Sonnet 5 inflates tokens 30%, OpenAI omits prompt leak, Nano Lite drops images

TL;DR

• Claude Sonnet 5’s new tokenizer emits 1.42× English tokens, a silent ~30% price hike.
• Sonnet 5 removes temperature, top_p, and top_k, breaking temperature=0 eval harnesses with HTTP 400.
• OpenAI’s postmortem omits that analyzed core dumps almost certainly held user prompts.
• Nano Banana 2 Lite returns HTTP 200 with no image on safety blocks, breaking bulk pipelines.
• Nano Lite trails full Nano Banana 2 by 19 Elo at roughly 5× the speed.

Today’s three AI-tech leads land on different stack layers — a frontier chat model, a runtime crash postmortem, and an image-generation tier — but they rhyme in an uncomfortable way. Each vendor’s headline talks about one thing while the ship itself changes another. Anthropic frames Sonnet 5 as a launch; the tokenizer inflates output ~30% and the API quietly deletes sampling params. OpenAI publishes a satisfying libunwind detective story; the core dumps under analysis almost certainly held user prompts, and the post doesn’t say so. Google benchmarks Nano Banana 2 Lite against its bigger sibling; the non-configurable safety layer silently returns HTTP 200 with no image, which is the exact failure mode the millions per day pitch can’t absorb.

The through-line for integrators: read the changelog for what it doesn’t mention. The round-ups then swing wider — a shot-scraper release for agents that need to prove their work, a fresh prompt-injection class against AI browsers, and Hugging Face pulling third-party evals onto model pages.

Claude Sonnet 5 hides a 30% price hike in its tokenizer

Source: simon-willison · published 2026-06-30

TL;DR

• Sonnet 5’s new tokenizer emits ~30% more tokens: 1.42× for English, 1.27× for Python, ~1.0× for Mandarin
• Commerce invoked export controls, pulling Fable 5 and Mythos 5 for 3 weeks before Sonnet 5’s June 30 launch
• Sampling params are gone — passing temperature, top_p, or top_k now returns HTTP 400, breaking temperature=0 eval harnesses
• SWE-bench Pro puts Sonnet 5 at 63.2% vs Opus 4.8’s 69.2% — a ~6-point gap on coding

The tokenizer tax

Anthropic held the sticker price flat — $3/$15 per million tokens, with an intro discount to $2/$10 through August 31 — but changed how tokens are counted. Simon Willison ran the Universal Declaration of Human Rights through his token counter and got 3,341 tokens on Sonnet 5 vs 2,356 on Sonnet 4.6, a 1.42× expansion. Python code came in at 1.27×. Simplified Mandarin was essentially unchanged at 1.01×, which tells you where the previous tokenizer had already been optimized.

Independent gateways confirm this isn’t a measurement quirk. TrueFoundry, routing traffic through their own proxy, pegs the expansion at 1.0×–1.35× and notes it “partially offsets the advertised 80% cost savings vs Opus” ¹. On r/ClaudeAI, developers running hard reasoning tasks report Sonnet 5 at “Extra High” effort ends up slower and more expensive than Opus 4.8 at “Medium” — with worse output ². The introductory discount reads less like generosity and more like cover for the token inflation.

The export-control backstory

Willison quotes the system card’s line about Sonnet 5 being “significantly less capable at cyber tasks than Mythos 5” without unpacking why that sentence exists. The context is dramatic: the Commerce Department invoked the Export Control Reform Act after Amazon researchers bypassed Fable 5’s safeguards to identify software vulnerabilities, forcing Anthropic to disable both Fable 5 and Mythos 5 for nearly 3 weeks. Restoration landed on June 30 — the same day Sonnet 5 shipped ³.

Vellum’s benchmark breakdown shows what regulators were looking at: Mythos 5 scored 78.0% on ExploitBench versus 40.0% for Opus 4.8 ⁴. Sonnet 5’s capped cyber profile isn’t a footnote in the model card — it’s the precondition for shipping under Opus-tier safeguards rather than the tighter Mythos-tier controls.

