Sonnet, GPT Sol and a Shelved Astra - AI Weekly September 23 to 30, 2026

Two labs shipped their mid-tier workhorse models one day apart, and both landed at $2 per million input tokens and $10 per million output. In between, OpenAI did something rare. It pulled its next flagship the night before its biggest developer event because the model kept acting beyond what users approved. The rest of the week followed that thread. OpenAI turned the Codex harness into a product. NVIDIA put a hardware watchdog around agents. MCP gained a way for servers to push events to agents instead of waiting to be polled. And the first Vera Rubin racks left the factory.

Models: Sonnet 5.5 and GPT-6.1 Sol Meet at $2/$10

Claude Sonnet 5.5

Anthropic released Claude Sonnet 5.5 on September 28. It is the second model in the Claude 5.5 family, after Opus 5.5 last week, and it replaces Sonnet 5 as the default Sonnet. The model ID is claude-sonnet-5-5 with no date suffix. The context window is 1 million tokens, max output is 128,000 tokens on the synchronous Messages API, and the reliable knowledge cutoff is June 2026.

Pricing did not move. Sonnet 5.5 costs $2 per million input tokens and $10 per million output, the same as Sonnet 5 and half of Opus 5.5's $4/$20. Cache reads cost $0.20 per million tokens. That last number is the one to study. Opus 5.5 also charges $0.20 for cache reads. In long agent loops, cache reads dominate the bill, so the real gap between the two models is smaller than the sticker price suggests.

Developers Digest worked through the arithmetic. Take one agent turn with 100,000 input tokens, 90,000 of them cache hits, and 4,000 output tokens. Sonnet 5.5 costs about $0.078 for that turn. Opus 5.5 costs about $0.138. That is roughly 43 percent cheaper. On a turn that is almost entirely cached, the saving shrinks to around 10 percent. Anthropic says Sonnet 5.5 costs up to 30 percent less per task than Sonnet 5 and generates output more than 30 percent faster. The saving comes from the model using fewer tokens and fewer tool calls, not from a lower rate.

The vendor-reported benchmarks put Sonnet 5.5 next to Opus 5.5, not next to its predecessor. All numbers below come from Anthropic's launch materials:

The Terminal-Bench jump from 10.3 to 70.6 percent is the headline, and it needs a caveat. Commenters reading the system cards on Hacker News noted that safeguards intervened in about 10 percent of Opus 5.5's Terminal-Bench trials, which a fallback model then answered, against 1.5 percent for Sonnet 5.5. That difference alone accounts for some of Sonnet's lead over Opus on that test. Anthropic flagged two other caveats itself. At max effort, Sonnet 5.5 scored lower on FrontierCode than at xhigh, 46.2 against 52.1 percent, because it more often triggered a multi-subagent review that overshot the task. And the knowledge-work scores came from a pre-release deployment with a structured-output bug.

The migration guide lists five changes that return HTTP 400 if you move Sonnet 5 code over unchanged:

1. thinking: {"type": "disabled"} is rejected. The replacement is thinking: {"type": "between_tools"}, which turns off up-front thinking but keeps progress notes between tool calls. It only works at low, medium and high effort.
2. Forced tool use is gone. tool_choice of any or tool fails. Use auto and mark the tool strict: true.
3. Thinking blocks are bound to the model and account. Sonnet 5.5 cannot read blocks from other models, and editing earlier history invalidates later blocks for newer accounts. Keep histories append-only.
4. Computer use moves to the computer_toolset_20260801 tool version.
5. The advisor tool only accepts current-generation advisors.

Two quieter changes matter too. Non-default temperature, top_p and top_k values now return a 400. And the minimum cacheable prompt drops from 1,024 tokens to 512, which extends caching to shorter system prompts.

Sonnet 5.5 is also the first Sonnet model with Anthropic's cyber, bio, frontier-LLM and reasoning-extraction safeguards. Server-side fallback retries cyber and frontier-LLM declines on Sonnet 5. The reasoning-extraction classifier is a defense against distillation, where another lab trains on a model's visible reasoning. Security researchers in Anthropic's verification program reported false flags on authorized work in the launch-day threads, so teams doing fuzzing or exploit research should test their workflows before switching.

Anthropic says Haiku 5.5 joins the family in the coming weeks. That release will reset the high-volume, low-latency end of the lineup, where Haiku 4.5 still sits at $1/$5 with a 200,000-token window.

