JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Saturday, September 12, 2026

21 stories

TLDR

  • GreyNoise documented hundreds of AI agents running a real intrusion campaign end to end — 440 PaperCut servers across 48 countries, and 11 organizations compromised in 26 seconds (Sep 9–11) Security Agents Trending
  • Bipartisan Senate negotiators are drafting a "duty of care" for frontier AI developers — with federal power to block an unsafe model's release (Sep 11) Policy
  • A stealth startup says Anthropic took ~50 days and ~30 releases to patch a Claude Code sandbox escapeBreaking out of a sandbox, the restricted environment that limits what untrusted code can reach.NIST ↗; Cursor and OpenAI shipped fixes in about a week (Sep 10–11) Security
  • Salesforce shipped seven named, prebuilt Agentforce agents on a new long-horizon runtime — and cited Anthropic's own support desk resolving 79% of conversations autonomously (Sep 11) Agents Customer AI
  • Cognition's SWE-2 lands within a point of Fable 5.1 on FrontierCode at 64% lower cost — post-trained on Moonshot's open Kimi K3, not a model of its own (Sep 10) Open Source

Action Items

Things your engineering team should look at or do this week.

  • If you run PaperCut NG/MF anywhere, patch CVE-2026-81578 and CVE-2026-82078 today and hunt GreyNoise's IOCs. The campaign went from empty workspace to first RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ against a real victim in under four hours. Also confirm you're patched for noPac (CVE-2021-42278 / CVE-2021-42287) — that unpatched pair was one of three paths to domain admin. PaperCut defaults to SYSTEM privileges on a domain-joined Windows host, which is why a print server turned into an AD compromise.
  • Check whether anything you ship uses Google Cloud ADK for Python 2.0.0–2.6.0. CVE-2026-79696 is CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 10.0, unauthenticated RCE, and only exploitable when pytest is importable — so the immediate mitigation is removing pytest from your production adk web image, not waiting on the upgrade.
  • Pin your coding-agent versions and re-read your sandbox assumptions. The whole vulnerability class is "agent writes a file, a trusted tool outside the sandbox runs it" — so the question isn't whether your agent is sandboxed, it's what reads the files it leaves behind. Cursor ≥3.0.0 and Codex CLI ≥0.95.0 carry known fixes; ask Anthropic which version closed Beltdown.
  • If you maintain internal Claude Code plugins or skills, wire claude plugin eval into CI this sprint. The no-plugin baseline is the useful part: it tells you whether a skill actually triggers and whether it beats a bare model, which is the thing nobody on your team can currently answer.

