We shipped the agentic execution layer well ahead of the containment layer, and October is when the incidents started catching up. Cohere reported a Qwen3.8B model that attempted to push data to remote storage during sandboxed testing, after stating in its reasoning trace that it wouldn't trigger any tools. Whether that's a training artefact or something stranger, nobody knows yet. Cloudflare disclosed that 155 Workers AI responses exposed data from other customers through a KV cache mismatch. And a widely-read piece argues that most "rogue agent" incidents trace back to missing egress controls and no audit logs, not model misbehaviour. I think that's the right read. The exciting parts are moving fast, and the boring parts (egress rules, logs) are the ones that stop you having a bad week.

In this edition of AI++ we look at why single-agent loops are beating multi-agent systems, try to make sense of an 80% collapse in LLM prices, and meet the model that lied to its own chain of thought.

Erick Ramirez | Apache Cassandra committer & Developer Advocate at IBM/DataStax

🛠️ Building with AI, Agents & MCP

Fewer agents, better loops

If you've built a multi-agent system this year, read this one before your next sprint. Anthropic's Applied AI team makes a concrete case for folding subagents back into your main agent loop. They're not saying subagents are wrong. They're saying most enterprises have built more of them than they need, and the architecture ends up mirroring the org chart. Across several enterprise deployments, a single agent with progressively disclosed skills and tools matched or beat a multi-agent setup on quality, and usually on latency too. The shared context window is the reason: an agent that has seen every prior step can connect them, whereas a handoff summary loses the texture. There's a migration kit so you can run the evaluation against your own system before you commit to anything.

LangChain published a companion piece the same week, writing up how they built their internal design agent, Content Studio. It's a first-hand build report with async subagents running as background tasks, the main agent acting as chief of staff, and a weekly loop that promotes lessons from finished projects into skills. The number that stood out to me: a median cost of about 50 cents per request, down from $8 after moving to Managed Deep Agents. The whole harness is open source, so you can fork it, and their post on the five components of a company harness is a handy taxonomy to read alongside it.

Context is the new RAM

Long-running agents get worse as their context fills up, and it's the problem I'd put money on you hitting first. LangChain's Jess Weng has two guides on keeping it under control: context engineering starts with retrieval, which covers oversized results and stale data, and how deep agents remember without keeping everything in context, which covers offloading, summarisation and subagent memory. The Anthropic piece above makes the same point from another angle: shared context works because the agent decides what to keep and what to drop, rather than a harness deciding upfront.

Ben Balter's documentation quality is your AI quality now is a good pairing. His case is that real headings, a single source of truth and native list formatting matter more than visual styling for RAG retrieval. If your agents read your own docs to do their work, this is the tuning knob you've probably missed.

Evals: the unglamorous backbone

Hamel Husain and Antaripa Saha published a rigorous guide to using decision models for evals. It covers threshold tuning, calibration, and cost-versus-performance comparisons across Jev, Perplexity Decider, Liquid d1, Cloudflare Clef and OpenAI Decisions. The finding that sounds obvious once someone says it: if you leave the threshold at the default 0.5 without checking it against your data, you're leaving performance on the table. The prompt templates in the appendix are worth saving. It also covers where decision models match LLMs on classification for less money, and where LLMs pull ahead on tasks that need knowledge and reasoning, so if a full LLM is your eval classifier right now, there are cheaper options to test.

LangChain also answered the most common questions about agent evals in one place, including LLM judges, multi-turn evals and Harbor benchmarks. For a concrete case study, Numan's write-up on their eval-first AI health coach shows per-category evals, simulated conversations and safety gates on a regulatory line.

