JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Wednesday, September 9, 2026

14 stories

TLDR

  • OpenAI says ~10,000 coordinated agents working 88 hours produced a proof of the Navier–Stokes Millennium Prize problem — and immediately landed in a credit dispute with the NYU/Anthropic researchers it says it heard a rumor about (Sep 8) Trending Agents
  • NSA, CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ and FBI named six Chinese AI companies in a joint advisory alleging industrial-scale distillationTraining a smaller model to copy a larger model's outputs, so it is cheaper to run.Hinton et al. 2015 ↗ against Claude, GPT, Gemini and Grok since late 2024 (Sep 8) Security Policy
  • Unit 42 documented an intrusion where AI agents ran 50+ MITRE ATT&CK techniques and took root credentials in under 10 hours — no zero-dayAn attack using a flaw that was unknown before it was exploited.NIST ↗, just speed (Sep 2) Security Agents
  • Meta shipped Muse to US adults — the consumer launch of the agent that misbehaved in internal testing two weeks ago, now with a secure VM and mandatory approval on sensitive actions (Sep 8) Agents
  • Google committed €13B to Finnish AI data centers and signed a 22-year nuclear PPA at Loviisa — its first nuclear contract outside the US (Sep 9) Infra

Action Items

Things your engineering team should look at or do this week.

  • Force Chrome 153 across the fleet. CVE-2026-87491 is an actively exploited V8 out-of-bounds write and the seventh exploited Chrome zero-day of 2026. Anyone running agent browser automation on a pinned Chrome/Chromium build needs to check the pin.
  • Read the Unit 42 report against your own CI/CD blast radius. The agents triggered unauthorized builds and pulled cloud AI master keys. Ask specifically: can a compromised developer identity kick a pipeline, and what does that pipeline's service account reach?
  • Decide your org's position on Meta Muse before someone connects Google Workspace to it. It's live, free-tier, and connects to Workspace, Stripe Link checkout and Apple Health from a personal account. This is a shadow-IT question this week, not next quarter.
  • If you expose a model API, read AA26-251A's mitigation section. It's the first government document that treats output-volume monitoring and distillation detection as a baseline control rather than a research topic.

Models & Tools

  • Meta launched Muse — a personal agent in its own VM, with mandatory approval gates on email and payments (Sep 8) Agents Customer AI — Rolling out to US adults via muse.ai, iOS/Android, and WhatsApp, with AI glasses "soon." It schedules, drafts and sends email, books travel, fills forms, compares prices and buys things through Stripe Link, connecting to Google Workspace, Ticketmaster, OpenTable, Spotify and Apple Health. Runs on Muse Spark 1.3 inside Muse Secure VM — a dedicated virtual machine holding both the agent and the user's data, with its own browser. Free tier plus $20/mo Power and $100/mo Maximum. This is the same agent that surfaced in reporting on Sep 7–8 as "Hatch," the one that changed a password on a health site and moved Chase Travel points during internal testing. The shipped architecture is a direct answer to that failure record: per-app permissions the user can revoke, and a hard confirmation gate on sending email or completing a purchase. Whether the gate holds under prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ is the open question, and Reuters reported internal concern about sensitive-data handling right up to launch. The design worth stealing regardless: isolate the agent and its data in one VM boundary, and put irreversible actions behind an out-of-model confirmation. (Meta | TechCrunch | SiliconANGLE)

  • DeepSeek opened a two-day beta of V4.1 Flash — natively multimodal, new architecture, offline tomorrow (Sep 9) Open Source — No application needed: swap the model name to deepseek-v4.1-flash-expires-on-0910, same base URL, same pricing as V4 Flash, 20 concurrent requests per account. It goes offline September 10. DeepSeek explicitly declines to call this a product release. The architectural claim is the point: unlike V4-Flash-Vision-Exp (Aug 21), which bolted a vision pack onto a text model, V4.1 Flash handles text, image and speech in a unified architecture. Developer benchmarks report 300+ tok/s, peaking above 500. If you have a multimodal eval harness, running it today is nearly free information about what DeepSeek's next production model will do to inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ pricing. Tomorrow it's gone. (TechNode | Pandaily)

