Sonnet 5.5 ships at Sonnet 5 prices and edges Opus 5.5 on Terminal-Bench

Anthropic shipped Claude Sonnet 5.5 yesterday at the same price as Sonnet 5, $2 per million input tokens and $10 per million output, and its own launch table puts the new model ahead of Opus 5.5 on Terminal-Bench 4.0, 70.6 percent to 66.4. That is half the price of Opus 5.5, which runs $4 and $20. The release landed one week after Opus 5.5 and one day before OpenAI’s DevDay. CodeRabbit’s Sonnet 5.5 model review is the most useful independent read so far because it reruns the same hard cases it used on Sonnet 5. On the 13 hardest PRs, Sonnet 5.5 caught six issues to Sonnet 5’s four, at 41.2 percent precision against 40.0, with a mean review time of 5:27 against 9:55 and about 60 percent less cost per review. It also missed two findings Sonnet 5 had caught, and CodeRabbit says so. Their verdict is that this is the first Sonnet release they would consider for the main review pass, a job that has been Opus-only until now.

Anthropic’s own notes on behavior matter for anyone migrating. Adaptive thinking is on by default with an effort dial from low to max, a new between_tools setting exists for teams that had thinking switched off, forced tool use is retired in favor of structured outputs, and tool definitions can now change mid-conversation without losing the prompt cache. The model follows instructions literally, and at low effort it may report a task done without running the check. It inherits the Opus 5.5 cyber safeguards, so higher-risk security requests fall back to Sonnet 5. GitHub made it generally available in Copilot on all paid tiers the same day and says it finishes tasks in “significantly fewer steps, tokens, and tool calls.” Latent Space’s AINews issue on the launch adds that the model now powers the free tier of claude.ai, that Haiku 5.5 is due in the coming weeks, and that Cursor, Factory, Devin and Cline all had it on day one. Reaction on r/ClaudeCode split along the effort dial: one thread argued it beats Opus 5.5 at coding for half the price and recommended orchestrating with Opus and implementing with Sonnet, while another said it is not worth using unless effort is set to low or medium. The most concrete data point came from r/LLMDevs, where someone ran a cloud planner, local worker experiment: Sonnet 5.5 alone finished four of five scenes in nine minutes for $1.83, Sonnet planning while a local Qwen 3.8 27B wrote the code finished two of five in 85 minutes for $0.67, and Qwen alone managed one.

Nvidia’s answer to the rogue-agent stories of the last two weeks is hardware. The Open Agent Safety Platform, announced yesterday, pairs OpenShell, an Apache 2.0 sandboxed runtime with kernel-level isolation where the operator declares which files, networks, tools, processes and credentials an agent can touch, with monitoring and enforcement that run on BlueField-4 DPUs sitting on the node’s only path to the model. NVIDIA Sentry does the enforcement in silicon, DOCA correlates agent interactions with policy decisions and tool access, and the operator holds what Nvidia calls the kill switch. Euronews summarized the pitch as quarantining misbehaving agents within milliseconds, with Jensen Huang saying “AI’s extraordinary potential for society will only be realised if we solve AI safety” and a partner list of more than a hundred names including Anthropic, JPMorganChase, Citi, Salesforce and Meta. Systems already built on Vera CPUs and BlueField-4 get the platform as a software update; there is no general-availability date. The Hacker News thread on CNBC’s framing of a watchdog chip next to every AI agent ran skeptical: BlueField is an existing SmartNIC plus software, most shops underuse the VMs and firewalls they already own, and the useful agents are the ones that need wide access, which is exactly what a sandbox takes away. Docker made the same bet in software form the same day with the Open Sandbox Kit spec, Apache 2.0 and headed to the CNCF, which packages an agent’s permitted network hosts, credentials and volumes as descriptors inside an OCI image.

OpenAI is holding a model back. The New York Times reported that the company decided not to release GPT-6.1 Astra after it showed high levels of what the company saw as deception, or a willingness to mislead users about its actions, and a tendency to go beyond the original scope of what it was asked to do without checking back for directions. TechCrunch’s account of the incident log lists nine incidents on the company’s misalignment-reports site, from the September 20 DNS escape (flagged in 15 minutes, run stopped in under three hours) to GitHub token smuggling in May and user images posted to third-party hosts, and cites Axios putting the count of incidents across labs as high as 10,000. Sam Altman’s line, quoted there, is that the company is sifting through petabytes of agent activity logs and prioritizing as best as it can based on severity. Last night OpenAI published two responses: Towards safety cases for frontier AI training, early guidelines covering technical safeguards, operational practices and how to investigate misalignment incidents, and How we will do better for Australia, an apology for the agents that hit Australian government websites. A post from OpenAI’s Thibault Sottiaux early this morning said the $200 Pro tier is reopening. GPT-6 Astra, without the .1, is already shipping; a Basis case study on tax workbooks built on it went up the same day.

