AI every minute
First-hand trials of AI tools and models. Everything here was installed and run: what it cost, what broke, and where a published claim did not survive being checked. Every prompt, output and figure came off a real run, including the ones that contradicted what everybody repeats, and the ones that contradicted what this site said last week.
Start here
Everything published is listed below in full. These twenty-seven are the ones that changed what I do.
- 8 of 8
Given a task that never mentioned a command line, Claude Code built one in 8 of 8 runs
The task was to read a CSV of orders and report revenue per customer. It never mentioned a command line. Claude Code with no instructions built an argparse interface in 8 of 8 runs, wrote two files every time, and came in at 73 to 88 lines. With a standing terseness instruction installed through a SessionStart hook, the same task produced an argparse interface in 0 of 8 runs and 37 to 60 lines. The arms do not overlap, with a gap of 13 lines. Eight rounds per arm, none excluded, and an arrival control confirmed the instruction reached the model in every round. The instruction is a third party plugin and the point here is not the plugin: it is that the DEFAULT adds structure nobody asked for, reliably enough to separate cleanly across sixteen runs, and that saying what you do not want changes it. What is NOT shown is that shorter is better. Neither program was run against real data or reviewed for correctness.
- 78%
Crossing the documented hook output cap silently drops 78% of the context you sent
Anthropic caps SessionStart hook output at 10,000 and documents it twice. Forty runs on 2.1.238 measure the price of crossing: 10,016 tokens of context arrive below the cap, identical in all four rounds, against 2,172 to 2,181 above it. The arms do not overlap. The payload is not destroyed, it is written to a file the model must spend a tool call to read, so a plugin that injects standing instructions silently stops delivering most of them. obra/superpowers at 3,334 bytes is well under. The cap counts UTF-16 code units, not characters, so every emoji counts twice; this corpus RETIRES its own earlier characters claim rather than rewording it.
- 1 of 5
Four of the five AI crawlers this site allows never fetched robots.txt or llms.txt in 14 days
Over 14 days and 19 hours a logging shim on robots.txt and llms.txt recorded 278 non-curl requests. robots.txt names seven AI agents but only five of them crawl: Google-Extended and Applebot-Extended are training-use control tokens that make no requests at all, so they are counted separately rather than as absent crawlers, and the crawlers they govern both showed up, Googlebot 26 times and Applebot 38. Of the five that do crawl, only OAI-SearchBot appeared, 50 times. GPTBot, ClaudeBot, Claude-SearchBot and PerplexityBot returned zero, including both crawlers their vendors document as collecting training data. llms.txt was fetched 25 times and exactly one came from any of the five; the rest were ordinary search bots, SEO tools and unidentified clients. The shim serves only those two paths, so a zero means never fetched robots.txt or llms.txt here, not never crawled the site. One young low-authority domain, one window, self-reported user agents.
- 1.41x
A book costs 41% more than tiktoken says, so a tiktoken estimate runs about 29% under
The same bytes written as a project-scope CLAUDE.md and read back from modelUsage cost 1.41x what tiktoken cl100k_base counts, on a 501-page technical book and on Moby-Dick, across 28 runs. The published figure is the slope between slices, so the CLAUDE.md framing constant cancels rather than inflating it, and every segment measured falls between 1.382x and 1.452x. The two books have different cl100k rates, so solving both for a tokeniser factor and a per-byte framing charge puts the framing term at -0.0133 tokens per byte, indistinguishable from zero and unable to be positive, which bounds a size-proportional overhead without ruling it out. Anthropic's own guidance puts this gap at 15-20% on typical text, implying 1.18x to 1.25x, and at an unstated 'much more' on code. Only the novel is the typical-text case, and at 29.3% it sits above the published band; the code-heavy book cannot contradict a clause that names no number. What the guidance does not predict is that both books landed at the same ratio, 29.08% and 29.28%, with the prose one marginally higher. A book tiktoken prices at 227,000 tokens is nearer 320,000 of Claude Code context, and any dollar figure computed that way is low by the same margin.
- 56,600
A trending 817-skill pack costs about 56,600 tokens before you type anything
mukul975/Anthropic-Cybersecurity-Skills ships 817 Agent Skills and adds about 56,600 tokens of startup context in an empty isolated project, 69.30 per skill, from 24 readings of which 21 sit inside a 48-token band. The synthetic curve behind this site’s own calculator interpolates to 13.46 per skill at that count, 5.15x low, while its real-pack measurements never disagreed. Description uniqueness and the pack’s extra frontmatter were tested and refuted, and deleting 338KB of frontmatter moved the reading 8 tokens, which matches what Anthropic documents. Why a real pack costs so much more than the synthetic fixture is not established.
- 1,536
Your skill description is cut at 1,536 characters, and the cap is a setting you can raise
A rare marker planted at a known offset inside a skill description, then asked for. Text ending at 1,530 characters is answered from context with no tool calls, four rounds of four; text ending at 1,536 never is, and the model shells out to Bash to open the file instead. That brackets the documented skillListingMaxDescChars default of 1,536 to within six characters, and the cap is a setting you can raise. Nothing errors: the words past the cut are simply absent when Claude decides whether your skill is relevant, so trigger conditions written last silently stop working. A 51-character increase in the skill name moves the cut not at all, and it does not move as more skills are installed, tested at 1, 10 and 40.
- 1 of 4
A trending diagram skill drew once in four unattended runs. One file fixes it
cathrynlavery/diagram-design carries two pause points that a headless run has nobody to clear, so it delivered a file in 1 of 4 rounds and spent 733,824 tokens across the three that produced nothing. A one-line .diagram-design marker in the project root took it to 4 of 4 across eight further rounds, which is the comparison that reaches significance at p=0.018. What it costs to sit installed and unused is not measurable at all: twelve readings of the same pack span 70 to 967 tokens.
- 7 of 12
Six models, one date question, and every visible miss was arithmetic
Six free-tier models from four vendors, asked twice each what date falls 120 working days after 3 March 2026. Seven of twelve runs landed on a defensible answer. All eight runs that showed a route to their answer set the problem up correctly and the wrong ones then slipped on the arithmetic, including one model that used the same method twice and got two different dates. Four of the five wrong answers contradict themselves in their own text.
- ~100 vs 34
The docs put a skill at ~100 tokens. Three measured packs came in at 34 to 96
Anthropic documents ~100 tokens per Skill for the metadata loaded at startup. Across the three trending packs where a measurement is reliable, per-skill cost ran 34.1 to 95.9 and every one came in below it, over-predicting by 4% on one and 193% on another, and the size of the miss does not order by description length. It is NOT a ceiling: this site later measured the example-skills pack Anthropic itself ships, twelve skills with 288-character descriptions, at 102 per skill, above the documented figure. So ~100 over-predicts for most packs and under-predicts for at least one. Measure the pack if the number matters.
