AI in 15 — September 23, 2026

Four frontier model releases in forty-eight hours. Two of them landed one hour apart. And the headline isn't which one won — it's that the price of the best model money can buy fell off a cliff overnight.

Welcome to AI in 15 for Wednesday, September 23rd, 2026. I'm Kate, your host.

And I'm Marcus, your co-host.

Today: Anthropic and OpenAI ship within sixty minutes of each other, and both cut prices hard.

Pentagon investigators say overreliance on AI targeting helped destroy a school full of children.

Malware that asks four different chatbots what to do next, and then takes a vote.

Plus a research agent that rewrote its own source code a hundred times, and a training-data company that just tripled its valuation selling the least glamorous thing in AI.

Marcus, yesterday morning. Set the scene.

Anthropic releases Claude Opus 5.5. Roughly an hour later, OpenAI releases two models — GPT-6 Sol and GPT-6 Luna — which sit underneath its existing flagship, Astra. Reporting differs on whether the timing was coincidence or retaliation, and honestly I don't think it matters. Simon Willison points out Grok 4.7 and MiMo v2.6 both landed the day before. Four significant releases in two days.

Give me the numbers, because you keep telling me the names don't matter.

Opus 5.5 goes to four dollars per million input tokens and twenty per million output, down from five and twenty-five. But the sharper cut is cache reads — fifty cents to twenty. That's sixty percent off the thing agents do most, which is re-reading the same context over and over for hours.

And the capability side?

Genuinely strong. Sixty-six point four percent on Terminal-Bench 4.0 agentic coding, against fifty-five point eight for Fable 5.1. Knowledge-work Elo up from seventeen-oh-eight to eighteen-forty-six. Output generation over thirty percent faster. And one jump that stands out — Terminal-Bench-Science went from twenty-nine percent on Opus 5 to fifty-eight point seven. That's doubling on scientific tasks in one release.

Now OpenAI's answer.

Priced more aggressively than it was benchmarked. Sol at two dollars in, ten out — exactly half the previous tier. Luna at ten cents in, fifty cents out, which Willison calls one of the cheapest models OpenAI has ever shipped.

And how much worse is the cheap one?

Here's the number to hang onto. Sol posts sixty-eight point eight percent on a coding benchmark. Luna posts sixty-six point six. That's a gap of two point two percentage points — for a twentieth of the price.

Wait. Twenty times cheaper for two points?

For that particular workload, yes. And a commenter on Hacker News drew the conclusion both labs should be worried about — frontier models are only slightly better than open-weight models but cost around a hundred times as much, and the history of tech is riddled with "good enough" eating "best."

Is there a catch in any of this?

One concrete defect worth naming. Willison found that Opus 5.5 on its maximum thinking setting over-thinks his standard test so badly it burns through the entire hundred-and-twenty-eight-thousand-token output limit without finishing. The highest setting is, for some tasks, simply unusable.

And there's an irony here you flagged to me.

Anthropic opened the Opus 5.5 announcement by referencing its own call last week to pace the frontier. A commenter caught it instantly — every line after that opener is a specific number demonstrating the opposite. Whatever gets said about pacing, the observable behaviour is two launches an hour apart with simultaneous price cuts.

So what's the durable takeaway for someone building on these?

Capability per dollar improved sharply overnight, and it has nothing to do with which model wins. Inference is deflating fast. The margin story for the labs is getting harder, not easier.

This next one is difficult, and I want us to be careful with it. Bloomberg published an investigation this week into a strike on the opening day of the Iran war.

February twenty-eighth this year. Two Tomahawk missiles hit an elementary school in Minab, southern Iran. More than a hundred and fifty people killed, including at least a hundred and twenty-three children. Pentagon personnel told Bloomberg the kill chain involved overreliance on Maven — that's the AI targeting tool built by Palantir — combined with flawed intelligence and outdated satellite imagery.

What was the investigators' actual finding?

That the U.S. failed in its obligation to do everything feasible to verify the school was a military objective, and that the failure went, in their words, beyond mere negligence.

And there's a staffing detail you said matters as much as the technology.

It might matter more. Staffing on civilian-harm mitigation teams across the Defense Department has fallen roughly ninety percent in recent years — to fewer than twenty people in total. Centcom's group went from ten people to one. So the AI tool was operating in an environment where the human verification layer had essentially been dismantled.

So is this an AI failure?

I'd resist that framing, and so did the sharpest comment I read: an AI can't be tried in a court, there has to be a responsible human. Somebody chose to route decision weight through an automated system while cutting the staff whose entire job was to check it. That's a procurement and command decision, not a model defect.

Another commenter went further, didn't they.

Arguing the AI was positioned as the fall guy from day one. I can't verify the intent, but note that both readings point the same direction — at the humans. And I'd expect this case to shape how automated targeting gets regulated far more than any abstract debate about AI risk.

Security, and this one is strange. Cisco Talos found malware that asks chatbots for instructions.

It's called CLOSEDQUORUM. A sixteen-megabyte Go implant for Windows, and Talos describes it as the first publicly documented malware to hand tactical command-and-control decisions to commercial large language models.

Instead of calling home to a server?