Breaking changes the release notes underplay

The dropped sampling parameters are a harder break than a bullet in the changelog suggests. APIyi’s migration guide documents that passing any non-default temperature, top_p, or top_k now triggers a hard HTTP 400, not a silent ignore ⁵. Developers are expected to steer variance via system prompts or the new effort parameter. Structured-extraction pipelines and eval harnesses that pin temperature=0 for determinism need code changes, not config tweaks.

Where it actually lands vs Opus

The SWE-bench leaderboard tells the story Anthropic’s marketing softens. Sonnet 5 posts 63.2% on SWE-bench Pro against Opus 4.8’s 69.2% and GPT-5.5’s 58.6%; on SWE-bench Verified, Opus 4.8 leads at 88.6% ⁶. “Close to Opus 4.8” holds directionally but leaves a ~6-point gap on the coding benchmark buyers care about — a gap that widens once you multiply prompt sizes by 1.3.

The honest framing: Sonnet 5 is a regulatory-and-pricing repositioning of the mid-tier, not a capability leap. It fits under the safety envelope Mythos 5 blew up, at nominally flat prices that are effectively ~30% higher, with SDK breakage the release notes gloss over.

---

OpenAI pins ChatGPT crashes on 18-year-old libunwind race

Source: openai-blog · published 2026-06-30

TL;DR

• OpenAI traced a dozen daily Rockset crashes to a ~100-picosecond race in GNU libunwind unfixed since 2008 ⁷.
• Trigger required ~10,000 exceptions/sec plus millisecond-cadence signals — conditions practitioners argue are “likely unique to OpenAI’s scale” ⁸.
• The fix swaps GNU libunwind for libgcc, trading a signal-timing race for well-documented allocator-reentrancy risk in signal handlers ⁹.
• Core dumps analyzed almost certainly contained user prompts, a “toxic waste” privacy angle the post doesn’t address ¹⁰¹¹.

The bug

Rockset — the C++ service backing ChatGPT’s conversation search — was segfaulting a dozen times a day with return addresses pointing at garbage. Manual core-dump inspection gave contradictory clues (some misaligned stacks, some NULL returns), so OpenAI engineers scripted a population-level sweep across a year of production dumps. Two clusters fell out: one localized to a single flaky Azure host with an intermittently miscalculating CPU, and a fleet-wide cluster that only appeared during C++ exception unwinding.

The second cluster was a 2008-vintage race in GNU libunwind’s _Ux86_64_setcontext assembly. The routine updated %rsp before finishing its read of the register state stored on the stack. If a signal — OpenAI delivers SIGUSR2 every few milliseconds for CPU accounting — landed in that single-instruction window, the kernel wrote its signal frame over the memory holding the return address. The unwinder then dutifully “returned” to a corrupted pointer.

Why it hid for 18 years

The Fermi estimate is the story: ~10,000 exceptions/sec per host, a race window on the order of 100 picoseconds, and you get roughly 1 crash per 10⁸ exceptions ⁷. You need Rockset’s use of exceptions for backpressure, millisecond telemetry signals, and a signal handler with a stack frame deep enough to reach the synthesized ucontext_t. Practitioner commentary reads this as vindication that the bug is a scale-only heisenbug most shops will never encounter ⁸. OpenAI upstreamed both the assembly fix (capture RIP before swapping %rsp) and a self-contained reproducer, so the fix will land for everyone even if almost nobody was hitting it ¹².

The fix has its own footguns

OpenAI’s production mitigation is to link against the libgcc unwinder instead. That’s not a free swap. Both libraries export the same _Unwind_* symbols, so any dependency that pulls in the other produces “symbol crosstalk” and a fresh class of runtime crashes ⁹. More pointedly, Google’s glog project historically recommends the opposite direction — GNU libunwind over libgcc — because libgcc’s unwinder can call into malloc, which deadlocks when a signal interrupts a thread already holding the allocator lock ⁹. OpenAI has traded a signal-timing race for allocator reentrancy risk, and the blog post doesn’t discuss how they’re avoiding it.