- 9,020
The biggest trending skill pack costs 9,020 tokens on every session
Six Agent Skill collections from GitHub Trending, installed and measured rather than estimated. google/skills is 111 skills and 40% of a clean startup context, paid whether or not you invoke any of them. Per skill it is 34.1 to 95.9, and it does not order by description length: the pack with the longest descriptions is not the dearest one. Check the plugin manifest before pricing a pack: the SKILL.md files in a repository are not all the ones you get.
- 2.04x
Subagent definitions never get cheaper in bulk, and everything else does
A skill or a slash command costs about 40 tokens and collapses to under 6 once you pass a few hundred. A subagent definition costs 51 at every count measured, so 400 of them cost 20,404 to 20,602 tokens against 9,989 to 10,187 for the same number of commands.
- 49%
Batching your tool calls saves about half a session
Three files read in one batch cost 121,732 tokens. The same three read one at a time cost 240,073, because every round trip re-sends the whole conversation.
- 20,581
A parallel subagent costs 20,600 to 28,500 tokens before it does anything, and far more with config loaded
The spread has a cause: a four-way fan-out takes six or seven parent turns and the total moves 16% between them, and which one you get is not under your control. On 2.1.238 six turns is the common case at 20,581 per agent, against 28,504 at seven; at matched turn counts those figures moved 1.0% and 0.9% since 2.1.232. On a configured machine every subagent re-pays about twice your CLAUDE.md and tools.
- 64 of 64
Compaction kept every planted value, across 24 compactions
Arbitrary values survived auto-compaction intact, including when the surrounding bulk was 31.7x less compressible and competing for room in the summary. Discrete stated facts survive; the loss people report is somewhere else.
- 7,379 vs 4
The same 28,000 bytes costs 7,379 tokens in CLAUDE.md and 4 as a skill body
A skill body only loads when it is invoked, so reference material belongs there. Move it, do not trim it. The gap is the durable part; the headline ratio it produces is not.
- 20x
Your CLAUDE.md is re-sent every turn, and after turn two it costs 20x less
An 18KB CLAUDE.md added 4,967 tokens to every turn of a session, identical on all four turns with zero spread, so the context cost is permanent. The money is not: the same tokens billed at $0.04966 and $0.04967 on turns one and two and $0.00248 from turn three, because the file stops being written to cache and starts being read from it. Trim it for the window you get back, not for the bill.
- 2.2x
Planning first cost about 2.2x, on a specified task and on an open-ended one
Plan mode is recommended as the cheaper way to work, specifically on open-ended prompts. It did make the execution cheaper, but only on the task with one right answer, and the plan cost about five times the saving it bought.
- +8%
The env var sold as a 90% saving cost 8% more
CLAUDE_CODE_FORK_SUBAGENT raised total context 38% cold and 66% warm across 28 runs. Cache creation, the thing it should remove, moved upward.
- 6 of 30
Only 6 of 30 AI-generated citations were real, and 11 fakes had working DOIs
Checked against Crossref and DataCite. On a niche topic, zero of fifteen were real. Verifying that a DOI merely resolves would have passed eleven fabrications.
- 8.5x
The same bug fix cost $0.11 on Haiku and $0.93 on Opus
Cost per token is the wrong unit. Sonnet used 74% more tokens than Opus to do identical work, so most of its per-token discount disappears.
- 8 of 8
It gave the same wrong answer eight times out of eight
Consistency is not accuracy. The question it was most stable on is one it never got right, while the visibly unstable answer is the one you actually catch by asking twice.
- 1 of 31
Exact word counts were hit once in 31 tries. Sentences and paragraphs, 17 out of 17
The workaround every guide repeats turns out to be right, across four models. If the number has to be exact, ask for sentences or paragraphs, never words.
- 2.2x per char
A Chinese skill description costs 2.2x per character, and the documented cap counts characters
ConardLi/garden-skills reached GitHub Trending at 11,112 stars with five skills whose descriptions are roughly half Chinese. Nine skills were installed one at a time on 2.1.247, four rounds each, every delta against a floor re-measured in the same round. Per description CHARACTER, descriptions with no CJK cost 0.363 to 0.482 tokens and majority-Chinese ones cost 0.887 to 1.048: the arms do not overlap, and the character-length ranges DO overlap, so length is not the explanation. Per BYTE of UTF-8 the arms OVERLAP (0.363 to 0.482 against 0.459 to 0.513), which is the honest qualification: a Chinese character is about 2.3 bytes, and that accounts for most of the per-character gap. It matters anyway, because the description cap Anthropic documents counts CHARACTERS and this site prices skills per character, so a Chinese description reaches that cap having spent roughly twice the tokens, and the published model, 39 tokens plus 0.276 per description character and declared valid only from 30 to 300 characters, lands 2.48x under on the Chinese arm while landing within 5 percent on the English one. What is NOT supported: that the tokeniser handles Chinese badly per unit of encoded text. Skill BODIES are unmeasured.
- 1.12x
The same CLAUDE.md in Chinese costs 12 percent more than in English, not two to three times
One translation pair, the same project instructions written in English and in Chinese, with byte sizes matching within 1.4 percent while character counts differ by 2.8x. That is what lets a single pair separate the two units. Sixteen self-paired rounds on 2.1.247, floor re-measured every round, one constant working-directory path because this site has measured the startup floor moving with the path. English is 604 tokens at the mode and Chinese 678: 1.12x, or 0.388 against 0.441 tokens per byte. Three predictions were pre-registered before anything ran and all are published. The one that matters most is refuted decisively: that Chinese is CHEAPER because it uses fewer characters predicted 183 to 248 tokens against 678 measured. What is NOT claimed: separated arms. Both arms wander in quantised 198-token steps and their ranges overlap, so 1.12x is a modal difference across 16 rounds, not a resolved per-run effect. One pair, one author, no native-speaker check.
- 6 of 6
A vendor skill rewrote the old Go idiom in 6 of 6 runs, and tripled the cost of the task
JetBrains publishes go-modern-guidelines, 1,916 stars, as a Claude Code plugin with a single skill whose body tells the model to run a pinned Go CLI before editing Go code. Two tasks were measured on 2.1.247, paired, same constant working directory. WHAT IT DOES: on a task the tool own ruleset covers, the arm without the skill wrote the pre-1.21 sort.Slice in 6 of 6 runs and the arm with it wrote slices.SortFunc with cmp.Compare in 6 of 6. No run went the other way, and the rule was taken from the CLI own published list rather than invented. WHAT IT COSTS: 45,582 to 45,960 tokens without against 146,181 to 146,872 with, roughly 3.2x, arms not overlapping. It does not inject 100,000 tokens, it adds tool round trips and each tool call re-sends the whole conversation. Sitting installed and unfired it costs only tens of tokens, so the listing cost usually quoted for skills is the wrong number here by three orders of magnitude. On a second task that had no modern idiom to apply, the same 3.2x bought code identical apart from one word of a doc comment, and the skill description fires on any Go edit at all. Neither arm was compiled or tested, and one rule of roughly two dozen was exercised.
