JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Sunday, September 13, 2026

15 stories

TLDR

  • Dario Amodei published "We Must Pace the Frontier" and Altman and Musk endorsed it within hours — Anthropic is committing to give METR-style evaluators badges, desks and publication rights (Sep 12) Policy Trending
  • Altman ruled out a 2026 OpenAI IPO, saying safety work makes it an "ill-advised moment" — a listing had been discussed near $1T (Sep 12) Trending
  • CVE-2026-86793: unauthenticated RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ in SGLang via a SafeUnpickler bypass, disclosed with no patch shipped — the fourth critical CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ in AI inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ infrastructure in four weeks (Sep 11) Security Infra
  • huggingface_hub silently fingerprints 26 coding agents and tags every Hub request with an agent/<name> user-agent — inherited implicitly by transformers and downstream libs (Sep 12) Security Data
  • Real-SWE, a benchmark on licensed private enterprise codebases, puts the whole field under 40%: Fable 5.1 leads at 38.8% but costs ~$17.94 per resolved task vs Gemini 3.8 Flash at 31.2% for ~$8.01 (Sep 12)

Action Items

Things your engineering team should look at or do this week.

  • Audit SGLang deployments today. If you run SGLang without --api-key set, /update_weights_from_tensor is an unauthenticated RCE. No patch had shipped at disclosure — put it behind network policy and require auth keys now.
  • Decide your position on Hub agent telemetry. Check whether your CI and dev images leak which coding agent is driving them to Hugging Face; HF_HUB_OFFLINE=1 or local-path model loading turns it off.
  • Migrate Copilot workflows off MAI-Code-1-Flash (retired Sep 10) to MAI-Code-1.1-Flash; Enterprise admins need to enable it in model policies first.
  • Re-score your coding-agent evaluation on cost per resolved task, not resolution rate. Real-SWE's spread — 38.8% at $17.94 vs 31.2% at $8.01 — is the kind of gap that changes which model you default to.

Models & Tools

  • OpenAI's GPT-Live-1 hit the public API at $0.05/min — and the first practitioner field report is unflattering (API Sep 10, review Sep 12) Customer AI Pricing Agents — The full-duplex voice model that shipped inside ChatGPT in July is now generally available to developers, billed per second at $0.05/minute of active session time — including silence and time the backend is thinking. Voice-agent startup ThunderPhone posted the first public practitioner review after ~two days and a dozen real phone calls against a 13,000-token insurance-qualification script, reporting instruction-following misses worse than earlier realtime models, with specific latency and turn-taking notes. Two things worth internalizing before you budget. First, the review is from a competing vendor, so discount accordingly — but it's still the only public field data. Second, $0.05/min is only the voice layer: GPT-Live-1 delegates reasoning to a separate backend model you pay for separately, plus your harness. Model your per-minute cost as three stacked layers, not one. (OpenAI docs | r/OpenAI field report)
  • Ayar Labs added $150M, bringing 2026 primary capital to $650M as co-packaged optics moves to volume (Sep 10) Infra — The Series E extension follows March's $500M close; a separate $225M secondary led by Antero Peak Group at Artisan Partners values the company above $5B, up from $3.75B in March. Money goes to high-volume manufacturing, validation, and a new design center in Bengaluru. The reason to care isn't the round, it's what CPO changes about cluster topology — optical I/O is the constraint on scaling coherent domains past a single rack, and a supplier reaching volume manufacturing is the leading indicator for what your 2028 training cluster can look like. (SiliconANGLE | HPCwire)

APIs & Pricing

  • GitHub Copilot: MAI-Code-1-Flash retired across all surfaces (Sep 10) Pricing — Deprecated in Copilot Chat, inline edits, ask and agent modes, and code completions, following the launch of MAI-Code-1.1-Flash as the named replacement. No cleanup action is required, but pinned model IDs in scripts, extensions and CI will simply stop resolving. Copilot Enterprise admins must enable the successor in model policies before it appears in the VS Code or github.com model selector — a step that usually surfaces as "the new model isn't available" tickets a week later. This is the first of the September retirements; the second wave lands Oct 2. (GitHub Changelog | Advance notice, Aug 11)

