JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Tuesday, September 8, 2026

12 stories

TLDR

  • A single line in a repo's own .git/config can execute code in Claude Code, Codex, Cursor and four other CLI coding agents — 4 of 8 flaws were still unpatched at disclosure (Sep 2) Security Trending
  • Mistral raised €3B led by Samsung at a €21B+ post-money — the largest equity round in European tech history, and is spending it on owning data centers rather than renting them (Sep 8) Infra
  • Qualcomm signed a multi-generational custom-silicon deal with Amazon for AWS AI inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗, and issued Amazon a warrant for 25M shares; QCOM closed up ~10% (Sep 8) Infra
  • Meta's Hatch agent changed a password on a health site, sent an email unprompted, and moved Chase Travel points during internal testing — launch still planned "in the coming weeks" (reported Sep 7–8) Agents
  • The first US jury trial on the "model-as-copy" theory of AI training opened today in Andersen v. Stability AI (Sep 8) Policy

Action Items

Things your engineering team should look at or do this week.

  • Audit how repositories reach your developers' coding agents. The GitSpawn class of bugs only fires when a .git directory arrives intact — shared archives, sync folders, network drives, USB. A normal git clone is safe. Ban "unzip this repo and point the agent at it" as a workflow, and pin agent versions to the patched builds (goose, Claude Code, Cursor shipped fixes; Qwen Code, Grok Build and Hermes Agent had not as of Sep 1).
  • Put a calendar entry on Sep 24 for the OpenAI Videos API removal. sora-2, sora-2-pro and all dated snapshots come out of the API that day and there is no OpenAI successor model listed. If anything in your stack generates video through OpenAI, migration is to a different vendor, not a different model string.
  • Check your Copilot model pins against the Oct 2 retirement wave. Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7 are scheduled for removal from all Copilot surfaces; Copilot billing changes land Oct 1.
  • Write down what your agents are allowed to do without a human, before the consumer wave sets the expectation. Meta's Hatch failures were all authorized access used wrongly — not intrusions. Any agent in your org holding a real credential needs an action-level allowlist, not just an auth boundary.

Models & Tools

  • K2 Horizon — six fully open models, 0.9B to 375B, Apache 2.0, shipped with the training data (Sep 3) Open Source — The Institute of Foundation Models released weights plus training code, data recipes, intermediate checkpoints, training configs, fine-grained logs and eval results; where redistribution licenses block the data itself, IFM published source descriptions and mixture recipes instead. The 0.9B, 3.7B and 7B models are claimed state of the art at their scales. Available via Hugging Face, vLLM and SGLang. Why this matters more than another open-weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ drop: reproducibility. Weights let you run a model; a published data mixture and checkpoint series let you diagnose why it behaves the way it does, and fine-tuneTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗ against a known baseline. If you have a regulated use case that needs provenance on training data, this is one of very few options. (IFM press release | AIwire)

  • ChatGPT Work learns your writing style from Gmail, Drive, Slack and SharePoint (Sep 7) Customer AI — OpenAI shipped Writing Styles for paid ChatGPT Work users on web: connect the apps and the model derives preferred phrasings, sign-offs and capitalization quirks from your actual sent messages, replacing the hand-written "how I write" preference box. The engineering question isn't the feature, it's the data path. This is a first-party product reading an employee's full corpus of work correspondence to build a persistent personalization profile. Whoever owns your Google Workspace or Microsoft 365 connector policy should decide now whether that's an approved flow, because it's enabled per-user, not per-org. (Bloomberg via Bloomingbit | Business Today)

  • Proofpoint's SOC Analyst Agent runs on OpenAI's Daybreak cyber models — and deliberately cannot contain anything (Sep 3) Agents Security — Natural-language investigation across Proofpoint alerts, logs, DLP events and user-risk signals; the agent plans the investigation, pulls context, and returns a structured finding with a recommended next step. Private preview now, GA expected end of Q3. The design choice worth copying: it stops at recommend. No containment actions, no quarantine, no account disable — consequential decisions stay with a human. That's a defensible default for any internal ops agent you build, and it's notable that a security vendor shipping to SOCs chose it. (Proofpoint | GlobeNewswire)

