Dev & AI weekly — September 26, 2026
Dev & AI weekly — September 26, 2026
Last week we wrote up Dario Amodei's "We Must Pace the Frontier" essay and a three-lab safety pact, and asked one question: whether "pacing" would change the release cadence or sit on top of an unchanged one. We got the answer in nine days. Four frontier models shipped in 48 hours, Anthropic's included, and all of them came with price cuts. Meanwhile a CVSS 9.8 zero-day landed in the appliance sitting at the edge of a lot of corporate networks. Here's what matters if you build.
OpenAI halved its prices — permanently
On September 22, OpenAI shipped GPT-6 Sol and GPT-6 Luna at roughly half the price of their GPT-5.6 equivalents. Sol is $2 / M input and $10 / M output; Luna, the high-volume option, is $0.10 / $0.50. OpenAI explicitly told VentureBeat these are permanent prices, not a launch promotion — which matters, because we flagged Gemini 3.8 Flash's "introductory" rate in August that doubles on January 1. This one doesn't.
Both carry a 1.05M-token context and can emit up to 128K tokens per response. Sol sits below GPT-6 Astra (the September 4 flagship) but now beats Astra on OpenAI's own business-task benchmark. The number that should get your attention is Luna's: 66.6% on DeepSWE v1.1 at max effort — 2.2 points behind Sol — while costing 93% less per task than Claude Opus 5.
Why it matters: a 93% cost reduction at a 2-point capability gap breaks the usual "cheap model, worse results" tradeoff for a large class of work. If you're running document extraction, ticket summarisation, classification, or any high-volume repetitive job on a frontier-tier model, Luna is a direct bake-off candidate and the math is unlikely to be close. The permanence claim is the part worth acting on — you can build a cost model on this without a January cliff.
Claude Opus 5.5: cheaper, faster, and the first post-"pacing" release
Also on September 22, Anthropic shipped Claude Opus 5.5 — its first model since the pacing essay. Pricing is $4 / M input and $20 / M output, 20% below Opus 5, with cache reads down 60% to $0.20. Anthropic puts the real-world saving at about 40% on typical workloads, with the model running 30%+ faster.
Capability moved materially, not marginally: 66.4% on Terminal-Bench 4.0, up from Opus 5's 52.3%, and 81.8% on OSWorld 2.0 for computer use. Anthropic also says it posts the strongest alignment scores of any recent Claude model and that its communication was tuned to be clearer and less jargon-heavy in long sessions. Sonnet 5.5 and Haiku 5.5 follow in coming weeks.
Why it matters: the cache-read cut is again the line item that moves agent bills — third time in two months a lab has cut cache pricing specifically, which tells you where the real token volume lives. But the more interesting thing is the framing. "Pace the frontier" apparently means keep shipping, and lead with efficiency and alignment rather than raw capability jumps. A 14-point Terminal-Bench gain is not a slowdown by any reading. It's a legitimate position — improving cost, speed and alignment while capability grows steadily is arguably exactly what responsible pacing looks like — but anyone who read last week's essay as "the cadence will slow" should update. It didn't.
Grok 4.7: same price, and honest about where it trails
xAI released Grok 4.7 on September 21 — 500K context, $2 / $6 for prompts under 200K tokens (with a step up to $4 / $12 beyond that), and cached input at $0.50. Notably the list price did not move from Grok 4.6 in August.
It improves on 4.6 across every benchmark in xAI's own comparison table, leads on EEBench and the Harvey legal-agent benchmark — and trails Claude Fable 5.1 on coding. On the independent Artificial Analysis Intelligence Index it landed at 46, seven points behind the 53 posted by both GPT-6 Astra and Fable 5.1.
Why it matters: in a week where two competitors cut prices 20–50%, holding price flat is effectively a price increase. The useful read is specialisation: if your workload looks like legal or domain-agent work, the EEBench and Harvey results are worth testing. If it's coding, the independent index says you have better options at similar or lower cost. Also worth noting the 200K-token repricing step — the same structural gotcha as GPT-6 Astra's 272K cliff. Long-context pricing tiers are becoming standard, and they punish naive context-stuffing.
F5 BIG-IP: a 9.8 zero-day, already exploited, at your network edge
On September 22, F5 disclosed CVE-2026-94127 — a CVSS 9.8 heap-based buffer overflow in BIG-IP Access Policy Manager allowing unauthenticated remote code execution via crafted traffic to an affected OAuth configuration. F5 published the advisory after determining attackers were already exploiting it, and CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of September 25.
It affects APM deployments running an access policy plus an OAuth profile on a virtual server — specifically where APM acts as an OAuth Authorization Server. Affected versions: 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3. Shadowserver is tracking 14,700+ IPs showing BIG-IP APM fingerprints. (Check Point also disclosed two 9.8s in Security Gateway/Management the same day.)
Why it matters: unauthenticated RCE on an appliance that by design sits in front of everything else is close to worst-case, and "already exploited before the advisory" removes the usual patch window. If you run BIG-IP APM as an OAuth AS, this is a today job, not a sprint item — and check for compromise, not just patch level, since exploitation predates disclosure. The broader lesson we keep relearning: the edge device terminating your auth is a higher-value target than anything behind it.
The through-line
Nine days after the industry's most prominent safety essay, four labs shipped frontier models and competed on price. That's not hypocrisy exactly — Anthropic's release genuinely leads with efficiency and alignment rather than a capability moonshot — but it does settle the practical question: plan your roadmap around the cadence continuing. Meanwhile the thing most likely to actually hurt you this week wasn't a model at all; it was a buffer overflow in a load balancer. The capability layer keeps getting cheaper and more abundant. The boring infrastructure keeps being where the incidents are.
What to watch next: whether Sonnet 5.5 and Haiku 5.5 carry the same cache-read cuts down the stack — and how many BIG-IP APM instances are still unpatched a week after a KEV listing with active exploitation.
Sources: DataNorth — GPT-6 Sol and Luna, prices halved · Digital Applied — GPT-6 Sol/Luna API prices & trade-offs · ComputingForGeeks — GPT-6 Sol and Luna benchmarks · VentureBeat — Claude Opus 5.5 beats Fable 5.1 at 60% cheaper · AI Weekly — Opus 5.5 at 20% lower token prices · Digital Applied — Grok 4.7: what actually changed · LLM-Stats — Grok 4.7 benchmarks & pricing · Rapid7 — CVE-2026-94127 critical unauthenticated RCE in F5 BIG-IP APM · The Hacker News — F5 patches BIG-IP APM zero-day · SecurityAffairs — BIG-IP APM zero-day exploited