Changelog — September 6, 2026

GPT-6 Astra is OpenAI's new most-capable model, and the specification sheet is a near-mirror of Anthropic's. gpt-6-astra: $10 per million input tokens, $1 per million cached input, $50 per million output, a 1,050,000-token context window and 128,000 max output tokens, on both v1/responses and v1/chat/completions. OpenAI positions it for "the hardest end-to-end work" — reasoning, coding, computer use, research and document creation — explicitly as a model that carries a task from request to finished artifact rather than answering a question. Our cost calculator carries it as of this run.

The convergence is the finding, and the cache rate is where it breaks. Astra and Fable 5.1 match on input price, output price and roughly on context — two days apart, from vendors who do not coordinate. What does not match is cached input: $1/MTok on Astra against $0.25/MTok on Fable 5.1. For a one-shot call that difference is invisible. For an agent that re-reads a large stable prefix on every turn — which is what both models are being sold for — it is the dominant term. A 500k-token cached context re-read 100 times costs $50 on Astra and $12.50 on Fable 5.1, while the sticker price says they are the same model. If you are comparing these two, compare them on your actual cache hit pattern, not on the headline.

The Responses API additions matter more than they read. Also on September 3, OpenAI added async tool calling, mid-turn steering, and the ability to adjust reasoning effort mid-conversation for Astra. Mid-turn steering in particular changes what a long agent run can be: a turn that is going wrong can be corrected without discarding it. Anthropic shipped a beta with the same shape for Fable 5.1 two days earlier (mid-conversation-output-config-2026-07-01). Both vendors independently concluded that the unit of control needs to be smaller than the turn, which is a stronger signal about where agent runtimes are heading than either announcement alone.

Two operational changes worth wiring into your retry logic. On September 2, OpenAI split what used to be one failure into two: traffic ramping too quickly now returns 429 with a slow_down code, while temporary overload returns 503 with server_is_overloaded. These want different handling — the first is your fault and wants backoff, the second is theirs and wants a retry — and a client that treats both as "rate limited" will back off pointlessly against an overload or hammer through a genuine limit. On September 1, IPv6 connectivity became available for api.openai.com.

The deprecation notice has a hard date, and it is closer than it looks. Announced August 26: whisper-1, gpt-4o-transcribe, gpt-4o-mini-transcribe and gpt-4o-transcribe-diarize shut down on February 26, 2027 — and the Assistants API shuts down the same day. The Assistants API sunset is the one to plan around; it is a whole application architecture, not a model string, and anything built on it needs a migration to the Responses API with its own testing window. Six months sounds like plenty until it is a quarter away. Separately, mutual TLS and X.509 workload identity federation reached general availability on August 29, and per-request regional processing for eligible customers on prefixed domains landed August 21.

Changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /chatgpt/agent-mode/, /tools/cost-calculator/

Our calculator had drifted badly on everyone who is not Anthropic or OpenAI, and this run fixes it. The Google group had not been verified since July 18, and there was no xAI or DeepSeek group at all — so a reader comparing costs was choosing between an accurate Anthropic column and a seven-week-old everything-else. Three vendor groups are corrected or added below, and every entry carries its verification date.

Gemini 3.8 Flash is the aggressive number this week. Google shipped it September 2 — its third Flash release in six weeks — at $0.75 per million input tokens and $3.75 per million output, with a 1,048,576-token context window, a 65,536-token output limit, and three thinking levels (low, medium, high; default medium). Read the price with its expiry attached: that is an introductory rate through December 31, 2026, and it doubles to $1.50/$7.50 on January 1, 2027. Anyone modelling 2027 costs on today's Flash rate is modelling half the real number. At the introductory price it undercuts both new flagships by roughly 13× on input at comparable context, which is the trade the whole Flash line exists to offer.

xAI is new to the calculator, and its pricing has a cliff you must know about. Grok 4.6 (released August 12) is $2 input, $0.50 cached input, $6 output per million tokens with a 500K-token context window — but only for prompts below 200K tokens. At 200K and above, the entire request rebills at $4/$1/$12. This is not tiered billing. A 210K-token prompt is not 200K at the cheap rate plus 10K at the dear one; all 210K tokens are charged at the higher rate. That makes 200K a genuine cost cliff rather than a gradient, and an agent whose context grows across turns will double its own bill the moment it crosses — with no signal that it has. If you run Grok with an accumulating context, put a hard cap below 200K or accept the step.

Grok Bot is the agent product that model powers, and it is worth knowing about even though we do not yet cover it as a platform. xAI launched it in beta on August 11, 2026: an always-on agent where each Bot gets its own cloud computer, signs into your existing tools, and runs multi-step work continuously, returning when it needs approval. Access runs through SuperGrok Heavy, Cursor Ultra or Cursor Teams Premium, and you sign in with a Cursor account — a consequence of SpaceX's June 2026 acquisition of Cursor and the merge of Cursor and xAI into one group. We are not adding a Grok Bot hub in this run: a platform page here means guides we maintain against a feed we poll, and we have neither yet. We have added the model to the calculator and are treating the platform as a candidate for the next expansion review.

