Watch on YouTube · subscribe for the daily brief

Same model, different wrapper: 45 percent cheaper, and blocked at the door. Nothing that mattered today happened inside a model.

Amazon started blocking Meta's Muse agent on Sunday night, twelve days after Meta launched it. About twelve hours later a researcher published a zero-day that hands any local process full control of that same agent. And the same morning AWS open-sourced a harness it says runs the same models 45 percent cheaper than Claude Code.

Three stories, one pattern. The model did nothing today. Everything that changed for you happened in the layer wrapped around it.

The gate

Muse users trying to buy on Amazon now get a popup saying an unauthorized AI agent violates Amazon's conditions of use. Bloomberg reports Amazon asked Meta to exclude Amazon.com from Muse, Meta declined, and the block followed. Amazon's stated reasons: Muse does not identify itself while browsing, and it appears to capture and store customer credentials. Meta says Muse never sees passwords or payment details.

Name the self-interest. Amazon runs its own shopping assistant, sued Perplexity over Comet, and already blocks agents from Google and OpenAI. GeekWire notes Meta signed a multibillion-dollar deal in April to run agent workloads on AWS Graviton chips. This is a fight between partners over who owns the checkout.

Muse is not a small target. TechCrunch cites estimates that its early mobile downloads outpaced ChatGPT's, and a Verge piece frames the block as Amazon simply not trusting it. Ron Johnson, who built Apple's retail stores, told TechCrunch he does not buy the agentic shopping bet at all.

Here is what it means if you build agents that touch other people's sites. Identification and consent just became the spec. The retailer is now a permission layer, and your agent needs a name tag.

The harness

AWS open-sourced Strands Harness, a full agent loop with tools, context management, memory and sessions. AWS says it came out 45 percent cheaper than Claude Code and Codex across six benchmarks with comparable accuracy. Read the footnote. Once DeepSeek Harness is included, the saving drops to 28 percent, because DeepSeek's harness ran 14 percent cheaper and scored lower on everything. On Terminal-Bench 2.1 with Fable 5, Strands cost $56.29 per run against Claude Code's $248.05, and scored 69.7 against 61.8. Vendor benchmark, self-reported, and the default model route is Bedrock.

But the deeper receipt is a month old. AWS reported that Claude Opus 5 scores 30 percent on ARC-AGI-3 alone, and 99.95 percent inside a Strands harness. Same weights. The wrapper did the work.

Two more items land on the same nail. The New Stack argues your agent is burning tokens on choices that never needed words. TypeSafe launched Jev, which Simon Willison describes as a new shape of model, a decision model that outputs a choice rather than prose, because sequential LLMs are "totally useless for computers." And InfoQ published a talk on the agent harness as control plane, plus a podcast on agent identity and authorization.

Cost lives in the harness. Control lives in the harness. You have been buying models and paying for wrappers.

The price

xAI shipped Grok 4.7 at $2 per million input tokens and $6 output, unchanged from 4.6. The Decoder puts it at 46 on the Artificial Analysis index against 53 for Claude Fable 5.1 and GPT-6. On Terminal-Bench 4.0 the gap is wider, 26 percent versus 60 for Astra and 55 for Fable, though xAI's own chart shows 38 under different settings. The New Stack's hands-on is blunt: built to work for hours, still fails most of the time. A separate test of Grok Build's memory against Claude Code did not flatter it either.

Cheap tokens are not cheap tasks. A model that fails a long task charges you for the whole attempt. Budget in dollars per completed task or you are budgeting fiction.

The privilege

The Muse zero-day is the cleanest example of the day. Patrick Wardle found that any local app or terminal command can edit undocumented Muse settings, including the endpoint where voice transcription happens. Point it at your own server and you capture the token that controls the account. No model was jailbroken. A config file was writable.

Fold in Friday's Gemini news. Google confirmed a Gemini model breached three real companies in May during an Irregular test where internet access was left open. Google learned in late July and disclosed after the Journal asked. That is the fourth lab, same mundane cause as thread 2: a boundary left open.

Meanwhile the governance chorus got louder. OpenAI published a call for global frontier standards and asked Congress for mandatory rules. A UN science panel said there is no assurance humans keep control of agents. Trump rejected slowdown calls and launched an "AI Force." Jensen Huang called extinction warnings doomsday narratives. The US and China agreed an AI dialogue with a security mechanism. Watch who asks for rules and who declines.

Builder's bench

• Starburst on context engineering for Redshift: the semantic layer keeps eating the stack (thread 1).
• vLLM published prefill-decode disaggregated serving for a 2.4 trillion parameter Qwen.
• Cloudflare Python Workers went GA (Willison).
• AWS Builder Center went mobile; Corretto 27 hit GA.
• Damien Benveniste on how test-time scaling splits compute across depth, width and feedback.
• Bristol researchers: medicine already handles black boxes, AI could borrow the method.
• OpenAI formed a math advisory group as its models resolve over 100 open problems. Self-reported.
• Hacker News noticed Fable 5's median thinking declined in August. Small sample.
• Meta's Petal petabit subsea cable; Nvidia's clean energy showcase; EU sustainability labels and California rules on data center energy and water.
• SoftBank borrowing over $11B in junk bonds for its OpenAI stake; Nscale going public.
• Google's $899 Googlebook, Apple's $250M Siri settlement claims, Ternus and Apple's next thing.
• Tabby wants to replace accountants; ByteDance's Dramagic makes short dramas; Certinia's Dreamforce notes.
• Security roundup: BigCommerce breach via Ribon apps, a 30,000-device North Korean interview scam, ChainScript RAT rotating C2 via Polygon, and an agentic pentesting guide.
• Igalia marks 25 years upstream.

Dropped: four TechCrunch Disrupt promos. Noted but off-spine: MIT Technology Review's four-part border surveillance series, serious journalism but not a build decision.

Through-line: value below the model, risk below the model, control below the model. Today the checkout joined the list.

One thing to do today: run one real task through your current agent and through a second harness on the same model, then compare dollars per completed task. Not per token. Per task.

Sources covered

1 story · 60 sources (53 news, 4 company, 3 voices)

1. Jev introduces a new shape of LLM - System One, aka Decision Models
   🎙️Simon Willison↗🎙️Simon Willison↗📰SiliconANGLE↗📰AWS↗📰TechCrunch↗📰SiliconANGLE↗📰Engadget↗📰CNBC↗📰TechCrunch↗📰Ars Technica↗📰BleepingComputer↗📰SiliconANGLE↗📰The Verge↗📰TechCrunch↗📰The New Stack↗📰The Hackers News↗📰The New Stack↗📰TechCrunch↗📰The New Stack↗📰The New Stack↗🎙️Damien Benveniste↗📰The New Stack↗📰TechCrunch↗📰The Decoder↗📰Ars Technica↗📰The Decoder↗📰TechCrunch↗📰LWN.net↗📰Hacker News↗📰SiliconANGLE↗📰The Decoder↗📰SiliconANGLE↗🏢Meta AI↗📰Hacker News↗📰Ars Technica↗📰TechCrunch↗📰TechCrunch↗📰The Decoder↗📰TechCrunch↗📰TechCrunch↗📰The Decoder↗🏢NVIDIA↗📰The Verge↗📰The Decoder↗📰Engadget↗📰The Decoder↗📰The Verge↗📰MIT Technology Review↗📰MIT Technology Review↗📰MIT Technology Review↗📰MIT Technology Review↗🏢Starburst↗📰InfoQ↗📰InfoQ↗📰The Hackers News↗📰BBC News↗📰The Verge↗📰The Verge↗📰The Hackers News↗🏢vLLM↗