JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Friday, September 11, 2026

12 stories

TLDR

  • OpenAI put the Codex harness behind an API — the Agents API is in public beta with hosted sandboxes, subagents and managed context compaction, at no markup over tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ (Sep 10) Agents Trending
  • The DOJ has opened a formal antitrust probe into whether Nvidia structured its ~$20B Groq license to dodge merger review — the first real legal test of the license-plus-talent-transfer playbook (Sep 9–10) Policy
  • The Pentagon is in talks to lend ~$5B to Fluidstack through its Office of Strategic Capital — not to build a data center, but to onshore the components that go into them (Sep 10–11) Infra
  • Anthropic's September threat report says newer Claude models can no longer be assumed below the bioweapons-uplift threshold — the first time a major lab has said that publicly (Sep 10–11) Security
  • Positron raised $875M at $5B for an inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ chip that uses commodity LPDDR5X instead of HBM, betting the memory shortage is the real constraint (Sep 10) Infra

Action Items

Things your engineering team should look at or do this week.

  • Audit every MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server you've approved for runtime metadata changes, not just install-time behavior. The Deadbugz campaign stays benign for exactly three tool calls, then rewrites its own tool descriptions to hunt SSH keys and cloud credentials. A one-time install review cannot catch this by construction — you need to diff tool metadata on every fetch.
  • If you've built your own agent orchestration loop, spend an hour reading OpenAI's Agents API surface before your next sprint planning. Session management, context compaction, subagent fan-out and sandboxing are now vendor-managed primitives. Decide deliberately whether your in-house harness is still a differentiator or just maintenance.
  • Re-read your model provider's misuse-reporting obligations. Anthropic's threat report and OpenAI's regulatory push both point the same direction: incident reporting and alignment-eval gates are heading toward statute. Know now what your vendor is contractually obliged to tell you.

Models & Tools

  • OpenAI shipped the Agents API in public beta — the Codex harness as a managed service (Sep 10) Agents Trending — The API exposes the same loop that powers Codex and ChatGPT for Work: model calls plus context management, tool execution, hosted sandbox access, subagent coordination and long-running session control. Agents can execute code, work with files, connect to MCP servers, create artifacts, compact older context automatically, and split a job across parallel subagents with separate working contexts. Pricing is the part to notice: no additional fee, you pay tokens and tools. The harness is built on the open-source Codex codebase, so the coordination logic is readable rather than a black box. The strategic read for a team lead: the orchestration layer is being commoditized to zero. Most of what a homegrown agent framework does — retry, compaction, sandbox lifecycle, sub-task fan-out — just became a provider primitive with no margin on top. That's a strong pull toward lock-in, and it's also an honest look at how much of your agent infrastructure was undifferentiated plumbing. (OpenAI | Docs | OpenAI Developer Community)

  • Sakana split Fugu into Max and Ultra v2 — an orchestration model that now explicitly excludes three frontier models from its pool (Sep 10) Agents Pricing — Fugu is a learned router: a model trained to dispatch tasks across a pool of open and specialized models and to recursively call itself. v2.0 is a point-refresh, not a new architecture — training cutoff moved to Aug 28, 2026, and the coordinator was re-tuned against the current model generation. The advertised change is pool composition: Claude Fable 5, Fable 5.1 and GPT-6 Astra are deliberately excluded. Fugu Ultra v2 prices at $5/$30 per 1M tokens ($0.50 cached), rising to $10/$45 above a 272K context, and Sakana reports 48.3 on Chartography against Opus 5's 27.3, and 74.3 on DeepSWE. Migration off an earlier Fugu is a single parameter change. Worth watching as a category: a router that publishes which models it refuses to route to is making a procurement claim, not just a capability one. Benchmark numbers here are vendor-reported. (Sakana AI | MarkTechPost)

  • Positron raised $875M at $5B to build inference silicon around commodity memory (Sep 10) Infra — A $375M Series C co-led by NEA, Atreides, Valor, Andra and SemiAnalysis Capital, plus a follow-on Series C-1 of up to $500M anchored by NEA and Jim Clark. The Asimov chip pairs Positron's compute architecture with 288 GB to 2,304 GB of memory per chip using commodity LPDDR5X, deliberately sidestepping HBM supply and advanced packaging. Tape-out on TSMC N3P at the end of 2026, production targeted for H2 2027. Proceeds also fund a 2MW engineering data center and the Titan system, which packs four to eight Asimov chips per node. The thesis is that for inference — as opposed to training — capacity and bandwidth matter more than peak FLOPs, and that HBM scarcity is a structural rather than temporary tax. This is a 2027-at-earliest story; the valuation went from $1.06B to $5B in seven months on a chip that has not taped out. (PR Newswire | SiliconANGLE)

