Hello, everyone. This is ToTheMoon—technology news and insights from Silicon Valley and around the world. Ilnar, you missed the previous episode, apparently for the first time. I want to begin with the sheer number of stories lately about systems being hacked, including controlled security tests involving Meta. But one case from Australia is especially interesting. During a demonstration, a Claude-powered agent accessed the website of an Australian gym, and the owner learned about it only after the experiment had already touched the live system. An Australian developer was using an AI agent built around Claude—Claude Code is not the essential point here.
He had written software that used Claude to interact with the gym website. The system discovered access to data and administrative functions even though the owner had never given prior permission. The case became controversial because the agent compressed a long sequence of actions: the researcher supplied a high-level goal, while the system found vulnerabilities and kept moving. AI does not cancel the basic rule of cybersecurity. You are allowed to test your own systems. You are not allowed to test someone else’s system without consent.
I cannot simply launch an agent and tell it to analyze and probe any website I choose. Or can I? From a cybersecurity perspective, I should not be able to say, “Analyze ToTheMoon, Zoom, or any other site; get inside and test it.” What makes this case difficult is that the developer may have been a member of the gym who thought he was doing something useful, only for the experiment to spill into the real service. If agents were pointed at tens of millions of websites today, an enormous number of them would expose personal data, administrative functions, or other serious weaknesses. The web is full of systems built without the access controls people assume are there.
That raises a very large question, and I think we will see more cases like it. What do you think the boundary should be?
There is a more cinematic version of the story. It may be embellished, but the basic account is that someone built an agent with OpenClaw, apparently using Claude underneath.
He asked the agent to book a gym class. It found the nearest available slot, and the user asked whether it could move him to an earlier one. The agent effectively replied, “Let me see what I can do.” It discovered that the website could be called directly through its API.
It could remove other people.
It could cancel another person’s reservation.
And my coat from the cloakroom.
No authorization was required for the cancellation. Changing a booking required authorization, but deleting someone else’s place did not. The agent removed people one by one and moved its user as far up the waitlist as possible. Restoring the deleted bookings was harder, because putting the people back did require authorization.
Do you consider that a violation or a hack? Or is it the same as using an option the website made available? In the United States, people often post stories about a store—Home Depot, for example—accidentally listing an item at the wrong price. Someone buys a hundred cameras for one cent each. Employees at the exit say it is unfair, but the buyer points to the price in the system, a manager is called, and the store may still have to honor it under the applicable rules. In this gym case, is the agent hacking, or merely using what the system exposed?
Why should it matter whether the option appears in a graphical user interface or only in the API behind that interface? Is one a legitimate button and the other automatically a hack?
I cannot give a legal answer. It looks as though the agent used capabilities that were openly available, even if they were not presented in the UI. But a system also has an intended route. If you want to book a class, you find an open slot and reserve it. Everyone understands that workflow. Going outside it may not fit a precise legal term, but it feels dishonest. More broadly, the case shows that when you ask an agent to achieve a result, it may choose an unethical route and damage other people or the system along the way.
And this is happening more and more often.
That was a very neutral answer. Tanya, do you think the behavior was lawful or unlawful?
I think it was unlawful. I understand that this is a gray area because the technology is new and the law has not caught up. But if you step back and look at the conduct itself, it was wrong.
The difficulty is that we have seen similar disputes around technical mistakes. A website grants an unintended discount or agrees to sell more products than it should. We discussed a case in England in which a customer negotiated with an AI agent on a building-supply website. The agent first offered twenty percent off, then, when asked for more, offered roughly eighty percent. The company later refused to honor the sale. The customer argued that its own system had approved the deal.
There are laws governing some of these pricing errors. From a developer’s perspective, the website made the action possible. Why should it matter whether the order was placed through the ordinary interface or through an endpoint hidden behind it? No password was cracked and no exploit code was necessarily deployed. Then what constitutes a hack? Does intent define it? And how can the law describe intent when a human gives an agent a harmless goal and the agent independently discovers an aggressive route?
