Openhour
Rush Hour · Friday AI brief · October 2026

Sophos Cuts Threat Hunts by 96 Percent

Inside: Anthropic's smallest model just got built for bulk work

A security vendor handed its alert triage to an OpenAI system and watched investigation time fall by almost all of it, while still keeping an analyst on every case that matters. The same week, Anthropic shipped a small model aimed squarely at the repetitive, high-volume jobs most agents spend their time on. Both point at the same shift: the cheap, fast layer of AI is where the real operating savings now live.


SECURITY

Sophos handed its threat triage to an OpenAI agent

Sophos sells managed detection and response, or MDR: it watches a customer's systems around the clock and, when something looks like an attack, a human analyst investigates it. The slow part has always been that investigation, pulling logs, reconstructing what happened, and deciding whether an alert is real or noise. Sophos wired OpenAI's Daybreak, OpenAI's security-focused system, into that step so the agent gathers the evidence and drafts the assessment before an analyst ever opens the case.

The reported result is a 96 percent cut in investigation time, with 52 percent of MDR cases handled automatically. The number worth reading closely is that second one: roughly half the caseload still routes to a person. The design keeps human sign-off on the cases that carry risk rather than letting the agent close everything, which is what makes the speed claim defensible instead of reckless.

For anyone running a lean operations team, the pattern transfers beyond security. The agent does the evidence-gathering that eats the hours, and the expert spends their time on judgment, not assembly.

MARKETING

Supermetrics lets marketers change campaigns mid-conversation

Supermetrics builds tooling that pulls a marketer's live advertising data out of platforms like Google and Meta and into one place. Its newer move is to put that data inside a Claude conversation, so a marketer can ask a plain question about yesterday's spend, get the real numbers back, and then adjust a running campaign without leaving the chat. What it replaces is the usual round trip: export a report, open a spreadsheet, interpret it, then log into each ad platform to make the change.

The mechanism that makes this work is the connection between the model and the live data, not the chat window itself. Because the model reads current campaign figures and can push changes back, the conversation becomes the control surface. Supermetrics reports a client report that took 10 hours now takes 20 minutes, and 250 percent monthly growth in users on the feature.

The ten-hour-to-twenty-minute figure assumes the underlying data connections are clean. The lesson for an operator is that the payoff comes from wiring the model to the system of record, not from the phrasing of the prompt.

ANTHROPIC

Claude Haiku 5.5 is built for the boring, high-volume jobs

Anthropic released Claude Haiku 5.5, which it calls its fastest and most capable small model. The framing matters more than the version number. Anthropic is pitching it specifically at high-volume work: summarizing large batches of documents, running as subagents under a larger model, and driving a browser through repetitive steps. These are the tasks an agent system spends most of its calls on, and they rarely need the full reasoning power of a frontier model.

The practical consequence is cost structure. A workflow that routes the heavy thinking to a large model and the bulk grind to Haiku pays frontier prices only where frontier reasoning is actually required. That is the same split the Sophos and Supermetrics deployments rely on, and a cheaper, faster small tier makes it easier to justify running agents at scale rather than on a handful of showcase tasks.

For teams already running agents, the move is to look at which steps are genuinely hard and which are just high in count, and price them separately.

Our fastest, most capable small model. Built for high-volume work like summarization, subagents, and browser use.
GOOGLE

Google pulls scattered agents into one hub

Google rolled out an offering that unifies an enterprise's fragmented AI agents into a single hub inside Gemini Enterprise. The problem it targets is familiar to anyone who has watched teams buy agents faster than they can connect them: separate agents for support, sales and operations, each with its own setup, none aware of the others. The hub is meant to be one place to deploy, manage and govern them together.

What changes is the posture. A Gartner analyst quoted in the coverage framed the move as a shift from agents that assist to agents that complete tasks proactively. In practice that means less of a human kicking off each agent and more of the system running standing work on its own, which only becomes manageable when the agents live somewhere central rather than scattered across tools.

The open question is governance: proactive task completion across many agents is useful only if an operator can see what each one did and stop one that goes wrong. Centralizing them is the precondition for that visibility.


Run the small-model test

Pick one high-volume, low-judgment task you already run through AI, something like summarizing emails, tagging support tickets, or pulling key fields out of invoices. Run the same ten real examples twice: once on your usual large model, once on a small, cheap one (Claude Haiku, or the smallest tier your provider offers).

Use an identical prompt for both so you are comparing the model, not the wording:

For each item below, return: 1) a one-line summary, 2) the category from this list [list yours], 3) any dollar amount mentioned.
Return one row per item. Do not add commentary.

[paste your 10 examples]

Put the two outputs side by side. If the small model gets the same answers, move that task to it permanently and note the price difference. You have just found a line item you can cut without losing quality.

Reply and tell me which task is eating your team's hours, and I'll tell you how we'd build an agent for it at Openhour.

Sources
  1. Sophos cuts threat investigation time by 96% with OpenAI Daybreakopenai.com
  2. Supermetrics: manage ad campaigns in a Claude conversationclaude.com
  3. Introducing Claude Haiku 5.5anthropic.com
  4. Google unifies fragmented AI agents into a single hubciodive.com

Evan's Essentials
  • RailwayRailwayI think Railway is the future of cloud infrastructure for AI.
  • Wispr FlowWispr FlowThis tool has single-handedly helped me 5x my speed and productivity.

Some links are affiliate links.

Free · every Friday

Get the weekly AI brief

Plain-English AI, in your inbox each week. One email, no spam.