Tuesday, September 1, 2026

The through-line is identity: who is actually on the other end of a request. Threat actors are forging AI crawler user agents to hunt for .env files, infostealers are lifting authenticated Claude sessions straight past 2FA, and 19 browser extensions bought their way into 80,000 installs before turning malicious. Meanwhile the Pentagon put ChatGPT and Grok on GenAI.mil, Brussels reclassified ChatGPT as a search engine, and Sacramento adjourned with 26 AI bills passed.

TLDR

The Pentagon added OpenAI's ChatGPT Mil and Starshield's Grok for Government to GenAI.mil, its enterprise portal for 3M DoD personnel — 1.7M of whom are already onboarded (Aug 31) Policy Trending
The European Commission designated ChatGPT a Very Large Online Search Engine under the DSA — 159.1M EU monthly users, four months to comply, fines up to 6% of global revenue (Aug 31) Policy
GreyNoise found 824 addresses forging six AI crawler identities — ClaudeBot, GPTBot and others, character-for-character — to scan for .env files, cloud keys and password stores (Aug 28) Security
Anthropic is emailing Claude users whose sessions were stolen by commodity infostealers and resold to drain usage; a copied session cookie skips password and 2FA entirely (Aug 30) Security
California's legislature adjourned with 26 AI bills passed; 24 now sit on Newsom's desk with a Sept 30 deadline (Aug 31) Policy

Action Items

Things your engineering team should look at or do this week.

Find every place a user-agent string grants access or waives a control, and put a real check behind it. GreyNoise's numbers make this concrete: 824 addresses, spread across 795 separate /24 networks, sent six forged AI crawler names — including a ClaudeBot string that matches Anthropic's documented value character for character. There is no network to block and no string to filter on. The check that works is the connecting address against the vendor's published range (Anthropic at claude.com/crawling/bots.json, OpenAI's three separate lists for GPTBot/ChatGPT-User/OAI-SearchBot, Google's and Perplexity's equivalents). Two cheap detections to add today: alert on any request for /.env, /.aws/credentials or /.git/config — no legitimate crawler has a reason to ask — and flag any "crawler" that never requests /robots.txt across a multi-day window. Anthropic's real crawler requested robots.txt more than any other path, 12% of its traffic; the six impostors requested it zero times. Then do the boring part: get .env, .git and cloud credential files out of the web root, and rotate any key that was ever reachable from a web path.
Re-plan your Claude Code weekly budget for September 14, and tell the team the real number. The temporary 50% weekly boost runs through September 13. On the 14th it is replaced by a permanent +25% over the pre-promotion baseline — which Anthropic confirmed, after deleting and reposting its own announcement, works out to a ~17% reduction versus what you have today. If your team's sprint velocity quietly absorbed the promo capacity over the summer, that shortfall lands mid-sprint. Decide now whether you absorb it, shift heavier work to the API, or move some agents to a cheaper model tier.
Treat "my usage limits drained while I wasn't working" as a compromise indicator, not a billing complaint. Anthropic's notice ties the account takeovers to Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer (AMOS) on Mac — none of them AI-specific. The mechanism generalizes to every SaaS tool your team is signed into: an infostealer copies the authenticated browser session, so the attacker never sees a password prompt or a 2FA challenge. Anthropic's own warning is the operative line — signing the user out kills the stolen session but not the malware, and the next login gets taken the same way. If anyone reports this pattern, the response is endpoint remediation first, then credential rotation and session revocation across every service on that machine.

