One sentence covers the week: the agent moved in, and everyone is deciding who holds the keys.

The week agents went operational

Google’s Threat Intelligence Group published its AI threat tracker on 8 September. The case that matters is small. Mandiant watched a financially motivated attacker compromise a company’s cloud and deploy what the report calls an autonomous multi-agent attack framework. It scanned, harvested, troubleshot itself and rotated addresses with nobody at the keyboard, and it compromised thousands of third-party credentials in under six hours. One exposed command server was managing more than 23,800 harvested secrets in real time, API keys for cloud and AI services among them.

The detail that makes it explicable: the weapon, in Google’s words, was an AI coding chatbot, a prompt, and a set of agent instructions. Preconfigured markdown instruction files, used as operational playbooks. If you have written a skill file for an agent, you know exactly what that object is. And the sentence from the report itself: frontier models can autonomously find zero-days and execute intrusions, and GTIG has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild. The autonomy was in the orchestration. A person wrote the playbook. The models Google names as abused are Gemini, Claude, Codex, DeepSeek Coder and open-weight models. The open-weight half is on that list too.

The money: CNBC reports that Brian Kelly, formerly of Fast Money, reopened his crypto hedge fund with an analyst bench made of agents. Steffi does technical analysis, Desmond does quantitative strategies, Houston is mission control. Annual labour cost went from about five million dollars across seven or eight people to between thirty and forty thousand. Read past the headline: he keeps the final call, it is his own capital only, CNBC reports no returns and no track record, and “ten times more productive” is his own number. We filed this as “run entirely by agents” on the first pass, until somebody read the paragraph with the human in it.

The hype: on 6 September Jensen Huang posted that GPT-6 Astra had trained on more than a hundred thousand Grace Blackwell GPUs and that AGI has arrived. The billion-dollar training cost going around is a tech site’s arithmetic, not a number OpenAI published. ARC Prize published two numbers on launch day: 62.7 percent in the standard harness, 99.9 in OpenAI’s own adapter, which keeps the model’s private reasoning between steps. Same model, two rigs, thirty-seven points apart. Whenever you see a record this month, ask in whose harness.

All three run one diagram: an orchestrator and named specialists. Astra dispatches sub-agents, Kelly’s Houston coordinates Steffi and Desmond, the attacker’s framework coordinated existing tools. It is the diagram in our agent teams guide, and the frontier is running our idea with a power plant attached. What money buys is scale, not the concept. The sober half: the same pattern let one person do a team’s work in six hours.

Why the agent you build disappoints you

Claude Opus 5 scored 23.9 percent this week on a test of building agents, and that was the winning score. Sierra’s paper (arXiv 2609.04611, MIT licensed, public leaderboard) asks a question nobody had scored: can an AI agent build another agent? It hands the builder what a real contract hands a real engineer, documents, transcripts, a working API, a codebase, a client who knows the requirements, a budget, then tests the result on real customer conversations in airlines, retail, telecom and banking. Six setups were tried and nobody broke 25 percent. Sierra’s co-founder chairs OpenAI’s board, and they published the result where the Anthropic model won anyway.

The specific failure causes are the most useful part of the story, and every one is something you can fix tonight:

  • They stopped researching too early. In banking the agents opened fewer than 80 of about 1,700 available files.
  • They barely asked anything. Questions to the client were 0.3 percent of everything they did. On tasks an expert could nearly ace, agents that asked zero questions scored 5 percent. One question, 15. Two questions, 25.
  • They never tried a second design. 92 percent built the same single-loop architecture; one sentence suggesting another took a score from 31 to 67.
  • They picked their own family: 96 percent of Codex builds chose an OpenAI model to run the finished agent.
  • They misjudged cost in both directions.

Sierra’s phrase for it: shipping the first design that runs. Two weeks ago Linus Torvalds said his AI stated flat out that a bug was impossible. This week somebody measured stubbornness, and the number is one sentence, 31 to 67. Four things to do with it: make the agent ask you questions before it builds, name the architecture instead of letting it default, check whether it opened your files or only searched them, and set the cost ceiling yourself. We put these four in our own production notes the day the paper came out, and a week later they were already paying off.

The assistant that reads your mail while you sleep is free

Two weeks ago this brief covered a startup selling families an AI chief of staff. This is the free version. Dreambeans, a Google Labs app, works overnight and hands you ten to fourteen personalised story cards in the morning. On 10 September it went free for everyone in the US, 18 and over. What it reads, from Google’s own page: Gmail, Calendar, Google Photos, YouTube, search history and Gemini. And the part almost nobody reported: if a story involves the people in your life, it uses Google Photos and Nano Banana 2 to personalise the illustration, which requires face grouping to be on. It is producing pictures with your family’s faces in them, overnight, in a data centre.

