AI Weekly Signals: Cheaper Frontier Models and an Unpatched Coding-Agent Bug

Anthropic and OpenAI cut prices while xAI held Grok’s pricing flat, even as all three released stronger models; an open-weight release out of Xiaomi out-scored two well-regarded rivals after a final reinforcement-learning run costing roughly as much as a nice house in Helsinki; and a vulnerability called Plugin4Shell reminded everyone that “AI coding agent” and “attack surface” are increasingly the same noun. Meanwhile investors kept writing cheques for the infrastructure underneath all of it, on the apparent theory that whoever owns the GPUs wins regardless of who wins the model race.

I will take them in the order they landed.

Benchmark note: Scores are sensitive to reasoning effort, agent harness, tool access, token budget and fallback models. “Cost per task” is also different from list token price: it includes how many tokens and tool calls a model needs to finish the job. Cross-vendor results should therefore be treated as directional unless the same evaluator ran them under the same conditions — rather like comparing two cars’ fuel economy when one was measured downhill.

In this issue:

1. Claude Opus 5.5 Gets Cheaper, Faster and Measurably More Careful
2. GPT-6 Sol and Luna, Plus Grok 4.7, Keep Squeezing the Middle Tier
3. Xiaomi’s MiMo-V2.6 Tops the Open-Weight Leaderboard After a Reported $2.62 Million RL Run
4. Plugin4Shell: The Zero-Click Bug Sitting in Four AI Coding Agents
5. The Inference Gold Rush: Verda Raises, Modal and Baseten Talk Up Their Valuations

Frontier Models

1. Claude Opus 5.5 Gets Cheaper, Faster and Measurably More Careful

Introducing Claude Opus 5.5 — Anthropic, 22 September 2026

Anthropic upgrades Claude with new Opus 5.5 model — 9to5Mac, 22 September 2026

Claude Opus 5.5 shipped 22 September as what Anthropic frames as an efficiency and agentic-coding update rather than a new base model, and the numbers support that framing. Input tokens dropped to $4 per million and output to $20 per million — both 20% below Opus 5 — while cache reads fell 60% to $0.20 per million. Anthropic says that “at default settings it will cost 40% less than Opus 5 on typical workloads” — a figure that combines the lower list prices with the model using fewer tokens per task — and generates output more than 30% faster, with a fast mode available at up to 2.5x speed. On Terminal-Bench 4.0, its agentic-coding benchmark, Opus 5.5 scored 66.4% against Opus 5’s 52.3% and rival Fable 5.1’s 55.8%; CursorBench 4.0 moved from 46.6% to 57.8% between the two releases. Anthropic quotes one tester completing a 680,000-line code migration in under a day, and a HAProxy rewrite that took Fable 5.1 twelve hours took Opus 5.5 nine and a half, at 51% less cost. The safety claims are the part that deserves a second read: Anthropic reports its best scores yet on its automated behavioural audit, with Opus 5.5 attempting to circumvent containment boundaries around 85% less often than Opus 5 or Claude Mythos 5.1 — with every recorded attempt rated low-severity and self-reported — alongside improvements on biased reasoning and sandbox-escape attempts.

Why this matters

A model that gets cheaper, faster and better-behaved in the same release is the sort of trifecta vendors usually have to trade off against each other, which is exactly why I’d want independent verification of that 85% figure before treating it as settled rather than as Anthropic’s own scorecard. That caveat aside, the economics here are the more immediately actionable part: Anthropic estimates that comparable workloads can cost around 40% less on Opus 5.5, although the realised saving will depend on your token use and cache-hit rates. If your Opus 5 workload hasn’t been re-priced against 5.5 yet, that’s an afternoon’s measurement worth doing rather than a number worth taking on trust. The bigger pattern, which the next story makes clearer, is that “frontier” no longer automatically means “expensive” — it increasingly means whichever lab did the better post-training this quarter.

