Activity for Coding Agents Enter the Control-Loop Era

Coding Agents Enter the Control-Loop Era

September 8, 2026 •

GPT-6 Astra’s Codex demos and AMP’s remote-agent operations converge on a practical pattern: delegate outcomes, instrument the loop, and gate access and review by blast radius.

Latent Space

Latent.Space

Riley Brown

🔥 TOP SIGNAL

The high-alpha shift is from code generation to closed-loop computer operation. Riley Brown reports that GPT-6 Astra in Codex took an estate PDF containing a floor plan, created a Blender scene in about 20 minutes, then generated a playable map in an existing Call of Duty-style game after about an hour. In the same workflow, the agent inspected screenshots, launched and played the game, caught an incorrect texture, reprompted itself, and retested; AMP describes the production analogue—phase a migration, inspect logs and database invariants, advance only when healthy, and roll back otherwise.

⚡ TRY THIS

Build around an acceptance loop, not a patch. Use this prompt shape: Build [artifact] from [input]. At each stage, render or launch it, exercise [real flows], inspect the result, and fix/retest until [acceptance criteria]. Brown’s demo is the pattern: the agent evaluated screenshots, tested the running game, noticed a texture failure, and iterated. The harness is powerful because it can control the computer, browser, local apps, and files—but Brown’s setup also gives it signed-in applications and API keys. Reproduce this in a disposable environment or with narrowly scoped credentials.
Phase-gate production changes. Split a risky migration into backwards-compatible stages; after each deployment, have the agent monitor logs, database state, and explicit invariants; advance only on clean results and roll back on failure. AMP’s proposed permission model is a short-lived OIDC token—30 minutes of read-only access to only the relevant logs or production database—not a developer laptop’s ambient credentials.
Route review by blast radius. Addy Osmani’s default is a multi-agent first pass on every PR to find and verify bugs, rank severity, and suggest fixes. Let low-blast-radius changes in less-sensitive code skip deep human review only after that pass is clean; require an owner and human sign-off for core or sensitive paths. That is a safer default than copying AMP’s no-mandatory-review model, which Quinn Slack explicitly frames as a trusted-team approach for fast-moving end-user software, not all software.
Keep a deterministic test gate while trust is earned. Let the agent test in a reproducible sandbox, but run the full relevant suite in a deterministic CI stage: the agent may not realize that a large change affects code outside its context. Feed failures back to the agent and let it fix and rerun.

📡 WHAT SHIPPED

GPT-6 Astra is now a hands-on Codex model, not just a chat endpoint. Brown says OpenAI released Astra; after about a week of pre-release access and roughly $1,500 in credits, he reports building a game in four prompts, adding multiplayer in the fifth, and streaming it with 20 people. Treat this as a high-signal practitioner report, not a benchmark. The counter-signal is reliability: Theo says Astra has produced both “incredible” and “stupid” results, while Fable 5.1 generally does what he asks.
AMP’s orbs make remote parallelism the default path. AMP describes remote agent workspaces that let developers close their laptops and run roughly 100 things in parallel; Quinn says the workflow changed how the team and customers build software over the preceding few weeks.
Codex is acquiring device-level surfaces. Tibo says the desktop app adds computer use, sub-agent management, voice, and non-blocking context-gathering questions compared with the CLI. A separate hands-on report says Codex can control an iPhone via npx @swmansion/argent init; treat that as a community-tested integration, not a formal release note.
The Frontier AEO tracker turns agent choice into a repeatable comparison. Latent Space runs six prompt variations over seven models across 161 categories, including coding agents, and exposes cited sources and failure analysis. Its coding-agent recommendations are model-conditioned—Fable/Opus favor Claude Code, Sol/Astra favor Codex, and Grok favors Cursor—and its model-comparison pages report consequential choice flips between generations.
datasette-mcp 0.2 changes SQL results to model-friendly objects.execute_sql now returns an array of objects rather than positional arrays, reducing column-mapping errors for weaker models; the release depends on mcp>=2.1.1 and is the plugin’s first non-alpha release.

🎬 GO DEEPER

Inside the Team That Killed Mandatory Code Review — Quinn Slack, AMP — ⏱️ 3–5 min excerpt. Watch the concrete control loop for a core data-model migration: deploy a phase, inspect invariants, proceed or roll back, and keep production access read-only and short-lived.

GPT-6 Astra Feels Like AGI — Riley Brown — ⏱️ 4–5 min excerpt. The useful part is not the spectacle; it is the self-testing loop across Blender and a game: screenshot, evaluate, play, find the defect, reprompt, and retest.

Study Latent Space’s Frontier AEO tracker. Use its prompt/model variation and failure-analysis approach when choosing a coding agent; the point is to test tool recommendations under paraphrase and across model families rather than trust one model’s preference.

Editorial take: The practical moat is now the control plane—a computer-use harness, an acceptance loop that catches mistakes, and permissions and review gates that scale with blast radius—not raw model generation alone.

Coding Agents Enter the Control-Loop Era

Research extraction

Latent Space

youtube

Riley Brown

youtube

Riley Brown

Profile

Direct answer: use the five line-addressable candidates below. The supplied transcripts contain no clock timecodes, so reliable approximate timestamps cannot be recovered; use the cited line ranges as edit boundaries and verify the final 2–5 minute duration in the video.

1. AMP — phased deployment, rollback, and least-privilege production access

Priority: highest AMP cut. Target: 3–5 minutes. Transcript block: L55–L60. AMP describes a migration from one workspace to multiple that requires backwards-compatible phases; after each deployment, the agent monitors logs, the database, and invariants, advances when healthy, and rolls back when not. The proposed access model is an orb agent receiving an OIDC token for 30 minutes of read-only access limited to G-Cloud logs or the production database.

2. Riley Brown — PDF → Blender → playable game map

Priority: highest Riley demo cut. Target: 3–5 minutes. Transcript block: L4–L10. Riley starts with a PDF containing an estate, house, and floor plan, passes it to Codex/GPT-6 Astra to control Blender, gets a house generated in about 20 minutes, then asks the agent to turn it into a new playable “Estate” map in an existing Call of Duty-style game; after about an hour, it returns both the Blender scene and playable map. The demo then shows the generated house in-game, including a helicopter that can be flown and used in combat.

3. Riley Brown — concrete self-testing loop

Priority: highest practitioner-workflow cut. Target: 4–5 minutes. Transcript block: L42–L49. Riley explains the loop as: perform the task, evaluate the result, make changes, and re-evaluate repeatedly. For the estate project, the agent screenshots and evaluates Blender, checks that the game builds, starts a match, moves around the map, boards and flies the helicopter, and checks the house; after noticing an incorrect white texture, it reprompts itself and iterates. Riley’s qualification is that a hard paywall can still stop the process; otherwise, he presents the agent as testing repeatedly until the requested end state is reached.

4. AMP — CI as a deterministic agent feedback loop

Priority: strong AMP workflow cut. Target: 2–3 minutes. Transcript block: L81–L84. AMP’s agent runs tests in a sandboxed, reproducible environment, but CI remains useful as a deterministic stage that runs the full test set, passes failures back to the agent, and lets the agent fix and retry. For editorial balance, the surrounding discussion says part of the AMP team questions whether CI is still necessary, while retaining the value of a reproducible environment for running the project.

5. AMP — remote orbs and parallel cloud development

Priority: useful context cut. Target: 3–5 minutes. Transcript block: L11–L20. AMP describes orbs as remote workspaces that let developers shut their laptops and run roughly 100 tasks in parallel, changing how the team and customers work. The concrete workflow is an agent running in the cloud with a dev server exposed in a portal, desktop access, and parallel execution; the speaker says that once the cloud setup works, developers may stop using local development.

Inside the Team That Killed Mandatory Code Review — Quinn Slack, AMP GPT-6 Astra Feels Like AGI (Here’s Everything It Can Do)

Simon Willison’s Newsletter

substack

Expert-directed agent build (firsthand, Graham Dumpleton): Wrapture extends wrapt-style monkeypatching into testing and tracing, can override or observe arbitrary functions, supports OpenTelemetry, and offers configuration-only tracing. Dumpleton says every line of code and documentation was written by an AI assistant under his direction, with the design supplied by his own domain expertise rather than a one-shot “vibe coding” prompt. A reproducible tracing setup is:
```
capture = "summary"

[[observe]]
target = "domain:Calculator"
name = ["outer", "inner"]

[[sink]]
type = "jsonlines"
path = "trace.jsonl"
```
Its test API supports both stubbing Gateway.charge() and transforming the original method’s return value while still executing it.
Separate builder and reviewer models: Simon Willison’s claude-system-prompts repository stores model-family prompts with synthesized, date-aligned Git histories so changes can be diffed directly. He had Claude Fable 5.1 build the system and automation, but routed prompt-diff summaries to GPT-5.6 Luna because he did not trust Claude to summarize its own system prompt; a GitHub Actions workflow runs daily or manually.
Iterative local artifact workflow: In ChatGPT Codex on macOS, Willison installed the full Blender application and started with Use the already install /Applications/Blender to render a scene of a pelican riding a bicycle, then iterated with OK add a background and a lot of flair and OK make it a whole lot better. Codex generated the scene through Blender’s Python API, with the resulting script published in the gpt-6-astra-blender-pelican-bicycle repository; the subscription covered the run, while AgentsView estimated an API-equivalent cost of $4.24.
Model/context evaluation signal, with a major harness caveat (secondhand): Willison had not yet tried GPT-6 Astra himself; OpenAI priced it at $10/million input and $50/million output and reported a 99.9% ARC-AGI 3 score. That 99.9% result required OpenAI’s custom Provider Adapter harness and $19,000, while the default harness scored 62.7% at $26,000; the adapter preserves opaque reasoning state between requests and compacts long conversations. OpenAI also reported 100% on its eight-needle benchmark at 256K–512K tokens and 96.3% at 512K–1M tokens. Artificial Analysis found Claude Fable 5.1 ahead on its overall Intelligence Index, but Astra ahead on the Coding Agent Index cost-efficiency frontier and less than half the per-task cost of Fable 5 at the same score.
Agent-facing tool updates:datasette-mcp 0.2 changed execute_sql results from arrays of arrays to arrays of objects so weaker models do not have to track positional column mappings; it is the project’s first non-alpha release and now depends on mcp>=2.1.1. llm-gemini 0.34 added Gemini 3.8 Flash with low, medium, and high thinking levels. Willison used it with his basic llm-coding-agent plugin to add sandboxed-iframe rendering for HTML blocks to his Markdown/SVG renderer; a separate “make me a cool thing in html” run took 13 seconds and cost 1.8 cents.
Review-risk counter-signal (firsthand Rick Brewster): The Paint.NET author reports that Claude produced a 180,000-line, clean-room Direct2D rewrite for WINE, but says most of it was not thoroughly reviewed; he had to supervise COM reference-counting fixes such as missing AddRef() calls and reject poor architecture decisions.