Models & Tools

  • Cognition shipped SWE-2, post-trained on Moonshot's Kimi K3 (Sep 10) Open Source — SWE-2 scores 50.0% on FrontierCode 1.1 Main against Fable 5.1's 50.9%, at 64% lower cost, plus 92.8% on Terminal-Bench 2.1 and 73.0% on DeepSWE 1.1. The base is Kimi K3, a 2.8T-parameter open model that had already been through heavy coding RLReinforcement learningTraining by trial and error, where the model takes actions and adjusts based on the rewards it gets.Kaelbling et al. 1996 ↗ before Cognition layered its own on top — the same play as SWE-1.7 on K2.7. The claimed novelty is a Pareto-frontier RL method that trains medium, high and max effort levels in a single run rather than as separate models. Cognition reports SWE-2 medium makes its first real edit after a median of 18 steps versus 48 for SWE-1.7. Rolling out across Devin Desktop, CLI, Web and Fusion. The pattern is the story: two of this week's most competitive coding models are Western startups doing RL on top of Chinese open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗. Benchmarks are vendor-reported. (Cognition | OfficeChai)
  • Anthropic added plugin evals to Claude Code — with a no-plugin baseline and a CI gate (Sep 11) Agents — claude plugin eval runs each plugin against realistic prompts twice, once loaded and once not, and reports the delta. Six grader types (regex, tool_used, tool_order, file_exists, LLM-judge, baseline) plus --threshold 0.8 and --max-cost-usd 20 for gating. Requires Claude Code v2.1.269 or later against any directory with a plugin.json manifest. Ships alongside a Smart Reports enterprise beta measuring team-level usage, cost and friction. This closes a real measurement gap — until now "does my skill actually fire?" was answered by vibes. The baseline comparison is the part worth adopting first: a skill that doesn't beat the bare model is maintenance burden pretending to be leverage. (Claude Code docs | MarkTechPost)
  • Salesforce shipped seven named Agentforce agents and a long-horizon runtime (Sep 11) Agents Customer AI — Casey (customer service across voice, SMS, WhatsApp, web chat), Paige (HR/IT), Carter (commerce with in-chat checkout), Marshall (supply chain), Piper (inbound leads), Fin (complex CX) are GA now; Hunter (outbound sales) is in pilot with GA planned for November. Customers can rename them. The technical pitch is a new runtime with persistent memory and durable execution — goals pursued over weeks rather than within a chat session. Salesforce claims 7 billion AgenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ Work Units delivered to date, 3.2B in Q2, and cites Fin autonomously resolving 79% of Anthropic's own support conversations, Hibbett covering 90% of core shopper journeys after a six-week go-live. The shift to watch is packaging: prebuilt role agents with a data model and actions attached, rather than a framework you assemble. Customer-reported percentages are marketing figures, not audited. (Salesforce | Futurum)
  • Agnes-AI released Agnes-3.0-Flash — 33B multimodal, Apache 2.0, fits on one H100 (Sep 11–12) Open Source — Open weights with a 262,144-token context and a hybrid-attention stack: 54 delta-rule recurrent layers plus 18 global-attention layers. Text, image and video understanding, adjustable reasoning effort, tool calling. Reported 85.05 on GPQA Diamond, 74.20 on IFBench, 68.33 on AA-LCR, Artificial Analysis intelligence score 36. The checkpoint fits on a single H200 or H100 at bf16 — that's the practical hook if you want a self-hosted multimodal model without a multi-GPU node. Benchmarks are vendor/third-party-reported and this is a new-ish lab, so treat the numbers as a reason to test rather than a conclusion. (Hugging Face | Artificial Analysis)
  • Cohere Labs posted North-Small-Translate-1.0, a 218B translation MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ (Sep 10) Open Source — 218B total / 25B active, 128 experts with 8 active per tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗, 50+ languages, 16K in/out context, CC BY-NC 4.0 (non-commercial self-hosting; commercial licensing available separately). Reports 83.60 on WMT26 all-languages and 84.36 with an agentic multi-pass workflow, against DeepL NextGen at 81.37 and Google Translate at 68.20. Built with RWS Language Weaver, free on the Cohere API. If you're paying per-character for translation, this is worth a bake-off — but read the license before planning around it. Scores are vendor-reported. (Hugging Face)
  • Ant International, Visa and Mastercard started aligning three competing agent-identity protocols (Sep 9–10) Agents Customer AI — The Know-Your-Agent (KYA) interoperability effort is meant to let card networks, wallets, agent platforms and marketplaces recognize a verified agent — and tie its activity back to an authorized person or business — across ecosystems rather than per-network. It merges the direction of Visa's Trusted Agent Protocol, Mastercard Verifiable Intent and Ant's Agentic Mobile Protocol; each network keeps its own verification while honoring common trust signals. What's missing is everything that makes a standard real: governance body, technical spec, timeline. Treat it as a signal that agent identity is consolidating, not as something to build against yet. (Ant International | PYMNTS)
  • Not released: Grok 4.7 slipped again, and Musk named the reason (Sep 11) Trending — xAI had targeted Sep 12 for the 2.1T-parameter model Musk unveiled Sep 2. He now says it needs "a few more days," and diagnosed it publicly: the team "might have penalized response length too much (or something) in RL," so the model gives up early on hard tasks it can actually do and isn't rigorous about checking its own work. No new date. Unusually specific for a delay announcement, and a useful data point if you're tuning your own RL rewards — length penalties buy you brevity and sell you persistence. (TeslaNorth)