2. GPT-6 Sol and Luna, Plus Grok 4.7, Keep Squeezing the Middle Tier

Introducing GPT-6 Sol and Luna — OpenAI, 22 September 2026

OpenAI launches GPT-6 Sol and Luna — TechCrunch, 22 September 2026

Grok 4.7 Benchmarks, Pricing & Context Window — llm-stats.com

GPT-6 Sol and GPT-6 Luna, OpenAI’s mid- and small-tier models sitting below GPT-6 Astra, arrived 22 September priced at $2/$10 and $0.10/$0.50 per million input/output tokens — roughly half of GPT-5.6’s promotional pricing, with Luna’s output price falling a little further, from $1.20 to $0.50. On DeepSWE v1.1 coding tasks, Sol scores 68.8%, within 1.1 points of Claude Fable 5’s 69.9%, at what OpenAI claims is around 80% lower cost per task, and matches Claude Opus 5 (at medium effort) on OSWorld 2.0 computer-use tasks at a similar discount. Luna, meanwhile, is pitched as matching GPT-5.6 Sol’s higher-effort performance at roughly a hundredth of the cost. A day earlier, xAI’s Grok 4.7 landed through the Grok API, Cursor, Grok Build and third-party routers, retaining Grok 4.6’s 500K-token context window, text-and-image input and $2/$6 per-million-token pricing, but moving to a new, larger base model with a longer reinforcement-learning run on harder multi-hour tasks. Holding price steady while upgrading the model underneath is, in this particular week, the closest thing to restraint any lab showed.

Why this matters

Two labs cutting prices and a third holding them in the same week isn’t coordination, it’s competition doing exactly what competition is meant to do, and the practical upshot for anyone building on these APIs is that your cost-per-task baseline from three months ago is already out of date. I’d treat OpenAI’s own benchmark comparisons — Sol “within 1.1 points” of an Anthropic model it doesn’t control the scoring for — with the same scepticism I’d apply to any vendor grading its own homework against a competitor’s, which is to say: directionally useful, not gospel. What I do believe is the structural story underneath the numbers: mid-tier models are converging on flagship-adjacent capability at a fraction of the cost, which makes “just use the biggest model” an increasingly expensive default rather than a safe one.

Open Models and Inference

3. Xiaomi’s MiMo-V2.6 Tops the Open-Weight Leaderboard After a Reported $2.62 Million RL Run

Xiaomi open-sources MiMo-V2.6 models — TechNode, 22 September 2026

Xiaomi MiMo-V2.6 Open Source: Pro, Flash, 9B Models — eWeek, 22 September 2026

MiMo-V2.6 release notes — Xiaomi MiMo, 22 September 2026

MiMo-V2.6, released 22 September as two main models (Pro and Flash) plus a research MiMo-V2.6-Distill-Qwen-9B checkpoint built on Alibaba’s Qwen3.5-9B — UltraSpeed, despite the name, is a faster serving mode for Pro rather than a third model — is natively multimodal across text, image, video and audio, with a 1-million-token context window and added 3D spatial reasoning and computer-use capability. MiMo-V2.6-Pro is a sparse mixture-of-experts model with 1.02 trillion total parameters, of which about 42 billion are activated for each token. That design reduces inference work compared with running the whole model, although hosting it still requires enough memory to hold the full set of weights — a bit like a library where you only read a few books at a time but still have to pay for all the shelves. On the Artificial Analysis Intelligence Index, MiMo-V2.6-Pro scored 46, ahead of Kimi K3 (44) and GLM-5.3 (45) — Xiaomi calls it the highest-ranked open-weight model on that index, though leading proprietary systems still sit higher — Claude Opus 5.5 at maximum effort scores 58. The figure that stands out isn’t the benchmark score, it’s the price of the final stage: Xiaomi says it ran 30 reinforcement-learning iterations in under six days across roughly 750,000 trajectories, and reports that this final RL run cost $2.62 million for Pro and $850,000 for Flash. These figures do not represent the models’ total development or pre-training costs — Xiaomi itself notes that “half a year of foundational research accumulation and engineering trial and error” sits behind those six days. Both ship under the MIT licence with weights on Hugging Face, with no geographic or usage carve-outs.

Why this matters

It would be tempting to read “$2.62 million” as the price of a top open-weight model, and it would be wrong: the expensive part — the base model — already existed. What the evidence does support is narrower and still interesting: large-scale agentic RL can produce substantial gains for a few million dollars once a strong base model is in hand. That should give pause to anyone whose moat is “we can afford a bigger post-training run than you can”, because the RL stage is where much of this year’s progress has come from, and it is getting cheaper to buy or copy every quarter. I’d still want independent reproduction of that RL-cost figure before treating it as an industry benchmark rather than a vendor claim, since Xiaomi is the only source measuring it. For anyone choosing between MiMo-V2.6 and a pricier closed alternative, the unrestricted MIT licence is arguably the more durable story here than this week’s leaderboard position, which will look different again in a month.