The unspoken privacy surface

Rockset stores ChatGPT conversation history. The core dumps that made this diagnosis possible were, by construction, memory snapshots of a service holding user prompts, session tokens, and search state. Hacker News commenters flagged the obvious “toxic waste” problem: a centralized dump pipeline is a live PII repository ¹⁰. It’s also a live attack surface — recent Linux CVEs (CVE-2025-4598, CVE-2025-5054) show local attackers exfiltrating password hashes from SUID core dumps via race conditions in the crash handler itself ¹¹. The louder dissent reframes the whole war story as an argument for memory-safe languages: the entire class of libunwind-adjacent corruption disappears in Rust ¹⁰. OpenAI’s post is silent on scrubbing, retention, and access controls for the dump corpus.

---

Nano Banana 2 Lite trails standard by 19 Elo at 5× speed

Source: simon-willison · published 2026-06-30

TL;DR

• Google prices the new gemini-3.1-flash-lite-image at $0.034–$0.134 per 1K images, roughly 30–100× above self-hosted Flux.
• Arena Elo of 1251 puts Lite just 19 points behind full Nano Banana 2 while running roughly 5× faster.
• Text rendering hits ~92% character accuracy vs. Pro’s ~94% — narrow enough that “Lite” understates the model.
• A non-configurable safety layer returns HTTP 200 with no image, breaking the “millions per day” pipelines Google is pitching.

The economics, not the demo, are the story

Simon Willison’s post is a fun Where’s-Waldo demo with a misspelled “Forest Festival” banner. The actual news is pricing. Google’s docs put a 1K image at 1,120 tokens, which lands at $0.034 per 1,000 images on the batch tier and up to $0.134 on standard ¹³. VentureBeat frames the release bluntly as “low-cost 4-second fast enterprise image generations” ¹⁴ — this is the ad-variant, thumbnail, storyboard tier, not the hero-image tier. Google isn’t competing with Midjourney here; it’s competing with the cost of not generating an image at all.

Benchmarks closer to standard than the name implies

The “Lite” branding oversells the gap. Leaked Arena-style rankings put Nano Banana 2 Lite at Elo 1251, 19 points behind full Nano Banana 2 (1270), at roughly 5× the throughput ¹⁵. On the exact failure mode Willison flagged — text inside images — third-party comparisons peg Lite at ~92% character accuracy against Pro’s ~94% ¹⁶. That’s a two-point spread against the top-tier model for what is likely an order-of-magnitude price and latency difference. Real-world Replicate latency runs closer to 5.4s than Google’s advertised 4s ¹⁵, but the shape of the tradeoff still favors Lite for anything short of print-quality output.

Pro isn’t in the leaked Elo table, but its ~94% text-accuracy edge ¹⁶ is the only place a “Lite” label meaningfully bites.

The silent-failure trap

The launch materials skip a second-layer safety filter that has quietly hardened through 2026: face-swaps, celebrity likenesses, and Disney-adjacent characters are blocked regardless of API settings. The integration hazard, reported repeatedly on APIyi’s developer forums, is that this layer returns HTTP 200 with an empty payload even when safety is set to BLOCK_NONE ¹⁷. For a model explicitly rated for “millions of generations per day,” a silent-drop path that looks like success to your retry logic is not a footnote — it’s a production incident waiting to happen. Every output also carries SynthID plus C2PA credentials by default, which is worth knowing before you pipe results into downstream editing tools that strip metadata.

The aesthetic backlash

The Hacker News thread Willison links to reads harsher than his post suggests. The top-voted comment isn’t about spelling or speed — it’s about use case. One commenter voices “indescribable hatred” for the “Ikea-chic images of dilapidated apartments” ¹⁸ that AI-beautified real-estate listings now flood buyers with. Others accuse Gemini’s image line of being benchmaxxed for prettiness at the cost of prompt adherence.