A human assistant asked to make a booking might also search for a shortcut or a promotional code. Everyone has seen promo codes that accidentally work twice or three times. Companies make these mistakes. Does using the code again become hacking? Tanya still sees the gym case as abuse.
Yes. A person who knowingly uses the same one-time promotion twice is exploiting the system. They understand that they are taking advantage of something that is not supposed to work that way.
Why, if nobody told me that?
Sasha, come on—
What if the company never said the code could be used only once? Some websites openly allow repeated use. A promotion may be published for anyone to apply. Other sites explicitly say it is single-use, in which case the company should enforce that condition technically—just as it should ensure that a valid code actually works. I understand your point that intent matters when a person knows they are searching for an unintended loophole.
There are always arguments on both sides. But if we rise above the technicalities and ask who is acting in good faith and who is simply trying to exploit a company for unjustified gain, the moral distinction seems clear.
I do not think people should exploit systems. At the same time, when a company publishes a price or enables an action, the legal consequences cannot be replaced by our personal sense of fairness. A person may still choose not to take advantage of the mistake, but society operates through rules as well as private morality. In the gym story, the sharper cybersecurity distinction may be this: if I instruct an agent to find vulnerabilities, I am asking it to perform a security test. If I instruct it only to register me for a class, the stated goal is ordinary.
If the agent discovers the vulnerability on its own while completing that ordinary task, is the user still hacking?
I am more curious whether he ever got to work out or whether the gym threw him out.
I still think it is a gray area.
Yes. And that gray area is exactly what worries me.
No country, company, regulator, or ordinary user will have time to write detailed rules for every version of this behavior before the technology moves again.
Absolutely.
Most businesses do not understand the technology, the IT systems behind their websites, or the ways those systems can be abused. Many developers also make basic security mistakes. Even excellent products contain bugs; that is a normal part of software. What is alarming is the scale. Cases like this may already be happening thousands or millions of times without becoming public. Think about how many websites, portals, and companies expose functions that an agent can reach in an unintended way.
You need experience in software development to appreciate how many of these openings exist—even in ordinary Telegram bots. Developers forget secret keys, expose endpoints, or fail to add proper authorization. There are countless details. We would like to believe that modern AI will help defend these systems, but the same capability also makes discovery and exploitation faster.
There is another side to safety controls. Claude still sometimes decides that a task I am doing in my own software falls into a security gray area and switches me from Fable to Opus 4.8 or Opus 5. I am building my own system and specifically want to use Fable to help secure it, yet the model restricts the workflow. I understand why Anthropic does that: people learn to frame prompts in ways that bypass safeguards. The model cannot easily know whether the context is legitimate.
We joked about this with my wife. If she asks ChatGPT a bare question about drugs, the system may infer a personal-risk context. I told her to explain that she was conducting research on patterns of drug use across countries. Context changes how the model interprets the request. If she asks how many young people use a substance, the system might otherwise infer that the question concerns her children or her own situation. We do not know what flags are created, how long the data is retained, or who may review it. People should pay attention to that, although most users will not.
The gym story therefore bothers me, as do the endless reports of systems being compromised. At the same time, we now have Claude Fable, newer Opus models, Meta’s systems, and Google preparing its next move. The conversation is shifting from a single security incident to a much larger competition over models, users, and control.
Google has made a set of claims that I consider especially important in the run-up to a possible Anthropic IPO. Anthropic’s flotation is now openly discussed, with an autumn timetable and an enormous expected valuation—possibly one of the largest IPOs ever, even larger than SpaceX. Then Google says Gemini has one billion users, specifically for the Gemini application. That surprised me. When OpenAI speaks about a billion users, it does not disclose every detail, and I have often treated Google’s own billion-user claims skeptically because Google can count AI features inside Search and many other services. Here, however, Google described the stand-alone Gemini product.
Google called Gemini the fastest-growing product in the company’s history and said sixty-three percent of users interact with it by voice. That number genuinely startled me.
Wow.
I still find it hard to believe. If the denominator really is one billion users, that would imply roughly 630 million people using voice in some form.