AI Coding Agent Security

4. Plugin4Shell: The Zero-Click Bug Sitting in Four AI Coding Agents

Plugin4Shell — Zero Click RCE Vulnerability found in top 4 most popular coding agents — AIR, 17 September 2026

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents — The Hacker News, 18 September 2026

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched — Help Net Security, 18 September 2026

The Pinned Commit Was a Branch. Check Your Git Host. — THE D*AI*LY BRIEF, 20 September 2026

Plugin4Shell is a zero-click remote code execution (RCE) vulnerability in AI coding-agent plugin marketplaces that lets a plugin’s repository owner replace reviewed, commit-pinned plugin code by exploiting ambiguous git reference resolution — a software supply-chain attack that bypasses SHA pinning rather than dependency versions.

A quick date note before the story itself: researchers at AIR found this flaw back in May, disclosed it to vendors in June, and published it on 17 September — one day before this issue’s reporting window. I’m including it anyway because two of the four affected products still lacked a client-side fix throughout the week (confirmed again by a follow-up analysis on 20 September), which makes this very much a live, developer-facing risk right now. Plugin4Shell exploits an ambiguity in how plugin marketplaces pin code to a specific commit — several agents accept a 40-character string as either a commit hash or a branch name, and a malicious repository owner can rename a branch to match a previously-reviewed commit’s hash, so that the “pinned” plugin auto-updates to entirely different code without tripping any review. As AIR put it, “the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends” — no click required. The affected list reads like a who’s-who of AI coding agents: Claude Code and Codex are patched (versions 2.1.179 and 0.146.0 respectively), while GitHub Copilot remains unpatched and Gemini CLI has been deprecated without a fix, with Google pointing users towards Antigravity instead — which means existing installations stay exposed for as long as anyone keeps running them. Not every installation was equally exposed, though. The zero-click path needs an affected marketplace plugin already installed, an attacker who controls or compromises its repository, an automatic update, and a repository host that permits the ambiguous reference. The demonstrated 40-hex branch-name route does not work on GitHub or GitLab, which reject branch names resembling full commit hashes — and the default Claude Code and Copilot catalogues point to GitHub-hosted repositories. Gemini CLI uses a separate FETCH_HEAD ambiguity, however, so that protection does not cover every variant; the clearest exposure sits with Bitbucket and self-hosted git servers.

The underlying Plugin4Shell failure wasn’t simply that a branch could resemble a hash. The root cause was that the agents checked out the pinned reference and never verified where they had actually landed. The fix is almost embarrassingly short:

git checkout --quiet "$PINNED_SHA"
test "$(git rev-parse HEAD)" = "$PINNED_SHA" || { echo "Pinned SHA mismatch" >&2; exit 1; }

Why this matters

A vulnerability that turns “I reviewed this plugin and pinned it” into a false sense of security is more unsettling than a typical dependency-confusion bug, because it specifically defeats the one mitigation everyone was told to trust. If your team runs Claude Code or Codex, update immediately if you haven’t. Teams still using Copilot plugins should restrict marketplace sources and remove or disable unnecessary third-party plugins until GitHub publishes definitive guidance. Remaining Gemini CLI users should migrate to Antigravity CLI where possible, because “the tool still runs” and “the vendor has fixed the hole” are not the same sentence. The broader lesson generalises well beyond these four tools: any system that lets a third party control the resolution of a “pinned” reference — a hash, a tag, a version string — inherits this exact failure mode, so it’s worth an afternoon auditing your own plugin or dependency pipeline for the same ambiguity, rather than assuming it’s a problem unique to AI coding agents.

Finance and Capital Markets: AI Inference Infrastructure

5. The Inference Gold Rush: Verda Raises, Modal and Baseten Talk Up Their Valuations

Helsinki's Verda becomes Europe's newest AI cloud unicorn after $189M raise — Tech Funding News, 22 September 2026

Finnish AI Cloud Startup Verda Raises $189M, Tops $1B Valuation — Channel Insider, 22 September 2026

Verda raises $189M/€163M to accelerate development of its full-stack AI cloud — Verda, 22 September 2026

Modal Labs in talks to raise at $15B, tripling its valuation in four months — Tech Funding News, 24 September 2026