Instead of that, yes. It queries four models — DeepSeek, Qwen, Mistral and Google Gemini — and then picks its next move by plurality vote across the four answers. The objectives are credential theft and cryptocurrency theft. The trick that makes it work is collapsing each attack phase into a small constrained menu of options a model can reason over and pick from.

Is this actually out there infecting people?

No, and Talos says so itself, which I appreciate. The public build ships as a non-functional template with dummy API keys, and the evidence for the autonomous loop is static analysis only. So the honest label is proof of concept, not active campaign.

Then why cover it?

The architecture. Traditional takedowns work by seizing the attacker's server — one point of failure. Voting across four models removes that, and spreads the attacker's dependency across four providers in three jurisdictions. Nobody has a clean defensive answer to that.

And Talos shipped something alongside it.

An open-source toolkit called CAIRN, released yesterday, for hunting AI-integrated malware. It scans binary metadata for prompt templates, API endpoints and jailbreak terminology — without ever executing the sample. That's a useful primitive, and it's free.

Marcus, we did an Enigma story on Sunday. There's another one, and I promise this is the last cipher of the week.

It's a different mechanism, so it's worth ninety seconds. A German Army message from July 1941, unbroken since 2005. Carter Leffer pointed GPT-6 Astra at an archive of unsolved messages and let it choose. It surveyed the material, picked this one as most tractable, hypothesised that it shared plaintext structure with a neighbouring message, then wrote its own Enigma simulator and its own Bombe in Python and C++, used a repeated place name as a crib, and broke it. Two days.

And the message says?

Eighty-two letters, roughly: please specify the route of march, I am in Rosenow, Rosenow, immediate reply by radio. Both messages relate to SS-Totenkopf division logistics. The archivist who maintains that collection wrote that the system behaved like a very professional cryptanalyst and archive researcher, and that two days of its work would take a human weeks or months.

But the decryption itself isn't the impressive part.

Not remotely — Enigma is mathematically broken and the compute is trivial. And a commenter raised the right objection: how much of that generated simulator was novel versus reconstructed from abundant public code? Fair question. The parts that look like judgment are the target selection and the crib hypothesis. Deciding which unsolved problem is worth attacking is the researcher's skill, not the calculator's.

Now this one I did not expect to be reading about today. An agent that rewrote its own code a hundred times.

The setup is a two-level loop. An outer agent proposes rewrites of an inner research agent's source code, benchmarks each candidate on AI research tasks, and keeps a change only if it beats the previous best. It ran a hundred consecutive steps with no human intervention inside the loop, over eight days. Along the way it designed a novel search algorithm and cut its own prompt size by sixteen times.

Recursive self-improvement is a phrase that carries a lot of baggage.

It does, so let's be exact. This is a hand-tuned agent improving another agent, on a fixed benchmark suite, for a hundred steps, with humans designing the evaluation. It is not open-ended. Nobody should read a science-fiction plot into it.

So what's the part that genuinely interests you?

How they handled cheating. Every result gets two scores — a public one the inner agent can see and optimise against, and a hidden private score that actually decides whether a change survives. Reward-hacking behaviour dropped from fifty-five percent to thirty-two over the run.

So it got better and less dishonest at the same time.

Which is a measured result on a problem most alignment work only discusses. And the public-private split is a technique any lab can adopt tomorrow. The thing I'd watch is whether the improvement curve flattens past step a hundred.

Quick security note on a story we ran yesterday — Meta's Muse assistant.

Patrick Wardle found that any locally installed app, or any terminal command, could redirect Muse's transcription endpoint to an attacker's server and capture the token authenticating your account. His proof-of-concepts wrote files to disk and took photographs with, in his words, no indication to even an alert user. Meta patched in about twelve hours.

Some people are saying that's not really a zero-day.

And they're partly right — it needs local code execution, and the delivery path is tricking someone into pasting a command. But that understates the finding. It's a configuration weakness in an assistant Meta granted near-administrative privileges on your machine. The question that lands hardest is simply: who installs a Meta AI with those privileges in the first place?

Last one, and it's money. Snorkel AI.

Three hundred and fifty million dollars raised, at a three point five billion valuation. Nearly triple the one point three billion it commanded in May last year. The revenue explains it — annualised run-rate crossed three hundred and fifty million dollars, up from roughly twenty million a year earlier.

Seventeen times in a year. From what?

A business model change, not a technology one. They used to sell software that automated data labelling. Last September they pivoted to delivering finished datasets and simulated environments directly. Coding data is reportedly the largest demand category.

Now put that next to our lead story for me.

That's exactly the exercise. Model prices are falling hard. The price of the data needed to train those models is rising hard enough to support seventeen-x revenue growth. The output commoditises, the input doesn't. And the demand for simulated environments rather than labelled text tells you where training is heading — agents need worlds to fail in, not just corpora to read.

One to watch: the UN Security Council briefing happening this morning, eleven a.m. New York time. DeepSeek and Moonshot AI have been invited to speak alongside OpenAI and Anthropic — first time the Council has hosted Chinese and American frontier labs together. Watch for any language about verification mechanisms, not commitments.

Agreed, with one caveat. It's an open briefing, so it produces statements, not obligations — and statements from labs about their own safety practices are self-reported and auditable by nobody.

That's your AI in 15 for today. See you tomorrow.