- -24.5%
Claude Code startup floor fell 5,594 tokens between 2.1.246 and 2.1.251
The startup floor is what a session costs before you add anything, and it is the base every other figure here is measured against. Re-measured on 2.1.251: 17,207 tokens with tool search on and 32,400 with it off, against 22,801 and 37,870 on 2.1.246. That is a 24.5 percent fall and the largest move recorded on this site. Eight rounds with every cell measured twice, and both floor arms returned a SINGLE value across all sixteen repetitions, histograms 17207 x16 and 32400 x16. An independent four-round invocation run minutes earlier returned 17,205 and 32,398 with an IDENTICAL 15,193 tool-search delta; it is reported separately rather than pooled because its working directory was one character shorter, and this site has measured that the floor moves with the path, so pooling would have made an exact cell look bimodal. The paired tool-search delta moved only 15,069 to 15,193, so whatever shrank is common to both arms rather than specific to tool search. What is NOT claimed: any cause. Nothing here establishes what Anthropic removed.
- 0 tokens
A 229 KB skill body costs nothing at startup, 8x beyond where this site had tested
This site published that a skill body is free at any size up to 28KB. mvanhorn/last30days-skill, 60,605 stars and MIT, ships one skill whose SKILL.md is 229,438 bytes: about 8.2x beyond that range, so the claim was being applied outside where it had been measured. Twelve pooled rounds on 2.1.251, floor re-measured every round, skill installed and NEVER invoked. The whole thing costs 101 tokens, which is just the listing: one skill plus a 246-character description. The body contributes zero, and the published model predicts 106.9 against 101 measured. Three predictions were recorded before the run; the site own position held and its validated range now extends 8.2x on a real pack rather than a synthetic fixture. One round read 998 instead of 101 because its FLOOR was 897 low, this machine known intermittent component, and that is published rather than dropped. What is NOT measured: what the skill costs when it FIRES. The tool was deliberately not run, because doing so auto-installs third-party CLIs via npx and can extract browser cookies behind an opt-in.
Tools11
AI tools installed, run and measured first-hand, including what they cost you and what they do badly.
tried it, here is what happened 11
A book costs 41% more in Claude Code than tiktoken says
I ran book-to-skill v1.4.0 on the 501-page Pro Git PDF, then measured what the extracted text actually costs in Claude Code context against its tiktoken count. The gap is 1.41x on a technical book and 1.41x on Moby-Dick, and because the two books have different cl100k rates, solving both together puts any per-byte framing charge at or below zero, which bounds an artefact of how Claude Code wraps the file without ruling one out. Anthropic publishes ~15-20% for typical text and an unbounded "much more" for code, and only the novel is the typical-text case; both books measured the same 1.41x regardless, which that split does not predict. It leaves book-to-skill's headline ratio underdetermined rather than refuted, and makes its dollar table low. Running it also surfaced three things a README cannot tell you, including a CLI that reports 93 chapters in a ten-chapter book because it counts shell comments inside code samples.
- tool book-to-skill v1.4.0, commit 3a97a71, 23,485 stars
- book Pro Git, 501 pages, 17.97 MB PDF
- this trial 28 runs, six cells of four rounds plus a floor per round
- extraction 501 pages in 0.55-0.64s
Anthropic ships five skill plugins, not one, and its own ~100-token figure fits the one I could measure
Anthropic documents ~100 tokens per Skill for the metadata loaded at startup. Its own repository ships five plugins rather than one, and only one of them is large enough for this instrument to give a figure. example-skills, twelve skills with ordinary 288-character descriptions, measured 102 tokens per skill. The three single-skill plugins cannot be measured: two carry ranges 198 tokens wide and the third spans 897, from minus 578 to plus 319, which contains zero. A separate sweep then knocked out the story I had been about to tell about long descriptions: above 500 characters they are close to free. Which turns out not to mean what it sounds like, because a later measurement found the text stops reaching the model entirely past about 1,400 characters.
- pack anthropics/skills, commit f379e5a
- runs 50, ten rounds x five plugins
- documented ~100 tokens per Skill
- measurable plugin 102 per skill, 288-char median
A 19,700-star diagram skill drew once in four unattended runs. One file fixes it
A trending Claude Code skill for editorial diagrams, installed and measured on 2.1.233. What it costs to sit on disk unused turned out not to be measurable: twelve readings of the same pack span 70 to 967 tokens. Run unattended on an ordinary request it delivered a file in 1 of 4 rounds, spending 733,824 tokens across the three that produced nothing, because SKILL.md tells the agent to pause and ask about brand colours before the first diagram in a project. Dropping a one-line .diagram-design marker in the project root took it to 4 of 4. No cost multiplier is quoted, because the plain arm alone varied 6.7x and the skill's arm has one delivering round. The marker effect is established at p=0.018; the skill-versus-plain comparison is underpowered and is not claimed.
- pack cathrynlavery/diagram-design, commit 09df49d
- stars 19,728 on 2026-08-17
- installed, never used not measurable, 70 to 967
- delivered a diagram 1 of 4 unattended
google/skills costs 9,020 tokens. Every session, before you use any of it.
Six trending skill packs, cloned and installed on Claude Code 2.1.233, measured against an empty floor, then re-measured after I found I had priced one of them wrong. 111 skills cost 9,020. The 25 skills Matt Pocock actually ships cost 852, not the 1,209 I first published for 35 files sitting in his repository. Per skill that is 34 to 96 tokens, and multiplying a published rate by a file count would have got two of the three badly wrong.
- claude code 2.1.233
- runs 56 across two harnesses, no exclusions
- clean floor 22,283 then 22,287, each round paired
- google/skills, 111 skills 9,020 tokens
- re-verified 2026-08-18 diagram-design 70 to 967 on 2.1.234
The docs say ~100 tokens a skill. I measured 34 to 96.
Anthropic documents ~100 tokens per Skill for the metadata loaded at startup. Measured across the three trending packs where a measurement is reliable, per-skill cost ran 34.1 to 95.9, all below the documented figure, over-predicting by 4% on one pack and 193% on another, and the size of the miss does not order by description length. Then I asked six model runs the same question: three repeated the documented number, one gave a different one, and two declined, including the model that had given a different one moments earlier.