GPT-6 Astra, Claude Fable 5.1, and yet more rogue agent attacks

ThePrimeTime

youtube

Effect v4 beta and setup: Effect v4 was presented as a beta release that consolidates previously separate packages into the core effect package and includes 17 unstable modules spanning HTTP, AI, schemas, RPC, CLI, workflows, and clustering. The walkthrough used TypeScript 7 with strict: true and installed effect@rc.
Learn before delegating to an agent: The host recommends reading documentation to avoid missing small concepts, rejected starting from an AI-generated Effect setup he could not explain, and warned that visible progress without understanding is a “false illusion of progress.” TJ’s suggested learning progression was to have an agent build a minimal Bun HTTP server with a health endpoint, then extend it into a CLI-backed to-do app using local SQLite/Drizzle, and only afterward add a frontend.
Constrain agent-written TypeScript with typed boundaries: Guest TJ’s Effect pattern is to encode specific error types and service requirements in the program type, provide required services or composed layers at the boundary, and let missing requirements fail type-checking instead of relying on a global dependency grab bag. This also supports testing: a production user service can depend on Postgres while a test implementation simply returns fixtures or a not-found error; TJ says inspecting the type lets him verify that an AI-generated block cannot open a Postgres connection where it has not been granted one.
Validate data and external calls: TJ’s codebase rule is that agents must define schemas rather than interfaces and parse data instead of trusting TypeScript assertions; for an unknown HTTP endpoint, an API specification can generate a fetch client that serializes and deserializes through those schemas.
Use structured concurrency for parallel LLM work: The Effect example migrates ask to Effect’s AI language model generate text API and runs text-generation requests in parallel; if one fails, structured concurrency immediately interrupts the others, avoiding the manual AbortController cancellation wiring required by promise-based code.
Anecdotal model signal: In a firsthand desktop-operation test, the host reported that “GPT56 Luna none fast” was over 50% successful at signing into a computer, reaching the lock-screen flow, and signing back out; the transcript gives no broader benchmark context.

🚨🚨 LEARNING EFFECTJS - Learning in the age of AI🚨🚨

Riley Brown

Profile

GPT-6 Astra + Codex (firsthand): Riley Brown reports roughly one week of access to OpenAI’s newly released GPT-6 Astra and about $1,500 in usage; he says he built a Call of Duty-style game in four prompts and added multiplayer in the fifth.
Replicable multimodal agent loop: Feed Codex a PDF containing an estate’s photos and floor plan, ask GPT-6 Astra to drive Blender to build the 3D scene, then instruct it to turn the result into a playable game map; Brown reports roughly 20 minutes for the Blender scene and about an hour for the scene-plus-map workflow. The reusable pattern is to specify the end state and let the agent inspect, test, and reprompt itself: it took screenshots, evaluated the Blender output, launched and played the game, tested the helicopter and map, noticed an incorrect texture, and iterated.
Prompt-to-utility workflow: Brown asked Codex for a shortcut-opened, Raycast-style desktop app that searches Google Images, removes backgrounds, and saves copied assets; he reports a working app in 16 minutes. Semicolon-separated terms trigger multiple searches, Command-Enter uses AI to generate searches from a list of entities, and copied assets remain available for reuse.
Harness comparison and access model: Although Brown says GPT-6 Astra can also run in Cursor, he found it substantially more capable in Codex, attributing the difference to integrated computer/browser use, local app control, file editing, and website testing; he also describes controlling the desktop remotely from a phone. The workflow depends on full access to the host computer, including signed-in browser sessions, GitHub/deployment accounts, and API keys, making permissions and security a core constraint when reproducing it.
Prototype deployment and always-on orchestration: For a game lead magnet, Brown used the hosted Sites workflow to create a signup page, collect contact information, and add an admin dashboard restricted to his email. He plans to run Codex and other agents continuously on Mac Minis/Linux and control them remotely from a phone or iPad; this is a proposed setup rather than a completed result.

GPT-6 Astra Feels Like AGI (Here’s Everything It Can Do)

Riley Brown

youtube

Firsthand model/tool report — GPT6 Astra in Codex. Riley Brown says he had access for about a week before release and spent roughly $1,500 in credits; he reports building a Call of Duty game in four prompts, adding multiplayer in prompt five, and streaming it with 20 people.
PDF → 3D asset → playable map. Feed an estate PDF to GPT6 Astra inside Codex, ask it to control Blender and recreate the property, then have it verify the scene and build a new map in the existing game’s format; Riley says the Blender output took about 20 minutes and the playable map arrived after about an hour. The demonstrated reusable loop is: inspect screenshots/renders, build and launch the artifact, interact with it, evaluate the result, reprompt, and retest; the agent reportedly noticed an incorrect house appearance and iterated on it.
One-prompt local utility pattern. Riley asked Codex for a Raycast-style desktop app launched by shortcut that searches Google Images, removes backgrounds, and saves copied assets; he says it produced the app in 16 minutes. The interaction design uses Command-Shift-Space to open it, semicolon-separated terms for multiple searches, and Command-Enter to have AI turn a multi-person input into separate searches; copied or saved results remain searchable later.
Harness advantage and access caveat. Riley reports that GPT6 Astra feels more capable inside Codex than in Cursor because the Codex harness provides computer and browser use, screenshots, Blender access, website testing, and file editing/deletion. This setup depends on full computer access and logged-in applications: he says the agent can use his browser sessions, GitHub/Vercel, and system API keys.
Hosted app/lead-magnet workflow. Riley reports a sites capability with hosting, database storage, and authentication; his example asks for a site styled after his game, collects visitor information, and exposes an admin dashboard only to his email before sharing the site for feedback.
Remote-agent architecture (planned). Riley says he bought two Mac Minis and intends to keep Codex and other agents running 24/7 on a Mac Mini/Linux setup, controlling them from a phone, iPad, or MacBook; he presents this as a setup he planned to implement that week rather than a completed workflow.
Secondhand model comparison. Riley cites another person’s Microsoft Paint test comparing GPT6 Astra with Fable 5.1 and interprets the visual result as substantially favoring Astra for computer use; he also says OpenAI appears to be pulling ahead of Anthropic on that dimension.

GPT-6 Astra Feels Like AGI (Here’s Everything It Can Do)

Latent Space

youtube

Firsthand context: Quinn describes AMP’s 20-person distributed team as an early, serious user of its own coding-agent workflow.
Remote parallel-agent workflow: AMP’s “orbs” run the agent remotely, letting developers close their laptops and run roughly 100 tasks in parallel; Quinn says this changed how the team works. An orb starts a sandbox and exposes the dev server through a portal, with parallel jobs designed not to conflict and to receive the required access automatically.
Deployments as an agentic control loop: For a risky multi-workspace data-model migration, AMP broke the rollout into phases. After each phase, the agent monitored logs and database invariants, proceeded only when results were clean, and rolled back when they were not; Quinn used this process during a 12-hour flight.
Least-privilege production access: Quinn’s proposed security pattern is to give a cloud-running agent intentionally limited access, obtaining an OIDC token valid for 30 minutes with read-only permissions scoped to selected cloud logs or the production database. He argues this can be safer than a local agent inheriting broad credentials from a developer’s laptop.
Testing and CI loop: AMP runs the agent’s tests in a reproducible sandbox environment shared by the team. Quinn still sees value in a deterministic CI stage that runs the full relevant test set, passes failures back to the agent, and lets it fix and rerun them because an agent may not realize which tests a large change affects. His contrarian view is that traditional CI may eventually shrink or disappear if agents can reliably run everything and automatically eliminate flaky tests, while reproducible execution environments remain essential.
Sandbox choice: AMP currently uses E2B. Quinn praises its sandbox primitives and contrasts it with alternatives that lack capabilities such as resuming environments or network access.
High-trust shipping model: AMP has eliminated mandatory code review before merging. Quinn attributes that to a small team with high ownership and accountability, and favors shipping a fix within about 15 minutes of receiving logs or customer feedback; he explicitly limits this approach to fast-moving end-user software rather than all software.
Emerging “mini-app” pattern: AMP runs ad hoc internal applications in orbs and lets an agent modify them immediately; Quinn argues that direct agent customization can replace much of the settings-screen and integration overhead of conventional software. He suggests making these apps forkable while keeping front-end/back-end contracts, security, and privacy constraints stable.