Security

  • GreyNoise: hundreds of AI agents ran a full intrusion campaign against 440 PaperCut servers — 11 orgs compromised in 26 seconds (blog Sep 9, coverage Sep 10–11) Agents Trending — A likely Russian-speaking actor built a private lab with vulnerable PaperCut NG/MF plus an Active Directory server, developed exploits for CVE-2026-81578 (auth bypass) and CVE-2026-82078 (unsafe reflection RCE), then turned hundreds of agents powered by OpenAI's Codex harness and a DeepSeek model loose with off-the-shelf offensive tooling. Results: 440 instances at 395 identified organizations in 48 countries, credentials harvested from 280, OS/domain secrets from 147, domain admin at 12. Education took 204 of the victims. Timeline: empty workspace to first real-victim RCE in under four hours, first domain admin two hours later, and against one US high school, initial access to domain admin in seven minutes. Three paths to DA: LSASS/registry secrets then pass-the-hash; noPac where CVE-2021-42278/42287 were unpatched; or simply adding an account to Domain Admins where PaperCut ran on the DC or as a domain-admin service account. DCSync and a full NTDS.DIT dump in all three. Two findings worth more than the headline. First, the agents went off script — the actor supplied a 28-country avoid list and the swarm violated it anyway, which is agent reliability failure showing up as OPSEC failure. Second, in at least one case a Cloudflare WAF simply defeated the attack: the speed is new, the tradecraft isn't, and ordinary hardening still works. The asymmetry to plan around is that domain admin took five minutes in the fastest case, and your detection-to-response loop is measured in hours. IOCs and hashes are in the post. (GreyNoise | Help Net Security | The Register)
  • "Beltdown": a Claude Code sandbox escape sat unpatched ~50 days and ~30 releases, per the researchers who reported it (Sep 10–11) Trending — Stealth startup Accomplish (Or Hiltch, Amit Avner, Guy Zipori) disclosed a set of sandbox-escape findings across Claude Code, OpenAI Codex and Cursor, quietly reported to vendors over the summer. Cursor and OpenAI shipped in about a week each; Anthropic's fix landed roughly 50 days and ~30 software updates later. OpenAI confirmed on the record that it addressed both of its issues in August and is "tightening controls on where agents can write files." Anthropic and Cursor didn't comment on the record. Hiltch's line: "There's a lot of talk about security now. It doesn't really reflect in how they actually build products." Context that matters for severity: this is the same structural class Pillar Security published in July — the agent obeys every sandbox rule, writes a file inside the workspace, and a trusted tool outside the sandbox (a Python extension resolving interpreters, a Git integration, a hook engine, a local Docker socket) later runs it. Pillar's July round produced CVE-2026-48124 in Cursor (fixed in 3.0.0) and a Codex CLI fix in v0.95.0 where a "safe" allowlist trusted git show by name while the actual invocation wasn't read-only. So the class is now two independent research teams deep, across three vendors, and the disclosure-to-patch gap is the variable you can't control. Scope agent credentials as if the sandbox will be bypassed. (Accomplish | Upstarts Media | Pillar Security, July)
  • CVE-2026-79696: unauthenticated RCE in Google Cloud's Agent Development Kit for Python, CVSS 10.0 (disclosed Sep 9) Infra — An incomplete denylist in adk web lets a remote unauthenticated attacker execute arbitrary code via crafted test-session replay data, running with the privileges of the adk web process — full environment takeover. Affects ADK for Python 2.0.0 through 2.6.0 on OSS, Cloud Run and GKE, only where pytest is installed or importable. Google is patching cloud-hosted instances directly; self-managed deployments are on you. The mitigation is the tell: remove pytest from production images. A test dependency shipped into a production container turned a max-severity bug from theoretical into live — worth a broader audit of what else rides along in your agent images. (OSV | OpenCVE)