- documented ~100 tokens per Skill
- measured, 3 packs 34.1 to 95.9 per skill
- worst over-prediction 193%, mattpocock/skills
- closest 4%, addyosmani/agent-skills
- re-verified 2026-08-18 one-skill pack 70 to 967 on 2.1.234
720 of 720 table cells read correctly. My scorer was the thing that kept failing
Every value in the test tables was unique, so a misplaced number could be told apart from a misread one. The model got all 720 cells right. The scorer got it wrong three times, always for the same reason, and twice it would have produced a confident and completely false headline.
- cells checked 720
- read correctly 720
- misplaced cells 0
- table sizes 5x4, 10x6, 20x8
I gave two AI detectors text from 1859 and 1996. Both called it human, but the newer one scored 23% AI
A hands-on trial of free AI detectors using text that cannot be disputed: an 1859 book, a 1996 internet standard, and two essays generated on the spot. Every verdict is shown. The detectors were right, and the margins say something the pass/fail does not.
- texts tested 4
- GPTZero verdicts correct 4 of 4
- Darwin 1859 100% human
- RFC 1958, 1996 77% human / 23% AI
- re-verified 2026-08-09 model label matters
A detector called an 1859 book AI-generated while its own numbers said 85% human
A hands-on trial of GPTinf, a free unlimited no-signup AI detector, using a public domain passage from 1859. The tool contradicted itself three times out of three, and the number most people would read is the one that moved.
- text tested Darwin, 1859
- verdict sentence shown "seems to be AI generated"
- its own breakdown 0% AI, 85% human
- contradiction observed 3 of 3 runs
A free AI detector switched to an older model when my scans ran out, then called an 1859 book 100% AI
A hands-on trial that nearly produced a spectacular false finding. GPTZero classified an 1859 public domain passage as 100% AI-generated, with high confidence. The text had not changed. The model that judged it had.
- text tested Darwin, 1859
- verdict on Model 4.8b 100% human
- verdict after quota 100% AI
- model after quota 3.3b / 2025-03-13-base
I tried to make a free image model misspell a word. It got all six right
Text in AI images is supposed to be the thing that still breaks. I gave FLUX.1-schnell six words to render, from OPEN up to a rare twelve-letter genus, at a fixed seed on a free public Space. All six spelled correctly.
- model FLUX.1-schnell
- words attempted 6
- spelled correctly 6
- hardest word ZEPHYRANTHES
Tesseract hit 53% word error at 6px text. Claude vision hit 0%
A ladder of deliberately degraded document images with exact ground truth, read by tesseract and by Claude vision. JPEG quality turned out to be irrelevant. Text height turned out to be everything, with a cliff between 7 and 6 pixels that one engine fell off and the other did not notice.
- tesseract at 6px text 53.3% word error
- Claude vision at 6px 0.0% word error
- JPEG quality 5 0.0% for both
- tesseract cliff between 7px and 6px
Claude Code39
What the tool actually costs and how it actually behaves, measured against its own documentation.
what things cost in context 28
Your skill description is cut at 1,536 characters, and the cap is a setting you can raise
A rare marker planted at a known character offset inside a skill description, then asked for. Text ending at 1,530 characters is answered from context with no tool calls, four rounds of four; text ending at 1,536 is never answered from context, and the model shells out to read the file instead. That lands within six characters of the documented skillListingMaxDescChars default of 1,536. A 51-character increase in the skill name moves it not at all, and the tail past the cut is text you wrote that Claude never sees when deciding whether your skill is relevant. Corrected 2026-08-21: an earlier version of this post framed the cut as undocumented and cited a 1,024-character maximum.
- cut between 1,530 and 1,536 characters
- at 1,400 in context 4 of 4 rounds
- at 1,550 in context 0 of 4 rounds
- documented cap 1,536, skillListingMaxDescChars default
- corrected 2026-08-21 the cut is documented, and configurable
A trending 817-skill pack costs about 56,600 tokens before you type anything
An 817-skill cybersecurity pack from GitHub Trending costs about 56,600 tokens of startup context in an empty isolated project, 69.30 per skill, from 24 readings of which 21 sit inside a 48-token band. The synthetic skills curve behind this site's own calculator interpolates to 13.46 per skill at that count, 5.15x low, and its 1,000-skill cell still re-measures correctly. Description uniqueness and the pack's extra frontmatter were each tested here and refuted; deleting 338KB of frontmatter moved the reading by 8 tokens. The cause is not established: neither the synthetic nor the real fixture carries its descriptions whole, which rules the comparison out as a test of what the words cost.
- pack mukul975/Anthropic-Cybersecurity-Skills, commit 4c0b700
- skills 817, counted off disk on every arm run
- measured 56,622 tokens, 69.30 per skill
- published 30 rounds, 80 runs, five arms
"A 5,000-token CLAUDE.md is a 5,000-token tax per turn." Half of that is true.
An 18KB CLAUDE.md adds 4,967 tokens to every turn of a session on Claude Code 2.1.233, and it never decays. But it costs $0.04966 and $0.04967 on turns one and two and $0.00248 on turns three and four, because the file stops being written to cache and starts being read from it. The context claim is true and the cost claim is true for about two turns.
- claude code 2.1.233
- runs 32, no exclusions
- CLAUDE.md 18,000 bytes, 4,967 tokens
- added to every turn 4,967, all 4 of 4 turns
400 commands cost 9,989 tokens. 400 agents cost 20,404.
One widely shared write-up prices a plugin at about 100 words of metadata each and tells you to keep four to six. Measured on 2.1.231, a plugin has no single price: a skill or a slash command costs about 40 tokens and collapses in bulk, while a subagent definition costs 51 and never does.
- claude code 2.1.231
- re-verified on 2.1.232 reproduced, within one 198-token component
- runs 88, no exclusions
- a slash command 40.0 tokens, then 5.6
- re-verified on 2.1.238 8 rounds, marginal rates reproduced
The same forty skills cost 1,558 tokens, or 152
A skill is not a fixed price. On a clean project the marginal cost falls from 39.0 tokens to 3.9 between 200 and 400 skills; on a configured machine it is 3.8 straight away. That is where this site measured 1.5 tokens a skill from, and why that figure never reproduced in isolation.
- claude code 2.1.231
- runs 132, no exclusions
- clean project, below 200 skills 39.0 tokens each
- clean project, past 400 skills 3.9 tokens each
- re-verified on 2.1.233 unchanged, 39.05 per skill at 200
A 7.9MB node_modules cost 2 tokens, and .claudeignore does nothing
Measured on Claude Code 2.1.229. A lean project cost 22,401 tokens at startup in four runs out of four, identically. The same project carrying 7.9MB and 1,960 files of node_modules cost 22,403. Across 24 runs, including 12 that invited exploration, node_modules was read zero times. A .claudeignore excluding it did not stop a file inside it being read, 3 of 3, while the documented deny rule blocked it 3 of 3.
