October 8, 2026 — Haiku Is Ninety Percent Cheaper, Until You Count Tokens

Host0:34

Ten cents. That's what Claude Haiku five point five costs per million input tokens on a short prompt, and output is fifty cents. Haiku four point five ran one dollar in and five out, per SiliconANGLE. So the list price just dropped ninety percent. Anthropic released it Wednesday, and the Claude Code release notes call it the new default Haiku on the Anthropic API. You call it as claude haiku five five on the Claude Platform, AWS, Google Cloud, or Azure. It's on OpenRouter too. GitHub says it's generally available in Copilot for Pro, Pro Plus, Max, Business, and Enterprise, rolling out gradually and billed by usage at list price. You get a one million token window and up to one hundred twenty eight thousand tokens back. Text and images in, text out. Past one hundred thousand prompt tokens, the price steps up to fifty cents in and two dollars fifty out. What's new for callers is an effort dial, a first for Haiku. Thinking is adaptive and on by default, and OpenRouter calls effort the main control for depth, latency, and cost. Anthropic pitches it for bulk work, and for small jobs that bigger models hand down. Now the benchmarks, and whose they are. Anthropic's own comparison with GPT six Luna has Haiku at seventy two point four percent on the OSWorld two point one offline subset, against forty eight point nine. On Terminal-Bench four point zero, it's thirty nine point two against sixteen point four. More than double, on a chart Anthropic published. That's not independent. OpenRouter displays an Artificial Analysis score of thirty two point eight on the same Terminal-Bench. Two sources, two numbers, no settled score. Watch the bill, too. Anthropic's seventy five percent average saving already accounts for a tokenizer that uses slightly more tokens per task. GitHub says early testing matched Sonnet five on many coding tasks with fewer steps, but that's GitHub's own claim. Limits. Rate limits, known weaknesses, open weights, and licence are all unclear so far. Anthropic still points complex agentic coding to Sonnet five point five and Opus five point five. Verdict. Try it on classification, summaries, subagents, and latency-sensitive support or browser work. Asana's Aaron Vinh called early testing noticeably snappier. Hold off replacing a stronger model on hard coding until you've run your own task mix. In Claude Code version two point one point two ninety three, pick claude haiku five five and measure.

3:26

Haiku taking jobs from bigger models raises a plumbing question: who defines the team? Docker's answer is a YAML file. Docker Agent is an open-source agent builder and runtime, Apache two point oh. It installs as a Docker CLI plugin, so you type docker agent. YAML defines each agent's instructions and tools, and the runtime connects them to model providers, MCP servers, built-in reasoning tools, and other agents. Providers include OpenAI, Anthropic, Gemini, AWS Bedrock, Mistral, xAI, and Docker Model Runner. Retrieval is pluggable, with BM twenty five, embeddings, hybrid search, and reranking. You can package an agent and push it to an OCI registry. Docker says it uses Docker Agent to build Docker Agent. Confidence, or a very tidy loop. The honest limit came up on Hacker News. A commenter, Olscore, argued orchestration isn't really the core problem, and the bigger challenge is agent coherency over long periods of time. It's also unclear how Docker Agent handles failures, conflicting work, or verifying a result beyond what the YAML describes. To try it, you need Docker Desktop four point sixty-three or later, where the plugin comes pre-installed. Set a provider API key and run docker agent run on the Golang developer example from the README.

5:00

Docker wants agents defined in your repo. Microsoft wants them living in your operating system. Here's the demo, as The Verge reports it. A local agent finds your tax documents, renames them, zips them, and drafts an email to your accountant with the archive attached. Microsoft says forthcoming Copilot features on Copilot plus PCs will use local context from your PC, take actions on your behalf, and tap local models, with your permission. Availability rolls out over the coming months. The part builders should read is the plumbing. Microsoft's containment system, MXC, is now generally available on Windows eleven. You set runtime policies for which files and networks an agent can touch. Windows supplies the isolation, from process or session separation to WSL, virtual machines, or Windows three sixty five for Agents. Then there's routing. Microsoft describes hybrid intelligence as sending tasks to local or cloud models. GitHub's HydraFusion routing will extend to local models. Windows ML, built on the ONNX runtime according to The Register, is adding llama.cpp support. An experimental preview in the GitHub Copilot app, CLI, and VS Code is planned for later in October. The Windows Search side is lighter. Quick actions like dark mode or microphone volume start arriving this fall. Microsoft's sample command is Text Elisa I'll be there soon. Elisa has not been consulted. Now the caveats. Microsoft calls Windows the most secure platform for agents. That's the company's characterization, not an independent result, and these Copilot features are still a coming rollout, so today's announcement isn't evidence of mature real-world safeguards. Privacy-conscious users and IT admins will push on broad file access. What I can't tell you is how you'll inspect, limit, and revoke those permissions. Or what happens when the router sends a supposedly local task to a cloud model. Today's announcement doesn't answer that.