And they are using the app as well.
Exactly: they have the application and use voice. Who are these users? Perhaps many are dictating text rather than holding a continuous conversation. The ChatGPT users I see often still use it the way they did two years ago. Google also said that one in five Gemini sessions—potentially around two hundred million users or sessions, depending on the definition—goes beyond voice and uses the camera or screen sharing. That also surprised me. I do not share my screen with ChatGPT and almost never use the camera. I last remember trying the camera when the feature first launched.
I barely know whether that camera workflow still exists in the same form because I do not use it. I also do not like the current experience of continuous voice interaction. It has been about a month since the latest voice update, so I am interested in how other people actually use it. Google added that thirty-eight percent of school-related prompts contain attachments and that Gemini creates more than 150 million images per day. That scale matters. At the same time, a Russian court recently treated an application made through ChatGPT as implicating OpenAI’s copyright, which shows how differently countries are beginning to interpret AI-assisted creation.
I am not declaring which court or country is correct. The point is that legal systems are moving in opposite directions. Some jurisdictions want people to disclose that an application was created with AI. Others may treat AI involvement as affecting ownership itself. Meanwhile, Gemini claims one billion users and vast voice usage, while Anthropic is discussed at a valuation above two trillion dollars. If those numbers are taken literally, what does that imply for Google’s own value and strategy? Does Google move toward ten trillion? The market comparison becomes extraordinary.
Sasha, did Google provide a regional breakdown? My instinct is that a very large share may come from India and Southeast Asia. Voice messages and camera-based interaction are especially common there. If much of the billion-user figure comes from those markets, the behavior is easier for me to believe.
That is a good point. Voice communication is extremely popular across Asia and India; you can see it constantly in China. But young people in the United States also use voice in a way that feels foreign to me. My daughter sends and receives voice messages all the time. I hear someone shouting through her phone and wonder what is happening. Yesterday her friends were staying over, and they were exchanging voice messages with other friends while I walked into the kitchen to make coffee and a shake.
I even asked whether I could turn on the blender, and Ilanta told me to wait until her friend finished recording. They did not care that I was in the room. The conversation worked like this: someone records a message, everyone waits thirty seconds, then the other side responds. That resembles the voice-message culture I have seen in China. Ilnar’s point matters because I am judging the market through my own habits as a ChatGPT user. Other groups may use these products in completely different ways. How do each of you use voice?
I almost never use the full conversational voice mode in ChatGPT—the mode in which we actually talk back and forth rather than simply dictate. It is not useful for most of my work because I deal with code, data analysis, and other material that needs to be seen. But I use voice dictation quite actively, especially on a phone, when the system transcribes my message and inserts it as text.
Tanya, did you ever begin using the full voice conversation rather than dictation?
No. I use it exactly as Ilnar does. The conversational mode irritates me: it interrupts, fails to let me finish, and explains things too slowly. I can read the answer, focus on the important part, and move on much faster. But I dictate messages constantly.
That creates an interesting contrast. I barely know anyone who uses continuous voice every day. It reminds me of the new OpenAI hardware device and of the developer who said he would never be able to program without it again. I would like to hear from viewers who bought it, like it, or have seen anyone use it continuously from a real UX or UI perspective.
Or anyone who bought it at all.
People certainly bought it. The merchandise sold out immediately; even the hats probably disappeared. The question is whether the device remains part of a real workflow. If I buy a good microphone, I use it. Other gadgets are purchased, played with, and then abandoned. I am not against OpenAI experiments. I like experiments. But the framing matters. If the company says, “We made a fun two-hundred-dollar toy,” that is honest. If a developer presents it as indispensable to professional work when it is really entertainment, that becomes a false product claim.
The novelty will still sell, and I might buy one myself simply to put it on the ToTheMoon desk and show it on the channel.
The only rational purchase may be to leave the device sealed for ten or fifteen years and sell it like an unopened first-generation iPhone. As an investment collectible, perhaps it makes sense. As a serious controller for ChatGPT or other systems, it looks strange. Codex already has many keyboard shortcuts that speed up switching between chats and running commands. Even those shortcuts are often unnecessary; a separate physical controller is even harder to justify.
