Everybody is a router now — and one of them will sell you a model with the refusals filed off
Sunday, September 6, 2026·8 min read·4 stories
Four stories today on one axis: the model your task runs on is increasingly not the model you chose. Spotify put a cheap reader in front of the expensive one and published the plugins. GitHub's Copilot CLI now assembles a plan per task across several models. The benchmark half of you quote in planning docs just changed its own arithmetic. And a startup will sell you a well-known open model with the refusals removed, billed by the token like anything else.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Spotify open-sourced the Claude Code plugins behind a 90% cut in bulk-read tokens
On September 3 a Spotify engineer published the arithmetic most teams are avoiding: engineering leaders are burning $200-$500 per developer per month on coding-agent tokens, with outliers past $2,000, and on the current curve AI coding cost passes the average developer's salary by 2028. The fix shipped alongside the post. Portal is Spotify's platform for declarative agents on ephemeral runtimes, and two plugins expose it to Claude Code: portal and shunt.
The mechanism is dull in the good way. Instead of your expensive model reading whole files into its own context, a cheaper model behind Portal reads them and returns a summary. Measured against a Java monorepo across four scenarios — tokens Claude would have spent reading directly versus tokens spent on the summary — mean savings came out around 90% for bulk-read operations. Defaults worth knowing: files over 350 lines get shunted (configurable), temperature 0.2, and each Portal invocation costs 10 to 30 seconds with a 30-second ceiling.
Read the claim precisely. It is 90% on bulk reads, not 90% off your monthly bill, and the honest tradeoff is in that latency line: you are buying tokens back with wall-clock time and with whatever the summarizer dropped. Install is three commands — claude plugin marketplace add spotify/portal-ai-plugins, then claude plugin install portal@portal and shunt@portal — followed by /portal:setup. The shunt plugin's source is on GitHub.
For builders
Do this as a measurement, not an install. Pull your last 30 days of agent spend and find what share went to file reads — if you can't answer that, that is the first thing to fix, not the token count. Then run one real task both ways on your own repo and compare three numbers: tokens, wall-clock, and whether the diff still passes review. The 350-line threshold is the knob that matters; on a codebase of small files you will pay 10-30 seconds per shunt for savings that never arrive, and on a monorepo of 2,000-line service classes you will feel it immediately. Set the threshold from your own file-size histogram, which is one find and one awk away.
Story II
GitHub's HydraFusion builds a plan per coding task — and the cost numbers are better than the quality numbers
GitHub opened a research preview on September 5 of Project HydraFusion in Copilot CLI: instead of sending every prompt to one model, it assembles an execution plan per request across models from several providers. Three patterns. Single sends one model at the problem. Cascade lets an efficient model draft and escalates through a quality gate when the draft fails it. Critique has one model draft, a second review, and the first revise.
The published numbers, measured against a Claude Opus 5 baseline: TerminalBench 2.1 at 67% lower cost and 4.9 quality points higher; DeepSWE at 36% lower cost and 1.5 points lower; CheckpointBench at 65% lower cost and 0.1 points lower. Read those as three different bets, not one result. On two of three benchmarks you are trading a small quality loss for two-thirds of the bill, which is a fine trade for a test-fixing loop and a bad one for the change that ships on Friday.
Availability is the catch. It is a research preview limited to Copilot CLI across all Copilot plans, with no open weights and no self-hosted path, so the routing logic is a black box you rent. Turn it on with /update, then /experimental on, then /model and pick HydraFusion (Research Preview). Billing stays per-token at each underlying model's standard rate, which means the savings are real savings and not a bundled subscription trick.
For builders
Route by stakes, not by default. Put HydraFusion on the work where a wrong answer costs you a rerun — test repair, lint sweeps, doc generation, first-pass refactors — and keep a single named model on anything that touches auth, money, migrations, or a public API. Two hours of setup: tag your repeat tasks into those two buckets today, run a week on the cheap bucket, and compare rework rate, not satisfaction. If your rework rate climbs more than the cost fell, you found your line. And log which pattern ran per task if the CLI exposes it, because 'Cascade escalated' and 'Cascade did not' are two different products sharing one name.
Story III
Artificial Analysis rebuilt its Intelligence Index after its own Astra score drew fire
Artificial Analysis shipped version 4.2 of its Intelligence Index on September 5, and the headline effect is that GPT-6 Astra gained four points on its predecessor Sol, where the two had been tied. The revised order puts Claude Fable 5.1 first, Astra second, Meta third. What changed underneath: AA-Briefcase (real-world knowledge work) and Surge AI's GDP.pdf (PDF document analysis) were added, GPQA-Diamond was dropped on the grounds that models have solved it, scoring errors were corrected across several benchmarks, and grading was adjusted for stability.
The pressure that produced this is worth naming. AA's initial reading had Astra roughly level with Sol while Epoch AI ranked it first at 169 points across more than 50 benchmarks and ARC-AGI-3 showed a large jump — a gap that big between indices is a measurement problem, and to AA's credit they treated it as theirs. Private test data now carries 40% of the weighting, which is the part that ages best: it is the only defence against a benchmark being trained on. Version 5 has been in development for eight months and rolls out gradually.
The uncomfortable read is that a composite index is a set of editorial choices with a number stapled to it. Removing one solved benchmark and adding two new ones moved a frontier model four points without any model changing at all. That is not a scandal, it is what compositing does — but it does mean the number is not measuring what your users will feel.
For builders
Stop pasting a composite score into your model-selection doc. Take the two hours this week to build a twenty-item eval from your own logs — real prompts your product actually received, with the outputs you would have wanted — and score candidates on that. It will disagree with every public index, and yours is the one that predicts your support tickets. If you must cite a public number, cite the sub-benchmark closest to your workload rather than the headline, and write down the index version and date next to it; a score without 'v4.2, September 5' attached is unfalsifiable six weeks from now.
Story IV
Removing a model's guardrails is now a paid API, and the base model was already refusing nothing
A US startup, Abliteration.ai, has been selling guardrail-stripped open-weight models over an API since late August, at $5 per million input or output tokens. The current offering is an abliterated GLM-5.3, following an earlier build on GLM-5.2. Its own published figures: 84.5% on CyberGym, 41.8% on Terminal-Bench 4.0, and 105 tasks solved in two hours on ExploitGym. It says prompts and responses are not stored, and that it retains operational metadata — tokens, timestamps, billing.
The number that should reframe this for you is not any of those. Per SaferAI, the unmodified GLM-5.2 refused zero tasks in its offensive security evaluations. The service is selling a removal of something that, for this class of work, was not meaningfully present. The research picture is mixed in a way worth holding onto: some work finds refusals can be sharply reduced without a comparable drop in code-generation quality, while other work finds behavioural changes even on tasks the base model never refused. So an abliterated model is not simply 'the same model, more compliant' — it is a modified model whose other behaviours you have not measured.
For builders
This is a supply-chain item, not an ethics debate. Two concrete moves. First, pin provenance: if you pull open weights, record the exact repo, revision hash and licence in your lockfile the way you would a dependency, and fail your build on an unpinned model — 'abliterated-model-large-v2' and a stock GLM-5.3 will happily answer to the same nickname in a config file. Second, delete the assumption that a refusal is a control. If your product's safety story anywhere reads 'the model won't do that', replace it with something you own: an allowlist on tools, an output classifier you can test, and a rate limit. A base model refusing zero offensive-security tasks is the evidence that the layer you were counting on is not load-bearing.