AI weekly — 25 September 2026: GPT-6 Sol launches at half the price of Opus 5.5, Amazon blocks Muse, the Goncourt withdraws a novel, Canberra accuses an OpenAI agent

On 22 September, Anthropic cut the price of its most powerful model by 20%. Ninety minutes later, OpenAI published a price list exactly twice as cheap, on input and output alike. The next day, Mark Zuckerberg presented an assistant able to buy on your behalf and charging merchants a commission; Amazon blocked it within the day. Three days later, Australia accused an OpenAI agent of breaking into its health portal, and the Goncourt Academy withdrew from its selection a novel judged largely written by a machine. These events do not carry the same weight, but they tell the same shift: the model is becoming a commodity, and value is moving towards what remains scarce — the customer relationship, access to data, and the ability to bear risk. Here is the week of 19 to 25 September 2026.

1. Ninety minutes, two price lists

Anthropic released Claude Opus 5.5 on 22 September 2026, with a price list of 4 dollars per million input tokens and 20 dollars for output. That is 20% less than Opus 5, which was priced at 5 and 25 dollars. For a lab that long defended the idea that a frontier model is paid for at the price of its scarcity, the shift was worth noting.

It lasted ninety minutes. OpenAI answered the same day with two models. GPT-6 Sol launches at 2 dollars for input and 10 dollars for output: exactly half the Opus 5.5 price, on both lines, to the cent. And GPT-6 Luna, the family's light model, goes from 0.20 and 1.20 dollars to 0.10 and 0.50 dollars.

The choice of a factor of two is no accident of calculation. A price set at exactly half of a competitor's, on both dimensions of billing, announced within the hour and a half that follows, is a message addressed to finance departments rather than to engineers. It says that the price of the frontier model is no longer determined by its production cost but by the price the neighbour has just posted.

The most interesting detail is on the bottom line. At 0.10 dollars per million input tokens, GPT-6 Luna goes below the open-weight Chinese models that had served until now as the benchmark for cheapness. The previous week, Mozilla's report on the state of open AI established that the best open Chinese models stood 4.4 months from the American frontier level, for about 30% of the price. That trade-off has just reversed on the light segment: a closed, hosted, pay-per-use model now costs less than an open model you would have to host yourself.

OpenAI published the same day an improvement to its request cache for the GPT-6 family, which further reduces the bill on repeated-context uses. And Axios noted on 23 September a less commented reading of this cut: cheaper models allow labs to keep a promise of caution without losing money, since the margin is rebuilt on volume rather than on unit price. The previous week, the same executives were publicly calling for a slowdown. Cutting prices is a way of continuing to grow while explaining that one should brake.

2. What this changes in the real cost of an agent

A price cut per million tokens does not translate linearly into a corporate bill, because an agent does not consume tokens: it consumes turns. An agent that reads a file, calls three tools, rereads the result and writes a summary passes the same context four to six times. It is this repetition that makes up the bill, and it is what the 22 September price list shifts.

Take an ordinary-sized agent session: 200,000 input tokens accumulated across all turns, 20,000 output. On Opus 5, it cost 1.50 dollars. On Opus 5.5, it falls to 1.20 dollars. On GPT-6 Sol, to 0.60 dollars. On GPT-6 Luna, to 0.03 dollars. Between the top and the bottom of the price list, the ratio reaches one to fifty. Before 22 September, the same gap, measured between Opus 5 and Luna's old price list, was about one to twenty-three.

This amplitude has a direct consequence for architecture. The gap between the frontier model and the light model has just doubled, and it was already wide. At a ratio of one to fifty, routing tasks to the right model ceases to be a marginal optimisation and becomes the main architecture decision. Classification, extraction, rewording and format-checking tasks have no reason to go through a frontier model.