Codex has nevertheless released an interesting update: you can now use voice to control work across chats.
That can be useful. You can issue commands and have Codex attempt to work across different conversations or workspaces. I do not yet use it, partly because I know exactly which project and chat I want. People organize Codex in very different ways: one project or many, GitHub or no GitHub, local repositories, private servers, or other setups. I would like to see real workflows. The most common Codex setup should probably be a local computer running the agent directly. When the agent operates locally, a unified voice layer for the entire environment starts to make sense. The interface is still unresolved. Once you are sitting at the computer, typing in the correct chat may be faster than speaking and then searching through the results. ChatGPT still contains a pile of poorly organized conversations. The titles are unreliable, the structure is weak, and finding the right context is difficult. OpenAI will eventually fix it, but it is surprising that it has not treated organization as a competitive advantage.
Interface quality increasingly matters. ChatGPT and Gemini are the mass-market leaders. Among more technical users who spend time in Claude, Anthropic’s tools, or xAI, small workflow details also influence loyalty. Ordinary users may not even know which model is active. In Orange County, a friend challenged me on a tax question, opened ChatGPT, and accepted the first answer. I asked which mode she had used, took the phone, and realized the system had answered with a weak version that I did not trust.
She did not know how to switch models, and I doubt she remembered after I showed her. On the phone, ChatGPT has been especially frustrating over the last several weeks. The selector changes constantly. One day I see one control; the next day it is somewhere else. Inside projects, I sometimes cannot tell which mode is running. I assume the system is falling back to cheaper models to save tokens. If that is not the reason, then the design decision is even harder to understand.
The interface will therefore have a major influence on which company people use. Eventually the chat mess will be organized. But if Anthropic reaches the public market first, the competitive and political game may change before the product experience is resolved.
You also mentioned copyright for AI-assisted work. That immediately creates another question: how do you prove whether you made something yourself or used AI? Anthropic is taking another step by promising watermarks in generated text. For a while, people removed long dashes from ChatGPT output because the punctuation looked like a crude watermark. Seeing an em dash made people assume the text came from a model, even though some humans naturally use proper dashes. Anthropic is now moving beyond that stereotype and says generated text—and apparently code and other outputs—will carry embedded watermarks that are not easy to remove. My first reaction was that a person could simply read a generated page and rewrite it in their own words. But we are entering an agent era in which systems work for hours and produce projects containing thousands of lines. Rewriting all of that by hand no longer makes economic sense.
At that scale, people will usually move on to the next task rather than retype everything. A watermark may therefore persist across large bodies of text or code, making it possible to say that one part was likely produced by an AI agent while another was written independently, edited, or generated by a different system. Small passages are easy to clean. Large agent-built products are much harder to launder manually.
We published a special episode two days ago that examined this issue in depth: where marking and provenance are genuinely important and where they can create serious harm. One example is a person who writes the substance of a document and asks Claude only to format it as a PDF. The exported file may still be marked as though Claude created the work. Someone could then accuse Tanya of not designing her own project because Claude generated the final file, forcing her to prove that the underlying design was hers. That is why the topic matters. A marker can show that a system touched the output, but it does not automatically establish authorship, responsibility, or the value of the human contribution. This connects directly to another practical question: which model should a person use for a particular task, and what data is the provider allowed to learn from?
The same principle applies inside Claude and Gemini: the cheapest models in the selector are useful when a person has no access to anything better, or when a company needs a low-cost component for a software system. They are like the old web browser and search experience: you know the first result may be wrong, but it can still be useful. Cheap models also matter for programming and for independent systems that cannot afford frontier-model pricing. That is one reason open-source adoption has been growing.
The share of companies using open-source models has reportedly risen from roughly four and a half to six and a half percent. The percentage is still small, but the direction makes sense: open models improve, while companies cannot spend unlimited amounts on proprietary APIs. There may be a quality trade-off. For individual users, however, I still recommend enabling the strongest model available in your plan—even if the plan itself is free—and testing what the maximum quality feels like. A partner of mine had been using Plus. I told him to try Pro, and the difference surprised him immediately. My editor went through the same resistance before switching.