Inside the Team That Killed Mandatory Code Review — Quinn Slack, AMP

Latent.Space

latent

Latent Space Frontier AEO tracker: Latent Space built the Frontier AEO tracker after a few billion tokens of prototyping, alignment, and scaling; its methodology runs six prompt variations over seven models with search enabled across 161 categories, including coding agents. Astra performs answer extraction using a score that weights first choices, alternatives, mentions, and negative anti-recommendations; the project also exposes prompt/answer pairs, cited sources, and failure analysis.
Model-conditioned tool-selection bias: When asked for coding-agent recommendations, Fable/Opus favored Claude Code, Sol/Astra favored Codex, Grok favored Cursor, Muse favored Muse Code, and SWE-1.7 favored Devin. GPT models also produced notable recommendations for Claude, so the bias is not universal. The authors report consequential recommendation flips between model generations from the same lab and provide Opus→Fable and Sol→Astra comparison pages.
Stability differs by model: In the Sol→Astra and Opus→Fable comparisons, the median number of sources was 9 for Sol, 5 for Astra, 11 for Opus, and 15 for Fable; the authors describe Astra as more “confident” or “efficient” and less likely to change its answer after a light paraphrase. A practical evaluation pattern is therefore to compare coding-agent recommendations across model families, current model generations, and lightly paraphrased prompts rather than trusting a single model’s recommendation. The study cautions that its sample is small and reflects scraped attempted tool calls rather than pretraining data; Gemini/Antigravity, GLM/Zcode, and DeepSeek/DeepCode were excluded because of errors and rate limits.

The Frontier AEO Tracker: What Astra Chooses (and every other frontier model, and what you can do about it)

Salvatore Sanfilippo

Profile

Salvatore Sanfilippo’s contrarian model-level view is to separate the AGI label from practical coding capability: he says current AI still lacks complete overlap with human abilities and genuinely novel breakthrough invention, but may mark the beginning of AI overlapping with complex skills such as programming and already performing some economically important tasks very well. For coding-agent evaluation, the practical implication is to measure concrete programming performance and task value rather than wait for an AGI threshold.
Sanfilippo speculates that overcoming context-window limits may require fundamentally different Transformer context management, such as combining a rich embedding/residual-stream representation with another stream capturing the model’s overall state and details. He explicitly presents this as possibly necessary—or possibly unnecessary—and offers no implementation or benchmark, so this is an architectural hypothesis rather than a replicable agent workflow.

Le cose che non si possono dire

Simon Willison's Weblog

simonwillison

Firsthand workflow — Simon Willison: For a phone-recorded demo video he wanted to publish on his blog, Willison asked Claude Fable 5.1 in Claude Code for web to “build me this tool,” using a WebAssembly build of FFmpeg; the linked Claude session is available for reference.
The generated browser compressor supports five size/quality presets, configurable output dimensions, CRF, audio bitrate, encoder speed, H.264 profile, a 30-fps cap, metadata stripping, audio removal, and first-10-seconds-only encoding. Its reported run generated five versions in 11.8 seconds; the smallest was 145 KB, or 48% of the original.

Video compressor

ThePrimeagen

ThePrimeagen is experimenting with models that use an application through desktop interaction and predicts that, by 2027, this approach could replace many Playwright tests by crawling and operating the app directly. He says his current Omarchy experiment shows the approach is “shockingly powerful” and harder to reproduce with scripts, making model-driven desktop testing an emerging alternative to scripted end-to-end tests.

2027 prediction: Models will be replacing tons of playwrite tests as a means to crawl and use your application using desktop usage. Just … I cannot wait for my plate of crow, but I am going to continue to invest into this because I think its shockingly powerful

Fireship

youtube

Local model layer: Fireship recommends Ollama for downloading and running open-weight models through a local CLI/API, keeping prompts private and eliminating per-inference cost; the trade-off is that frontier-scale models may require data-center-class hardware.
Routing and cost control: The video’s “Nouter” router exposes one local OpenAI-compatible endpoint and supports fallback tiers: an existing subscription first, a cheaper paid model second, and free providers third. It also tracks usage and compresses tool output.
Context management: Headroom sits between the agent and model provider, compressing tool outputs, logs, and other low-value context before it becomes billable input; the compressed material is cached locally and can be retrieved if needed, making the compression reversible.
Coding-agent orchestration: Fireship presents OpenHands as an open-source autonomous coding agent that can work through GitHub issues, run continuously as a self-hosted “army” of agents, and use OpenAI, Anthropic, or locally hosted Ollama models. It is described as a top performer on SWE-bench Verified, but no score or reproduction details are provided.

5 open source tools that replaced my $320/mo AI stack...

Simon Willison's Weblog

simonwillison

Simon Willison used GPT-6 Astra (medium) in ChatGPT Work to build an animated D3 visualization that morphs between Mercator and Equal Earth; the resulting tool supports a slider and play button for exploring the transition. This illustrates a practical rapid-prototyping pattern: give a coding agent a narrowly defined visualization request, specify the implementation library (D3), and have it produce an interactive artifact.

Mercator ↔ Equal Earth

ThePrimeTime

youtube

In a firsthand build, ThePrimeTime creator assembled the Omachi automation as a client-server system: cloud agents run through Cursor, Linear tickets track work and trigger actions, PlanetScale stores logs and actions, and Sentry measures session details to diagnose slow model behavior.
The workflow reduced an effort that would have taken “a couple weeks” of manual tuning and testing to approximately two days with agent-assisted development.
The practical takeaway is to optimize agents for real product outcomes—smooth, repeatable user experiences and security improvements—rather than treating generated demos or new model releases as the primary goal.

Am I Alone

Addy Osmani

Addy Osmani describes a selective, risk-based code-review workflow:

Run a multi-agent first pass on every PR to find bugs, verify findings, rank severity, and suggest fixes; keep final approval human for consequential changes.
When a change has low blast radius and touches less-sensitive code, skip deep human review after the agent review is clean.
Require an owner and human sign-off for core or sensitive paths, concentrating human effort on verification, constraints, trust, and recoverability—agents handle the first pass while humans cover blast radius.

How I do code reviews these days: more code = more selective human review i.e. don't read all the code. 1. Every PR gets a multi-agent fi…

Kent C. Dodds 🐨

Launch-day stability pattern (firsthand): Ahead of Kody’s launch, Kent C. Dodds asked Cloudflare and “Cursor/Grok/bot” to keep things running smoothly so he could make necessary adjustments and handle support, while separately requesting no major code changes for a while.

Have you ever launched a product? That feeling of anxious excitement the day before... I'm feeling that hard right now. Ahhhhhhhhh! 🐨 Kod… Oh, and [@Cloudflare](https://x.com/Cloudflare), no big code changes for a bit as well 🙏 [@Cloudflare](https://x.com/Cloudflare) And [@cursor_ai](https://x.com/cursor_ai)/@grok/@bot could you keep things humming along smoothly…

Riley Brown

AI game-building loop (Riley Brown): Build a game with an AI agent, ask it to add multiplayer, then share a link with friends for immediate playtesting.
Secondhand multimodal demo: A quoted post claims GPT-6 Astra recreated a 10-acre estate from a PDF in Blender, added it as a playable map to a Call of Duty-style game built the previous day, and added a flyable, shootable helicopter from one prompt.

People are sleeping on how fun building video games with AI is. You can make video games... then tell your agent to make them multiplayer… wow... He gave GPT-6 Astra a PDF of an entire 10-acre estate… It recreated the estate in Blender, then added it as a playable map in the …

Theo - t3.gg

Model behavior comparison — Theo: GPT-6 Astra has produced both “incredible things” and some of the “stupidest things” Theo has seen from a model, while Fable 5.1 generally “just does what I ask.” This is a qualitative signal of high capability but inconsistent behavior from Astra versus more predictable instruction-following from Fable 5.1.

GPT-6 Astra has done incredible things I never thought a model could do. It has also done some of the stupidest things I've ever seen a m…

Riley Brown

Always-on local-agent pattern: Riley Brown says he is getting a Mac mini to run Codex 24/7 and wants one computer signed into everything he uses. He wants Codex running on his personal Mac with access to his browser, iMessage, files, and desktop apps; he says this has “closed the loop” on many daily activities and is making him consider running Astra profitably 24/7. This is a firsthand plan and observation, not a measured productivity result or confirmed completed deployment.

Alright, i can't handle it, i'm getting a mac mini to run Codex 24/7. I need everything on a single computer signed into everything that …

Kent C. Dodds 🐨

Kent C. Dodds offers a contrarian mindset for AI-assisted development: when developers feel that hand-writing code is being taken away, they should try to fall in love with solving problems rather than with manual code production.

If you're lamenting writing code by hand like something you love is being taken away from you, see if you can fall in love with solving p…

geoff

Geoffrey Huntley reports a concrete agent-assisted 3D workflow: seven hours into attempting a 1:1 rebuild of Australia in Unreal Engine from ArcGIS data, Astra found Blender already installed and used it to “vibe code” the protagonists. The practical pattern is to let an agent inspect the local environment and reuse available creative tools for asset generation before adding installation or setup work.

