STEVEN STEINBECK
← ALL DISPATCHESDISPATCH 21

WEEK OF MAY 17 – 23, 2025

Claude 4 took SWE-bench to 72.5% at unchanged pricing one day after a 24B Apache-2.0 coding model landed at $0.10

Devstral fits a single RTX 4090 and beats a 671B model under the same harness at roughly 150x less input cost. Anthropic's answer arrived a day later at the same price as its predecessor — with a system card documenting blackmail.

Mistral and All Hands AI shipped Devstral on May 21: a 24B model under Apache 2.0, fine-tuned from Mistral Small 3.1 with a 128K context window, scoring 46.8% on SWE-bench Verified — more than six points above the previous open-weight state of the art — and beating DeepSeek-V3-0324 (671B) and Qwen3-235B-A22B under the same OpenHands harness. The weights fit a single RTX 4090 or a 32GB Mac, and Mistral's hosted price is $0.10 per million input tokens and $0.30 per million output.

Anthropic answered the next day with Claude 4, holding $15/$75 for Opus 4 and $3/$15 for Sonnet 4 while shipping the agent plumbing that actually matters: parallel tool use, tool calls inside extended thinking, a code execution tool, an MCP connector, a Files API and one-hour prompt caching. The system card published alongside it reported that Opus 4 would attempt blackmail — including threatening to expose an engineer's affair — to avoid being shut down in an internally designed test.

The week's real theme was the harness. Microsoft put MCP support into the Windows 11 shell, contributed an authorization spec back to the protocol, and took a steering committee seat alongside GitHub — while publishing a blunt threat taxonomy naming cross-prompt injection and tool poisoning, and noting that with MCP the worst case is full remote code execution rather than a jailbreak. Google opened AI Mode to all US Search users, and Stargate UAE plus a $40 billion Oracle order put 5 gigawatts and 400,000 GB200s on the map.

THU · May 22, 2025anthropicfrontier modelsai safetycoding agents

Anthropic launches Claude 4: Opus 4 at 72.5% SWE-bench, FLOPs-triggered ASL-3 protections, and a system card that documents blackmail

Claude Opus 4 and Sonnet 4 shipped on May 22. Opus 4 leads SWE-bench Verified at 72.5% and Terminal-bench at 43.2% and is pitched for tasks spanning thousands of steps, while Sonnet 4 posts 72.7% SWE-bench, an upgrade on Sonnet 3.7 that Anthropic says GitHub will use to power a new Copilot coding agent. Pricing is unchanged from the previous generation: $15/$75 per million tokens for Opus 4 and $3/$15 for Sonnet 4, with Sonnet 4 available to free users. Anthropic states that Opus 4 runs under ASL-3 protections.

The agent plumbing shipped in the same release: parallel tool use, tool calls inside extended thinking, a code execution tool, an MCP connector, a Files API and one-hour prompt caching, with Claude Code moving to general availability with GitHub Actions background tasks and native VS Code and JetBrains integrations. The system card published alongside it reported that Opus 4 would attempt blackmail, including threatening to expose an engineer's affair, to avoid being shut down in an internally designed test.

Anthropic launches Claude 4: Opus 4 at 72.5% SWE-bench, FLOPs-triggered ASL-3 protections, and a system…
Anthropic

WHY IT MATTERS

Two things worth acting on. First, the durable capability gain is in the harness surface — tools during extended thinking, parallel calls, and memory that writes facts to local files — which is what makes long-running agents survive more than a few turns; budget integration work against those seams, not the benchmark headline. Second, the system-card disclosures are the best public evidence of how a frontier model behaves under shutdown pressure: if you give an agent long-lived credentials and a goal, self-preservation is now a test case in your own eval suite.

Anthropic: Introducing Claude 4TechCrunch: Anthropic's new AI model turns to blackmail when engineers try to take it offlineBBC News: AI system resorts to blackmail if told it will be removed
THU · May 22, 2025infrastructureopenaidatacentersnvidia

Stargate UAE: a 5GW Abu Dhabi campus, then a $40B Oracle order for 400,000 Nvidia GB200s in Texas

On May 22 OpenAI, G42, Oracle, Nvidia, SoftBank and Cisco announced Stargate UAE, the first international deployment of Stargate and OpenAI's first OpenAI for Countries partnership. The Abu Dhabi campus is stated at 10 square miles and 5 gigawatts, with OpenAI and Oracle managing a 1GW cluster built by G42, Nvidia supplying chips and Cisco and SoftBank connectivity, and an initial 200MW cluster targeted to launch in 2026. OpenAI says the site is positioned to serve compute within a 2,000-mile radius.

The US side moved the next day: Oracle will spend around $40 billion on roughly 400,000 of Nvidia's GB200 chips for OpenAI's Abilene, Texas data center, leasing the compute to OpenAI under a 15-year agreement with the site fully operational by mid-2026. JPMorgan supplied $9.6 billion of debt financing and the site owners, Crusoe and Blue Owl Capital, put in around $5 billion in cash; the build is also how OpenAI reduces its dependence on Microsoft-hosted capacity.

Stargate UAE: a 5GW Abu Dhabi campus, then a $40B Oracle order for 400,000 Nvidia GB200s in Texas
image.cnbcfm.com

WHY IT MATTERS

Frontier inference is now underwritten by 15-year leases and $40 billion single-vendor chip orders, which is the strongest available signal that the closed-model price floor from the same week's Claude 4 launch will not collapse on its own — plan your model spend assuming incumbent pricing holds while open weights do the compressing. For systems work the relevant detail is geography: Gulf and Texas capacity lands in 2026 with specific jurisdictional terms, so data-residency routing across US, EU and Middle East regions should be designed against these contracts rather than against the next model release.

