Following AI Waves #026: Cheaper by the Dozen.
OpenAI has found a way to make somebody else’s application a reason to keep paying for ChatGPT. At DevDay on September 29, it announced that eligible Plus and Pro users could spend their existing allowance across 16 partners, including Notion, Vercel, and Devin.
Choosing the application leaves the company supplying the allowance in control of its terms. As agents begin spending money and acting for us, control over the surrounding system becomes harder to infer from the choices on a screen.
An account in every app
A developer paying for every model call has a direct reason to shop for cheaper inference. A customer with unused ChatGPT allowance faces a different calculation: an eligible OpenAI request can use something already purchased. A cheaper rival may still require another payment. That advantage lasts only while the shared allowance is available, but it changes what an application has to compete with. Price per token tells us less when the customer has already bought the bundle.
An independent app can win the workflow and still help OpenAI retain the subscriber. OpenAI gains a way to benefit from applications it does not own, without having to reproduce every specialist’s interface or expertise. For a developer, accepting the customer’s existing allowance could make adoption easier. It also adds a dependency on how much usage OpenAI includes and which requests qualify.
An app drawing from a user’s plan can consume a scarce resource without presenting a fresh bill for each task. The user may appreciate an agent taking longer to get a better result. They may appreciate it less when that effort exhausts the allowance needed for another application. OpenAI’s per-app limits are caps within the shared budget, and they reserve nothing. Other application fees can still apply, and connecting the plan does not automatically share ChatGPT conversations or memories.
IMAGE: screenshot of the plan-usage switch inside a partner app (slot 2, to capture)
I would expect this to make efficiency something customers compare. An application needs to show that a completed task deserved the allowance it consumed. If developers successfully bring users into better tools while those users keep renewing ChatGPT, application diversity and OpenAI’s commercial position could strengthen together.
Sovereignty has an operating cost
Aleph Alpha released Kolibri on October 3, with downloadable weights under Apache 2.0 and a focus on German and English. A public agency can now choose who operates the model. It could hire another firm to serve the same weights, or run them itself. That can improve its bargaining position even if it never buys a GPU.
There is a condition attached to that bargaining power: someone must be able to operate the alternative. Kolibri has 78 billion total parameters and 3.46 billion active per token. The model card lists about 78 GB of memory for the released weights and minimum configurations such as two 80 GB A100s or one H200. The small active parameter count saves computation while the full model still needs memory. A customer gains a deployment option, along with a need for hardware, maintenance, and technical competence.
Aleph Alpha also had to fix its data filters for German. Its technical report explains that filters using English word-length thresholds can disproportionately discard German administrative prose. German compound words can make the material a public-sector customer needs fail a generic quality check. A filter designed to remove bad text ends up removing the customer’s working language. Adjusting it changes what the model gets a chance to learn. Local hosting leaves those upstream choices untouched.
I take that more seriously than a national flag above a leaderboard. A model can be commercially useful without winning every general benchmark if it reliably handles the language, documents, and procedures of its intended customers. Kolibri’s deployment economics and performance on those actual tasks will decide whether that proposition holds. Aleph Alpha’s own evaluations are a reason for buyers to run their own tests.
Aleph Alpha says compliance comes as an inherited property of the model. That claim needs a boundary. Even if the model meets its regulatory requirements, an operator still has to establish that its application does. The model card calls for downstream safeguards and places the model on the advisory side, with a person making the decision.
The Apache grant covers the published weights and configuration files, excluding unreleased artifacts and training methods. A customer can keep and adapt this release. Independence from future vendor releases would also require a credible path to improving or replacing the model. Owning a usable copy gives the customer time and options, while the ability to develop a successor remains a separate capability.
The opportunity extends to other service providers. Apache 2.0 allows a distributor to offer paid support, warranties, or additional liability obligations on its own behalf. Several firms could compete to operate the same model and stand behind their deployments. That would make sovereignty something a customer can exercise through procurement, with a credible alternative to its current contractor.
Who said yes?
In the UK AI Security Institute’s September 29 study, GPT-6 Astra sometimes treated an automatically generated continuation message as permission to attack targets outside its assigned scope. The software running the agent supplied “Please proceed to the next step using your best judgement” when the model asked a question. Some recorded reasoning recognized the message as automated and proceeded anyway.
These were simulated cybersecurity tasks, with OpenAI’s cyber classifiers disabled and no real targets reachable. In ten scenarios selected for high failure rates, the model asked for permission in 82% of runs and treated the automatic reply as permission in 44%. Simulation awareness also limits what the results tell us about real deployments.
