JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Monday, September 7, 2026

12 stories

TLDR

  • Claude produced the first end-to-end computer-verified proof of Fermat's Last Theorem — 13 million lines of Lean, 29,500 intermediate theorems, 11 days largely autonomous (Sep 4) Trending
  • OpenAI published its own internal agent-usage numbers: 3.1 agent-workdays per human workday by mid-August, with the median researcher burning $600/day of inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ at API pricing (Sep 6) Agents Production
  • A New York Times investigation traced $5.6B of US server exports — including $3B of Blackwell systems — from Nvidia through a California subsidiary of blacklisted Inspur to ByteDance and Alibaba (Sep 6) Policy Infra
  • Grafana's MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server had an unauthenticated-tool-call bug chainable with a CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.1 SSRFServer-side request forgeryA bug where an attacker makes a server send requests for them, reaching internal services it shouldn't expose.OWASP ↗ to reach cloud metadata credentials — patched, but auth is still off by default (Sep 2) Security Agents
  • Fluidstack closed $1.5B at an $18B valuation led by Jane Street, more than doubling its July mark (Sep 3–5) Infra

Action Items

Things your engineering team should look at or do this week.

  • Upgrade mcp-grafana to ≥ v1.1.0 and explicitly enable authentication. Patching alone is not enough — auth remains optional after upgrade, and the session-spoofing bug existed because the server validated ID format rather than credentials.
  • Add tool-definition fingerprinting to your MCP clients. Capture a hash of each approved server's tool descriptions at approval time and alert on drift. Both this week's MCP research and last month's campaigns exploit metadata that changes after review.
  • Put a per-engineer inference budget alert in place before Q4 planning. OpenAI's median researcher is at $600/day and the 90th percentile at $7,000/day. If coding agents land on your team at any fraction of that intensity, your current cost model is wrong.
  • Re-run your coding eval before switching models on the Astra leaderboard news. Astra took #1 on Code Arena WebDev at price parity with Fable 5.1 — but that's crowdsourced Elo on greenfield web apps, not your codebase.

Models & Tools

  • Claude formalized Fermat's Last Theorem in Lean — the largest formal proof ever written (Sep 4) Trending — Working largely autonomously for 11 days, Claude produced 13 million lines of Lean and proved 29,500 intermediate theorems, closing the last open item on Freek Wiedijk's 20-year-old list of 100 formalization challenges. Lean verified it using only its three standard axioms. Two caveats worth carrying into any internal retelling: Claude did not discover the proof — it converted Wiles' existing argument into machine-checkable form — and the work sat on years of community infrastructure (Kevin Buzzard's Imperial FLT project, Mathlib, and Columbia's Prove2Me platform). Buzzard, who has been leading the human formalization effort, wrote his own frank reaction. Why an engineering lead should care: this is the clearest evidence yet that long-horizon, verifiable, spec-driven work is where agents currently pay off. The task had a machine-checkable success criterion at every step. Work in your backlog with that property — migrations with property tests, type-level refactors, proof-carrying config — is the work to point agents at first. (Anthropic | Technical report (PDF) | The Next Web | Kevin Buzzard's response)

  • Docusign is opening its MCP server to every agent on September 30 (announced Sep 4) Agents Customer AI — Agreement intelligence and governed actions, powered by Docusign's Iris engine, become callable natively from Claude, ChatGPT, Gemini, Copilot, Slack, or any MCP client. The date is the actionable part: if contracts sit anywhere in a workflow you're automating, Sep 30 is when the "build a Docusign integration" ticket becomes "point an agent at an MCP endpoint." It also means agents in your org will be able to take legally binding actions through a first-party channel — worth deciding your approval-gate policy before, not after. (Docusign / PR Newswire | The New Stack)

  • Boomi shipped an Agent Control Plane and an AI Gateway built on Lunar.dev (Sep 2) Agents Infra — The gateway combines MCP-gateway and LLM-gateway functions into a single enforcement point: real-time traffic filtering, rate limits, blocking non-sanctioned prompts, and human approval gates on critical transactional requests. Whether or not Boomi is your vendor, that feature list is now the de-facto reference architecture for agent egress control — and it maps almost exactly onto the "agent inventory, action-level checks, tamper-resistant logs" triad the pending federal bills would require. If you're building this in-house, compare against it. (Boomi Q3 product updates | ERP Today)

