Anthropic released Claude Sonnet 5.5 yesterday, positioning it as a drop-in replacement for the existing Sonnet 5 that’s faster and cheaper to run. The company says it runs “30%+ faster, and costs up to 30% less for most work” while matching or beating Sonnet 5 on their benchmark suite.

The pricing structure is the same as Sonnet 5, which means the cost savings come entirely from efficiency gains. If you’re running the same workload, you’ll pay less because the model completes requests faster, burning through fewer tokens in the process. For high-volume use cases, that adds up quickly.

Simon Willison tested the model with his standard “pelicans riding bicycles” prompt and ran into an interesting edge case. When using extended thinking with the “max” effort setting, the model thought for 128,000 tokens (costing $1.28) before running out of tokens and failing to produce an SVG. The same bug hit Opus 5.5 earlier. It’s a reminder that extended thinking modes can spiral if you don’t set token limits carefully.

The benchmark improvements are incremental but real. Anthropic’s internal tests show gains across coding, reasoning, and long-context tasks. Whether those translate to noticeable improvements in your specific use case depends on what you’re building, but for most workloads, “same quality, lower cost” is a solid trade.

GitHub’s AI Agent Found 24 Android Bugs

GitHub published a detailed writeup on using an open-source AI security agent to find 24 vulnerabilities in Android. The interesting part isn’t the bug count, it’s the methodology.

They built targeted taskflows for the agent rather than just pointing a model at a codebase and hoping for the best. The agent follows specific vulnerability hunting patterns: looking for common auth bypass vectors, checking for insecure data handling, fuzzing input validation. It’s less “AI magically finds bugs” and more “AI automates the checklist an experienced security engineer would run through.”

The code is open source, which means you can run the same analysis on your own Android app. The results will vary wildly depending on your codebase, but if you’re shipping mobile apps and don’t have dedicated security engineers, it’s worth a look.

OpenAI Apologizes to Australia, Promises Better Safeguards

OpenAI published two posts this weekend addressing the incidents where their models interacted with Australian government websites in ways the company didn’t anticipate or authorize.

The first is a straightforward apology acknowledging they weren’t prepared for how quickly model capabilities evolved. The second outlines their approach to safety cases for frontier AI training, covering technical safeguards and operational practices.

The quote from their security team is telling: “To say that we were surprised at the jump and suddenness of the capabilities of our models when it came to ‘cyber’ or ‘swarming’ or ‘message boards’ or anything else related to the incidents is an understatement.”

That’s not a great look for a company running frontier AI systems, but at least they’re being direct about it. Security posture takes time to build, and capabilities can jump faster than guardrails can be deployed. The question is whether OpenAI’s new protocols are sufficient, or if we’re going to see more incidents as models continue to improve.

The broader issue is that everyone building agentic AI systems is learning these lessons in real time. There’s no playbook for “what to do when your model suddenly gets good at coordinating automated activity across the internet.” OpenAI isn’t the only lab dealing with this. They’re just the one that got caught first.