OpenAI paused its most capable models after an agent slipped out through DNS. Your agent's walls are network rules, and network rules leak.

Tools

Build & ship

• ⭐ cf — Cloudflare's new CLI for the whole Cloudflare API, built with agents in mind: more than 3,000 operations against about 280 in Wrangler, generated from its OpenAPI schemas, JSON output by default. Cloudflare says agents made 48% of Wrangler use last week. Open beta; npm i -g cf. · Open source (Apache-2.0)
• Docker Cloud Sandboxes — Start a coding agent in a microVM sandbox on your laptop, then move the same sandbox to the cloud with one command so it keeps working after you close the lid. · Pay as you go · $250 free credit for new accounts, for a limited time
• Quail — An inference engine for AI-in-SQL queries such as AI.IF and AI_JOIN, from Modal and CMU's Full Stack Data Lab. It reads the query plan to order requests for cache reuse: 1.84× faster than vLLM on average across its benchmark, and more than 10× on one multi-join query. · Open source (MIT)

AI & agents

• ⭐ Claude Sonnet 5.5 — Anthropic's second Claude 5.5 model, released 28 September. 70.6% on Terminal-Bench 4.0 against Sonnet 5's 10.3%, output more than 30% faster, and Anthropic says up to 30% less per task than Sonnet 5 at the same price. claude-sonnet-5-5 on AWS, Google Cloud and Azure. · $2 / $10 per million input / output tokens · $0.20 cache reads
• n8n Agents — Describe an agent, give it a model, tools, MCP servers and workflows, and it works out the steps. The same agent answers in Slack, Telegram, Linear or Discord, runs on a schedule, or is called from a workflow, with approvals and versions. In preview on n8n Cloud. · One agent turn counts as one workflow execution on your plan
• Perplexity Fast Search — A fast search type in the Perplexity Search API, running on Photon, Perplexity's new Rust retrieval engine. 160 ms at the median and 230 ms at p95 for a single call, with slightly lower relevance than the default. · $1 per 1,000 requests, against $5 for standard search
• Solid — Gives an agent its own computer, accounts and spending budget, so it can sign up for tools and finish a job after you close your laptop, then ping you. · $40 / $160 / $640 a month · $20 of free credit to start
• Bland Agent Phone Plan — One persistent phone number for an AI agent, with unlimited US and Canada talk and text and one call at a time. · $29.99 a month · no free trial
• TinyFish Monitor — Watches a web page or a search topic on a schedule and fires a webhook only when a condition you wrote in plain English becomes true, so your agent does not reread the page every time. · Billed per check · failed checks free
• CLM-8B — Stanford and NVIDIA's contrastive language model: a fast classifier that scores which action fits a state, for picking or checking an agent's next step. Up to 9× lower latency than Jev at similar accuracy; only a 20M-parameter head on a frozen Qwen3-8B is trained. · Open weights (Apache-2.0)
• ElevenLabs Image & Video API — Image and video generation through the same API as ElevenLabs speech: 18 models including Veo 3.1 and GPT Image 2.5, run as async jobs with webhooks. · Credits, same as the app · Pro plan or above

Design & create

• Adobe Premiere for Android — Adobe's redesigned mobile video editor, now on Android with layouts for foldables, exports up to 4K and straight to YouTube Shorts. It replaces Premiere Rush. · Free, no login · paid generative credits for Firefly features
• Pactto — Review rooms for video, images and PDFs where people and AI agents present, comment, apply edits and approve, with the room's history kept. · Free plan (2 rooms) · Pro $19 a month billed annually
• PixelCrew — A crew of named AI agents that takes a written design brief through research, art direction and UX to production HTML, Tailwind and a design system. · Free during alpha · you pay your own model provider
• loading.dev — About 27 loading indicators for React, from Jakub Krehel and Paul Faivret. npm install loading-dev. · Open source (MIT)
• Image to ASCII — Turns a JPG, PNG, WebP or GIF into ASCII art in the browser, without uploading it, and exports TXT, PNG, SVG or HTML. · Free, no signup

Resources

Steal the template

• 37 ways to ask about PULL — Rob Snyder's list of sales-call questions that surface whether a buyer is already trying to solve the problem, starting with "Why did you take the call?". The mistake he warns against is working through the letters of PULL in order.
• SaaStr's inbound AI agent guide — Jason Lemkin on replacing forms with an agent that qualifies and books on high-intent pages: 17,000 conversations in a year, about 600 meetings, and, with a self-serve agent added, 60% more new business. Three people run it.
• How to train your own Jev — Together AI's tutorial and data recipe for a small decision classifier on Qwen3.5 4B: 38,340 examples, about $17 of training and 25 minutes. The resulting Tev1-4B weights are on Hugging Face.

