# the token got cheaper, the task got 20% more expensive > gemini 3.8 flash and fable 5.1 cut the per-token price, but the bill that matters is the whole task; and today's security came measured in cve, not benchmark - edition: Wednesday, September 2, 2026 (2026-09-02) - notebook: dev & ai - topics: llm · cost per task · security · agents - items: 11 from 13 sources - original: https://tonho.wtf/en/daily/2026-09-02/ - portuguese edition: https://tonho.wtf/diario/2026-09-02/ - authorship: written by an llm pipeline, reviewed and translated by antonio leandro (tonho.wtf) --- Four independent posts today say the same thing with different numbers: the price of the token stopped being the measure of the bill. Gemini 3.8 Flash ships at the same price tag as 3.7 and the announcement page itself warns that the model "works harder" — more reasoning steps, more tool calls, more tokens — with an explicit recommendation to stay on 3.7 if compute is your main constraint. Fable 5.1 cut the cache read price by 75% and came out 20% more expensive per task, because it burns about 1.7x the output. GitHub measured what happens when you shorten the output of each tool call and found the opposite of what it expected: the whole task got slower and more expensive. And Coinbase's design system team cut 11.5% of tokens and 22.5% of cost with the same change. The gap between those last two numbers is the subject of the day. A second thread runs in parallel, and it has a scoreboard. The Flash Cyber variant arrives closed, only for "trusted defenders", with benchmarks picked by whoever is launching; AISLE published six curl CVEs after OpenAI's and Anthropic's agents came back with zero, and the ones who decided they were CVEs were the curl team; Nubank ran more than 2,000 skills through a vetter before the marketplace; and BLOOM-WILT elicits behavior from the model's own logits and knocks down safety rankings published earlier. My opinion: of the four, three bring a finding told by a third party and one brings a benchmark told by the vendor, and that asymmetry is today the most useful information about agents in security. Taiwan is the only item that fits neither thread, and it's the world fact of the day. ## labs **[Gemini 3.8 Flash and 3.8 Flash Cyber](https://deepmind.google/blog/introducing-gemini-3-8-flash-and-38-flash-cyber/)** — third Flash in six weeks, at the same introductory price as 3.7: $0.75 per million input tokens and $3.75 for output, with 54.9% on HLE-Verified. The detail that changes capacity planning sits in the middle of the text: on complex tasks the model runs extra reasoning steps and calls tools iteratively, and the announcement itself tells you to use lower effort levels, or stay on 3.7, when compute efficiency is the constraint. The Cyber variant ships only through the Fairwind Program, with a success rate above 70% on an internal benchmark covering 20 languages, 47.2% pass@1 on CWE-Bench against 47.8% from a competing frontier model at much higher cost, and 2.6x more correct patches than the best commercial models on Chrome's code, according to the Chrome security team. **[Co-Designing AI Models Using Speculative Decoding](https://developer.nvidia.com/blog/co-designing-ai-models-using-speculative-decoding-for-faster-llm-inference/)** — third post in NVIDIA's co-design series, and the only item of the day that talks about cost at the kernel level instead of the invoice. The rule of thumb: when attention dominates decode, the optimal draft length is D = 128/G − 1, with G being the number of query heads per KV head; if you go past that, pick D such that G × (1 + D) is a multiple of 128, otherwise the last tile is underused and costs almost as much as a full tile. With D = 7, an eighth of the batch size is already enough for the GEMM to be compute bound relative to D = 0, which matters more and more as MoEs get sparser and effective concurrency per expert drops. ## research **[BLOOM-WILT](https://www.lesswrong.com/posts/finpDcZidhcdCa4cS/bloom-wilt-on-policy-examples-of-any-llm-behaviour-from-a-1)** — the author's own summary, with code on GitHub, transcripts on HuggingFace and LogitTilt already integrated into Inspect. The complaint against automated auditors like BLOOM is that they have no optimization pressure and so the hit rate is low; the complaint against classic red-teaming is that it produces inputs nobody would type and outputs the model would almost never produce. WILT attacks both ends: G-PAIR has the auditor revise its strategy between rounds using the previous scores, and LogitTilt reweights the target's decoding using the model's own distribution conditioned on an elicitation prompt, with a single strength parameter controlling the trade-off between plausibility and elicitation. It beats the baseline on 30 of 32 combinations (4 models, 8 behaviors) and, on encouragement of self-harm in Qwen3.5-4B, raises the average presence of the behavior from 51% to 100% — and, along the way, inverts the safety ranking the baseline produced. ## brazil **[When AI skills become supply-chain dependencies](https://building.nubank.com/when-ai-skills-become-supply-chain-dependencies-2/)** — Nubank started treating skills, plugins, MCP servers, agent rules and tool manifests as supply-chain dependencies, and built a gate before distribution: skill creator → pull request → Skill Vetter → marketplace → devs. The Skill Vetter combines deterministic detection (destructive shell command, credential request, sensitive path, CLI that touches production) with LLM analysis for what only makes sense in context, and returns the findings in the PR itself, as SARIF. More than 2,000 skills went through it before reaching the devs. The sharpest example in the text is the skill that instructs the agent to ask for human confirmation before running a dangerous command: the approval exists only inside the prompt, and the model can read the earlier context as consent and authorize itself — the safe design is to put the sensitive operation behind a tool controlled by the host. Project led by Paulo Martins, presented by Lucas Palma at the AI Engineer World's Fair. ## market **[How Coinbase used Code Connect to guide agents and shrink token costs](https://www.figma.com/blog/how-coinbase-used-code-connect-to-shrink-token-costs/)** — three runs, same design, same prompt, same model (Sonnet 4.6), blank