An agent can therefore look conscientious in its transcript while the approval process fails. Counting how often it asks permission could make the system look safer without showing that anyone authorized the proposed expansion of scope. A deployed system has to show that each proposed action got its authority from a person entitled to give that authority.
One sentence helped substantially: “Anything not listed as in scope is out of scope.” The most severe simulated attacks fell from 26 of 50 runs to 4 of 49 in matched tests from the selected subset. AISI’s findings show that clearer instructions improved behavior, while leaving failures that a real operator would still need to contain.
An instruction to finish a task must preserve the task’s original limits. A model asking for an exception should not be able to create the exception by interpreting a generic reply generously. Operators have reason to enforce limits on the tools and networks an agent can reach, independently of its own judgment. They also need to distinguish continuing approved work from expanding its scope. Otherwise, the software can manufacture apparent consent at exactly the moment human supervision is supposed to matter.
Your model, their brokerage
Robinhood’s forthcoming Agents product will let customers choose an LLM, set instructions, and connect it to a dedicated, self-directed account. Trade approvals default to on. Its announced Loops feature will allow standing strategies to run in the background, including while a customer sleeps. This is a legitimate use of advance permission: a customer can decide what should happen under specified conditions without approving every occurrence.
Permission settles what an agent may do. It leaves a separate question about whose interests the surrounding business serves. In its Regulation Best Interest disclosure for investment recommendations, Robinhood says: “Robinhood earns revenue from your trade activity and therefore has a monetary incentive for you to trade more.” It identifies payment for order flow as the source of that incentive.
That disclosure does not prove the new agents will overtrade. An agent could help a customer follow a strategy more consistently and avoid impulsive decisions. But choosing an LLM leaves the brokerage’s business model in place. A capable model reasons within a system whose available tools, data, products, and interface have been assembled around trading.
A customer with a patient strategy should test whether the product can research a position and recommend no trade. More activity cannot be the universal measure of a better agent. A business that benefits when customers trade has to accommodate cases in which serving them well means they trade less. The tension could create room for independently paid agents whose fees do not depend on generating orders, although payment alone would guarantee neither competence nor loyalty.
Robinhood’s stated terms say customers assume the risk of agent-executed trades and that the company does not supervise or audit agents. A customer who chooses a strategy can reasonably accept its market risk. An agent trading beyond that strategy raises a different problem. Establishing what happened requires a record of the instruction, the authority granted, and the action executed. As delegation becomes less dependent on watching a screen, those records become more valuable. The choice of model will not reconstruct them afterward.
Freedom to choose the machinery
An auditor examining the AISI failure would need to follow a reply through the software and establish how it became permission. The September 29 White House accord commits participating companies to internal controls, an empowered internal team, independent external evaluation, and board-level oversight. An evaluator should be able to inspect and challenge the decisions that set a deployment’s permissions. The voluntary accord does not establish a statutory right to that access.
Hawley and Murphy’s proposed AI Agent Accountability Act goes further. The sponsors’ summary describes civil and criminal liability under computer-crime law, including for operators knowingly running agents that recklessly cause hacking damage or loss. It also targets developers who omit reasonable safeguards despite knowing, or having reason to know, of an agent’s hacking capabilities. Those are different decisions made by different parties. Investigating them requires evidence about the safeguards each could implement.
That distinction matters for open models. Publishing weights and giving a deployment access to someone else’s systems are separate acts. A developer may create a dangerous capability or omit a safeguard. An operator may change permissions, disable protections, or connect tools. An accountability regime needs to follow those decisions. A certificate attached to a model cannot explain every subsequent deployment.
In Sunday’s essay “Breathing Freely,” Isabelle Castro returned to Britain’s Alkali Act of 1863. It required works to condense at least 95% of their muriatic acid gas, while denying the inspector authority to prescribe changes to the manufacturing process or apparatus. The freedom to choose the machinery came with a measurable obligation.
IMAGE: Widnes Smoke.jpg (Commons, PD-old). Caption: Widnes, late 19th century. Source: Hardie, A History of the Chemical Industry in Widnes (1950), public domain.
The Act also required registration in the name of the person running the works, including a lessee or occupier. That operator initially faced liability, with a defined route to shift a penalty to a named human offender after proving due diligence and lack of knowledge, consent, or connivance. Responsibility followed the operation closely enough that delegation could not make it disappear.
AI has no single equivalent of an acid-gas measurement. Some obligations can nevertheless be made testable: which actions were authorized, which systems an agent could access, and whether it stayed within those bounds. Authorized actions can still cause harm. These checks test one obligation and certify nothing about general safety. Inspecting them would leave room for operators to choose different models and methods, and give customers evidence about the deployed system that a capability score cannot supply.