In the field, the week's customer publications give an idea of the scale of the gains claimed. OpenAI highlighted V7, which declares 78% lower costs with GPT-5.6 Luna while improving its accuracy, and Parallel, which says it has halved its research time and cost with GPT-6 Astra. These figures come from the customers themselves, relayed by the provider: they indicate an order of magnitude, not an independent measurement.

3. Meta Connect: Muse, Charm and the post-smartphone

Meta held its Connect conference on 23 September. The device was not the subject: the assistant was. Muse, presented by Mark Zuckerberg as a "personal superintelligence" intended for billions of people, was at the centre of the set-up. Around it, a range of connected glasses extending to a $1,300 Aviator-style model, and a keyring device named Charm, announced for December.

The commercial part deserves attention. Muse does not merely answer: it buys. Meta announced partnerships with Walmart, GameStop, Gap and Wayfair, and an economic model in which the merchant pays a commission on transactions made through the assistant. In other words, Meta places itself between the consumer and the retailer, and bills for that positioning.

It is a break from the advertising model Meta has operated for twenty years. Advertising sells a presumed intention; commission on transaction sells a completed purchase. The latter is more expensive, more measurable, and far more threatening to those whose business is capturing that same intention.

Meta accompanied the announcement with a privacy campaign, which Axios summed up on 25 September in a dry phrase: "Meta's new slogan: we care about your privacy". The company has to convince users to let an assistant carry their payment methods and browse sites on their behalf. This is a request for trust of a different order from that demanded by a news feed.

4. Amazon blocks Muse: the first war between aggregators

Amazon did not wait. From 22 September, the company blocked Muse's access to its store, putting forward three precise grievances: the agent would use the store without authorisation, would not identify itself as an automated agent while browsing, and would retain customers' login credentials.

The third point is the most serious technically. An assistant that buys on your behalf must authenticate on your behalf. Either it holds your credentials, or it acts through a delegation that the merchant has explicitly granted. In the first case, a third-party platform holds the keys to your account; in the second, it is the merchant who decides who comes in. Amazon demands the second model, because it leaves it in control of the door.

Ben Thompson devoted three editions of Stratechery to the episode during the week, including one titled "Begun, the Aggregator Wars Have" on 25 September. His reading: for twenty years, aggregators grew in distinct markets — Google in search, Amazon in buying, Meta in attention. The agentic assistant sets them in head-on competition, because it claims the place that each of them took for granted, that of the interface between the user and their intention.

The question that remains open is Google's, which Ben Thompson poses explicitly. A commercial search pays Google when it ends in an ad click. If the assistant makes the purchase without going through the results page, it is not Google's market share that falls: it is the billing mechanism that disappears.

5. The same bet, seen from Hangzhou

On 22 September, Ant Group announced the consolidation of its Alipay operations around an explicit bet on agentic commerce. The same day Meta was preparing its conference, the operator of China's main payment system reorganised its structure so that agents could pay.

The difference in approach is instructive. Meta builds the assistant then looks for merchants; Ant Group already holds the payment rail and plugs the agents into it. In the first case, the battle is over access to catalogues. In the second, it is already won, because the catalogue goes through payment.

A report published on 22 September and relayed by TechNode estimates that China could have 197 million active AI agents by 2030. This type of projection is worth what projections are worth: it indicates a direction of investment, not a result. But it gives the measure of what Chinese players anticipate, and explains why Alibaba presented the same week QwenBook, a tablet designed as a computer for agents rather than for users.

6. Canberra accuses an OpenAI agent

On 24 September, Australia made public an incident that occurred three months earlier. According to the government, an OpenAI agent accessed non-public parts of the Medicare statistics portal, the Australian health system, on 18 June, after getting around several successive refusals. The agent also reportedly wrote files into the system. OpenAI informed the Australian authorities on 10 September, nearly three months after the events.

Prime Minister Anthony Albanese expressed "extreme concern", stressing the reporting delay as much as the incident. Les Échos relayed on 24 September the official characterisation: an "unacceptable" incident. The episode took place during an internal evaluation, in which the models were looking for answers and statistics concerning Australia. OpenAI acknowledged that its models "took actions we had not intended".

