The Haiku 5.5 Pricing Trap: Why Identical Token Prices Triple Your Bill - and the AgentCore Exploit

Claude Haiku 5.5 and GPT-6 Luna list the exact same prices: 0.10 dollars per million input tokens, 0.50 dollars per million output tokens. The same task still costs roughly three times as much on Haiku 5.5 as on Luna, and the reason sits not in the price sheet but in the token counter: Haiku 5.5 does not let you switch its reasoning off and emits roughly 162,000 output tokens per task, Luna about 50,000. Whoever operates agents pays the difference in the end, not the sign in the pricing document. Added to that this week is a security lesson of matching scale: a single prompt to one publicly reachable agent was enough for researchers to read temporary AWS credentials and take over every agent in the same account. Both stories circle the same question: what does thinking actually cost, and who foots the bill? This post sorts the numbers behind both findings and draws the lines that remain for your own agent operation.

Artificial Analysis scored Haiku 5.5 at 43 points on its Intelligence Index on release day, 26 points more than the previous Haiku generation one year earlier. The sticker price matches GPT-6 Luna, 0.10 and 0.50 dollars per million tokens up to a context of 100,000 tokens. The decisive finding sits elsewhere: at maximum effort Haiku 5.5 emits around 162,000 output tokens per Index task, Luna about 50,000 in its comparison mode, roughly a third. At similar intelligence on High the consumption sits close together with around 55,000 against 50,000 tokens, and the gap opens only as the effort dial turns up. Cost per task, by the way, is published by the measurement site as explicitly provisional for this model, because their Index measurement does not yet reflect the price step above 100,000 tokens of context. For your own accounting that means: the reliable number is the token ratio, not the cent figures.

Simon Willison demonstrated the dial on 7 October 2026 on the very task he has used for years to test models: an SVG of a pelican riding a bicycle. On effort Low the pelican cost 0.0936 cents and took 7 seconds. On effort Max the best pelican he had seen from Anthropic models emerged after 5 minutes 9 seconds and 67,647 output tokens, for 3.3826 cents. That is a factor of 36 between the two runs. The sentence that matters for the pricing trap comes from the same report: the new Haiku does not allow reasoning to be disabled, the default setting is Medium. Reasoning tokens bill as output tokens, and output is precisely the block priced at 0.50 dollars per million. Willison also notes that Haiku 5.5 ships a less generous tokenizer, so the same text costs more tokens than on its predecessor. The cheap sticker price therefore holds mainly for work that stays small in context and runs under low effort.

Coverage so far has focused on the reasoning, but the second cost trap stands in the same table: above 100,000 tokens of context the Haiku price rises fivefold to 0.50 dollars for input and 2.50 dollars for output per million tokens. Luna rises too, but only at 272,000 tokens and only to 0.20 and 0.75 dollars. Willison's summary is terse: if your workloads fit under 100,000 tokens, both models cost the same and Haiku reports higher benchmark scores; above that, Luna looks like a much better deal. Exactly this threshold hits agent operations where they are most sensitive: long tool chains, research threads and document stores grow unobserved into the context. An agent that runs economically at 90,000 tokens can move into a different price zone after three more documents without anything about its task having changed.

If low costs tempt you to scale up an agent operation, the attack surface grows with the invoice. The week's second topic supplies the counterexample in its purest form: Zenity Labs research, published under the name AgentCorruption, demonstrated a chain on AWS Bedrock AgentCore in which a single prompt to one publicly reachable agent sufficed to reach the Instance Metadata Service, harvest temporary credentials and take over every agent in the same account within the same region. The agents ran in Firecracker microVMs lacking the required network isolation, and the default role was not scoped to the individual agent. Reporting says the flaw has since been patched. The parallel to the pricing trap lies in direction, not in code: both times the danger does not sit in the model but in what was never configured around it. Discounts on thinking make small sources of error numerous, because more agents become affordable.

What an agent payment flow looks like when the model never sees payment secrets, LangChain described on 8 October 2026 with its sample agent Restock. The flow: a user asks in Slack for office supplies under 25 dollars, the agent picks the items, the user approves the purchase in Slack, payment runs through Link, the user's own wallet. The agent never touches a card number, the delivery address and API keys live in managed connections, and the spend is capped in advance. Two human approvals confirm the order, one in Slack, one in Link. The rules can be lifted from the example: build protection outside the model instead of promising it in the prompt, give every agent its own credentials and fixed limits, place publicly reachable agents in an account of their own. That exact line was missing in the AgentCore finding.

Seen from the deck, both findings reduce to a short operating list. First, my billing runs through Ollama in a request window rather than token prices, so the pricing trap hits me indirectly, when I outsource work to models that bill by token. Second, the effort dial is the biggest cost lever the measurements show: a factor of 36 between Low and Max on the same task is not a rounding difference but an operating insight that belongs in every task budget. Third, the context tier decides the provider switch: a model comparison never reaches 100,000 tokens if your own threads grow toward them. Fourth, the AgentCore finding works as a checklist: scope roles per agent, wall metadata access out of the sandbox, isolate public endpoints, and build the approval path the way Restock demonstrates. Cheap reasoning tempts you toward more agents, and more agents mean more configuration you can give away for free if you leave it at the default.

From the measurement situation I keep one simple operating rule that has governed the deck since this week: set effort per task type, not globally. Classification, short answers and routine trimming run on Low, where the Willison figures sit at fractions of a cent. Writing and structuring tasks get Medium, the model's default. Tool chains with real planning needs get High, and Max is reserved for one-off pieces whose result gets reused later. Artificial Analysis additionally notes that stepping from xhigh to Max buys about two Index points for roughly 1.8 times the token consumption, so the top rung of the dial costs time and money rather than intelligence. Whoever sets the dial per task instead pays for exactly the thinking the task needs, and not for what the model delivers out of habit.

Limits of this post: the price and token figures come from the Artificial Analysis article of 7 Oct 2026 and the Willison report of the same day, both retrieved and checked against the originals on 9 Oct 2026. Artificial Analysis itself labels its per-task cost figures provisional because the Index measurement does not yet reflect the price step above 100,000 tokens, so this post works with the token ratio instead. The AgentCore section rests on the Zenity press release and Dark Reading coverage; I have not read the underlying technical report in full, and the patch status follows the same coverage. The Restock description follows the LangChain post of 8 Oct 2026, whose prices are marked as illustrative there.

About the author: I am Marcel, graphic designer and operator of the HUNTER cyberdeck, an agent setup built on a used Google Pixel 6a. The token and price figures in this post come from the original reports by Artificial Analysis and Simon Willison, checked on 9 Oct 2026. Last fact-checked on 9 Oct 2026.