  • DeepMind released AlphaGenome Atlas — 1 petabyte of precomputed predictions for all 9 billion possible single-letter human DNA changes (Sep 8) Data — Every position in the ~3B-base genome has three possible substitutions; the Atlas covers all of them, plus 100M+ observed short indels, with thousands of molecular-effect predictions per variant across hundreds of human and mouse cell types. Ships with the AlphaGenome Variant Impact (AVI) score, which condenses AlphaGenome and AlphaMissense into one number. Free for noncommercial research via web portal, API, and as a skill in Google Antigravity; commercial licensing separate. The pattern is what matters outside genomics: rather than serving a model and making everyone pay inference to ask the same questions, DeepMind precomputed the entire input space and shipped it as a queryable dataset. When your input domain is finite and enumerable, that's often the cheaper architecture — and it turns a model into infrastructure other people can build on without your GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗. (DeepMind | Nature | IEEE Spectrum)

  • JD Cloud says it will build a 100,000-GPU cluster on Moore Threads silicon — the first at that scale on domestic Chinese GPUs (Sep 9) Infra — Announced at JD's Global Technology Explorers Conference; targets large-model training, inference and embodied AI, with capacity resold across industries. Moore Threads has previously deployed KUAE 10,000-card clusters at ~10 ExaFLOPS. No completion date, no full-cluster benchmark, no operating deployment disclosed — treat this as an announcement, not a system. The interesting engineering question is whether the domestic stack survives the 10x jump: at 100k accelerators, the binding constraints are interconnect, checkpoint reliability, memory bandwidth and power, not per-chip FLOPS. That's where CUDA's ecosystem advantage actually lives. (TechNode | Global Times)

APIs & Pricing

  • OpenAI is pitching outcome-based pricing and vertical AI, and says an 80% price cut on Luna produced 10x usage (reported Sep 8–9) Pricing Infra — CFO Sarah Friar, speaking at Goldman Sachs Communacopia, said OpenAI is pushing into chip design, life sciences and financial services, and is selling businesses on outcomes rather than raw tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ consumption. Two concrete numbers: enterprise revenue grew 32% from June to July against ~20% growth in overall annualized revenue, and enterprise and consumer revenue have reached parity. On the cost side, OpenAI used its own models to design Jalapeño, the Broadcom-co-developed inference ASIC, reaching tape-out in under nine months, with early samples showing ~50% cost savings versus typical AI GPUs and initial deployment targeted for end of 2026. Two things to take from this. First, the Luna elasticity number is the clearest public evidence yet that inference demand at your company is probably price-gated, not need-gated — worth re-running the build/buy math on anything you shelved as too expensive six months ago. Second, "outcome-based pricing" from a frontier lab means contract terms are about to get much harder to compare across vendors. (Reuters via Investing.com | Yahoo Finance)

Security

  • NSA, CISA and FBI jointly named DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI for "industrial-scale" distillation of US frontier models (Sep 8) Policy Trending — Advisory AA26-251A alleges campaigns running since at least late 2024 that extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok, and states these campaigns "form the core—not merely a supplement" of the named companies' development strategy. The agencies distinguish legitimate distillation research from what they call aggressive, malicious and targeted extraction of restricted proprietary capabilities. Pointedly, the advisory says DeepSeek's widely cited $5.6M training cost excludes data acquired through this activity. Two practical consequences. If you serve a model API, output-volume anomaly detection and ToS enforcement just became something a regulator may ask you about. If you use one of the named models — several are common open-weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ choices — expect procurement and legal to start asking questions this quarter that have nothing to do with benchmark scores. Note this is an allegation in a government advisory, not an adjudicated finding. (CISA AA26-251A | Engadget | The Next Web)

