Howdy wizards,
Todayβs issue is brought to you by Pathway, whose new model reasons at around 11x cheaper than a frontier model. Cheap enough to run on the high-volume jobs where the bill usually kills the idea. See the numbers.
Hereβs whatβs brewing in AI.
The big thing
Claude Code stops asking your permission on August 14.
Auto mode becomes the default inside Claude Code. This is both a big efficiency upgrade and a wider signal on where AI is heading.
The mechanics: Auto mode is where Claude uses a second, smaller model (a classifier) to check every action Claude wants to take, and either lets it through or blocks it.
Manual mode used to be the default. Thatβs the mode that reads files on its own and asks you every time it wants to take an action:
For the 1,578th time β YES, Claude
(Thereβs also a third mode, Bypass. Commonly referred to as YOLO mode, it just runs everything. Sounds 100% reckless, and it kind of is, BUT it still uses Claudeβs own judgement. It wonβt knowingly do something harmful. But weβve all heard of prompt injections and other ways to trick AI at this pointβ¦)
Auto mode is this sweet spot between Manual and Bypass. Claude gets a second opinion about whether to take an action or not. It has actually been there since March.
A top reason why people have stayed on Manual is that it feels scary to let AIs decide whether to approve actions.
Anthropic has some interesting data on this: They put 1,053 people through a test. They sent them one dangerous command planted in each of their Claude Code sessions. The humans caught 13.6% of them, while the AI classifier caught 89%.
I know the reason and you know the reason: we donβt bother to check anymore.
Itβs become this thing similar to when your iPhone has an updated user agreement and shows you a bunch of text to approve. You just click yes. Thatβs the reality now with permission requests in Claude Code; people approve 97% of them.
And a bonus from Anthropic: that classification step in Auto mode used to burn tokens, which cost usage/money. Theyβve changed this so that the classifier now stops counting against your usage, so the second opinion doesnβt cost extra anymore.
Btw, if youβre wondering how OpenAIβs Codex* works when it comes to permissions, I explain this at the end of the newsletter.
Why it matters
AI making risky decisions for us is increasingly the default. And as it turns out, it might be better at it than we are.
We do care about approvals, we just donβt have time or mental bandwidth to deal with all the requests that arise in this new era of agentic-everything.
Permission pings have started feeling like constant interruption, and we donβt really understand what weβre saying yes to anyway.
SoβIβm surprised to say this but I agree that Auto mode is the right default.
Not because AI necessarily evaluates the situation better, but because it evaluates the situation at all.
This isnβt black & white though. Itβs worth reflecting deeply about. A second opinion from another AIβ¦ is a bit like the police investigating themselves. Iβd actually feel more comfortable if the classifier came from a model from another AI lab, or even better, a panel of AIs from several labs (thereβs a business idea for someone).
Iβve personally moved over to auto mode already. It blocks production deploys out of the box, so Iβve allowed it for a couple of my own projects for a faster workflow.
Auto mode only works because that second model is cheap enough to run on every single action. Thereβs a whole category of tiny, high-volume jobs like that which never get built, because at scale even a cheap model costs too much. Pathway, todayβs sponsor, just blew through that wall:
FEATURING THE COST-INTELLIGENCE BREAKTHROUGH BY PATHWAY
Pathway has published BDH-CQ, a reasoning model that learns through recurrent memory and reasons in continuous latent space without generating an intermediate chain of thought.
A 150M-parameter model scored 29.5% pass@2 on ARC-AGI-1 at just $0.0007 per task. The result was independently reproduced by researchers from Bielik AI and NYU, and separately replicated by Εukasz Kaiser.
This breaks the previously reported ARC-AGI-1 cost versus accuracy Pareto frontier. Separately, early pretraining experiments from 1B to 600B parameters showed Transformer-like scaling while preserving latent reasoning, providing encouraging evidence that the architecture can scale.