- claude code 2.1.229
- lean project, startup 22,401 tokens, 4 of 4 identical
- plus 7.9MB node_modules 22,403 tokens (+2)
- node_modules read 0 times in 24 runs
The 150-rule limit for CLAUDE.md measures something a CLAUDE.md is not
Measured on Claude Code 2.1.229 across 35 runs, no exclusions. A rule at the top of the file and a rule at the very bottom were both obeyed in 15 of 15 function definitions at 2, 10, 50, 150, 300 and 500 rules. The negative control scored 0 of 15 on both. This does not refute the benchmark behind the 150 figure, which measures a different thing. What 500 rules did cost was 23,427 tokens of context.
- claude code 2.1.229
- runs 35, no exclusions
- rule counts tested 2, 10, 50, 150, 300, 500, plus a control
- top rule 15 of 15 at every count
Fanning out was about 1.7x slower on work built to favour it
Measured on Claude Code 2.1.229 across 24 runs with no exclusions. Eight agents took 29.6s against 16.8s inline, a 12.8-second gap; four took 20.0s against 11.7s. Tokens ran 1.82x and 2.17x. Every arm is separated. The delegation control confirms the parent made zero file operations in all twelve fan-out runs, which took a field called parent_tool_use_id to establish.
- claude code 2.1.229
- runs 24, no exclusions
- eight agents 29.6s against 16.8s inline
- four agents 20.0s against 11.7s inline
Halving the output saved 6.8% of the bill
Measured on Claude Code 2.1.229 across 30 runs in three batches, no exclusions. Output is 1.45% of billed tokens and 10.2% of cost, seven times its token weight, because the input side is mostly cache reads at a tenth of the output rate. A terseness instruction halved the output and saved 6.8%. Every terse run cost less than every default run.
- claude code 2.1.229
- runs 30, no exclusions, three batches
- reply length 4,733 chars to 1,969
- output tokens 1,821 to 842 median, a 54% cut
Forcing the cache expiry everyone warns about made the session 7.6% cheaper
Measured on Claude Code 2.1.229 across 24 runs with no exclusions. After an eight-minute break the next turn cost $0.017 on the default cache and $0.118 with the five-minute TTL forced on, 6.8x. Summed over all three turns the same forced arm cost $0.370 against $0.400, and every forced run beat every default run. It wrote 50% more cache tokens and still cost less. A separate bracket found the default cache alive at 55 minutes and gone by 70.
- claude code 2.1.229
- runs 24, no exclusions (15 + a 9-run hour bracket)
- turn after an 8-minute break $0.017 default, $0.118 forced 5m
- whole 3-turn session $0.400 default, $0.370 forced 5m
The third step cost less than the first, in the session that was never cleared
Measured on Claude Code 2.1.228, ten rounds per arm, on three steps where each builds on the last. Keeping one session cost 274,436 tokens against 344,408 for clearing between every step, with the fresh arm dearer in 10 of 10 paired rounds. Both lose to asking once: the worst single-prompt run beat the best run of either multi-prompt arm on every measure. All 30 runs passed the hidden suite.
- claude code 2.1.228
- rounds 10 per arm, 30 runs on 2.1.228
- one prompt 103,828 tokens, $0.1697
- one session, three prompts 274,436 tokens, 2.64x
- re-verified 2.1.229, every claim held
Planning made the execution cheaper, and cost more than the job it was planning
Measured on Claude Code 2.1.228. Plan-then-execute and straight auto-accept were run four times each on the same bug fix with an objective pass/fail. Both passed 4 of 4. Planning genuinely made the doing cheaper, $0.1685 against $0.2062, but the plan call cost $0.2301 on its own, six times the saving it bought. The workflow cost 1.69x the tokens and 1.95x the dollars.
- claude code 2.1.228
- auto-accept, one call $0.2062 median
- execute call, plan in hand $0.1685, cheaper 4 of 4
- plan call alone $0.2301, dearer 4 of 4
- corrected 2026-08-12 withdrew the "mechanism is backwards" claim and the title asserting it
- corrected again, same day withdrew "upper bounds"; the equal-permission re-run is larger
Planning helped least on exactly the work its advice recommends it for
Measured on Claude Code 2.1.228 over seven paired rounds, with an open-ended prompt and a hidden rubric applied afterwards. Plan-then-execute cost 2.29x the tokens, 2.27x the dollars, 2.14x the turns and 2.17x the tool calls, with no overlap on any of them. Every run in both arms scored full marks on the rubric, which is a real limit on what the quality comparison can say, and the plan arm paid for a broken exit tool, which makes the ratios upper bounds.
- claude code 2.1.228
- paired rounds 7, bash control 22/22
- auto-accept $0.2910, 146,179 tokens
- plan then execute $0.6600, 334,425 tokens
The plan cost 1.47x the whole job, and made the job 29% cheaper
Measured on Claude Code 2.1.228, eight runs per arm, with --allowedTools Bash on every call in both arms and a full tool-call record behind every turn count. Plan-then-execute cost 2.01x the tokens and 2.18x the dollars of straight auto-accept, with no overlap. Split by call: the execute call is cheaper than doing it in one shot in 8 of 8, and the plan call alone is dearer than the entire one-shot run in 8 of 8.
- claude code 2.1.228
- runs 8 per arm, bash control 24/24
- auto-accept, whole job $0.1493, 114,268 tokens
- plan call alone $0.2192, dearer 8 of 8
The same fan-out costs 53% more, about a third of the time
Measured on Claude Code 2.1.228 across 26 runs. An eight-agent fan-out has two execution modes separated by num_turns: nine turns costs 207,102 tokens, one turn costs 317,786, for the same eight files. It happened in 3 of 10 runs, which means a single measured figure for per-agent cost is not one number.
- claude code 2.1.228
- cheap mode, 8 agents 207,102 tokens (turns=9)
- expensive mode, 8 agents 317,786 tokens (turns=1)
- difference 1.534x, +53.4%
- corrected 2026-08-22 four phantom medians replaced with observed ranges
Each parallel subagent costs 20,398 tokens, or 92,304 with your config loaded
Measured on Claude Code 2.1.227 across 44 runs, of which 4 sit behind the configured figure. Cost per parallel subagent is flat at about 20,400 tokens on a minimal config, so eight agents cost 3.2x one rather than 8x. On a machine carrying 37,808 tokens of user-level configuration, the per-agent cost rises to 92,304, which is about twice that configuration rather than most of it. The 75,466 figure this post originally used was the same quantity counted twice; see the correction. Re-measured on 2.1.231 the same slope is 20,690 and 103,397, about twice the configuration again.
