Wednesday was a two-first-party-labs day: Anthropic’s Fable 5.1 / Mythos 5.1 launch (the same model in two safeguard configs, with the cache-read price cut that actually changes agent cost math) and OpenAI’s claim that Astra now meets its “Critical” cybersecurity threshold — the first model designated at that level. Underneath, a record-fresh arXiv day (1,072 items, all Sep-1 IDs) filled the research slots with harness- and agent-memory-focused work: training/inference mismatch in memory-compressing harnesses, deterministic cache invalidation across episodes, and a continuity substrate for persistent agents. Simon Willison found a full LibreOffice copy riding in the Codex desktop app, and WSJ says Gemini 3.8 Flash could drop as soon as today.

The lead: Anthropic ships Claude Fable 5.1 and Mythos 5.1

  • Introducing Claude Fable 5.1 and Claude Mythos 5.1 — Same underlying model in two safeguard configs: Fable 5.1 is generally available; Mythos 5.1 is trusted-access only (US cyberdefense orgs via CVP, biology access coordinated with the US government). Price stays $10/$50 per 1M in/out, but cache-read pricing drops 75% to $0.25/1M — cutting estimated cost ~25% for typical workloads and up to ~45% for highly agentic, context-heavy work. Also new: Enterprise Frontier Safeguards (EFS) — zero data retention by keeping data in customer-controlled cloud infrastructure, phased in later this fall, with plain zero-retention for eligible customers until then. Cyber-safeguard false positives down 60%. Per PCWorld, Fable 5.1/Mythos 5.1 are Anthropic’s first models to watermark text outputs, with a detection API for eligible groups under EU law. Vendor-reported numbers flagged, not independent: Terminal-Bench 4.0 55.8 (Fable) / 60.9 (Mythos), Terminal-Bench-Science 52.6 vs Fable 5’s 24.7, OSWorld 2.0 41.7% strict, HLE 60.9% no-tools. Defaults to High effort in Claude Code, Medium in Cowork/Claude.ai — the cache-read cut is the number that changes agent cost math. System card linked from the page. (HN · first-party · Techmeme)

Policy & provenance

  • Path to Astra: critical capabilities and frontier safeguards — First-party: OpenAI now assesses that Astra meets the Critical cybersecurity threshold under its Preparedness Framework — the first model designated at that level. Self-reported eval highlights: 100% on ExploitBench, and on an internal port of 20 recent V8 vulns Astra hit high arbitrary-code-execution rates and discovered two zero-days mid-eval (being disclosed); expert assessments produced a browser sandbox-escape chain and a local privilege-escalation chain to root. Safeguards: 91.5% refusal on cyber-jailbreak sets (vs 59% for GPT-5.6 Sol), stricter boundaries for high-risk accounts, and chain-of-thought misalignment monitoring that can stop unauthorized agent actions in production. Release “soon” with advanced-cyber access limited to alpha testers/Daybreak Blue. The post ties back to the HF incident (OpenAI says its then-safeguards would have prevented it; the paused large frontier RL run restarted Aug 28). All capability numbers are vendor-reported. Context: The Information (paywalled, sources-say) reports Astra uses “recurrent depth” — cheaper and faster, but reasoning that’s harder to monitor, which is precisely the tension this post is managing. (HN · first-party · Techmeme)

Agent frameworks & tooling

  • The ChatGPT/Codex app bundles a full copy of LibreOffice — simonw dug into the desktop app bundle: a full LibreOffice install rides along so ChatGPT Work/Codex can render and edit .docx/.xlsx-style files offline. Explains the app’s Office-file behavior and its disk footprint; useful before you blame the agent for weird document round-trips. (HN)

Models & research

  • MemoryWalker: Stop Training Agents on Contexts They Never Saw — (arXiv 2609.00865, Sep 1) the paper’s own subtitle says it: “Your Memory-Compressing Harness Makes Training and Inference Inconsistent.” Production harnesses (Claude Code, Qwen-Agent, MemexRL) compress context during rollout, so the effective training object is a tree, not a sequence — naive linearizations leak or mismatch. Proposes exact fixes (LogitTree, packed 4D attention mask) plus a one-pass SDCC relaxation that closes the train-deployment gap on web-search agent benchmarks. Anyone fine-tuning agents that run in memory-compressing harnesses should read this. (arXiv)

  • Invalidation Contracts for Cross-Episode Agent Memory — (arXiv 2609.00243, Aug 31 → Sep 1 feed) a protocol layer that version-stamps cached agent recovery suggestions so stale entries get evicted deterministically instead of failing silently after data drift. Row-level invalidation recovers 29–33% of token cost on 4 of 7 models; table-level invalidation destroys co-located entries (0% post-drift success on 5/7). Best detail: compliance is planner-dependent — identical bytes get 100% first-try compliance from Claude Haiku 4.5 but ≤11% from Sonnet 5, which refuses schema changes. Directly useful for agent-memory/caching design. (arXiv)

  • HarnessDev: Can LLMs Create and Evolve Their Own Agent Harness? — (arXiv 2609.01437, Sep 1) flips evaluation from task output to runnable infrastructure: agents build a harness from a seed and evolve it with execution feedback across 2,207 held-out instances. Generated harnesses lag human references on code and search-research, match on writing and ML experimentation, and evolution gains are unstable and mostly don’t transfer across models — evidence that harness capability is model-specific. (arXiv)

  • Runtime-Independent Persistent Agents: Preserving Identity, Memory, and Code Across Models, Harnesses, and Servers — (arXiv 2609.00546, Sep 1) a continuity substrate (identity + private durable memory + versioned code body) separated from the replaceable execution layer (reasoner/harness/host), with a quiesce–checkpoint–validate–bind–rehydrate–resume protocol so changing models or hosts is migration, not re-creation. Open reference implementation (Enoch, 833 core tests). The right mental model for anyone building long-lived agent memory like the OpenViking-style systems you work on. (arXiv)

  • The Structure of Quantization Damage in LLMs: Why the Next Bit Should Be Spent Globally — (arXiv 2609.01587, Sep 1) causal mixed-precision interventions across 9 open-weight models show quantization damage is diffuse, not concentrated in identifiable “critical layers”: recovering 75% of the gap takes roughly half the layers on 8/9 models. At a matched precision budget, spending it on finer global quantization granularity beats targeted layer repair by 21–52 points; 8-bit is near-lossless under RTN/GPTQ/AWQ. Practical default for self-hosters: finer group sizes over layer-salience hacks. (arXiv)

  • Residual Sparsification via Output Importance for Compressing MoE LLMs — (arXiv 2609.00575, Sep 1, EMNLP 2026 Main) the standard MoE compression objective (minimize per-matrix residual error) is misaligned with accuracy because expert outputs couple across projections; PARSER instead weights residuals by their actual contribution to expert output error, narrowing the gap to the uncompressed model 1.41× on Qwen and 1.44× on DeepSeek at the same peak-memory reduction. Relevant if you serve big MoE models memory-constrained. (arXiv)

Industry

All gathered items - what was cut and why (10)