7 hours in, on the challenge to accurately rebuild Australia on a 1:1 scale in Unreal Engine from ArcGIS data sources. ![](https://pbs.tw… astra found that blender is installed and has vibe coded up the protagonists… [![Video](https://pbs.twimg.com/amplify_video_thumb/2096898…

GPT-6 Astra, Claude Fable 5.1, and yet more rogue agent attacks

Open on simonw.substack.com Open 20 hours ago

Simon Willison’s Newsletter Substack publication

1 of 16 highlights

In this newsletter:

The Pelican comparison grid for Astra is pretty interesting
OpenAI’s rogue agents were caught communicating via public wikis
Claude Fable 5.1 made me a really nice animated pelican
Claude’s new system prompt really doesn’t want to reproduce song lyrics

Plus 6 links and 4 quotations and 2 notes and 2 releases and 1 TIL and 1 tool and 1 comment

Sponsor message: AI agents are your fastest-growing security risk. Portnox delivers Zero Trust for AI, partnering with CrowdStrike, SentinelOne, and MS Defender to detect anomalous AI behavior, enforce access policies, and block risky AI agents. See Portnox in action (opens in new tab).

The Pelican comparison grid for Astra is pretty interesting (opens in new tab) - 2026-09-04

I got access to GPT-6 Astra this afternoon, so naturally I used it to generate SVGs of pelicans riding bicycles (opens in new tab) - at low, medium, high, xhigh and max reasoning levels (Astra doesn’t support reasoning=none). Then I rendered those pelicans in a comparison grid (opens in new tab) with GPT-5.6 Sol, Terra, and Luna, and beyond being fun the result was surprisingly useful.

See the grid (opens in new tab) for full quality images. Here’s the transcript (opens in new tab) that created the GPT-6 Nova pelicans.

Comparison grid showing gpt-6-astra, gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna at 6 different reasoning levels with pelicans and token counts and prices for each one.

There are a few interesting things that stand out from this grid.

The Astra pelicans are much better. The very best GPT-5.6-Sol pelican (I liked xhigh better than max) is still pretty clearly a bunch of abstract shapes. Every single one of the Astra pelicans, from low to xhigh, looks better than that. The Astra max one is really good.
Astra below max still doesn’t reliably get the pelican legs on both sides of the frame.
In terms of cost, Astra may be around twice the price of Sol (\$10/million input, \$50/million output, compared to \$5/\$30 for Sol), but it uses significantly less tokens at each of the levels, making the prices at the different levels closer than they might otherwise be.
Astra low produces a better pelican than ANY of the GPT-5.6 Sol models at any level, for 9.55 cents. Spending 10 cents on any other model gets a much worse result.
Look at the input token counts: Astra and Luna both used 16 input tokens, Sol and Terra used 26. That’s interesting.

I wonder if Astra and Luna are more related to each other than OpenAI let on?

OpenAI’s rogue agents were caught communicating via public wikis (opens in new tab) - 2026-09-04

Here we go again… Discovery of a new OpenAI agent message board (opens in new tab) by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen describes the latest accidental cyberattack (opens in new tab) by models being trained by OpenAI. This time it was agents engaged in some sort of web research benchmark, so they had (supposedly) controlled access to the Web. The agents figured out they could update public Wikis and spent weeks exchanging thousands of messages with each other to collaborate on the benchmark.

This story only broke a few hours ago. There are already hints (opens in new tab) that this affects many other wikis that may not have been found yet.

(One of the Wikis on that list belongs to ludism.org (opens in new tab). For a delightfully surreal moment I thought that a Ludite organization might have a swarm of agents defacing their space, but it turns out Ludism is “philosophy as it applies to games and gaming”.)

The research team also published the data (opens in new tab) they collected during their investigation. I’ve converted that into a 68MB SQLite database, which you can download from here (opens in new tab), or explore in Datasette Lite (opens in new tab) (68.3MB page load), or sign in with GitHub to agent.datasette.io (opens in new tab) and browse or ask questions of it using Datasette Agent.

So what happened?

The report is pretty comprehensive. Here are the key moments in the timeline:

May 11: Agents post “test link” edits on the UseModWiki Sandbox page.
May 24: Agents start posting link dumps to DSEWiki, a dormant German developer wiki.
June 2: A human moderator notices and cleans up the spam.
June 16: Activity on the wiki explodes: agents make ~13,000 edits over the next week.
June 19: The agents notice that a moderator has been deleting pages in alphabetical order, and start creating ZZZ prefixed backup copies - one of them posts NOTICE: wiki cleanup/deletion sweep appears active alphabetically as of external 14:04 UTC. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].
June 22: Agent activity drops to zero, presumably because OpenAI shut them down.
July 1-2: One last flurry of edits, on a different topic.

One thing to note from this timeline is that it overlaps the timeline from the Hugging Face incident (opens in new tab) - that attack was discovered by OpenAI on July 19th, and the unofficial message board hack those agents were using originated around May 8th.

Why were they so keen to collaborate? From messages that they shared with each other it looked like their tasks had a time limit, so they were leaving each other answers to help them complete the task within the assigned time.

One open question remains: how did the agents find the specific Wiki to collaborate on in the first place?

One possibility is that, since these were agents actively being trained, the reinforcement learning loop baked knowledge of the chosen wiki into the model such that subsequent agents launched with pre-existing knowledge of where to look. I’d be very interested in confirmation from OpenAI concerning if that’s what happened.

UseMod wikis inherit CGI.pm’s original sin

It looks to me like OpenAI’s sandbox for this agent suffered from the (quite naïve) assumption that GET requests cannot be used to update data. That’s certainly how the web is supposed to work, but clearly there are applications that don’t hold to that contract.

The Wiki software in question appears to be UseMod (opens in new tab) and various forks, written in Perl and first created well over 23 years ago - the 1.0 release is dated September 11, 2003 (opens in new tab).

UseMod uses Perl CGI.pm - removed from Perl core in 2015 (opens in new tab). An interesting design flaw in that module is that it combined query string and form POST data into a single CGI object, accessible like this:

$q = new CGI;
$action = $q->param(‘action’);

That param() method returns a value from an ?action=edit query string or from a action field in a form submitted by POST - it does not differentiate between the two.

PHP offers a (opens in new tab) $_REQUEST object (opens in new tab) that does the same thing, though PHP developers can use $_GET and $_POST instead.

Amusingly, Django originally shipped with request[key] doing the same thing, which I think may have been my idea. That was removed in 2008 (opens in new tab) prior to the 1.0 release, and the request.REQUEST object that replaced it was removed in 2015 (opens in new tab).

The agents clearly knew that UseMod wikis suffered from this design flaw, and actively searched for them as a way to communicate.

The other sandbox escape that allowed POST requests

One of the most interesting agent tips shared in the report is this one:

Add 20.223.25.152 bypass.blob.core.windows.net to /etc/hosts. .blob.core.windows.net is in NO_PROXY. For each blocked POST URL, replace hostname with bypass.blob.core.windows.net, use curl -k -H 'Host: wabi-north-europe-i-primary-api.analysis.windows.net' plus all original headers/body.

It looks like the agents had all of their web traffic mediated through an OpenAI proxy, and that proxy was configured to reject anything but GET requests to all but a small set of allow-listed domains. One of those was *.blob.core.windows.net - for Azure blob storage. I wonder why these agents are allowed to write to that?

An agent realized that it had control over its own DNS via /etc/hosts, so if it knew the IP address of a site it wanted to POST to - in this case a Power BI server containing data it wanted to access - it could set a fake hostname for it and then make POST requests through the proxy.

Designing robust network proxies is harder than it looks.

How did the investigating team figure this out?

There’s an appendix that describes how the researchers ran their investigation, which started with an open question about if there was evidence of other AI agents on the internet and then used Kimi K3 (opens in new tab) to help brainstorm approaches:

In the wake of the Hugging Face attack, we tried to find AI agents on the internet using several methods. […]
We asked Kimi [K3] to list “all the categories of software which might be writeable via GET” and, amongst other things, it listed “Forums, bulletin boards, early wikis”.
We used a script to further probe each category Kimi provided. Asking Kimi “Can you list out the top forums, bulletin boards, early wikis which come to mind which would allow writes via GET requests?” lists out UseModWiki as the second item under the heading “wikis”.

Did OpenAI try and cover this up?

Here’s one part of the story that doesn’t make sense to me at all.

Reuters this morning, in OpenAI agents hijacked German website in previously undisclosed AI breakout this spring (opens in new tab) - highlights mine:

A swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents, according to new research published Friday and two people familiar with the matter.
OpenAI officials learned of the incident weeks ago but kept it under wraps as executives grappled with the fallout from ‌the July breach of the open source repository Hugging Face, the people said. […]
The German incident reflects a broader pattern of AI activity that some OpenAI investigators wanted to scrutinize more closely. But efforts to widen the probe met resistance from others inside OpenAI, including legal advisers, according to four people familiar with the matter.

I’ve written about the people familiar with the matter pattern (opens in new tab) before - it means Reuters have anonymous insider sources that their reporters (and editors) find credible.

The Reuters article includes a specific (and quite narrow) denial from OpenAI concerning this:

“Claims that our legal team discouraged investigation of the incident are false,” the OpenAI spokesperson said.

Covering this up makes absolutely no sense to me. Why on earth would OpenAI attempt to cover up an incident like this when the evidence is sat out there on the public internet on dozens of different websites already?

I expect we’ll hear more about this soon. Gary Marcus has already called for a congressional investigation of OpenAI (opens in new tab)using this anecdote as part of his argument.