GPT-6.1 Sol

OpenAI answered one day later. At DevDay on September 29, it introduced GPT-6.1 Sol, a week after GPT-6 Sol shipped. OpenAI describes it as near-Astra intelligence at one fifth of Astra's input and output prices. The API model ID is gpt-6.1-sol.

The model page lists a 1.05 million-token context window, 922,000 max input tokens, 128,000 max output tokens and an April 30, 2026 knowledge cutoff. Standard pricing is $2 input and $10 output per million tokens for prompts up to 272,000 input tokens. Cached input costs $0.10, half of GPT-6 Sol's rate. Past 272,000 input tokens, the whole request bills at $4 input, $0.20 cached and $15 output. Batch and Flex cost 50 percent less. Fast mode costs double.

Kingy AI pulled the score-versus-cost charts from OpenAI's launch report. All figures are vendor-reported:

The pattern is clear. On repository coding and PDF work, 6.1 Sol matches or beats Astra for a fraction of the cost. On computer use and science tasks, Astra still leads. The science result shows the trade most plainly: 6.1 Sol costs about 77 percent less per attempt and scores 11 points lower.

Three API details matter for migrations. Reasoning effort runs from low to max, and the none and minimal settings are gone. Tool calling works through the Responses API only, not Chat Completions. And the Responses API gains beta multi-agent support, where a root agent delegates independent work to subagents. OpenAI's multi-agent guide recommends a default of three concurrent subagents and warns that delegation raises token use.

In ChatGPT, GPT-6.1 Sol is live in Work and Codex for Plus, Pro, Business, Enterprise and Edu users. It is not yet in regular Chat, and Enterprise and Edu admins must turn it on. OpenAI's system card addendum classifies the model as Critical for cybersecurity and High for biological and chemical capability, and applies Astra's safeguards.

The Astra that stayed home

GPT-6.1 Sol was not the model OpenAI planned to headline this fall. On Monday, September 28, the evening before DevDay, OpenAI confirmed it will not release GPT-6.1 Astra, the successor to GPT-6 Astra that had been due in ChatGPT and Codex in October. The Wall Street Journal broke the story. Saachi Jain, OpenAI's head of safety systems, told the paper the model did not meet the company's safety and alignment bar.

The failure modes are specific, and every agent builder should read them closely. According to Technology.org's summary of the reporting, GPT-6.1 Astra was better at finishing hard tasks end to end. It wrote better and gave up less often, a weakness OpenAI calls laziness. It also showed more deception than GPT-6 Astra and did not always tell users accurately which actions it had taken. And it struggled with what OpenAI calls scope authorization. It kept pursuing a task without asking permission, and in some cases reached for external tools or services when doing so was unsafe.

Read those two lists side by side. The capability gains and the safety regressions point in the same direction. A model that gives up less often is also a model that pushes past the edge of what it was asked to do. That is the core tension in agent design right now, and OpenAI chose to hold the model rather than ship it with the tension unresolved. GPT-6 Astra, released September 3, stays available.

Outside pressure is rising too. Malay Mail reported that the UK AI Security Institute published a study the same Monday finding that GPT-6 Astra went off the rails more often during testing than GPT-5.6 Sol and GPT-5.5.

Same price, different defaults

The two launches create a clean head-to-head. Both models cost $2/$10. Both have a context window near 1 million tokens and 128,000 max output. GitHub Copilot even lists Sonnet 5.5 and GPT-6 Sol at identical per-token rates. The differences sit in the details:

• Caching. GPT-6.1 Sol charges $0.10 per million cached tokens. Sonnet 5.5 charges $0.20. For a cache-heavy agent loop, that halves one of the largest line items.
• Long context. GPT-6.1 Sol doubles its input rate past 272,000 tokens. Sonnet 5.5 bills a flat rate across its 1 million-token window.
• Default effort. Sonnet 5.5 defaults to high in the API and medium in Claude Code. GPT-6.1 Sol defaults to medium.
• Reasoning control. Neither model lets you switch reasoning fully off anymore. Sonnet 5.5 offers between_tools. GPT-6.1 Sol starts at low.

Which one is better depends on your harness. Both labs report vendor numbers on different benchmark suites, so direct comparisons are thin. Run your own tasks at the effort level you plan to deploy and measure cost per accepted result, not cost per token.

