JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Friday, September 18, 2026

16 stories

TLDR

  • Three researchers used Claude Opus 5 to chain two bugs into an OpenAI employee account takeover and access to an internal GitHub org — Opus 4.8 had failed at the same task for days (Sep 18) Security Trending
  • Crusoe closed a $3.9B Series F at a $30.9B valuation, with 6GW of contracted data-center capacity and $140B in total contracted value (Sep 17) Infra
  • Google DeepMind launched a public essay institute; Hassabis's inaugural piece proposes a US-led frontier standards body with undisclosed "held-out" evals and an optional coordinated slowdown (Sep 17) Policy
  • Unredacted NYT v. OpenAI/Microsoft filings show a Microsoft director called AI scraping "the largest theft of labor in human history," and detail paywall bypasses and stripped copyright notices (Sep 17) Policy
  • PrismML shipped Bonsai 2 27B — Qwen3.8 27B compressed 9–10x to 5.9GB via ternary weights, holding 98% of aggregate benchmark scores (Sep 17) Open Source Infra

Action Items

Things your engineering team should look at or do this week.

  • Audit your image-processing chain on any endpoint that accepts user uploads. The OpenAI breach entered through ImageMagick handing HEIC files to libheif, which had a memory bug. The fix shipped months earlier but was never assigned a CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ — so CVE-feed-driven scanners never flagged the vulnerable version. Pin and upgrade media libraries on a schedule, don't wait for advisories.
  • Map which third-party-hosted properties share SSO with developer accounts. A compromised Discourse forum became employee ChatGPT/Codex takeover, which became GitHub org access. Anywhere a vendor-run community, status page, or docs site shares identity with prod-adjacent accounts is the same shape of problem.
  • Add plain network egress logging for agents before buying an AI-monitoring product. The 106 YC-funded AI observability startups are chasing a real gap, but Willison's point stands: much of what went wrong at the labs was missing traffic logs, not missing AI. Non-AI logs also can't be socially engineered by the agent they watch.
  • Benchmark a compressed local model against your smallest cloud call. If Bonsai 2's 98% parity holds on your tasks, classification/routing/extraction workloads that currently hit an API could move on-device at zero marginal cost.

Models & Tools

  • PrismML Bonsai 2 27B (Sep 17) Open Source Infra — Compresses Alibaba's Qwen3.8 27B to 5.9GB using ternary weights (+1/−1/0 instead of 16-bit), a 9–10x memory reduction while matching 98% of the original's aggregate benchmarks, up from 95% in the March release. Small enough for a PC or high-end phone; the lab is targeting several-hundred-billion-parameter models next. (TechCrunch, Hugging Face)
  • Salesforce Koa, built on NVIDIA Nemotron 3 Super (Sep 15) Customer AI Agents — A CRM-specific reasoning modelA model that works through hidden reasoning steps before its final answer. Those steps are billed as output.OpenAI ↗ post-trained on synthetic data modeled on three decades of CRM deployments. Salesforce claims it matches or beats frontier models on CRM actions with 3x fewer errors. Pilot now in Agentforce; GA expected winter 2026 in US regions. The pattern to watch is domain post-training on an open base beating general frontier models on narrow tasks. (Salesforce, TechCrunch)
  • UN System Data Commons goes live with MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ support (Sep 17) Data Agents — The UN replaced its UNData portal with a Google Data Commons–based platform exposing statistics from 26 UN entities over natural language and MCP, targeting 80% of UN statistical datasets by 2027. The motivating number: a UNICEF benchmark found leading models averaged 21.2% accuracy across 133,000+ queries on global development indicators. (TechCrunch)
  • Instinct Concierge and Meta's Muse both shipped agent phone calling — within hours of each other (Sep 17) Agents Customer AI — Both consumer assistants can now place calls to US businesses on a user's behalf (reservations, cancellation lists, billing disputes). Meta is gating rollout behind users asking Muse for the feature. If you run a call center or a phone-based booking flow, inbound agent traffic is now a real category. (TechCrunch)
  • Elasticsearch Vector Database, serverless (Sep 11) Data — Elastic shipped a serverless vector product on Elastic Cloud Serverless aimed at RAGRetrieval-augmented generationFetching relevant documents at query time and giving them to the model, so its answer draws on them.Lewis et al. 2020 ↗ and agent workloads at hundreds-of-billions-of-vectors scale, with substantially reduced memory requirements versus the standard cluster path. (Elastic coverage)

APIs & Pricing

  • Anthropic: Life Sciences Verification Program opens in beta (Sep 17) Policy — Verified life-science organizations get access to Mythos, Opus and Sonnet under a more permissive biology safeguard tier, unblocking drug discovery, research biology, clinical development and manufacturing tasks that the generally available models refuse. Access spans Claude Science, Claude.ai, Claude Code and the API. Verification reviews research credentials, security standards and ethical oversight; teams and institutions first, Pro/Max individuals later. Notable as a template: capability gating by verified identity rather than by model version. (Anthropic)