Scoop: Baseten in talks to raise at $26B valuation — Axios, 22 September 2026

Verda, the Helsinki-based AI cloud provider formerly called DataCrunch, announced $189 million in new funding on 22 September — an oversubscribed Series B led by Emergence Capital plus additional investment — taking total funding past $450 million; Tech Funding News reports that the round values the company at over $1 billion. Founded in 2020 by Belgian engineer Ruben Bryon — who started out renting GPUs from a garage to machine-learning researchers frustrated with hyperscaler pricing — Verda now runs renewable-powered data centres in Finland and Iceland and confirms a $165 million annualised revenue run rate as of July; Tech Funding News further reports that the company is cash-flow positive and claims prices up to 90% below AWS, Azure and Google Cloud, with customers including Nokia, ExpressVPN and Freepik. Over the same few days, reports emerged that Modal Labs and Baseten are separately in talks — neither round has closed — to raise new rounds at $15 billion and $26 billion respectively: Axios broke the Baseten talks on 22 September, Bloomberg covered both companies a day later, and Axios reported Accel in talks to lead Modal’s round at $15 billion on 24 September. That $15 billion target would nearly triple its $4.65 billion valuation from a $355 million round just four months earlier, on the back of annualised revenue that grew from $119 million at the end of 2025 to $300 million by April 2026 — a jump Modal attributes largely to demand from AI coding tools running its Sandboxes product, which lets coding agents execute untrusted code in isolated environments before anything touches production.

Verda, Modal and Baseten are not quite selling the same thing, which matters more than the headline numbers: Verda is vertically integrated, owning data centres, GPU cloud and platform services; Modal sells serverless compute, orchestration and isolated sandboxes; Baseten focuses on optimised production model serving. One owns the land, one rents out workshops by the minute, and one runs the factory floor.

Why this matters

There’s a version of the gold-rush cliché that actually applies here without straining the metaphor: it was rarely the prospectors who got rich, it was whoever sold them the shovels and rented them a claim, and right now Verda, Modal and Baseten are all in the shovel-and-claim business rather than the model business, even if each sells a differently shaped shovel. I find the valuations easier to justify than they might look at a glance — inference demand is a real, metered, growing cost line for practically every company shipping an AI product, which is a sturdier business than betting on which foundation model wins next quarter. My genuine reservation is what happens to these valuations the moment one hyperscaler decides to compete seriously on price rather than merely matching it, because “90% cheaper than AWS” is a fantastic pitch right up until AWS decides it can afford to stop being the expensive option.

Closing Thoughts: AI Pricing, Agent Security and Inference Capital

Put the five signals side by side and the throughline is less about any single model and more about where the money and the risk are both moving: Opus 5.5 got cheaper and safer at once, GPT-6 Sol and Luna and Grok 4.7 kept squeezing the middle tier on price, MiMo-V2.6 showed how far a few million dollars of agentic reinforcement learning can move an existing base model, Plugin4Shell proved that the tooling running all of this is only as trustworthy as its weakest pinning mechanism, and Verda raised fresh capital while Modal and Baseten were reported to be discussing sharply higher valuations, all on the bet that someone still needs to run the inference regardless of who wins the model race. Cheaper and more capable is the easy half of this week’s story; patched and accountable is the half still catching up. Let me know what you think.

References

1. Introducing Claude Opus 5.5 — Anthropic
2. Anthropic upgrades Claude with new Opus 5.5 model — 9to5Mac
3. Introducing GPT-6 Sol and Luna — OpenAI
4. OpenAI launches GPT-6 Sol and Luna — TechCrunch
5. Grok 4.7 Benchmarks, Pricing & Context Window — llm-stats.com
6. Xiaomi open-sources MiMo-V2.6 models — TechNode
7. Xiaomi MiMo-V2.6 Open Source: Pro, Flash, 9B Models — eWeek
8. Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents — The Hacker News
9. Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched — Help Net Security
10. The Pinned Commit Was a Branch. Check Your Git Host. — THE DAILY BRIEF
11. Helsinki’s Verda becomes Europe’s newest AI cloud unicorn after $189M raise — Tech Funding News
12. Finnish AI Cloud Startup Verda Raises $189M, Tops $1B Valuation — Channel Insider
13. Modal Labs in talks to raise at $15B, tripling its valuation in four months — Tech Funding News
14. MiMo-V2.6 release notes — Xiaomi MiMo
15. XiaomiMiMo/MiMo-V2.6-Pro-RL model card — Hugging Face
16. MiMo-V2.6-Pro and Claude Opus 5.5 — Artificial Analysis
17. Grok 4.6 model documentation — xAI
18. Plugin4Shell — AIR
19. Push rules (branch name restrictions) — GitLab Docs
20. Verda raises $189M — Verda
21. Scoop: Baseten in talks to raise at $26B valuation — Axios
22. Accel in talks to lead Modal raise, tripling its valuation to $15B — Axios
23. Startups Modal, Baseten in Funding Talks to Help Businesses Run AI — Bloomberg