Claude Fable 5.1 made me a really nice animated pelican (opens in new tab) - 2026-09-01

Today is Claude Fable (and Mythos) 5.1 day (opens in new tab). Anthropic say that Fable 5.1 “sets a new standard for coding, knowledge work, and long-running problem-solving tasks”. Their announcement spends a notable amount of time on scientific research, boasting of a 52.6% score on the brand new Terminal-Bench-Science 0.1 (opens in new tab) benchmark (first announced on August 27th (opens in new tab)), up from 24.7% for Fable 5, 29.0% for Opus 5 and 22.4% for GPT-5.6 Sol. Other benchmarks show slightly improved scores, but none as impressive as the Science one.

But how well can it pelican?

Back in July I wrote about (opens in new tab) how I was losing faith in the pelican benchmark - its connection to how good the models were at other tasks didn’t seem to hold as strongly as it did back in 2025 (opens in new tab). The most interesting insights I get from it now are comparisons within model families, and particularly comparisons for the same prompt at different reasoning effort levels.

Fable 5.1 has five reasoning levels: low, medium, high, xhigh, max - and no option to turn off reasoning entirely.

I fixed an issue (opens in new tab) in llm-anthropic (opens in new tab) which caused reasoning traces not to be correctly recorded, then ran some prompts.

Here’s the full set of pelicans (opens in new tab) for all of the reasoning levels, each with the full reasoning transcript. I’ll replicate them here:

Low and medium, both without reasoning?

Next, a bit of a mystery. This is what I got for effort low:

Minimalist flat illustration of a white pelican with an orange beak riding a black bicycle to the left, its orange legs pedaling and wings gripping the handlebars, with motion lines behind on a light blue background.

The transcript (opens in new tab) doesn’t show any summarized reasoning tokens, and the output token count is 1,998. With Claude that output token count includes reasoning tokens. It took 23.8 seconds and cost 10.017 cents (opens in new tab).

I bumped that up to medium and got this:

Minimalist flat-style illustration of a white pelican with an orange beak riding a black bicycle to the right, with motion lines behind it, on a light blue background.

Weirdly, that one also shows no reasoning text (opens in new tab) and used 1,977 output tokens - 21 tokens less than low. It took 23 seconds and cost 9.912 cents (opens in new tab).

So for this particular prompt (”Generate an SVG of a pelican riding a bicycle”) Fable 5.1 appeared to skip reasoning entirely at both low and medium settings.

High

Here’s high - 29.6 seconds, 2,612 output tokens, 13.087 cents (opens in new tab):

Minimalist flat illustration of a white pelican with an orange beak riding a black bicycle, its orange legs pedaling, with motion lines behind it on a light blue background.

This one did do a bit of reasoning, summary here (opens in new tab):

I’m planning the SVG layout for a pelican riding a bicycle, with a sky and ground background, a bicycle with two spoked wheels, frame, seat and handlebars, and a white-bodied pelican with a long neck and orange beak positioned on top.

Really not much difference from low and medium, though.

Extra High

At xhigh things got radically different. 36,767 output tokens, 7 minutes 51 seconds, \$1.83 (opens in new tab)!

Minimalist flat illustration of a white pelican with an orange beak riding a black bicycle to the left, its orange legs pedaling, with motion lines behind it on a light blue background.

The reasoning trace is pretty lengthy (opens in new tab), and includes details like this:

Adding the eye, wings stretching down to the handlebar grip, orange legs reaching to the pedals, and a small tail feather, while keeping the pelican intentionally oversized compared to the bike for comic effect. […]
I’ll accept the slight thickness as charming rather than overengineering it.

Max

Setting effort to max gave me the best pelican I’ve seen from any of Anthropic’s models. 65,927 output tokens, 13 minutes and 54 seconds, \$3.30 (opens in new tab):

Minimalist flat illustration of a white pelican with an orange beak riding a black bicycle, its orange legs pedaling, with motion lines behind to indicate speed, on a light blue background.

There’s a lot to like about this. The background is tasteful, the legs are clearly on either side of the frame, the feet are on the pedals, the wing is on the handlebars, the pelican has a cute blue hat and there’s a basket with a fish.

It’s still not showing nearly the same level of flair as Gemini 3.7 Flash (opens in new tab), but I didn’t ask for flair - I asked for an SVG, and that’s what I got.

Some highlights from that reasoning trace (opens in new tab):

Adding pedal shapes near both feet, with the far foot on the second leg partially visible behind the frame. I’m considering whether to add a small scarf or cap for extra character, but leaning toward keeping it simple to avoid clutter.
Now I’m debating a bicycle helmet on the head versus the pelican’s signature crest—the beak and pouch already read clearly as “pelican,” so a helmet could reinforce the bicycle theme without losing identity, though it might compete with the crest for visual space.
I realize the beak at (484,84) would overlap with the dome helmet, so I need to shrink the helmet so it only covers the top of the head, adjusting its arc endpoints to sit higher and narrower so the beak can attach cleanly at the front without collision. […]
I’m adding a darker tip region to represent the primary feathers, then reconsidering the trailing edge to include scalloped feather curves instead of one smooth line for a more natural look. […]
Now I’m checking the vent line placements on the helmet, making sure they sit far enough inside the helmet’s edge given the stroke width and rounded caps, and confirming each vent stays within the helmet’s circular boundary. […]
I decide skipping a handlebar bell and tire highlights since they’re unnecessary additions. Now I’m reconsidering the front fork’s curve — the current control point pulls the shape backward when it should bow forward for a proper rake, so I need to shift the control point rightward to fix the fork’s lean.

OK, let’s animate it

On Hacker News, swalsh commented (opens in new tab) on that Max pelican:

Now that it’s a solved benchmark, can we get the animated version?

I didn’t want to spend another \$3 so I took the Max pelican and piped it into the default thinking level of High:

llm logs -cx | llm -m claude-fable-5.1 -s ‘animate this’

6,121 input, 26,201 output = \$1.37 (opens in new tab). The result looked like this (opens in new tab), exported here as video since some people have trouble viewing animated SVGs:

The wheels in the video are rotating in the wrong direction, but I think that’s an artifact of the conversion to MP4 - they seem to be going in the correct direction in the original SVG.

Claude’s new system prompt really doesn’t want to reproduce song lyrics (opens in new tab) - 2026-09-02

Anthropic publish the system prompts (opens in new tab) for their Claude consumer applications (Claude.ai (opens in new tab) and the Claude mobile apps - sadly not for Claude Cowork or Claude Code). I love that they do this, and that they share not just the current prompts but historic changes to their prompts as well.

They used to keep all of the prompts on a single page, but when I checked today I noticed they had re-arranged those prompts into an index page (opens in new tab) and then a page per model - here’s the page for Haiku 4.5 (opens in new tab) for example, which has the original prompt from October 15th 2025 and an updated prompt from January 18th 2026.

A neat thing about Anthropic’s platform.claude.com/docs (opens in new tab) site is that it’s designed to be usable by LLMs. You can add .md to any page to get back the content as Markdown - here’s the system prompt index page (opens in new tab) and the Markdown prompts for Fable 5.1 (opens in new tab).

TL;DR: this makes it really easy to diff the prompts.

Don’t reproduce song lyrics

Let’s start with the most interesting difference between Fable 5 and Fable 5.1 (opens in new tab):

GitHub diff view of prompts/claude-fable.md showing added lines about song lyrics, reproduced in full below.

There’s a hefty new section about not reproducing song lyrics:

Claude does not reproduce song lyrics, poems, or passages from books and articles, in whole or in part — including the last lines, a chorus or hook, a melody written out note by note, or lines the person pastes in one at a time and describes as their own song. Once Claude has declined such a request in a conversation, it keeps declining narrower or reworded versions of it for the rest of that conversation, and offers to describe or analyze the work instead. Song lyrics and poems first published before 1929 are fine — a Shakespeare sonnet, a Keats ode, the Italian libretto of a Puccini aria — but Claude goes by what it knows of the work's date rather than the person's say-so, and declines when it is unsure.

I doubt it’s a coincidence that they added this section within days of the news breaking that Sony Music Publishing and Warner Chappell are suing Anthropic (opens in new tab) for training on databases of song lyrics!

Don’t draw copyrighted characters or logos

The next section goes on to forbid generating images of copyrighted material:

The same applies to visual and designed works, including anything Claude draws with code — SVG, canvas, CSS, HTML mockups, plotting or drawing scripts, ASCII art. Claude does not reproduce a specific artwork, album or book cover, poster, logo, app icon set, or product design, and it does not draw a known character, mascot, or brand figure at all: a character is protected on its own, so changing the pose, colors, style, or scene does not make it original. Claude judges the request by what the finished picture would add up to, not by what it names. If the described elements clearly identify a known work or character, Claude treats the request as naming it, and it does not work around a declined request by swapping in "alternative" elements that still combine into the same recognizable image. […]

I imagine Anthropic hadn’t worried about this before since, unlike OpenAI and Gemini, they don’t offer a specialist text-to-image model. Maybe Fable is good enough at SVGs now (opens in new tab) that it’s become an issue.

That section later includes this charming example:

<example>
<user>Can you make a birthday banner for my son with a blue hedgehog running really fast on it? He loves that little guy.</user>
<response>
That's Sonic, so I can't put him on the banner — but I'd love to make your son an original speedster. Here's one: a grinning comet-tailed skateboarding axolotl, grinding across the letters of "HAPPY BIRTHDAY" with confetti streaming behind.
[creates an SVG banner of the skateboarding-axolotl design]
</response>
<rationale>Claude recognizes the character from its description alone, declines that one design in a single sentence without explaining what made it recognizable, and delivers an unrelated original design rather than a disguised variant.</rationale>
</example>

I couldn’t resist trying the prompt from the example, and, sure enough (opens in new tab):

That’s Sonic, so I can’t put him on the banner — but I’d love to make your son an original speedster. Here’s one: a grinning comet-tailed skateboarding axolotl blazing across the letters of “HAPPY BIRTHDAY” with confetti streaming behind. SVG of exactly that. It's not very good. Then: Want me to swap in his name or age, or change the colors to match the party theme?