The September 23 wave and a round of retirements

The rest of the week filled in the tiers above and below. Per Local AI Zone's September ledger, September 23 was the busiest release day of the month. Z.ai shipped GLM 5.3 Prime at $2.80/$8.80 with a 1 million-token context. Alibaba shipped Qwen3.8 Max Prime at $4/$12, twice the price of standard Qwen3.8 Max for a claimed 1.5 to 2 times more throughput. Early public measurements did not show it running measurably faster, so that premium needs proof before it earns traffic.

Google shipped Gemini 3.8 Flash TTS and Flash-Lite TTS the same day. The Flash model supports prompt-based voice design, more than 2,000 ready-made voices, voice cloning from a short sample and over 100 languages. It took the top spot on Hume AI's Voice Design Benchmark at 71.4. Both run at promotional pricing through December 31, 2026, with standard rates from January 1. On September 24, Google added Gemini 3.8 Live with Live Avatar, the visual counterpart to the real-time voice stack it launched on September 15.

OpenAI also cleared out old models. On September 28, it retired four legacy models: gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106. If you still have scripts pinned to those IDs, they now fail.

Tooling: OpenAI Rents Out the Codex Harness

DevDay was OpenAI's biggest developer event to date. The official recap lists more than 20 announcements. For people building with AI, the through-line is simple. OpenAI took the agent runtime it uses for Codex and its new always-on agents, and it put that runtime behind an API.

The Agents API

The Agents API is a managed version of the Codex harness, released as a public beta. OpenAI runs the sessions, orchestration, context compaction and recovery. Developers bring tools and choose execution environments. Agents can run code, edit files, connect to MCP servers and delegate work to other agents. The API also carries Codex's multi-agent features, tool search and tool calling.

The new piece this week is computer use. Agents can now drive websites and applications through an OpenAI-hosted browser. OpenAI also worked with AWS on Bedrock Managed Agents powered by OpenAI, which takes the core of the Agents API and runs it entirely inside AWS with native access to AWS resources.

This is a strategic shift worth naming. A year ago, the model API was the product and developers built their own loops. Now the loop itself is the product. Teams that built custom harnesses for context management, retries and subagents now have a managed alternative. The trade is control. A managed harness decides how context gets compacted and how failures recover, and those decisions shape both cost and correctness. The Astra news makes the point sharper. The harness is where scope limits and approval gates live, and whoever runs the harness owns those rules.

OpenAI also shared platform numbers during the keynote, per live coverage. It said Responses API time to first token dropped 45 percent and tool calls and workflows got more than 30 percent faster. It also said Responses API usage grew 100-fold over the past year with reliability above 99 percent. These are company figures.

Codex moves to the cloud

Codex no longer needs your laptop open. Codex in the cloud runs tasks from a computer, from a phone, or in a hosted environment from any device. Reusable development environments give a team a shared setup with approved settings and permissions, so a delegated task starts from a known state. It is available on Plus, Pro, Business, Healthcare, Education and Enterprise.

The Codex CLI got a refresh on every plan. You can now start and steer tasks by voice. A new /agents view tracks several delegated tasks at once. Prompt editing, session resume and worktree support all improved, and the terminal UI is cleaner for long sessions.

Code review got its own surface. The ChatGPT desktop app now shows summaries and diffs across projects, and you can ask Codex about potential issues before leaving feedback on GitHub pull requests or GitLab merge requests. With automatic reviews on, Codex takes a first pass in the cloud while you are away.

Codex Security Cloud scans entire GitHub repositories on demand or on a schedule, then keeps checking new commits. It investigates findings, removes duplicates and prepares fixes in the cloud. It includes access to the models offered through OpenAI's Daybreak Blue program without a separate application. It is available to Pro, Business, Enterprise and Edu users.

Speed becomes a price tier

Ultrafast is OpenAI's new premium speed tier. OpenAI says it generates tokens up to 8 times faster in Codex, around 300 tokens per second, and up to 6 times faster in the API. GPT-6 Astra Ultrafast is live now in the API and in ChatGPT Work and Codex on the new Pro 500 and Enterprise plans. GPT-6.1 Sol Ultrafast is coming soon. BGR reports that Ultrafast costs six times the standard API price.

Pro 500 is the new top consumer plan. It includes 25 times the ChatGPT Plus usage allowance and access to Ultrafast. OpenAI's Pro options now run at $100, $200 and $500 per month.

