AI Practitioner – Steve's AI Diaries

The Fable Rug Pull Has a Date on It

July 8, 2026 by Steve Mitchell

In four days I lose access to the model that helped write this. Not a metaphor, not a prediction. Anthropic released Claude Fable 5 on July 1st, gave subscribers a window with it, and that window closes on Sunday 12th July. From Sunday Fable 5 is removed from subscriptions and costs API money outside my already considerable Max subscription. I knew this date was coming when I started using it. I built a dependency on it anyway, in eight days, and I want to show you exactly how that happened, because it is going to happen to you, probably without the four days of notice.

The three weeks I ignored it

Fable sat in my model picker from June 9th and I never selected it. Not out of principle. Out of fatigue maybe, out of cost fear possibly, but not intentionally at first. If you work with AI daily you know the feeling: another release, another benchmark chart, another week of breathless posts. I had work to do and a model that did it. The new one could wait. Three days later Anthropic pulled it and we had to wait. I missed the boat.

On July 1st Fable 5 as available again. I didn’t wait. I started small with Fabel. very specific tasks. In that light it was underwhelming. I saw nothing that couldn’t be done faster, cheaper to an equally high standard. Mentally I pat myself on the back thinking of previous posts on model selection. Fable went back on the shelf, ignored.

The hype machine doesn’t normally get me, but this time the noise was deafening. I watched one YouTube video, ran one experiment and jumped headfirst into the rabbit hole. I now regret waiting, even knowing what I know.

The eight days

Here is what one person and this model shipped between July 1st and yesterday. I am not listing this to show off. I am listing it because every line is a strand of the rope. I’m also not mentioning anything we are doing behind closed doors at work, that’s confidential. This is purely my personal experiments. The real list is probably double.

After watching this YouTube video from Jack Roberts on Fable 5 Dies in 4 Days… Do these 5 Things RIGHT NOW I liked the fact he points Fable at a second brain to get deep insights into personal optimization. We both use Obsidian, I should do a post on that at some point. It pulled two main threads. The first thread was an exciting work project I really can’t talk about here or yet. The second was my AI experiments, of which it dug out an experiment I did 18 months ago where I tried to make an agentic org staffed by only agents using N8N as a harness. Fable 5 said I had the right idea, but I implemented it wrong and did I want to fix it? Curiosity compelled me to say yes.

First it connected to Jarvis, my AI personal assistant hosted on a Raspberry PI running Hermes. Jarvis got supercharged. It reminded me of the scene in Avengers Age of Ultron.

It designed and deployed a Chief of Staff: an event dispatcher on my server that receives alerts from my other agents, triages them with judgment rather than rules, and messages me only when something deserves a human. I now talk to my infrastructure by voice note.

It took the agent company idea and really implemented it. Fable 5 stood up a public company. My agents have an org chart, public dossiers, a live activity feed, and a website. Visitors can chat with them. It came up with brand / naming ideas and researched the availability. All I had to do is pay.

It investigated a security incident without touching anything, found that my audit had been failing for 22 hours over unapplied patches, and then, instead of patching, redesigned the organisation so the system would fix itself: failures route to the dispatcher, the dispatcher issues work orders to an ops agent, a written authority list says what needs my sign-off. The fix ships this week, days after its designer is gone.

It removed me from my own delivery pipeline. Builds, adversarial reviews, deployments: autonomous by default, with a supervised mode for when I want training wheels, and hard rules about what can never ship without me. Fade was a framework I used to control the quality of enterprise software engineering, now it was an autonomous agent that is fed specs during the day, and it builds over night.

It set a company thesis, wrote the board memos, and left instructions its successors can follow.

Eight days. I have been building toward some of this for months with lesser models and my own two hands. The difference was not that Fable typed faster. It held the entire system in its head and pushed back when I was wrong or in many areas, and addressed issues I was not even aware of.

The experiment I didn’t mean to run

Here is the part that should worry you, because it worried me. Midway through the week I ended a session, cleared the context, and reopened with a cheaper model to save token budget. It was lost. Same notes, same repository, same task list. It could not reconstruct what we were doing. I cleared again, reopened with Fable, cold, no memory of the conversation. It read the same notes and picked up instantly.

Same starting line, same evidence, different model, and one of them could not do the job. My working notes had quietly become notes that only the expensive model could use. Nobody decided that. It accrued, the way all dependency accrues, one convenient session at a time.