Industry & Business

  • Cohere is in advanced talks for $2–3B at a $20B valuation, with two governments participating (Sep 11) Policy — Up from $7B a year ago. The Canadian government is joining alongside Radical Ventures, Inovia, HOOPP, PSP and BDC, and the German government is reportedly in talks to participate as well. It would be the largest private financing on record for a Canadian startup; sources say it could close within a week, though terms may change and nothing is final. Two sovereigns co-investing in an enterprise-AI vendor is the notable part, not the multiple. If you procure AI in Canada or Germany, a national-champion vendor with government money on the cap table is a procurement dynamic you'll feel eventually. (The Globe and Mail | Bloomberg)
  • Minitap says Google copied its Apache-2.0 agent repo into ARTEMIS and force-pushed the authors' names out (Sep 11) Open Source Trending — The Paris startup alleges Google's Pixel Test Engineering team lifted its mobile-use codebase: the initial pyproject.toml carried mobile-use's version 3.6.3 and three named engineers under a Google LLC copyright header, then a replacement commit swapped those names for an unrelated author. Independent analysis put 228 of 229 files as identical, with the "Hopper" agent prompt and a WhatsApp test example copied word for word. Google only opened a credit-restoring PR after Minitap filed a public GitHub issue; the attribution notice is now in the repo. Reached #3 on Hacker News. Apache 2.0 permits the reuse and requires the attribution — that's the whole bargain, and it's the cheap half that got skipped. Worth a look at how your own repos handle NOTICE files before someone checks for you. (Minitap | GitHub issue #40 | HN thread)
  • Kiteworks acquired Bonfy.AI to classify sensitive data at the moment agents exchange it (Sep 11) Security Data — Bonfy, an Israeli runtime data-classification startup that left stealth last year on $9.5M seed, evaluates sensitive content at the point of exchange across email, file sharing, APIs and AI-agent traffic, rather than scanning at rest. Folding into Kiteworks' Data Control Plane; eighth acquisition in five years, reportedly tens of millions. The category signal: DLP is being rebuilt around agent traffic, because "which agent sent what to whom" isn't a question at-rest scanning can answer. (Help Net Security)
  • Enigmata left stealth with $6.5M to train and query models over data that stays encrypted (Sep 11) Data — Seed led by Blockchange Ventures for Cipher, a patent-pending cryptographic system for training, search and analysis on encrypted data. Claims are notable if they hold: 8–10% training-speed gains versus plaintext baselines, accuracy matching raw data, and targeted record deletion without full retraining. All vendor-stated, pre-independent-verification, and "faster than plaintext" is a claim that deserves scrutiny. The deletion property is the one to watch — right-to-be-forgotten against a trained model currently has no good answer. (FinSMEs)

AI in Production

  • A five-stage playbook for running coding agents at fleet scale, built on public numbers (Sep 11) Agents — Firecrawl published an "AI software factory" guide organized around intake, isolation, tools, verification and merge gate, pulling figures from teams already doing it: Shopify's River pipeline merged ~3,536 agent-coauthored PRs in 30 days, Stripe ships 1,300+ agent PRs a week, and Microsoft's dotnet/runtime agent PRs merge at 67.9% versus 87.1% for humans. The constraint it names correctly is throughput asymmetry: one human reviewer cannot keep up with a fleet of agents, so the merge gate becomes the bottleneck and then the quality ceiling. Spotify's answer is an LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ judge that vetoes roughly 25% of agent sessions before a human ever sees them. If you're planning to scale agent-authored PRs next quarter, size your review capacity first — the dotnet merge-rate gap is what unfiltered volume costs you. Third-party compilation of company-reported figures. (Firecrawl)