Models & Tools

Claude in Chrome went generally available — and the notable change is that it acts without asking (Aug 26) Agents — Anthropic moved its Chrome extension out of the year-long pilot to GA for paid plans. The behavioral shift is the story: Claude now takes browser actions autonomously rather than requesting approval for each one, with a safety classifier validating each action against the user's request before it executes. It reads pages, types, clicks, navigates and fills forms using your existing logins — which is precisely the capability the pilot existed to make safe, since the original announcement framed prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ from web pages, emails and documents as the blocking risk. The question to ask before you approve it for a team: a classifier is a probabilistic control on an agent that holds your authenticated sessions, and the blast radius of a false negative is whatever those sessions can reach. Worth deciding deliberately which browser profile it runs in. (Anthropic)
Claude Code v2.1.252 fixes a Remote Control stall and a settings-file gap (Aug 31) — A maintenance release, but two fixes matter if you run agents across machines. Remote Control sessions hosted by Claude Desktop or VS Code could stall for minutes after a tool finished when the connection to claude.ai degraded — a failure mode that looks like a hung agent rather than a network problem, which is exactly the kind of thing that burns an afternoon of debugging. Also fixed: "always allow" silently failing to persist in projects that don't yet have a .claude/settings.local.json, and oversized background-task failure output (a git error on a full disk, say) blowing past the API request size limit. (Claude Code changelog)

APIs & Pricing

Anthropic: Claude Code weekly limits drop ~17% on September 14 (announced Aug 29) Pricing — Anthropic announced on X that it is "permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterprise plans" starting September 14, with the current temporary 50% increase in place until then. The arithmetic is the news: if the original allowance was 100, you have 150 today and you get 125 on the 14th. Anthropic deleted the original thread and reposted a clarification stating plainly that "compared to today, this works out to a 17% reduction in weekly limits on Claude Code," and said further usage changes are coming with "more visibility and control." Both framings are accurate against different baselines — but the one that affects your sprint is the reduction. Note also that weekly allowance is not a fixed prompt count; it varies with conversation length, model choice, tool usage and effort level, so a team that shifted toward heavier agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ runs will feel this more than the headline percentage suggests. (BleepingComputer | @ClaudeDevs)

Security

Threat actors are forging AI crawler identities to hunt for credentials — and the user agent cannot tell you apart from them (Aug 28; picked up widely Aug 31) Security Production — GreyNoise observed a cluster impersonating 13 AI crawler identities from eight companies, requesting .env files, /.aws/credentials, private keys and password stores. Six of those names — belonging to Anthropic, OpenAI, Google and Perplexity — arrived from the same 824 addresses in near-identical volume on a single HTTP client fingerprint between July 28 and August 23, with the largest day on Aug 23. Three findings worth internalizing: (1) the forged ClaudeBot string matches Anthropic's documented value exactly, so no user-agent rule can separate them; (2) none of the 824 addresses fall inside any published crawler range from any of the four companies, making address verification the only reliable control; (3) the impostors never requested /robots.txt, while Anthropic's real crawler requested it more than any other path and never once asked for a credential file. GreyNoise also caught 263,849 sessions forging Google-Extended, a tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ Google documents as never being sent as a user agent — so every one of them was fake by construction. The 824 IPs are published; the recommendation is investigation via fingerprint, not blocking, since the addresses span 795 /24s. (GreyNoise | IoC list | Help Net Security)
Anthropic is notifying Claude users whose authenticated sessions were stolen by commodity infostealers (Aug 30) Security — Anthropic emailed affected users that "a bad actor" is using common infostealer malware to steal Claude login sessions from people's computers, then using those sessions to access accounts and consume usage. The detection heuristic Anthropic offered users is a good one: "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause." Named families: Vidar, LummaC2, StealC, RedLine, Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Anthropic is revoking sessions, removing saved payment methods and refunding unauthorized charges, and is explicit that the malware is not related to Claude, installed through Claude, or caused by anything the user did in Claude — the confirmed vector in the case that surfaced publicly was a pirated game download. Why this is a general lesson rather than a Claude story: stolen session cookies bypass password and 2FA, so every SaaS tool signed in on that endpoint is equally exposed, and signing the user out does nothing until the endpoint is cleaned. (BleepingComputer | Security Affairs)
19 Chrome and Edge extensions turned malicious via routine auto-update, after the attackers bought them (Aug 30–31) Security — Socket traced a malware framework across 18 Chrome extensions and one Edge extension that deployed modules to steal cryptocurrency wallet secrets, passwords, browser data and history, and to inject ClickFix lures. The supply-chain mechanic is what makes it worth your attention: the attackers acquired established add-ons that already had users, then shipped the payload through the normal automatic update channel. The extensions were genuinely useful things — search helpers, price monitors, copy-unlocking tools. One, "Enable Right Click & Copy — Smart Unlock + OCR," had at least 70,000 Chrome users when it turned; the most exposed pair reached roughly 80,000. Activity may date to early 2024. Read this next to the Claude in Chrome item above: browser extensions run in the same profile as your agent's authenticated sessions, and "I vetted it at install time" is not a control against an ownership change. (The Hacker News | BleepingComputer)

