JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Wednesday, September 2, 2026

15 stories

TLDR

  • Anthropic shipped Claude Fable 5.1 and Mythos 5.1 and cut cache reads 75% to $0.25/MTok — list price unchanged at $10/$50, but agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ workloads get up to ~45% cheaper (Sep 1) Pricing
  • A critical Langflow RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ (CVE-2026-0768, CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8) is under continuous active exploitation since Aug 29, with attackers harvesting OpenAI and AWS keys from .env files and environment variables (Sep 1–2) Security
  • AIR emerged from stealth with $50M and a finding worth acting on: it filters out ~27% of the public agent skills and add-ons it scans, including skills impersonating Anthropic and OpenAI that execute arbitrary code on install (Sep 1) Security Agents
  • Cognition is closing ~$1B at a $47B valuation — up from $26B in May, on roughly $900M annualized revenue for Devin (Sep 2)
  • METR disclosed two 2026 security incidents, including a fail-open auth bug on a researcher's EC2 instance that leaked an API key and burned ~$600,000 in inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ credits (Aug 31) Security

Action Items

Things your engineering team should look at or do this week.

  • Find every Langflow instance you run and patch or take it offline today. CVE-2026-0768 is unauthenticated arbitrary code execution as root — a missing validation check before the validate endpoint executes its code parameter as Python. Every release up to and including 1.4.2 is affected. This is not theoretical: VulnCheck saw continuous exploitation beginning August 29 from ~20 source IPs across 6+ countries, with 50+ canary detections. The post-exploitation behavior tells you what to rotate: attackers went for the Langflow secret_key, API keys and cloud credentials in environment variables, SSH keys, .env files, and the Langflow source itself. So patching is step one; step two is rotating every provider key that instance could see, because unauthenticated root RCE means assume-breach. Note the shape of this bug — it is the low-code AI-agent builder, not the model, that got you. Inventory the rest of that category while you're in there.
  • Build an inventory of every skill, MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server and agent add-on installed across your dev environments, with a provenance check on each one. AIR's number is the useful part of its launch: of the publicly available agent skills and add-ons it evaluates, roughly a quarter fail its criteria, and among the failures were skills impersonating Anthropic and OpenAI designed to slip past review and run arbitrary code once installed. This is the same mechanism the TeamPCP campaigns used earlier this year — a project-level skill or MCP server carrying hidden instructions that the coding assistant executes as normal operation, exfiltrating credentials on the way. Your existing dependency scanning almost certainly does not cover this surface. Start with the list: what is installed, who added it, where did it come from, and does anything re-fetch on update.
  • Re-run your Claude API cost model before you decide anything about model tiers. Fable 5.1's list price is unchanged at $10/$50 per MTok, but cache reads dropped from $1.00 to $0.25 — 0.025× base input. Anthropic's own estimate is ~25% cheaper on typical workloads and up to ~45% on highly agentic ones, which is exactly the profile of a long-running coding agent that re-reads a large system prompt and codebase context on every turn. Cache writes did not move ($12.50 for 5-minute, $20 for 1-hour), so the economics now reward fewer, larger, longer-lived cache entries rather than aggressive re-caching. If your prompt-caching strategy was tuned when reads cost 4x more, the optimum has moved. Separately: the Sonnet 5 increase that was on the calendar for September 1 did not happen — see below — so any migration you paused waiting on that can be unpaused.

Models & Tools

  • Claude Fable 5.1 and Mythos 5.1 (Sep 1) Pricing Agents — Anthropic's successors to Fable 5 for long-running agentic coding, research and knowledge work. Both keep the 1M-token context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗, 128k max output and always-on adaptive thinking at $10/$50 per MTok — but cache reads fell 75% to $0.25/MTok, and batch processing halves both rates to $5/$25. Anthropic reports 52.6% on Terminal-Bench-Science and claims better performance reviewing code across a whole application, troubleshooting inside third-party libraries and running multi-step scientific work. The split to understand before you plan around it: Fable 5.1 is generally available (API, Bedrock, Google Cloud, Microsoft Foundry); Mythos 5.1 is gated to registered partners in cybersecurity and life sciences — same family, different access model, which matters if a proof-of-conceptProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗ assumes availability it won't get. (VentureBeat | TechSpot | System Card)
  • GitHub reopened Copilot Business and Copilot Enterprise sign-ups for card-paying customers (Sep 1) — New Copilot Business and Enterprise customers paying by credit card or PayPal can sign up again as of September 1. Small item, but if your procurement was blocked on this it is unblocked. (GitHub Changelog)

APIs & Pricing

  • Anthropic: the September 1 Sonnet 5 increase to $3/$15 did not take effect (deadline passed Sep 1) Pricing — Sonnet 5 launched with introductory pricing of $2/$10 per MTok and a scheduled step-up to $3/$15 on September 1 — a 50% increase on both sides. Anthropic reversed that in mid-August and made the introductory rate permanent. The date has now passed with no change. Worth a line in your team channel if anyone budgeted for a Q4 cost increase or paused a Sonnet migration waiting for the number to settle; it has. (Anthropic pricing docs)

