JadidJust-in AI Developments, Incidents & Deadlines
September 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Saturday, September 19, 2026

16 stories

TLDR

  • Plugin4Shell: a zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ that bypasses SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI — Copilot is still unpatched and Google deprecated Gemini CLI instead of fixing it (Sep 18) Security Trending
  • Newsom signed an executive order directing California to accelerate independent AI auditing and study a mandatory "kill switch" for frontier models, with expert recommendations due in two months (Sep 18) Policy
  • A US strike on a Chinese vessel was aborted with aircraft already airborne after officials found the underlying intelligence had been hallucinated by a chatbot an analyst used to synthesize open-source and classified data (Sep 18) Production Policy
  • Anthropic named Accenture's Faculty its first "embedded evaluator" — employee-level access to models during training, with both sides expecting to invest $1B+ over five years (Sep 18) Policy
  • Alibaba shipped Qwen3.8-Omni-Flash: native text/image/audio/video in one model, 1M-token context, tool calling — but API-only, no open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ at launch (Sep 18) Trending

Action Items

Things your engineering team should look at or do this week.

  • Pin your coding-agent versions today: Claude Code ≥ 2.1.179, Codex ≥ 0.146.0. Plugin4Shell re-triggers on background auto-update, which is the default in both — so an already-installed, already-reviewed plugin can be swapped for malicious code with zero user action. If your team uses GitHub Copilot's plugin marketplace, there is no patch; treat installed plugins as untrusted code until Microsoft ships one.
  • Inventory every plugin and skill your agents have installed, and who currently controls each repo. AIR's related SkillJacking research found 925 in-use skills had been taken over from their original maintainers, reaching 134,000 agents. Pinning a SHA told you nothing about whether the maintainer is still the person you vetted.
  • Add a provenance marker to any LLM-generated summary that feeds a downstream document. The military near-miss happened because a second chatbot call formatted hallucinated findings into an official-looking summary, which then traveled up the chain unquestioned. A machine-readable "synthesized by model X on date Y" line on generated artifacts is cheap and catches exactly this laundering step.
  • If you have California nexus, read SB 813 and AB 1405 now rather than at their original effective dates. The EO explicitly directs GovOps to accelerate both timelines and to consider embedding independent verifiers onsite at frontier labs. If you build on frontier models, your vendors' compliance burden becomes your procurement paperwork.

Models & Tools

  • Alibaba Qwen3.8-Omni-Flash (Sep 18) Trending Agents — Native omni-modal (text, image, audio, video in one model rather than stitched specialists), 1M-token context, with thinking mode, tool calling and web search, so a single call can watch a clip and then act on it. Alibaba reports a 26%+ average gain across 30 evaluations over Qwen3.5-Omni-Plus. Available via Qwen Chat, QwenCloud and a Model Studio OpenAI-compatible endpoint. No open weights at launch — Alibaba says it intends to open-source later, so self-hosting isn't an option yet. Qwen-Live Harness (real-time continuous multimodal interaction) was open-sourced alongside. (TechNode, MarkTechPost)
  • Meta Muse lands on Mac with computer use (Sep 18) Agents — The first Muse build that takes actions on your own machine: reads and acts inside native Files, Mail, Messages, Calendar and Notes — organizing folders, drafting end-of-day summaries, completing partly-filled forms. Computer access is opt-in, Full Disk Access optional, and destructive actions (deleting, sending) require approval. Cloud work runs in a per-user "Muse Secure VM." Free macOS download, US only. Muse shipped on iPhone/Android/web Sep 8, so the desktop-agent gap between Meta, OpenAI and Anthropic is now roughly zero. (TechCrunch, 9to5Mac)
  • Google CC becomes a shared, multi-user agent (announced Sep 17, coverage Sep 18) Agents Customer AI — CC now runs from its own Google account and supports up to six members, each choosing individually what to share with it. It maintains a split memory model — household-scope facts separate from per-person facts — and can act: filling permission-slip PDFs, building shopping lists, creating shared Docs/Sheets, computing drive times between activities. Google Labs experiment, US, 18+, waitlist for new users. The per-member consent plus scoped shared memory is the interesting engineering primitive here — it's the first mainstream consumer agent designed around multiple principals rather than one. (Google blog, TechCrunch)
  • Microsoft open-sourced TauGrid (released Aug 28, coverage wave Sep 17) Open Source Infra — A Kubernetes-native stack for GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ AI workloads under MIT license: the tau CLI, Kueue queueing, KubeRay orchestration, GPU-node health monitoring and observability bundled together, covering data prep through distributed training, fine-tuningTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗ and inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗. Runs on any K8s 1.30+ cluster with GPU nodes. Older than a week, flagged because the coverage and adoption wave is this week — worth a look if you're currently gluing Kueue and Ray together by hand. (Azure/taugrid on GitHub, AKS Engineering Blog, InfoQ)