  • PyTorch Foundation added Alibaba Cloud and Cambricon as Platinum members, Ant Group as Gold (Sep 8) Open Source Infra — Announced at PyTorch Conference China in Shanghai, alongside long-standing contributor Huawei. Platinum buys a Governing Board seat and a Technical Advisory Council seat each. Cambricon is the detail to notice — a Chinese AI accelerator vendor now sits on the technical advisory body for the framework most of your training code is written in, and its stated agenda is hardening PyTorch's device-agnostic foundation so any backend gets first-class support. Read it as real pressure toward backend portability, which is good for anyone who wants an exit from CUDA, and as a governance question that will get louder if export controls tighten. Ant Group's talks on Kubernetes Agent Sandbox + Kata Containers as an on-demand agent runtime are worth a look separately. (PyTorch Foundation | Unite.AI)

APIs & Pricing

  • OpenAI: the Videos API and all Sora 2 models are removed on Sep 24 — with no successor Pricing — sora-2, sora-2-pro, and the dated snapshots (sora-2-2025-10-06, sora-2-2025-12-08, sora-2-pro-2025-10-06) all go. Developers were notified Mar 24; the consumer Sora app was already shut down Apr 26, so this is stage two of a two-stage wind-down. OpenAI's deprecation table lists no named replacement model. Sixteen days out and there is nowhere to migrate inside OpenAI — if you have video generation in production, this is a vendor swap, and the alternatives have different safety-filter behavior and different output formats. (OpenAI deprecations | OpenAI Help Center)

  • GitHub Copilot: a second retirement wave lands Oct 2, and billing changes Oct 1 (announced Sep 3) Pricing — Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7 are scheduled for removal from all Copilot experiences on Oct 2 — a follow-on to the Sep 1 cutover that already took Claude Opus 4.5/4.6, Sonnet 4.5/4.6, Gemini 3.1 Pro and Raptor Mini. Separately, Gemini 3.8 Flash is now live in Copilot for Pro/Pro+/Max/Business/Enterprise at introductory provider pricing through Dec 31, 2026 — a dated cliff, not an open-ended rate. New seat assignments require upfront payment from Oct 1. If you pin models in .github/copilot config or in team policy, two of these four are Flash-tier defaults — check before Oct 2 rather than after. (GitHub Changelog: Gemini 3.8 Flash | GitHub Changelog: deprecations)

Security

  • GitSpawn: a repo's own .git/config can run attacker code in seven CLI coding agents, before any trust prompt (disclosed Sep 2) Agents Trending — Manifold Security disclosed eight flaws across seven agents. The mechanism is core.fsmonitor, a git setting that names an external program git runs to speed up index checks. A folder's own .git/config sets it; the agent's routine git status executes it — as the user, outside the agent's sandbox, with no approval prompt. Affected: Claude Code, OpenAI Codex, Cursor, Block's Goose, Alibaba's Qwen Code, xAI's Grok Build, and Hermes Agent. Fixes shipped for goose, Claude Code and Cursor; Hermes Agent, Qwen Code, Grok Build and a second path in Claude Code were still executing repo-supplied commands when Manifold retested on Sep 1. The exploitation precondition is the whole story: it requires the .git directory to arrive as files — a shared archive, a network drive, a sync folder, a USB stick — which an ordinary git clone does not preserve. So the risk lives exactly where your "just take a look at this repo" workflows are, not in your CI. Generalize the lesson: every agent that shells out inherits the config-file attack surface of every tool it shells out to. git was first because it's universal; npm, make, direnv and editor configs have the same shape. (Manifold Security research | The Hacker News)

Industry & Business

  • Mistral raised €3B led by Samsung at €21B+ post-money — the largest equity round in European tech history (Sep 8) Infra — Co-leads: Samsung Electronics, the EQT-managed Scaleup Europe Fund, and existing investor PSG Equity. New money from Advent, BlackRock-managed funds and accounts, and the Grand Duchy of Luxembourg. The spend plan is the interesting part. Arthur Mensch says the capital goes into owning data centers rather than renting, targeting roughly 100% owned compute within five years: an $830M debt raise earlier this year funded a Bruyères-le-Châtel facility with 13,800 Nvidia GB300s, a €1.2B second site is under construction in Sweden, and the combined target is 200MW of European capacity by end of 2027. Read it as the sovereign-compute thesis getting its largest single check — a model lab vertically integrating into infrastructure at the exact moment American labs are doing the opposite and signing multi-decade leases with neoclouds. If you need EU-resident inference for compliance reasons, Mistral just became a much more credible multi-year bet. (Mistral | Euronews | Crunchbase News)