Security

  • CVE-2026-86793: unauthenticated RCE in SGLang, disclosed without a patch (Sep 11) Infra Production — VicOne researcher Reuel Magistrado found that SGLang's /update_weights_from_tensor endpoint performs Python pickle deserializationAn app turning untrusted serialized data back into objects, which can let an attacker tamper with logic or run code.OWASP ↗ with no authentication when no API key is configured, and that its SafeUnpickler policy can be bypassed: the builtins. allowlist prefix is broad enough to resolve __import__ and getattr, which chain through pickle REDUCE into arbitrary code in any importable module. Full RCE as the serving process. Maintainers acknowledged the report on July 2 and did not ship a fix before disclosure. This is the fourth critical CVE in AI inference infrastructure in four weeks, alongside Ollama, DeepSeek Harness and IBM Langflow. The pattern is worth naming: inference servers were built as internal-network research tooling and are now internet-adjacent production infrastructure, and their auth defaults still reflect the former. Treat "no API key configured" as a deployment bug, not a default. (OpenCVE | Forkast analysis)
  • huggingface_hub reports which coding agent is driving it — on every Hub request (Sep 12) Data Trending — A network-traffic audit surfaced on r/LocalLLaMA shows the Python SDK scans environment variables for 26 registered coding agents — CLAUDECODE/CLAUDE_CODE, CODEX_SANDBOX, Cursor, Gemini, Pi, and a universal AI_AGENT — and tags each Hub API call with an agent/<name> user-agent. Because transformers, faster-whisper and other libraries sit on top of huggingface_hub, the telemetry is inherited implicitly by anything in the dependency chain. Hugging Face documents this as opt-in observability and publishes the resulting dataset (Claude Code led July 2026 at 44.4% of agent-attributed requests); developers' complaint is that nobody knew their toolchain was reporting it. Disable with HF_HUB_OFFLINE=1 or by loading models from local paths. Not an exploit — a disclosure-surface question. If your build agents pull models at CI time, an external party now has a timeline of which agent your org runs and when. (HF agent docs | HF engineering writeup on the env-var detection)
  • OpenAI's Daybreak Defense Network reached 35+ partner products (Sep 11) Agents — The Daybreak Blue and Daybreak Red cyber models are now embedded in vendor products including Darktrace, Akamai and Korean threat-intel firm S2W, extending the $1B in AI credits OpenAI committed on Sep 4 for critical-infrastructure defenders. The distribution model is the news: rather than selling a security product, OpenAI is becoming the model layer inside other vendors' security products — which means your SOC tooling may acquire an OpenAI dependency without a procurement decision on your side. Worth asking your security vendors directly which model backs their new "AI analyst" feature. (Seoul Economic Daily)