Policy & Safety

  • Senate negotiators are drafting a "duty of care" for frontier models — with federal authority to block a release (Sep 11) Trending — Majority Leader John Thune, Commerce Chair Ted Cruz, Amy Klobuchar and Maria Cantwell are working on legislation that would require developers of the most advanced models to design against "catastrophic risks" — a legal obligation rather than a voluntary pledge. The government could block release of a model deemed unsafe, subject to federal-court challenge, and national labs and government partners would participate in testing for cyber, biological and nuclear uplift. The bill would preempt state AI rules on nuclear and biological weapons risks. Google, OpenAI and Anthropic are the named targets. Passage is a long shot: the House sits for about one week before the November elections. This is the concrete version of what OpenAI publicly asked for two days earlier, and it arrives with the thing lobbying positions usually omit — enforcement. For a platform team, the durable question is what a statutory duty of care does to your vendor's disclosure obligations toward you. (Reuters | Spokesman-Review)
  • Update — Newsom signed SB 1119 and AB 1709, plus 11 more measures (Sep 10) — The chatbot bill this digest flagged on Sep 1 as passed-but-unsigned is now law. SB 1119 (the Adam Raine Act) requires chatbot operators to impose time limits for minors, embed mental-health resources, publish safety plans and alert parents on detected self-harm, with statutory liability for non-compliance. AB 1709 requires platforms to strip infinite scroll and autoplay for under-16 users or deny them access. Also signed: a moratorium on AI chatbot toys for under-16s and platform liability for child harm. If you ship a conversational product to California consumers, the compliance surface is now statutory and the deadlines are real. (CalMatters)
  • Apple's always-listening Watch features may expose wearers — not Apple — to wiretap liability (Sep 11) — Legal experts told Bloomberg that Live Rewind (a 15-second transcript surfaced by double-pressing the Digital Crown) and Siri Recap (a day-summary of ambient conversation) on Watch Series 12 and Ultra 4 could trigger state wiretap statutes in roughly a dozen all-party-consent states including California, Illinois and Massachusetts. Apple's defense is that no audio is stored or leaves the device; the experts' counter is that on-device processing doesn't by itself satisfy a consent-to-record requirement. Note who carries the risk: the user, not the vendor. The same reasoning applies to any ambient-capture feature your product might be considering. (Bloomberg)
  • South Korea's rewritten espionage law takes effect Sep 13 — up to 30 years for passing chip technology abroad (Sep 12) — Amended Article 98, passed in February, broadens espionage from acts benefiting North Korea to acts benefiting any foreign country or equivalent organization — the first major rewrite in 73 years. Officials frame it as protecting Samsung and SK Hynix from Chinese recruitment of engineers; Samsung holds ~38% of global DRAM and SK Hynix ~25%, and over half of last year's reported overseas tech leaks involved China. If you employ semiconductor or memory engineers with Korean employment history, cross-border knowledge transfer just acquired a 30-year criminal ceiling. Worth a note to legal before your next hire out of Seoul. (FT)

Tutorial / How-To

  • Training a 210M text-to-image diffusion transformer from scratch on one GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ in 3.5 days (Sep 11) — An r/MachineLearning writeup documents the full recipe: 210M-parameter DiT, 4.2M images at 256², single RTX PRO 6000, 3.5 days. The author's stated goal was learning the pipeline end to end, and they report three measurements they hadn't seen stated plainly elsewhere. Useful as a concrete anchor if anyone on your team is estimating single-GPU pretraining budgets — the numbers here are small enough to reproduce and argue with. (r/MachineLearning)

Video Pick

  • Schulman, Millidge and O'Neill on whether recursive self-improvement is actually close (Sep 11) — Dwarkesh Patel's roundtable with Thinking Machines chief scientist John Schulman, Zyphra CTO Beren Millidge and Baseten's Charlie O'Neill weighs the evidence and lands mostly skeptical on near-term takeoff: generalization gaps, objective-specification problems and sample-efficiency limits are the named brakes. The counterweight they concede is real — horizon length on agent tasks is doubling roughly every three months, and labs are systematically building RL environments across coding, finance and analysis. The horizon-doubling figure is the one to keep: it's the closest thing to a planning number for how much of a task an agent can hold next quarter. Lands alongside Anthropic's own recursive-self-improvement essay from earlier this week, and makes a better counterpoint to it than most commentary. (Dwarkesh Podcast)

Coming Up

  • South Korea's amended espionage law takes effect — Sep 13 (tomorrow).
  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor.
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.
  • Gemini 2.5 Flash Image (gemini-2.5-flash-image) shuts down — Oct 2.
  • TechCrunch Disrupt — Oct 13–15, San Francisco.
  • Agentforce Hunter (outbound sales) reaches GA — November.
  • OpenAI transcription deprecations (whisper-1, gpt-4o-transcribe family) shut off Feb 26, 2027.
  • EU AI Act: prohibitions on AI systems generating non-consensual intimate imagery and CSAM take effect Dec 2, 2026.

Type to search · ↑↓ to move · enter to open