A bare user story costs 29.7% more tokens than a full spec

Strip a coding task down from a full specification to a bare user story and the agent spends 29.7% more tokens reaching the same place. That number comes from 2,700 runs of Kimi K3 at three thinking efforts, posted to arXiv yesterday by Jakub Smékal, and the surrounding results are more useful than the headline. Prompt sensitivity is task-dependent and runs from 13% to 115%, so the same underspecification tax that barely registers on one ticket nearly doubles the bill on another. Run-to-run variance stayed flat no matter how the prompt changed, which means the spread you see across repeated runs is not something you can prompt your way out of. The paper also fits a predictor that prices a full distribution of specification and thinking-effort configurations from one cheap probe on an unseen task, landing within 36%.

Within a few hours of that, Turing Post ran a guest study from Sonar on the other half of the same bill: not how you phrase the task, but what the agent burns finding the code. Six tasks across four languages, ten runs per side, previously merged open-source commits as ground truth, prompts written without file names or line numbers, and every run required to pass the real build and tests before it counted. Giving the agent a structural code graph alongside grep made a Java interface change 36% cheaper, a package rename 20%, a Python compiler change 20%, a C# return-type change 20% on the typical run, and a TypeScript change 5%. Sonar sponsored the post and the graph is their product, so weigh the numbers accordingly. The completeness claim underneath the cost delta is the one worth arguing about: a text search cannot enumerate every implementor of an interface, and a site that changes behavior indirectly still compiles and still passes tests nobody wrote for a connection they did not know existed. Two independent measurements of agent spend in one day, one on the prompt side and one on the retrieval side, and neither team was measuring the other’s variable.

Google shipped Gemini Omni 1.1 Flash yesterday, a multimodal video generation and editing model aimed at giving developers frame-level control rather than raw quality headroom. You can extend an existing scene, pin the starting and ending frames of a shot, pass video inputs as references, upscale a take to 4K, and iterate at 360p before committing to a full render. The 360p draft mode is the part that changes how you’d actually build on it, since the expensive step in a video pipeline is discovering three generations later that the shot was wrong. It hit the Hacker News front page and both the DeepMind blog and the main Google developer blog the same afternoon.

GitHub published an interview with the OpenClaw maintainers that is the best field report yet on what happens when agent-authored contributions outrun human review. The repo, started by Peter Steinberger as a weekend project in November 2025, was at roughly 388,000 stars, 81,000 forks, and more than 80,000 commits as of August 26. Steinberger stopped calling them pull requests: “I don’t even call them pull requests. I call them prompt requests.” Some contributors were opening hundreds at a time from automated pipelines mining the issue tracker. The adaptation is specific and worth copying. Merge counts became a manipulable trust signal, so people duplicated other people’s pull requests to farm the badge, and the maintainers replaced that signal with evidence: agent transcripts, screenshots proving the change was tested, and an explanation of the contributor’s reasoning. Steinberger’s line on authorship is the cleanest formulation of the new norm anyone has published: “Nobody cares if you wrote the code or not, but we care if you actually thought about this feature.” The team also pruned core dependencies and opened direct relationships with the maintainers of what remained, after the recent supply chain attacks.

GitHub’s own tooling moved the same direction on the same day. Copilot code review now covers pull requests authored by bots, including the Copilot cloud agent, and very large pull requests it previously skipped, and you can record why you resolved a given review comment. Agents reviewing agent-written code was already the practice at OpenClaw, where maintainers described pressing the Copilot review button on every AI-authored submission; it is now the default path on the platform.

Semgrep answered Mythos on the IDOR benchmark that has been running back and forth this week, reporting that Semgrep Multimodal found 63 manually reviewed IDOR vulnerabilities Mythos missed. Both sides are vendors publishing on their own corpus, which is the structural problem with every security-agent comparison shipping right now. The useful residue is the disagreement set: 63 findings that one system’s authorization reasoning surfaced and another’s did not is a more informative artifact than either vendor’s aggregate score.

Away from agents, Cloudflare wrote up how they cut 100 terabytes of memory out of the 1.1.1.1 DNS cache across the fleet behind Big Pineapple. Worth reading even if DNS is not your problem, since the pressure on memory pricing from AI buildouts has started showing up in non-AI infrastructure budgets.

The ecosystem item to watch: DuckLabs is joining AWS, with the projects staying open source. The commitment is stated plainly, and the question is what governance looks like a year out, which is the same question anyone maintaining a dependency on an acquired open-source project should be asking after reading the OpenClaw maintainers on knowing who maintains your dependencies.

What to watch next: whether anyone reproduces Smékal’s token-spend predictor against a second model family. A cost estimate you can compute from one probe before dispatching a task is the missing piece in every agent budget dashboard shipped this year, and one paper on one model is not yet a tool.