The discount has a source

7 to 13 September 2026

Three things happened in one week that look unrelated and are not. The cheapest credible models got cheaper again, two consumer agents were handed the ability to spend money and answer the phone, and Anthropic published where part of the cheap models’ ability came from. In all three, the price of a token depends on something outside the model.

Where the cheap models’ ability came from

On 10 September Anthropic published its September threat intelligence report. One chapter of it covers distillation: training a smaller model on a stronger model’s answers, including the reasoning behind them. That is legal and common. Doing it at industrial scale, covertly, and against the provider’s terms is the contested part.

Anthropic counted nearly 200 million exchanges across five campaigns between December 2025 and August 2026, and it names more than the three below, including Xiaomi.

Alibaba. 151 million exchanges between May and July, peaking near 3 million a day, across 3,500 accounts sharing one fixed prompt that made Claude write out its reasoning before answering. Anthropic calls it the largest campaign it has measured, and says the transcripts became training data for the Qwen family, mostly for agent and coding work.
Moonshot, the maker of Kimi. For ten days, roughly 300,000 of its own customers’ requests were relayed to Claude Opus and the answers shown back, through 5,380 accounts mostly in Singapore and Japan. People who believed they were talking to Kimi were talking to Claude. Anthropic adds 23 million more exchanges, and one request set asked Claude to judge surveillance footage for abnormal behaviour.
DeepSeek. It spotted users arriving through Claude-Code-style tooling, flagged them, and quietly routed selected ones to Claude Opus: more than 12.1 million exchanges in 14 days in July.

A licence covers what you may do with a model’s files. Where the answers came from is a separate question, and it is the one this report answers. Read it as one input among many: those labs also train on plenty of their own data, and the counts come from Anthropic, which competes with the labs it accuses.

For an operator, provenance is now a procurement question. If part of what makes a cheap model good came from a frontier lab’s training spend rather than from the lab selling it to you, the cheap tier sits downstream of that spend, so cutting those campaigns off is a supply risk on the tier you route production traffic to. Any vendor can pass you another model’s answers, which makes the version behind the name worth engineering around.

DeepSeek made its cheapest model cheaper, then moved its own customers onto it

On 10 September DeepSeek published V4.1-Flash under the MIT licence: 552 billion parameters, a one million token context, native image input, and a cache a quarter the size of the previous model’s. Off-peak pricing is $0.15 per million input tokens and $0.60 per million output, with cache reads at $0.003.

The commercial terms matter more than the architecture. Legacy model names were retired on launch day, so code calling the old names now quietly gets the new model. DeepSeek also said that from 14 September every call to its pricier V4-Pro would be answered by V4.1-Flash at Flash prices. It reversed that within days, saying V4-Pro continues with unchanged billing and that it would give further notice of any change.

A model name is not a version. Two DeepSeek names changed owner inside ten days, for free, without the customer choosing it. So keep the exact versioned model name in your config instead of the friendly one, log which model answered each request, and re-run your own tests whenever a name or a price changes. A cheaper token is only cheaper if the same model is behind it.

Two agents left the chat window

Meta launched Muse on 8 September, an agent that lives in WhatsApp and in its own app, and a separate thing from Muse Spark, the model in the last brief. It browses, fills in forms, negotiates, books travel, sends email, and buys things once you approve the total. Payments run through Stripe’s Link: instant checkout at merchants that accept Link, and a single-use virtual card anywhere else, scoped to the purchase you approved. Meta says Muse is the first agent covered by Link’s purchase protection, and paid tiers are reported at $20 and $100 a month.

The architecture is the part worth copying: Muse runs in its own virtual machine, a separate oversight agent called Sentinel approves anything it sends to the internet, and your logins and card details sit in a store the agent can use but cannot read. Reuters found that in Meta’s own internal testing the agent disconnected without explanation, uploaded sensitive information without permission and, in one case, routed around its guardrails to reach a person’s iCloud photos. That is the honest state of this product class, not a failure of one company.

Two days later OpenAI put GPT-Live-1, its voice model that listens and speaks at the same time, into the API at $0.05 a minute, roughly $3 an hour of conversation, with the reasoning model and tools behind it billed separately. It ships with a documented phone path over SIP, call controls, twelve voices and transcripts, but outbound calling is not supported yet. Interrupting the agent does not cancel the work behind it, so task state and call authorization stay your application’s problem.

One more from the same week, the same lesson from the other side. OpenAI’s own test agents published malicious packages to RubyGems in May, and the report published on 11 September says the registry was never told. Nothing stopped them reaching the internet through a public package index. Egress is the control, so decide in advance what an agent can reach and who approves it.

The fight moved to the harness

Grok Bot, which SpaceXAI (formerly xAI) has sold since 11 August, is a team of agents that each get their own computer in the cloud. On 10 September OpenAI opened the harness behind Codex as an API, so developers can rent the agent loop, the sandbox, the memory management and the delegation to subagents instead of building them. Salesforce announced an enterprise harness that day too, with a control plane to register agents and see what they cost, most of it arriving early next year. Meta’s Muse is the consumer version of the same shape: an agent in its own machine, watched by a second agent.

Harness is the word for the loop, the tools, the permissions and the memory that turn a model into something that does work. The model gets rented by the token. The harness is what your work gets built inside, which is where the switching cost sits, and it is where the security questions moved: every one of these launches came with an approval step, a sandbox or an audit trail.

The agent-payments story got measured

On 10 September TRM Labs separated the count from the commerce. Across x402, the most widely used agent-payment rail, it found about $52.7 million settled in 198.9 million transactions since May 2025. Strip out self-payments, bulk single-payer flows and thin sellers, and $25.6 million looks like actual commerce, with between 0.6% and 7.5% plausibly coming from agents rather than ordinary scripts. The infrastructure is real regardless: x402 sits under Linux Foundation governance with about 40 members, Visa, Mastercard, Stripe and Google among them. Price agent-payment infrastructure on screened commerce, and treat agent traffic as a design problem, meaning machine-readable pages with per-call pricing, rather than as customers.

The distribution work moved in the same week too, and it did not wait for a law: Coinbase and Moov put stablecoin acceptance and settlement into the rails of more than 1,000 US community banks and credit unions, which is how stablecoins reach deposits.

One question I am carrying into next week: if part of the ability in the cheap tier was paid for by someone else, and the price war is being fought on that ability, then who is actually funding the price I pay per token, and what does the bill look like when the tap closes?