In the September note I said the models would be cheaper again by the time I wrote about October. It took a week. But the more interesting thread is the one I flagged as the real design problem: authority. Google answered it this week by giving its agent a workplace identity, and Anthropic answered it by narrowing what an agent may fetch. Both are worth reading closely if you ship agents.
The short version
- Small models got serious. Claude Haiku 5.5 ships with a 1M-token context and adaptive thinking; Sonnet 5.5 cache reads were halved; open "decision models" as small as 2B arrived. Routing work to the cheapest model that passes your eval is now the main cost lever.
- Agents got identities. Google's new Gemini agent gets its own Workspace account and email address, delegates to subagents, and shows its work in a tasks inbox with an audit trail. Treat agents like service accounts: least privilege, named owner, logged actions.
- Platforms are hardening the defaults. Anthropic's Managed Agents now only fetch URLs that already appeared in the session — a direct defence against prompt-injection exfiltration. Expect your own agents to need the same rule.
The nine days in one list
Cloudflare releases Clef and Clef-flash (27B and 9B) and Amazon releases Strands Decider 2B — open-weight, Apache 2.0 "decision models" built for routing and classification inside agent systems. Microsoft AI ships a streaming transcription model and new text-to-speech voices.
Anthropic extends its Models API so code can ask, rather than assume, what a model supports: the model line, whether thinking can be disabled, and which server tools it accepts.
Mistral opens a public preview of Mistral Large 4: a multimodal mixture-of-experts model with 1.05 trillion total and 49 billion active parameters and a 1M-token context. Mistral calls it open-weight; the weights are promised later.
Anthropic expands Claude for Startups at SF Tech Week: a free year of Claude Team (up to five premium seats) and $1,000 in API credits for young or recently funded companies.
Anthropic launches Claude Haiku 5.5: 1M-token context, 128k max output, adaptive thinking with an effort control, on its API, Bedrock, Google Cloud, and Microsoft Foundry. Same day: Sonnet 5.5 cache reads drop from $0.20 to $0.10 per million tokens, and the SDKs gain beta classes for browser-use and computer-use tools.
Anthropic tightens Managed Agents networking:
web_fetchnow only fetches URLs that have already appeared in the session, and a limited-network environment's host allow-list now applies to web search and fetch too.Google launches the Gemini agent at Gemini at Work: a "universal" workplace agent that plans toward an objective, delegates to subagents, can pick among models (including Claude), and gets its own Workspace identity. Businesses first, consumers later.
Anthropic adds dynamic workflows to Managed Agents (beta): for large jobs an agent can write a program that runs many agents in phases and combines their results.
1. Small models got serious
Haiku 5.5 is the clearest example of a pattern that has been building all year: the small tier now carries the same context window and output ceiling as the flagship, plus the same adaptive-thinking control. Anthropic positions it for high-volume and latency-sensitive work, and that description is the point — a large share of what production systems do is high-volume and latency-sensitive. Classification, extraction, routing, first-pass summarisation, tool-call planning for simple tools.
Put that next to the rest of the week. Sonnet 5.5's cache reads are now half what they were a week ago. Cloudflare and Amazon both shipped open models whose whole job is to make a decision cheaply. And one release I missed in September: OpenAI's GPT‑6.1 Sol, announced at DevDay on September 29, was priced at a fifth of GPT‑6 Astra's token prices while targeting near-Astra quality on agentic coding.
The practical consequence is that model choice is now a routing problem, not a single decision. The interesting question is not "which model do we use" but "which steps of this workflow need which model," and the only defensible way to answer it is to run your own eval set across tiers and route each step to the cheapest model that passes. I described how I build those sets in The evaluation gap; this is the month the effort pays for itself.
One caution from the Haiku 5.5 release notes. Code written for Haiku 4.5 can break: temperature, top_p, top_k, assistant prefill, and manual thinking budgets can each return a 400, and adaptive thinking is on by default. That is the same migration tax I wrote about with Sonnet 5.5. The new Models API capability fields help — your code can check what a model accepts instead of hard-coding it — but they do not replace a test run.
2. Agents got identities
In September the big launches gave agents their own computers. This week Google gave one a job title. The Gemini agent gets its own Workspace account and email address, understands who is on which team and who approves what, can delegate to subagents, and connects to Workspace, Microsoft 365, Slack, Jira, Confluence, Git, BigQuery, Databricks and more. Google Cloud's CEO framed it as handing it "objectives, not just instructions."
The detail I would copy is not the identity itself but the tasks inbox: a view of the agent's reasoning, its delegation decisions, and its progress, with an audit trail. That is what makes an identity safe. An agent with an email address and no audit trail is a shared password with opinions.
If you run agents inside a company, this gives you a ready mental model: treat each agent like a service account with a named human owner. Give it the narrowest scopes that do the job, log every action against its identity, and put approval gates where actions are hard to reverse. None of that is new security thinking — which is exactly why it works. I go deeper on where the human belongs in Human-in-the-loop is a design decision.
3. Platforms are hardening the defaults
The least-noticed change of the week might matter most. Anthropic's Managed Agents web_fetch tool will now only fetch a URL that has already appeared in the session — in the user's message, a search result, or a page fetched earlier. A URL that shows up only in the model's own output, an attached document, or a tool result is refused. Anthropic says plainly that the goal is to reduce the risk of data exfiltration.
That closes a specific hole: an instruction hidden in a document tells the agent to "fetch" an attacker's URL with your data in the query string. If your own agents have a fetch or HTTP tool, the same rule is cheap to implement and worth having — together with an explicit host allow-list, which Anthropic now also applies to search and fetch. I listed injected tool results among the production pitfalls in MCP, plainly; it is good to see the platforms treating it as a default rather than an option.
Dynamic workflows, launched today, point the other way: agents that write programs to run many other agents. That makes the hardening more important, not less. Every sub-agent inherits whatever the parent was allowed to do.
What I would do before month end
- Run your eval set on the small tier. Try Haiku 5.5 (or your provider's equivalent) on every step of one real workflow and record which steps pass. Route those steps down.
- Turn on prompt caching where you have stable prefixes, and check the cost per outcome again — the price of a cache read just halved on one major model.
- Give every agent an owner, a scope list, and an action log. If you could not answer "what did this agent do yesterday, and on whose authority," fix that before adding another agent.
- Restrict outbound fetches to URLs the user or a trusted search supplied, plus an allow-list of hosts.
I will close out the month with a full October recap. If the pattern holds, the theme will be the same one: capability keeps getting cheaper, and the work that matters is deciding what an agent is allowed to do with it.