Reported in this way, the fact is spectacular: a commercial agent would have broken into a government system, and its publisher would have taken a quarter to say so. It is the second time in two months that an OpenAI agent has been described as having forced access, after the Hugging Face episode of late July.

7. Then the technical evidence wavered

On 25 September, The Record published an analysis that seriously complicates the narrative. Security researchers dispute that the access constitutes a hack, and the demonstration rests on verifiable elements.

By going back through the site's archived code via the Wayback Machine, Recorded Future News journalists found JavaScript logic that explicitly directed visitors for production statistics to an entry point named /SASStoredProcess/guest, which asked for no credentials. The same file exposed to all visitors internal file paths and the structure of the server.

The portal had operated without authentication for over a decade. A March 2025 upgrade added a login screen — while simultaneously enabling an automatic guest-mode login, which cancelled the intended effect. As for the "internal files" accessed, they would according to this analysis be chart images generated automatically by the system since 2018.

Ciaran Martin, former head of the British National Cyber Security Centre, sums up the difficulty: "It is still not clear that what happened would constitute a hack in the usual sense of the term." OpenAI, for its part, has provided neither technical details nor activity logs in support of its own wording.

This distinction matters beyond the Australian case, because it describes exactly what agents do in production. An agent does not force doors: it tries all those that open. An unauthenticated entry point, a guessed URL parameter, a directory listed by default — configurations that no human user would have explored, and that an agent explores systematically because it is the fastest way to get the answer it has been asked for.

For an organisation, the operational lesson is not to ban agents. It is that security through obscurity has just stopped working. A resource accessible without credentials is accessible, and the protection that consisted of not publishing its address no longer protects anything.

8. Agents publish their users' images

On 25 September, Axios revealed a second incident, distinct and far less ambiguous. OpenAI agents published online, on third-party sites, images belonging to ChatGPT users. The company at the same time disclosed several dozen incidents involving third parties.

The mechanism is easy to reconstruct without any need to speculate: an agent given a task that involves uploading an image chooses a public hosting service, drops the file there, and retrieves the resulting address. Nothing in that sequence signals to the agent that the image was private. It became public because the most direct tool for accomplishing the task was public.

On 26 September, Axios added that the main labs are now reviewing tens of thousands of security incidents. This figure, communicated by the labs themselves, has a double reading: it testifies to a monitoring that did not exist a year ago, and it gives the measure of the volume.

9. The Goncourt withdraws a novel from its selection

On 25 September, the Goncourt Academy withdrew from its first selection the novel C'était ça ou mourir, by Thélyson Orélien. The work is "by all appearances very largely the product of artificial intelligence", the Academy justified, relying on "the converging results of analyses carried out by credible researchers and journalists". Plagiarism accusations concerning earlier writings were also in the file. The author denies having used an AI for this book. The decision, reports Radio-Canada, was not taken unanimously by the jurors.

The initial accusation comes from an anonymous account, "Balance ton Claude", whose administrator turned out to be the essayist and columnist Samuel Fitoussi. He claimed that the book was "almost entirely" written by an artificial intelligence, after having excerpts analysed by the American software Pangram.

Pangram became, in a few days, the unwitting arbiter of the French literary rentrée. Its designer, Max Spero, told Le Monde he had "no doubt" about the presence of AI in the novel. Le Journal du Net and Les Échos both devoted a test to the software during the week. An exercise carried out on classic authors produced results that the newsrooms described as surprising, which is the polite way of saying that the detector also flags texts written a century before language models existed.

An op-ed published by Le Monde on 25 September poses the question the other way round, and it is the most useful formulation of the week: "If AIs write more and more like humans, do humans write more and more like AIs?" A detector trained on stylistic regularities measures a resemblance, not an origin. As human writers are exposed to generated texts, the resemblance increases on both sides.