Be fair: Google’s controls are better than the category average. You choose which apps connect, you can delete your history inside the app, and nothing changes elsewhere in Google. The gap is narrower and specific. The page tells you how to delete your data. It does not say what happens to it in the meantime. The argument is not that Google is a villain. It is that this job, read my week and tell me what matters, does not require any of it to leave the house. Our own runs on an old home PC: it wakes at eight, reads everything that came in overnight and hands over a digest. Same architecture. Ours reads public feeds; theirs reads your inbox and your photographs.

The other end of the week has no AI in it at all. Gregory Gibson at MakeUseOf replaced six subscriptions on a fifty-dollar Celeron mini PC with four gigabytes of memory, eleven containers, 2.4 GB in use. Same functions Google offers. His honest half is the line to keep: updates, backups and access are all his responsibility now. He calls it the DIY tax. The local morning briefing is something we are building. A promise, not a product.

You hit the limit. Two answers, one is free

Two people hit Claude’s twenty-dollar tier wall and solved it in opposite directions at XDA. Anurag Singh left: Qwen2.5 Coder 14B on a MacBook Air M5 with 16 GB, inside VS Code, subscription cancelled. He does not claim it matches Claude; it cannot understand all the moving parts of a large project. It works because his job is scoped: help me find where I went wrong. An electronic rubber duck. Nolen Jonker stayed and stopped sending it everything. His Obsidian vault became a pointer system: a skill file of about 400 tokens saying which notes to open, a behaviour file of about 400 tokens, an index folder that generates itself, notes pulled per task. Sessions land in the two-to-four-thousand token range and he never gets near the cap.

The through line: the fix is a markdown file. So was the weapon. A 400-token text file is now the unit of agent capability, and it costs nothing to write one. The question is not which model. It is whether your work is scoped or sprawling. Scoped, put a 14B coder on your own machine. Sprawling, write one router file before you pay for a bigger tier. Both are other people’s setups; we have run neither.

They fixed what makes voice AI feel broken. We built the pattern

OpenAI shipped GPT-Live-1 on 10 September. It is full duplex (it listens while it talks, so you can interrupt it), and when a hard question needs a bigger model it keeps talking and folds the answer in when it arrives. The mechanism is the story: the voice model is only the frontline, hard turns are delegated to a heavier model in the background. That is an architecture, not a model. The receipts are the vendor’s and its customers’ (Speak reports almost 80 percent fewer interruptions of people who had only paused to think). The price is the pivot: five cents a minute, three dollars an hour, about 24 dollars a day for a companion running eight hours.

So this week we built the pattern in this house on one RTX 5090. Gemma 3 4B holds the floor, a 27B Qwen with memory and tools thinks in the background, Whisper hears, and the answer is folded into the next turn. Our numbers, measured on Saturday: the frontline answers in half a second to a second. A delegated memory search comes back in seven to nine seconds when the card has headroom, and 24 to 78 seconds when the voice, the transcriber, the 27B brain and Discord all share 32 GB. Extra video memory used by the pattern: zero. Four rounds on the microphone in one day: chatty and falling behind, then too terse, then the middle, then a first-time tester’s verdict of fun and slow. The pattern works, the delay is the card. What is missing versus OpenAI, said plainly: theirs is natively full-duplex speech, ours is still a cascade. Kyutai’s Moshi and Unmute are the open-weight candidates for the duplex half, named here, not built.

A second data point that is not ours: a post on NVIDIA’s developer forum has Gemma 4 12B on a Blackwell workstation card and Gemma 4 E2B on a Jetson Orin NX holding a voice conversation at sub-second latency on a C engine called Little Gemma. One person’s post, not run here.

The music model we pay for retrained. The local one landed

We pay for Suno, and we earn a referral when someone signs up through our link. On 9 September Suno launched v6, three models trained on catalogue licensed from Warner, BMG and Believe plus its own users’ data, with Universal and Sony still outside the deal. Every model before v6 is retired, no rollback, downloads capped per tier. Licensing the training data is a real move, and it happened under litigation pressure rather than before it.

The same week a pull request from ComfyUI’s maintainer added native support for YuE2, a 3B open music model from the m-a-p group, 48 kHz stereo, weights on the Comfy-Org Hugging Face page. It is on a branch, so landing, not shipped. The new part: it writes an editable score first, in ABC notation. The weights are CC BY-NC 4.0. You can run it, you cannot sell what it makes.

A hosted model you built on can be retired under you. Our own stings were made on a Suno model that no longer exists. We have not run YuE2, so there is no comparison here. When we have, you will hear both.

The warnings were not wrong. They were early

Jacob Coxon spent three years on pretraining at OpenAI and then Anthropic, and this week he resigned, saying both companies are racing to self-improving superintelligence and gambling with our lives. The fact the headlines buried: recursive self-improvement is not yet possible. Anthropic’s own words are that it has not been achieved and is not inevitable. He resigned over a trajectory. The “more than one in ten within a decade” figure travelling with the story is not his; it belongs to Evan Hubinger, an alignment lead at Anthropic who backed him publicly.