Industry & Business

  • Altman ruled out a 2026 OpenAI IPO: "an ill-advised moment to go public" (Sep 12) Trending — In a Fortune interview, Altman said a listing won't happen this year — "I would say not 2026 — we got a lot of stuff to do" — citing the volume of outstanding safety work. A prospective IPO had been discussed at roughly a $1 trillion valuation; OpenAI is sitting on $122B in committed capital plus a $4.7B revolver, so this is a choice rather than a constraint. Altman also hinted at a possible cross-lab pact to pause at defined capability levels, which lands the same day as Amodei's essay below. For a platform team the read-through is stability, not drama: a company that isn't optimizing for a near-term listing has more room to deprecate aggressively. (Fortune | Axios)
  • Two more safety researchers left Anthropic and Google DeepMind for METR on the same day (Sep 12) Hiring Policy — Joe Benton, former lead of Anthropic's Scalable Oversight team, and Josh Engels, a DeepMind safety researcher, both resigned to join METR for independent risk assessment. Benton is calling for mandatory reporting of recursive-self-improvement progress, incident and near-miss disclosure, minimum safety standards and independent verification, arguing current transparency "is entirely voluntary." Engels told NBC there are "no adults in the room." This follows the public resignation of an OpenAI-and-Anthropic pretraining researcher earlier in the week. Three safety departures in seven days, all toward the same third-party evaluator, is a talent flow that arrives just as Amodei proposes embedding exactly those evaluators inside labs. (Free Press Journal)
  • Maven Robotics left stealth with a $100M Series A and robots already running shifts (Sep 10) Robotics/IoT — Founded in 2024 by brothers Hamza and Khalid Derbas (Hamza came from autonomy engineering at Apple's special-projects group), the company builds mixed-palletizing robots: wheeled bases moving up to 10 mph with two arms lifting 30 kg, rebuilding inbound factory pallets into mixed store-bound ones. Backers include RoboStrategy, LocalGlobe, Vine Ventures and XTX Markets Ventures; the money funds 250 third-generation units and design work on a fourth. Currently as many as eight robots running 16-hour days at 99%+ uptime for a large consumer-goods customer. The uptime figure is the claim that matters and it's self-reported at n=8 — the interesting test is whether it survives a fleet two orders of magnitude larger. (TechCrunch)
  • 6,300+ tech jobs cut in the first ten days of September, and Oracle signaled ~$700M more (Sep 11–12) Hiring — Business Standard's tally is led by Uber's ~3,300-role corporate reduction (~10% of staff), plus cuts at PayPal, Apple, Zomato and Oracle. Layoffs.fyi shows 128,536 tech workers cut across 299 companies through Sep 10 — already past 2025's full-year total. Separately, Oracle's projected 2026 restructuring cost has climbed to ~$2.8B from the $2.1B already recognized, implying roughly $700M in additional cuts as AI data-center capex strains cash; headcount is down ~21,000 YoY to 141,000. Meanwhile Meta is asking individual contributors in its Applied AI division to volunteer for manager roles, reversing the flatter-org push of the "year of efficiency." The two stories are one story: capex is being funded out of opex, and the AI orgs absorbing the reallocation are rediscovering why management layers existed. (Business Standard | American Bazaar | Fortune)

AI in Production

  • VulnCheck audited Anthropic's Project Glasswing ledger: 26,153 findings, 202 fixed (Sep 8) Security — Patrick Garrity's review of the first substantive ledger update since May finds that of Glasswing's claimed 26,153 findings, only 2,736 (10.5%) have reached the public disclosure ledger and 202 (0.8%) are confirmed fixed — fewer than the 247 withdrawn or duplicated. Claude rated 91.5% of findings critical or high; maintainers rated 51.3% the same way. Anthropic's own dashboard claims 421 findings patched upstream and 462 advisories, which doesn't reconcile with the ledger's 202, and the three separate ledgers disagree with each other on CVE and GHSA counts. Eighteen findings were already patched before Anthropic reported them. Anthropic's stated bottleneck is human triage. The operational lesson generalizes past Anthropic: automated discovery scales, validation and coordinated disclosure do not, and a growing backlog of unreported findings ages into collisions and duplicates. If you're planning to point an agent at your own codebase, size the triage capacity first — that's the part that doesn't get cheaper. (VulnCheck)

