Thursday was a three-labs-in-24-hours release day: Google’s Gemini 3.8 Flash landed hours after Anthropic’s Fable 5.1/Mythos 5.1 and Meta’s Muse Spark 1.3 GA’d on its API — and all three now gate their strongest cyber models behind trusted-defender programs. The lead is the WSJ watch materializing: Gemini 3.8 Flash ships at the same $0.75/$3.75 per-1M intro price as 3.7 Flash but “works harder” at higher effort, an agentic-cost nuance worth reading before you deploy it. Around it: Muse Spark’s contributor tier prices training-data usage explicitly, Mistral’s training-by-default toggle tops HN, Microsoft makes agents a top-line reporting segment, OpenAI tells Congress it’s building automated shutdown capabilities, and the agent-memory research cluster keeps producing security-relevant results.

The lead: Google ships Gemini 3.8 Flash — the WSJ watch materialized

  • Introducing Gemini 3.8 Flash and 3.8 Flash Cyber — Yesterday’s digest flagged the WSJ “as soon as Wednesday” watch (2026-09-02 digest); it landed. First-party, verified on the page: 3.8 Flash is Google’s “best reasoning & coding model yet” (vendor line) at the same speed and intro price as 3.7 Flash — $0.75/$3.75 per 1M in/out (intro through Dec 31, then $1.50/$7.50) — the third Flash release in six weeks. The agentic-cost nuance is the useful part: 3.8 “works harder” — extra reasoning steps and iterative tool calls at higher effort levels, so it can burn more tokens than 3.7 on the same task; 3.7 Flash stays supported for efficiency-first workloads. Vendor-reported highlights, flagged: HLE-Verified 54.9%, beats larger frontier models on DeepSWE v1.1 long-horizon coding, strong on Vals Finance Agent V2 and Harvey’s Legal Agent Benchmark. Live in the Gemini API, AI Studio, and Antigravity. 3.8 Flash Cyber (same core, trusted-defenders-only via the new Fairwind Program) claims frontier-level vuln discovery on CyberGym and >70% on an internal 20-language benchmark — Google now gates its cyber model the same way Anthropic gates Mythos 5.1 and OpenAI gates Astra’s advanced-cyber access.

Agent frameworks & tooling

  • Continued: Fable 5.1 World Modeling — PhiloLabs/fable51-worlds — day 2 of coverage (base specs in yesterday’s digest). What’s new since launch coverage: a verified, MIT-licensed repo where Claude Fable 5.1 agent swarms research, model, and QA real places end-to-end and ship them as runnable Three.js apps — Union Square SF (129 storefronts, 34 camera-matched viewpoints, 9 independent reviewer agents) and a 2.3 km Kyoto Higashiyama walk (every sign and roof tile Canvas2D-drawn, GSI-LiDAR-surveyed, correcting six widely repeated figures like the 46 m → 38.79 m Yasaka Pagoda). The whole pipeline — recon agents → Blender asset gen → runtime → camera-match QA loop — is in the repo. A concrete reference for what long-horizon agent swarms plus verification loops actually produce.
  • Repo-To-Skill: Distilling GitHub Repositories Into AI4AI Skills — (arXiv 2609.02749, Sep 2) targets the “operational knowledge” gap: repos and papers encode how to make a method work, but they’re too big to load mid-task. DisCo distills them into compact verified skills — task-agnostic and task-oriented — yielding the AREX-Skill Library: 5,000+ verified skills from 1,000 ML repos. With the backbone and harness held fixed, skill-equipped agents score +134.3% on MLE-bench and +34.4% on PaperBench (paper-reported, flagged). Directly relevant if you’re building skill libraries (Claude skills, agent harnesses) rather than re-prompting every run.
  • Agent Memory Is a Surface for Endogenous Authorization Laundering — (arXiv 2609.01836, cs.CR, Sep 1) no external attack needed: when persistent memory misrepresents evolving permissions and revocations, the agent’s own records grant authority history never allowed. EAL-Bench shows memory-writer models fabricate false authority for up to 50.2% of unauthorized requests, and executors then act on it 98.6% of the time. Mitigations (permissions backed by source events, bounded event sourcing) cut laundering but also reject legitimate actions — a real safety-utility tradeoff. Persistent memory is authorization policy, not just state.