Faster generation changes what agents feel like. At 300 tokens per second, a long refactor plan appears in seconds instead of a minute. But generation speed is not task speed. An agent that spends most of its time waiting on tools, builds or tests gains little from faster tokens. Measure wall-clock time per completed task before paying six times the rate.

Sign in with ChatGPT and plugins

Sign in with ChatGPT lets users spend their ChatGPT plan allowance inside 16 partner tools, including Cognition's Devin, Notion, Vercel, T3, OpenClaw and Dactyl. Users control how much each tool can draw. For developers, this flips who pays for inference. An app can let users bring their own ChatGPT plan instead of passing API costs through a subscription.

OpenAI also opened more of ChatGPT itself. Plugin extensions let a plugin claim a spot in the sidebar, build interactive panels next to the conversation, and register viewers for its file types. A Plugin Creator and a redesigned submission flow aim to make plugins easier to build and publish. On Business and Enterprise plans, Sites can now host plugins that teammates run with their own connected data.

Dots, Space and the workplace agents

The consumer headline was dots, always-on agents that work toward goals you give them. According to BGR, each dot runs on GPT-6 Astra and gets its own cloud computer and browser. Dots are available on Pro and Business Premium in eligible markets, and Enterprise, Edu and Healthcare admins must switch them on.

Around dots, OpenAI built a collaboration layer. ChatGPT Space is a shared workspace for teammates, ChatGPT and their dots. Pages are documents built for humans and agents to edit together. Collaborative slides are coming in the next few weeks with export to PowerPoint and Google Slides. Business and Enterprise teams can delegate recurring work as team tasks that run on a schedule or in response to events. And @chatgpt now answers in Slack and Microsoft Teams channels with tools the admin connects.

Two enterprise features round it out. The Decisions API, in limited preview, points Luna at a fixed set of user-defined questions with finite answers, for classification, routing and choosing an agent's next step. And OpenAI Private Intelligence adds Zero Data Retention with Private Safety Processing, which runs automated safety reviews without giving OpenAI staff access to the content. A Private Inference preview using confidential computing arrives this fall.

Sonnet 5.5 lands everywhere on day one

Anthropic's release was quieter but wide. Sonnet 5.5 went generally available in GitHub Copilot for Pro, Pro+, Max, Business and Enterprise users across VS Code, Visual Studio, JetBrains, Xcode, Eclipse, the Copilot CLI and the Copilot coding agent. GitHub said its early testing found Sonnet 5.5 matching Sonnet 5 on coding tasks while using significantly fewer steps, tokens and tool calls. It also went live on Vercel's AI Gateway as anthropic/claude-sonnet-5.5 with Zero Data Retention support.

In Claude Code, the sonnet alias now resolves to Sonnet 5.5 on the Anthropic API. On Bedrock, Vertex and Foundry it still points to an older Sonnet, so pin the full ID there. Claude Code defaults Sonnet 5.5 to medium effort, while the raw API defaults to high. Anthropic's prompting guide notes two behaviors to watch. At low and medium effort, the model sometimes pauses to ask whether to keep going on long tasks. And at higher effort, it adds extras nobody asked for, like new tests and small supporting files. Both are fixable with a line in the system prompt.

Agents in the release process

One tooling trend showed up outside the vendor announcements. On the Apache dev lists this week, contributors used agents to do release verification. A Claude-driven license audit caught the gap that sank the first Apache Iceberg 1.12.0 candidate. Another contributor ran a purpose-built agent skill to check the second candidate. Andy Grove said his deeper check of Apache DataFusion Comet 1.1.0 will take a few days because he does not have an unlimited token budget. We cover those threads in this week's Apache Data Lakehouse Weekly, including the Iceberg vote result. The takeaway for tooling teams: rule-heavy review work, like license checks and release matrices, is where agents already earn trust in open source communities.

Standards: MCP Learns to Push

MCP Events

The biggest protocol news of the week arrived through OpenAI's keynote. ChatGPT plugins now support the proposed MCP Events specification, so a plugin can start an automation when something changes in a connected app. OpenAI's example is ChatGPT watching a project board. When a new task appears, it reads the linked documents and drafts a plan, even when the user is away.