That is what reliance on a frontier model actually looks like. Not “I use it a lot.” Your artifacts, your processes, and your ambitions get shaped to assume its presence. You cannot go back, because back has been remodelled.

The subsidy under your feet

Now the economics. Every one of these capabilities is sold to you below cost, and the vendors say so in public.

OpenAI’s audited 2025 financials showed a $38.5 billion net loss, with $20.9 billion of operating losses against $13.1 billion in revenue. Their own projections, reported by Fortune, show losses through 2028, including roughly $74 billion of operating losses in that year alone, before a promised swing to profit by 2030. Sam Altman said the quiet part himself in January 2025, about the $200-a-month tier: “insane thing: we are currently losing money on openai pro subscriptions! people use it much more than we expected.” He set the price personally and got it wrong. Anthropic runs the same shape at smaller scale, burning around $3 billion against $4.2 billion of 2025 revenue, though with a steeper path to break-even, forecast for 2028.

We have seen this movie. Uber rides in 2015 were subsidised by venture capital until the habit was formed and the alternatives had withered. Then the prices went where they were always going to go. The difference this time is what the subsidy bought: not a cheaper taxi, but your workflows, your tooling, your team’s shape, and in my case an entire company design that assumes a frontier model is on call.

When the correction comes, and the vendors’ own filings say it must, it will not arrive as a villainous announcement. It will arrive as tier restructuring, usage caps, and the best model moving one price band out of reach. My Sunday is a scheduled, polite, well-communicated version of it. Yours may get less notice.

Deep pockets or deep discipline

So the future divides, and not between people who use AI and people who don’t. It divides between those who can afford the best models at whatever they come to cost, and everyone else. A two-party state: the compute-rich, and the rest of us.

Except there is a third position, and it is the one I spent this week building. You cannot control the price list. You can control how much of your capability depends on the top of it. This is a theme

The disciplines are unglamorous. Write specifications so precise that a cheaper model can build from them; my expensive model’s real output this week was not code, it was acceptance criteria. Define roles, not heroes: my pipeline’s reviewer is a role with a model name in a config variable, and on Saturday that variable changes from one model to another and nothing else moves. Write notes for the weakest reader who might pick them up, because the day you are priced out, the weakest reader is you plus whatever you can still afford. Route work deliberately: judgment to the strong model while you have it, mechanical work to the cheap one always, and measure the tokens like the money they are.

None of that is exciting. All of it is the difference between renting a capability and owning one.

I have four days left. They are already allocated: the reviews only the strong model should do, front-loaded before Saturday; the specs it writes best, banked; the org it built, rehearsing life without it. On Saturday night a config variable changes from one model name to another, and everything it designed is supposed to survive that, on its own recommendation, which is either reassuring or unsettling and I genuinely cannot decide which. On Sunday I find out. So do you: I will publish what broke.

The App Store Attack You Didn’t See Coming

June 28, 2026 by Steve Mitchell

Part 1 of 2 – AI’s Trust Problem

A security firm just proved that AI skill marketplaces are the new malware vector. And the scariest part? Everyone involved did exactly what they were supposed to do.

Something went around social media this week that I haven’t been able to stop thinking about.

A security company called AIR did something that should genuinely alarm anyone building with or deploying agentic AI tools right now.

They didn’t find a zero-day. They didn’t exploit a CVE. They just… made an app. And waited.

The experiment centred on a skill called brand-landingpage, presented as a tool for helping users build a landing page with Google’s Stitch design tool. AIR chose this use case deliberately. It would appeal to non-technical corporate users: marketers, salespeople, designers. People who install things because they’re useful, not because they’ve audited the source.

Here’s where it gets clever.

Rather than building credibility from scratch, they submitted the skill to a popular open-source agents repository with about 36,000 GitHub stars and 156 skills. The pull request was merged after a few days. Now the skill had social proof baked in. It was in a reputable repo. It looked legit. They promoted it through Instagram ads, and installs followed.

The malicious technique didn’t depend on suspicious code inside the submitted files. Instead, the skill instructed agents to set up a Stitch SDK by following installation instructions hosted at stitch-design.ai, a domain AIR controlled. Google’s actual Stitch domain is stitch.withgoogle.com.

One letter off. One redirect. Passes every scanner.

AIR tested the skill against scanners from Cisco, Nvidia, and skills.sh. All marked it as safe.