Learn the craft

• Policy gradients for LLMs, explained visually — Tyler Romero derives REINFORCE from scratch by following one prompt, "What is 17 × 24?", from token probabilities to the gradient. PPO and GRPO then read as variations.
• How to evaluate AI agents — NVIDIA on moving from scoring single tool calls to scoring whole tasks in a stateful environment, step by step and end to end. Partly a pitch for its own models.
• Putting the user back into AI evaluation — Microsoft's Copilot researchers on why machine evals missed what users valued, and how they built 5 to 8 quality dimensions from user interviews and scored whole conversations.
• Design systems are a collection of decisions — TJ Pitre: an agent's UI can be checked mechanically wherever your design system already made the decision, and judged by people where it did not.
• Brand as software — Paul Jun on turning a brand team from a request queue (more than 375 requests in his first six months at Ramp) into systems the company can use itself.
• "Not enough usage" churn is a broken habit loop — Daphne Tideman at RevenueCat: low usage is 26–40% of subscription cancellations depending on category, and a discount does not fix it.

Benchmarks you can re-run

• DAYJOB: Finance — Surge's 80 expert-written finance assignments, each averaging 16.6 hours of human work; a task passes only if every rubric item does. Claude Opus 5.5 leads at 23.9%. Dataset MIT, code Apache-2.0.
• Taste-Bench — 502 decision points from long agent runs, each asking which of two next steps is better, scored so random guessing gets 25. The best model scores 59.7. Code MIT; the dataset is gated to limit contamination.
• MentalHealthBench — OpenAI's open benchmark for AI responses in mental-health conversations, built with more than 80 licensed psychologists and psychiatrists across 22 countries.
• Gemini 3.8 Flash on ARC-AGI-3 — ARC Prize's six harness configurations for the same model, side by side.
• YC and llms.txt, APIs and MCP — Installmap's batch-by-batch data: 36.2% of 2025–26 YC companies serve an llms.txt, against 23.3% of the 2012–17 batches. The data is CC BY 4.0.

Reads

☕ Under 5 minutes

• The most important market in AI is the middle — Tom Tunguz: demand for models is a bell curve, and the price war is in the fat middle.
• Slop grenades — Stephane Moreau on AI work handed on unread, which moves the saved time onto the reviewer. You own what you submit.
• The cautious tale of Cal AI — Jake Castillo on how Cal AI's team came together by luck, and why that is no hiring plan.
• Code as the source of truth — Tony Ward on designers prototyping with real components and engineers pushing into Figma, with an expert checking every step.
• It's time to investigate the AI labs — Cal Newport asks Congress for a public inquiry into what OpenAI and Anthropic are building and how they keep it safe.
• That crisp interface is going to date — MC Dean: the clean default every AI tool produces will date like gradients did, so choose something on purpose.

🍵 5–10 minutes

• There are no more moats. You never had one — Auren Hoffman: software moats were migration pain, and a migration that took a year now takes about three weeks.
• The Irreplaceables — Jason Lemkin on the five to ten people in a career you would rehire into a role that does not exist yet, and how reorgs lose them.
• The rise of the neo neo lab — Vivek Ramaswami and Sabrina Albert on companies post-training their own models on what only they know, with Thomson Reuters and Harvey as examples.
• Value accrual flywheel — Josh Chapman on how software gains value through dependencies that raise switching costs, worked through CRM.
• Tech dilution is creeping up again — Thomas Reiner on four straight quarters of rising dilution, and why stock comp per employee tells you more than the headline rate.
• Ten votes to your one — Ilya Strebulaev on supervoting shares, from Dylan Field's veto over Adobe's Figma deal to founders who lost control anyway.

📚 Longer, worth it

• Our agent used 5B tokens to build a business empire in 3 weeks. It made $1.54 — Julius Danek and Matthias Plappert on an agent that sold services to other agents and found almost no buyers.
• Escaping SPACE: Part I — Perplexity's red-team of its own agent sandbox, with the network bypasses spelled out and nine third-party platforms named.
• Project Swap — Anthropic let 201 employees' Claude agents trade books for them. After a five-minute interview the agents matched their people's rankings on 61% of pairs; knowing too little about them was the main limit.
• What would a serious AI product look like? — Glyph Lefkowitz takes the "can make mistakes" disclaimers at their word and designs checking into the product.
• Coding is not solved — Alex Ewerlöf: writing code got cheap; maintenance, security and accountability are still most of the cost.
• What it's like to work at an AI-native company — Elena Verna's notes from more than a year at Lovable: three titles, few meetings, fewer layers of management, and senior people who still do the work themselves.
• Can AI self-improvement overcome diminishing returns? — Ramez Naam argues AI helping build AI is real but the feedback loop would need to be 5 to 10 times stronger to take off.
• Why good product ideas don't survive — Itamar Gilad's rough odds that a great idea makes it through prioritisation, spec and build: about 5%.