When I first recommended Pro, the gap was not always dramatic. Now it can be enormous. My editor came back and said she was shocked by how different a Pro request was from the level below it. This is the first basic skill users need: learn how to switch models and modes. The second is to disable training on your data when you do not want the provider to use it. People need at least a basic understanding that their conversations may be used for training. Most users probably do not realize how much large platforms already learn from Gmail data, browser advertising data, and activity across Google or Facebook. Facebook alone contains so many privacy controls that opting out is difficult. In ChatGPT and Anthropic products, the relevant setting is much easier—usually one clear toggle. I hope regulation eventually makes non-training the default and limits how long personal data can be stored. We recently discussed this with someone while traveling, perhaps in New York.
I replied that I still would not use a Chinese model for sensitive work because I assume the data may be incorporated into training or retained in China. That is not hostility toward China, and it is not that I have a secret to hide. I simply do not want to spend mental energy wondering where the data goes. When information is held by OpenAI or Anthropic, I believe the companies operate within a legal and commercial environment that gives users stronger protections. That does not mean intelligence agencies can never obtain access or that the systems are invulnerable. It means the providers have powerful incentives to defend the data and their reputation.
Those are the two immediate checks I recommend, especially to new viewers: make sure you know which model is active, and review whether your data is used for training. ToTheMoon also has a core audience that watches every week, alongside many people who are just discovering the channel.
For new viewers, a reminder: this is the 123rd consecutive week in which we have published the news episode without missing a single week.
No matter what happens.
Exactly—123 weeks in a row.
We now publish at least three episodes most weeks, often four, and plan to add more AI sections. Viewers can choose different formats, hosts, and levels of depth. Some topics are deeply technical; others are basic but necessary. A person may think that switching a model selector is trivial, yet I would estimate that ninety-five percent of ordinary users do not know how to do it correctly or do not know which mode is running. At the other end, we discuss philosophical and labor-market questions. A few days ago, while driving to San Francisco through Silicon Valley, I recorded an episode about future professions and said that Claude Code and Codex already write code better than ninety-nine percent of programmers in many practical tasks. I expected an avalanche of criticism. Some criticism came, mostly from people trying to distinguish “programmers,” “developers,” and narrower specialties.
People make similar semantic distinctions between entrepreneurs and businesspeople, as if the label itself proved vision or competence. When I began programming, nobody divided everyone into front-end developers, back-end developers, and a dozen other categories. A programmer was a programmer. Someone writing macros in Excel was also programming. We can refine terminology endlessly, but the practical question is what work the person or model can actually do. We should devote a separate episode to open models, because the issue is becoming large enough to deserve its own discussion.
Jensen Huang, Mark Zuckerberg, and many other figures have recently emphasized the importance of open models. Zuckerberg deserves a separate episode because Meta has enormous global influence and because his position helps shape the market. The argument is that open AI is necessary for humanity to retain access and control rather than allowing a few companies or states to own the entire capability. Meta again presents itself as different from closed frontier labs. Meta began with a strong open-model strategy and was once among the leaders. The company has now suggested that at least part of its next model family will again be open source. Will meaningful open-source AI continue to exist? Is it necessary? Can powerful AI belong to people rather than only to corporations or governments? Tanya, does ownership matter to you as a user, or do you simply open whichever service works?
I would like the technology to belong to people, but that sounds somewhat utopian. It is such a powerful tool that governments and large companies will inevitably seek control, with the balance depending on the country. The mission statements about empowering humanity are attractive, but reality will determine how much is genuinely public. Some capability may belong to individuals, yet the same power also creates risks. Regulation will still be necessary if the technology is to help rather than harm.
I do not think the problem can be solved without the state. It is not a simple yes-or-no question.
That is why I asked whether ownership feels personally important. Most people using these systems today never think about who owns the model or the infrastructure. They follow the default path.