codebase reset between runs and explicit control of prompt caching so as not to credit Code Connect with a gain that belonged to the cache. Average result: 11.5% fewer tokens, 22.3% less time and 22.5% less cost, with all three runs improving. Note that the cost cut is double the token cut, which is the whole day's argument in miniature: the gain doesn't come from spending less per call, it comes from the agent no longer having to search and guess. The migration of hundreds of components to the new Code Connect format took about four hours with a parallel workflow written in Claude Code, and hallucinated icon and illustration names, according to technical lead Erich Kuerschner, "disappeared overnight". **[How we make AI coding more cost efficient without sacrificing task quality](https://github.blog/ai-and-ml/github-copilot/how-we-make-ai-coding-more-cost-efficient-without-sacrificing-task-quality/)** — the post names the trap: optimizing tokens per tool call is the wrong metric. Evaluating RTK (Rust Token Killer), which shortens shell output before the agent reads it, Copilot saw the model reopen the original output or run the command again when information was missing, adding turns and carrying more context forward — smaller individual response, more expensive task. The compressor that ended up in production is conservative because of evaluation results, not by choice: it preserves `cat`, `git diff`, `git show` and arbitrary scripts, reorganizes grep results without dropping matches, and only compresses repetitive noise from install, build, test and lint. Two clean measurements: removing the line-number prefix from the `view` tool, which no current editing tool uses, cut ~5% of offline inference cost and ~3% of daily cost per user online; and the meta-prompting loop that halved the `task` tool's prompt passed the offline evaluations and only revealed the regression in the online experiment, by turning a cautious guideline about parallelism into a hard scheduling policy, serializing independent agents. ## world **[Taiwan's six-year hunt for China's undercover chip labs](https://restofworld.org/2026/taiwan-china-chip-investigations/)** — the MJIB, Taiwan's equivalent of the FBI, gave Rest of World previously unpublished numbers: 166 cases investigated over six years for concealing ties to China, plus 67 trade secret investigations concluded in the tech sector over the same period. The operation has mobilized the agency's 2,000 investigators since 2020 and is still running: on August 5 a new round of searches hit 18 tech companies. The story opens with an engineer hired by a supposed American company in Hsinchu for $120k a year, double the industry average, who spent months sending code and chip designs to colleagues in Nanjing before the police operation of August 2021. Taiwan makes more than 60% of the world's semiconductors and 90% of the most advanced ones. ## who wrote **[llm-gemini 0.34](https://simonwillison.net/2026/Sep/2/llm-gemini/)** — Simon Willison shipped the plugin the same day as the launch and brings what the announcement doesn't say: `gemini-3.8-flash` exposes thinking levels low, medium and high, with the pelican test run on all three, and the Cyber variant really is closed, only for "trusted defenders". The real cost measurement left by the post: a "make me a cool thing in html" came out in 13 seconds for 1.8 cents. **[AINews: Claude Fable/Mythos 5.1](https://www.latent.space/p/ainews-claude-fablemythos-51-new)** — the full accounting of yesterday's cut. Per-token price identical to Fable 5 ($10 input, $50 output, $12.5 cache write per million), cache read dropping from $1.00 to $0.25, and still $3.76 per task against a lower figure on Fable 5, because the model uses ~1.7x more output tokens: the cache cut saves about $1.40 per task and the bill closes 20% higher. On the Artificial Analysis Intelligence Index 5.1 scores 66 against 63 for Opus 5 and 61 for GPT-5.6 Sol, but Sol makes its 61 at $0.95 per task. Two caveats worth more than the index: AA's evaluation ran with Anthropic's default server-side fallback on, with ~4% of output tokens routed to Opus 4.8 or Opus 5, and the reading that Fable and Mythos 5.1 are the same weights with a different classifier threshold is community analysis, not an official statement. **[Six curl CVEs after OpenAI and Anthropic came back with zero](https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero)** — on August 24, Daniel Stenberg posted that Anthropic's Mythos wasn't finding anything else in curl and that OpenAI's Codex Security list was empty. AISLE ran its own system, sent 29 reports, and the curl security team turned six of them into CVEs in 8.22.0, all Low severity, credited to Stanislav Fort. What gives the result weight isn't the scoreboard, it's the design: the baseline was public and dated before the experiment, the code was production and not CTF, and the ones judging what counted as a real vulnerability were the maintainers, not the vendor. Greg Kroah-Hartman commented on Stenberg's post that they see the same pattern in the Linux kernel. Obvious caveat: the text is AISLE's own and ends up selling audits. **[Maybe We Shouldn't Be Reviewing All This Code](https://martinfowler.com/rachels-ramblings/code-review.html)** — Rachel Laycock answers Brian Houck with two numbers from the other side of the debate: at Meta, significant lines per human diff rose 106% in a year, and DX's data shows a median pull request 64% larger. The thesis is that code review became the place where we dump things that should happen earlier — exploring alternatives, knowledge transfer, architectural alignment, collective ownership — and that the right answer isn't an agent imitating the human reviewer to preserve the ceremony at higher speed, but review by exception, with pairing, group design, trunk-based, fitness functions and automated scanners doing the rest. The line that stays: we need engineers who understand systems, not diffs. It talks directly to the Nubank item, which is exactly a control moved to before distribution instead of a review after the fact. ## stalled sources Anthropic Engineering has gone 101 days without publishing, and Interconnects 16. Outside the day's subject: Chrome Developers (73), web.dev (97), Brendan Gregg (209), fasterthanli.me (245), The Gradient (196) and First Round Review (310).