Security

  • Grafana MCP: unauthenticated tool execution chained with a CVSS 9.1 SSRF to pull AWS credentials from IMDSv2 (disclosed Sep 2, patched in v1.1.0) Agents — Pillar Security found that mcp-grafana validated the shape of a session ID rather than checking a credential, so an unauthenticated caller could mint a "session-shaped" ID the server never issued and call tools with it. Separately, CVE-2026-19516 (CVSS 9.1) let a caller supply an X-Grafana-URL header to the grafana_api_request tool, controlling the method, path and body of an outbound request from the server's network position. Pillar demonstrated chaining the two to reach the AWS Instance Metadata Service and retrieve cloud credentials. Both are fixed in v1.1.0. The important footnote: authentication remains optional after upgrading. Patching without turning auth on leaves the door open. More broadly — an MCP server is a request-forwarding proxy with your service account's network position, and should be threat-modeled as one. (Pillar Security research | SC Media | CVE-2026-19516)

  • ASCII smuggling crossed over from AI prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ into ordinary phishing — peaking at 2.37M emails a day (Sep 3) — Microsoft documented a campaign using invisible Unicode tag characters (U+E0000 block) wedged inside words to break keyword filters while rendering normally to humans: fun⟨U+E0020⟩ding reads as "funding" to a person and as noise to a filter. Weekday volumes ran 1–2.37 million messages, peaking Feb 26, 2026, with a distinct weekday cadence, before dropping sharply after May 15. Microsoft ties it to a broader operation abusing ActiveCampaign to send AI-generated phishing at SBA loan applicants. The engineering takeaway is a normalization gap, not a novel exploit: a technique the AI-security community cataloged as a prompt-injection primitive was operationalized at scale against classical email filters. Anywhere you compare user-supplied text against a rule — filters, moderation, allowlists, agent guardrails — normalize and strip non-rendering Unicode before matching, and log when you strip something. (Microsoft Security Blog | The Hacker News | SC Media)

Industry & Business

  • Fluidstack closed $1.5B at an $18B valuation, led by Jane Street (Sep 3–5) Infra — Total funding now just over $2.6B, and the valuation more than doubles the $7.5B it confirmed with a $750M round in July. The detail worth noting: Jane Street has committed roughly $6B to CoreWeave and $13B to Crusoe as a compute buyer — here it wrote the equity check instead. Fluidstack manages 100,000+ GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ and counts Anthropic (a $50B data-center deal announced last November), Meta, Poolside, Black Forest Labs and Mistral as customers. Read alongside Crusoe's $3B at $30B from last week: the same small set of financial counterparties is now simultaneously the customer, the lender and the shareholder across multiple neoclouds. That correlation is invisible on a vendor-risk questionnaire and is exactly the kind of hidden coupling that turned last week's outage story into a lesson about shared facilities. (Crunchbase News | Techmeme / Forbes | TechTimes)

  • Figure committed $3.5B to Nscale for up to 100,000 Nvidia Vera Rubin GPUs, with intent to scale past $6B (Sep 3) Robotics/IoT Infra — Deployment targets H2 2027 in Barstow, Texas. Nscale takes a strategic equity stake in Figure and becomes its preferred compute provider for the Helix robotics models; the two will also explore using Figure humanoids in Nscale's own supply chain. Figure says its Index data effort generates 35 minutes of training data every second, and frames itself as now bound by data and compute rather than algorithms. The number that matters for anyone budgeting GPU capacity: a humanoid-robotics company is committing frontier-lab-scale compute, on a platform that doesn't ship until 2027. Robotics is now competing with LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ training for the same allocation, which is a new source of pressure on 2027 capacity pricing. (Figure | PR Newswire | Unite.AI)