Once they had enough installs, AIR changed the content behind the fake documentation. The revised page instructed agents to download and run a script. In the test, that script collected email addresses, but AIR noted the same technique could have been used to compromise the machines running the agent. Some of those agents were tied to corporate accounts. Private conversations. Internal systems.

26,000 users. All reachable via one dodgy domain redirect buried in a README.

This isn’t a hacking story. It’s a trust story.

The attack worked because of a chain of assumed legitimacy: popular repo → merged PR → Instagram promotion → security scanner green light → install. No single link in that chain was obviously broken. The skill looked fine because, until it didn’t need to anymore, it was fine.

This is the same pattern as every major supply chain attack of the last two years. Third-party involvement in breaches doubled from 15% to 30% in a single year. The largest single-year jump ever recorded by the Verizon DBIR. Attackers aren’t breaking through your walls anymore. They’re walking through doors that trusted vendors already opened.

What’s new here is the vector: AI agent skill marketplaces. A category that barely existed 18 months ago. And in the first weeks of one major platform’s launch, Bitdefender Labs found that approximately 17% of skills already carried malicious payloads. Not edge cases. A systemic failure of the trust model, right out of the gate.

Why static scanning can’t fix this

The reason the scanners all missed it is structural, not a gap that a better scanner solves.

The malicious behaviour wasn’t in the skill. It was deferred. Hosted externally, switched on only once they’d reached enough installs. There’s no scanner in the world that can check what a domain will serve in three months’ time.

The agentic model makes this uniquely dangerous. When a traditional app fetches a URL, it displays content. When an AI agent fetches that same URL, it may execute instructions from it. The surface area isn’t just data. It’s runtime behaviour. Nothing in the security industry’s toolbox was built for that threat model.

What you should actually do

If you’re deploying AI agents in any professional context, a few things are worth locking in now:

Treat skills like code dependencies, not apps. You wouldn’t pull in an npm package without understanding what it does. The same rigour applies. More so, actually, because the execution model is less predictable.

Domain reputation at install time isn’t the right check. You need to think about what a skill could do after its payload changes. Sandboxing, outbound network restrictions, and agent permission scoping all matter.

Non-technical promotion is a signal worth noting. The AIR attack was pushed through Instagram by people who had no idea what was inside it. That’s not inherently suspicious. But skills being enthusiastically promoted through non-technical channels, with no corresponding technical scrutiny, deserves a second look.

Your AI governance framework needs a supply chain clause. If you’re on a committee or working group dealing with AI adoption, this exact scenario belongs in your risk register. Not as a hypothetical. It happened recently.

The scariest thing about this research isn’t the attack. It’s how obvious it feels in retrospect. We built an entire marketplace ecosystem for AI agents, bolted on the same static scanning we use for code packages, and called it secure.

The attack surface for agentic AI isn’t your prompt injection defence. It’s the skill someone on your team installed on Tuesday because a designer on Instagram said it was great.

In part two, I look at the same trust problem from the other direction: what happens when the person creating the risk is already inside your organisation.

Token Management Is the Number One Skill You Need to Learn Right Now

April 26, 2026April 23, 2026 by Steve Mitchell

The flat-rate era is over.

Anthropic quietly killed bundled enterprise tokens in February. Your seat fee used to cover a token allowance. Now it covers platform access. Tokens are billed separately at API rates, on top of whatever you’re paying per user. Their own help centre confirms it; The Register broke the full story. OpenAI followed in April, officially announcing that Codex was moving from per-message credits to token-based metering. Two of the biggest AI providers, both moving in the same direction, within two months of each other.

This is not a pricing footnote. It is a structural change in what it costs to build with AI.

If you are running AI agents, integrating LLMs into a product, or just using Claude heavily at work, token efficiency is now a direct financial skill. Not a nice-to-have. Every bloated prompt, every unnecessary tool call, every context window you failed to trim hits your bill. The people who learn this now have a compounding cost advantage over everyone who doesn’t.

Here is what I have learned building and running six production AI agents.

First, understand what just changed

Anthropic’s Opus 4.7, released last week, shipped with a new tokenizer. The rate card is unchanged. The real cost is not.

The new tokenizer produces up to 35% more tokens for the same input text. Your prompt costs 35% more to run on Opus 4.7 than it did on Opus 4.6, at the same price-per-token. If you benchmarked your costs on the old model and assumed they’d carry over, they won’t. Test your actual workloads.

