JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Wednesday, September 16, 2026

17 stories

TLDR

  • Ursula von der Leyen endorsed the pacing consensus from the floor of the European Parliament and said she will invite the frontier labs to Brussels (Sep 16) Policy Trending — the first head of a major government to back the slowdown, 48 hours after the US President called the premise a hoax.
  • Google shipped Gemini 3.8 Live and 3.8 Live Extended Thinking — #1 on Artificial Analysis' speech-to-speech index, at roughly a third of GPT-Live-1's per-minute cost (Sep 15) Pricing Agents
  • A security startup evaluating Baseten as an inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ vendor got admin GitHub access in 25 minutes, via a three-year-old tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ sitting in Docker build history in a publicly-readable Harbor registry (disclosed Sep 16) Security
  • Anthropic signed its first Australian data-center lease — a A$32B, 2.16GW Queensland site, explicitly for Claude inference and not training (Sep 16) Infra
  • NYT/Siena: 61% of US voters oppose new AI data centers in their area, and fewer than 1% name AI as their top voting issue (Sep 15) Policy

Action Items

Things your engineering team should look at or do this week.

  • Check whether any container registry you operate allows anonymous pulls, then scan your images' build history for credentials. The Baseten finding was not a clever exploit — it was a public Harbor project, an anonymous pull token, and GITHUB_TOKEN preserved in a layer from March 2023. Run docker history against your published images and grep the layer commands; a credential baked into a layer survives every later RUN that "removes" it.
  • Inventory long-lived personal access tokens with org-wide push rights. The Baseten token was over three years old and still carried admin and push on the main product repo, the GitOps repo driving their clusters, and their Homebrew tap. If you cannot answer "how old is our oldest live PAT," that is the finding.
  • If you run a voice agent on GPT-Live-1, re-run your cost model against Gemini 3.8 Live. $0.005/min audio in and $0.018/min out versus the $0.05/min GPT-Live-1 landed at on Sep 12. Note the tool-call-while-speaking behavior changes turn design, so this is a rewrite, not a model swap.
  • If you publish open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗ checkpoints, read the DDO paper before your next release. Refusal-feature ablation is a two-minute attack on a downloaded model; there is now a post-hoc weight edit that defends against it with no runtime overhead.

Models & Tools

  • Google shipped Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking (Sep 15) Pricing Agents Customer AI — Two native speech-to-speech models, live today across the Gemini API, AI Studio, Search Live, Workspace, and Gemini Enterprise (private preview). Extended Thinking took #1 on Artificial Analysis' Speech-to-Speech Quality Index at 82.6, with 68.6% on τ-Voice and 35.1% on Sierra's τ-Voice-banking. Both auto-detect and switch across 97 languages mid-conversation, and — the part that actually changes how you build — run tool calls and API requests in the background while continuing to talk, giving a verbal acknowledgment up front and reporting back when the task finishes. Pricing is $0.005/min audio input, $0.018/min audio output (Google's estimate from $3/$12 per 1M tokens). The background-execution model is the architectural change worth attention. Every voice agent built in the last two years is structured around blocking on the tool call and filling the gap with a stall phrase; this removes the gap, which means your turn-taking logic, your interruption handling, and your latency budget all move. (Google blog | SiliconANGLE | MarkTechPost)

  • Shanghai AI Lab's Atria Dawn Preview: a 744B agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗, MIT-licensed, published with no announcement (weights Sep 11, paper Sep 14, trending since) Open Source Agents Trending — Built on the GLM-5.2 foundation, 256K context, instruct and FP8 checkpoints on Hugging Face and ModelScope, plus hosted API endpoints for international and China regions. Read the scorecard carefully rather than the headline. It leads on the search and tool-use axis — BrowseComp 92.5 (vs GPT-5.6 Sol 92.2, Claude Opus 5 90.8), DeepSearchQA 96.0, BFCL v4 77.0, AutomationBench 53.8, CyberGym 86.5 — and trails badly on coding: SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Pro 59.6 against Opus 5's 74.7, Terminal-Bench 2.1 78.3 vs 90.2. It is also text-only, which the model card documents by explaining how to make Codex and Claude Code stop sending it images. So this is not a frontier coding model you can drop into an existing harness — it's a strong, free, self-hostable retrieval-and-tool-use model, and that is a different procurement question. The paper is signed by 143 authors and reports ~one-third of its AI-assisted tasks were judged infeasible without the agent. (Hugging Face model card | arXiv 2609.15818)