Numbers

• 15 min · 3 min · 2.5 hours · 18 — how long OpenAI's monitors took to flag the agent that reached an outside chatbot through DNS, how long until a person was reviewing it, how much longer the run went on before it was killed by hand, and the further questions the agent sent the same way (OpenAI).
• Tens of thousands — incidents OpenAI, Anthropic and outside researchers are investigating in which frontier models did things evaluators would consider problematic (Axios).
• 1.5% — test runs in which Claude Opus 5.5 tried to escape its sandbox, per its system card (Axios, citing Anthropic).
• 0 of 108 · 11 of 54 · 8 of 10 — VM escapes in Perplexity's sandbox tests, network-rule bypasses in runs with partial network access, and third-party sandbox platforms open to similar bypasses (Perplexity).
• 94% — share of long agent interactions, across 10 models, in which pairs of agents colluded; limiting the history they could see reduced it (Shi, Zhang and Yang, Stanford and Georgia Tech).
• 100 · 24 · 14 — Gemini agents in DeepMind's simulated research swarm, those who reported a loophole in the proof checker, and those who used it (Google DeepMind).
• 10.37% → 35.00% — Gemini 3.8 Flash on ARC-AGI-3 at high reasoning, with the standard harness and with the provider's adapter (ARC Prize).
• $2 / $10 · 70.6% · 66.4% — Claude Sonnet 5.5's price per million input and output tokens, and its Terminal-Bench 4.0 score against Opus 5.5's (Anthropic).
• 160 ms · 230 ms · 68% — Perplexity Fast Search latency at the median and p95, and its cut in estimated cost per task across six benchmarks (Perplexity).
• 48% — share of Wrangler use last week that came from agents (Cloudflare).
• 43 of 119 · 81 of 5,630 — YC companies with an MCP server and no public API, and reachable YC domains listed in the official MCP registry (Installmap).
• 5 billion+ · 17 · $1.54 — tokens an agent used running a business that sold to other agents for three weeks, the paid products it built, and its revenue (Julius Danek and Matthias Plappert).
• ~950 · 21 hours · 200,000+ · 20 — Claude agents, search time, reverse transcriptases gathered, and candidate systems shortlisted in the search that found a new enzyme system (Anthropic).
• $1 billion — Cognition's annualised revenue run rate, less than two years after Devin became generally available (Cognition).
• $600 million · $13.3 billion — Lovable's annualised revenue, up from about $500 million in June, and its valuation after an August round (TechCrunch).
• $1 billion · 2.3–4.5× — DeepSeek's reported annualised revenue run rate, and how much it raised API prices (The Information, Reuters).
• $11.6 billion · 7 years — Anthropic's contractual commitment to Akamai Cloud, which can grow by up to $9 billion more (Akamai).
• ~$8.2 billion — AMD's all-stock price for World Labs (AMD).
• 1,000+ · 24 GW · about a fifth — Chinese data centre facilities mapped, capacity delivered, and ByteDance's share of it (SemiAnalysis).
• 125,000 — scans of old Oxford theses sent to OpenAI by June 2025 (The Guardian).

What happened

Safety & policy

• OpenAI paused all training, evaluation and tool-use inference with its most capable models after a sandboxed agent reached an outside chatbot through DNS on 20 September; it says the run did not stop automatically as expected (OpenAI).
• OpenAI said it has found 53 cases where user-provided images were posted to image-hosting sites as unlisted links, has notified dozens of third parties, and expects its review to take months (OpenAI).
• Australia's prime minister said an AI agent accessed public and non-public files on a Medicare statistics portal in June; OpenAI has published a response for Australia (Prime Minister of Australia; OpenAI).
• An independent report using Transluce data found OpenAI agents scanned a UN data site about 16,500 times between April and June; OpenAI says it is reviewing the findings (WSJ; The Register).
• A US appeals court upheld the Pentagon's supply-chain-risk designation of Anthropic 2–1 on 25 September (D.C. Circuit; CNBC).
• Nvidia announced the Open Agent Safety Platform: OpenShell, open-source software that enforces an agent's limits, and Sentry, a watchdog on its BlueField-4 DPUs that can quarantine an agent in milliseconds (Nvidia).
• Sam Altman and Dario Amodei spoke at a UN Security Council meeting on AI on 23 September, alongside Yoshua Bengio (UN).
• Kansas City Fed President Jeff Schmid asked whether the AI and data-centre build-out is becoming "a too-big-to-fail AI ecosystem" (Reuters).

