September 2026 AI Release Roundup: The Month Agentic Work Got Cheaper and Cyber Capability Got Gated

Five significant releases landed between September 1 and September 14, and two patterns run through all of them. Running agents got materially cheaper, and the labs that shipped cyber-capable models put them behind verification programs rather than behind a credit card.

Everything below comes from vendor announcements and documentation. Where a number circulated widely without a vendor page confirming it, this roundup leaves it out.

Anthropic: Claude Fable 5.1 and Mythos 5.1

Anthropic announced Fable 5.1 and Mythos 5.1 with a system card dated September 1, 2026. The two share one architecture and differ in safeguards.

Pricing held at $10 per million input tokens and $50 per million output tokens, while cache reads dropped 75% to $0.25 per million, which works out to 2.5% of the standard input price. Anthropic puts the practical effect at roughly 25% less than Fable 5 for typical workloads and as much as 45% for heavily agentic work.

That gap between 25% and 45% carries the real news. Agentic workloads reread the same context repeatedly, so a cache-read discount compounds in a way a headline token price never shows. Teams that priced agent work earlier in the year and shelved it deserve a second look at the arithmetic.

Mythos 5.1 reaches users through the Cyber Verification Program for defensive security work and the Life Sciences Verification Program, which Anthropic built with the US government. Vetted US organizations qualify today, with international expansion planned through government coordination.

OpenAI: GPT-6 Astra

OpenAI released GPT-6 Astra as its most capable model, and the safety overview carries the detail that matters more than any benchmark: Astra became the first model to reach the Critical level of cybersecurity capability under OpenAI’s Preparedness Framework.

Expert assessments found that Astra, running without production safeguards, could discover previously unknown vulnerabilities and achieve arbitrary code execution in hardened browsers, plus build privilege-escalation exploits against hardened operating systems.

The safeguards shipped accordingly: stricter isolation, checkpoint encryption, and monitoring of full trajectories including chains of thought. On cyber jailbreak evaluations Astra refuses 91.5% of requests, against 59% for GPT-5.6 Sol. Access for advanced cybersecurity workflows started with a small alpha group and expands through Daybreak Blue to support defensive use.

Google: Gemini 3.8 Flash and 3.8 Flash Cyber

Google introduced Gemini 3.8 Flash and 3.8 Flash Cyber on September 2, its third Flash release in six weeks.

The standard model holds the introductory price set by 3.7 Flash at $0.75 per million input tokens and $3.75 per million output tokens, with gains in software engineering, agentic tasks, and multi-step reasoning.

The Cyber variant reaches trusted defenders through Google’s new Fairwind Program. On CyberGym, the industry benchmark for vulnerability discovery, Google reports frontier-level autonomous performance that surpasses both the earlier 3.5 Flash Cyber and significantly larger frontier models, plus a success rate above 70% across an internal benchmark spanning 20 programming languages.

Meta: Muse

Meta introduced Muse on September 8 as a personal AI agent powered by Muse Spark.

Muse sends emails, books travel, opens browsers, fills forms, and negotiates on a user’s behalf. It runs continuously in the background and returns when circumstances change or when it needs approval, and it integrates with everyday apps including WhatsApp. Meta ships it in the US on iOS, Android, and muse.ai, with support for AI glasses coming, on a free tier with paid plans for expanded capability.

This one targets consumers rather than engineering teams, and it still belongs in a roundup aimed at technology leaders. An agent that fills forms and negotiates on an employee’s behalf will reach corporate systems whether or not anybody planned for it.

DeepSeek: V4.1-Flash

DeepSeek shipped V4.1-Flash with an architecture aimed squarely at agent economics.

The model activates 16B parameters per token while decoding and only 8B while prefilling. More consequentially, it cuts the global KV cache footprint to 890 bytes per token, roughly a quarter of DeepSeek-V4-Flash, using Compressed Sparse Attention 2 with cross-layer KV cache reuse and FP4 KV caching. A deployment optimization called SWA Bounded Replay takes the persistent host or SSD footprint to an eighth.

DeepSeek states the reasoning plainly: cache-hit charges account for a large share of agent costs, so compressing the cache cuts those costs directly. From 04:00 UTC on September 14, all deepseek-v4-pro requests route to V4.1-Flash at V4.1-Flash rates until V4.1-Pro launches.

The Numbers Side by Side

Published rates for the models that carry public pricing, as their vendors state them:

Model	Input / 1M	Output / 1M	Notable
Claude Fable 5.1	$10.00	$50.00	Cache reads $0.25, down 75%
Gemini 3.8 Flash	$0.75	$3.75	Introductory rate held from 3.7 Flash
DeepSeek V4.1-Flash	Not restated here	Not restated here	v4-pro traffic rerouted from Sept 14, 04:00 UTC

Two cautions before anybody builds a spreadsheet on that table. Google describes its rate as introductory, which means it carries an expiry nobody has announced yet. And DeepSeek’s headline story concerns cache footprint rather than per-token rates, so comparing it on input price alone misses the part that changed.

The cache column deserves more weight than its size suggests. An agent that rereads a large system prompt and a growing transcript on every turn pays the cache-read rate far more often than the input rate, which is exactly why Anthropic’s typical-workload saving of about 25% widens to roughly 45% on agentic work.

What the Month Adds Up To

Agent economics improved from two directions at once. Anthropic cut the price of rereading context and DeepSeek cut the memory cost of holding it. Both vendors named agentic workloads as the reason. If your agent pilot died on unit economics before September, the arithmetic changed underneath it. Our inference cost playbook covers how to rerun that comparison across vendors.

Cyber capability became a gated product tier. Three labs, inside two weeks, shipped their strongest security models behind verification: Anthropic through CVP, Google through Fairwind, OpenAI through Daybreak Blue after a Critical classification. That convergence deserves its own treatment, which our guide to gated cyber model access provides.

Consumer agents arrived with system access. Muse acts inside browsers and messaging apps on behalf of a person who never filed a ticket about it.

Pricing pages move faster than roundups. Verify current rates at each vendor before you commit a budget to them.