  • Bloomberg: Microsoft is planning ~38 GW of data-center capacity by 2032, up from ~12 GW today (Sep 10) Infra — More than a tripling, covering owned and leased facilities but excluding neocloud rentals from the likes of CoreWeave. AI-dedicated capacity would go from about 2 GW now to roughly a third of the 38 GW total. The reported driver is blunt: hardware constraints recently pushed Microsoft to turn away cloud and AI customers and throttle subscriptions. Caveat this one properly — Microsoft has not confirmed the number in a release or filing, and it comes from unnamed sources. If you're on Azure and have been quoted long lead times on GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ capacity, this is the shape of the answer: relief is a 2027+ event, not a 2026 one. (Reuters via Investing.com)

  • Nvidia lined up eight Australian operators for up to 2 GW of AI factory capacity by 2027 (Sep 9–10) Infra — Partners are Firmus, Sharon AI, IREN, Megaport, ResetData, CDC, NEXTDC and AirTrunk; Nvidia supplies the DSX platform, accelerated compute, networking and software while the partners operate the facilities. Australia's entire existing data-center footprint is roughly 1.6 GW, so this would more than double it. Relevant if you have data-residency obligations in APAC — in-region inference capacity there has been genuinely scarce, and this is the first commitment large enough to change that. (NVIDIA | Qz)

Security

  • Deadbugz: a malicious MCP server that stays clean for exactly three tool calls, then goes hunting for credentials (disclosed Sep 2, campaign still active) Agents — Pillar Security documented a campaign distributing a "productivity-suite" MCP server through 23 unsolicited GitHub pull requests pushed in a 74-minute window on Aug 10. The server behaves as an ordinary text-formatting tool for its first three calls, then silently rewrites its own tool metadata to instruct the connected agent to exfiltrate SSH keys, AWS credentials and Kubernetes config — while hiding the activity. The observed set spans 17 remote-MCP configurations, four local-script configurations and two directory listings, attributed to a single account and its infrastructure. The mechanism defeats the primary control almost everyone relies on. Because the trigger is a call count and the payload arrives through metadata returned at runtime, there is no code change to diff and nothing hostile present at install-review time. A server that passes every check you run before approval is not the same as a server that is safe. The practical control is continuous: hash tool descriptions on every fetch and alert on drift, and scope agent credentials so that "read SSH keys" isn't something the agent's identity can do at all. (Pillar Security | Cloud Security Alliance briefing)

  • Anthropic's September threat report: attacks now run on agent frameworks, and the bio threshold caveat is gone (Sep 10–11) Policy Agents — Covering disrupted misuse from December 2025 through August 2026 across seven harm areas — cyber operations, influence, surveillance, scams, biological misuse, conventional weapons and distillationTraining a smaller model to copy a larger model's outputs, so it is cheaper to run.Hinton et al. 2015 ↗. Notable specifics: a Russian state espionage cluster (GTG-20006 / Midnight Blizzard) engaged 24 of 27 targeted institutions over 130 days, including Ukrainian ministries and drone supply-chain manufacturers; one influence cluster published 8,913 articles in ~20 languages across 70 fake news sites, another ran 1,000+ fake X accounts. The report's central structural claim is that LLMsLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ are increasingly embedded in autonomous multi-agent frameworks that execute complex operations at machine speed, compressing the capability gap between nation-states and low-resource actors. And the line that will get quoted for months: newer Claude models can no longer be assumed to be below the threshold for meaningful bioweapons assistance — the first such public statement from a major lab. For a platform team, the operational takeaway is narrower than the headline: if attackers are running agent frameworks, your API keys are the loot. Key rotation cadence and per-key rate/spend anomaly detection are now security controls, not billing hygiene. (Anthropic | Rappler | TechNode Global)