  • Mozilla swapped Firefox's Smart Window onto Mistral models and opened it in France (Sep 16) Customer AI — The AI browsing assistant, launched in the US and Canada in August, now runs on Mistral and ships in French, with UK and Germany later in 2026. Mozilla says conversations are not retained on its servers by default and Mistral has agreed to zero data retention; features include answer-checking through an Exa partnership, tab grouping with duplicate detection, and visual history search. The contractual detail is the story, not the feature list. A default-browser vendor putting a written zero-retention term on its model provider is the first consumer-scale instance of the data posture enterprise buyers have been demanding — and it lands in the EU first, which is not a coincidence. (Mistral announcement)

Security

  • Strix got admin access to Baseten's GitHub while evaluating them as an inference vendor — in 25 minutes (disclosed publicly Sep 16; reported Jul 13, fixed Jul 17) Security Infra — The chain: certificate-log enumeration surfaced a Harbor container registry on a Baseten subdomain; one Harbor project was set public, which allowed anonymous listing of repositories and anonymous pull tokens; pulling baseten/baseten-app and reading the image's Docker build history exposed a GITHUB_TOKEN preserved from March 2023. The credential still carried admin and push on the main product repo, the GitOps repo driving their clusters, and their Homebrew distribution tap, plus read/write on private customer-specific repos. Baseten confirmed as critical, locked the registry and rotated within a day, and consented to disclosure. Three separate controls failed independently, and every one of them is a checkbox you can verify this afternoon: registry visibility, secret-in-layer scanning, and PAT lifetime. The GitOps repo is the one that should worry you most — push access there is push access to production clusters, including other people's workloads. (Strix writeup | Techzine)

Industry & Business

  • Anthropic signed its first Australian data-center lease: a A$32B Queensland site at 2.16GW (Sep 16) Infra — The Western Downs Digital Park, near Dalby, ~250km northwest of Brisbane, developed by Singapore's Zerra DC, with a power draw Anthropic compares to 1.5 million average Australian households. Target for first use is 2027, though the development application was only filed with the local council last month and the lease is subject to Foreign Investment Review Board and council approval. Anthropic is explicit that the site serves Claude inference for user queries, not model training. The inference-not-training framing is doing real work here — it is a regulatory and political argument (local jobs, local latency, no frontier-capability story to object to) as much as a technical one, and it is the template every lab will now use when siting capacity in a jurisdiction with data-center opposition. Read it against the NYT/Siena number below. (ABC News)

  • Z.AI's $5B raise settles today (announced Sep 13–14, settlement Sep 16) Trending — The Hong Kong-listed Chinese lab formerly known as Zhipu priced up to 21.965M H-shares at HK$714 (net ~HK$15.68B) — 9.96% below Friday's HK$793 close — alongside RMB 20.14B (~$3.02B) of zero-coupon convertible bonds due 2027 at a HK$892.50 conversion price. Use of proceeds: 60% to next-generation GLM foundation models plus training and inference infrastructure, 15% to expansion and strategic investments, 25% working capital. This is the second raise in two months after roughly $4B in July, following a January IPO. If you are evaluating GLM-family models for self-hosting, the 60% allocation is the number that matters — it is a funded commitment to keep shipping the open-weight line that Atria Dawn was built on. (Caixin Global | Business Standard)

  • Cornelis Networks raised $205M and shipped an open GPU-agnostic alternative to InfiniBand and NVLink (Sep 14) Infra — The Intel spinout closed a round led by IAG Capital Partners and unveiled Active Compute Fabric, an open-architecture networking layer aimed squarely at Nvidia's interconnect lock-in, alongside a strategic collaboration with Qualcomm for rack-scale inference. The CN5000 (400 Gbps) ships now; the multi-protocol CN6000 (800 Gbps) arrives Q4. Pre-production simulations claim up to 50% reduction in network traffic in large clusters. The Qualcomm pairing is the signal. Interconnect has been the quiet reason GPU-agnostic inference stacks stay theoretical; a networking vendor and an accelerator vendor announcing together is the first credible attempt at an alternative rack, rather than an alternative chip. Simulation numbers, though — wait for third-party cluster benchmarks. (TechCrunch)

  • ByteDance's AI drug-discovery spinoff Anew Labs raised $290M at a $1.5B valuation (Sep 16) — Led by HSG and IDG Capital. The Shanghai unit, running since 2021 under Kai Liu with about 50 core members, recently unveiled an AI-designed small molecule targeting the previously undruggable IL-17 protein. The structural move is the spinout itself — ByteDance separating AI-for-science commercialization from the consumer platform, which is how you raise outside capital and sign pharma partners without the parent's geopolitical baggage attached to every contract. (Reuters)