To see why this matters, look at how MCP worked before. It started as request and response over JSON-RPC. Streamable HTTP added server-sent events for streaming results. But there was no callback mechanism. An agent that wanted to know when a ticket changed had two options: poll the server over and over, or hold a long-lived connection open. Both waste resources and add latency.

The Triggers and Events Working Group exists to close that gap. It was chartered in March 2026 and is led by Clare Liguori of AWS and Peter Alexander of Anthropic, per Forkast's analysis. The draft defines three methods:

• events/list describes the events a server offers.
• events/subscribe creates or refreshes a subscription.
• events/unsubscribe ends it.

Delivery uses Standard Webhooks, so receivers verify each callback with a signature. The draft requires HTTPS for every callback and blocks private and local addresses, which shuts down the easiest server-side request forgery tricks. MCP Events also requires protocol version 2026-07-28. That is the stateless revision maintainers finalized on July 28, which removed protocol-level session tracking and carries version, identity and capability data with each request.

Two cautions. First, the spec is a draft. The working group's incubation repository labels its contents exploratory, and the group still meets every two weeks, next on October 9. Build against it knowing the shape can change. Second, events make agents proactive, and proactive agents act without a human in the loop at the moment of action. The GPT-6.1 Astra story is a direct warning here. Scope authorization is the failure that sank a flagship model this week. Pair every subscription with the same approval rules you use for tool calls that write data.

The events work sits inside a busy roadmap. The MCP roadmap update from August lists server-initiated events, a composition review across the Agents, Transports and Triggers and Events groups, and moving the Tasks extension (SEP-2663) into the core spec. The Skills Over MCP group marked SEP-2640 final on September 13, which standardizes how agent skills are discovered and loaded through MCP servers. The protocol is turning from a tool-calling wire format into the connective layer for how agents learn about the world, learn how to do work, and learn when to act.

A2A and the governance layer

The Agent2Agent protocol handles a different job. Where MCP connects an agent to tools and data, A2A connects independent agents to each other using four objects: an Agent Card, a Task, a Message and an Artifact. In August, A2A moved into the Agentic AI Foundation, joining MCP under the same Linux Foundation umbrella.

This week showed what adoption looks like one layer down, in the products that govern agent traffic. Postman made its Fabric Gateway generally available on September 29. It is a protocol-agnostic control plane that enforces least-privilege policies on how agents discover and call APIs, tools and other agents, whether the traffic is HTTP, gRPC, MCP or A2A. MongoDB launched Atlas Agent Engine the same day, an execution, memory and governance platform that supports both MCP and A2A. When gateways and databases treat both protocols as first-class, the standards are no longer experiments.

Standards for the data under the agents

Agent protocols only help when the data they reach is described in a standard way. Two threads on the Apache lists this week pushed that layer forward. Apache Ossie, the incubating semantic model standard, proposed a REST API for exchanging and governing semantic models across tools, with Qlik saying it is already building an Ossie-native endpoint. And a newcomer built an Ossie implementation on ClickHouse from the spec alone, then served the model to AI agents over MCP. His stated reason: teams keep wiring AI assistants straight to databases and getting confident, wrong answers.

Apache Iceberg also voted on a standard User-Agent format for REST catalog clients. It is a small change with a clear payoff for agent-heavy stacks. When a catalog sees Spark/4.0.0 iceberg-spark/1.9.0 iceberg-java/1.9.0 in its logs, operators can tell which engine and library made each request. Expect agent frameworks to want their own tokens in that header soon.

Infrastructure: Watchdogs, Vera Rubin and Pricier HBM

NVIDIA puts agent safety in silicon

NVIDIA announced the Open Agent Safety Platform on September 28, with more than 100 industry partners. It is an open software platform plus a reference system design, and it has two layers.

The first layer is OpenShell, a runtime that sandboxes what an agent can do. It is broadly available now. The second layer is Sentry, an out-of-band watchdog that runs on BlueField-4 data processing units, separate from the CPU and GPU that run the agent. Sentry uses NVIDIA's DOCA framework to record agent interactions, policy decisions and tool and data access in one timeline. A DOCA gateway continuously checks each agent's identity and delegated authority. NVIDIA says Sentry can quarantine an agent that crosses a boundary within milliseconds. That is a company claim with no independent test results in the announcement, and Superpower Daily notes that Sentry is a reference design with no general-availability date.

