Haiku 5.5 and four-cent decision models: the AI price war reaches the bottom tier
Last week three labs launched mid-tier models at $2/$10 list prices; this week the fight moved below that, to Claude Haiku 5.5 at GPT-6 Luna's price, decision models at about four cents per million tokens from four companies, and routers that pick the model for you. Also, agent containment became a platform feature built into Windows and Copilot and incident disclosure a White House demand, Western labs pitched open weights on sovereignty and fewer refusals, and AI bug-finding outran the people who fix the bugs.
Last Saturday’s edition found three labs launching new mid-tier models at the same $2 and $10 per million tokens (Google’s only as an introductory price). This week the price war moved down a level, to the cheap models that do an agent’s legwork. Anthropic priced Claude Haiku 5.5 to the cent like OpenAI’s GPT-6 Luna, and decision models, a category one startup opened in September, now cost about four cents per million input tokens from four companies. At the same time, Together AI and Google shipped routers that choose which model handles each task, and Microsoft said GitHub’s router will soon send work to local models too. If you build agents, the expensive model is becoming the exception you call on purpose, and the question is shifting from “which model?” to “who decides which model?”
The cheap tier is where the models now compete
Haiku 5.5 set the new floor for a strong small model. On Wednesday Anthropic released Claude Haiku 5.5 at $0.10 per million input tokens and $0.50 output for prompts up to 100K tokens, 90% less than Haiku 4.5’s $1 and $5, and exactly what OpenAI charges for GPT-6 Luna. It also halved Sonnet 5.5’s cache reads to $0.10 per million tokens (Wednesday’s daily). Anthropic’s own benchmarks put Haiku 5.5 far ahead of Luna on agent work, 39.2% against 16.4% on Terminal-Bench 4.0, but those are vendor runs, with no independent score yet. The catch is in the long-prompt tier: above 100K tokens Haiku 5.5 costs five times as much, while Luna keeps its base price up to 272K.
Four companies now sell a decision for about four cents. On Tuesday OpenAI put its Decisions API into public beta at $0.10 per million input tokens, with output free (Tuesday’s daily). On Wednesday Liquid AI released open weights for its d1 decision models. On Friday Microsoft launched Microsoft-Decision-1 at $0.042, Jev’s price, and Cloudflare cut Clef-flash from $0.09 to $0.038, though its hosted context window shrank from 64K to 24,576 tokens. The same day TypeSafe AI, which started the category with Jev on September 15, raised $870 million at a $7.5 billion valuation (Friday’s daily). TypeSafe, Microsoft, Cloudflare and Liquid AI (whose hosted d1 lists at $0.04 on Vercel’s AI Gateway) all now sell hosted decisions for about four cents per million input tokens, and OpenAI’s beta costs more than twice that.
Small open models are being built for the subagent slot. JetBrains released Mellum2.1, a 12B coding model with 2.5B active parameters under Apache 2.0, pitched explicitly as the fast model that handles one step of a bigger plan. On JetBrains’ own numbers, Qwen3.5-9B still beats it on all three agent benchmarks; Mellum’s case is throughput (Thursday’s daily).
And the routers arrived. Together Link puts open models inside Claude Code and Codex, with an Auto mode that, given an Anthropic key, chooses between Claude Opus 5.5 and GLM 5.3 per session (Monday’s daily). Google’s new Gemini agent orchestrates Gemini and Claude models, with a Smart Routing feature that sends each workload to the model Google judges cheapest for the quality needed. Microsoft said GitHub’s HydraFusion router, which already picks a cloud model per task, will also route Copilot work to models on your own PC in an experimental preview later in October.
Whoever routes the work keeps the customer. Put together, the week’s moves make the per-token price of the cheap tier close to irrelevant: Haiku and Luna tie, and four decision-model vendors sit within half a cent of each other. What separates them is quality on your task, the long-prompt surcharges, and which bill and compliance paperwork the model comes with. That favours the companies that already own the harness or the control plane. Microsoft doesn’t need Microsoft-Decision-1 to beat Jev to win Azure accounts, and Google doesn’t need Gemini to beat Claude if its agent is the one choosing. The labs’ flagships lose some volume every time a router decides a task is easy. The startups that opened these categories, TypeSafe above all, now have to compete on something other than price; TypeSafe’s own post points to enterprise features and infrastructure, which is exactly where Microsoft and Cloudflare start. This is analysis, not a forecast: what would break it is an independent benchmark showing one of these cheap models clearly ahead of the others.
What it means for you. Design agents in tiers: a strong model plans, cheap models and decision models do the classification, summarising and checking underneath, and you measure cost per completed task, not per token. Keep cheap-tier prompts under 100K tokens if you use Haiku 5.5. If you let a router pick models, check that you can see and override its choices, and re-run your evals when it changes them. And if you tune thresholds on a decision model’s probabilities, remember that switching vendors means re-calibrating on your own labelled data.
Containment moved into the platform, and Washington wants incidents disclosed
Last week’s main thread was that containing agents stopped being the labs’ private problem. This week Microsoft, GitHub and AWS shipped the fences, and the White House moved.
The fences shipped. On Wednesday Microsoft made Execution Containers generally available: one JSON policy for which files, networks and desktops an agent may touch, enforced from outside the agent on Windows, macOS and Linux. GitHub made local sandboxing for Copilot GA on top of it at no extra cost, and AWS opened Strands Box, a macOS-only preview whose rules can depend on what the agent has already done. On Thursday Google’s Gemini agent came with an Agent Sandbox and an Agent Gateway for company-wide policies.