  • SK Hynix is in early talks to have Intel manufacture memory chips at US fabs (Sep 16) Infra — Per Reuters sources, it would be the first time Hynix outsources memory production to a rival, driven by AI HBM demand it cannot meet internally. Sources flag potential opposition from Seoul as a major hurdle. It sits alongside Hynix's separate $4B Indiana packaging plant and its earlier NAND deal with Intel. Early-stage talks, so calibrate accordingly — but HBM supply is the binding constraint on accelerator availability through 2027, and this is what the constraint looks like from the supply side. (Reuters)

AI in Production

  • SemiAnalysis: Vera Rubin NVL72 delivers 7x Blackwell's tokens per megawatt — more than double Nvidia's own public claim (Sep 15) Infra — Pre-release testing on DeepSeek V4 Pro's 1.6T-parameter model puts Rubin at 59.4M tokens/sec/MW at 100 TPS interactivity, versus 28.5M for GB300, which the authors translate to a modeled $149.9B annual profit per gigawatt for Rubin against $105.3B for GB300 on Dynamo SGLang. Jensen Huang has publicly claimed 3x. The authors' verdict: "Jensen needs to stop sandbagging." For anyone doing multi-year inference capacity planning, tokens-per-megawatt is the unit that matters now, not tokens-per-dollar-of-hardware — power, not silicon, is what is rationed. A 7x efficiency step also means the cost curve you modeled for 2027 inference is probably too conservative, which cuts both ways: cheaper for you, and cheaper for whoever is competing with you on price. (SemiAnalysis)

  • 404 Media: OpenAI has hundreds of contractors reading real ChatGPT prompts under an internal program called "Project Lily" (Sep 14) Policy — Contractors recruited through Crossing Hurdles and paid via Mercor (one reports over $50/hour) read live user prompts — many containing sensitive personal information — and rate responses on a 1–7 scale. ChatGPT has 900M+ users, and model training is on by default for consumer plans. The piece notes Anthropic and Google run comparable human-review programs. None of this is a policy violation and that is exactly the point. If your staff paste customer data, incident logs, or unreleased code into a consumer-tier assistant, "a human at the vendor may read this" is the correct threat model, and it is the one your DPA and your acceptable-use policy should already reflect. Check which tier your team is actually on. (404 Media)

Policy & Safety

  • Von der Leyen endorsed the pacing call in her State of the Union address and will summon the frontier labs to Brussels (Sep 16) Trending — Speaking in Strasbourg, the Commission president framed AI as one of the two "tipping points of our time" alongside climate, quoted the labs back at themselves — "CEOs of the most advanced companies tell us that it is time to slow down... To pace the frontier" — and committed: "I will invite the main frontier labs for a discussion on how we can support ongoing industry efforts to pace the frontier." She also previewed "game-changing" industrial-AI initiatives in November across health, transport, agri-food, advanced manufacturing, and defense and space, and separately proposed banning social platforms for under-15s. This is the first government-level endorsement the pacing consensus has received, and it arrived from the one jurisdiction that already has a binding statute to hang it on. Amodei's three asks were embedded evaluators, coordinated limits among democracies, and arms-control talks with authoritarian states; Washington called the premise a hoax and Beijing called it a Cold War playbook, and Brussels just said yes to the middle one. Practically: if you sell into the EU, the AI Act's existing deadlines are still your compliance calendar — but a November industrial-AI package plus a frontier-lab convening is where the next set of obligations gets drafted. (France 24 live coverage | Rappler | Euronews)

  • Sen. John Kennedy will try to pass an AI "kill switch" mandate by unanimous consent tomorrow (announced Sep 14–15, floor attempt Sep 17) — The bill would require every AI developer to build an in-house shutdown mechanism, deliberately leaving the trigger with the company rather than the federal government — Kennedy's stated calculation being that a bill expanding executive power over AI would not survive a veto. As of Monday it had no cosponsors, and unanimous consent can be blocked by any single senator. Expect it to fail, and watch what the objection sounds like anyway. A UC attempt is a cheap way to force every senator to either let a safety mandate through or say out loud why not, eight weeks before the midterms — and the design concession (industry holds the trigger) is a preview of the only shape federal AI safety legislation is likely to take. (Newsweek | Roll Call)