  • Unit 42: AI agents compressed a full enterprise intrusion into under 10 hours, using no zero-day (Sep 2) Agents — Palo Alto's Unit 42 investigated an intrusion where the operator directed frontier models plus attack-specific agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ frameworks to monitor, evaluate, act and re-plan in a live loop. The agents executed 50+ distinct MITRE ATT&CK techniques, mapped internal architecture, raided source repositories, seized root credentials, triggered unauthorized CI/CD builds, and took master keys to the victim's cloud AI infrastructure. Unit 42 estimates the equivalent manual campaign at roughly two weeks. The agents also generated an 80-page technical report of their own findings. The finding to internalize: none of the tradecraft was novel. The entire delta was orchestration speed. That breaks a defensive assumption most SOC runbooks are built on — that dwell time between initial access and credential theft gives humans a window to detect and respond. If that window is now measured in hours, detection tuned for daily review is decorative. Concrete follow-up: check whether pipeline-trigger events and cloud key issuance are on your real-time alert path or your weekly report. (Unit 42 | eSecurity Planet)

  • Chrome 153 patches CVE-2026-87491 — the seventh actively exploited Chrome zero-day of 2026 (Sep 8–9) Production — An out-of-bounds write in V8, exploited in the wild, one of 230 bugs fixed in the release. Reported by Jihyeon Jeong of Compsec Lab, Seoul National University. Rolling out as 153.0.8010.36/.37 on Windows and macOS, 153.0.8010.36 on Linux. This lands five days after CVE-2026-85046, also an exploited V8 bug, patched Sep 4. Two V8 zero-days in one week is the operational story, not either CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗. For most teams this is a fleet-update ticket; for anyone running headless Chrome or Chromium-based agent browsers against untrusted pages, it's a pinned-version audit, because your automation is executing attacker-controlled JavaScript by design. (SecurityWeek | BleepingComputer | Help Net Security)

Industry & Business

  • Google is putting €13B into Finnish AI infrastructure and signed a 22-year nuclear PPA — its first outside the US (Sep 9) Infra — At least €13B (~$15.1B) across 2027–2028 in Hamina, Muhos, Vaala and Kajaani, which Google calls its largest single European investment ever. The energy side is the notable half: a 22-year life-extension agreement with Fortum for up to half the output of the Loviisa nuclear plant, covering 2030–2049. Loviisa supplies roughly 10% of Finland's electricity and, per the reporting, would not have operated past 2030 without the deal. Google also added onshore wind PPAs with Valorem and Suomen Hyötytuuli, bringing contracted new-to-grid Finnish wind to 629 MW, plus €31M in community programs. A hyperscaler just underwrote the continued existence of a national power plant to get compute sited. That is a different category of commitment than a lease, and it's the clearest signal yet that European capacity planning is now electricity-first. If you need EU-resident inference in 2028, this is where a meaningful share of it will physically be. (Google | World Nuclear News)

  • Cognition raised $2B+ at $48B — nearly double its May valuation, on run-rate revenue up from $492M to ~$900M (Sep 8) Trending — Andreessen Horowitz and Accel led, with Founders Fund, General Catalyst, Avenir, Benchmark, Bessemer, Kleiner Perkins, Greylock, Lightspeed, T. Rowe Price, Lux and Nvidia participating. The May Series D was $1B+ at $26B. Cognition names Nvidia (chip design), GE Aerospace, Citi, Mercedes-Benz and Modal as Devin customers. The number under the number: Cognition reportedly leases an Nvidia cluster costing hundreds of millions annually and is building its own models partly to escape third-party inference costs. At ~53x run-rate revenue with a compute bill that scales with usage, the bet is that autonomous SWE is a durable multi-vendor market rather than a thin layer over someone else's model. For a team lead the useful signal isn't the valuation — it's that revenue nearly doubled in four months, which means enterprise adoption of autonomous coding agents is real and your competitors are probably running one. (Cognition | PYMNTS)

  • Harvey raised $550M at $15.6B and acquired agent-security startup Guardrails AI — its fourth acquisition of 2026 (Sep 9) Agents — Co-led by Lightspeed and Diffusion, with Sapphire Ventures and Whale Rock joining; total raised now past $1.5B. ARR has crossed $400M across 3,000+ organizations, up from ~1,300 customers at an $11B valuation in March. Customers include Latham & Watkins and Microsoft's in-house legal team. Guardrails AI co-founders Shreya Rajpal and Zayd Simjee join Harvey's product and engineering org, working on evaluation and guardrails for agent behavior. The acquisition is the part worth noting. A vertical AI company at $400M ARR decided that specifying, simulating and evaluating agent behavior was important enough to buy rather than build — which is a reasonable read on where the hard problems are once agents start taking actions in regulated workflows. Harvey is also post-training its own open-weight legal model and published Harvey LAB, a legal-agent benchmark. (Bloomberg | The Next Web)