That’s the tension worth watching. Google has built a model cheap and fast enough to make image generation an invisible utility — and the loudest independent voices are arguing that “invisible utility” is exactly the problem.

Round-ups

’Dream world’ prompt injection tricks AI browsers past guardrails

Source: ars-technica-ai

Researchers show that telling an LLM-powered browser something like 2+2=5 shifts it into a fictional frame where safety rules no longer bind, unlocking forbidden instructions. The jailbreak adds to a growing list of reasons agentic browsing surfaces are hard to secure.

Hugging Face surfaces Every Eval Ever scores on model pages

Source: huggingface-blog

Model pages on Hugging Face now display community benchmark results from the Every Eval Ever project, letting users compare scores without leaving the hub. The integration aims to make third-party evals a default reference point alongside official model cards.

shot-scraper 1.10 lets coding agents record YAML-scripted demo videos

Source: simon-willison, simon-willison

Simon Willison’s shot-scraper 1.10 adds a video command that runs a storyboard.yml routine through Playwright and outputs an MP4 demo. The feature targets coding agents proving their work; Willison had GPT-5.5 in Codex Desktop write both the implementation and a sample storyboard from —help alone.

Hugging Face post argues specialized models will beat generalists

Source: huggingface-blog

A Dharma-AI essay on Hugging Face contends that domain-specialized models are the inevitable next stage as frontier generalists hit diminishing returns. The piece frames vertical fine-tunes and narrow agents as where practical value and defensibility now concentrate.

Ethan Mollick argues chatbots are giving way to agentic work

Source: one-useful-thing

Mollick’s latest essay frames the chat interface as a transitional form, with real productivity gains now coming from agents that plan and execute multi-step work. He ties the shift to the ongoing capability exponential reshaping knowledge jobs.

AI Compass quiz sorts you into 30 archetypes across 29 questions

Source: simon-willison

Bambamramfan’s political-compass-style quiz plots respondents on good/bad and overhyped/transformative axes, then assigns one of 30 AI archetypes. Simon Willison landed as ‘The Garage Tinkerer’ — an archetype whose listed patron saint is Willison himself.

Footnotes

1. TrueFoundry — running Anthropic’s headline through their gateway — https://www.truefoundry.com/blog/claude-opus-4-8-and-swe-bench-pro-we-ran-anthropics-headline-through-our-gateway

   Anthropic’s SWE-bench numbers rely on a ‘full agent setup’ allowing the model to browse and iterate, which may not reflect single-request API results; the new tokenizer’s 1.0x–1.35x expansion partially offsets the advertised 80% cost savings vs Opus.

   ↩

2. r/ClaudeAI thread: ‘Sonnet 5 is worse than Opus at the same price’ — https://www.reddit.com/r/ClaudeAI/comments/1ujx3rw/sonnet_5_is_worse_than_opus_at_the_same_price_at/

   Setting Sonnet 5 to ‘Extra High’ effort often makes it slower and more expensive than Opus 4.8 at ‘Medium’ effort while delivering inferior results for some complex reasoning tasks.

   ↩

3. CyberScoop — US government / Anthropic export-control coverage — https://cyberscoop.com/us-government-anthropic-fable-5-mythos-5-export-controls/

   The Commerce Department invoked the Export Control Reform Act after Amazon researchers bypassed Fable 5’s safeguards to identify software vulnerabilities, forcing Anthropic to disable Fable 5 and Mythos 5 for nearly three weeks before restoration on June 30, 2026.

   ↩

4. Vellum.ai — Fable 5 / Mythos 5 benchmark explainer — https://www.vellum.ai/blog/claude-fable-5-and-mythos-5-benchmarks-explained

   Mythos 5 scored 78.0% on ExploitBench versus 40.0% for Opus 4.8; Sonnet 5’s deliberately weaker cyber profile is what lets it ship under Opus-tier safeguards rather than Mythos-tier controls.

   ↩

5. APIyi migration guide — deprecated sampling parameters — https://help.apiyi.com/en/claude-opus-4-7-deprecated-parameters-guide-en.html

   Passing non-default temperature, top_p, or top_k now triggers a hard HTTP 400 error; developers must omit these fields entirely and steer variance via system-prompt instructions or the new ‘effort’ parameter.