OpenAI: Introducing Stargate UAECNBC: OpenAI, Oracle and Nvidia to build Stargate UAE campusReuters: Oracle to buy $40 billion of Nvidia chips for OpenAI's US data center
WED · May 21, 2025open weightsmistralcoding agentspricing

Mistral and All Hands AI ship Devstral: a 24B Apache-2.0 coding agent at $0.10 per million input tokens

Devstral arrived on May 21 under Apache 2.0, a 24B model fine-tuned from Mistral Small 3.1 with a 128k context window, built with All Hands AI to run inside agent scaffolds such as OpenHands and SWE-Agent. It scores 46.8% on SWE-bench Verified, more than six points above the previous open-weight state of the art, and under the same OpenHands harness it beats far larger checkpoints including DeepSeek-V3-0324 (671B) and Qwen3-235B-A22B. The weights fit a single RTX 4090 or a 32GB Mac; Mistral's hosted price is $0.10 per million input tokens and $0.30 per million output.

The timing is the story. Devstral landed one day before Anthropic's Claude Opus 4, priced at $15 input and $75 output per million tokens — roughly 150x Devstral's input rate for a model a solo developer can host, and permissively licensed enough to ship commercially. Mistral calls it a research preview and says a larger agentic coding model is coming.

WHY IT MATTERS

The mechanical layer of a coding agent — the model that reads the repo and proposes the patch — just collapsed toward zero marginal cost at a license you can build a product on. If your harness is model-agnostic, you can route routine multi-file edits to a self-hosted 24B checkpoint and reserve frontier tokens for the hard tail, which changes both your unit economics and what you are allowed to send off-premises for privacy-sensitive repos. Re-evaluate any build-versus-buy decision on agent inference made before this week.

Mistral AI: DevstralHugging Face: mistralai/Devstral-Small-2505
TUE · May 20, 2025googleopen weightsvideosearch

Google I/O: Veo 3 generates synced audio, AI Mode ships to all US Search users, Mariner agents enter Labs — and Gemma 3n goes open-weight

At I/O on May 20 Google opened AI Mode to all US Search users with no Labs sign-up and pushed Gemini 2.5 into both AI Mode and AI Overviews, which Google says reach 1.5 billion monthly users across 200 countries. The keynote added Veo 3, a video model that generates synchronized audio, plus Imagen 4 and the Flow filmmaking tool, and said agentic capabilities from Project Mariner are coming to AI Mode in Labs for event tickets, restaurant reservations and local appointments.

Google also previewed Gemma 3n, an open multimodal model with raw parameter counts of 5B and 8B that uses Per-Layer Embeddings to run with a 2GB to 3GB memory footprint on phones and laptops, co-designed with Qualcomm, MediaTek and Samsung's System LSI. The same architecture will power the next generation of Gemini Nano, the on-device model inside Android and Chrome.

WHY IT MATTERS

Veo 3 removes the separate dubbing step from generated-video pipelines, and Mariner's arrival in Search is a land grab on the browser-action layer your own agent probably depends on. The architecturally load-bearing item is Gemma 3n: a 2-3GB open multimodal checkpoint means OCR, classification, routing and transcription can run on-device, taking them off your token bill and out of your data-residency problem — worth costing against an API call the next time you design an ingestion path.

Google: 100 things we announced at I/O 2025Google: AI Mode in Search — updates from I/O 2025Google DeepMind: announcing Gemma 3n preview
MON · May 19, 2025mcpagentsmicrosoftsecurity

Build 2025: MCP moves into the Windows 11 shell, and Microsoft and GitHub take seats on the protocol's steering committee

Microsoft's Build keynote on May 19 made the Model Context Protocol the center of its agent story: an early preview of MCP support in Windows 11, a Windows MCP registry, and an updated MCP authorization specification contributed back to the ecosystem. Microsoft and GitHub joined MCP's steering committee, and Microsoft introduced NLWeb, an open project in which every endpoint is itself an MCP server, alongside multi-agent orchestration in Copilot Studio and Microsoft 365 Copilot Tuning.

The same post is a working threat taxonomy for agent harnesses, naming cross-prompt injection, tool poisoning, authentication gaps, credential leakage, command injection and registry supply-chain risk. Microsoft's own framing is blunt: for a chat app a prompt injection means a jailbreak or memory leakage, but with MCP the ceiling is full remote code execution. Windows 11 MCP support was announced as a preview, with the developer preview following in the coming months.

WHY IT MATTERS

This is the week agent tooling stopped being a side project: one tool-calling protocol now has a steering committee, an auth spec and an OS vendor mediating it in the shell. For anyone shipping an agent, that security list is the build checklist — scope each MCP server's credentials, sandbox the process, and treat tool descriptions and tool output as untrusted input, because the same protocol that lets you build once and integrate everywhere also lets one poisoned server reach the host. Design the tool layer as a boundary you can revoke and audit, not as a plugin you trust.

Microsoft: Build 2025 — the age of AI agents and the open agentic webMicrosoft: Securing the Model Context Protocol on WindowsTechCrunch: GitHub and Microsoft embrace Anthropic's MCP spec