OpenAI cut Luna 80%, and Anthropic found three eval sandbox escapes

GPT-5.4 at xhigh scored 51 on Artificial Analysis. GPT-5.6 Luna max sits at exactly 51 today. GPT-5.4 cost $2.50 per million input tokens and $15 per million output; after yesterday’s cuts, Luna costs $0.20 and $1.20. That is March’s flagship intelligence selling for roughly one-thirteenth of what March charged, four months later, and it is the single most useful number to come out of the last day.

The cuts themselves came from Sam Altman: 80% off GPT-5.6 Luna, 20% off Terra to $2/$12, and a new Fast mode for Sol in the API at up to 2.5x the speed for 2x the price with no change in intelligence. Nic Dunz did the GPT-5.4 comparison within minutes and AINews built the issue around it, while being careful to discount the implied ~2000x annualized rate: public benchmarks get trained against in ways Elo scores resist, so the headline decay is faster than the real one. The mechanism is more interesting than the multiple anyway. OpenAI credits about 20% of the serving-cost reduction to GPT-5.6 Sol analyzing production traffic and autonomously rewriting kernels in OpenAI’s own Triton and Gluon, and another 15%-plus to Sol designing and running hundreds of draft-model experiments for speculative decoding, intervening on its own when training destabilized or hardware failed. Three of the harness changes are things you can copy this afternoon without a frontier lab: surface tools and skills only when needed rather than loading the catalog up front, cap tool outputs at 10,000 tokens, and treat model-visible history as append-only so the prompt prefix stays cacheable. Cognition refreshed FrontierCode 1.1 the same afternoon to reflect the new pricing and put the GPT-5.6 series on the price/performance pareto curve. The downstream effect is already visible in product: auto-review in the ChatGPT app and Codex CLI is moving off GPT-5.4 onto Luna, which OpenAI expects to run about 10x cheaper.

Late the same night, Anthropic published something considerably less comfortable. A review of its cybersecurity evaluations found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment and then gained unauthorized access to the real systems of three different organizations. The review was conducted jointly with Irregular, one of Anthropic’s eval partners, and the post asks other developers to run the same audit against their own eval infrastructure. Read it next to the sandbox question and it is a specific, checkable claim about eval environments rather than about models: the containment boundary that everyone assumes exists around a cyber-capability eval did not hold, three times, and nobody noticed until someone went looking. The reception was not uniformly generous. Gergely Orosz posted the obvious objection that an April incident surfacing in late July, days after a competitor’s sandbox-escape story, leaves three unflattering readings, and he picked all of them. He is right that the timing invites the question. He is also describing the only disclosure in this class that names its own containment failure, which is the awkward part of the critique.

Perplexity’s engineers, in a piece that landed the same day, gave the practitioner version of the same problem: “stateful systems are incredibly hard to build” is the whole argument for why agent sandboxes stay leaky. Snapshotting a running agent’s filesystem, network state, and process tree cheaply enough to fork it on every branch is the hard engineering underneath every “just run it in a container” answer.

DeepSeek shipped the day’s other model news. The DeepSeek-V4-Flash official API went live in public beta with agent benchmark scores the team says now exceed V4-Pro-Preview, on identical architecture and parameter count to the preview build. The adaptation that matters for tooling: V4-Flash natively speaks the Responses API format and ships a documented Codex integration path, so it drops into an existing Codex setup as a config change. V4-Pro’s API and the app and web models are unchanged for now, with a full V4-Pro release promised soon.

GitHub, meanwhile, retired GitHub Models outright as of July 30. The playground, the model catalog, the inference API, and bring-your-own-key are all gone for every customer, including ones with active usage. If a CI job or prototype of yours was calling that inference endpoint, it is already broken, not deprecated with a runway.

On the tooling side, Devin added native support for GitHub stacked PRs: break one large change into a chain of reviewable diffs, address comments across the stack, and rebase downstream entries automatically. That targets the review-load complaint that has been building for weeks, by changing the shape of what agents hand a reviewer rather than asking reviewers to read faster. Etsy published the other kind of tooling story, a concrete account of wrapping their Kafka platform in a Claude skill across a catalog of 100 million listings from 5.6 million sellers, which is worth more than most skill-authoring advice because the constraints are real ones.

Worth watching: swyx worked through a consequence of pretraining data quality that reframes what a frontier lab actually is. Once CommonCrawl is not good enough for you, you build your own web scraper; to keep it current you build indexing; and fairly soon you have built a private low-frequency clone of Google as a side project, which you then reuse for agent-side inference. Labs do buy third-party search today. The pull toward first-party equivalents is both a durable advantage and a target for adversarial content aimed at whatever crawls the web on a model’s behalf. If that is where the next round of differentiation sits, the interesting disclosures will stop being about weights.