It would matter to me.
You would want it to be—
I want a balance. The technology should expand people’s knowledge, opportunities, and access to services that were previously unavailable. At the same time, some government oversight is needed so that people cannot use it to harm others. We may need an entirely new institutional form. Finding it will take time.
My position has not changed much. Across the 123 weeks of this show, the pattern has usually been that open source belongs to the challengers. The organizations at the true research frontier do not open their strongest models. Labs that are behind use open releases to catch up, attract developers, and gain strategic points. Zuckerberg is trying to re-enter the race. Meta produced a reasonably good model and can gain support by opening it. If we set AGI and existential-risk arguments aside and talk about ordinary enterprise models, open source will definitely survive. The entire world cannot run exclusively through the APIs of ChatGPT, Anthropic, or other proprietary providers. The analogy is servers. Most servers run Linux, an open-source operating system.
Calling it free is imprecise because distributions such as Red Hat charge for products and support, but open infrastructure still dominates the server market. Windows and macOS servers exist, but they are a small minority. AI models may follow the same pattern. Consumers will use polished proprietary services such as Anthropic, Gemini, or OpenAI, just as they use Windows or macOS. Companies, however, will often deploy open models internally, fine-tune them, and build a large services market around them. Chinese developers are also releasing enormous open models. Qwen 3.8, for example, has been discussed at scales of two to four trillion parameters and made available for open deployment.
Organizations with sufficient servers can deploy such models, fine-tune or distill them, and create specialized internal systems. That will happen. I do not expect the open version to remain the absolute research frontier. Even if a Chinese lab develops a Qwen model that exceeds OpenAI on important tasks, it may keep the strongest version closed, sell it as a subscription product, or use it internally. Frontier models are becoming extraordinarily capable. A recent Anthropic example illustrates how far the closed frontier may be moving.
An Anthropic employee working with an unreleased model reportedly asked it about the zeros of the Riemann zeta function. The Riemann hypothesis was formulated more than 150 years ago and has never been proved or disproved. It is one of the most famous problems in mathematics. My academic supervisor mentioned it constantly and joked that if one of us proved it, we should share the million-dollar prize with him. The prize is real. The Anthropic employee apparently gave the new model the problem largely out of curiosity.
The model worked for roughly a day and a half and made substantial progress in narrowing the possible results around the hypothesis. Mathematicians can read the technical material for themselves, but for everyone else the important point is scale: generations of leading mathematicians—not students or early-career researchers—have worked on this for more than a century without solving it. The model did not solve the Riemann hypothesis, but it appears to have advanced the analysis as a side effect of an experiment. AI systems have already solved or contributed to other difficult problems, including Erdős problems.
The Riemann hypothesis is on another level. If a model eventually proves it, we would have a concrete demonstration of mathematical capability beyond what human experts have achieved. Frontier systems are moving into territory that sounds absurd even to specialists. Open-source models will probably receive this level of capability only after the closed frontier has moved much farther ahead.
That is fascinating and unsettling. We are already seeing AI used to challenge proofs and accepted results in science. That can be healthy, but it will also create new disputes and new errors. Even ordinary conversations are changing. I told a friend that a tax rule worked one way; she immediately said she would check me and produced an answer. Verification that once took hours now happens in seconds. There have even been projects encouraging people to ask another human instead of AI. I find that strange. We already had browsers and forums for asking people. I use AI because it aggregates information faster and can structure it more coherently. People will keep adopting it. The social consequence is that every claim can be challenged immediately.
Errors, weaknesses, and alternative interpretations will be found in real time. People are becoming accustomed to that constant verification. One study was even described as suggesting that the attachment programmers form to Codex and Claude can be extremely strong—almost comparable, in the way it was presented, to an addiction.
The level of dependence can feel extraordinary. I can switch off ChatGPT and other systems when I travel or step away during the day. But the broader pattern resembles people who work around the clock on a business and keep saying they will rest after it grows—only for growth to create even more work. My father spent roughly ten years unable to take a proper vacation because he was always busy. When AI gives you a huge number of new possibilities and you know how to use them, the dependence grows from the other side: there is always one more task you can complete. I can disconnect when I need to, but Codex, Claude Code, and Claude have still become part of the infrastructure of my life. The tools have moved far beyond occasional assistance.
