Dev & AI weekly — October 4, 2026

The pricing war from last week turned into something more interesting this week: two labs landed mid-tier models at exactly the same list price, a day apart. Meanwhile OpenAI used DevDay to make a bigger bet than any single model — turning ChatGPT into a platform that agents and plugins live inside, wired together with a new MCP event spec. And OpenSSL shipped a high-severity fix that anyone running DTLS should take this week. Here's what matters if you build.

DevDay: ChatGPT stops being a chatbot

OpenAI held DevDay on September 29 and called it its biggest yet — more than 20 announcements. Strip out the consumer features and the developer story is one move: ChatGPT is becoming a platform you build inside, not an API you call from outside.

The pieces: ChatGPT Space, a shared workspace where teammates and persistent agents build on the same knowledge, with Pages as a new document type that people and agents co-author. A plugin platform built on the same internals OpenAI uses for its own features — plugins get a sidebar home, interactive panels, and run with each user's own connected data and permissions. And MCP Events: ChatGPT now supports a proposed extension to the Model Context Protocol that lets a plugin trigger automations when something changes in a connected app — the example given is ChatGPT watching a project board, reading linked docs, and drafting a plan while you're away. Agents also get an OpenAI-hosted browser for computer use, parallel subagents, MCP server connections, and durable session state.

Why it matters: MCP Events is the part to watch. MCP so far has been request/response — the model asks, the tool answers. An event model means tools can wake the agent up. That's the same shift we covered with Cursor Projects and the Agents API three weeks ago, now arriving at the protocol layer with OpenAI's distribution behind it. If you maintain an MCP server, event support is likely to become an expected capability. The caution is the one we keep repeating: an agent that triggers itself from a project board, with per-user credentials and a hosted browser, has a large blast radius. Design what an event is allowed to cause, not just what it can see.

GPT-6.1 Sol vs. Claude Sonnet 5.5: same price, different bets

Two mid-tier launches landed a day apart at an identical list price — which makes this the cleanest head-to-head in months.

Claude Sonnet 5.5 shipped September 28, second in the 5.5 family after Opus. Anthropic held Sonnet 5's price — $2 / M input, $10 / M output, $0.20 cache reads — and says it generates output 30%+ faster while costing up to 30% less per task in their testing, because it accomplishes more with fewer tokens.

GPT-6.1 Sol shipped September 29 at DevDay, also at $2 / M input and $10 / M output — but with cached input at $0.10, half Sonnet's cache-read price. OpenAI's one-line pitch is near-Astra intelligence for a fifth of the price: it ties GPT-6 Astra on DeepSWE v1.1 and scores 6.4 points above GPT-6 Sol. The cost-per-task numbers are the useful ones: on Terminal-Bench Science, the average task costs $5.47 on 6.1 Sol versus $23.80 on Astra and $23.21 on Opus 5.5. On AutomationBench it scores 36.1% at $0.30 per task.

Why it matters: when list prices are identical, the comparison moves to two places pricing pages don't show — tokens per task and cache-read cost. Anthropic is betting on efficiency (fewer tokens to finish the job); OpenAI is betting on cheaper cache reads and near-flagship capability. For agent loops that re-read large contexts, OpenAI's $0.10 cache rate is a real edge on paper; for workloads where Sonnet finishes in fewer turns, Anthropic's efficiency claim could more than offset it. You won't know which wins for your workload without running both on a representative task set and measuring cost per completed task, not cost per token. This is the clearest case yet that per-token pricing is the wrong unit.

OpenSSL: high-severity DTLS heap leak

On September 29, OpenSSL shipped fixes for CVE-2026-84782, a high-severity flaw (CVSS 8.2) in DTLS handshake retransmission. If retransmission starts while a fragmented handshake message is mid-send, OpenSSL ends up with a wrong buffer position — an out-of-bounds read that can leak heap memory to the remote peer as plaintext handshake data, or crash the process. Fixed versions: 4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23, plus 1.1.1zj and 1.0.2zs for legacy-support customers. No exploitation was known at disclosure. The same release batch patched 14 issues in total.

Why it matters: DTLS is TLS over UDP, so most web stacks aren't exposed — but WebRTC, VPNs, IoT, VoIP, and a lot of game and real-time infrastructure are. Heap disclosure to a remote peer is the class of bug Heartbleed made famous; the fact that it's DTLS-only narrows the blast radius but doesn't make it benign. If you ship anything with a UDP-based secure channel, check whether you link OpenSSL directly or through a vendored copy in a dependency — the vendored ones are the ones that don't get patched. No known exploitation is a window, not a pass.

The through-line

The price floor stopped moving this week; the unit of comparison moved instead. Two labs met at $2/$10 and started competing on tokens-per-task and cache rates, and OpenAI's biggest DevDay bet wasn't a model at all — it was making ChatGPT the place agents live and MCP the wire they're triggered over. The practical upshot for builders: benchmark cost per completed task, not per token, and start thinking about agents as things that react to events rather than things you call. Under all of it, the oldest layer — a C library from 1998 — still needed a patch.

What to watch next: whether MCP Events gets adopted beyond ChatGPT — Anthropic's response to it will tell you whether it becomes the protocol's next standard feature or an OpenAI-specific extension.

Sources: InfoQ — OpenAI DevDay 2026 recap for developers · The Neuron — DevDay 2026: ChatGPT becoming an AI operating system · Emergent — Every DevDay announcement · Unite.AI — Claude Sonnet 5.5 at unchanged pricing · DataNorth — Claude Sonnet 5.5 · Developers Digest — Sonnet 5.5 release guide · Lindy — GPT-6.1 Sol benchmarks & pricing · OrcaRouter — GPT-6.1 Sol: near-Astra at unchanged price · The Hacker News — OpenSSL fixes high-severity DTLS flaw · The Cyber Express — CVE-2026-84782