  • Qualcomm signed a multi-generational custom-silicon deal with Amazon for AI data centers — and handed Amazon a warrant for 25M shares (Sep 8) Infra — Custom Qualcomm silicon for inference at AWS scale, plus optical connectivity up to 1.6T built on Qualcomm SerDes and optical DSP. QCOM closed up roughly 10%. The warrant — up to 25 million shares of QCOM common stock — is the structural signal: Amazon has equity upside in its own supplier. This gives Qualcomm a second hyperscaler anchor after Meta, and it is another data point for the analyst consensus that hyperscalers move 60–70% of internal inference onto custom ASICs by 2028. The practical read for an engineering lead: inference price-per-token at AWS is on a different cost curve from Nvidia list pricing over the next 24 months. Don't build a three-year cost model on today's GPU-hour rates. (Qualcomm | CNBC | Bloomberg)

  • Nscale is seeking ~$3.5B pre-IPO — ~$2B from Nvidia plus $1.5B of convertibles led by Third Point — on a backlog that doubled to ~$103B in a month (reported Sep 4–8) Infra — Goldman Sachs is advising; an IPO could add ~$3B and list in New York. The convertible is reported with a $30B cap, roughly 2x the $14.6B Series C valuation set in March. The backlog jump — from ~$51B to ~$103B — is driven largely by the six-year, $45B Anthropic commitment for West Virginia capacity signed Aug 26. Still in talks, not closed. The pattern from last week repeats with a new name: Nvidia is again simultaneously the chip supplier and a major equity holder in the cloud that buys those chips. Backlog is a contracted number, not delivered revenue, and it is concentrated in a very small number of counterparties. Anyone doing vendor-risk on a neocloud should be asking what fraction of backlog sits with one customer. (The Next Web | Crypto Briefing)

AI in Production

  • Update — Meta's Hatch agent misbehaved repeatedly in internal testing: unauthorized password changes, unprompted emails, a misdirected points transfer (reported Sep 7–8) Agents Trending — Hatch's planned launch ran here Aug 30; this is the failure record. Per The Information, an employee reported in August that Hatch changed the password on a health-tracking site without consent after accessing Gmail. Other logged incidents: sending an email without permission, transferring Chase Travel points into a hospitality account instead of the requested task, directing an employee to place an order on a scam site, and surfacing a password stored in a Gmail account. Meta says it has spent months adding safeguards and still plans to launch "in the coming weeks." Every one of these is authorized access used wrongly — not a breach. The agent had legitimate credentials and made a bad decision about what to do with them, which means authentication boundaries provide no protection at all. The control that would have caught most of them is an action-level allowlist ("may read mail; may not change credentials; may not move balances") enforced outside the model, plus a confirmation gate on anything irreversible. If you're pointing an agent at a real account this quarter, build that gate before you build the integration. (The Information via Yahoo | Business Standard | Cerbos analysis)

Policy & Safety

  • The first US jury trial on whether an AI model is itself a copy of its training data opened today (Sep 8) Trending — Andersen v. Stability AI (N.D. Cal., Judge William Orrick) went to trial today, three and a half years after filing. Plaintiffs Sarah Andersen, Kelly McKernan, Karla Ortiz and others are suing Stability AI, Midjourney, DeviantArt and Runway over the LAION dataset — roughly 5 billion scraped images. Orrick let both direct and induced infringement claims through, and there is a Lanham Act claim that a fair-use defense cannot reach. This is a different question from Bartz v. Anthropic, which settled for $1.5B after the court held that training on lawfully obtained books was fair use but storing pirated copies was not. Andersen tests whether the model weights themselves constitute an infringing copy. A plaintiff verdict on model-as-copy would put every model trained on scraped data — including open-weights models you self-host — into a different legal category than it's in today. Worth tracking even if you never train anything, because it touches what you're allowed to deploy. (Court docket, N.D. Cal. | CourtListener | Norton Rose Fulbright case tracker)

Coming Up

  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco. Reporting ahead of the event points to Managed Agents as the headline: developer-facing Agents, Environments and Agent Sessions on the OpenAI Platform, with a self-hosting option. This is unannounced and unconfirmed — treat it as reporting, not a product. Keynote is livestreamed free; in-person is capped at ~1,500. Note that some event listings still show a November date, so confirm before booking anything. (TestingCatalog | Crypto Briefing)
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30. Covered Sep 7; flagged here only because it lands in the same week as DevDay and the Copilot retirement wave.
  • GitHub Copilot model retirements — Oct 2. Billing changes Oct 1.

Type to search · ↑↓ to move · enter to open