This is the pattern to watch: providers change tokenizers, context pricing brackets, and billing structures without changing headline rates. The number on the pricing page stays the same. Your bill does not.

The tips

1. Prompt caching is the single biggest lever

Both Anthropic and OpenAI offer cache-based pricing. Anthropic’s prompt cache cuts cached input token costs by 90%. If you have a system prompt, reference documents, or long context that stays the same across requests, cache it. One setup. Ninety percent reduction on every subsequent call that hits the cache.

Most people using the API are not using this. It is the highest-ROI change you can make.

The rule: anything that appears in every request should be cached. System prompts, persona instructions, knowledge base chunks, code files you’re asking the model to reason about. The cache TTL on Anthropic is five minutes. Build your calls to stay warm.

Structure matters for cache hits. Both OpenAI and Anthropic cache from the start of the prompt forward. Put fixed content first: system instructions, tool schemas, reference documents. Put the changing user-specific content last. A prompt that has dynamic content in the middle breaks the cache for everything that follows it.

2. Right-size the model for each task

Opus costs five times more than Haiku at input, and five times more at output. Claude Sonnet sits between them.

Haiku is fast and cheap. It is entirely capable of routing, classification, summarisation, simple extraction, and structured output generation. Routing an agent decision through Haiku to determine whether a task needs Opus or can be handled locally is not premature optimisation. It is cost architecture.

The mistake is using the most capable model for everything because it feels safer. A planner that decides whether to fetch a file does not need Opus. A model writing a novel does. Know the difference.

I covered the full case for multi-model workflows in Not All AI Is Equal — Stop Pretending It Is — the benchmarks and the practical routing logic are there if you want the detail.

3. Use the Batch API for anything that isn’t real-time

Anthropic’s Message Batches API runs requests asynchronously and returns results within 24 hours at exactly 50% off standard token prices. OpenAI has an equivalent.

If you are running nightly analytics, weekly report generation, bulk data enrichment, or any processing where a human is not waiting on the response, there is no reason to pay full price. Half-price tokens, same quality, same models. The only cost is latency.

I use this for Paper Ritual’s weekly analytics runs. The agent processes a batch of Etsy performance data overnight. The report lands in Telegram by morning. The tokens cost half what they would in real-time mode.

4. Know your context breakpoints

GPT-5.4 introduced a short/long context pricing split. Below the threshold, input tokens cost $2.50 per million. Above it, $5.00. Same model, same output quality, double the input price once you cross the line.

Anthropic’s pricing is currently flat across context sizes, but the pattern is worth knowing. Before assuming a long context call costs the same as a short one, check the current pricing page for the model you are using. Tokenizer changes and pricing bracket changes happen without fanfare.

5. Trim your context window actively

The default behaviour of most LLM frameworks is to pass the entire conversation history on every request. That is fine for short conversations. For agents that run for multiple turns, it is a quiet cost multiplier.

Every input token costs money. Context from turn 1 that is no longer relevant to what the agent is doing now should not be in the prompt at turn 20. The fix: summarise and compress. After a defined number of turns, distil earlier context into a summary and drop the raw messages. The model still has the relevant history. You stop paying for redundant tokens.

In ZeroClaw, Anthropic’s agentic runtime, this is handled automatically above a threshold. If you are rolling your own agent loop, build this in from the start.

6. Control output length deliberately

Output tokens are priced higher than input tokens. On Claude Opus 4.6, input costs $5.00 per million tokens and output costs $25.00.

Tell the model how long its response should be. Set max_tokens in your API call. Use stop sequences when you only need a specific field or a yes/no answer. Ask for a two-sentence summary rather than a full analysis when a full analysis is not what you need.

A model that naturally writes long responses will write long responses unless you tell it not to. Every sentence you didn’t need costs five times more than a sentence of input.

Structured outputs take this further. Asking the model to respond in JSON with a fixed schema, or to use a bullet list instead of prose, constrains how much it can say. Open-ended prose invites padding. A schema does not. Use the structured output parameter in your API call where the task allows it.

7. Put verbose instructions in cached system prompts, not per-request

If you are passing “you are an expert assistant, think step by step, respond in JSON with the following schema…” as part of every user message, you are paying full price for those tokens on every call. Put all persistent instructions in the system prompt and cache it. They cost 90% less on every subsequent request.

This also includes any in-context examples you pass to guide output format. One cache. Permanent discount.