The channel’s position, in the creator’s words. We have heard the end of the world before: nuclear weapons, pesticides, bioweapons, Y2K, the occasional meteor. The lazy version is that they cried wolf. That version is wrong. Nuclear weapons were used, twice, and what we have since is eighty years without a third use, built out of treaties and doctrine. The pesticide warning was correct and the bans followed. Bioweapons got a convention in 1972. Y2K cost somewhere between three and six hundred billion dollars of boring code review (Gartner’s estimate), and nothing happened because something was done. Meteors got planetary defence and a spacecraft that moved an asteroid’s orbit by 32 minutes. Loud warnings from credentialed insiders are the mechanism by which people adapt. Coxon quitting in public is the system working, and the thing to watch is whether the adaptation follows, because in every case on that list it had to be built on purpose. Responsibly cautious optimism: not “it is fine”, not “it is over”. What is built, what runs, and who holds the controls. Not because the machine might wake up. Because the keys should not all be in one building.

Who profits from this number

A new slot. Business Today carried a staffing firm’s real dataset, 450 million job postings, agentic AI engineer demand up 260 percent. Solid work, say that first. Then an aggregator stripped the byline, the method and the country, and served it next to three related stories from a course seller and two agencies. Somewhere in transit a salary appeared that is not in the study. Second specimen: Meta’s Muse hit number two on the US App Store, and TechCrunch printed the number underneath: 83,000 downloads. Threads did 4.3 million on day one. Top charts rank by velocity, not size.

Three questions for any AI number: who measured it, what do they sell, whose market was it. Applied to us: this channel takes affiliate revenue on the hardware it recommends and earns from music and voice signups. The disclosure page is linked below every video.

The ticker

Unity shipped a first-party Claude Code plugin, 29 engine skills at launch; the vendor now decides what your agent is good at. ChatGPT Images 2.5: sketch input, point-and-edit, up to 50 percent lower latency claimed; nothing open weight. RAMDeck: Qwen3.8-27B on a 12 GB laptop by pooling memory across four devices, 1.92 tokens a second, useless for conversation and fine for overnight batch. A single-slot RTX 3060 with no power connector, 70 W, $495, sometimes slower than a GTX 1060 in reviewers’ tests: video memory is not compute; it fits and it is usable are two different questions. ComfyUI 0.35 with a sparse attention node in core. A task-aware quant of Qwen3.8-27B from ISTA holds 99.8 percent of the base’s task average at 3.5 bits and 11.8 GB, on the tasks it was tuned for. A Krea 2 Turbo LoRA restores the seed-to-seed diversity the distillation removed, by its author’s account; modify a model for one property and something else moves. LTX 2.5 Ingredients, reference sheet to video. An assistant that lives inside ComfyUI and edits the live workflow. And a user had GPT-6 Astra complete Portal for $571 in tokens, his number. At home the price of curiosity is electricity.

The lab report

Two episodes went up. An RTX 3070 laptop with 8 GB went through eight local models, and a 30B mixture-of-experts model with two thirds of itself off the card beat a 14B dense model that fit better, by three to four times: file size does not predict speed, active parameters do. Two people came out of a group photograph in five local editors, and the first result was an empty room until one grammatical change, name who leaves instead of who stays, fixed it three times out of three. Faces survived in every editor; four of five changed her body.

The lesson that cost the most: on the second cam run of that episode the queue started re-rendering a finished cam, because a freshness check carried over from the previous episode’s tool had never been run twice. Shipping the first design that runs, in a spare room. One more, reported and not run: MiniMax H3 now has RefMods, a one-megabyte cached reference sold as a LoRA without training. It is not a LoRA, and the two will fail differently. It is going on the bench.

Kicker: when the agent cannot find a brand, it builds the thing itself

Armature ran Claude Code, Codex and Cursor through 16,900 sessions across 51 codebases where the agent had to choose a tool and wire it up. In its own words, Armature sells growth services to dev tools and this study is part of its work on getting products picked. Their numbers, read as such. Payments went to Stripe nine in ten. The three agents agreed only 42 percent of the time. PayPal was mentioned 139 times and picked zero times. And the result nobody led with: the most common label across twenty categories was custom, built in house, in twelve of them. Where no vendor owns the brand, the agent writes the thing. A third party with the opposite incentive landing on this channel’s position: a lot of what people rent could just be built.

The useful beat: your agent’s tool advice is frozen in time. Twenty years of brand building simply froze, as The New Stack put it. The fix is one sentence: tell the agent what year it is and what you actually have installed.

Sign-off

2,890 subscribers this morning, up from 2,660 at the last brief. Both episodes from the last two weeks are on the channel and both guides are on this site, free, no email gate. Everything that came from somebody else is theirs and labelled; everything from this machine is one card, one week, reported as what happened here rather than as a law. The agent moved in this week. Decide who holds the keys, because if you do not, someone else already has.