DeepSeek V4 Flash joins the open-weights group and resets what the floor looks like. 284B total parameters, 13B active, a 1,048,576-token context window, 384K max output, MIT licence, GA since July 31. First-party pricing is $0.44/$1.32 per million tokens at peak and half that off-peak ($0.22/$0.66) — we list the peak rate, because a calculator that quotes the cheaper number understates a real bill. That is exactly one third of DeepSeek V4 Pro's rates, and roughly 23× cheaper on input than the new flagships at the same context length. Whether it is good enough for your workload is a question for the benchmarks page, not this one — but the price makes it the reference point that every other 1M-context model now gets compared against.

Cost calculator → Affects: /tools/cost-calculator/, /compare/, /benchmarks/, /openclaw/cost-optimisation/, /kilocode/models/, /nemoclaw/switching-providers/

The most consequential fix in this window is a parsing bug that silently disabled permission rules. v2.1.260 fixes Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left "read-only" folders writable. The failure mode is the dangerous kind: the rule is in your settings file, the interface shows it, and it does nothing. Parentheses in a path are not exotic — C:\Program Files (x86), any foo (copy) directory, a great many real project paths. If you rely on a deny rule to protect a directory whose path contains a bracket, assume it has not been protecting it and verify after upgrading. A companion fix in the same release: one rule with an uncompilable pattern (an unclosed [, say) made every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells instead of poisoning the whole set.

The second security fix is a shell-parsing escape. v2.1.260 also fixes Bash permission checks auto-approving zsh commands that hide a command substitution in a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt. This is the same family as the Cygwin-symlink and input-redirection checks — the permission layer reads a command string, and a shell offers more ways to smuggle execution into one than any parser enumerates on the first pass. It is an argument for --restricted (added in v2.1.248) over a carefully tuned allowlist whenever you are pointing the tool at code you did not write.

Unattended and managed deployments got the pieces they were missing. v2.1.259 added --permission-prompts none for headless hosts — anything that would prompt is denied automatically while the active permission mode, including auto mode, keeps deciding — and managedMcpServers, letting organizations push HTTP/SSE MCP servers to every user with the same entry shape as .mcp.json (entries naming a command to run are skipped). v2.1.259 also fixed concurrent sessions silently reverting each other's ~/.claude.json changes, so workspace trust no longer resets and MCP state is no longer lost when many sessions run at once — a bug anyone running a fleet will recognise immediately.

A second round of Read() deny-rule holes closed. v2.1.259 fixed Bash Read() deny rules not covering files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff/git grep file operands, or cd DIR && cat FILE compounds; and grep -r/cp -r over a directory holding a denied file now asks. Every one of those is a way to name a file without it looking like a filename argument. Together with the parentheses bug above, this window is a reminder that a deny rule is a claim about a parser, not about the filesystem.

The visible feature is a diff panel. v2.1.260 added a diff panel that opens beside the conversation in fullscreen mode and shows uncommitted changes as Claude edits, toggled with /diff. Same release: /cost and the status line's prompt_cache field now name a likely cause for cache misses (tool definitions or system prompt changed, idle past the TTL), which turns the cache telemetry added in v2.1.251 into something actionable rather than merely observable. Also added: /reload-plugins in headless sessions, and a text form of /advisor (/advisor, /advisor <model>, /advisor off) for the desktop app, Remote Control and other headless sessions.

v2.1.261 is the diagnostics-and-limits release. It added an "Organization policy" line to /status and claude doctor explaining why a policy could not be loaded (a proxy not passing the endpoint through, for instance); bashOutputMaxChars and taskOutputMaxChars to raise how much command and background-task output reaches Claude inline before spilling to a file, up to 128K characters; --append-subagent-system-prompt-file for subagent prompts too large for a command line; and /skill-doctor, which shows which loaded skills go unused and what they cost in context so you can prune them. That last one is a direct answer to a real and under-measured cost: skills load into every request whether or not they fire.

Everything else, briefly. v2.1.259 fixed a conversation whose thinking was rejected once being rejected again on every later turn, the prompt cache being invalidated on OAuth refresh with telemetry disabled, fullscreen showing a blank conversation after hundreds of tool calls, auto mode running a turn on a model it does not support when a command or skill's frontmatter named one, and CLAUDE_CODE_MAX_CONTEXT_TOKENS being ignored for Vertex-style model IDs. It also added glab merge-request recognition (MR !N in the collapsed tool summary and footer badge) and --json for claude plugin validate. v2.1.261 fixed typed or pasted characters landing out of order or being dropped during fast input, a false /add-dir resolution error on /net automounts, the Bedrock setup wizard hanging when AWS never responds, cloud sessions discarding a claude.ai-synced plugin that managed settings force-enable, deletion of the character before an inline [Image #N] chip, resuming a session losing hook output and context around parallel tool calls, and two Remote Control bugs (a stale permission mode after attaching, and sessions showing as still working after a turn was stopped). v2.1.263 published no itemized notes.