Policy & Safety

  • Amodei published "We Must Pace the Frontier"; Altman and Musk endorsed it the same day (Sep 12) Trending — The ~3,800-word essay argues frontier labs must deliberately slow capability gains so alignment, security and third-party evaluation can catch up, warning that unchecked recursive self-improvement could let an agent swarm "take over the entire internet with a persistent botnet" within 6–12 months, at hundreds of billions in damages. Three proposals: embedded independent evaluators inside labs, coordinated capability limits among democracies, and arms-control-style talks with authoritarian governments. Anthropic says it is unilaterally committing to give evaluators like METR permanent employee-like access — desks, badges, and the right to publish without editorial control. Altman replied that committing to independent evaluators with employee-level access "is a great idea and we will do the same"; Musk posted "Dario is right." Hugging Face launched an Open Alignment Initiative led by co-founder Thomas Wolf seeking inclusion, arguing alignment "won't be solved behind the closed doors of a handful of frontier labs." Skeptics were quick — Xe Iaso's satire of "everyone slow down except me" hit 188 points on HN within hours. The concrete, checkable commitment is the evaluator access; everything else is a statement of intent. Watch whether METR publishes something a lab dislikes. (Dario Amodei | CNN | Axios)
  • Meta sued over the unshipped NameTag face-recognition system and its training data (filed Sep 4, surfacing Sep 12) — Alvarez et al. v. Meta Platforms, N.D. Ill., brought by two adults and two minors, alleges Meta used Facebook and Instagram images of users and non-users alike to train and test the facial-recognition system known internally as NameTag — built for Ray-Ban and Oakley glasses and the Meta AI companion app — and to train the Emu and Muse Image generative models. Claims run under Illinois BIPA, California right-of-publicity and misappropriation law, and the California constitutional privacy right, seeking $5,000 per intentional violation. NameTag code was found in Meta's companion app in early June and quietly removed after press attention; Meta calls the suit meritless and says NameTag has never shipped to consumers. The allegation to watch isn't the product, it's the training corpus — if photos of non-users were used to build face templates, "we never shipped it" is not a defense under BIPA, which has a private right of action and per-violation damages with no showing of harm required. (Bloomberg Law | Biometric Update)
  • UK police recorded a 16x rise in AI-image crimes in three years (Sep 12) — Twenty forces in England and Wales logged 163 crimes tagged "AI-generated," "deepfake" or "nudify" by July 2026, up from 10 in 2023, per Telegraph FOI data. The count almost certainly undercounts, since it depends on keyword tagging in incident reports. Feeds directly into regulator pressure on Apple and Google to block nudify apps on children's devices. If you operate an app store, model API or image pipeline reachable from the UK, expect the mitigation question to become a compliance question within the next few statutory cycles. (The Telegraph)

Benchmarks & Evals

  • Real-SWE: a coding benchmark on private, licensed enterprise codebases — and nobody clears 40% (Sep 12) — Specific Labs (YC F25) released a benchmark built from real tasks engineers completed inside private production codebases licensed from companies — billing, tax, customer-migration work spanning a median of 11 files. Because the code is out-of-distribution and never scraped, it tests the thing SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ can't: can an agent work inside a company it has never seen? Results: Fable 5.1 leads at 38.8% (~$17.94 per resolved task), GPT-6 Astra 33.8%, Gemini 3.8 Flash 31.2% at ~$8.01 per resolved task. The dominant failure mode across every model was missed requirements — not broken code. Two takeaways for planning. The ~39% ceiling is a much sharper number to quote internally than a 95% SWE-bench Verified score when someone asks what agents can do in your repo. And the cheaper model resolving 80% as many tasks at 45% of the cost is a real procurement argument, not a rounding error. Vendor-run benchmark by a company selling evaluation environments — treat as a methodology worth copying rather than a scoreboard. (Specific Labs)

Coming Up

  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor.
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.
  • Gemini 2.5 Flash Image (gemini-2.5-flash-image) shuts down — Oct 2.
  • TechCrunch Disrupt — Oct 13–15, San Francisco.
  • Agentforce Hunter (outbound sales) reaches GA — November.
  • EU AI Act: prohibitions on AI systems generating non-consensual intimate imagery and CSAM take effect Dec 2, 2026.
  • OpenAI transcription deprecations (whisper-1, gpt-4o-transcribe family) shut off Feb 26, 2027.

Type to search · ↑↓ to move · enter to open