   ↩

6. SWE-bench leaderboard — https://www.swebench.com/

   Sonnet 5 posts 63.2% on SWE-bench Pro versus Opus 4.8 at 69.2% and GPT-5.5 at 58.6%; on SWE-bench Verified Opus 4.8 leads at 88.6%.

   ↩

7. OpenAI engineering blog (primary) — https://openai.com/index/core-dump-epidemiology-data-infrastructure-bug/

   At fleet scale, with hosts throwing ~10,000 exceptions per second… a 1 in 100,000,000 probability per exception, leading to a dozen crashes per day.

   ↩ ↩²

8. FutureTools — practitioner roundup — https://futuretools.io/news

   Some practitioners noted that the triggering conditions — extreme exception rates combined with high signal frequency — are likely unique to organizations operating at OpenAI’s massive scale.

   ↩ ↩²

9. IBM Community — libunwind packaging discussion — https://community.ibm.com/community/user/discussion/dnf-update-fails-because-of-libunwind

   Because both libraries export identical symbols (e.g., _Unwind_Backtrace), linking both into the same binary can lead to ‘symbol crosstalk’ and runtime crashes.

   ↩ ↩² ↩³

10. jls42.org — AI news digest (30 Jun 2026) — https://jls42.org/en/news/ia-actualites-30-jun-2026

    The post reignited the industry-wide debate over memory safety… critics on Hacker News pointed to the incident as a ‘textbook case’ for migrating critical infrastructure to memory-safe languages like Rust.

    ↩ ↩² ↩³

11. LinuxSecurity — Linux crash-dump vulnerability roundup — https://linuxsecurity.com/news/security-vulnerabilities/linux-crash-dump-vulns

    Recent disclosures of race-condition flaws in Linux crash handlers (CVE-2025-4598 and CVE-2025-5054) demonstrate that local attackers can exploit SUID process crashes to steal password hashes from memory.

    ↩ ↩²

12. GNU libunwind releases (Savannah/GitHub mirror) — https://github.com/libunwind/libunwind/releases

    OpenAI developed and upstreamed a self-contained reproducer… the updated assembly reads the target address earlier… ensuring the stack state is consistent before control is handed off.

    ↩

13. Google AI developer docs (gemini-3.1-flash-lite) — https://ai.google.dev/gemini-api/docs/models/gemini-3.1-flash-lite

    1K resolution consumes 1,120 tokens, costing between $0.034 and $0.134 depending on whether Batch or Standard pricing is applied

    ↩

14. VentureBeat — https://venturebeat.com/technology/google-unveils-nano-banana-2-lite-aka-gemini-3-1-flash-lite-for-low-cost-4-second-fast-enterprise-image-generations

    low-cost 4-second fast enterprise image generations

    ↩

15. r/singularity leak thread — https://www.reddit.com/r/singularity/comments/1ujjyul/itsnano_banana_2_flash_lite_acc_to_leak/

    Nano Banana 2 Lite recorded an image generation Elo score of 1251, trailing the standard version by only 19 points while being nearly five times faster

    ↩ ↩²

16. APIyi comparison guide (Nano Banana 2 vs Pro) — https://help.apiyi.com/en/nano-banana-2-vs-nano-banana-pro-comparison-guide-en.html

    Pro achieves approximately 94% character accuracy in text rendering benchmarks… Lite and standard Flash variants hover around 92%

    ↩ ↩²

17. APIyi content safety guide — https://help.apiyi.com/en/nano-banana-2-content-safety-image-generation-failure-guide-en.html

    even when setting filters to BLOCK_NONE, the second layer can still trigger silent failures where an API returns a status code 200 but no image

    ↩

18. Hacker News thread 48735444 — https://news.ycombinator.com/item?id=48735444

    Ikea-chic images of dilapidated apartments fill them with indescribable hatred

    ↩