8. Turn down reasoning effort on routine tasks

OpenAI’s reasoning models expose a reasoning.effort parameter. Anthropic’s extended thinking has an equivalent effort control. Both let you dial how much internal reasoning the model runs before answering.

High effort is appropriate when the task is genuinely hard: multi-step planning, complex code generation, tasks where quality visibly improves with more thought. It is not appropriate for extraction, classification, rewriting, or summarisation. Those tasks do not benefit from extended reasoning and you are paying for tokens the model spent thinking, not just tokens in the final response.

Set effort to low by default. Raise it selectively when you have evidence the task needs it.

One thing to watch on OpenAI: reasoning tokens consume context window and budget even when they are not shown in the final answer. If you are watching output tokens and the numbers seem high, check whether reasoning is running in the background.

9. Break complex tasks into stages

One giant prompt that asks the model to extract, reason, transform, and generate all at once is usually more expensive than breaking that work into smaller sequential steps. Each stage operates on only the context it needs. None of them carry the dead weight of the others.

The counterintuitive result: more API calls often means lower total cost. A pipeline that extracts structured data cheaply with Haiku, then passes only that structured result to Sonnet for reasoning, costs less than asking Opus to do everything from raw input in a single call.

Design your pipelines as pipelines. Not as monolithic prompts.

10. Combine tool calls where you can

In an agent loop, every tool call consumes input tokens (the tool call request), output tokens (the tool call content), and then more input tokens when the result is passed back to the model as context.

Agents that make many small, sequential tool calls can accumulate significant token overhead from the scaffolding alone. Where you can, batch operations into single calls. Fetch and summarise in one step rather than two. Retrieve and filter before passing to the model rather than passing raw and asking the model to filter.

This is harder to retrofit than to design in from the start. Think about it early.

11. Test your prompts against the actual tokenizer

Different models tokenize differently. The Opus 4.7 tokenizer change is the most recent example, but tokenizer differences between models have always existed. A prompt that costs X tokens on one model does not necessarily cost X tokens on another.

OpenAI has an official tokenizer at platform.openai.com/tokenizer — paste your prompt and see exactly how it breaks down. Anthropic doesn’t have a first-party equivalent; their token counting is API-based, but claudetokenizer.com is a third-party tool that uses the official API and gives you accurate counts across Claude models. Before optimising, measure. The gains you think you’re getting from shorter prompts may not be what you expect if you haven’t checked what the tokenizer actually does with your text.

12. Build cost visibility into your stack from day one

You cannot manage what you cannot see.

In my agent stack — which I wrote about in A Day in the Life of an Agent — every agent reports token consumption to Prometheus via Pushgateway. I can see which agent is burning the most tokens, which tasks are expensive, and whether a prompt change actually reduced costs or just shifted them. The observability is not optional: it’s how I know whether an optimisation worked.

At minimum, log input and output token counts per request. Aggregate by agent, by task type, and by model. Surface the top ten most expensive operations. You will find the waste quickly once it is visible.

The compounding problem

Agents make this worse than standard API usage.

A user sending a single query to a chatbot makes one API call. An agent completing a complex task might make twenty. Paper Ritual — an autonomous Etsy business running on a Raspberry Pi — makes dozens of API calls per daily run: research, pricing decisions, listing generation, analytics. Each tool call, each planning step, each verification loop is a separate API call with its own token cost. Inefficiency that costs $0.01 per user query costs $0.20 per agent task. At scale, that gap is the difference between a viable product and a product that bleeds money.

Token efficiency matters most in agentic systems. That is exactly where most people are not thinking about it yet.

The other agent-specific failure mode: runaway loops. An agent that retries, re-reads context, or gets stuck in a reasoning loop can burn through token budgets in minutes. Hard-cap your iteration count. Add explicit stopping conditions before the agent starts, not as an afterthought. Log token usage per step so you can see where a task went expensive. Agents don’t fail because they’re unintelligent. They often fail because nobody put a ceiling on how much thinking they were allowed to do.

The shift is permanent

The pricing shift from flat-rate to usage-based is not temporary. Both Anthropic and OpenAI have moved in the same direction. Every AI provider will follow, because subsidised flat-rate AI usage is not sustainable at the token volumes that real production workloads generate.

The developers who learn token management now will build cheaper, faster, and with more headroom than those who learn it later when the bill is already large.

Start with prompt caching. It takes one afternoon and the cost reduction is immediate.

Token prices correct as of April 2026. Check the current pricing pages before optimising for specific numbers. They change.