The Signal — September 23, 2026

Today's headline numbers look different once the methods are visible. Anthropic routed some benchmark tasks to older models, Cisco Talos analyzed malware it never saw deployed, and a Stanford labor paper found a shrinking junior share inside firms that were still adding workers.

Anthropic's new benchmark scores belong to more than one model

Anthropic released Claude Opus 5.5 on September 22, the first model in a new 5.5 family and, by the company's own framing, its first release since Dario Amodei called for pacing the frontier. The pitch is efficiency rather than raw capability. Anthropic says the model performs at the level of Claude Fable 5.1 on most work while costing 40 percent less to run than Opus 5. Input and output tokens are priced at $4 and $20 per million, 20 percent below Opus 5. Cache reads, which Anthropic notes make up the majority of agentic and coding costs, dropped to $0.20 per million, down 60 percent. The model generates output more than 30 percent faster. Frontier Design and METR tested it before release.

A footnote under the benchmark table qualifies those scores. Anthropic writes that Opus 5.5 "was evaluated with its production safeguards enabled. When they intervened, cybersecurity tasks were completed by Claude Opus 4.8, and biology and frontier LLM development tasks were completed by Claude Opus 5." The published figures, including 66.4 percent on Terminal-Bench 4.0 and 58.7 percent on Terminal-Bench-Science 0.1, therefore describe a system with a safety router in front of it, not a single set of weights, wherever those safeguards fired. Anthropic says this likely lowered the scores. The Verge also reports that cybersecurity requests fall back to Opus 4.8 and flagged biology requests to Opus 5.

Anthropic says Opus 5.5 is comparable to Claude Mythos 5.1 in biology and cybersecurity, so it ships with Fable 5.1-tier safeguards. Access for work those safeguards obstruct runs through a Life Sciences Verification Program that is open now and a Cyber Verification Program expanding in the coming weeks. The performance claims come from Anthropic or named partners: Zapier ran AutomationBench and the AI security firm Gray Swan ran the prompt-injection benchmark. The reports of a 680,000-line migration finished in under a day and a 200,000-line audit completed in under three hours come from unnamed early testers. Anthropic also cautions that "at these levels of capability we've found that benchmark margins have become a less reliable guide to real-world differences."

Sources: Anthropic · The Verge · GitHub · AWS

Malware that asks four chatbots what to do and follows the plurality vote

Cisco Talos released CAIRN on September 22, an open-source toolkit for fingerprinting and tracking malware that calls out to AI services, and published its first finding alongside it. CLOSEDQUORUM is a 16.4MB Windows binary written in Go that is designed to use commercial LLM APIs as its command-and-control infrastructure, with no attacker-operated server and no human in the loop. The implant's code queries DeepSeek, Qwen, Mistral and Google Gemini one at a time, tallies their responses by plurality vote, and executes whichever action won.

The decision space is deliberately narrow. Talos extracted the system prompt from the binary: "You are an advanced malware strategist. Provide ONLY executable decisions." Responses come back in a typed JSON schema, and the winning value routes to a handler. steal fires three functions at once, dumping LSASS, browser credentials and crypto wallets. inject generates shellcode and branches to either process hollowing or APC injection. persist establishes a foothold. move has no handler in the distribution build. If all four providers fail or refuse, the fallback value has no handler either, so the loop sleeps and retries rather than picking a default action. Results go out through a Discord webhook.

Talos focuses on attacker economics rather than a new malware capability. Conventional command-and-control requires infrastructure that is attributable, blockable and expensive to rotate, including domains that land in threat feeds, IP addresses that end up on blocklists and new servers that appear in certificate transparency logs before they are used. By querying four commercial API endpoints used by thousands of legitimate applications, the implant avoids attacker-operated command-and-control infrastructure and some of that exposure. The researchers call this effort displacement: an entire phase of the attack chain moves from the operator to the system, which could keep choosing actions without a human watching it.

Talos has no confirmation that the implant was deployed against a real target. The developer could not be identified beyond artifacts linking to carding forum postings from 2025, and the public build ships placeholder API keys and a dummy webhook, so researchers never observed end-to-end execution. The behavior described comes from static analysis plus development builds. Ryan Fetterman, who led CAIRN's development, told WIRED he expected an explosion of AI-enabled malware after Ukraine's CERT-UA flagged the LAMEHUG implant in July 2025, and found roughly nine documented families a year later. CAIRN has since surfaced about twenty more. His read: "while I do think this is still largely experimental for attackers, the landscape is a lot more complex and diverse than has been publicly reported."

Sources: Cisco Talos · WIRED · Cisco Talos (CAIRN) · GitHub

Firms adopting AI hired more people, and fewer of them were junior

Most evidence on what generative AI does to employment has come from the United States. A Stanford Digital Economy Lab working paper posted September 21 by Bharat Chandar and Bouke Klein Teeselink analyzes 1.25 billion job postings and 154 million employment records across 41 countries. Firms that adopted AI grew to have roughly 3.3 percent more employees than comparable firms that did not. Senior employment at those firms rose 6.7 percent while junior employment fell about 2.5 percent, and the junior share of the workforce declined in about three-quarters of countries, including the United States, Brazil and Saudi Arabia.

The paper is explicit that the falling junior share "primarily comes from growth in senior employment rather than from a fall in junior employment." These are firms getting bigger and getting more senior as they grow; the estimated decline in junior employment is not the main driver of the changing share. The authors also find that senior employment shifts toward AI-exposed occupations while their point estimates suggest juniors shift away from those same occupations.

Measuring adoption required a workaround because no registry of companies using AI exists. Chandar and Klein Teeselink searched over a billion job postings for generative AI terms, then had a language model read the candidates and judge whether the advertised role actually involved generative AI. That filter removes airline copilots, people named Claude, "LLM" meaning a law degree, conventional machine learning roles, and postings that mention AI only to ban it. Employment records come from Revelio Labs, which assembles public LinkedIn and job board data. Chandar says the sample skews toward "digitally attached multinational firms" and describes adoption measured through job ads as "a lower bound" because a company can start using AI without advertising for it. The paper is a working paper, not peer-reviewed, and labels its productivity findings and the junior occupational shift as suggestive rather than established.

Sources: Stanford Digital Economy Lab · Bharat Chandar · Insurance Journal

On the Editor's Desk

OpenAI published a case study saying the startup Parallel halved its research time and cost using GPT-6 Astra. The case study appears only on OpenAI's site, and its outcomes are self-reported by the customer, with no independent evidence supplied alongside them. We also passed on a Hugging Face write-up about the UK AI Safety Institute and EvalEval publishing evaluation cards to make benchmark results reproducible. It overlaps closely with the Anthropic story above and would have made most of today's edition about benchmark methodology.

We also skipped an arXiv paper on building reusable agent harnesses, three days after we ran NVIDIA's harness-optimization work, and OpenAI's proposal for international AI standards, which yesterday's edition noted we had already covered several times this month. A joint statement from six banks warns that agentic shopping could increase fraud, but it offers principles rather than evidence about how often that fraud occurs, and we ran an agentic-commerce story yesterday.