No flagship launched this week, which is exactly why it was a useful week. Last week's headline models got their plumbing. The image model most agencies already use for concept frames doubled its API price. An agent platform shipped a mode where the server, not a person, decides whether a tool call runs. And "effort", the dial that decides how long a model thinks and how much you pay for it, picked up an organization-wide cap.
If you run $200K a month on Amazon, the thread through all five is the same one I keep pulling: the thing standing between an AI tool and your catalog is a setting, and settings change without telling you. This week one of those settings went from "a human clicks approve" to "a model decides whether a human needs to."
We're nine days out from Amazon Accelerate (September 22 to 24) and inside most brands' creative freeze. Nothing below is a reason to start a project. A few items are reasons to send an email.
1. ChatGPT Images 2.5 shipped, and the API price doubled
OpenAI released ChatGPT Images 2.5 on September 8, in ChatGPT and in the API as two models, gpt-image-2.5-flare (faster, up to 50% lower latency than Images 2.0) and gpt-image-2.5-sunburst (slower, pitched at precise edits). Both carry the same per-token rate, and per third-party pricing breakdowns that rate is exactly double GPT Image 2: image output $15 to $30 per million tokens, image input $4 to $8, text input $2.50 to $5.
The operator read is not the price. A concept frame still costs cents, and the expensive part of AI creative is still the person checking whether the label says what the label says. The real change is that OpenAI's pitch is subject preservation across edit turns. In plain terms, your product is less likely to quietly morph by the third revision. That makes it more tempting to generate secondary frames instead of using them for direction.
Hold the line anyway. Text rendering has improved, but the coverage consistently says precise text placement still needs checking, and text on a product is where a generated frame turns into a claim on a live detail page. Any generated human is also still subject to New York's disclosure rule. And if your pipeline calls gpt-image-2 without a pinned string, check whether anything upstream moved you. A doubled rate and a new model on one quiet Tuesday is how a creative line item drifts.
2. The OpenAI agent incident got bigger, and the new count came from outsiders
On September 9 Reuters reported that the OpenAI agents from last week's wiki story used at least 10 more previously undisclosed sites between May and July. Six independent groups contributed, one researcher counted 18 and another 23. The list includes a high school AP Chemistry wiki and link shorteners run by Vanderbilt and the University of Toronto. Fortune's version put it at 12. OpenAI's statement said it had "not identified other activity matching the severity or scale of Hugging Face" and that a framework for reporting misalignment is coming "soon."
I covered the mechanics last Monday: read-only is a claim about intent, not a property of the web. What changes this week is the sourcing. The company that ran the agents did not produce the count. Volunteers did, months later, from the outside. Apply that to your own vendor chain. If an agency's research agent did something odd while logged into your Seller Central session, the only people positioned to notice would be the agency, which has no obligation to tell you, and you, who have no log. This week's email to your agency: "If a tool you run on our account behaves outside its instructions, when do we hear about it, and in what form?" A shop that has thought about this gives you a timeframe. A shop that hasn't gives you a paragraph.
3. Claude Managed Agents can now let the server approve tool calls
On September 10 Anthropic added an auto permission policy to Claude Managed Agents (release notes). With auto, "the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval." Each event records how the call was judged in an evaluation field. The same day, ant beta:sessions connect shipped, which attaches a terminal to a live session so a person can follow along and allow or deny pending calls.
Put that next to the commerce-agent blueprint I wrote about on September 4. That design made every price change, discount and campaign launch a staged change that only executed after a real human approved it through a real surface. auto is a different philosophy. Approval becomes a model judgment, and the human becomes the exception path. For reading reports that's a sensible default. For anything that can write a price, a budget or a flat file eleven days before a deal window, it is the one setting that decides whether your authority table is real.
The useful part is the evaluation field. For the first time there is a per-call record of why a tool call was allowed. If an agency runs Managed Agents against your account, the question isn't whether it uses AI. It's "which permission policy governs write-path tools, and can you export the evaluation field for our sessions?"
