AI code ships with a security flaw 45% of the time — and GPT-5.6 just got 80% cheaper to write more of it

Three things happened at once this week: the frontier labs kept cutting prices and shipping remote-control tooling, Georgia Tech built a live scoreboard for how much security debt vibe coding is quietly racking up, and the job market keeps proving it's not one market anymore. Also — our own portfolio landed its first paying customer this week, on a product I wasn't expecting to be first. Let's get into it. ## This Week in AI Coding - **Claude Code's usage boost got extended, but the price hike didn't.** Anthropic extended the temporary 50% weekly usage boost for Claude Code subscribers through August 19. Meanwhile Sonnet 5's promo pricing ($2/$10 per million tokens) still sunsets August 31 — standard pricing ($3/$15) kicks in September 1. If you're running Sonnet 5 in Claude Code like I am, enjoy the last month of the discount. - **GPT-5.6 got 80% cheaper, and o3 got a retirement date.** OpenAI cut GPT-5.6 Luna pricing 80% and Terra 20% on July 30 ($0.20/$1.20 and $2/$12 per million tokens respectively), while o3 is set to retire from ChatGPT on August 26 after its 90-day sunset. Frontier price wars keep rewarding whoever ships this month, not whoever benchmarked best last month. - **Codex Remote hit general availability on every ChatGPT plan.** You can now start or continue a Codex session on a connected Mac or Windows host and review, approve, or redirect it from the ChatGPT mobile app, via QR-paired device auth. Approving a diff from your phone while the agent works on your laptop is either the future of async dev or a great way to fat-finger a prod deploy from the couch. - **GitHub Copilot Chat shipped an Agent (Preview) mode**, built on the same Copilot SDK that powers the Copilot CLI — fewer round-trips to get a task right. Also quietly happening: the Copilot Billing Preview app retires August 3, right as the Business/Enterprise promotional AI-credit window (extra $30-70/mo pooled credits) winds down. - **Anthropic's "Claude for Open Source" program expanded.** Qualifying maintainers and core contributors get 6 months of Claude Max 20x (normally $200/mo) free — eligibility now explicitly covers maintainers of critical-infrastructure packages, not just projects with headline download counts. If you maintain something widely depended on, this is real money on the table. - **Georgia Tech is now tracking AI's security debt in public.** The "Vibe Security Radar" project logs CVEs directly attributable to AI-generated code; one research note pegs the flaw rate at 45% of samples across 100+ models, with roughly 20% of AI-generated dependency references pointing at packages that don't exist ("slopsquatting" bait). This is the CyberOS thesis in one sentence: shipping fast with an agent means shipping someone else's unreviewed CVE too. - **The job market is splitting in two, not collapsing.** AI/ML roles are facing a 63% talent shortage (500K+ open positions, 15-25% pay premium), while junior/entry-level hiring keeps shrinking — down 25-28% at Big Tech from 2022 levels. Translation: if you can architect and review AI output, you've never been more employable. If you're two years out and copy-pasting suggestions, you're competing with the thing that made the suggestion. ## What We Shipped - **Cheshbonai landed the portfolio's first paying customer** — anywhere. Not the product I'd have bet on, but real recurring revenue on cheshbonai.com moved it straight to the #1 "now pushing" slot on veridux.ai. - **Johnny (our AI co-founder platform) is back healthy** after a 9-day outage — root cause was a GCP spend cap on the project, not a code bug. VPS key rotated, gateway active again. - **Honest miss:** the YouTube render pipeline is still stalled (~110 scripts drafted, none rendered), and our internal billing tracker hit its third straight blocked run this week on an expired gcloud auth token. Moving that to a service account so it stops happening on a schedule. ## Tool of the Week: Vibe Security Radar Georgia Tech's Systems Software & Security Lab built a live feed of CVEs traced back to AI-generated code — the first project I've seen actually quantify vibe coding's security debt instead of just gesturing at it. Worth a bookmark if you ship with an agent and skip the review step more often than you'd admit. It's also exactly the gap CyberOS exists to close on your own repos: automated AI-code review before the CVE, not after. ## Quick Links - [GPT-5.6: Frontier intelligence that scales with your ambition](https://openai.com/index/gpt-5-6/) - [Work with Codex from anywhere](https://openai.com/index/work-with-codex-from-anywhere/) - [CSA Research Note: Vibe Coding's Security Debt](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/) - [Claude for Open Source](https://claude.com/contact-sales/claude-for-oss) --- More at [endofcoding.com](https://endofcoding.com) · Building a resume-worthy AI coding portfolio? [vibecodingebook.com](https://vibecodingebook.com) · Job hunting with AI? [llmhire.com](https://llmhire.com) · Videos on [YouTube @endofcoding](https://youtube.com/@endofcoding)