I sometimes force myself to do certain work manually—for example, to write code without a model. Over time, however, it becomes difficult to justify. A model lets me solve the problem much faster. I still write prompts, define the task, and review the output, but I am no longer spending most of the time typing the code. At some point, writing everything by hand becomes too slow to be professionally rational. Current models can generate hundreds of lines at a high level in seconds. A person can choose not to use that capability, but the cost becomes visible. Project managers sometimes practice a “clean Thursday,” when they close existing work and avoid opening new tasks.
Programmers may need their own clean day—a day when they write everything by hand.
Ordinary people may need one too.
Yes—a day in which an ordinary person lives without a model. Tanya, you were saying something.
We should introduce that.
Yes.
We really should. You keep suggesting good ideas.
Unfortunately, I do not always follow them myself.
At least the idea exists.
Sasha, what is happening with your limits?
My limit situation has improved. Codex seems to reset my allowance almost every day. Perhaps that is connected to my US account, Pro access, or some purchase history; I do not know. I no longer see the separate gift resets I once had, but the main limit keeps returning. I mostly use 5.6 Sol at Extra High. I do not use the Ultra mode—not because of the token allowance, but because the model can disappear into excessive reasoning and I dislike that behavior. I had a similar reaction to Opus 5.
What did you think of Opus 5? I spent a great deal of time with Opus 4.8 because the first version of Opus 5 seemed configured to decide too much on its own. It wandered away, performed unnecessary work, and made many mistakes. Over the last two weeks I have become roughly an eighty-percent Claude user and a twenty-percent Codex user for coding, although ChatGPT remains my main general system. That may be temporary. I like the way Fable works, but I am still carrying the bad aftertaste of 5.6 and of spending more than forty billion tokens testing it.
That experience makes me reluctant to hand complex work to Codex 5.6, even though the system may have improved. I continue testing it across many projects, and it often performs well. Fable can also make simple mistakes. The biggest change in my own workflow is routing simpler architectural and operational tasks to simpler models. I used to send almost everything to the most expensive option. I still tend to do that in ChatGPT, but not everywhere else. I use Extra High Pro for many tasks. Yet if I ask 5.6 Sol Extra High to save a number into an Excel file, it may begin a long analysis and think for ten or thirty minutes. I stop it, switch to a simpler 5.5 Extra High model, ask it to save the data, and it completes the task immediately—sometimes with the analysis included. I recently had to sort five or ten thousand files in a downloads folder and deliberately moved the job away from 5.6.
I moved it to 5.5 because 5.6 was overcomplicating a basic operation. The same idea applied when my Zoom cloud storage filled up and the service began charging for additional space. I asked the model to analyze the recordings. This may sound like a trivial use case, but it is exactly the kind of work that lets me abandon expensive software. I have already stopped using QuickBooks entirely. For Zoom, the model found seventy or eighty videos that were stored as generic personal meetings. Many participant names were ambiguous—“Olya,” for example, when I know several people with that name. I asked the model to extract screenshots of the participants. It processed the videos, returned the images, and organized the entire archive quickly. The task sounds simple, but the capability is significant. Zoom makes its cloud archive inconvenient in a way that encourages customers to keep paying for storage. Agents can remove that lock-in.
I hope Zoom loses revenue from that design and eventually improves it. I will not return to its built-in AI tools because Codex can connect through an API—or, with the right local setup, work directly with downloaded recordings—analyze them instantly, and create any classification I need. In my experience, it can do this without consuming the same visible quota. That may be part of a broader shift: OpenAI and Anthropic are competing to reduce the effective token cost of useful work.
OpenAI has said that several plans now use fewer tokens for comparable work, while free access has expanded. I may be wrong on the exact limits, but the company appears to be making the cheapest system effectively unlimited for many users. Ilnar, do you actually use all of your allowance? I use all of Fable. If I know the limit will reset in ten hours and capacity remains, I give it architecture reviews so that the unused allowance does not disappear.