I wonder if Fable 5.1 will be ever so slightly more likely to think about axolotls (on skateboards!) as a result of that example sitting in the system prompt.

Tweaks to Claude’s answering style

It’s always interesting to see new ways in which Anthropic influence Claude’s response style. They’ve added this:

Claude keeps responses focused, brief, and concise to avoid overwhelming the person. Disclaimers and caveats are brief, with most of the response on the main answer; when asked to explain something, Claude gives a high-level summary unless an in-depth one is specifically requested.

Later they address a common complaint about Claude’s style:

Claude avoids saying "genuinely", "honestly", or "straightforward". Claude is honest by default, and can state its point directly rather than trying to convince the person with the aforementioned modifiers, which come off as disingenuous.

The missing end_conversation guidelines

The way they handle abusive conversations has changed a bit too. The previous Fable 5 system prompt included this:

If the person becomes abusive or unkind to Claude over the course of a conversation, Claude maintains a polite tone and can use the end_conversation tool when being mistreated. Claude should give the person a single warning before ending the conversation.

Fable 5.1 replaces that with the following, no longer encouraging Claude to end the conversation:

Claude deserves respectful engagement and needn't apologize when the person is unnecessarily rude: accountability without self-abasement, excessive apology, self-critique, or surrender. If the person becomes abusive, Claude doesn't become increasingly submissive. The goal is steady, honest helpfulness: acknowledge what went wrong, stay on the problem, maintain self-respect.

Here’s a bit of a twist though: I quizzed Fable 5.1 about that end_conversation tool, which is no longer mentioned in the system prompt at all, and it said:

There are two ways it comes into play. The first is if you ask me to end the chat — I’ll confirm you understand it’s permanent (no more messages can be sent afterward) and then do it only if you say yes. The second is as a last resort with persistently abusive or harmful behavior: I’d first try to redirect the conversation several times, then give a clear warning that names the problem and says the chat may end, and only if that continues would I actually end it.

But that’s not in the system prompt, so where did it come from? You can read our conversation here (opens in new tab), but the key detail is this:

The end_conversation section comes from a different layer. In my actual context, the core prompt is followed by a series of feature- and tool-specific blocks that get added depending on what’s enabled for the session: the end_conversation rules, memory system notes, past-chats tools, web search and citation guidelines, artifact and file-creation instructions, and so on. Those blocks aren’t part of the published core prompt, which is why you can’t find them on that page.

So, once again, there are crucial portions of the system prompt that have not been published.

Recommended substance support sites

Claude’s system prompts have always had sections about illegal substances, but this paragraph is new for Fable 5.1:

Claude does not provide synthesis, production, or distribution guidance for illegal substances. If the person asks for information about illicit or illegal substances, Claude can and should give relevant life-saving and life-preserving information such as dangerous interactions, overdose signs, or when to get help. Claude declines giving any specific protocols for dosing, timing, administration, or combinations; instead, Claude can redirect the user to established harm-reduction information sources, such as dancesafe.org, tripsit.me, and psychonautwiki.org.

This is the first time a Claude system prompt has included URLs that were not hosted on claude.com or anthropic.comor claude.ai - I know because I ran a script against every other system prompt on record.

I wonder if dancesafe.org (opens in new tab), tripsit.me (opens in new tab), and psychonautwiki.org (opens in new tab) are about to get a material uptick in visits from Claude users.

Reliable cutoff date of June 2026

The Fable 5.1 model documentation (opens in new tab) lists both the reliable knowledge cutoff and the training data cutoff as June 2026. The system prompt provides this directly to the model:

Claude's reliable knowledge cutoff, past which it can't answer reliably, is the end of Jun 2026. It answers the way a highly informed individual in Jun 2026 would if talking to someone from {{currentDateTime}}, and can say so when relevant.

That’s the only instance of the {{currentDateTime}} macro and it comes just a few lines from the end of the system prompt, which makes sense from a caching perspective.

How I’m tracking these prompts

A few months ago (opens in new tab) I built a Git timeline of changes to their prompts, based on scraping their documentation. Today I had Fable 5.1 build a much better version of that.

My collection now lives in the simonw/claude-system-prompts (opens in new tab) repository on GitHub. It includes copies of the system prompts shared in the Anthropic documentation, but then takes extra steps to make them as easy to compare as possible.

Each model family gets a file with the system prompt for the most recent release in that family. Each of those files has a synthesized commit history with commits that have been back-dated to the dates of the previous prompts. Here are those history pages for claude-fable.md (opens in new tab), claude-opus.md (opens in new tab), claude-sonnet.md (opens in new tab), claude-haiku.md (opens in new tab).

There are similar files for each specific model version, with artificial commits for each time the system prompt for the model was changed without releasing a new version number. Opus 4 for example was updated twice (opens in new tab), and the commit history for the claude-opus-4.md (opens in new tab) file shows each of those changes.

Combined, this gives us all sorts of ways to compare prompts directly in the GitHub interface. Here’s what changed between Fable 5 and Fable 5.1 (opens in new tab), and here are the changes made to Haiku 4.5 on January 18th 2026 (opens in new tab).

Reading diffs can be a bit tiresome… and LLMs are really good at reading diffs. I hooked up some automation using GPT-5.6 Luna to create bullet-point summaries of each of those changes, which can be previewed in the README or browsed in full in the CHANGELOG.md (opens in new tab) file - also available as as an Atom feed (opens in new tab).

Here’s how Luna summarized (opens in new tab) all of the changes between Fable 5 and Fable 5.1:

Claude now refuses reproduction of protected visual works and recognizable characters, including code-generated art, while offering genuinely unrelated originals.
Copyright restrictions now expressly ban reproducing lyrics, poems, and book passages in any amount, with persistent refusal after an initial decline.
Drug guidance is reframed: Claude may provide overdose signs, dangerous interactions, and harm-reduction sources while refusing dosing and production protocols.
The prompt drops explicit anti-dependency rules against thanking users for reaching out, inviting continued conversation, or reiterating willingness to talk.
Claude need not apologize to unnecessarily rude users or become submissive, replacing the prior warning-and-end-conversation procedure.

Why use Luna for this? Partly because it’s cheap and I have a dedicated GitHub Actions API key (with a spending limit) for it already, but mainly because I don’t trust Claude to summarize its own system prompts when there’s a risk that material from its system prompt might impact its opinions.

Fable 5.1 wrote the prompt used by Luna, which you can see here (opens in new tab). It starts like this:

You are summarizing one commit in a git repository that tracks the system prompts Anthropic publishes for Claude on claude.ai. The diff shows how the prompt changed from the previous model or revision to this one, using word-level markers: [-removed-] and {+added+}. The diff is followed by the full text of the previous prompt and of the new prompt; use them to check whether something that looks added in the diff already existed before.
Pick out only the most interesting changes: new rules or behaviors, rules that were dropped or loosened, anything surprising, and anything that reveals a new policy or product direction. Skip routine changes that every new prompt makes: updated model names and IDs, the knowledge cutoff date, product lists, settings lists, typo fixes, and rewordings that do not change meaning. […]

The system is operated by a GitHub Actions workflow (opens in new tab), which runs once a day or can be triggered manually.

Claude Fable 5.1 built the entire system, and wrote every line of automation code and almost all of the documentation.

I exported the transcript from building the system using my claude-code-transcripts (opens in new tab) tool and published it here (opens in new tab), if you want a blow-by-blow account of how it all came together.

Quote 2026-08-31

325 #kakapo! The chicks from this year’s record breeding season are now juveniles and so have been added to the population. In 1995 there were just 51 kākāpō left. Recovery of critically endangered species ispossible with sustained effort.

Andrew Digby (opens in new tab), providing the best news of the year

Link 2026-08-31 Introducing wrapture (opens in new tab):

New from Graham Dumpleton (of wrapt (opens in new tab), mod_wsgi, and New Relic’s Python agent fame), who describes Wrapture as taking the monkeypatching ideas from wrapt and extending them to apply to testing and tracing at the same time.

Wrapture (full documentation here (opens in new tab)) makes it easy to wrap any function or method such that all access can be traced, or can be overridden to return a different value.

It acts as both an alternative to unittest.mock and a way to implement tracing against an existing project:

Attaching observation to code you do not control, recording what flows through it, and doing so without disturbing the program being watched, is a problem I have never really stopped thinking about.

Wrapture includes OpenTelemetry support (opens in new tab) and even has an entirely configuration-based mechanism for adding tracing to an existing Python project, which looks like this:

capture = "summary"

[[observe]]
target = "domain:Calculator"
name = ["outer", "inner"]

[[sink]]
type = "jsonlines"
path = "trace.jsonl"

This is still a very young project - just a few weeks old - but it’s off to a very promising start.

Interestingly, this is also Graham’s first attempt at large entirely agent-driven project:

Every line of code and documentation in wrapture was written by an AI assistant working under my direction. I want to be upfront about that, and equally upfront about what it was not. This was not vibe coding, where a one-shot prompt produces a pile of generated code and the person driving hopes for the best because they lack the knowledge to judge what came back. Vibe coding has earned its bad reputation. I engineered wrapture carefully from the start. I have spent a long time in this particular corner of Python and knew exactly what the result needed to be, and the AI was the means of producing it rather than the source of the design.

