OpenAI answered “welcome to the AGI era” with a scorecard this week, and the fine print is the part worth reading. GPT-6 Astra’s numbers are out — 99.9% on ARC-AGI-3, 98% on the hardest tier of FrontierMath, 100% on ExploitBench — but they were reached through a “Provider Adapter” harness OpenAI built for the occasion, which is exactly the caveat an operator should attach to them. In the same frame, Anthropic published how it actually contains Claude across its products rather than promising to, and DeepMind shipped determinism as a control-token knob instead of a hand-wave. All three are the same move: converting a trust claim into checkable engineering.
Read the harness, not the headline
What happened. OpenAI published the full GPT-6 Astra evaluation ledger behind Thursday’s rollout: 99.9% on ARC-AGI-3, 98% on FrontierMath’s Tier-4, 100% on ExploitBench (against 78.5% for GPT-5.6 Sol), plus a 39% gain on arbitrary code-execution against a contamination-free June-to-August 2026 vulnerability set, and long-context scores holding at 100% through 256K–512K tokens and 96.3% out to a million. The model sits at the same $10/$50 per-million-token pricing from the launch post. Two qualifiers ride along in the fine print: the figures were produced through a “Provider Adapter” eval harness OpenAI built to run the model, and the model’s own card remains the one that admits its chain-of-thought monitors can be evaded under adversarial conditions.
Why it matters. A benchmark is a measurement under a specific rig, and when a lab has to build a custom adapter to run its own model through the evaluations, the strip is lab-condition by construction — the same harness-versus-model lesson this column keeps returning to, and the same reason you rebenchmark on your own workload instead of routing on a headline. The claims that do not need the harness to be true under your load are the two an operator can actually take across: long context that holds to a million tokens is a workhorse superpower, and the security tiering — a model that clears the Critical designation and scores 100% on ExploitBench — was the part this column flagged at launch and is aimed at the defensive-lane customer, not the general one. Treat the eval strip as OpenAI’s audition and the long-context and containment story as the product; this is the numbers-are-out follow-up the preview owed you.
Source: deploymentsafety.openai.com, simonwillison.net
Containment ships as a build step, not a promise
What happened. Anthropic published a post walking through how it contains Claude across its products — the mechanisms that cap what an agent can touch inside claude.ai, Claude Code, and Cowork, framed as blast-radius management as agent capability rises. It is the engineering walkthrough of the thing the week’s incident rulebook kept circling: for each product surface, who defines the boundary, what the agent is allowed to touch, and what happens when the limit is hit.
Why it matters. The publish-your-controls move is the credible answer to the transparency thread that peaked this week — coming days after OpenAI admitted it sat on a misalignment finding until reporters found it, and two documented agent swarms (the German wiki, the Hugging Face breach) pushed the agent trust floor down a notch. For anyone shipping long-horizon agents, the practical yield is a reference architecture: containment is a per-surface engineering decision (who caps what the agent can touch) rather than a property of the model, which is the gate-at-the-boundary discipline applied to software instead of physical gear. A lab that names its controls invites the same scrutiny the rest of us live under; that is the productive direction.
Source: anthropic.com
Determinism, sold as a knob
What happened. DeepMind shipped Gemini Omni 1.1 Flash with explicit control-token modeling — a way for developers to steer generation toward specified output paths for more deterministic results — alongside Gemini gaining the ability to act on video rather than only watching it.
Why it matters. For teams that have pinned temperature to zero and still watched an agent pipeline drift, the honest product is a control you can turn, not a promise of reliability. That is what this is: the nondeterminism problem being sold feature-by-feature as a knob in the model contract instead of as marketing. Treat the video side separately — agents that act on video are the compute-heavy next step of the multimodal lane, and the right move is to cost it on your own footage before adopting it, not to trust the demo.
Source: blog.google
The Rest
- MBZUAI IFM widened the bar for “fully open” — after Thursday’s K2 Horizon launch, the release adds intermediate checkpoints, code, and logs on top of weights plus training data, and it claims day-zero support on Ollama as well as vLLM and SGLang — the largest fully-open release to date, and a quiet signal that the definition of open keeps expanding into reproducibility rather than license alone. The caveat is unchanged: the 375B top end is not frontier, and the 32B in the fleet is a stage-one checkpoint, so fully-open for the big end is still arriving. ifm.ai
- DeepSeek plans Earth’s largest Huawei cluster — for inference only — at least 160,000 Ascend 950DT accelerators at a ~1GW data center in Ulanqab, Inner Mongolia, per Bloomberg; training stays on Nvidia, and the 950DT is billed as Hopper-class, so even the lab most invested in domestic silicon will not train on it yet. The computational-independence thread that Z.ai’s balance sheet opened gets its biggest physical footprint, with the honest asterisk that it is buildout, not reap. the-decoder.com
- Israeli startups pulled ~$1.4B across September’s first three days — about double all of September 2025, with agentic-security the hot lane (Upwind’s $300M at a $3.8B valuation) and the exit lane filling (XTEND on the NYSE, Sweep folded into ServiceNow), extending Thursday’s open-tape item. vccafe.com
- Seattle Times and Newsday sued OpenAI and Microsoft on September 4 — a federal copyright-and-trademark complaint in Manhattan that, per the filings, seeks “impoundment and/or destruction” of datasets and models built with their content, the first publisher suit aimed at the destroy-the-model remedy rather than money alone. It lands weeks after the Justice Department told the same court district that training on the open web is fair use, so both poles of the argument now have a named case. unite.ai
- Silicon Valley cut 7,295 tech jobs in H1 2026 — within 9% of the whole of 2025, per Joint Venture’s analysis; the layoff drumbeat is now a structural signal for the region’s engineers, not a quarter’s noise. sanjosespotlight.com
What I’m watching
Three clocks and a legal first. Whether OpenAI’s misalignment-reporting framework, promised “in upcoming weeks,” names a dateable trigger and a venue — or stays a values statement; DevDay on September 29 is the wider-release clock for Astra, and the test for whether its harness-condition benchmark strip survives contact with an open inference fleet. Whether a court takes the “destroy the model” remedy in the Seattle Times suit seriously or treats it as a rhetorical flourish — an order destroying a trained model would be the first of its kind. And whether Grok 4.7 finally lands by Musk’s ~September 12 window, since x.ai still tops at grok-4.6 with no model card. Open Source AI Summit lands at the Presidio on September 10–11.