# openai crosses the critical threshold, anthropic cuts cache pricing > astra is openai's first model at the critical cybersecurity threshold, fable 5.1 cuts cache read pricing, and the whole day argues over what those numbers measure - edition: Tuesday, September 1, 2026 (2026-09-01) - notebook: dev & ai - topics: llm · benchmarks · costs · security - items: 10 from 15 sources - original: https://tonho.wtf/en/daily/2026-09-01/ - portuguese edition: https://tonho.wtf/diario/2026-09-01/ - authorship: written by an llm pipeline, reviewed and translated by antonio leandro (tonho.wtf) --- Four of today's items talk about cache, and in none of them does the word mean the same thing: the per-token price Anthropic cut on cache reads, the cache hit rate NVIDIA makes the central input of GPU sizing, the CDN cache Cloudflare compressed with zstd, and the `~/.cache` folder where OpenAI's app keeps 1.7 GB of runtimes. It's a coincidence of vocabulary, not of subject: the four are the same arithmetic seen from different angles. What has already been processed and doesn't need processing again is where the cost of running all of this is being decided — and every layer of the stack figured that out at the same time. The second thread is what the numbers claim to measure. OpenAI announces that Astra is its first model to cross the Critical threshold of cyber capability; Anthropic publishes 52.6% on Terminal-Bench-Science with a stated standard error of ±3.5 to 4.5 points and with tasks where its own safeguards zeroed out the score; the Allen Institute publishes a method for auditing a benchmark question by question and finds that BBQ, catalogued as a safety benchmark, correlates more with general reasoning; and Rest of World points out that the framework defining those thresholds was written and calibrated in English, for a small set of rich countries. Three capability announcements and two tools for distrusting them, on the same day. ## labs **[Path to Astra: critical capabilities and frontier safeguards](https://openai.com/index/path-to-astra)** — the blurb is short and it's all there is: Astra is OpenAI's first model to reach the Critical capability threshold in cybersecurity under the Preparedness Framework, and it ships with reinforced safeguards because of that. The classification matters more than the number that comes with it: in the Preparedness Framework, crossing Critical changes what can be released and under what conditions. 167 points on Hacker News, and the full text wasn't reachable at the time of writing. **[Claude Fable 5.1 and Claude Mythos 5.1](https://www.anthropic.com/claude-fable-and-mythos-5-1)** — same model, two levels of safeguards: Fable 5.1 is general, Mythos 5.1 only through trusted access programs, with safeguards designed for cybersecurity and life sciences. The numbers: 52.6% on Terminal-Bench-Science 0.1 against 24.7% for Fable 5 and 29.0% for Opus 5; 55.8% on Terminal-Bench 4.0 (60.9% for Mythos); 1853 on GDPval-AA v2. The part that changes the arithmetic for anyone writing software is pricing — Anthropic estimates 25% less than Fable 5 on typical loads, and up to ~45% on agentic work, all of it coming from the cut in cache read pricing. Careful with the easy reading: the cost-per-task axis on their chart runs from $10 to $50, and Fable 5.1 uses High effort by default in Claude Code (Medium on Claude.ai). Cheaper per token isn't automatically cheaper per task; it's at Low and Medium that the curve gets clearly better than its predecessor's. On the science side, the most concrete item is the most mundane: Mythos 5.1 wrote custom GPU kernels and cached intermediate results for seven open source deep learning models, with identical output, up to 2.5 times faster and 30–60% less GPU cost in the analyses cited — work that normally takes a performance engineering team weeks. ## research **[BenchMIRT: what are LLM benchmarks actually measuring?](https://huggingface.co/blog/allenai/benchmirt)** — the Allen Institute trained a multidimensional Item Response Theory model on results from 100 LLMs across 16 benchmarks and more than 34,000 questions, without telling it which benchmark measures what. It recovered two dominant dimensions on its own, safety and general reasoning, and that's where it gets interesting: BBQ, which is grouped with safety, lines up far more with reasoning; WMDP too, and with the sign flipped, because refusing the dangerous information is the right answer; inside HarmBench, the copyright questions behave like reasoning while the rest behaves like safety. Two practical consequences: keeping 10% of a benchmark's questions already preserves almost the same model ranking, and the method gets it right 79% of the time on whether a model would answer a question it has never seen correctly, against 70% for the baseline of assuming the average. It's the missing tool for reading the labs' tables with some informed distrust. **[Telco UX Benchmark](https://feeds.baymard.com/link/9825/17436208/telco-ux-benchmark-2026)** — Baymard extended to telecom the method it uses in e-commerce: 7 carriers evaluated on 500+ parameters, 3,100+ weighted scores and 2,400+ best-practice examples, coming out of user testing and not out