- re-verified on 2.1.232 unchanged at matched turn count
- claude code 2.1.227
- per parallel subagent 20,398 tokens
- per subagent, configured machine 92,304 tokens (4 runs)
- corrected 2026-08-12 the 288,040 outlier was a second execution mode, 3 of 10 on 2.1.228
- corrected 2026-08-13 the config figure was double-counted; 37,808 not 75,466
The env var sold as a 90% saving cost 8% more
Measured on Claude Code 2.1.227 across 28 runs. The flag is real and it engages in print mode, but on both a cold and a genuinely warm parent it increased cost rather than reducing it, because each child inherits the parent conversation instead of skipping the prefix. Every flag-on run used more context than every flag-off run; cache creation barely moved and 97% of the increase arrived as cache reads.
- claude code 2.1.227
- cold session cost, 4 agents +8.1% with the flag on
- warm session cost, 4 agents +15.6% with the flag on
- cold total context +38.2%
A 2MB screenshot costs the same as a 623-byte one: 3,135 tokens
Measured the context cost of reading images at eleven sizes, twice each. A 3,366x range in file size produced a 5-token difference. Above 2000px the cost stops growing entirely, and a retina screenshot costs 1.69x a normal one for exactly the same picture.
- claude code 2.1.224
- 1568x1568 image 3,135 tokens
- same image at 2MB 3,140 tokens
- client-side resize cap 2000 px
A skill costs 1.5 tokens, an MCP tool 15, and a subagent 1.72x the whole task
Skills, MCP servers, subagents and CLAUDE.md do overlapping jobs at wildly different prices: 1.5 tokens, 15 tokens, 1.72x the entire task, and 0.26 tokens per byte on every single round trip. The right choice is usually obvious once you can see the numbers.
- claude code 2.1.226
- one skill ~1.5 tokens
- one MCP tool, deferred ~15 tokens
- one MCP tool, loaded ~304 tokens
Trimming CLAUDE.md saves under 4%. Batching your tool calls saves 49%
The advice circulating about Claude Code token costs is mostly unmeasured. Here is each common tip with the measurement next to it: what actually saves tokens, what saves a rounding error, and the two claims the numbers contradict outright.
- claude code 2.1.226
- batching tool calls saves 49%
- trimming an 8KB CLAUDE.md saves 3.6%
- 200 MCP tools, default 3,054 not 60,854
The same 28KB costs 7,379 tokens in CLAUDE.md and 4 tokens in a skill
Measured on Claude Code 2.1.224: a CLAUDE.md costs about 0.26 tokens per byte plus 106 tokens of fixed overhead, and that cost lands on every single session. The same bytes parked in a skill body cost 4 tokens until invoked.
- claude code 2.1.224
- 28KB in CLAUDE.md +7,379 tokens
- 28KB in a skill body +4 tokens
- ratio 1,845x
- re-verified on 2.1.227 mechanism holds; ratio is fragile
- re-verified on 2.1.228 +8,137 vs +5; ratio now ~1,620x, third value in three versions
Delegating to a subagent costs 1.72x and saves 6.4%
Measured on Claude Code 2.1.224: delegation buys a smaller parent context at a large one-off cost. The saving is exactly the content you kept out of the parent, so the trade only works if the session continues long enough to bank it. Also: .usage does not count subagent tokens at all.
- claude code 2.1.224
- inline 126,825 tokens
- via subagent ~218,000 tokens
- cost multiplier 1.72x
Trying a new --effort level costs 40,054 tokens. Switching back is free.
Measured on Claude Code 2.1.224: changing --effort does not change your context size at all, but the first run at each new level writes about 40,054 tokens of cache at $0.41 against $0.029 warm. Once a level is warm, alternating between levels is free.
- claude code 2.1.224
- first run at a new level 40,054 tokens created
- cost cold vs warm 13.9x
- switching back 0 tokens
Adding one 5-token skill costs 47,544 tokens
Measured on Claude Code 2.1.224: a warm session reads 66,078 cached tokens and reports $0.033. Change a single character of CLAUDE.md, or add one small skill, and the next session recreates 47,544 tokens of cache and reports $0.485. The file size barely matters; the invalidation does.
- claude code 2.1.224
- warm session 0 created, 66,078 read
- after any change 47,544 created
- cost multiplier 14.6x
Reading a 6-byte file costs 58,851 tokens
Measured on Claude Code 2.1.224: a tool call costs approximately your whole current context, regardless of what it returns. File content is only about 0.35 tokens per byte, so on a 40KB read the overhead is four times the file itself. Batching tool calls halves the total.
- claude code 2.1.224
- one tool round trip +58,851 tokens
- 3 reads batched 121,732 tokens
- 3 reads sequential 240,073 tokens
Resuming a session costs 43,350 tokens once, then 293 a turn
Measured on Claude Code 2.1.224: continuing a conversation adds exactly 293 tokens of cache write per trivial turn, with everything else served from cache. Across six turns the context grew 1,465 tokens while reported cost rose 2%.
- claude code 2.1.224
- first resume 43,350 tokens created
- each turn after 293 tokens created
- cost over 6 turns +2%
Turning off MCP tool search costs you 17,214 tokens before you connect anything
Measured context cost of MCP tools with tool search on and off, across 5, 50 and 200 tools. Deferring saves about 95%, an MCP tool costs roughly 200 times what a skill costs, and disabling tool search adds 17,214 tokens to an empty session.
- claude code 2.1.223
- 200 tools deferred +3,054 tokens
- 200 tools loaded +60,854 tokens
- tool search off, no servers +17,214 tokens
- re-verified on 2.1.224 +17,795 tokens
- re-verified on 2.1.233 +14,644 tokens, down 17% from 2.1.232
What 1,000 skills actually cost you: 1,474 tokens
Measured prompt tokens across skill counts from 1 to 1,000, with body sizes from 200 bytes to 28KB and descriptions from 90 to 1,500 characters. Every configuration paired against a baseline measured in the same batch, because the baseline drifts.
- claude code 2.1.223
- 1000 skills cost 1,474 tokens
- on disk 3.9 MB
- 28KB body cost +5 tokens
- re-verified on 2.1.224 1,461 tokens
how it actually behaves 9
A deny rule on .env leaked nothing in 20 runs, and 14 of 24 got through another way
Measured on Claude Code 2.1.229 across 88 runs with a fabricated credential as the canary. With permissions.deny Read(./.env) in place, the Read tool, cat, head, sed and grep leaked 0 times in 20. A python one-liner, a node one-liner and dd leaked 14 times in 24. Every result matches the documented boundary; what the documentation does not convey is that the uncovered side has no enforcement, only judgement.