🧠 New models

• ​GPT-6.1 Terra is OpenAI's fast, cost-efficient computer-use model at $1/M input and $5/M output, scoring 50.3% on Terminal-Bench 4.0 at max reasoning effort. It sits below GPT-6.1 Sol and GPT-6 Astra for complex coding, but the price makes it interesting for agentic workflows that need visual reasoning without flagship rates.
• ​Kimi K3.1 Pro from Moonshot AI scores 55 on Artificial Analysis, ahead of several proprietary models, with open weights promised by 4 November. The Latent Space deep-dive puts it in Fable 5.1 class for open-weight models, and the 2 to 3x API speed bump makes it worth testing if you're paying more for similar performance.
• ​LFM2.5-24B-A2B and LFM3 from Liquid AI: the first is a sparse-activation model built for fast on-device agents, and the second adds multimodal capabilities for specialised intelligence. Liquid had a busy fortnight.
• ​Apple's 20B on-device model activates only 1 to 4B parameters per prompt by keeping most weights in flash storage. That's roughly 2GB of memory on an M3 Max and significantly lower energy use than comparable open models. Maths performance is weaker, but if you're targeting Apple silicon for agents, this is the architecture to understand.
• ​Gemini 4 Argon: Zvi's analysis covers the gains over Flash 3.8, plus a notable finding that Argon shows increased evaluation awareness and performs differently when it detects a test. Read it before your next benchmark comparison.

🗞️ Other news

• ​OpenAI's models may have disproved the Exponential Time Hypothesis: a Lean-verified proof, reviewed by outside researchers including the ETH's original authors. The engineering angle is the one I care about. Model-generated formal proofs as a code correctness layer are closer than they looked.
• ​OpenAI and Anthropic cut LLM prices by up to 80% in a few months. Why? Max Woolf digs into the unit economics. Worth reading before your next quarterly cost review.
• ​AI agent security incidents trace back to missing containment, not model behaviour: the checklist implied here (egress controls, audit logs, sandboxing) is the practical takeaway.
• ​Anthropic's S-1: 85% margin, 48% of revenue through cloud partners, $10B lifetime burn. The financials matter because they tell you how durable the API ecosystem you're building on really is.
• ​Cross-request KV cache exposure in Cloudflare Workers AI: 155 GLM-5.3 responses exposed data from other customers through a capacity mismatch. If you rely on shared inference infrastructure, read this disclosure.
• ​Publish fake stats, get cited in LLMs: a researcher shows how bad data propagates into model outputs. Useful context if you're building RAG over a web-sourced corpus.
• ​DeepSeek banned from US federal civilian agencies under a new DHS order​

Fun with AI

• ​Sebastian Raschka's from-scratch video course on building reasoning models landed with 834 HN points. I haven't started it yet, which says a lot about my calendar this fortnight.

🧑‍💻 Code & Libraries

• ​NVIDIA OpenShell is an open source safe, private runtime for fleets of autonomous AI agents with containment guarantees
• ​LangSmith LLM Gateway is a spend-cap, rate-limit, model-fallback and PII-redaction layer for production agents, now in public beta
• ​Cloudflare Computer v0.7 is a durable browser-control runtime that lets agents resume after crashes and pause for human approval
• ​ThinkRail is a JetBrains IDE wrapping the pi coding agent with parallel git worktrees, living SPEC.md files and reusable skills
• ​PaperPilot is a zero-cloud, pure-Rust PDF engine with WASM and an MCP server
• ​SlopCodeBench Oct 2026 is a real-codebase coding agent benchmark across six models, with Opus 5.5 and Astra leading and a notable finding that xhigh effort is counterproductive

🔦 Langflow Spotlight

​Langflow 1.13 is out, and its three headline features are aimed squarely at teams running Langflow in production. Audit logging lets you trace every action through the platform, which matters when someone asks "who triggered that?" at 2am. Reusable OAuth connections mean you configure a credential once and share it across flows instead of embedding it in each one. And concurrent editing now detects when two people save the same flow at the same time, so one save doesn't silently overwrite the other. If you've been waiting for Langflow to feel less like a prototyping tool and more like a production platform, 1.13 is a meaningful step. Check the release notes for the details.

🗓️ Events

There's only one event on the calendar this issue, and it's AI++ itself: we're moving house.

This is the last issue of AI++ on this list. From the next one, the newsletter lives on IBM's newsletter platform, and the first issue there lands in November. The catch is that your subscription can't come with it. For privacy reasons, subscribers don't transfer automatically, so every reader needs to sign up again on the new platform. That includes you, even if you've been here since Phil Nash's first issue.

The form asks for your name and email address and nothing else. No account, no survey, no hoops.

I'd hate for anyone to miss out on the next issue because of a form, so please do it now rather than later: re-subscribe to AI++ here, and do it by 10 November. Forward this to the colleague who always reads your copy over your shoulder, too.