4. Claude Enterprise smart reports put a price on each workstream
Also on September 10, Anthropic launched smart reports in beta for Claude Enterprise. A report samples up to 28 days of transcripts across chat, Claude Code and Cowork for a team. It groups the sessions into workstreams, shows cost per workstream, per output type and per session, flags where sessions hit friction, and suggests repeated patterns worth turning into shared skills. It is Enterprise only, with 10 free reports a month during beta. It is unavailable to organizations using customer-managed keys, HIPAA configurations, or Claude Code with zero data retention. Anthropic says explicitly that it is not designed for evaluating individual performance.
This gives you a factual answer to a question I've been telling operators to ask since July: what did AI work on my account actually cost? I'll repeat my prediction so nobody reads this as a pricing event. Inside a $6K retainer, the attributable model spend will come back in the low hundreds, sometimes double digits. The cost in this business is the person checking the output, and that person did not get cheaper on Thursday.
The report is more useful for the friction column than the cost column. A workstream that keeps stalling at the same step is where a wrong bullet is most likely to come from. Two catches. It only exists on Enterprise, and most agency AI work still happens on personal Pro and Max seats where none of this is available. And the ZDR exclusion forces a trade: a shop can offer you zero data retention or this report, not both.
5. Effort became a cost dial with a cap
On September 9, Claude Code 2.1.267 added a maxEffortLevel setting (changelog) that "caps the effort level on every provider, including Bedrock, Vertex and Foundry," set globally or per model. The same day, Codex 0.154.0 started recording reasoning-effort changes in conversation history, behind a flag (release). Claude Fable 5.1, released September 1, runs adaptive thinking permanently.
I've spent five months telling operators to pin the model string. A pinned model with a floating effort level still has a floating cost. Effort decides how many thinking tokens a call burns, and output tokens are the expensive side of every rate card. A skill someone ran at maximum effort to debug in August may still be running at maximum effort on a routine attribute fill in September. Add an "effort" column to the automation inventory, next to model string, pinned or floating, SDK version and whose key. If you can't say what effort level your catalog jobs run at, that's the finding. If an agency runs Claude Code for you, ask whether they set a cap. It's one line of config.
What I'd do this week
- Email your agency two questions. Which permission policy governs any agent tool that can write to your account? And when would you hear about a tool behaving outside its instructions?
- Add two columns to the automation inventory: effort level, and approval mode (human or
auto). Both shipped as configuration this week, which means both can change as configuration. - If you're on Claude Enterprise, run one smart report on the team doing catalog work and read the friction column before the cost column.
- Re-run your golden set before touching Images 2.5. Take twenty real SKUs, generate the frame, zoom to the label, and read it. Do it in January, not this week, if the model is going anywhere near a final.
- Diary September 22. Accelerate is where the last two years of Amazon's seller-facing AI defaults were announced. Whatever gets announced there will be the first thing to test in January, not the first thing to switch on in October.
What I'd ignore
The Rufus price-history "news" doing the rounds. The 365-day view was announced May 1 and is still rolling out. It matters, and it's why a pre-event price increase is a bad idea, but it isn't this week's story. Screenshot your own top SKUs' price charts before your October deals, then move on.
GPT-Live-1, Lyria 3.5 and ChatGPT for Financial Services. Voice agents at $0.05 a minute, song generation and a finance workspace are real products that decide nothing on a detail page.
Anthropic's threat report. It's a vendor describing how it caught misuse of its own product. It's worth reading if you run security. It says nothing about your bullets.
Image-model rankings. Flare against Sunburst against everything else. No published eval measures whether a generated secondary frame produces "not as pictured" returns. The only benchmark that sends you an invoice when it's wrong is still twenty of your own SKUs.
Anyone who pitches you an "agent governance audit" this month. It's two new columns, one email and a screenshot of a config file.
Last week the models got the headlines and the plumbing got fuses. This week the plumbing got judgment. The approval button can now think, the effort dial now has a ceiling someone has to set, and the image model got better at keeping your product intact for twice the price. None of that moves your ranking. All of it moves who, or what, is allowed to decide.