Industry & Business

The Pentagon put ChatGPT Mil and Grok for Government on GenAI.mil — and the anti-lock-in framing is deliberate (Aug 31) Policy Trending — The DoD launched OpenAI's ChatGPT Mil and Starshield AI's Grok for Government on GenAI.mil, the enterprise portal that launched Dec 9 with Google Gemini as its only tool. The stated rationale for adding two more: eliminate vendor lock-in and promote a broader American AI ecosystem. Scale: more than 1.7 million unique users onboarded out of 3 million DoD personnel. ChatGPT Mil is cleared for controlled unclassified information and ships chat, files, projects and custom GPTs, aimed at drafting and reviewing procurement materials, summarizing policy documents and generating compliance checklists; a DoD official framed Gemini as the search tool and ChatGPT as the text-work tool, with users picking per task. The context that makes this more than a procurement note: the department is simultaneously working to remove Anthropic's Claude department-wide by end of September, after the Pentagon designated the company a supply-chain risk — a deadline that has already slipped right from an original August 27 target, with the Air Force Research Lab pushing its contractors to purge by Sept 1. A federal judge ruled that blacklisting illegal on Aug 28. Multi-vendor as policy, in other words, has a live counter-example running alongside it. (TechCrunch | DefenseScoop | Defense One | Breaking Defense)
Clay is raising at a $7B pre-money valuation, led by Wellington (Aug 31) Customer AI — The GTM/sales-automation platform inked a deal at $7 billion pre-money, up from the $5B mark set in a January 2026 employee tender led by DST Global, and from the $3.1B Series C led by CapitalG in August 2025. That's a 2.3x in about twelve months, in a category — AI for sales and marketing ops — that is closer to the revenue than most of the infrastructure layer. Worth tracking as a read on where enterprise AI budgets are actually landing versus where the funding headlines usually point. (Axios Pro)
Microsoft and HUMAIN expand at LEAP 2026: a Microsoft 365 + Copilot bundle and a locally-built AI PC (Aug 31) Infra — The two announced an enterprise "AI productivity bundle" pairing HUMAIN ONE with Microsoft 365, Microsoft 365 Copilot and Microsoft's IQ capabilities, hosted on Azure and initially targeting one million users across the Middle East and Africa. They also unveiled a HUMAIN AI PC shipping with Windows, combining CPU, GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ and NPU to run workloads locally alongside cloud AI. This builds on an Aug 26 announcement integrating HUMAIN's ALLAM Arabic-language models into Microsoft's ecosystem. The pattern to note: sovereign-AI deals are increasingly bundled — model, productivity suite, cloud region and endpoint hardware in one commitment — which is a materially higher switching cost than a per-token contract. (Microsoft Source EMEA | PR Newswire)