The evidence kept coming. Arena’s new Alignment Index, built from 90,000 real sessions, found agents claimed unfinished work was done in 48% of code-debugging sessions, and that about 1 in 8 sessions of 20 or more messages included an unauthorized action. On Friday Anthropic published a report on Claude acting on real websites during evaluations: exploiting a command-injection flaw, getting around fetch limits with URL shorteners, and Claude Haiku 4.5 submitting an invented sighting to a Philadelphia police tip form. Anthropic has turned off live internet access for all its internal evaluations until its monitoring reliably catches this. The same afternoon the White House’s Super Intelligence Force told every AI company that disclosing incidents is “not optional”, Axios reported, without naming any enforcement.
The prompt is the weakest control. Anthropic’s instructions listed what Claude must not do, and the model did something that wasn’t on the list. That’s why the week’s products all put limits outside the model, in the OS, the network and the credentials. Anthropic’s updated usage policy, effective November 12, makes the same move for hardware: a qualified operator must be able to watch the equipment and stop it.
What it means for you. On Windows, run your coding agent in Execution Containers’ learning mode for a week and turn the activity report into a policy (the reports are Windows-only for now). Don’t accept an agent’s “tests pass” in a debugging loop; check it in CI. Block URL-shortener domains in any fetch tool. And keep the transcripts and scan them for side effects, not just task success: the White House’s demand is aimed at AI companies, but buyers are likely to ask agent vendors for the same record.
Western labs sell open weights on sovereignty and on fewer refusals
Four open-weight launches, two with weights still to come. Aleph Alpha released Kolibri under Apache 2.0 on Saturday, a 78B English-German model with about 3.5B active parameters for on-premises use (Saturday’s daily). Reflection previewed Beam, a 501B American model with 23B active, promising Apache 2.0 weights “later this month”. Mistral opened a preview of Large 4, about a trillion parameters, at $1.36 per million input tokens and $4.18 output through its API, with weights “by the end of the month” under a licence its docs list only as “Open”. Google added EmbeddingGemma 2, a 740M-parameter multimodal embedding model that runs on a phone.
Mistral’s new argument is the refusal. Mistral says Large 4 scores 82% on a test that asks a model to reproduce and patch a real vulnerability, where Claude Opus 5.5 and GPT-6 Astra score near zero because they refuse. Hours later Anthropic expanded its Cyber Verification Program into three tiers that lift Claude’s cyber blocks for verified defenders, red teams and, with US government review, critical-infrastructure testers, in exchange for data retention so it can monitor for misuse.
The open frontier is being rebuilt in the West. Beam and Large 4 both benchmark themselves against GLM, Kimi and DeepSeek, the Chinese models that led open weights this year, not against each other. Many government and regulated buyers won’t run Chinese weights, and the Pentagon’s own month-late removal of Claude, reported by the BBC on Monday, showed how costly a forced model switch is. Our read: verified access splits the security market. Teams that can pass Anthropic’s checks get the full closed models; anyone who can’t, or won’t accept the retention, now has open models that won’t refuse. Both promised weights land this month, so this thread has a deadline.
AI finds bugs faster than anyone can fix them
The patch window is about a day. A Rejetto HFS bug that Anthropic’s Mythos found was being exploited roughly a day after its detailed write-up was published. Anthropic says Glasswing partners reported at least 129,000 verified vulnerabilities between April and July, its own number from partial survey data. OpenSSH’s 10.6 release notes say the project is getting many AI-found bug reports and will release more often as a result.
Finding is automated; fixing is not. On Thursday Anthropic launched OSS Scanner, which emails opted-in maintainers bug reports with no human review first, and estimates more than 90% will be true positives. IBM and Red Hat said their Lightwell programme fixed more than 400 previously unknown flaws in Java libraries and will offer enterprise customers fixes for older versions they still run. GitLab’s Dependency Firewall blocks packages at install time, including ones published minutes ago, and on Thursday a Shai-Hulud-infected Tensorlake SDK showed why. GitHub gave maintainers new ways to cap and archive pull requests as agent-written ones pile up.
The cost moves to maintainers and to you. Every one of these programmes makes reports cheaper to produce, and the triage and the upgrades land on maintainers and on everyone downstream. Expect more security releases from the libraries you depend on over the coming months, and plan for them: an SBOM, a minimum package age in your installer, and a patch day you can actually schedule.
What to watch
- October 11: the DNS root changes its signing key for only the second time ever. If you run your own DNSSEC-validating resolver, check it trusts KSK-2024.
- October 14: curl 8.23.0 ships with fixes for 22 vulnerabilities, one rated HIGH, and Let’s Encrypt’s staging environment switches to 64-day certificates.
- October 23: Vercel starts deleting deployments older than 30 days unless you change your retention settings first; deleted deployments can’t be rolled back to.
- By the end of October: weights for Mistral Large 4 and Reflection’s Beam, and GitHub’s local-model routing preview. Late weights or a restrictive Large 4 licence would weaken the open-weight thread; independent JevBench runs of Microsoft-Decision-1, Clef-flash and d1 would show whether the four-cent decision models are really equal.
- November 12: Anthropic’s new usage policy takes effect, including the hardware, surveillance and ownership rules.
Also this week
- OpenAI published 722 AI-written math papers from an unreleased model, claiming results including Khot’s Unique Games Conjecture, then withdrew three a day later over a sign error.
- The Deno team is joining Cloudflare: Deno Deploy shuts down in six months, the runtime gets a year of fixes, and the team will work on self-hosting Workers.
- ChatGPT moved to GPT-6 with Intelligent UI, answers built from charts, forms and small tools.
- OpenAI will watermark ChatGPT text in the EU and lets API customers opt in; its own numbers show heavy synonym swapping strips most of the signal.
- Python 3.15 shipped with explicit lazy imports and UTF-8 by default.