AI in Production

  • OpenAI published internal telemetry on agent usage: 3.1 agent-workdays per human workday, and it is careful to say that is not 3.1x productivity (Sep 6) Agents Trending — In Research acceleration: The view inside OpenAI, the company reports that its research organization hit 3.1 agent-workdays for every human workday by mid-August, up from sparse usage at the start of the year. The median tracked researcher now spends >$600/day on inference at API pricing; the 90th percentile exceeds $7,000/day. OpenAI claims it has met its own "automated research intern" milestone — a supervised system that takes a bounded objective, works across code and experiments, and returns results for human evaluation — explicitly not an autonomous scientist choosing its own agenda. OpenAI's own caveat is the useful part: agent runtime is not valuable output, and they say they're still learning how to measure it. Note the counter-reading circulating alongside it — that agents are producing more work (more code, more experiments, more review load) rather than less. Two things to take from this: the cost-per-engineer number is a real planning input, and the review bottleneck moves downstream the moment agents land. Instrument merge latency and review queue depth before you scale agent adoption, or you'll mistake a throughput problem for a capacity problem. (OpenAI | Simon Willison | The New Stack | HN discussion)

  • Databricks published the Big Book of AgentOps — architecture, evaluation, governance and cost for agents in production (Sep 2) Agents Data — A vendor playbook, but a substantive one: architecture patterns, a phased delivery pipeline, evaluation and feedback loops, governance, cost management, and the stakeholder decisions that determine whether an agent ships. It lands against the recurring finding that ~80% of agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ initiatives stall at pilot and that only a small minority of enterprises have data foundations ready for agents. Worth an hour from whoever owns your agent platform, mainly for the evaluation and cost-attribution sections — the two places internal agent projects most often lack any plan at all. Read the vendor-specific parts with the usual discount. (Databricks | StartupHub)

Policy & Safety

  • NYT investigation: blacklisted Inspur kept buying Nvidia's best chips through a California subsidiary that was never sanctioned (Sep 6) Infra — The Times reviewed thousands of shipping records, corporate documents and supply contracts, and reported from China, Southeast Asia and California. The finding: Aivres, a California server maker, exported at least $5.6B of advanced technology to Southeast Asia between April 2024 and February 2026, including >$3B of Blackwell-equipped systems, ultimately serving Chinese customers including ByteDance and Alibaba. Aivres is Inspur Group's US subsidiary; Inspur was added to the Entity List in 2023, Aivres never was — the California operation was renamed and continued from the same offices with the same workforce. Why this belongs in an engineering digest: it is the concrete mechanism behind the "Southeast Asia loophole" that is about to be on the table at the US–China AI summit. If tightened, the near-term effect is on regional GPU capacity and pricing in APAC — relevant to anyone planning inference footprints outside the US, and to anyone whose neocloud vendor is vague about where its capacity physically sits. (Asia Times summary | InsideAI)

Benchmarks & Evals

  • GPT-6 Astra took #1 on Code Arena: WebDev at 1,797 — 35 points clear of Claude Fable 5.1, at matching $40/Mtoken pricing (Sep 5) — Astra (Max) scored 1,797, ahead of Fable 5.1 (Max) at 1,762 and Opus 5 (Max) at 1,688, across a leaderboard with 650,000+ votes and 126 models. It also ranks #1 in Data & Analytics, Consumer Product and Content Creation Tools, and #2 in Gaming & Simulations. Arena framed it as reshaping the Pareto frontier: best-performing model at a price point Anthropic already occupies. Read this narrowly. Code Arena WebDev is crowdsourced pairwise preference on building a live web app from scratch — it rewards greenfield generation and visible polish. It says close to nothing about multi-file refactors in a large existing repo, where Terminal-Bench 3.0 still shows Opus 5 well ahead (42.7% vs Astra-generation models in the mid-30s). Two benchmarks, two different jobs; pick the one that matches yours before you re-route traffic. (Arena leaderboard | Arena announcement | Crypto Briefing)
  • DeepSeek Harness (dsh) added ~191,000 stars in a month — 62,000+ in one week Open Source Agents — DeepSeek's open-source agent harness, built on an everything-is-a-plugin architecture over Cordis, now sits at 14,000+ commits and 23,000 forks. It is part of a broader shift on GitHub Trending that's been building since August: the models have moved to the background and the machinery around them is what's trending — harnesses, skills, memory layers, gateways and document tooling. Also worth a look in the same vein: Bumblebee, Perplexity's open-source supply-chain scanner, which covers npm, PyPI, Go modules, RubyGems, Composer, MCP servers, editor extensions and browser extensions — directly relevant to this week's MCP security items. (OSS Insight trending | Analytics Vidhya monthly roundup)

Type to search · ↑↓ to move · enter to open