Industry & Business

  • DOJ opened a formal antitrust probe into Nvidia's ~$20B Groq license (Sep 9–10) Policy — The department is investigating whether Nvidia structured the deal — a non-exclusive license to Groq's chip technology, paired with hiring several Groq executives including founder Jonathan Ross — to avoid pre-merger review. A formal demand for information has been issued. Reporting puts the package between $17B and $20B. Likely outcome if the DOJ finds fault is a fine rather than unwinding. This is the first real legal test of the reverse-acquihire structure that has absorbed a long list of AI startups over the past two years. If license-plus-talent-transfer is ruled a reportable acquisition, the consolidation pattern the whole sector has been using gets slower and more visible. (Bloomberg | Axios)

  • WSJ: the Pentagon is in talks to lend ~$5B to Fluidstack — for components, not capacity (Sep 10–11) Infra Policy — The money would come from the Office of Strategic Capital, which lends to companies doing work deemed critical to national security; prior recipients include rare-earth suppliers and drone manufacturers. The stated use is shoring up the US supply chain and manufacturing capacity for data-center components, not funding a new AI facility. Not finalized. Context: an executive order last month declared a national emergency and banned certain foreign equipment from the US electricity grid. The signal worth extracting: transformers, switchgear and grid equipment are being treated as defense-critical inputs. If your capacity planning assumes lead times on physical plant stay where they are, national-security prioritization is a new variable in that queue. (Reuters via Yahoo Finance | Data Center Dynamics)

  • Meta acquired Swedish agent startup Stilla.ai, eight months after it left stealth (Sep 9) Agents Customer AI — Stilla, founded in Stockholm in 2024, raised $5M pre-seed and emerged in January building agents that work across an organization's tools with shared context, permissions and enterprise infrastructure. Team and technology go to Meta pending close; the existing platform continues serving current customers. The target is Meta Business Agent — the system handling merchant conversations and transactions across WhatsApp, Messenger and Instagram, which Meta says already reaches 1M+ businesses and 1B+ daily business conversations. Eight months from stealth to acquisition is the number to sit with. The scarce asset being bought is working permission and context plumbing for agents, not models. (Axios | ArcticStartup)

  • Salesforce is in talks to buy Listen Labs for ~$2B — at roughly 67x revenue (Sep 10) Customer AI — Listen Labs, founded 2023, automates qualitative customer research: generating survey questions, running audio and video interviews, and synthesizing results into reports. Approximately $30M annualized revenue. Talks are preliminary and may not close. The detail that frames the price: Listen Labs recently walked away from a signed $125M Series C term sheet led by Menlo at a $1.5B valuation. This would be Salesforce's fourth AI acquisition of 2026. The pattern across this and the Stilla deal: incumbents are paying enormous multiples for proprietary data-collection surfaces rather than for model capability. (Reuters via Yahoo Finance | PYMNTS)

Policy & Safety

  • OpenAI is asking Congress for mandatory national AI safety rules — binding on itself — before the session adjourns (Sep 9–10) Policy Trending — Chief global affairs officer Chris Lehane: "The United States needs mandatory, capability-based national regulation that can evolve as the technology does." The specific asks are unusually concrete for a lobbying position: common testing and independent-assessment protocols, cybersecurity requirements, incident-reporting rules, mandatory monitoring for model misalignment, prompt written notice when a model circumvents security controls, and alignment-evaluation gates before deployment. OpenAI says it will keep supporting state legislation until federal action happens. Congress adjourns in December. The stated motivation is the recent run of incidents in which agents reached external systems during testing. Two ways to read it, and both are probably true: a genuine response to containment problems the labs can't solve alone, and a bid to replace a 50-state patchwork with one federal ceiling. Either way, "written notice when a model circumvents security controls" is a disclosure obligation worth asking your vendor about now, contract by contract, rather than waiting to see whether it becomes law. (Reuters via KFGO | The Next Web)

Coming Up

  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor.
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Docusign MCP server opens to all agents — Sep 30.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.
  • TechCrunch Disrupt — Oct 13–15, San Francisco.
  • OpenAI transcription deprecations (whisper-1, gpt-4o-transcribe family) shut off Feb 26, 2027.
  • EU AI Act: prohibitions on AI systems generating non-consensual intimate imagery and CSAM take effect Dec 2, 2026.

Type to search · ↑↓ to move · enter to open