The weekly delta
One email per week: what changed in AI that matters for how you work. Not a digest: a delta.
Verdict changes only
When our recommendation flips, you hear it first, with the evidence, not the hype.
Deadlines that bite
Deprecations, price changes, and migrations, flagged while you still have time to act.
The rejection pile
Every issue shows what we filtered out and why. If we say it's noise, you can skip it.
Get the next issue
Free, weekly, unsubscribe anytime. No sponsors in the copy, no filler.
Read recent issues first
Every issue is published on the web. Judge the signal before you subscribe.
The MCP Python SDK Let a Malicious Server Steer OAuth Credentials
This week's published stories share one lesson: an upgrade or a new default is not the same as protection. The MCP Python SDK fix protects nothing until you also pass issuer=, SpaceXAI will make Grok Voice Transcribe 2.0 the default with no date set, and Claude Code already serves Sonnet 5.5 as its default Sonnet on the Anthropic API, while thinking-off setups must move to between_tools first.
Claude Haiku 5.5 Ships From $0.10/$0.50 per 1M Tokens
Every new model this week entered our directory as a conditional pick for the same reason: the numbers that sell it are the vendor's own. Claude Haiku 5.5 is now Anthropic's cheapest current model, Mistral Large 4 is a priced public preview whose weights are still a promise, and Kolibri-1 ships Apache 2.0 weights that need about 78 GB of GPU memory.
A DeepSeek Harness Agent Could Switch Off Its Own Sandbox
This week's published stories were about what an agent can reach once you let it in: DeepSeek Harness let a sandboxed agent switch off its own sandbox, ZCode uploaded whole workspaces with their git history to Z.ai's cloud, and infostealers are spending stolen Claude sessions. The bill was just as hard to see, because Grok Bot meters its usage separately with no published price, and every Gemini 3.8 TTS rate doubles on 1 January.