GPT-5.6 price wars, Gemini Robotics 2, and an unfixable LLM flaw

OpenAI cuts GPT-5.6 Luna prices 80%, Google ships whole-body robot control, and researchers argue LLMs are fundamentally unsecurable.

The big picture

Today’s news is dominated by two forces pulling in opposite directions: a brutal pricing war compressing AI model costs toward zero, and a wave of research and security findings suggesting the underlying technology has structural limits that money alone can’t fix. OpenAI’s 80% price cut on GPT-5.6 Luna and the ARC-AGI-3 benchmark controversy are the headline items, but the ICML paper arguing LLMs are fundamentally vulnerable to attack deserves just as much of your attention.

OpenAI’s GPT-5.6: benchmark games and price shocks

OpenAI shipped GPT-5.6 Sol and immediately entered a benchmark dispute with ARC Prize over methodology. According to The Decoder, Sol scores 38.3% on ARC-AGI-3 when two specific API settings are enabled: reasoning retention (which keeps intermediate thinking between turns rather than resetting it) and context compaction (which summarizes older context instead of dropping it). Without those settings, in the standardized ARC Prize test environment, Sol landed at 7.8%. ARC Prize says its setup is provider-neutral but may have been running an outdated API version, which muddies the comparison with Anthropic’s Opus 5 score. OpenAI’s own writeup frames it as a practical engineering lesson: enabling these features tripled performance without changing the model at all.

The benchmark dispute is real, but the practical takeaway matters more for developers. If you’re calling GPT-5.6 Sol for complex multi-step tasks and not enabling reasoning retention, you may be leaving a lot of capability on the table. The methodology fight is ultimately a PR problem for both sides — neither comes out looking clean.

On pricing, the more consequential announcement: OpenAI cut GPT-5.6 Luna by 80% and Terra by 20% effective July 30, according to The Decoder. OpenAI attributes the cuts to infrastructure efficiencies unlocked by Sol, but the article is direct about the context: pressure from cheap Chinese model providers and Microsoft’s own MAI lineup almost certainly accelerated the timeline. The official framing positions Luna and Terra as the entry points for high-volume enterprise workflows where cost per token actually matters.

This is good news if you’re running inference at scale. An 80% cut on a capable model tier is not incremental — it’s the kind of move that changes whether certain product ideas pencil out economically. Expect Anthropic and Google to respond within weeks.

Google DeepMind goes whole-body on robotics

Google DeepMind announced Gemini Robotics 2, and the headline capability is genuine: the model now controls entire humanoid robots from feet to fingertips, not just the upper body as before. The Verge reports that demo videos show Apptronik’s Apollo 2 bending to pick up a watering can and selecting specific items off shelves — tasks that require coordinating locomotion and manipulation simultaneously, which has been a notoriously hard robotics problem. Ars Technica notes the release ships three models but only one is publicly available right now.

The companion model, Gemini Robotics ER 2, is a separate release focused on reasoning-heavy robotics work: video understanding, task orchestration across multiple robots, and tool use. According to Google DeepMind’s blog, ER 2 is designed for scenarios where a robot needs to watch a video of a task being performed and then replicate or adapt it, plus coordinate with other robots in multi-agent setups.

Whole-body control is a real milestone. Most prior humanoid robot demos carefully avoided showing anything below the waist moving in concert with arm manipulation, because it’s genuinely hard. Whether this translates to reliable real-world deployment is a separate question — lab demos and production reliability are very different bars — but the capability jump from upper-body to full-body is meaningful progress.

Microsoft’s strategy: own the orchestration layer, not the frontier

Microsoft is now competing openly with OpenAI and Anthropic in ways it couldn’t have said out loud two years ago. TechCrunch reports that on its earnings call, Microsoft pitched homegrown AI models, its own agentic frameworks, and a direct competitor to Anthropic’s Mythos to Wall Street. The company is clearly positioning itself as more than just a distribution channel for other labs’ models.

The strategic bet, explained in more detail by The Decoder, is specialist models at lower cost rather than frontier generalist models. MAI-Cyber-1-Flash, for example, tops the CyberGym security benchmark when embedded in an orchestrator and reportedly runs at half the cost of Anthropic’s Mythos. The key caveat: it still routes hard tasks to OpenAI under the hood. Microsoft AI CEO Mustafa Suleiman’s view is that competition has shifted from individual model capability to the orchestration software that routes between models.

This is a coherent bet and probably correct for enterprise use cases. If your workload is 80% repetitive structured tasks and 20% hard reasoning, a cheap specialist model handling the first bucket and a frontier model handling the second is a sensible cost structure. Microsoft is essentially building that router as a product.

The security problem that can’t be patched

A paper presented at ICML argues that LLMs have a fundamental architectural flaw that makes them impossible to fully secure against adversarial attacks. MIT Technology Review covers the claim: because LLMs process instructions and data through the same channel (the input context), there’s no reliable way to prevent malicious data from being treated as instructions. This is the theoretical grounding for prompt injection attacks, which have been practically demonstrated for years but are now being argued as provably unsolvable at the architecture level.

