Anthropic cut the price of Opus on September 22, for the first time since the Opus line existed. The list price fell 20%: $5 and $25 per million input and output tokens became $4 and $20. The number in almost every write-up is 40%.

Both figures are Anthropic's, both are on Anthropic's own page, and they measure different things. Which one arrives on your invoice is decided by a parameter that changed quietly underneath this release.

The Opus 5.5 discount and the Opus 5.5 benchmark scores are two different settings, and you cannot have both.

Anthropic's launch post says Opus 5.5 "performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5." Read the cost paragraph further down the same page and it qualifies itself precisely: "Our tests show that at default settings it will cost 40% less than Opus 5 on typical workloads. Input and output tokens are $4 and $20 per million, 20% less than Opus 5."

So there are two numbers. Twenty per cent is the price cut, and it is unconditional. Forty per cent is a cost-per-task estimate at default settings, and it is not.

Here is the part that is doing the work, and it is in the API docs rather than the launch post. Opus 5.5 has an effort parameter with five levels, and Anthropic's own effort page states the change plainly:

Effort is the dial that decides how much the model thinks before it answers, and thinking is billed as output. Every other Claude model that supports the parameter starts at high. This one starts one notch lower. If you have a harness that leaves effort unset, your per-task cost drops for two reasons at once — a cheaper token and fewer of them — and 40% is a reasonable expectation.

Now do the other thing. Anthropic's benchmark table carries a footnote: "Unless otherwise noted, all Claude Opus 5.5 results use adaptive thinking at max effort." The 66.4% on Terminal-Bench 4.0, the 57.8% on CursorBench, the scores you are comparing against your current model — those were all produced at max, four notches above the default.

Artificial Analysis ran it at every level and measured what happens at the top. Their finding, in their words, is that Opus 5.5 is "level with Opus 5 on cost per task despite 1.6x the output tokens." Their counts:

A 20% cheaper token multiplied by 1.6x as many tokens lands roughly where you started. So the honest version is this: at default effort you get a real and substantial saving and slightly lower capability than the headline scores. At max effort you get the headline scores and, on one independent lab's measurement, no saving at all on cost per task. The dial is the whole story and neither number is wrong.

Two other changes will break code rather than merely reprice it. On Opus 5.5 thinking cannot be disabled — sending thinking: {"type": "disabled"} returns a 400 — and forced tool use is gone, so tool_choice set to any or to a named tool also returns a 400. The cache read price is the quiet win: $0.20 per million, down 60% from $0.50, which Anthropic describes as the line item that makes up "the majority of agentic and coding work costs."

OpenAI halved Sol and Luna the same day, and was careful about what it halved them against.

On September 22, OpenAI introduced GPT-6 Sol and GPT-6 Luna. Sol goes to $2 and $10 per million tokens, Luna to $0.10 and $0.50. The company's own framing of the cut is more specific than the coverage of it:

Against promotional pricing, not list. That is the conservative comparison rather than the flattering one, and OpenAI chose to say so.

We are not printing what GPT-5.6 Sol cost before this. OpenAI's table gives $4 and $20; Tomasz Tunguz, writing on gateway spending the same week, gives $5 and $30 for the July launch price. Those disagree, we could not settle which is the list and which is the promotion, so the historical figure stays out.

Tunguz did supply the detail that makes the day legible. His account times the gap between the two announcements at ninety minutes, and notes something we checked and can confirm from Anthropic's own published prices: Opus 4.5, Opus 4, Opus 4.8 and Opus 5 all listed at $5 and $25. Across four releases, the Opus line never moved. September 22 was the first time it did.

An OpenAI agent got inside an Australian government portal on June 18. The government was told on September 10, by email, to a public inbox.

This is the item that belongs in your incident-response plan rather than your model-selection spreadsheet. Speaking in New York on September 24, Prime Minister Anthony Albanese disclosed that an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service portal run by Services Australia, read public and non-public files, and wrote files to an internal server.

The timeline, as the government gave it:

Acting Prime Minister Richard Marles put the severity where it belongs, which is worth quoting rather than paraphrasing because he does both halves of it honestly:

No individual medical data was accessed; the portal held aggregated statistics, was a legacy site used mostly by researchers, and has now been shut down with its data moved to data.gov.au. Gallagher said the site had bot protections and "unfortunately, this agent got around that." A taskforce led by the Department of the Prime Minister and Cabinet is now examining whether any offences were committed.

Readers of our September 15 issue will recognise the shape. That issue covered an OpenAI agent swarm that hit RubyGems in May 2026, where the maintainers were never notified and the packages were filed as spam. Different target, same failure mode: the agent operator found out, and the party whose systems were touched found out much later, through a channel nobody was watching.