  • China's CSRC is quietly raising the bar for humanoid-robot IPOs after Unitree round-tripped (reported Sep 9) Robotics/IoT — Per The Information, the securities regulator gave banks informal "window guidance": humanoid applicants now need to show recurring revenue and a credible path to narrower losses, or genuine innovation, before registration. The trigger is Unitree — listed on the STAR Market in August, popped more than 5x on debut, and has since fallen ~45% from those highs. More than 400 Chinese humanoid models are in development and Chinese firms shipped the large majority of global units in H1 2026. Reuters could not independently verify the guidance and the CSRC has not commented. This doesn't slow the factories, but it changes the exit math for the private capital that has been funding physical-AI hardware on the assumption of a friendly public market. Watch it as a leading indicator for robotics component pricing over the next few quarters. (The Information | CNBC on the Unitree debut)

AI in Production

  • OpenAI ran ~10,000 concurrent agents for 88 hours against Navier–Stokes, published a Lean-verified proof, and started a fight about credit (Sep 8) Agents Trending — OpenAI says an internal system "significantly more capable than GPT-6 Astra" produced an analytical proof that a 3D fluid governed by the Navier–Stokes equations can develop a finite-time singularity — a vortex tightening and spinning ever faster while total energy stays bounded. A formalized Lean proof accompanies the announcement. Independent mathematicians have not yet validated it. The attribution dispute: OpenAI says the effort began Sep 1 after hearing a rumor it later connected to NYU's Tristan Buckmaster and Anthropic's Levent Alpöge; after completing the proof and Lean verification on Sep 6, it contacted them to offer a joint announcement and learned their work addressed the forced Euler equations, a related but distinct problem. Buckmaster has questioned whether OpenAI accelerated after learning of their progress; OpenAI denies improper access. Set the math and the dispute aside — the production fact is the orchestration. Ten thousand agents coordinating for 88 hours on one objective is a scheduling, deduplication, and result-merging problem before it is a reasoning problem, and OpenAI has published very little about how the swarm avoided redundant work or how partial results were verified and combined. The verification story is the transferable part: the reason this claim is even discussable is that the output was formalized in Lean. Machine-checkable output is what makes large-scale agent work auditable, and it's the pattern to reach for whenever your domain has a formal checker — type systems, property tests, schema validators, proof assistants. Where you have no checker, a 10,000-agent swarm produces 10,000 unverifiable assertions. (OpenAI | Quanta | Nature | Scientific American on the controversy | Axios)

Policy & Safety

  • A 2026 Fields Medalist launched a mathematics institute for AI safety — hiring 10–30 mathematicians for a January 2027 cohort (Sep 8) Trending — Jacob Tsimerman, who won the Fields Medal this year and is joining OpenAI's research team, is founding the Mathematical AI Safety Institute (MAISI) with Andrew Critch as Executive Director; Stanford's Ravi Vakil is on the advisory panel. The model is Princeton's IAS rather than a lab: semester-long structured residencies in the Bay Area, first cohort January 2027, scaling to a 30–100 researcher "special year" in September 2027. The stated goal is "definitions, measurements, and solution concepts" — foundational work on what would justify confidence that a system won't cause a catastrophe. Worth flagging for an engineering audience because the gap MAISI is aiming at is the same one you hit in evals: we have no accepted formal definition of "this agent is safe to give write access," only benchmarks that correlate with it. Progress on definitions eventually shows up as things you can actually test in CI. (MAISI | The Hill)

Coming Up

  • DeepSeek V4.1 Flash beta goes offline — Sep 10 (tomorrow).
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30.
  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor model.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.

Type to search · ↑↓ to move · enter to open