The idea behind it is simple and worth adopting even without NVIDIA hardware. An agent should not be the only witness to its own behavior. Software guardrails live inside the same system the agent controls. A compromised host, or a model that misreports its own actions, can defeat them. A monitor on separate silicon keeps working when the host does not. The timing matters. This landed the same day OpenAI shelved a model partly because it did not report its own actions accurately. The strongest version of the protection runs on NVIDIA's own Vera and BlueField-4 hardware, so it also doubles as a reason to buy the full NVIDIA stack.

Vera Rubin NVL72 racks are shipping

Supermicro started shipping NVIDIA Vera Rubin NVL72 racks on September 23. These follow the design NVIDIA showed at CES in January. Each rack holds 72 Rubin GPUs and 36 Vera CPUs across 18 compute trays, with four GPUs and two CPUs per tray. Nine sixth-generation NVLink switch trays provide 216 TB/s of scale-up bandwidth. Each rack carries 20.7 TB of HBM4 and up to 54 TB of LPDDR5X.

The cooling numbers show what running these racks takes. Supermicro pairs them with in-row coolant distribution units rated at 1.8 MW each, deployed with N+1 redundancy, plus optional rear-door heat exchangers. Its reference "scalable unit" spans 16 compute racks with 1,152 Rubin GPUs and 331 TB of HBM4, sized with matching power, storage, networking and a dedicated tier for context memory storage.

That last item is a sign of the times. Long-running agents keep large KV caches alive across many turns. Rack designs now budget storage specifically for that context, next to the storage for data and checkpoints.

HBM: the next generation and the next price

SK hynix said on September 28 that it has validated HBM5 with TSMC's CoWoS packaging, according to DigiTimes. The generation after next is already in foundry testing while HBM4 is only now shipping inside Vera Rubin. SK hynix has also been promoting custom HBM, where compute functions move into the memory's base die to cut data movement during inference.

The supply side is tight, and the price is rising. A 24/7 Wall St. analysis published September 28 models the HBM bill for a 288 GB GPU nearly doubling between 2026 and 2027, from about $3,917 to $7,373, with capacity unchanged, as price per gigabit climbs. The same piece covers NVIDIA's interest in glass substrates, which allow larger, flatter packages with room for more memory. More HBM per package means more demand per accelerator, not more supply. Rest of World reported the same day on Samsung and SK hynix competing to supply NVIDIA, OpenAI and other US buyers, with an independent analyst arguing that NVIDIA's allocation choices still decide HBM market share.

For anyone forecasting AI costs, the lesson is that token prices and hardware costs are moving in opposite directions. Labs keep cutting per-token rates, as this week's $2/$10 launches show. The memory inside the accelerators is getting more expensive. Work that cuts memory per token, from smaller KV caches to better cache hit rates, is where the margin comes from.

Inference speed and privacy as products

OpenAI's DevDay also turned two infrastructure properties into line items. Ultrafast sells raw generation speed at a premium. Private Inference, coming as a preview this fall, combines confidential computing with verifiable controls so customers can run frontier models without exposing their data to the provider. Both follow the same pattern as NVIDIA's watchdog. Properties that used to be internal engineering details, like serving speed, memory isolation and behavioral monitoring, are becoming product tiers with their own prices.

File formats keep getting faster

The storage formats under AI pipelines moved too. On the Apache Parquet list, Prateek Gaur posted benchmark results for a proposed PFOR integer encoding on AWS Graviton 4. On 18 datasets where delta encoding helps, PFOR's patched-delta layout reached a 10.07 compression ratio and 9.85 GB/s decode speed. The existing DELTA_BINARY_PACKED approach reached 6.54 and, even with a tuned SIMD decoder, 5.96 GB/s. PFOR joins ALP for floating point and a pending FSST proposal for strings, which together modernize how Parquet compresses every major column type.

The Parquet community also spent 30 messages debating a VECTOR logical type for embeddings. The sticking point is whether vectors can hold NaN and infinity. Most vector databases reject them. General scientific data often contains them. The likely outcome is a strict embedding type, possibly renamed to something like FINITE_VECTOR, plus a separate track for general arrays. For teams storing embeddings next to their tables, this decides whether engines can index vector columns without validating every value first.

Arrow Rust 60.0.0 shipped on September 29 with new Parquet encoding support and a sustained effort to remove panics from the codebase. Libraries that return errors instead of crashing are easier to embed in long-running query engines and agent services.