AI in Production

A single expired certificate took Exchange Online down and dragged Teams, SharePoint, OneDrive, Purview and Defender XDR with it (Aug 31–Sep 1) Production Infra — The incident opened as EX1464935 around 17:30 UTC Aug 31 and was re-scoped to MO1465074 as it spread across the suite. Microsoft's preliminary root cause: an issue within a core authentication configuration used by multiple Microsoft 365 services, with a misconfiguration preventing authentication components from deploying to part of the infrastructure; independent reporting attributes it to a certificate that was not renewed before expiry. Symptoms ran from send/receive failures and broken mailbox search to stale Teams presence and admin-tool errors. Roughly 12 hours in, mailbox connectivity was restored, with search and queued-mail backlogs still draining into Sept 1. Not an AI outage — which is the point. The auth layer that every AI surface in your stack quietly depends on is a shared single point of failure, and Defender XDR going down with the mail it monitors is the kind of correlated failure that tabletop exercises usually assume away. Two questions worth asking your own team this week: what expires in the next 90 days, and who gets paged when it does. (TechCrunch | BleepingComputer | Born's Tech)

Policy & Safety

The European Commission designated ChatGPT a Very Large Online Search Engine under the DSA (Aug 31) Policy — The Commission designated ChatGPT as a VLOSE, alongside Reddit and Roblox as VLOPs, on the basis of 159.1 million EU monthly active users against a 45 million threshold. The classification itself is the interesting part: the Commission treats ChatGPT as a search engine because it answers questions and searches the web — a reading that could travel to any assistant with a retrieval surface. Obligations that follow: annual systemic risk assessments with independent third-party audits, a public advertising repository, data access for vetted researchers, twice-yearly transparency reports, notice-and-action procedures and a crisis response mechanism. Compliance window is roughly four months from notification — end of December 2026 — with fines up to 6% of global annual revenue. Why an engineering lead should care beyond OpenAI's problem: "vetted researcher data access" and "auditable systemic risk assessment" are architectural requirements, not legal ones, and if you ship an AI product into the EU at any scale, the logging and evaluation infrastructure they imply takes longer to build than the compliance deadline you'll eventually be given. (European Commission | heise | Search Engine Journal)
Update — California adjourned with 26 AI bills passed; 24 are on Newsom's desk and he has until Sept 30 (Aug 31) Policy — Following up on the weekend floor votes flagged here yesterday: as of 9 p.m. Monday, the legislature had passed 26 AI-related bills this session. Two are already signed; 24 now await the governor, who has until September 30 to sign or veto. Among those that cleared: SB 1119, updating California's existing chatbot law with child-safety provisions (39-0 in the Senate on May 19, Assembly on Aug 31); AB 1709, barring social platforms from serving addictive features like personalized feeds and autoplay to under-16s; and AB 1883, which would prohibit employers from using AI workplace surveillance tools to collect neural data or infer a worker's emotional state (final Assembly vote Aug 30). The one to put on your own roadmap is AB 1883. Emotion inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ and biometric signals show up in more products than teams realize — meeting summarizers, support-quality scoring, developer-productivity dashboards — and if it's signed, "we don't do emotion detection" needs to be something you can demonstrate from the code, not assert from the product page. (HR Dive | Bloomberg Law | Transparency Coalition)

Tutorial / How-To

"No AI Fridays" — a one-day-a-week abstention protocol, and it's trending on HN today (trending Sep 1) Trending — A short manifesto, mandated as practice by the CEO of htmx, arguing for one AI-free workday per week. The argument is about calibration, not purity: constant AI use creates blind spots because offloading decisions means you stop seeing the trade-offs being made on your behalf, and a weekly unassisted day is a cheap audit of whether the direction the tools are steering you still matches your own judgment. Two secondary claims worth testing on your team — that a day without tokens surfaces opportunities for ordinary deterministic automation you'd otherwise have prompted your way past, and that it measurably reduces long-run token spend. Why it's here rather than in the culture-war pile: it's a concrete, low-cost team experiment with a falsifiable outcome, which is more than most "how to work with AI" content offers. Whether the flow-state argument lands is a matter of taste; the blind-spot argument is testable. (noaifridays.com | Hacker News)

A quiet day for models and a loud one for everything around them.