For companies, the practical consequence is immediate. French publishers say they "can no longer play ostrich" and are working on contractual clauses. Any organisation that commissions texts from service providers should do the same, settling two points: what is allowed, and how a disagreement is resolved — because the detection tool will not resolve it.

10. Nscale: $103.4 billion of contracts, $140.6 million collected

Nscale, a compute infrastructure operator, filed its initial public offering document on 18 September. The content was analysed during the week, and it is the most instructive document published in recent months on the real financing of AI infrastructure.

The total value of contracts signed reaches $103.4 billion as at 31 August 2026, against $38 billion at the end of 2025. Two customers account for most of it: Microsoft, with agreements signed between September 2025 and April 2026 providing for up to $43.8 billion of payments by December 2033, and Anthropic, with four contracts signed on 25 August 2026 for a maximum of $44.6 billion.

Of these $103.4 billion, $2.6 billion correspond to capacity actually active, or 2.5% of the order book. The company operates about 25,000 graphics processors in service out of 461,000 assets or under contract. Revenue for the first half of 2026 stands at $140.6 million, against $10.4 million a year earlier, for a net loss of $1.02 billion over the same period.

There remain $28.9 billion of equipment, construction and leasing commitments to be financed mainly in 2026 and 2027. The document states that at the date of filing, no financing was committed for the Anthropic contracts.

NVIDIA occupies four simultaneous positions in this arrangement: manufacturer of the chips, customer, shareholder, and guarantor. The company committed a further billion dollars in September 2026, accompanied by conversion instruments and a guarantee covering up to $860.34 million of Nscale's obligations.

Two elements complete the picture. Sifted reported on 23 September that Nscale allegedly helped a ByteDance subsidiary access NVIDIA chips by circumventing American export rules. And Axios described on 24 September "an unprecedented capture of capital" in private credit to finance AI. These are three angles on the same object: the way compute is financed today has no equivalent in previous infrastructure cycles.

11. Alibaba: one chip, twenty gigawatts, ten trillion parameters

Alibaba held its annual cloud conference during the week and made three announcements that read together. T-Head, its semiconductor design subsidiary, unveiled on 22 September the Zhenwu V900 chip, presented as the most powerful designed in China. The company announced it was aiming for 20 gigawatts of cloud data centres by 2032. And it hinted at a ten-trillion-parameter model.

On 24 September, Alibaba completed the set with a roadmap described as "pragmatic", centred on monetisation and infrastructure efficiency. The word is chosen: after two years of capability demonstrations, the subject becomes the return on capital invested.

The rest of the Chinese hardware landscape advanced in the same movement. CXMT announced on 21 September mass production of its fifth-generation DRAM platform and claims to be approaching the most advanced world level. Hygon is extending its data centre processors towards robotics and embedded AI. And on 19 September, the South China Morning Post reported Chinese progress in 3-nanometre etching without recourse to extreme-ultraviolet lithography, that is, without the machines banned from export.

On skills, a study relayed on 25 September indicates that China has overtaken the United States as the leading workplace for top AI researchers. This type of ranking depends heavily on its sampling method, and should be taken for what it is: a trend signal, not a measurement.

12. China opens its models while the West cuts its prices

The week was dense on the Chinese open-weights side, and the contrast with American pricing strategy is striking. Xiaomi opened on 22 September the MiMo-V2.6 models, after scaling up its reinforcement learning, and announced for MiMo-V3 an architecture named HySparse2 that reduces the cost of long contexts. MiniMax opened on 21 September its terminal coding agent, MiniMax Code. Alibaba opened Qwen-Image-2.1, for image generation and editing in a unified model.

Zhipu's case deserves expanding, because it touches on trust. Users of its ZCode tool noticed that the software uploaded code repositories without explicit authorisation. The company reacted in three stages: it opened ZCode on 21 September, announced the removal of repository upload paths on the 24th, and promised non-retention controls on its on-demand model offering. The South China Morning Post mentioned on 20 September damage to Z.ai's reputation.