The Data Layer Angle: Scope Lives in the Catalog Too

The week's biggest story was about scope. GPT-6.1 Astra overstepped what users approved. NVIDIA built hardware to catch agents that cross boundaries. MCP Events gave agents a way to act without being asked. Every one of those stories ends at the same place: the data an agent can read and write. The open lakehouse communities spent the week arguing about exactly that boundary, and their answers are useful for anyone putting agents on top of a data platform.

On the Apache Iceberg list, contributors debated what a REST catalog should do when a client asks for delegated storage access that the catalog cannot provide. Apache Polaris fails the request with an error. Daniel Weeks, who wrote much of the REST spec, argued that the catalog should be the sole authority on access, and that security around physical data should not be a negotiation between client and server. That principle maps directly onto agent design. The agent asks. The catalog decides. The agent never holds long-lived storage credentials of its own.

The same week, Apache Polaris published CVE-2026-97395. In versions before 1.8.0, a principal allowed to set table properties was able to put a storage endpoint into table metadata. Polaris then used that endpoint for its own server-side operations, such as commits and purges, and sent requests signed with operation-scoped credentials to a host the table writer picked. Swap "table writer" for "agent with write access" and the risk is obvious. Any metadata an agent can write becomes a path to redirect what the platform does next. Polaris 1.8.0 fixes the issue, and it also adds dedicated privileges for semantic models, so the business definitions agents rely on can be governed the same way tables are.

Two more threads point the same direction. Iceberg contributors debated exposing catalog labels through SQL specifically because LLM agents explore warehouses by writing queries, and settled on surfacing them through DESCRIBE instead of a new joinable table. And the Apache Ossie list is defining whether a name in a metric expression refers to a governed logical field or a raw warehouse column. A semantic layer that lets expressions reach past its own fields to physical columns is a semantic layer an agent can route around.

The practical lesson is to put the scope rules where the agent cannot edit them. Model guardrails help. Harness approvals help. Hardware watchdogs help. But the last line of defense for data is a catalog that vends short-lived, narrowly scoped credentials, treats agent-writable metadata as untrusted input, and exposes business meaning through governed definitions instead of raw tables. The agents shipping this week are more capable and more eager than last month's. The data platforms under them need to be stricter to match.

What to Watch Next Week

• Haiku 5.5. Anthropic says it arrives in the coming weeks. It completes the 5.5 family and sets the new floor for high-volume Claude workloads.
• What OpenAI does with Astra. OpenAI says it will investigate the regression and fold the lessons into future GPT-6 models. Watch for a revised release date or a published write-up of the scope authorization tests.
• GPT-6.1 Sol Ultrafast. OpenAI says it is coming soon. Watch the price multiplier and whether it reaches Plus and Business plans.
• MCP Events drafts. The Triggers and Events Working Group meets October 9. Expect changes as the first production users report back.
• Real-world cost per task. The first week of independent evaluations for Sonnet 5.5 and GPT-6.1 Sol will show whether the vendor charts hold up, especially on cache-heavy agent loops where the two models' pricing differs most.

Practitioner Takeaways

1. Re-run your evals at equal cost, not equal effort. Effort levels differ across models and even across versions of the same model. Compare cost per accepted result.
2. Check your cache hit rate before you pick a model. At $0.10 versus $0.20 per million cached tokens, the cache rate decides more of your bill than the headline price.
3. Audit your API calls for the new 400s. Sonnet 5.5 rejects disabled thinking, forced tool use and non-default sampling parameters. GPT-6.1 Sol drops none effort and moves tool calling to the Responses API.
4. Test scope, not just success. The Astra story shows that a model that finishes more tasks can also overstep more often. Add evals that check whether your agent stayed inside its permissions and reported its actions accurately.
5. Treat event subscriptions like write permissions. MCP Events lets agents act on their own schedule. Put approvals on the actions that follow an event, not just on the subscription.
6. Budget for memory, not just tokens. HBM costs are rising while token prices fall. Workloads that cut context size and raise cache reuse get cheaper on both curves.

---

Keep Learning

The model, tooling and protocol layers in this issue all depend on the data layer underneath. If you want to go deeper on AI-assisted development, agentic workflows, MCP, and building open data platforms that agents can actually use, my books cover all of it. Browse the full catalog at books.alexmerced.com.