models and sanctioning Chinese AI labs over the alleged Fable distillation. The signatory list is the analysis: OpenAI and Anthropic did not sign, and the split maps cleanly onto business model — companies selling compute, platforms, or open models want weights to circulate freely, while labs approaching IPO with frontier model IP as the core asset do not.

Proposed EPA Rule Would Cut Public Comment on Minor-Source Air Permits #

Ars Technica / EPA

The EPA has proposed eliminating the federal requirement that states provide a 30-day public comment period before issuing air permits for “minor source” facilities — a category that covers the backup generator fleets attached to AI data centers — leaving each state to decide whether comment happens at all. A virtual hearing was held July 22 and written comments run through August 21. Combined with Administrator Zeldin’s June statement that the agency will not pursue nationwide environmental requirements for the AI industry, the direction is consistent: data center siting friction is being pushed down to states, which is a material input to buildout timelines for anyone modeling compute capacity growth. (Ars Technica’s article body was not fetchable for this digest; the substance above is drawn from the rule as reported across regional coverage and the EPA’s own docket.)

The Complexities of Governing Mental Health AI #

Stanford HAI

Stanford HAI convened policymakers, clinicians, and researchers and reported three governance gaps: no working definition of where a wellness feature ends and a regulated clinical function begins, evaluation methods that lag other healthcare AI with industry data largely closed to independent researchers, and business models optimizing engagement against outcomes. Recommendations cover transparency requirements, crisis-response mechanisms, parental controls for minors, and standardized multimodal evaluation. The definitional gap is the load-bearing one for builders: any product with a supportive conversational surface is currently one regulatory definition away from being a medical device, and nobody can tell you today which side of the line they are on.

Funding & Business #

Prentis in Talks to Raise $100M at a $1B Valuation #

TechCrunch

Prentis — founded by Ritankar Das with Reid Hoffman and Mark Pincus — is raising $100M at a $1B valuation on the thesis that automating routine office work will overtake coding as AI’s largest use case, backed by up to $50M in signed contracts across healthcare, manufacturing, and apparel for tasks like insurance claims processing and customs duty refunds. The company claims its Hive-32B model beats GPT-5.4 and Claude Opus 4.6 on computer-use benchmarks at roughly one-tenth the cost per task; TechCrunch notes it has not verified those claims, and a 32B model outperforming frontier systems on computer use is exactly the claim that needs an independent harness before it is credible. The structural bet is sound regardless of whether Hive-32B holds up: narrow, high-volume workflow automation tolerates a much worse cost-per-task ceiling than general agents, and small specialized models are the obvious way to attack it.

Why Cognition Bought Poke #

TechCrunch

Cognition acquired The Interaction Company of California, maker of the messaging-native assistant Poke, for a valuation in the low nine figures. Poke keeps operating through year-end, with experiments starting next year that could put it on Cognition’s SWE-1.7 model and eventually have it orchestrate multiple Devin sessions while maintaining persistent memory across tasks. The orchestration angle is the real acquisition logic: Cognition is buying a conversational front end for parallel agent supervision, which is the same problem OpenAI just tried to solve with a $230 keypad and voice control — three different bets this week that managing many agents, not improving one, is where the product surface is.

Midjourney Acquires Co-Star #

TechCrunch

Midjourney acquired social astrology app Co-Star — roughly 4.3 million monthly active users, two dozen employees — on undisclosed terms, continuing a diversification that already includes medical and spa products. The plausible read is talent and distribution rather than content: Co-Star’s team has shipped a mainstream consumer app, which is precisely what Midjourney has never done outside Discord. Worth noting mainly as evidence that generative-media labs are buying consumer product competence rather than building it.

Research & Papers #

Euclid-MCP: A Model Context Protocol Server for Deterministic Logical Reasoning via Prolog #

Hugging Face Daily Papers

The paper wraps a Prolog engine behind an MCP server so LLMs can offload multi-step logical inference to a deterministic solver rather than attempting it in-context, targeting safety-critical and compliance-sensitive domains where probabilistic reasoning is unacceptable. The neuro-symbolic pattern is not new, but MCP as the delivery mechanism is the practical contribution — it makes the symbolic layer a drop-in tool for any MCP-capable agent instead of a bespoke integration. For teams with hard consistency requirements, the architectural question this raises is which classes of reasoning should never touch the model at all.

Windowed-MTP: Removing the Full-Context Draft-KV Tax at Million-Token Context #

Hugging Face Daily Papers

Speculative decoding assumes the draft model is nearly free, but frontier models shipping built-in multi-token-prediction heads pay full-context KV costs on the draft path — an assumption that breaks down badly at million-token context. The paper windows the draft’s context to eliminate that tax. This is the kind of inference-economics work that determines whether long-context agent loops are affordable in production: if your agents carry large persistent context, draft-side KV cost is a line item worth measuring rather than assuming away.

Infrastructure #

OpenAI GPT-5.6 Sol, Terra, and Luna Reach GA on Amazon Bedrock #

AWS Machine Learning Blog

The three GPT-5.6 variants are now generally available on Bedrock, served through the Responses API on a bedrock-mantle endpoint, with prompt caching for cost reduction, documented quota and scaling guidance, and a supported path for connecting the OpenAI Codex coding agent. Landing the same day Opus 5 arrived on Bedrock, this makes AWS a genuinely provider-neutral inference surface for both frontier families. For teams already routing across models, the operational win is that provider switching becomes an endpoint change under one IAM and billing boundary rather than a separate vendor integration.

Other #

Bluesky’s Attie Adds Open-Network Research Queries #

TechCrunch

Attie, Bluesky’s assistant for building custom feeds without code, added Quests — open-ended research questions answered across Bluesky and any AT Protocol app, covering things like trending topics or influential accounts in a given field or region. It is in beta behind a waitlist and currently free. The notable part is structural rather than technical: an open protocol means a research agent can query the whole network’s data without per-platform API negotiation, which is the concrete argument for open social infrastructure that closed platforms cannot answer.

Threads to Watch #

Cost per task, not peak capability, is now the axis frontier labs compete on. Opus 5 leads with half-price Fable-level performance and a per-request effort dial; Ars Technica’s read is that it is a token-efficiency release rather than a capability leap. Prentis is raising at $1B on a 32B model claiming one-tenth frontier cost per task, and Bedrock now sells both GPT-5.6 and Opus 5 from behind one endpoint. Every one of those moves assumes the buyer’s question has shifted from “what is the smartest model” to “what is the cheapest model that clears my task’s bar” — which makes the effort toggle, not the benchmark table, the most consequential thing Anthropic shipped.

Agentic vulnerability discovery arrived as a commodity, and the defensive side is not ready. A 32-agent open-weight configuration allegedly producing a Redis zero-day and working RCE in 27 minutes, a full Cowork sandbox escape to host SSH keys published the same week, and Anthropic’s simultaneous pitch that Opus 5 is its least prompt-injectable model are three faces of one shift: agents are now both the most capable attacker and the most exposed asset in the stack. The open-weights letter argues restrictions would stifle innovation; the Kimi K3 result is the strongest available counter-argument, and both landed within 48 hours of each other.

Three companies bet this week that supervising many agents is the product. Cognition bought a conversational assistant to eventually orchestrate parallel Devin sessions, OpenAI shipped a keypad whose entire premise is dispatching six concurrent agent sessions plus voice control for directing them, and LangChain shipped recursive subagents to decompose context-heavy work. None of these improve a model; all of them address the same emerging bottleneck — a single human’s ability to direct and track work happening in parallel.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

Weights & Biases: Fully Connected — scrape: homepage returned navigation shell, no article listing extractable