Two of today's stories are about someone else deciding what you get, and two are about the bill. Three federal agencies named six Chinese labs in a formal advisory and then recommended something unusual: that model providers subtly worsen responses for accounts they suspect. Meanwhile ordinary subscribers are watching their usage drain while they sleep, because the thing being stolen is not a password but a live session. Reducto dropped single-pass document parsing to a cent a page. And Ramp's numbers say the average price of a million tokens has fallen 41% since March, which is either the best news in your budget or the reason your favorite lab is getting nervous.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
The advisory names six labs — and asks providers to quietly serve worse answers to accounts they suspect
On September 8 the NSA, CISA and the FBI published joint advisory AA26-251A, accusing six China-based companies of industrial-scale distillation against US frontier models: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The scale claimed is billions of tokens across millions of requests since at least late 2024, arriving through three channels — native APIs, cloud providers, and third-party aggregators. The advisory says DeepSeek targeted reasoning and agentic behavior from GPT-4, GPT-5 and several Claude versions, and that Moonshot has been distilling since at least mid-2025.
The tradecraft section is the part worth reading closely, because it describes ordinary-looking accounts. Fraudulent registrations not tied to real users. Multiple accounts sharing registration details and payment methods. Bulk premium subscriptions split across teams of developers. StepFun is singled out for running pools of accounts with employees holding multiple concurrent sessions. Query volumes on a single topic ranging from thousands to millions.
Then the second recommended mitigation: "Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs." Read that as an engineer rather than as a policy analyst. It is a federal recommendation that providers degrade output quality silently, based on a detector, with no notification to the account. Detectors have false positives. The advisory does not say what happens to a legitimate customer whose traffic pattern looks like the description above — heavy concurrency, one narrow topic, high volume, a shared team plan — and neither does any provider's status page. The six named companies did not respond within the advisory itself.
For builders
Go look at how your team's API access is actually registered, because the tradecraft list reads like a description of half the startups I know: one bulk plan shared across a team, several accounts on the same card, high concurrency, thousands of near-identical prompts on one narrow topic. Move to per-developer keys under your org account rather than a pooled login, and put your batch jobs behind an identified service key with sane concurrency instead of a fan-out from personal accounts. Then add the cheap insurance: pin a small golden set of 20-30 prompts with known-good outputs and run it on a schedule against your provider, diffing quality over time. Silent degradation is by definition something you cannot get support to confirm — a regression harness is the only way you would ever notice it. Keep a second provider wired and tested behind a flag, not just listed in a doc.
Story II
Infostealers are draining Claude subscriptions, and the thing being stolen is the session, not the password
Grant De Swardt, an independent AI consultant in East Sussex, noticed on August 4 that his Claude Max usage was climbing while he was not working. He ran a controlled test — left the account alone, watched consumption go from 45% to 55% on its own. He was not alone. Reports on Reddit and GitHub describe the same thing: one user's quota went from 0 to 100% automatically, another burned 0 to 49% in twelve minutes.
Anthropic's explanation was specific: a bad actor using common infostealer malware to steal Claude login sessions from people's computers, then using those sessions to access the accounts. The company suspended compromised accounts, invalidated sessions and tokens, issued partial refunds — De Swardt got £44.49 back on a $200/month plan — and warned affected users that their machines may be infected.
Nothing here was an infrastructure breach, which is exactly why it should bother you more. A stolen session token walks past your password and your 2FA because it represents an authentication that already happened. And De Swardt's real complaint is the one every provider should answer: without itemized usage tracking, a subscriber has no way to detect this at all. You get a percentage bar. A percentage bar cannot tell you that half of it was spent from an IP in another country at 3am.
For builders
Do the five-minute version today: revoke all active sessions on every AI account you hold, rotate any API keys stored in plaintext, and then go looking for where those keys actually live. On a dev machine that usually means a shell history, a .env committed to a branch nobody merged, and a config file under your home directory — all of which are precisely what an infostealer grabs. Move keys into your OS keychain or a secrets manager and reference them by lookup, so a filesystem sweep gets nothing usable. Then set the alarm you do not have: if your provider exposes usage via API, poll it hourly into a small dashboard and alert on any spend during a window when you are demonstrably not working. That single check turns a month of silent theft into an hour of it, and it is the difference between arguing for a refund and pointing at a timestamp.