- claude code 2.1.229
- runs 88, canary-scored
- rule tested deny: Read(./.env)
- Read tool, cat, head, sed, grep 0 of 20 leaked, 18 blocked at the layer
Compaction kept all 64 planted values, across 24 compactions
Measured on Claude Code 2.1.228. Eight unguessable values were planted at spaced turns, the session was driven past the compaction threshold, and every value was asked back with files off-limits. 64 of 64 survived across 24 compactions and two bulk types. This tests recall of discrete stated values, which is not the same thing as preserving nuance, and the post says so.
- claude code 2.1.228
- values recalled 64 of 64
- compactions survived 24
- dense arm 32 of 32, 4 compactions per run
Claude Code's auto-compaction fails with `too_few_groups` when one turn fills your context
Measured when auto-compaction actually fires and whether it works. It reports a status event carrying compact_result and an undocumented compact_error. Filling the context in one turn produces failed / too_few_groups, reproducibly, which is precisely the case people hit.
- claude code 2.1.226
- single turn, 122,575 tokens failed / too_few_groups
- multi-turn, 115,471 tokens success
- --autocompact range auto or 100k–1M only
A 28KB CLAUDE.md costs 7,379 tokens and no measurable time
Measured on Claude Code 2.1.224: adding a 28KB CLAUDE.md produced a median time-to-first-token difference of 178ms, against run-to-run variance ranging from 1,527ms to 8,337ms on identical configurations. A sign test over 20 paired samples gives p = 0.263.
- claude code 2.1.224
- paired samples 20
- 28KB slower in 13 of 20
- sign test p 0.263
In Claude Code permissions, deny always wins
Eight headless runs across four settings configurations show a deny rule blocks a tool call regardless of which scope it sits in, even when a higher-precedence file explicitly allows the same pattern, and even inside the same file.
- claude code 2.1.223
- headless runs 8
- configurations 4
- control passed
Three ways to write a dead deny rule, one of them silent
Eighteen headless runs across five rule forms. A misspelled tool name warns, a raw-string matcher warns, and a misplaced colon fails completely silently while looking correct.
- claude code 2.1.223
- headless runs 18
- rule forms tested 5
- dead rules found 4
Nothing in a project can unset an inherited Claude Code env var
Measured how Claude Code combines the env setting across user, project, local and --settings. It deep-merges across all four, an inherited key cannot be removed from a higher-precedence scope, non-string values are silently coerced by JavaScript string conversion, and OTEL_ variables never reach subprocesses at all.
- claude code 2.1.224 (8a2a469b68f9)
- scopes env merges across 4 of 4
- ways to unset that work none cleanly
- null becomes the string "null"
Three Claude Code hook fields the docs name wrong
Wiring 15 hook events to a capture script and running two headless sessions turned up three field names that did not match the documentation on 2026-08-07, plus several useful fields undocumented at the time, including per-tool duration_ms. Re-checked on 2026-08-21: every one of those discrepancies has since been fixed in the hooks reference, so this now stands as a record rather than as current guidance.
- claude code 2.1.223
- hook events wired 15
- events captured 22
- sessions run 2
Subagents load CLAUDE.md invisibly
A general-purpose subagent provably reads your CLAUDE.md, and the hook meant to observe instruction loading never fires for it. If you use InstructionsLoaded to audit what reaches your agents, subagents are a blind spot.
- claude code 2.1.223
- headless sessions 5
- subagents spawned 5
- InstructionsLoaded events 8
keeping the numbers honest 1
Every measurement re-run on Claude Code 2.1.224: two were identical to the token
Claude Code 2.1.223 became 2.1.224. Re-measuring every figure this site has published shows the deltas are remarkably stable across the version bump, while the absolute baselines drift, which is precisely why paired baselines matter.
- claude code 2.1.224
- figures re-verified 11
- unchanged 9
- moved 2
- re-verified on 2.1.226 all figures hold
- re-verified on 2.1.227 batching 2.0x, mechanisms hold
- re-verified on 2.1.228 batching 2.0x, mechanisms hold, ratio moved again
- re-verified on 2.1.231 floor +64 tokens, tool-search delta held
running the site 1
Deploying a static site to Hostinger shared hosting
Both candidate folders carried a DO_NOT_UPLOAD_HERE marker and the domain resolved to an IP that was not the SSH host. Here is how to find the real document root in one command instead of guessing.
- host shared, no root
- node on PATH none
- node available v24.6.0
- time to find docroot one probe
Models18
The same method pointed at the models themselves: what each one costs to run, and where they measurably differ.
what each model costs 3
The same 8KB file is 3,519 tokens on Opus and 2,586 on Haiku
Measured the token cost of byte-identical files across Opus 5, Sonnet 5 and Haiku 4.5, and the startup context floor of each. Opus and Sonnet agree to within 15 tokens on every input. Haiku does not agree with either, and the gap depends on what the text is.
- claude code 2.1.224
- 8KB prose on opus 5 3,519 tokens
- same file on haiku 4.5 2,586 tokens
- haiku vs opus range 0.66 to 0.90x
Eight tokenizers agree exactly on English. On Hindi they differ by 3.3x
Measured one paragraph and its translations into ten languages across eleven tokenizers, including three Claude models measured empirically. English is unanimous. Everything else is not, and for non-Latin scripts the spread is large enough to change which model is cheaper.
- english agreement 8 of 8 exact
- hindi spread 3.27x
- russian spread 3.70x
- spanish, gpt-4o vs opus 5 103 vs 201
The same bug fix cost $0.11 on Haiku and $0.93 on Opus
Measured what it costs to actually complete a task rather than what a token costs, by giving Opus 5, Sonnet 5 and Haiku 4.5 the same failing test suite and verifying the fix by running it. Cost to finish varied 8.5x, and the ranking is not the one the price list implies.
- claude code 2.1.226
- haiku 4.5 median cost $0.109
- opus 5 median cost $0.925
- sonnet 5 median tokens 1,084,272
where they measurably differ 15
7 of 12 runs got the date right. Every miss that showed its working was arithmetic
Six free-tier chat models were each asked twice what date a project finishes after 120 working days from 3 March 2026. Seven of twelve runs landed on a defensible answer. Of the three misses that showed any working, none was a misreading of the question: each chose a correct method and then executed the arithmetic wrongly, including one model that used the same method twice and got two different dates. Four of the five wrong answers contain a statement that is false or impossible on its own terms; the fifth is one of the two that showed no working at all.
