The exact number was the wrong one
Compression tools that cut tokens and raised the bill, two lists of open models with one repository in common, and an anti-pattern named for letting an agent judge its own tool calls.
How we organise
Token reduction is not cost reduction
Three compression tools were run against unmodified Claude Code over 2,908 paid sessions, with every cost taken off the provider’s own bill. The build that removed 38.4 per cent of the text cost 6.8 per cent more per completed task. The authors put the ceiling for these tools at about 5 per cent.
We tell a client to price the completed task, not the meter. The token is the most precise number in the programme, which is why it gets read as the cost. An agent that loses material goes and finds it again, and pays for the extra turns further down the same invoice. The authors built one of the tools tested.
How we build
Hugging Face on the state of open models
Rank open-model repositories by downloads this year, then by likes, and exactly one repository appears on both lists. No model published in 2026 reaches the download list, and thirteen of the top twenty-five date from 2022.
Our position is that the model a firm depends on is rarely the model its coverage is about. Attention follows whatever shipped last, while dependence accrues to small stable models over years. A review that reads likes selects for novelty and calls it a standard.
How we assure
AWS on authorising an agent’s tool calls
The anti-patterns are the useful half. Relying on the agent’s own judgement about whether a tool call is appropriate is the first, with no independent check at the tool layer. Every call should be authorised against policy before it runs.
We judge authority at the moment it is used. A valid token proves who is calling; it does not prove the call still serves the purpose the authority was granted for. That gap is where prompt injection does its work, with the right principal and the right permissions and a replaced purpose.