Story III
Reducto's r-1 does document parsing in one pass for a cent a page, down from three to six
Reducto released r-1, a single-pass document parsing model that folds OCR, layout detection, table recognition, formatting and grounding into one full-page step, replacing the company's previous multi-stage agentic pipeline. The pricing is the headline: a flat 1 cent per page, all-inclusive, down from 3-6 cents. It is in preview through the hosted Parse API v3, switched on with a settings.model: "r-1" flag. There are no open weights and no self-hostable checkpoint.
The quality claims deserve the discount they usually get. Reducto says r-1 cuts errors 20% — but that is against Reducto's own legacy pipeline, not an independent baseline. It also says r-1 beat Amazon Textract and Azure Document Intelligence in internal evaluations, with no public evaluation dataset released. Vendor-run benchmarks against competitors are marketing until someone else reproduces them. What is not marketing is the architecture change: collapsing a sequential multi-stage pipeline into one pass removes real latency and real failure modes, and that is a claim your own test set can settle in an afternoon.
For builders
If you run any document ingestion at volume, the arithmetic is worth ten minutes: 100,000 pages a month at 3-6 cents is $3,000-$6,000, and the same volume at a cent is $1,000. That gap is large enough to justify a real bake-off rather than a skim of the changelog. Build the bake-off correctly, though — pull 200 pages from your actual worst inputs, not clean PDFs: scanned invoices at an angle, multi-column reports, tables that break across pages, and anything in a script your current parser mangles. Score field-level accuracy on what you extract downstream, not a general quality impression, and measure end-to-end latency while you are there, since single-pass is where that win should show up. Two cautions before you migrate: preview APIs change, and there is no self-hosted escape hatch, so keep your current parser behind an interface you can flip back to rather than deleting it the week the invoice looks better.
Story IV
A million tokens now averages 68 cents, down from $1.15 in March — and per-employee AI spend just fell
Ramp, which sees spending data from 70,000 companies, reported that 56% of its customers paid for AI products in August 2026, but growth from July to August was 0.4% — essentially flat. Among the top 1% of AI-spending firms, per-employee spend fell nearly 10% to $7,205. And the number underneath all of it: average token costs dropped to $0.68 per million, down from a 2026 peak of $1.15 in March. For context on how early this all still is, a Census Bureau survey puts AI use across all US businesses at 22%, and only 6.4% of Ramp's AI-spending businesses touched a model-serving or inference platform at all in August.
There are two readings and the honest answer is that nobody can yet separate them. One is seasonal: August is a vacation month, and the historical pattern shows similar August-to-October dips. The other is structural: price competition between OpenAI and Anthropic is pushing customers toward cheaper, older models — ChatGPT 5.6-Terra, Anthropic's Sonnet tier — and volume has not grown enough to make up for the cuts. I lean toward both being true, which is the least satisfying position but the one the data supports. What I would not conclude is that demand is falling; a 41% drop in unit price with flat spend means people are buying considerably more tokens for the same money.
For builders
Take one thing from this into your own numbers: stop tracking AI cost in dollars per month and start tracking dollars per unit of work — per support ticket resolved, per document processed, per PR reviewed. Unit price fell 41% since March, so a flat monthly bill means your usage grew roughly 70%, and a monthly total cannot tell you whether that growth was useful or a runaway retry loop. It also gives you a real lever at renewal: walking into a negotiation with cost-per-ticket and a competitor's current rate is a different conversation than asking for a discount. And if you have been paying frontier prices out of habit, run your evaluation set against the cheaper tier the market has been moving to — the quiet story in this data is that a lot of companies already tried that and did not switch back.
— The Vibe Gate news desk. We read the firehose so you can keep building.