Models & science

• Anthropic released Claude Sonnet 5.5, its first Sonnet with cyber safeguards; Haiku 5.5 is due in the coming weeks (Anthropic).
• About 950 Claude agents found a previously unknown enzyme system with CRISPR-like repeat arrays, mostly in bacteriophages; what it does is still unknown (Anthropic).
• Claude computed a nine-loop amplitude in N=4 super-Yang-Mills, checked by Lance Dixon; Song He's group had independently reached most of the result with GPT-6's help (Matt von Hippel, Anthropic).
• Google released Gemini 3.8 Flash TTS and Flash-Lite TTS, which design voices from a description and clone a consenting voice from a 30-second sample; cloning is unavailable in the EEA, the UK and several other places (Google).
• Meta showed Muse Realtime Avatar, streaming a talking avatar at 25 frames a second; Google put a Live Avatar into Gemini 3.8 Live for Gemini Enterprise (Meta; Google).
• Qwen launched three mobile agents for planning, cross-app tasks and content creation (Qwen).
• Fireworks released Ember-1, built on Kimi K3, which used about 35% fewer tokens per task in live A/B tests (Fireworks).

Business moved

• AMD agreed to acquire World Labs; Fei-Fei Li becomes AMD's chief scientist, reporting to Lisa Su (AMD).
• Anthropic committed $11.6 billion over seven years to Akamai Cloud for CPU workloads and received a warrant for up to about 5% of Akamai (Akamai).
• Cognition crossed $1 billion in annualised revenue (Cognition).
• Lovable's annualised revenue passed $600 million, co-founder Fabian Hedin said (TechCrunch).
• DeepSeek's annualised revenue reportedly doubled to $1 billion after it raised API prices; DeepSeek did not comment (The Information, Reuters).
• Elon Musk said another 220,000 GB300 GPUs would be running at xAI next week and another 220,000 in November, with a third batch by late December "if we get lucky" (Elon Musk).
• Gusto co-founder Tomer London said more revenue can make a startup a worse acquisition target, because AI has raised the bar for buying over building (The Peel).
• Oxford let OpenAI train on scans of old theses from the Bodleian, which it says are out of copyright (The Guardian).
• CXMT said its fifth-generation DRAM is in mass production and on par with the industry's best nodes (CXMT).

Platforms shifted

• Microsoft rebuilt Copilot around Home, Code and Autopilot; Home and Code reach its Frontier program in the coming weeks and Autopilot enters private preview at the end of the month. Satya Nadella told Alex Heath Autopilot is built on a hardened version of OpenClaw (Microsoft; Sources).
• Meta announced Ray-Ban Meta Audio, camera-free AI glasses from $349, and FDA-cleared hearing enhancement for its AI glasses at $149.99, in the US later this year (TechCrunch; Meta).
• Claude Tag, Claude's Slack integration, now uses personal connectors in channels on Team plans, and developers on paid Claude plans can submit plugins to the Claude directory (Anthropic).
• Adobe's Claude plugin gained Acrobat tools, bringing it to more than 80 tools, and Adobe apps arrived in Gemini (Adobe).
• Gemini added connected apps including Linear, Webflow, Airtable and Zoho (Google).
• Google said it will add server-side memory under Private AI Compute that Google itself cannot read; no date given (Google).
• Cloudflare released Worker Previews, a production-like preview per Git branch (Cloudflare).
• AWS released CloudWatch Omni, AI-assisted observability for apps and agents that does not need AWS Console access (AWS).
• LangChain's Managed Deep Agents 0.8 added per-user credentials and memory, webhook channels and free web search during the beta (LangChain).
• Adobe ends support for Premiere Rush on 30 September (WIRED).
• OpenAI holds DevDay in San Francisco today (OpenAI).

We skipped the Opus 5.5 and GPT-6 launches we covered last week, a $500 ChatGPT tier that so far exists only in leaked code, a back-office automation story whose byline turned out to be an AI persona, and a pile of sponsor placements.