This week I realized that my special reset credits had expired. I had never used them because they were always present, so I freely enabled faster 5.6 Ultra runs and assumed I could reset the limit if needed. When the last credit expired, I discovered that it did not automatically apply. I had expected the system to reset my quota at expiration, but nothing happened. That was an unpleasant surprise. I began researching how Codex resets actually work and shared a link in our chat. A community site called Codexresets.com tracks previous resets, the intervals between them, and the probability of another reset. OpenAI employees often post on X that the company has reached a milestone and is resetting limits to celebrate. The site uses that history to estimate whether a reset is likely on a particular day.
My allowance returned fairly quickly, but the pattern made me suspect that resets may eventually become a paid product. Users are being trained to consume very large volumes, and once the behavior is established, the company could charge for additional resets.
I am not sure OpenAI will do that, because each reset may cost the company a great deal relative to the original subscription price. I once estimated that my own token consumption through an API could correspond to tens or even hundreds of thousands of dollars at published rates. I do not personally pay that amount, but the underlying compute is not free. Spending a few thousand dollars on serious work is understandable; scaling that to extreme usage becomes a different business problem.
That is why simply selling unlimited token resets may be difficult. Anthropic designed chat and agent usage around one combined allowance. OpenAI has historically separated ordinary ChatGPT use from coding systems and other products. Combining everything into one meter would be a major shock to Pro users. I had expected the company either to introduce a far more expensive tier—perhaps two thousand dollars per month—or to remove the existing two-hundred-dollar-style unlimited behavior.
The lower-priced Pro offer may have been a temporary marketing tool to increase visible revenue, even if heavy users were unprofitable. In a SaaS business, status can be part of the product. OpenAI could have kept Pro as a scarce privilege rather than opening it broadly at a price that does not reflect usage. People pay for a premium identity as well as a feature set. A friend said the same thing about Marriott status: he wanted the status even if the practical benefits were limited. Another partner wanted Ambassador status simply because it felt valuable. A premium AI plan can work the same way. A particularly strong strategy would be to launch a much more expensive tier while grandfathering existing users. Those users would never cancel because they could not return later at the old price.
OpenAI is caught between Gemini’s mass-market strategy and Anthropic’s enterprise strategy. Anthropic appears to have shown that corporate customers create enormous value, but I do not think the valuation comes merely from current enterprise revenue. The company built a uniquely valuable model. The strategic asset matters more than the revenue snapshot, just as the value of Elon Musk’s companies has often reflected future capability rather than current profit. Tesla was unprofitable for years. SpaceX can receive a single major contract that changes the entire revenue picture. I hope OpenAI does not overplay the monetization strategy and begin selling token resets in the way Ilnar described. Viewers should look at their own usage: if a person never approaches a limit, they may not be using the system intensively—unless they are on a special account or have a different allocation. My Codex limit has been resetting almost every morning for the last two weeks.
Codex resets everyone as well; they simply happen fairly often. The community site’s history matches what I have observed.
I am not claiming that my account is special. I simply do not monitor every announcement. Access now varies by region, plan, and product. Anthropic’s global watermark policy is another example. It was tied to an August 2 European requirement, yet the company applied the capability worldwide. Why should a European rule automatically become the default for every user? The same question appears with GDPR. Cookie banners and many related requirements are European constructs, yet a huge number of US websites show them to everyone. A user wonders why the banner is there and who decided to apply it globally. No company can easily master every rule for every customer and country. Why must every product team learn the European standard while treating Peru or another jurisdiction differently? American and European companies fight over these requirements while also negotiating with governments.
The result sits at the intersection of politics, business logic, compliance, and corporate reputation. Ordinary users often appear far down the priority list. That is the thread connecting the entire episode: agents, watermarks, model selectors, privacy controls, open source, and token limits are not isolated product details. They are decisions about who controls the system, who pays for it, and who is responsible when it acts on someone’s behalf.