Wednesday, July 22, 2026
Two competing accounts of how to split agent work between expensive and cheap models, a fresh argument that Chinese open weights are cheap only because compute is scarce, and seven sandbox escapes that never touched the sandbox.
Where agent money goes
Cursor published its agent-swarm architecture and cost numbers: frontier-model planners decompose a recursive task tree and never write code, cheap worker models execute the leaves and never plan. The test was reimplementing the 835-page SQLite manual in Rust with source, tests, the binary and the internet withheld, graded against sqllogictest, which the swarm was never told existed. Cursor says the same result cost $1,339 with an Opus planner and Composer workers against $10,565 with GPT-5.5 alone: workers carry over 90% of tokens in most runs but planner tokens cost far more. It credits the gain to context efficiency rather than parallelism, since a planner’s window never fills with leaf detail. Supporting it required a from-scratch version control system handling about 1,000 commits per second; the prior harness on Git peaked near 1,000 commits per hour and stalled at 70,000-plus merge conflicts. All figures are Cursor’s, on unreleased-tier model names, with no independent check.
A same-day post argues the opposite handoff. Stencil’s “/prewalk” claims agent cost scales with reads, not thinking: about 9% of tokens in a sample trace were edits, so a plan document throws away the 100K-token grounded context and makes both models re-read everything. Its benchmark has Opus planning and Gemini Flash executing at $3.18 and 84.6% pass, against Opus solo at $2.78 for the same pass rate. The alternative is to start on the frontier model, swap to the cheap one the moment the first edit lands, and prune the planning instruction, leaving the cheap model the live context plus one valid in-context edit. Self-reported results: roughly 92-97% of frontier pass rate at 53-61% of cost. Reliability came from a validation-gated todo list, not the edit trigger.
Google’s Gemini 3.6 Flash attacks the same bill from the model side at $1.50/$7.50 per million input/output tokens, with Google claiming 17% fewer output tokens than 3.5 Flash on the Artificial Analysis Index. A third variant, 3.5 Flash Cyber, is tuned for finding and patching vulnerabilities and goes only to governments and trusted partners, citing dual-use risk. Methodology is undisclosed.
Open weights and what they actually cost
Ben Thompson argues in Stratechery that the Chinese-model price gap is a compute-shortage artifact: open weights are free only in R&D, a fixed cost, while inference is COGS that scales with revenue, and demand currently exceeds frontier supply, letting labs price above marginal cost. His sharper point: tokens are not fungible, so the commodity is intelligence per correct answer, and Kimi K3’s lower sticker price is eaten by reasoning tokens. Meanwhile the Trump administration is reviving efforts to curb Chinese models after Kimi K3’s launch, first reported by Axios and summarized by Tom’s Hardware, leaning on procurement rules and Entity List threats rather than a ban that downloadable weights would defeat. In the same market, poolside shipped Laguna S 2.1, a 118B-total/8B-active MoE with up to 1M context under OpenMDW-1.1, and published every final-run trajectory, including a disclosure that an LLM judge once flagged over half its SWE-bench runs for using solutions found online.
Security
Pillar Research reports seven sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity, none of which break the sandbox: the agent writes a permitted file that an unsandboxed host component later executes, whether a virtualenv interpreter, a git hook, a .vscode task, or the Docker socket. Findings are self-reported with no CVEs or vendor responses cited. Relatedly, an audit of 19 package managers found 17 fork the git binary and only Go’s cmd/go passes --end-of-options, the flag that stops an untrusted ref being read as --upload-pack=<cmd>; Go added it in January 2026 as the CVE-2025-68119 fix.
Romania’s cadastre agency ANCPI was wiped after a failed extortion attempt, halting property transactions for a week, reported by Risky Business. An offline backup survived; the agency is rebuilding its network from scratch. Romania is at least the sixth country in three years to have its land registry breached.
Also
Lean maintainer Kevin Buzzard describes a summer in which models produced counterexamples to open conjectures and formalized them: he says OpenAI’s “Sol” generated 1.2 million lines of Lean in three weeks, against mathlib’s 2.3 million over nine years. Verification took him minutes, in a sandbox, because Lean runs arbitrary code. Separately, Flatiron Institute researchers report in Science that tensor networks plus belief propagation reproduced on a laptop the qubit-lattice dynamics a March 2025 D-Wave paper argued classical machines could not match.
What to watch today
- Whether anyone reproduces Cursor’s planner/worker cost split on a public harness, or the prewalk result on a standard SWE-bench setup.
- Vendor responses and CVE assignments for Pillar’s seven agent sandbox escapes.
- Whether the reported draft executive order on liability for hosted Chinese models actually surfaces.
- Gemini 3.5 Pro’s exit from partner testing, and who gets 3.5 Flash Cyber access.