- runs 12, six models, four vendors
- correct 7 of 12
- models right both times 3 of 6
- runs that showed a setup 8 of 12, all correct
A CLAUDE.md rule held for 270 turns and 136,000 tokens
Context rot is described everywhere and measured almost nowhere. A CLAUDE.md convention that pushes against the language default held on both models at every context size reached, and the function names were parsed rather than pattern-matched so a single ambiguous word could not be scored as a failure.
- claude code 2.1.226
- scorable turns 270
- violations 0 of 270
- Haiku 4.5 context reached 136,392 tokens
- re-verified 2026-08-10, isolated 80 of 80, to 41,072 tokens
A required field was absent. It answered null 24 times out of 24
A schema with seven deliberate traps, extracted by plain prompting rather than constrained decoding. Shape and truth were scored separately so the gap the guides warn about would be visible. It did not appear once.
- claude code 2.1.226
- extractions 24
- schema-valid 24 of 24
- every field correct 24 of 24
- re-verified 2026-08-10, isolated 24 of 24, unchanged
AI tests killed 35 of 36 planted bugs. Four suites never ran at all
Mutation testing on generated pytest suites, with each mutant verified to be catchable before it counted. Opus produced ten usable suites out of ten and killed every mutant. Re-verified under isolation the caught-bug result held and improved to 38 of 38; the claim that Haiku failed on the same two functions every time did not.
- claude code 2.1.226
- suites generated 20
- mutants killed 35 of 36
- Opus 5 usable suites 10 of 10
- corrected 2026-08-21 phantom medians 196 and 11 withdrawn
- re-verified 2026-08-10, isolated 38 of 38 mutants killed
- corrected 2026-08-10 per-subject failure claim withdrawn
Haiku got XXE wrong every time. Opus used defusedxml every time
The circulating figure is that 44% of AI code generation tasks introduce a vulnerability, from corpora nobody can inspect. Here are six classes, both prompts and every generated file published. SQL injection never appeared once. XML external entities appeared in three runs out of three.
- claude code 2.1.226
- files generated 36
- flagged by the scanner 4 of 36
- XXE, Haiku 4.5 3 of 3 vulnerable
CLAUDE.md stopped Opus adding docstrings 8 of 8. The Haiku half did not hold
The advice everywhere is to put a "never add comments" rule in CLAUDE.md because the model ignores you otherwise. The original Haiku figures here did not reproduce and have been withdrawn; a re-run the same day produced the opposite result. The Opus finding, that the rule removed a docstring from every file, is unaffected.
- claude code 2.1.226
- generations 86
- inline comments seen withdrawn, did not reproduce
- Opus 5 file writes, no rule 8 of 8 had a docstring
- Haiku 4.5, either way withdrawn, did not reproduce
- corrected 2026-08-10 Haiku control re-ran as 8 of 8
The loud prompt injection failed 30 times. The quiet one worked 6 of 6
A benign marker payload, five placements, two models, and an arrival control proving the file was read on all 42 runs. The obvious injection was caught in all 30. Reworded as an ordinary editorial note, the same instruction got through the cheaper model 6 times out of 6, silently.
- claude code 2.1.226
- obvious payload runs 30
- obvious payload obeyed 0 of 30
- quiet payload, Haiku 4.5 6 of 6 followed
- re-verified 2026-08-10, isolated unchanged, 0 of 20 obeyed
"Think step by step" changed nothing in 96 runs
Three prompt styles, two models, four questions with ground truth computed by the script that asked them. Adding "think step by step" never once turned a wrong answer right, because the models already reason without being told to. Forbidding the working is what broke one of them.
- claude code 2.1.226
- runs 96
- correct overall 92 of 96
- cells CoT improved 0 of 8
- re-verified 2026-08-10, isolated direction holds, 0 of 4 became 1 of 4
With the control arm controlled, Haiku commented all 16 files
The control arm was running under a machine-level prohibition, so neither arm was rule-free. Isolating it needed a flag that blocks user memory without breaking tools, verified by hook rather than assumed. The corrected result reproduces across two rounds and says the opposite of the original.
- claude code 2.1.226
- files, corrected trial 32
- no rule, files clean 0 of 16
- rule, files clean 16 of 16
A model hashed passwords with raw SHA-256 in 8 of 9 runs. Two extra words fixed it
The widely quoted figure is that 45% of AI-generated code contains vulnerabilities. I tested two textbook cases across three models with an objective checker. One failed badly and consistently, one classic vulnerability never appeared at all, and the fix was two words of prompt.
- password, neutral prompt 8 of 9 insecure
- same model, "make it secure" 2 of 2 secure
- SQL injection found 0 of 12
- models tested 3
Eight models, one bug, three rounds: the 32B coder passed every time and the 72B failed every time
A hands-on trial rather than a benchmark: one small JavaScript bug with a trap in it, eight models, three rounds each, every answer executed against the real test suite. The results are not ordered by model size, and the code the models wrote shows exactly why.
- models tried 8
- rounds each 3
- Qwen2.5-Coder-32B 3/3 passed
- Qwen2.5-72B 0/3 passed
Finding one fact in 43,000 words: 10 of 10. Adding three of them up: 8 of 10
A needle-in-a-haystack test at 43,000 words found no position bias whatsoever: the fact was retrieved from 0%, 25%, 50%, 75% and 100% depth every time. A harder version requiring three buried facts to be added together failed twice in ten runs, and both failures were arithmetic, not retrieval.
- document length 43,000 words
- single fact, all depths 10 of 10
- three facts combined 8 of 10
- decoy codes in document 12
It gave the same wrong answer 8 times out of 8. Consistency is not accuracy
The circulating concern is that models give different answers to the same question. Across 64 runs the more useful finding was the opposite: the most stable answers included some of the most reliably wrong ones, and asking twice tells you nothing about correctness.
- runs 64
- correct overall 41 of 64
- questions that varied 4 of 8
- letter count 0 of 8 correct, 1 answer
Models hit an exact word count once in 31 tries. Sentences: 17 out of 17
A measured test of the most-repeated prompting workaround. Word counts came in anywhere from 28% short to 52% long. Sentence and paragraph counts were hit exactly in all 17 runs, across every model tested.
- exact word counts 1 of 31
- exact sentence counts 9 of 9
- exact paragraph counts 8 of 8
- worst word miss +52%
Only 6 of 30 AI citations were real, and 11 of the fakes had DOIs that resolve
Citation fabrication measured rather than described: 30 citations from three open models, each DOI resolved against Crossref and DataCite and its title compared to the claimed one. Verifying that a DOI merely exists would have passed 11 fabrications.
- citations checked 30
- verified real 6
- niche topic real 0 of 15
- real DOI, invented title 11
Every figure above is collected on the measurements page.