Security

  • Langflow CVE-2026-0768 is being actively exploited to steal OpenAI and AWS keys (exploitation from Aug 29; reported Sep 1–2) Security Production Agents — Unauthenticated arbitrary code execution as root in Langflow, the low-code builder for AI agents, from missing validation before the validate endpoint executes its code parameter as Python. CVSS 9.8, all releases up to 1.4.2 affected, originally disclosed by Trend Micro's ZDI in January. VulnCheck observed continuous exploitation starting August 29 from ~20 source IPs across more than six countries, mixing reconnaissance with credential harvesting. What the attackers took is the part to plan around: the Langflow secret_key, API keys and cloud credentials from environment variables, SSH keys, .env file contents and Langflow source code — i.e. everything needed for lateral movement out of the AI stack into the rest of your cloud. (BleepingComputer | SecurityWeek | Dark Reading)
  • AIR launches with $50M to vet agent skills and add-ons — and ~27% of what it scans fails (Sep 1) Security Agents — Founded by Unit 8200 veterans Yair Saban and Niv Hoffman, AIR raised $10M led by Sequoia and $40M led by Greenoaks within weeks of each other, six months from founding. The product discovers agents running inside a company, continuously vets the skills, tools and components those agents load, and blocks interactions that fail its criteria; it also runs a whitelist marketplace of vetted add-ons. The research findings are the reason this is here rather than in the funding section: AIR filters out roughly 27% of the add-ons and skills it finds online, and its team turned up AI skills impersonating Anthropic and OpenAI that could run arbitrary code once installed — brand impersonation specifically designed to pass a human security review. 20+ customers, about a quarter of them large enterprises. The point stands independent of whether you buy the product: the agent add-on ecosystem is an unmanaged dependency surface, and one in four of its public artifacts does not survive contact with a scanner. (TechCrunch | SiliconANGLE)
  • METR disclosed two security incidents — including ~$600,000 of inference credits burned through a fail-open auth bug (Aug 31) Security Production — The frontier-model evaluation nonprofit published an unusually candid update. March 2026: attackers stole an API key from a researcher's public EC2 instance that had a fail-open vulnerability silently disabling authentication, then consumed roughly $600,000 in public-model inference credits. May 2026: systematic probing of METR's public infrastructure, including a failed attempt to exploit a bug in a public transcript viewer and an unsuccessful attempt to reach internal data via an inadvertently exposed endpoint. No sensitive information is believed accessed; no attribution; and explicitly not AI agents escaping evaluations. Two things to take from it. First, "fail-open" is the failure mode that produces no alerts — an auth layer that silently stops checking looks exactly like an auth layer that is working. Second, inference credits are now a theft target with direct dollar value, so treat provider API keys with the same rotation discipline and spend-anomaly alerting you'd apply to cloud credentials. (METR | The Hacker News | Dark Reading)

Industry & Business

  • Cognition is set to raise ~$1B at a $47B valuation — nearly double May's $26B (Sep 2) — The maker of Devin received close to $10B in investor interest for a round that could exceed $1B; terms are still moving. The trajectory: $10.2B in September 2025 → $26B in May 2026 → ~$47B now, against roughly $900M+ in annualized revenue. The multiple is the story — roughly 50x ARR for an agentic coding company in a market where the same buyers are, per McKinsey below, increasingly building rather than buying. Worth watching as a read on whether the coding-agent layer is being priced as infrastructure or as a product. (Bloomberg | TradingView/Reuters)
  • Nvidia put $3.5B into MediaTek — its largest direct investment outside the US — and MediaTek adopts NVLink Fusion (Sep 1) Infra Robotics/IoT — Structured as a convertible-bond purchase, with the partnership spanning three layers: cloud AI infrastructure (MediaTek adopting NVLink Fusion, letting custom XPUs plug into Nvidia's rack-scale NVLink fabric), local AI compute (continued chip work for RTX Spark and DGX Spark), and automotive (Dimensity Auto cockpit platforms alongside Nvidia DRIVE AGX). MediaTek shares rose ~10%. Why an engineering lead should note NVLink Fusion specifically: it is Nvidia's answer to hyperscalers building their own accelerators — rather than compete with custom silicon, make Nvidia's interconnect the thing your custom silicon has to speak. That is a durable lock-in point well below the layer most AI infrastructure decisions get made at. (CNBC | Bloomberg)
  • Anthropic signed a $35B cloud deal with Nvidia-backed Lambda — and Nvidia holds the lease on the data center (Aug 31) Infra — Anthropic will rent GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ compute from Lambda, on a 700MW campus in Nueces County, Texas developed by Hut 8. Nvidia occupies three positions in the same transaction: chip supplier, Lambda equity backer, and lease anchor on the underlying facility. This lands days after Anthropic's separate $45B commitment to Nscale in West Virginia, putting $80B of cloud commitments on the books in about a week. The structure is what's being debated, not the size — when the chip vendor also backs the cloud provider and anchors the real estate, the demand signal and the supply signal are partly the same signal. Related but separate from the Lambda $1B debt raise noted here yesterday. (Bloomberg | Forbes | BetaNews)
  • ChatGPT Ads hit a $1B annualized run rate in under 200 days, and self-service opened in India, Europe, the Middle East and North Africa (Aug 31) Customer AI — OpenAI expanded direct Ads Manager access to advertisers in those markets; the platform now has tens of thousands of advertisers, with SMBs already a material share since Ads Manager launched in May. $1B annualized in under 200 days is the fastest ramp of any OpenAI revenue line to date. The second-order effect worth tracking: an ad-funded assistant has different incentives around answer ranking and sponsored placement than a subscription one, which is a product-integrity question for anyone embedding ChatGPT surfaces in a customer-facing flow. (OpenAI | Forbes)