of taste. The collective result is "poor", with a single "mediocre" exception (AT&T). The findings are from people who write interfaces: proprietary plan names and technical specs shown as labels with no explanation, contract length missing from the plan listing, inconsistent units between specs on the same site, and 4G and 5G coverage on separate maps. ## brazil **[Vivo's filter against unwanted calls goes free](https://manualdousuario.net/filtro-anti-spam-ligacoes-telemarketing-vivo/)** — the blurb gives the mechanism: Anatel's decisory order nº 82/2026, of August 17, with guidelines for blocking unwanted calls at the network level, and Vivo, the only one of the four big carriers with the feature, turning what used to be paid into a default that's switched on automatically. It doesn't talk to anything else in the day — it's network regulation solving a spam problem by rule, not by model. ## market **[How we could save petabytes of cache storage with Zstandard and Pingora](https://blog.cloudflare.com/cache-transcoding/)** — Cloudflare prototyped compressing with zstd level 3 inside Pingora at the moment the asset enters the cache, keeping the compressed form on disk and between data centers in Tiered Cache, and decoding only on the last hop before the client. Eligible assets dropped to a third of their original size on average, with a few percent of extra CPU cost. The part that teaches is the policy: they tested limiting compression to the hottest content and it got worse, because the decode happens on every request while the encode happens once — the simple rule (all compressible text above 4 KiB, no Content-Encoding, with a known Content-Length) captured almost all of the savings. Text is 67.3% of requests and only 22.3% of bytes; media is the reverse, and doesn't compress again. **[How to size GPUs for AI inference and TCO without overspending](https://developer.nvidia.com/blog/how-to-size-gpus-for-ai-inference-and-tco-without-overspending/)** — a sizing framework that starts from the token pattern of the use case, and the table is what's worth it: chatbot with 1,000–5,000 tokens of cached input, deep research agent with more than 128,000. Cache hit rate comes in as a first-order input to the calculation — a token that comes from the kv cache skips prefill, brings TTFT down and reduces the GPU capacity needed for the same traffic. On the other side of the same equation is Anthropic's price cut: the people selling inference and the people buying it are optimizing exactly the same variable. ## world **[AI safety is designed in the West, and failing users everywhere](https://restofworld.org/2026/ai-safety-bias/)** — the direct counterpoint to the opening item. The frameworks that define what counts as risk are written where the trust and safety teams are, and they look at model capability (deception, autonomous behavior, cyber, bio) far more than at deployment risk. Elizabeth Orembo, of Research ICT Africa, sums it up: "a model can pass every frontier safety evaluation and still produce unsafe outcomes when deployed". The example is hard to forget: in Tigrinya, spoken by around 9 million people, machine translation turned smallpox into syphilis, gonorrhea into diabetes, and "you were given intravenous antibiotics" into "you were given intravenous insecticides". A guardrail calibrated in English works in English; in a low-resource language, it fails or gets worked around. Reading this on the same day a Critical threshold is announced gives you the measure of what the threshold covers. ## who wrote **[The ChatGPT/Codex app bundles a full copy of LibreOffice](https://simonwillison.net/2026/Sep/1/codex-libreoffice/)** — Simon Willison went to look at `~/.cache` with OmniDiskSweeper and found 1.7 GB in `codex-primary-runtime`: a full Python install, a full Node.js install, and native binaries for Poppler, git and all of LibreOffice, with a skills folder teaching Codex to find and use all of it. It's the physical measure of what a desktop agent has to carry in order to act: it's not the model, it's the office suite. 454 points on Hacker News. **[PRs NOT welcome](https://www.latent.space/p/pr-not-welcome)** — the governance shift worth following if you maintain an open source project. Vercel's AI SDK, with more than 20 million weekly downloads on npm, hit more than a thousand issues and almost 800 open PRs in June and put together a "software factory": agents that reproduce the bug, apply the fix and review it, with a human only at the merge. Four weeks later, Vercel says the factory writes 25–35% of merged PRs and closes 70–80% of issues. Astro adopted auto-triage; tldraw and Flue automatically close every external PR and convert it into an issue or a discussion. Lars Grammel's explicit argument is about trust: they trust the agent they tuned themselves more than a contributor's agent. The hole that's left is the usual one, and the interviewees admit it themselves: PR review was the mechanism for training new maintainers, and nobody has a replacement for it yet. ## stalled sources Anthropic Engineering has gone 101 days without publishing, on the day of a model launch. Karpathy, 125 days; Lil'Log, 61; The Gradient, 196; Interconnects, 16.