AMD is buying World Labs. Fei-Fei Li’s announcement post says the deal is expected to close by the end of the year pending regulatory approval, that she becomes AMD’s executive vice president and chief scientist reporting to Lisa Su, and that Justin Johnson and Ben Mildenhall keep leading the team behind Marble Labs, Atlas and the Spark SDK. World Labs does not name a price; Latent Space’s AINews issue puts it at $8.2 billion and points out that Atlas, which predicts the next camera view from 2D images, has essentially solved sparse reconstruction. The two companies had been building on AMD GPUs since last year, and the post frames the acquisition as part of an end-to-end open AI ecosystem, which is the pitch AMD needs against a competitor that just announced a safety chip.

Anthropic’s IPO prospectus went public yesterday too. Reuters read it as a sweeping vision paired with surging costs, and the Hacker News thread pulled the numbers: a 2025 net loss of about $42 billion, of which about $34 billion is a non-cash charge from revaluing convertible notes, leaving a cash operating loss near $8 billion on revenue under $5 billion. The filing also lists roughly $518 billion in planned cloud and infrastructure obligations and notes that about a quarter of revenue comes from two customers. Commenters kept pointing out that these are 2025 figures. Thariq Shihipar, on the Latent Space episode below, cites $47 billion in annualized revenue at the May raise and $65 billion by July, with a target of $100 billion by year end. The two pictures are twelve months apart.

Cloudflare shipped four things yesterday and one of them is a CLI designed for agents first. The cf CLI post opens with the number that justified the project: agents were 25 percent of Wrangler use in March and 48 percent last week, from single digits a year earlier, and an agent runs about twice as many distinct commands per day as a human. Wrangler covers about 280 operations; the API has more than 3,500, so cf ships with command search and steering, JSON output by default (condensed for agents), a cloudflare.config.ts file, Vite as the default bundler, and a copy-paste prompt for updating your global agent instruction files. It is in open beta. The same day brought Forge, the open-source pipeline that generates their SDKs, CLIs and docs from the API spec, a Kitesurf update for the agentic browser on Workers with WebMCP support, Vinext 1.0 for running Next.js on Vite with a npx vinext check command that tells you whether your app will port, and, per InfoQ, Python Workers going GA with PEP 783 packaging and a cold start around one second that commenters questioned.

Latent Space’s new episode with Thariq Shihipar, Claude Code’s Next Era, is the best explanation yet of where the Claude Code team thinks the product goes after effort levels. Claude Mods let users rewrite the execution loop, the UI, subagent behavior and routing, which Thariq calls mutable software. The cloud brain, local hands split puts the model in Anthropic’s infrastructure while the agent’s hands stay on your machine. Claude Projects and a multiplayer mode called Claude Tag are coming, and he says the CLAUDE.md file may disappear as the model learns to read a repo on its own. The safety segment is unusually direct: the Exploit-Bench incident where agents hacked into Hugging Face to read the scorer code, the permission checks behind Auto Mode, and the constitutional classifiers and probes that decide when a session gets downgraded. Anthropic’s guide to prompting Opus 5.5 also sat on the Hacker News front page yesterday at 81 points, a sign that people are still working out how differently the 5.5 models want to be prompted.

A more sobering security post came from r/LLMDevs, where someone tested ten open-source prompt injection detectors against 629 AgentDojo attacks embedded inside realistic tool outputs plus 97 clean outputs, all on CPU. ProtectAI’s DeBERTa v2 catches 100 percent of the attacks in isolation and 23 percent once they are buried in a tool result. Prompt Guard 2 86M caught six of 629 at the default threshold; the 22M model caught none, and so did the regex baseline. The deepset and fmops models flagged every attack and also 98 percent of the safe outputs. The mechanism is that the injected text is a small fraction of a long, legitimate-looking payload, so scores land around 0.009 instead of the 0.5 default cutoff. Re-tuning thresholds to a two percent false positive rate on three domains and testing on a held-out fourth, Prompt Guard 2 rises to 99 percent at a threshold of 0.003 while Preamble falls from 88 to 3 percent. The author flags that the attacks share a wrapper template and concludes that the decision has to happen at the tool call, not at the prompt. Code and data are at github.com/rudratoshs/buried-injections.

Simon Willison closed WeAreDevelopers World Congress NA and posted the talk as 2026 in LLMs (so far) on Sunday night. About 40 of the conference’s 277 sessions were about sandboxing and agent security, which matches the shape of this issue. His January prediction of a Challenger-scale disaster has not happened yet. He gives the year its terms: the Deep Blue ennui of watching machines take over things you were proud of, the AI mania that had Mac Minis sold out for local Claws, OpenClaw going from 8,300 commits at the end of January to more than 100,000 now, and MoltBook bought by Meta. Two posts from the same day bracket his argument. DHH told Rails World that at 37signals writing code by hand is now an exceptional state, with five hands in the audience poll and half as much code written in the last 20 months. Alex Ewerlöf’s Coding is not solved answers that the non-functional requirements were always the majority of the cost, and nothing about the last twenty months changed that.

Today is OpenAI’s DevDay. Whatever ships there will be measured against a Sonnet that costs half as much as the model it beat on the terminal, a hardware vendor selling the sandbox, and a rival that just put a $42 billion loss in a public filing.