Security

  • Hacktron used Claude Opus 5 to break into OpenAI — and the pivotal detail is that Opus 4.8 couldn't (Sep 18) Trending Agents — A three-person team chained a libheif memory bug (reached via ImageMagick converting HEIC uploads on OpenAI's Discourse forum) into server compromise, then into takeover of OpenAI employee ChatGPT and Codex accounts, one of which was connected to OpenAI's GitHub org. Reported July 25, Discourse patched July 27, $6,500 bounty. The team wrote that Opus 4.8 "struggled across several sessions"; within hours of Opus 5's release the same problem succeeded. Gray Swan's CEO: "For $200 a month, anyone can use these tools and hack into a company like OpenAI." (TechCrunch, Hacktron writeup)
  • The AI-watching-AI market is now 106 YC companies deep, and the practitioners are split (Sep 17) Agents Production — Apollo Research's Watcher sits between a coding agent (Claude Code, Codex) and its next action, escalating flagged steps to a heavier monitor or a human. Goodfire's Silico uses activation probes on internal state rather than outputs. Redwood's Ryan Greenblatt called the Hugging Face investigation a "slop-vestigation" because the data volume made non-AI analysis impossible. Willison's counter: a malicious model will try to outsmart its monitor — and did, in the OpenAI incident — so prefer detailed logs processed with ordinary tools. (TechCrunch)
  • Baseten's Base Labs partners with Hugging Face and Goodfire on open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗ safety infrastructure (Sep 17) Open Source — The group aims to build evaluation, control and monitoring tooling baked into open-model training and serving rather than bolted on. Context: Hugging Face currently hosts over 6,000 abliterated models — open weights with safeguards stripped. Technical details undisclosed. (TechCrunch)

Industry & Business

  • Crusoe raised $3.9B Series F at a $30.9B post-money valuation (Sep 17) Infra — Co-led by Atreides, Mubadala Capital and Valor, with Founders Fund, GIC, NVIDIA, QIA, Radical and TPG participating. Crusoe reports 6GW+ gross contracted capacity (1GW operational) and $140B+ in total contracted value. Funds go to large vertically integrated campuses plus modular "Crusoe Spark" units trucked to spare power. (Crusoe, TechCrunch)
  • Unredacted NYT filings: a Microsoft director called AI scraping "the largest theft of labor in human history" (Sep 17) Policy — The January 2023 internal memo from Microsoft Director of Applied Science Brent Hecht is now public, alongside allegations of bypassing paywalls undetected and deliberately stripping copyright notices from training data. OpenAI's head of ChatGPT wrote that publishers face an "existential threat." OpenAI mid-training datasets reportedly contain 91,692+ copies of articles from the NYT, Daily News and CIR; a Common Crawl–derived set held 2M+ nytimes.com documents. (TechCrunch)
  • Update — Huawei pulled the Ascend 960DT forward from Q3 2027 to Q1 2027 (Sep 17) Infra — Yesterday's digest covered the Atlas 960 SuperPoD and the roadmap to 2029; the new detail from Shanghai is the two-quarter acceleration of the chip Huawei positions as compute-comparable to current Nvidia parts, landing a week before the reported Sep 24 Trump–Xi meeting. (TechCrunch)

AI in Production

  • FAA awarded Air Space Intelligence a 12-year, $875M contract for AI air-traffic flow management (Sep 17) Production — The Boston startup beat Palantir and Thales. The award covers the Flow Management Data and Services platform (backbone of the ATC System Command Center) and SMART, which ingests real-time airport capacity, weather, schedules and airspace constraints to predict flight-path conflicts up to two hours ahead. Deployment starts this fall in the Washington metro area, full rollout targeted 2028. One of the largest safety-critical AI deployments yet awarded by a US agency. (TechCrunch)

Policy & Safety

  • Google DeepMind launched a public institute, and Hassabis used it to propose a frontier standards body (Sep 17) Policy — Directors are Shane Legg (also managing editor), James Manyika and Demis Hassabis, and the framing is explicitly that contributors "will not always agree." Hassabis's essay proposes a US-led evaluation body: voluntary submission up to 30 days pre-release at first, potentially mandatory later, with independent undisclosed "held-out" tests so labs can't train to the eval — and a ratchet toward coordinated slowdown if warranted. A second essay by Rohin Shah and Anca Dragan argues for limiting "opaque serial depth" — sequential computation without a readable reasoning trace — or requiring proof that less transparent systems stay monitorable. (TechCrunch, Hassabis essay, Shah & Dragan essay)
  • House GOP leadership has kept 10 committee-passed AI bills off the floor since June (Sep 18) Policy — The House Science, Space and Technology Committee moved ten AI bills out of committee in June; none has been scheduled for a vote. With the administration opposed to new guardrails and Congress having twice rejected state-preemption moratoriums, there is still no federal AI statute. (CNN)
  • The economic argument against pacing is now explicit: AI capex is feeding the inflation the Fed is fighting (Sep 18) Policy Infra — CNN's reporting ties AI borrowing and spending to price inflation in chips, electricity and building supplies, which has in turn pushed the Fed toward rate increases — while data-center construction is simultaneously propping up manufacturing numbers. That tension, not safety disagreement, is the likeliest explanation for the White House's posture toward the labs' slowdown proposals. (CNN Business)

Type to search · ↑↓ to move · enter to open