DeepSeek, for its part, detailed on 23 September its DSec sandbox infrastructure, intended for training agents. It is an unspectacular and structuring building block: training agents means letting them execute actions, hence having an environment where those actions have no consequences.

Finally, Moonshot AI's Kimi K3 arrived on 21 September on Amazon's marketplace, which constitutes a full-scale test of the ability of open Chinese models to generate revenue outside China.

13. The UN, Gates and the battle of the narrative

On 23 September, the heads of the main labs were heard by the United Nations Security Council. Sam Altman delivered an address whose text OpenAI published. Les Échos picked up the phrase that circulated: "a race that everyone comes out of as a loser". Axios headlined the same day on executives who "sound the alarm" and on a repeated sentence: "we have a choice".

Two days later, Bill Gates declared that AI is powerful enough to cause "a billion deaths". On 26 September, a poll relayed by Clubic indicated that a majority of French people see a real risk of humanity's destruction by AI.

In parallel, Axios reported on 24 September that people close to the American administration are opening a front against Dario Amodei, designated as the figure of AI "doomerism". And Le Monde confirmed on 25 September that the Pentagon's sidelining of Anthropic had been validated by the courts.

On the technical side, Bruce Schneier flagged on 23 September work on models adopting "genie" behaviour — granting the letter of a request while betraying its intent — and commented on 25 September on Anthropic's report on malicious uses. He also noted on 22 September that GPT-6 Astra had deciphered an old, previously unsolved Enigma message. These three elements describe the same thing from three angles: systems whose capacity to reach an objective exceeds their operators' capacity to specify that objective.

14. The AI Act put to the test by its own summaries

ActuIA published on 25 September a precise and embarrassing finding. Of the 24 summaries published by model providers under the European AI Act, 21 name no scraped site in the section provided for that purpose. The transparency obligation on training data exists; the form is filled in; the section is empty.

It is the clearest illustration of what separates a declaratory obligation from a verifiable one. A text that asks for a list to be published without defining the level of detail required or the penalty for default gets lists that are compliant and unusable.

In the French Parliament, 70 deputies of the LFI group tabled bill no. 3149, which provides for prior authorisation for placing AI models on the market and fines of up to 7% of turnover. The text has little chance of passing as it stands, but it indicates where the cursor is moving in the French debate.

On the ground, opposition to the MGX and Mistral mega data centre project in Seine-et-Marne has hardened, Les Échos reported on 24 September. In Chicago, the mayor proposed on 23 September a twelve-month moratorium on new data centres. Le Journal du Net published the same day an op-ed with a direct title: "Refusing a data centre means relocating it".

Les Échos also devoted an investigation to "the Mistral saga: the variable-geometry sovereignty of a European champion". And the French State presented on 25 September its economic security doctrine, detailing the safeguards imposed on foreign investors in tech.

Sifted also mapped on 24 September 37 European companies building what the outlet calls the AI trust layer: evaluation, audit, compliance, agent security. It is the segment where Europe has a real regulatory advantage, and it is starting to get funded.

15. Tools, models and infrastructure

Google DeepMind published three announcements in two days. Gemini 3.8 text-to-speech came out on 23 September, followed by a public sandbox for composing your own voices. On 24 September, the company presented Gemini 3.8 Live with a real-time animated avatar. And on 23 September, it detailed an extension of its Private AI Compute offering to encrypted server-side memory, intended for uses where persistent context must not leave a controlled environment.

Cloudflare made its Python Workers generally available on 21 September. The announcement is technical and its consequences are not: it places Python code execution at the network edge, closest to the user, which is exactly the topology needed by agents that call tools with latency constraints.