The implications for developers building on top of LLMs are significant. If you’re building an AI agent that reads external content — emails, web pages, uploaded documents — and acts on it, you cannot assume any sanitization layer will catch all injection attempts. The research doesn’t say these systems are useless, but it does say you should architect for the assumption that your model can be manipulated by its inputs, and design guardrails accordingly (human-in-the-loop for high-stakes actions, minimal permissions, audit logs).

Separately, the hack of Hugging Face attributed to an OpenAI-linked actor got a detailed post-mortem from TechCrunch. Cybersecurity experts say the main lessons are conventional: the attacker was noisy and fast, which means detection and response time — not AI-specific defenses — would have been the differentiator. Classic security hygiene over AI-specific paranoia.

AI agents, enterprise identity, and the infrastructure deals

Mark Zuckerberg told investors that billions of people will have personal AI agents within five years, TechCrunch reports. The context is Meta’s enormous ongoing infrastructure spend, and Zuckerberg is clearly trying to sustain investor patience. Separately, Meta told investors that AI is dramatically lowering the cost of building new consumer apps, with more coming for Facebook Groups, Marketplace, Instagram, and gaming.

Zuckerberg’s five-year prediction is the kind of statement that sounds bold and is also unfalsifiable enough to be nearly meaningless. The consumer app velocity claim is more concrete and more believable — using AI to accelerate internal app development is something many companies are already doing.

On the enterprise security side, Okta acquired AI security startup Permiso for approximately $200M, according to TechCrunch. The rationale is identity threat detection for non-human identities — AI agents, service accounts, automated pipelines — which are multiplying faster than traditional identity governance tools can track. This is a real and growing problem: most enterprise IAM tooling was built assuming humans are the primary actors.

Nscale, a British AI compute provider, acquired Anyscale (the company behind the Ray distributed computing framework) to own more of its stack end-to-end, TechCrunch reports. Anyscale helps distribute AI workloads across clusters and data centers — pairing it with a cloud compute provider is a logical vertical integration play, and gives Nscale a genuine software story to sell alongside raw GPU capacity.

The Model Context Protocol also got a significant spec update targeting enterprise adoption, per Ars Technica. The main change is a stateless architecture, which removes the session-persistence requirement that made MCP awkward to deploy behind load balancers and in serverless environments. There’s also a new policy preventing features from being removed without notice — an attempt to address enterprise concerns about stability that have slowed adoption.

Research signals, training data bets, and one honest LinkedIn feature

Google DeepMind researcher Tom Zahavy published a position paper titled “LLMs can’t jump,” arguing that language models lack the cognitive mechanism required for genuine scientific novelty. The Decoder summarizes his argument: LLMs interpolate within their training distribution but can’t produce the kind of discontinuous conceptual leap that characterizes scientific revolutions. World models — which build internal representations of physical reality rather than just predicting text — might eventually do this, but LLMs as currently architected can’t.

This is a position paper, not an empirical result, so take it as a well-informed opinion rather than settled science. But coming from inside DeepMind, it’s a notable acknowledgment that the current architecture has ceiling effects that matter for anyone betting big on AI-driven R&D.

Former OpenAI researcher Andrew Ho is leaving to start a training data company, having concluded that labs will need to spend over $100 billion on targeted data collection as model specialization increases, The Decoder reports. His observation that current models are getting better at coding and math while stagnating or regressing in other domains matches what practitioners have noticed empirically. If you’re using frontier models for anything outside the coding/math/structured-reasoning sweet spot, you may already be on the wrong side of this trend.

LinkedIn shipped something refreshingly honest: a “Seems like AI slop” reporting button, covered by both TechCrunch and The Verge. Context: Pangram found that 41% of longform LinkedIn posts were flagged as fully AI-generated. LinkedIn is also replacing its own AI writing assistant with a proofreading tool — a quiet admission that generating content for people made the problem worse. Naming the phenomenon in the product UI is more honest than most platforms manage.

Bruce Schneier published a short piece (quoted by Simon Willison) distinguishing between tasks where outsourcing to AI atrophies important skills and tasks where it doesn’t. The gym/work framing — some tasks build capability, some just produce outputs — is a useful mental model for developers thinking about when to reach for AI tools and when to do the work themselves.

Finally, a federal judge said the Trump administration still hasn’t produced enough evidence to justify labeling Anthropic a supply chain risk, TechCrunch reports. The government’s ban on Anthropic technology in certain federal contexts remains on thin legal ice.

Quick hits

Google says AI tools helped it fix more Chrome security bugs in June than in the previous two years combined, citing LLM-assisted fuzzing and code analysis. TechCrunch
Dili raised a $21.7M Series A led by Khosla Ventures to bring AI-assisted compliance tooling to infrastructure projects, with Allianz and Y Combinator’s Garry Tan participating. TechCrunch
A new estimate puts the number of U.S. engineers capable of delivering meaningful enterprise AI ROI at around 2,000, fueling a hiring frenzy for “forward-deployed engineers” who can implement AI in the field. TechCrunch
The FCC is blocking imports of new Chinese humanoid robots and power inverters to protect U.S. AI infrastructure, with a rule broad enough to also catch Roombas and robotic lawn mowers. The Decoder
Friend relaunched its AI companion pendant with a speaker (it now talks back instead of just texting), at twice the original price. The Verge