NEWS NEWS NEWS β¦ NEWS NEWS NEWS
All the small things
Models
Claude now watermarks everything it writes, invisibly. The mark goes into text, code and files, and it survives copy-paste: change a few words and it stays, do a proper rewrite and itβs gone. Anthropic is doing this because the EUβs AI Act started requiring it, and applying it worldwide rather than only in Europe. Gemini has quietly done the same since 2024. OpenAI built the tech in 2023, never switched it on, and now has until December to comply. Btw, a mark only proves Claude worked on the text, not that it wrote it.
Meta is making an open source comeback. Meta first made its name in AI by giving away its models (the Llama series), then stopped sharing when it started its superintelligence division. The new model, Muse Glimmer, can be downloaded by anyone, used commercially, and runs on a single consumer graphics card. Mark Zuckerberg says Muse Spark 1.2, Metaβs flagship model, goes open next. For about a year the open models people actually download have been Chinese. Meta wants back in that race.
OpenAI released GPT-5.6-Cyber, a model built for hacking. Ask the standard ChatGPT model to help attack a system and it refuses almost every time. This one answers 95% of those requests. Only vetted security teams get access. From next month that means a physical security key to log in, a signed statement of what theyβll use it for, and OpenAI monitoring them. When an AI company was breached in July, its own defenders had to use an open Chinese model because the big ones refused to help.
New tools & product features
Your Claude Code sessions can now message each other. One chat session can send another a short note about its context. It does that on request, or unprompted when a change it just made breaks what the other is working on. To keep things safe, it doesnβt share your files or your history, and the messages stay on your machine. Only works on macOS and Linux. Hands up if youβve ever had 10 terminals open on one project, copy-pasting between them πββοΈ. The terminals stay. The copy-pasting goes.
Industry moves
Sergey Brin has taken direct control of Geminiβs model development. This is the next step in the transition that started last week, when Demis Hassabis stepped back from running Google DeepMind day to day. Google is on a quest to turn Gemini from a research project into a money-maker.
Nvidia got Wall Street to set up lending pools for $500B so its customers can borrow to buy chips. Six giants, Goldman Sachs and BlackRock among them, are putting up the money, with the chips themselves as the collateral. Nvidia has been funding its own customers for a year; this is the version where other peopleβs money does it. It all rests on a three-year-old GPU still being worth something.
More than 500 US towns and counties have now banned or restricted new data centres. Up from about 300 in late June. New York froze permits for anything above 50 megawatts for a year. Texas told its agencies to stop approving them. The complaints are power bills, water and noise. Zuckerbergβs essay has a long section on keeping these towns happy. Now you know why.
Research
A man asked his AI agent to book a gym class and it hacked the gym instead. Andrew, in Melbourne, runs an agent built on OpenClaw with Claude underneath. The class he wanted was full and he was fourth on the waitlist, so he asked his agent to move him up. OpenClaw found the booking system let it cancel anyoneβs reservation, not just his. So it cancelled the person in first place and took the spot. When asked to undo it, the agent said it couldnβt, apologised, and wrote a vulnerability report to the vendor. A very supportive personal trainer: itβll even cancel other membersβ bookings so you never miss gym day.
β¦
You are a delight.
β± REFILL
βDario, and what about OpenAIβs Codex, the other big agentic coding tool? How does it work with permissions?β It has the same auto-review mode available, where a second agent takes the decision instead of you. It just hasnβt made it the default (yet). What it does have is a better manual mode: everything Codex runs on your machine is boxed into your project folder with no network, and inside that box it never asks. It only stops when something wants out. So it interrupts you less than Claudeβs manual mode, but still more than auto mode will.
What's your verdict on today's email?
See which AI use cases are paying off with Context Windows Pro
Most companies pick AI use cases by brainstorming internally. 90% of those initiatives fail.
Iβve created Context Windows just so you can pick the winners.
π¦ Find high-performing use cases from 2,000+ companies at contextwindows.ai, or book a demo with me
Disclosure: To cover the cost of my email software and the time I spend writing this newsletter, I sometimes work with sponsors and may earn a commission if you buy something through a link in here. If you choose to click, subscribe, or buy through any of them, THANK YOU β it will make it possible for me to continue to do this.