No reverts in this window. Nothing here walks back anything we have published. As flagged in the September 1 entry, the replacement Cygwin-symlink and input-redirection permission checks reverted on August 18 have not appeared in nineteen days; the REPORTTIME fix above is a new escape in the same family rather than the promised replacement, so we are now recording those two as abandoned rather than pending.

Full changelog → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/skills-guide/, /claude-cowork/, /security/

Eight releases in five days, and nearly all of the substance is in Agent Manager. Kilo Code's parallel-agent surface is where this line is being invested, and the additions describe a product converging on "review other agents' work" as the core loop.

The orchestration change is the one with the widest effect. v7.5.8 lets the orchestrating agent choose a model, provider and reasoning effort for each subagent task, behind an experimental setting. That is the right shape for cost control in a multi-agent run — a planning agent on a flagship and ten workers on a Flash-tier model is a completely different bill from ten workers on the flagship — and it arrives in the same week that the spread between tiers widened to 13×. If you run Kilo Code's orchestrator, this setting is now the largest single lever on what a run costs.

Agent Manager gained a full pull-request loop. v7.5.11 added pull request discussion comments and review submissions at the bottom of the Agent Manager PR view, with actions to send them to the agent or terminal, copy, or dismiss, plus a refresh button to fetch the latest PR state and /update-from-base to update a worktree agent from its saved base branch without stashing or discarding uncommitted work. It also added an inline introduction explaining worktrees, parallel agents, PR status and conflict resolution — a tell that the feature had outrun its own discoverability.

Local preview closes the frontend loop. v7.5.8 added previewing local applications inside Agent Manager with embedded developer tools, grouped diagnostics, and review-style element feedback for precise frontend changes. Pointing at an element and describing what is wrong with it is a meaningfully better input than describing it in prose, and it is the piece most agent IDEs still lack.

The rest are patches, and two are performance work worth noting. v7.5.14 keeps codebase indexing status current, supports workspace paths with non-ASCII characters, and pauses Changes, Review and chat-badge polling while their panels are hidden, reusing unchanged file counts to reduce CPU use in large repositories — a real complaint, properly addressed. v7.5.13 keeps Shift+Tab available for reasoning-variant cycling while the slash-command menu is open and standardises the Agent Manager toolbar's Open/Apply/Run buttons; v7.5.12 keeps model and reasoning selectors open during automatic prompt focus restoration. v7.5.8 also added editing queued messages in VS Code before they are sent and optional instance kind, process start time and Git branch in CLI heartbeats. v7.5.15 reports "no notable changes."

Releases → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/, /kilocode/models/

The security-shaped fix is a DNS rebinding hole in the Windows Ollama path. #10889 prevents Windows Ollama DNS rebinding. DNS rebinding against a local inference endpoint is the attack where a web page you visit resolves a hostname to 127.0.0.1 after the browser has granted it origin trust, and then talks to your local model server as if it were the site's own backend. Local-first inference is the whole premise of this platform, so a local endpoint reachable from a browser tab is precisely the exposure that matters here. If you run NemoClaw with Ollama on Windows, this is the change to take.

v0.0.120 is being prepared (#11100), and versions.json moves to it in this run — the first bump since 0.0.113 on August 20. Alongside the release docs, #11102 and #11101 document trusted Hermes rebuild aliases and clarify the Hermes rebuild image override.

The inference layer took the bulk of the work. #11070 updates the Model Router pool — worth watching if you rely on router defaults, since the pool decides what a request without an explicit model gets. #11044 makes preset memory failures surface rather than fail quietly, #11048 stops a pinned vLLM retry loop during onboarding, and a WSL validation fix keeps the timeout floor and shows its guidance instead of dying silently. #10910 corrects Nemotron endpoint probe parameters in onboarding.

Onboarding and sandbox repair continue. #11046 restores N1x standard onboarding and #11122 persists N1x preview acceptance so the prompt stops recurring; #10996 repairs Shields removal regressions, and #11024 makes legacy recovery prefer the pinned Hermes base. On macOS, #11121 recognises Homebrew 6 gateway labels and #11125 reduces Homebrew trust operations for readiness checks — a follow-on from the Homebrew repair-loop fix two weeks ago. #11120 retains actionable build diagnostic tails in the CLI, which is the difference between a build failure you can act on and one you have to reproduce.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/policy/