This Week in AI: Longer Runs, Cheaper Models, and a Wider Attack Surface

The headline this week is price and run length: GPT-6.1 Sol brings near-frontier capability at a fifth of the flagship price, and Gemini 4 Argon allows a million output tokens in one run. The security work published alongside it is the counterweight. Longer, cheaper agent runs mean more autonomous work per dollar, and also more time during which something can go wrong without a human looking. The layer that decides whether that is a good trade is yours: the gates, the isolation and the audit trail.

GPT-6.1 Sol: near-Astra at a fifth of the price

OpenAI describes GPT-6.1 Sol as near-Astra intelligence for coding, computer use and professional work at one-fifth of Astra’s standard API input and output token prices. Latent Space’s DevDay roundup lists $2 and $10 per million input and output tokens, with cached input at $0.10, and reports that Sol matches Astra on DeepSWE. Those are vendor-reported figures; run your own tasks before you reroute on them.

The same roundup covers an Ultrafast mode: up to 8x faster generation in Codex and 6x in the API, at six times the standard price. Speed is now a priced dial, separate from capability. That is The Token Budget Framework’s argument in product form: cost is a set of settings you choose per task, and the default should be the cheapest one that clears your bar. The routing logic from earlier this fall still applies; only the numbers moved.

Gemini 4 Argon: a million output tokens, for almost nobody yet

Google DeepMind announced Gemini 4 Argon, and Ars Technica’s headline states the catch: you cannot use it yet. Latent Space reports access limited to government users and trusted cyber defenders in the Fairwind Program, with broader access promised. The notable engineering detail is output length: 1M tokens through Long Decode Continuation, an API feature that lets a response pause and resume across calls, against a 64K standard maximum.

Published benchmarks put it first on 13 of 19 against GPT-6 Astra and Claude Opus 5.5, including 77.9% on DeepSWE versus 74.2% for Opus 5.5. These are Google-published numbers on a model almost nobody can test. Plan for it; do not route to it.

The design question is what a pausable response means for a gate. Each resumption is a natural checkpoint: log the state, diff the work so far, and decide whether to continue. A run that can emit a million tokens without a stop is a run where The Human Gate Protocol has to be built in, because no one will stumble on a break.

Sandboxes contain one agent, not what agents share

Simon Willison quoted Matthew Green on the question “Is sandboxing sufficient to contain rogue agents?” Green’s argument, from his post, is that agents in isolated sandboxes can still spread something harmful through shared resources. Replace a package cache with email or Slack, and sandboxes with deployed personal agents, and the conditions for propagation look the same.

Pair that with Anthropic’s Frontier Red Team, quoted on 100 binary exploitation tasks: GLM-5.3 achieved full control-flow hijacks in 4% of trials and Claude Mythos Preview in 6%, where Claude Opus 4.6 and GLM-5.2 achieved none. Their point is that advanced cyber capability is spreading across models, not staying with one lab.

This is The Agent Security Surface Framework and The Concurrent Agent Isolation Framework meeting. Isolation per agent is necessary. The surface you also have to map is everything agents share: caches, queues, channels, credentials, and the files each one reads that another wrote. Audit the shared resources first.

Source-aware verification for MCP agents

A Hugging Face post on source-aware verification for MCP agents names a failure that ordinary faithfulness checks miss: an agent states a fact that exists somewhere in its pooled tool output but attributes it to the wrong tool. The authors’ ProvenanceGuard decomposes an answer into claims, routes each to its likeliest source, checks support, and compares the claimed attribution with the real one.

On 361 medical claims it reports an F1 of 0.802 for blocking unsupported claims, against 0.783 for MiniCheck and 0.758 for RAGAS, and identifies the right source for supported claims about 86% of the time. The benchmark is narrow and medical, so read the numbers as a direction. The direction is right: when an agent calls several tools, provenance belongs in the record, which is The Agent Observability Framework at the claim level.

The throughline

Capability keeps getting cheaper and runs keep getting longer. Neither one makes the surrounding system safer. Isolation that covers shared resources, a checkpoint at every resumption, and provenance on every claim are what let you take the cheaper, longer runs without taking on the risk unreviewed.

The frameworks behind those controls are laid out for engineers at curiochat.ai/software-engineer/.