7:19

Containment is for services that trust too much. LMCache's multiprocess server trusts everyone. Here's the order of events. A crafted message runs code while the server decodes its arguments, and only afterward does the server log a type error. The error report arrives after the exploit. JFrog disclosed CVE twenty twenty-six dash one zero five one nine two, rated nine point eight on the CVSS scale for a routably bound server. As of October seventh, no fixed version exists. It affects multiprocess mode, where an unauthenticated ZeroMQ socket lets workers register and share KV-cache blocks. JFrog traces it to msgpack extension code that reaches pickle loads while decoding a register request, before any handler runs. There's no CURVE, no password, no message authentication. So a crafted message runs code as the LMCache user. Exposure is conditional. The default bind is localhost, and a single vLLM process doesn't open this port. Operators can make multi-node setups reachable by binding a routable address; the default port is five thousand five hundred fifty-five, and The Hacker News says official container images run it as root. The vulnerable path first shipped in zero point three point nine. It's still in the latest PyPI release, zero point five point five, plus the zero point five point six release candidates through rc three. Until there's a fix, keep that transport on localhost or a trusted network. A firewall reduces exposure but doesn't make an unauthenticated service safe for every host that can reach it. JFrog's guidance is to stop passing network bytes to pickle. Distributed teams may object that this workaround disables the multi-node connectivity they rely on. Fair. Check what address your LMCache binds to today.

9:28

Copilot local sandboxing is the containment idea from Microsoft's story, already shipped. It's generally available in the CLI, the Copilot app, and VS Code sessions using Agent Host, at no extra Copilot charge. Policies can limit filesystem, network, credentials, and local MCP and language servers where supported, powered by MXC on Windows, macOS, and Linux. Which defaults ship on each surface is unclear. Copilot CLI one point zero point ninety-four dash zero adds a model picker. Run slash model and it lists supported models from your running Ollama. Discovered models must support tool calling and streaming. GitHub's dry warning: picking a local model doesn't switch on offline mode or disable telemetry. Offline mode is an explicit setting. Codex CLI zero point one six one point zero makes GPT six point one Sol the default in the bundled and Amazon Bedrock catalogs. It turns on multi-agent V two and Ultra reasoning, only on compatible Bedrock models, and adds GovCloud regions. Teams with pinned catalogs should check compatibility and cost first. Also, Daybreak needs an explicit opt-in, since setting daybreak to true alone does nothing. Next.js sixteen point four recommends Cache Components for every app, enables them in new ones, and the team says they become the default in Next.js seventeen. The team calls use cache a component-level Cache-Control header. Its Turbopack disk cache uses twenty to twenty-five percent less space, a team claim. A new ensureStatic option can make a route's shell, prefetch, or full navigation static and fail the build if disallowed dynamic content is introduced. Upgrade with npx next at canary upgrade, agent set to latest.

11:28

That Ollama picker assumes you own hardware worth picking models for. Microsoft and NVIDIA would like to sell you some. RTX Spark laptops opened for preorder October seventh and ship October sixteenth, from Acer, ASUS, Dell, HP, Lenovo, Microsoft, MSI, and Gigabyte. Microsoft's Surface Laptop Ultra starts at two thousand five hundred ninety-nine dollars with twenty-four gigabytes of RAM. The top configuration runs about five thousand nine hundred. Up to one hundred twenty eight gigabytes of unified memory is the number that matters for local models. NVIDIA claims up to one petaflop of FP four. The Register says that relies on sparsity and puts it nearer five hundred teraflops without it. Microsoft's claim of two point one times faster time to first token than a MacBook Pro with M five Pro comes from its own tests on preproduction machines. Wait for independent numbers.

12:32

Fast Boot, where today's three attacks get their changelogs read aloud. FortiGate lockout. The FBI cited more than eighty six thousand compromised FortiGate devices in one hundred ninety-four countries, based on SOCRadar's verification. Reports also describe attackers locking legitimate admins out. Their exposed backend reportedly held scripts that filter honeypots and rank targets by revenue, so they have a sales funnel. Muse phishing. A fake Muse ad site appeared eight days after Meta announced Muse, with a login window drawn inside the page. The same kit posed as Gemini, Claude, ChatGPT, Perplexity, and Manus ads, so it's less a phishing page than a template library. MALFEX npm. Checkmarx counted forty thousand seven hundred sixty-seven campaign downloads. It says the operator published twelve packages, eight of them malicious, and function-flag accounted for most of the downloads. The attacker's README credits the MALFEX team and names an owner, so at least the supply chain has a contributors section. Contributors section, sales funnel, template library. Somewhere, a very bad startup is thriving.

13:53

Today we covered Claude Haiku five point five and its ninety percent lower list price, Docker Agent's YAML approach to agents, Microsoft's plan to give Copilot access to local files with MXC containment, and the unpatched LMCache flaw. Your try-it for today: point one classification job at claude haiku five five, and compare cost per finished task, not price per token. Links for every story are in the show notes. Follow The Daily Reboot in your podcast app, so tomorrow's news lands on its own. Go check your bind addresses. See you tomorrow.