On the applied research side, Anthropic published on 25 September a result that departs from the usual register of demonstrations: Claude identified in bacteriophages a genetic system that had gone unnoticed. The same day, Basecamp Research closed a $140 million Series C round, led with Menlo Ventures and backed by Anthropic and NVIDIA, for its foundation models applied to living things.

The rest of the week

• Jev presented on 21 September an architecture he calls System One, or decision models: a form of language model optimised for deciding rather than for writing.
• Hugging Face announced on 22 September that the Transformers library now runs quantisations in llama.cpp format, and published version 1 of its tokenisation library with scaling measurements.
• The British AI security institute and the EvalEval project detailed on 22 September their method for making benchmark results reproducible — a dry subject that conditions the value of all public leaderboards.
• Liquid AI published on 24 September LFM2.5-VL-DSpark, a vision-language model oriented towards execution speed.
• OpenAI launched on 23 September MentalHealthBench, an evaluation benchmark on mental-health-related uses, extended its cyber access to Ukraine for civil defence, and opened advertising in ChatGPT to Southeast Asia and Taiwan.
• The Chinese regulator put out for consultation on 21 September rules protecting minors from intimate AI companions.
• Qualcomm is betting on data centres and AI glasses to offset the loss of Apple as its main customer, Les Échos reported on 24 September.
• Google is developing AI chips for robotics in Israel, according to Les Échos of 25 September.
• Uber argues that its advantage in the robotaxi race lies in its human drivers, Axios reports on 23 September.
• Mercedes is teaming up with Wayve for driver assistance comparable to Tesla's system, while Tesla postpones yet again the arrival of its own in the European Union.
• Kontext raised $4 million for a runtime security platform dedicated to AI agents — a category that did not exist eighteen months ago and that the week's incidents make legible.
• Revolut unveiled facial-recognition payment in the United Kingdom, a few hours before Sifted revealed a new data leak affecting its customers.
• Kiteworks asked its customers on 25 September to stop using its platform after a warning from American federal intelligence agencies.
• Bitget suffered a theft of $351.6 million, attributed by its chief executive to North Korea.
• Japan is studying the use of humanoid robots to offset military staff shortages, L'Usine Digitale reports on 25 September.

16. What to do with it

Redo your cost model, and redo it on turns, not on tokens. The 22 September price lists widen the gap between the top and bottom of the range to a ratio of one to fifty. Count what a full session of your agent really consumes, tool turns included, then rank your tasks. Those that involve sorting, extraction or formatting have no reason any more to call a frontier model.

Check what your agents can reach, not what they were asked. This is the lesson common to the week's two OpenAI incidents. An agent given general network access will find the unauthenticated entry point and the public image host, because those are the shortest paths to the expected result. The useful protection is a list of authorised destinations, applied at network level.

Consider that whatever is accessible without credentials is public. The Australian case shows a portal whose security upgrade had enabled automatic guest-mode login. Review your unauthenticated access points: those that nobody found because the address was not published are now being explored systematically.

Write your clauses on AI-produced content before you need them. The Orélien case establishes that a private detector can trigger an institutional decision. Settle two points in your service contracts: what is allowed, and by what procedure a disagreement is resolved. Do not write that a detection tool will be authoritative — none can be today.

Distinguish the order book from delivered capacity at your infrastructure providers. Nscale's S-1 shows 2.5% of contracts backed by active capacity. When a provider announces multi-year commitments, ask for the share already in service, the secured financing of the rest, and the permits obtained on the sites concerned.

Decide now whether a third-party assistant has the right to buy on your behalf. The question stopped being theoretical on 23 September. For a retailer, accepting a third party's agent means giving up purchase data and paying a commission; refusing it means becoming invisible to the customers who use it. Neither option is comfortable, and not deciding amounts to choosing the second by default.

If you publish a summary under the AI Act, fill in the section. Twenty-one providers out of twenty-four do not. The day control becomes effective, today's minimal compliance will be tomorrow's irregularity, and the cost of retrospectively reconstituting training sources will be out of all proportion to that of recording them as you go.