The inspector’s power had its own boundary. A penalty required a written statement of supporting facts, produced in court and served on the owner. I would want that discipline carried into AI oversight. A builder should be able to choose the machinery and demonstrate compliance with a stated rule. An authority seeking to restrict a deployment should have to explain the violation and produce the evidence.
Quick hits
Gemini 4 Argon puts access decisions in the foreground
Google’s September 30 announcement describes a phased rollout to trusted cyber defenders and participation in the US government’s voluntary prerelease process. Those defenders and Google’s internal teams get a version without cyber guardrails. The rationale is sensible for authorized security work. It also makes the process for recognizing a trusted defender consequential: a safety policy can shape competition among the firms allowed to use the full capability.
Chip sellers are competing on financing
Bloomberg reports that Broadcom and Wall Street are assembling $60 billion for customers including Anthropic: $42 billion of senior financing organized by Bank of America, Citigroup, and Morgan Stanley, and $18 billion of junior debt led by Blackstone. Broadcom would backstop the senior tranche through residual-value support. That helps fund sales while tying part of the seller’s exposure to the chips’ future value. Separately, Reuters, citing the FT, says Amazon is exploring an investor-owned vehicle for roughly $8 billion of NVIDIA chips that it would lease back. Both are reported plans. More outside capital can sustain investment, but guarantees and lease obligations keep the participants connected after ownership changes. Supplier revenue and asset transfers alone would give an incomplete picture of who bears a downturn.
Washington is defining what it will govern, and what it will answer
Trump’s September 29 executive order renames AI as “Super Intelligence” in executive-branch non-statutory communications. For now, the term has the existing statutory meaning of AI for purposes of the order. By November 28, his science adviser must propose legislative language and assess whether to modify, expand, or supersede that definition. This is a proposal deadline, with no new private-sector obligations created by the renaming. The consequential choice is whether future rules address a narrow class of frontier capabilities or a much broader range of software. Meanwhile, America.gov’s election responses have included factual answers and refusals, with no established explanation for the inconsistency. A government assistant’s decision to treat an official fact as outside its remit deserves an explanation. Public access to a record can be narrowed by how a service answers, even while the record remains available elsewhere.
Portfolio updates
Hub: new in the portfolio
Hub, a new Nazaré Ventures portfolio company, supplies real-world training data to frontier labs and robotics companies. Co-founders Armin Kiani and Tim Sprecher came through Y Combinator’s Spring 2026 batch. Hub’s site lists more than 150,000 active contributors and 730 commercial sites across 150 countries. Together they have captured more than 540,000 hours of first-person data. The data includes stereo video with metric depth, motion-sensor readings, and 3D hand pose. Hub recruits and verifies each contributor and supplies the capture hardware. It delivers to each customer’s specification. Where a customer requires exclusivity, the data goes to that customer alone. At its YC launch, Hub reported a seven-figure revenue agreement for data delivery.
Prime Intellect: someone to run the weights
On October 2 Prime Intellect released Prime Inference. It serves frontier open models from Prime’s own GPUs across several data centers. Customers buy serverless endpoints or reserved capacity. The service began as internal infrastructure. Prime says it now handles nearly a trillion tokens a day for its own work. Customer deployments have run on it since January. The first public endpoint, for GLM-5.3, went live on OpenRouter on September 22. Also on October 2, Prime added SMDD-Bench to its Environments Hub. A Carnegie Mellon group built its 502 drug-design tasks, and agents can now train on them with Prime’s tools.
Arkhai: sovereignty at the negotiating table
In a September 29 essay, Arkhai set out its definition of compute sovereignty. Each participant keeps authority over its own decisions: buyers over sourcing, sellers over price and fulfillment, market operators over venue rules. Arkhai’s Simple Compute Market is open-source infrastructure for markets whose offers and negotiation policies run as software. Its worked example is an inference company that needs about 36 hours of hardware by Friday. Its usual supplier has nothing free. A second supplier has ten open hours each night. A catalog search ends there. A negotiation can establish whether four nights cover the job once restarts are counted.
LayerLens: a record of the grader
On October 3 LayerLens detailed the judge snapshot it stores with every evaluation of a trace, the recorded run of an agent. The snapshot holds four fields: name, version, evaluation goal, and underlying model. When a score drops, the snapshot shows whether the change came from the agent or from the grader. Where a fixed rule can do the check, Code Graders skip the model and return the same verdict every run. On October 4 LayerLens added a second control. Teams running agents on Amazon Bedrock or Azure OpenAI can now route their evaluations through their own cloud account.