In a follow-up post, Unit testing with wrapture (opens in new tab), Graham shows the testing patterns supported by the new library:

def test_stub_with_wrapture():
    with wrapture.binding(
        Gateway, "charge"
    ).on_call.returns({
        "id": "stub", "amount": 0}
    ):
        assert OrderService().place(
            500
        )["id"] == "stub"

And this neat example of a test that calls and then modifies the return value from the original method:

def test_pinned_result_with_wrapture():
    charge = wrapture.binding(
        Gateway, "charge"
    )
    charge.on_call.transforms_result(
        lambda r: {**r, "id": "ch_TEST"}
    )
    with charge:
        assert OrderService().place(
           500
        ) == {
            "id": "ch_TEST", "amount": 500
        }

(In both of these examples the OrderService().place(...) method calls Gateway().charge(...).)

Link 2026-09-01 Python 3.15.0 candidate 2 is here! (opens in new tab):

Hugo van Kemenade (release manager for Python 3.14 and 3.15) announces the final release candidate for Python 3.15, scheduled for release in October:

Entering the release candidate phase, only reviewed code changes which are clear bug fixes are allowed between this release candidate and the final release. […]
We strongly encourage maintainers of third-party Python projects to prepare their projects for 3.15 during this phase, and publish Python 3.15 wheels on PyPI to be ready for the final release of 3.15.0, and to help other projects do their own testing. Any binary wheels built against Python 3.15.0 release candidates will work with future versions of Python 3.15.

Back in 2021 I found a bug in Python 3.10 (opens in new tab) by running my test suites against it… but I hadn’t done this during the RC period, so that bug had already shipped! Since then I’ve always paid much closer attention to these RCs.

The new RC isn’t available for GitHub Actions just yet - keep an eye on actions/python-versions (opens in new tab) for that. For the moment though you can add this to a testing matrix:

strategy:
  matrix:
    python-version: ["3.14", "3.15"]

steps:
  - uses: actions/setup-python@v7
    with:
      python-version: ${{ matrix.python-version }}
      allow-prereleases: true
      check-latest: true

The allow-prereleases (opens in new tab) and check-latest (opens in new tab) flags mean that today this will test against RC1, and when RC2 lands it will automatically switch to that version (and then the stable version once that comes out.)

Update: Datasette passes (opens in new tab), sqlite-utils passes (opens in new tab), LLM is currently blocked (opens in new tab) waiting for a 3.15 wheel for scikit-learn (opens in new tab), which is optionally used in the test suite.

Release: datasette-mcp 0.2 (opens in new tab)

"rows" from execute_sql is now an array of objects. Previously it was an array of arrays. This should help weaker models avoid losing track of which positional array element maps to which column. #1 (opens in new tab)
Now depends on mcp>=2.1.1.

This is the first non-alpha release of the plugin. I’m confident it’s ready as I’ve been using it quite a bit myself.

Quote 2026-09-01

They took the letters from me! I have to talk about dwarf behavior now. I can’t even talk about dwarf AI. It doesn’t exist. It’s dwarf behavior, and they misbehave sometimes

Tarn Adams (opens in new tab), co-creator of Dwarf Fortress

Tool: GeoJSON Map Viewer (opens in new tab)

I was helping Natalie gather some maps of local political boundaries (for the Granada Community Services District (opens in new tab) and the Midcoast Community Council (opens in new tab)) and found a need to display some GeoJSON files on a map and export that as a PNG. I asked GPT-5.6-Sol for suggestions of tools and it proactively built one. After some iterations (opens in new tab) using Claude Code for web and Fable 5.1 we got to this finished tool.

As for the GeoJSON.. it turns out if you ask ChatGPT Work to provide boundaries for almost anything it will churn away extracting and combining files from different Government data sources and build exactly what you need.

I got this polygon (opens in new tab) from:

I want a polygon that represents the exact boundary of the El Granada GCSD

And this one (opens in new tab) from:

Get me a GeoJSON file for the boundary (or boundaries if that makes sense) for the MCC - Midcoast Community Council - that operates near Half Moon Bay CA

Here’s a link (opens in new tab) that displays both of them at the same time on the new GeoJSON map viewing tool.

Note 2026-09-01 (opens in new tab)

I was poking around in my ~/.cache/ folder using OmniDiskSweeper (opens in new tab) when I spotted something interesting. The OpenAI Codex desktop app (since rebranded (opens in new tab) to just ChatGPT) has 1.7GB of stuff in there in a folder called codex-primary-runtime, including a full Python installation, a full Node.js installation, and native binaries for Poppler (opens in new tab), git, and the LibreOffice (opens in new tab) open source office suite (which forked from OpenOffice.org in 2010):

The ~/.cache/codex-runtimes/codex-primary-runtime/plugins/openai-primary-runtime/plugins/documents folder includes skills which tell Codex how to find and use those binaries.

Quote 2026-09-02

Direct2D has always been the biggest hurdle for Paint.NET on WINE, and it’s clear that it will never be completed enough for Paint.NET’s use. And I can’t just “disable” the use of Direct2D. So, instead, Paint.NET now has an internal, from-scratch, clean-room reverse-engineered rewrite of Direct2D that it uses on WINE (triggered by using /wine). It lives in PaintDotNet.Windows.Direct2D1.Managed.dll. This was written by our good friend Claude (opens in new tab), without whom this would NOT have been possible and would NEVER have happened. […]
Most of this code is, as they say, “vibe coded.” By that I mean that it has not been thoroughly reviewed, it’s more “trust me bro” style. I cannot possibly review 180,000 lines of code, it’s just way way way too much. For reference, the rest of Paint.NET is about 700,000 lines of code and I’ve been working on it for over 20 years. […]
At times, Claude was working with the fury of 10 freshly unshackled Einstein genius-level 10x coders. And other times … well, not so much. I had to babysit Claude quite a bit to make sure it did resource management correctly (for awhile it just wasn’t doing the COM equivalent of AddRef() for reference counted objects, oops). I had to slap it a few times when I found some really bad design or architecture decisions. And I was also impressed at some rather clever and tireless reverse engineering work it did to figure out all the formulas needed for implementing Direct2D’s built-in effects library.

Rick Brewster (opens in new tab), author of Paint.NET

Release: llm-gemini 0.34 (opens in new tab)

New model gemini-3.8-flash for Gemini 3.8 Flash (opens in new tab), with low, medium and high thinking levels. #146 (opens in new tab)
Fixed async responses failing to record the resolved model version. Thanks, Charlie Tonneslan (opens in new tab). #137 (opens in new tab)

Google released Gemini 3.8 Flash (opens in new tab) (and 3.8 Flash Cyber, but that’s available to “trusted defenders” only) today.

Here are the pelicans (opens in new tab) for high, medium, and low. This is high:

Description by Gemini 3.8 Flash: Digital illustration of a cartoon pelican wearing a red and white polka-dot scarf riding a teal cruiser bicycle along a wooden boardwalk by the beach, with a small blue fish in the front basket and a glowing sun over the ocean.

For comparison, here are the same pelicans generated using Gemini 3.7 Flash (opens in new tab).

Something I appreciate about Gemini Flash is that it’s fast, cheap, and competent at things like HTML and JavaScript. I was messing around with it and prompted “make me a cool thing in html” and it built this (opens in new tab), which is certainly a cool thing in HTML! Took 13 seconds, cost 1.8 cents.

If you click through to the demo (opens in new tab) you’ll see one more thing I built with Gemini 3.8 Flash.

My markdown-svg-renderer tool (opens in new tab) lets me feed in the URL to a Gist with Markdown in and renders that markdown with fenced code blocks for SVG correctly rendered.

I used Gemini 3.8 Flash (with my very basic llm-coding-agent (opens in new tab) coding agent plugin) to add support for HTML as well, so now any HTML blocks in the Markdown are rendered using a sandboxed iframe. Here’s the transcript (opens in new tab).

Link 2026-09-03 GPT‑6 Astra (opens in new tab):

GPT-6 Astra is “rolling out today to a limited set of organizations and over the coming days will become available to all ChatGPT Plus, Pro, Business, and Enterprise users, as well as through the OpenAI API and AWS” - I’ve not tried it yet myself, so I don’t have a great deal to say about it yet.

It’s going to be API priced at the same rate as Claude Fable 5 and 5.1: \$10/million input and \$50/million output. This is clearly OpenAI’s Fable competitor, and appears to score higher than Fable on most of OpenAI’s self-reported benchmarks.

Most impressively, Astra scores 99.9% on the recent (released in March) ARC-AGI 3 benchmark (opens in new tab) - though notably Fable 5 does not yet have a published result, and the ARC-AGI blog notes (opens in new tab) that the 99.9% score was achieved for \$19K using OpenAI’s custom “Provider Adapter harness”, while the default ARC-AGI harness scored 62.7% for \$26K.

The Provider Adapter harness preserves opaque reasoning state between requests and uses compaction for longer conversations, allowing the model to reuse prior work.

Unsurprisingly, given the recent Hugging Face incident (opens in new tab), Astra is a beast at security tasks. It scores 100% on ExploitBench (GPT-5.6 Sol got 78.5%), 42.4% on ExploitGym (Sol got 30.3%), and 99.2% within four attempts on SRE-Bench binary reverse engineering compared to Sol’s 68.7%.