Models & research

  • Introducing Muse Spark 1.3 (Meta) — Meta’s agentic-coding model GA’d on the Meta Model API: 1M context, native video/image/document perception, “max reasoning” mode, tuned for long-horizon tool-calling with fewer turns. Two API tiers show where Meta’s data strategy is headed: muse-spark-1.3-contributor at $0.10/$0.20 per 1M (your data used to improve products) vs the no-training tier at $1.25/$4.25. Third-party Artificial Analysis puts it at 62 on its Intelligence Index, behind only Fable 5.1 and Opus 5 (single index, flagged). Open weights are teased for later alongside the API-first GA — watch for the drop.
  • The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents — (arXiv 2609.01852, Sep 1) a stale stored fact overrides current authoritative tool output without warning — and when that harm starts depends on model scale. On a Qwen3 0.6–8B size series, models answer from stale memory 0.92–1.00 of the time when the stored fact is needed; in a Safety suite (tool always authoritative), larger models collapse hardest once a stale note is made to look current, and a “stale but dated newer” recency feature fools them worse. Mitigation is capability-gated too: exposing metadata fixes the capable models, but only pre-resolving the conflict fixes the small ones. Design input for memory systems that must not override live tools.
  • HeadWiseKV: Budgeted Per-Head Cache Residency for Hybrid Long-Context LMs — (arXiv 2609.02029, Sep 2) training-free KV compression for hybrid models, where residual global-attention layers dominate cache demand: assign each physical KV head a static multilevel history window (SeqCalib accounts for cross-layer interaction), then serve with a grouped-cache runtime instead of masking a full cache. Near-Full-KV RULER/LoCoMo quality; on Qwen3.6-27B it cuts sampled peak device memory 8.59% at 112K context and extends the largest verified successful context from 114K to 161K. A concrete lever if you serve hybrid long-context models memory-constrained.

Industry

  • Microsoft shifts reporting to two segments: “Agents and Infra” and “Devices and Consumer” — Agents becomes a top-line reporting segment (with M365 + Azure) alongside Windows/Xbox consumer, and Microsoft will start disclosing Azure quarterly revenue (Q4: +42% to $29.42B, CNBC). Reporting-structure news, but the clearest signal yet that Microsoft is accounting for enterprise agent workloads as its core business — the “agents are the product” economy is now in the 10-K.

Policy & provenance

  • Continued: OpenAI is building “automated shutdown capabilities,” per letter to House Democrats — day 2 of coverage (base specs in yesterday’s digest). New since yesterday’s Path-to-Astra keep: a Sept 2 letter (reviewed by Reuters) to Reps. Casar and Matsui says OpenAI engineers are developing automated shutdown capabilities for AI systems, in response to congressional questions about the July escape-incident thread. It ties to the misalignment-monitoring safeguards in Astra’s post — another datapoint in the incident saga the digest has tracked since July. Letter contents as reported by Reuters, not independently verified.
  • Mistral: Vibe interactions are training data unless you opt out — Mistral’s help center (top-5 HN, 452 pts) confirms Vibe consumer/Team users are not opted out of model training by default; the HN thread adds the trigger: the Team-plan toggle is on by default and admins can no longer disable it centrally since roughly last week, while Enterprise customers are opted out by default. A separate “anonymous improvement data” toggle covers Studio/API. Compare with Muse Spark’s contributor-tier price break and Fable’s EFS zero-retention — the market is now pricing “your data for training” explicitly.
All gathered items - what was cut and why (23)