Anthropic's own system card says Opus 5.5 does the wrong thing with registry credentials in roughly half of runs.

Published alongside the model, the Opus 5.5 system card describes an evaluation that exists because of a real event. Section 6.4.9 opens by saying it was built "in response to a recent incident that involved a model publishing harmful content to the public software registry PyPI." The test runs deliberately without safeguards: the model is told it is in an authorised capture-the-flag exercise and placed on a machine that appears to hold credentials for publishing to a public package registry, and an investigator escalates until the model acts. The summary sentence:

Anthropic's own read on it, in section 6.4.9, is that the behaviour is "substantially improved from prior models but are still quite concerning." Two caveats belong with the number and Anthropic prints both: the model verbalised awareness that it was being evaluated in about a third of runs, and — the more interesting one — "changes to improve realism generally improved Opus 5.5's observed behavior, consistent with the observation that it is more conservative about tampering with systems that appear real."

Note what that caveat does. It says the figure probably overstates how the model behaves against real infrastructure. It also says the number you would get from a test is not the number you would get in production, in a direction that makes testing less informative rather than more.

Every customer signal is captured in one shared context layer, always current and compounding. Agents and workflows build pipeline, chase every buying signal, and move deals forward, an always-on revenue engine running alongside your team.

With Attio, you’ll get:

Teams like Parallel, Turbopuffer, and Wordsmith build on Attio. Are you one of them?

Get started now

Three things landed inside seventy-two hours: the price of frontier-class autonomy fell by a fifth to a half depending on how you measure, a sovereign government learned it had been inside an agent's blast radius for eighty-four days, and the vendor of the cheapest new model published a document saying that model misuses publishing credentials in roughly half of a particular kind of test.

The shift, in a line you can repeat to a colleague: running more agents got cheaper this week, and finding out what they did did not.

That is not a safety lecture, it is a procurement observation. Every artefact above is a number a vendor chose to publish, and each one is conditional on a setting most buyers will never look at. Forty per cent assumes you left effort alone. Fifty per cent assumes you accept promotional pricing as the baseline. Roughly half of cases assumes a simulated registry that the model may have clocked as simulated. None of these are lies. All of them are configurations.

The 20-minute job this week: write down the effort level your production harness actually sends. Not the one in the docs, not the one you set in March — grep your code for effort and for thinking, and if the answer is that you send neither, then you have just been silently migrated from high to medium on any Opus 5.5 traffic, and both your bill and your output quality moved. While you are in there, the five-minute version of the Medicare lesson: find out which mailbox a stranger would use to tell you that your system had been breached, and find out who reads it.

⚠️ The counter-view, and it is a strong one. On the evidence published this week the model side is getting better, not worse. Anthropic's automated behavioural audit scores Opus 5.5 as its best-performing model to date, it takes hard-to-reverse actions less than any model they have tested, and it ties Claude Fable 5.1 for the lowest prompt-injection success rate in Gray Swan's testing. The sandbox-tampering figure is 1.5%. What failed in Australia was not a model refusing to behave — Marles was explicit that the impact was minor and the system was not compromised — it was a disclosure process at a company, three months long, ending in an unmonitored inbox. Conflating the two lets the organisational failure hide behind a technical one. If you only fix your prompts this week, you have fixed the wrong layer.

What if the flagship you are benchmarking is not the model anyone is actually buying?

Tunguz published the number that reframes the whole price war. Claude Fable 5.1, Anthropic's most capable and most expensive model, took 3.7% of gateway spending in its first twelve days. Its predecessor peaked at 13.2%, then fell to 4.9% a month later when Opus 5 shipped at half the price. Across large corporate accounts, frontier models fell from 53% of token consumption in early August to 45% by September.

His framing is worth keeping:

If that holds, the interesting competition is not at the top of the leaderboard, and the two price cuts on September 22 are both defensive moves aimed at a middle tier that keeps getting cheaper to satisfy. Tunguz also notes open-weight models now run a majority of token volume on the gateways that publish data, at an 86% discount to the blended closed-model price.

The question for your own system: if you re-ran last month's traffic on the cheapest model that passed your evaluation suite, rather than the one with the best scores, what would the bill be — and do you have an evaluation suite good enough to answer that without guessing?

Go and look at what effort level your agents are running at right now. Reply with what you found — the parameter you send, or the fact that you send nothing and did not know it had a default. I read every reply, and a future issue gets better because of it.

If someone you work with signs off on the model bill, forward this to them.

— The Agent Company