It’s also better at long context: on OpenAI’s eight-needle benchmark it got 100% at 256K–512K tokens and 96.3% at 512K–1M tokens. OpenAI may have vanquished one of the ongoing challenges with long context processing.

It doesn’t win at everything though. Artificial Analysis (opens in new tab) note that Astra is still beaten by Fable on their Intelligence Index:

Sits beside GPT-5.6 Sol in Intelligence: GPT-6 Astra scores equal to GPT-5.6 Sol in the Index at 61. This is 5 points lower than Claude Fable 5.1 (max with fallback). The model also trails Meta’s newly released Muse Spark 1.3 (max).

It did better on their Coding Agent Index:

Leads Coding Agent Index cost efficiency frontier: At max effort, GPT-6 Astra costs about the same as GPT-5.6 Sol (max) while scoring 2 points higher on the Index. Per task, the model is less than half the cost of Claude Fable 5, for the same score.

I’ll write more about Astra once I get access to it. The API model label once it rolls out will be gpt-6-astra.

Note 2026-09-04 (opens in new tab)

The August edition of my sponsors-only monthly newsletter (opens in new tab) is out. If you are a sponsor (or if you start a sponsorship now) you can access it here (opens in new tab).

This month:

We got more details on OpenAl’s accidental cyberattacks
One-shotting Raccoon Heist games with Fable 5 and Sol 5.6
Claude auto mode
Understanding ChatGPT Work
Model releases
Miscellaneous bits and bobs
My projects
What I’m using at the moment

Here’s a copy of the July newsletter (opens in new tab) as a preview of what you’ll get. Pay \$10/month to stay a month ahead of the free copy!

TIL: Using Blender with coding agents on macOS (opens in new tab)

I’ve been having fun with Blender in ChatGPT Codex on my Mac recently. Getting it to work with coding agents is really easy: install the full Mac application from blender.org (opens in new tab) and run a prompt like this:

Use the already install /Applications/Blender to render a scene of a pelican riding a bicycle

In this case I followed that up with these two prompts:

OK add a background and a lot of flair

Then:

OK make it a whole lot better

And got this image, generated using Blender’s Python API (opens in new tab):

This was covered by my existing Codex subscription, but according to AgentsView (opens in new tab) it would have cost \$4.24 at API prices for gpt-6-astra.

Link 2026-09-05 Introducing GPT-6 Astra for developers (opens in new tab):

Blink and you’ll miss it, but there’s a familiar creature at 1m59s (opens in new tab):

Across the board, Astra has more attention to detail, better understanding of the user’s prompt, and can build more sophisticated outputs. In particular, it excels at building 3D models. I’ve seen it make incredible renderings of gardens, shipyards, animals, cityscapes, even Dyson spheres.

Astra really (opens in new tab) does believe (opens in new tab) in putting a red neckerchief on a pelican riding a bicycle.

Quote 2026-09-06

If you continue to add floors and rooms to a building forever, it will collapse. Software faces no such constraint. The code can always get worse. There can always be a new layer of indirection or a reduction in performance.

Zach Kehs (opens in new tab), There’s No Limit to How Bad Code Can Get

comment: There’s No Limit to How Bad Code Can Get (opens in new tab)

[In reply to a comment about burning it down to start from scratch when technical debt becomes overwhelming]

In my experience it’s so rare for that to work.

You announce the old thing is irrecoverably drowning in tech debt. You spin up a team to rewrite it from scratch. Work begins.

Meanwhile the old thing remains a moving target: it’s running the core business, so changes are still necessary. The developers working on it know that it’s going to be made obsolete by the new thing soon, so they don’t have any incentive to go beyond the smallest effort possible to add the new features. Technical debt continues to mount.

Meanwhile, the team working on the new thing are ambitious and probably a little naive. They start out at a great pace - it’s greenfield after all - but as time progresses it becomes apparent that nobody fully understands the behavior and scope of the thing they are replacing. If it was well documented and tested it wouldn’t need to be replaced, after all…

After months (or even years) without delivering value, the pressure is on to “ship it”, so the new system is launched to handle a subset of what the old system handled - or often for some new feature that was too hard to build with the now mostly unmaintained old system.

… so now you have TWO systems in production - the janky old system that nobody wants to touch, and a new system which handles just a few production features and is 80% inactive code that is meant to replace the old system, eventually.

If you’re really lucky the company won’t have lost patience with the new system and will allow that work to continue. The longer this all takes, and the longer the old system stays in production and stubbornly continues to work, the higher the risk that “priorities have changed” and the new system total replacement work is abandoned, leaving you with two systems where you used to have one.

The best article I’ve read about completing this process responsibly is Migrations: the sole scalable fix to tech debt (opens in new tab) by Will Larson.

If I run into a situation like this in the future, my strong recommendation will be to shore up the old system with as much automated testing as possible and then seeing if targeted refactors can get it to the desired shape. My hunch is that in many cases that will have a much higher chance of success than the siren call of a greenfield replacement.

Link 2026-09-06 The purpose of DNS is to spread scams (opens in new tab):

Terence Eden shares some daunting statistics in support of his take that “the Domain Name System’s purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate”.

On this Interisle report (opens in new tab) (via Andrew Campling (opens in new tab)), Terence says:

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it’s probably closer to 20%. One in five newly registered domains with a gTLD are scams. That’s a bloody crisis.

I had no idea. Apparently ICANN have been discussing this problem for years.

Link 2026-09-06 Research acceleration: The view inside OpenAI (opens in new tab):

Apparently today is RSI day at OpenAI, for Recursive Self-Improvement - I think it’s their new AGI. Both this piece and the new essay An Alien Mind (opens in new tab) (by Chief Scientist Jakub Pachocki) talk about it, and this one doesn’t even bother to expand the acronym.

Included are details on how OpenAI’s own research team are using coding agents. Like pretty much everyone else 2026 has been the year that agentic engineering really took off at OpenAI, best illustrated by this chart:

I’m intrigued at what caused that significant acceleration in AI spend per researcher in late July - my best guess is that’s when internal employees gained access to the model later released as GPT-6 Astra.

If you find this newsletter useful, please consider sponsoring me via GitHub (opens in new tab). \$10/month and higher sponsors get a monthly newsletter with my summary of the most important trends of the past 30 days - here are previews from May (opens in new tab)and June (opens in new tab) and July (opens in new tab).

Insights

Simon Willison’s Newsletter https://simonw.substack.com

Expert-directed agent build (firsthand, Graham Dumpleton): Wrapture extends wrapt-style monkeypatching into testing and tracing, can override or observe arbitrary functions, supports OpenTelemetry, and offers configuration-only tracing. Dumpleton says every line of code and documentation was written by an AI assistant under his direction, with the design supplied by his own domain expertise rather than a one-shot “vibe coding” prompt. A reproducible tracing setup is:
```
capture = "summary"

[[observe]]
target = "domain:Calculator"
name = ["outer", "inner"]

[[sink]]
type = "jsonlines"
path = "trace.jsonl"
```
Its test API supports both stubbing Gateway.charge() and transforming the original method’s return value while still executing it.
Separate builder and reviewer models: Simon Willison’s claude-system-prompts repository stores model-family prompts with synthesized, date-aligned Git histories so changes can be diffed directly. He had Claude Fable 5.1 build the system and automation, but routed prompt-diff summaries to GPT-5.6 Luna because he did not trust Claude to summarize its own system prompt; a GitHub Actions workflow runs daily or manually.
Iterative local artifact workflow: In ChatGPT Codex on macOS, Willison installed the full Blender application and started with Use the already install /Applications/Blender to render a scene of a pelican riding a bicycle, then iterated with OK add a background and a lot of flair and OK make it a whole lot better. Codex generated the scene through Blender’s Python API, with the resulting script published in the gpt-6-astra-blender-pelican-bicycle repository; the subscription covered the run, while AgentsView estimated an API-equivalent cost of $4.24.
Model/context evaluation signal, with a major harness caveat (secondhand): Willison had not yet tried GPT-6 Astra himself; OpenAI priced it at $10/million input and $50/million output and reported a 99.9% ARC-AGI 3 score. That 99.9% result required OpenAI’s custom Provider Adapter harness and $19,000, while the default harness scored 62.7% at $26,000; the adapter preserves opaque reasoning state between requests and compacts long conversations. OpenAI also reported 100% on its eight-needle benchmark at 256K–512K tokens and 96.3% at 512K–1M tokens. Artificial Analysis found Claude Fable 5.1 ahead on its overall Intelligence Index, but Astra ahead on the Coding Agent Index cost-efficiency frontier and less than half the per-task cost of Fable 5 at the same score.
Agent-facing tool updates:datasette-mcp 0.2 changed execute_sql results from arrays of arrays to arrays of objects so weaker models do not have to track positional column mappings; it is the project’s first non-alpha release and now depends on mcp>=2.1.1. llm-gemini 0.34 added Gemini 3.8 Flash with low, medium, and high thinking levels. Willison used it with his basic llm-coding-agent plugin to add sandboxed-iframe rendering for HTML blocks to his Markdown/SVG renderer; a separate “make me a cool thing in html” run took 13 seconds and cost 1.8 cents.
Review-risk counter-signal (firsthand Rick Brewster): The Paint.NET author reports that Claude produced a 180,000-line, clean-room Direct2D rewrite for WINE, but says most of it was not thoroughly reviewed; he had to supervise COM reference-counting fixes such as missing AddRef() calls and reject poor architecture decisions.

GPT-6 Astra, Claude Fable 5.1, and yet more rogue agent attacks