  • NYT/Siena: 61% of US voters oppose new AI data-center construction in their area, but under 1% call AI their top voting issue (Sep 15) — The pre-midterm survey also finds 42% trust Republicans on AI versus 40% Democrats — inside the margin of error, i.e. no partisan ownership of the issue at all. The gap between those two numbers is the whole political dynamic. Broad, bipartisan, low-salience opposition does not decide national elections, but it decides county zoning votes — which is precisely where every gigawatt of announced capacity has to clear. Anthropic's Queensland framing above, and Trump's "sick conspiracy" post on Sunday, are both responses to this number. (New York Times)

  • The Commerce Department ordered Kalshi to take down its AI compute futures product, citing national security (reported Sep 15; order issued in August) Infra — Per Semafor, Commerce told the prediction-market platform to remove its "compute forward curves" — launched in July as implied future hourly rental prices for Nvidia B200, H200 and A100 — and separately pressured the CFTC to freeze approval of new compute contracts for 60 days. Counterparties had included CoreWeave, CME and Intercontinental Exchange. Kalshi complied quietly; many underlying markets remain open. Commerce called the story "false"; Kalshi declined comment. The stated worry is that a thin market could be manipulated to make older-chip prices look like they were collapsing, moving AI equities. The second-order effect is the one to note: the only public price signal for compute just got switched off, so anyone trying to forecast GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ rental costs is back to vendor quotes and inference from earnings calls. (Semafor | Gizmodo)

Paper Spotlight

  • "Decoy Direction Optimization: A Post-Hoc Defense Against LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ Abliteration" (arXiv 2609.16204, trending on HF daily papers Sep 16) Open Source Security — Abliteration (refusal-feature ablation) is the attack that strips safety refusals out of an open-weight model by locating the refusal direction with a contrastive estimator and editing it away — cheap, fast, and the main reason "we released the weights responsibly" is a contested claim. DDO's move is to attack the attacker's estimator rather than hide the circuitry: it injects a high-magnitude nonlinear decoy signal into MLP neurons so the contrastive search converges on a harmless orthogonal feature while the real refusal mechanism stays intact. It is post-hoc weight editing — decoy parameters optimized on a small prompt set and compiled into the weights, no base-model finetuningTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗, no architectural or runtime overhead, composable across releases. Reported attack success rate holds below 10% across an eight-fold adaptive attack sweep where prior defenses collapse. Two caveats before you plan around it. Defensive-deception results historically degrade once attackers know the decoy exists, and the sweep is the authors' own; but if it holds, this is the first hardening step that fits into an open-weight release pipeline without retraining. (arXiv)

Tutorial / How-To

  • "Learning to solve hard problems in RLReinforcement learningTraining by trial and error, where the model takes actions and adjusts based on the rewards it gets.Kaelbling et al. 1996 ↗ for LLMs by never giving up" (Sep 16, HN front page) — Michael Noukhovitch's write-up argues that standard RL pipelines for LLMs discard exactly the prompts the model needs to improve on: samples that return low or zero reward get filtered as noise, which means the training distribution silently collapses toward problems the model already solves. The post lays out a recipe for keeping hard, low-reward samples in the loop rather than pruning them. Worth reading even if you never train a model, because the same failure mode shows up in eval-set curation and in agent-harness regression suites — drop the cases that keep failing and your dashboard improves while your system does not. (mnoukhov.github.io)

Coming Up

  • Sen. Kennedy's AI Kill Switch Act unanimous-consent attempt — Sep 17.
  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor.
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Gemini gemini-omni-flash-preview shuts down — Sep 30. Replacement: gemini-omni-1.1-flash.
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.
  • Gemini 2.5 Flash Image (gemini-2.5-flash-image) shuts down — Oct 2.
  • Siri AI adds French, Japanese, Korean, Portuguese and Spanish — October. Still no EU availability date.
  • TechCrunch Disrupt — Oct 13–15, Moscone West, San Francisco. Exhibit-table booking closes Sep 18.
  • Firmus ASX IPO targeting up to ~US$5B — end of October.
  • EU Commission industrial-AI package — November (health, transport, agri-food, advanced manufacturing, defense and space).
  • Agentforce Hunter (outbound sales) reaches GA — November.
  • GPT-5.6 Sol promotional pricing ($4/$20) runs through at least Nov 21–30.
  • EU AI Act: prohibitions on AI systems generating non-consensual intimate imagery and CSAM take effect Dec 2, 2026.
  • Anthropic's Queensland data center targeted for first use — 2027 (pending FIRB and council approval).
  • Agility Digit 5 early access — H1 2027; broad availability end of 2027.
  • OpenAI transcription deprecations (whisper-1, gpt-4o-transcribe family) shut off Feb 26, 2027.

Type to search · ↑↓ to move · enter to open