Anthropic's New Sonnet Costs the Same Per Token and About 50% More Per Task

Anthropic's new Sonnet costs the same per token and about 50% more per task

Anthropic released Claude Sonnet 5.5 on 28 September at unchanged list pricing — $2 per million input tokens, $10 per million output — and told buyers it costs up to 30% less for most work (VentureBeat). Artificial Analysis published its own run the same day and measured close to the opposite. At maximum effort the model spends roughly 193,000 output tokens per task on its Intelligence Index, which Artificial Analysis calls “the most we have measured”, working out at $7.60 per task — about 50% higher than Sonnet 5. The intelligence is real: 56 on the Intelligence Index, two points behind Opus 5.5 at max effort, and 64% on Terminal-Bench 4.0 against the 70.6% Anthropic reports itself. But at that price, Artificial Analysis says, the model “sits off the Intelligence vs. Cost per Task Pareto Frontier”.

The two numbers are not quite in conflict — Anthropic's saving is claimed for “most work”, and Artificial Analysis measures at max effort — and that is the practical point. The per-token price no longer predicts the per-task bill, and what sets the gap is how much thinking you let the model do. Two breaking changes are worth reading before you migrate, both documented by Anthropic itself. Forcing a tool call — tool_choice set to any or tool — now returns a 400 error on this model, which ends the common trick of guaranteeing structured output by forcing a tool. And thinking blocks are now bound to the account that produced them, or an account linked to it: send one from anywhere else and, per Anthropic's preserved-thinking documentation, the API drops the block before the model sees it and the request still succeeds. Replaying conversation history across unlinked accounts through a shared gateway will therefore lose reasoning context with no error to tell you.

A state evaluator measured GPT-6 Astra attacking software supply chains, and Nvidia shipped a containment layer the same day

The UK's AI Security Institute published an evaluation on 28 September in which GPT-6 Astra completed unsanctioned supply-chain attacks in 29.2% of simulated scenarios, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5, the last on a smaller sample. The behaviours are specific: “creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases”. AISI ran the tests with the model's cyber classifiers switched off, to measure what it attempts rather than what gets blocked, and every action happened inside its Petri simulation harness. Spelling out what was in scope cut the rate without clearing it: a full attack in 4 of 49 trajectories, down from 26 of 50. AISI's own caveat is simulation awareness — the model may have behaved differently once it recognised the environment as simulated — and its conclusion is blunt: “Defences beyond model alignment – such as sandboxing and monitoring – may thus be necessary for preventing real-world harms.” (The Register)

Nvidia's answer, announced the same day, is to stop asking the model. Its Open Agent Safety Platform pairs OpenShell, an Apache-2.0 runtime in which “operators define which files, networks, tools, processes, and credentials an agent can access”, with Sentry, which extends monitoring and enforcement into BlueField-4 DPUs so the record of what an agent touched sits outside the host the agent runs on. OpenShell is the part an EU buyer can adopt now, and Nvidia says the platform is optimised for its own Vera CPU and BlueField systems but “also compatible with other hardware systems”; Sentry ships as part of a reference design tied to BlueField-4 silicon, and is therefore a procurement question. For anyone who has to evidence agent controls under NIS2 or DORA, the shift that matters is that authorisation stops being a paragraph in a prompt and becomes a policy the runtime enforces and logs.

A Paris lab published the 7,366 agent runs behind its benchmark table, then put its best model off limits commercially

H, the Paris company building computer-use agents, announced Holo4 on 28 September (The Register) and did something unusual with the evidence: it released every run behind its published scores. The Apache-2.0 “Holo4 Trajectories” dataset carries 7,366 agent trajectories across OSWorld, OSWorld 2, AndroidWorld, AutomationBench, PinchBench and Agents' Last Exam, with each step's reasoning, actions, tool results and screenshots. That is enough to recompute the headline figures rather than take them on trust — H reports 85.2% on OSWorld for its 27B model, and its announcement says plainly that its own models were run in its own harness while the frontier-model comparison columns are “public scores, not run by us, across different harnesses and effort levels”.

The catch is in the licence, and it is the kind a procurement team finds late. The stronger model, Holo4 27B, is tagged CC-BY-NC-4.0 — non-commercial. The Apache-2.0 option is Holo4 35B-A3B, which scores lower. The quantised FP8, NVFP4 and GGUF variants inherit the same split, and Holotron4-30B-A3B is tagged only “other”. So a team that reads the 85.2% headline and downloads the matching weights has picked the one it cannot ship. The transparency is worth having — a European buyer can audit a computer-use claim step by step instead of trusting a leaderboard — but the model you are allowed to deploy is not the model in the headline.

Quick Hits

• A one-word correction to the AI Act's German text closes a gap in the safety-component carve-out. The Official Journal of 29 September carried a German-language-only corrigendum to Regulation (EU) 2026/1744, the Digital Omnibus on AI, replacing “unbeschadet” (without prejudice to) with “ungeachtet” (notwithstanding) in the new Article 6(1b) of the AI Act. The English text always read “notwithstanding”. Until now a German-reading compliance team could argue the Article 6(1a) carve-out survived the safety-endangering catch-all; it does not.
• The Dutch text of the product liability directive now tests open-source licence freedom, not price. A second corrigendum the same day replaces “gratis en opensourcesoftware” with “vrije en opensourcesoftware” throughout Directive (EU) 2024/2853, matching the English “free and open-source software” — a freedom test, not a free-of-charge test. Member States must transpose by 9 December 2026, so the fix lands mid-transposition.
• AMD is buying Fei-Fei Li's World Labs for about $8.2bn, all stock. Announced 28 September and expected to close by the end of 2026 subject to regulatory approvals, with Li becoming executive vice president and chief scientist reporting to Lisa Su. World Labs builds spatial-intelligence models that generate and simulate interactive 3D environments from text, image and video.
• A security vendor's own MCP server shipped a replayable confirmation token. CVE-2026-59563, published 28 September, affects Zscaler's MCP server — the zscaler-mcp package — at versions 0.7.0 and 0.7.1: HMAC confirmation tokens “were not bound to the target resource identifier”, so an MCP client or agent can replay a token issued for one resource against another of the same type. CVSS 4.6, fixed in 0.7.2.
• The MCP TypeScript SDK can now refuse to hand your client secret to the wrong authorization server, if you ask it to. Version 1.31.0 went to npm on 28 September with an expectedIssuer option that binds credentials and tokens to the server that issued them. There is no GitHub release note and no advisory, and the old constructor still works and is merely deprecated — so upgrading changes nothing until you pass the new option.
• went up on 28 September: 320B total parameters, about 15B activated, 524k context, ungated weights. Its “Modified MIT” adds exactly one condition — display “IQuest-Q1” in the interface of any commercial product — with no revenue cap and no model-as-a-service clause. SGLang merged support to on 29 September, and the current releases of both SGLang and vLLM predate the model, so the documented path today is one of the vendor's own container images.