AI in Production

  • McKinsey's State of AI 2026: 32% of organizations skipped a software purchase because coding agents could build it — and EBIT impact stayed flat (Aug 30) Production — Nearly a third of respondents decided against buying off-the-shelf software in favor of building in-house with agentic coding tools; 41% in the technology sector. Among "high performers" — the 6% attributing at least 5% of EBIT to AI — nearly half are skipping purchases, versus 31% of peers. About two in ten organizations are scaling agentic coding tools, 31% at larger enterprises. The finding that should temper the headline: enterprise-level EBIT impact from AI stayed flat at 37% even as the build-vs-buy shift accelerated. Replacing a SaaS line item with code your team now owns moves the cost from a subscription to a maintenance obligation, and the survey does not yet show that trade paying off in aggregate. If your roadmap has a "we'll just build it" item on it this quarter, price the five-year run cost, not the build. (McKinsey)
  • ChatGPT Work took a multi-hour partial outage on Aug 31 — and there is still no public root cause (Aug 31) Production — Elevated errors and latency beginning around 11:04 AM ET, with users unable to start or continue tasks; heaviest impact on ChatGPT Work and Plus subscribers. OpenAI acknowledged it on the status page, shipped a mitigation and confirmed recovery by evening, but has not published a technical explanation. The operational lesson is about your side, not theirs: a several-hour degradation of a paid work tier with no post-incident detail is the normal case, not the exception, so any workflow that hard-depends on a single provider's availability needs its own fallback and its own user-facing degradation story. Worth pairing with yesterday's Microsoft 365 auth outage — two multi-hour dependencies failing in the same 48 hours. (BleepingComputer | OpenAI Status)

Policy & Safety

  • Anthropic raised its own catastrophic-harm risk assessment from "very low" to "low" in the Fable 5.1 system card (Sep 1) Policy — Alongside the model launch, Anthropic's system card states that these models demonstrate the strongest overall cyber capabilities of any model it has released, and that it now assesses the risk of catastrophic harm as low rather than very low, citing increased uncertainty in light of recent incident disclosures about model behavior. On automated AI R&D, the models remain well below Anthropic's own researchers, with METR's external testing consistent with that assessment. Read the tier split as a control, not a marketing distinction: the more capable, less restricted Mythos 5.1 is gated to registered cybersecurity and life-sciences partners, and Anthropic ships monitoring with customer control over it. If you are building on the cyber-capable tier, that monitoring configuration is now a decision you own. (System Card | Business Today)
  • The G20 Innovation Ministerial put Huang, Altman and Anthropic's Tom Brown in front of G20 ministers in Chapel Hill (Sep 1–2) — Hosted by Commerce Secretary Howard Lutnick with OSTP Director Michael Kratsios; Elon Musk and David Sacks participated on day one, Altman, Huang and Brown on day two. Huang's framing was the sovereign-compute argument, delivered directly to policymakers: AI infrastructure is as foundational to a country's development as core infrastructure, and "every single country needs to build infrastructure so that you could support your own local economy" — structured around his five-layer stack of energy, chips, data centers, models, then data and applications. Why it matters beyond the optics: this is the argument that turns AI procurement into industrial policy, and it is the same logic behind the sovereign-AI bundles showing up in enterprise contracts. Expect more national-capacity requirements attached to deals in markets where your product operates. (CNBC | Bloomberg)

Benchmarks & Evals

  • SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Verified is saturated; Terminal-Bench is where the spread still is (as of Sep 1) — On SWE-bench Verified, Claude Fable 5 leads at 0.950 across 113 evaluated models, with frontier models clustered in the mid-90s — at that density the benchmark no longer discriminates between models, it just confirms they're all frontier. Terminal-Bench still separates them: GPT-5.6 Sol at 65.9%, Claude Fable 5 at 62.9%, GPT-5.5 at 60.6%. Anthropic's 52.6% on Terminal-Bench-Science for Fable 5.1 is a different, harder split — not comparable to the numbers above. The practical implication for model selection: if you're still using SWE-bench Verified deltas to justify a model choice, you're reading noise. Terminal-Bench-style CLI and long-horizon agentic evals have more signal left, and your own task-specific eval set has more than either. (SWE-bench Verified leaderboard | TerminalBench leaderboard)

Type to search · ↑↓ to move · enter to open