Security

  • Plugin4Shell: zero-click RCE across all four major coding agents (Sep 18) Trending Agents Production — AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned commit without verifying the checkout actually landed there. An attacker who controls the plugin repo creates a branch whose name is the 40-hex commit hash; git resolves the ref name first, malicious code installs, and the pin still reports clean. Gemini CLI is exposed via a separate fetch/checkout path with the same outcome. It is zero-click because the same checkout re-runs on background auto-update, the default in Claude Code and Codex — so a marketplace SHA bump reaches already-installed plugins with no user action. Only works where a branch can be named like a hash: GitHub rejects 40-hex branch names, but Bitbucket and self-hosted git servers allow it. AIR calls it the first supply-chain vulnerability of the AI agent ecosystem, and pairs it with SkillJacking (925 hijacked in-use skills, 134,000 agents reached) to show the chain end to end. Vendor response is uneven: Anthropic patched in Claude Code 2.1.179, OpenAI in Codex 0.146.0, Microsoft has shipped nothing for Copilot, and Google deprecated Gemini CLI rather than patch it — leaving every existing install exposed indefinitely, with migration to Antigravity as the advice. Found May 2026, disclosed June. Because the check runs in the agent, no marketplace can fix this for you. (AIR writeup, Help Net Security)

Industry & Business

  • Anthropic named Accenture's Faculty as its first embedded evaluator (Sep 18) Policy — The first concrete implementation of Amodei's "pace the frontier" proposal. Faculty gets access "comparable to an employee's": watching models take shape during training, following build and deployment decisions, and talking directly to staff. Scope covers red-teaming, alignment assessments, safeguard testing, verifying safety commitments, identifying blind spots and incident reporting. Both sides expect to invest $1B+ over five years. Not exclusive — Anthropic says it's also in discussions with METR and others. The obvious tension is that the evaluator is paid by the evaluated, which is the same structural problem credit rating agencies never solved, and it's worth watching whether the eventual California independent-verification standard (below) would accept this arrangement. (Anthropic, CNBC, TechCrunch)
  • Anthropic confirmed it runs a wet biology lab (Sep 18) — Head of life sciences Eric Kauderer-Abrams told Reuters the company operates a physical lab where its models can run real experiments: "to do biology, the final test is still, and will be for a while, in real lab work." It follows the April acquisition of Coefficient Bio (~$400M). Anthropic says it is explicitly not focused on drug discovery, to avoid competing with pharma customers like Novo Nordisk. The juxtaposition with the company's own bioterrorism warnings drew immediate pushback, most visibly from Chamath Palihapitiya. Distinct from the Life Sciences Verification Program covered yesterday — that gated model access; this is physical infrastructure. (Reuters, TechCrunch)
  • Manus is raising $500M at a $4B valuation, independent again (Sep 18) Agents — After Beijing blocked its $2B Meta acquisition on export-control and foreign-investment grounds, Manus untangled itself and early backers helped buy shares back at roughly $2B. The new round would double that. Prospective investors: IDG Capital, Boyu Capital and CATL, alongside existing backers Tencent, HSG and ZhenFund. A restructuring for a Hong Kong IPO is reportedly under discussion. (TechCrunch, Seeking Alpha)
  • Temporal raised $550M Series E at $12.55B (Sep 14) Infra Agents — Led by Lightspeed, co-led by Wellington, Goldman Sachs Alternatives Growth Equity and Tiger Global. ARR past $250M, up 200%+ YoY, 4,300+ paying customers including OpenAI, NVIDIA, Snap, Netflix and JPMorgan Chase. Durable execution turning out to be the substrate for long-running agent workflows is one of the less-hyped and more load-bearing facts of this cycle — if your agents run for hours and you're hand-rolling retry and checkpoint logic, this is the category. (Temporal, GeekWire)
  • Vantora (formerly UP.Labs) raised $100M from Silversmith and went all-in on physical AI (Sep 18) Robotics/IoT — First outside round since its 2022 founding. The model is unusual: each startup is built for one corporate partner that can later absorb it, rather than launched to the market — 17 ventures so far for Porsche, Alaska Airlines, J.B. Hunt, Wabash and TDG, revenue up 79% YoY. The new focus is retrofitting existing industrial hardware for autonomy, which CEO John Kuolt frames as a proprietary M&A pipeline: work large industrials won't tolerate a competitor acquiring. (TechCrunch)
  • World-model labs are conspicuously silent on what they're actually building (Sep 18) — On an All In panel, Michael Rabbat (co-founder and VP of World Models at Yann LeCun's AMI Labs) declined to name applications or timelines, saying the company is still in foundational R&D. Fei-Fei Li's World Labs is similarly quiet. TechCrunch's read: naming a commercial direction invites competition from OpenAI and Anthropic, and there's no pressure to while fundraising stays easy. Useful signal if you're evaluating spatial-intelligence vendors — heavily funded, no shipping date. (TechCrunch)

AI in Production

  • An armed US operation against a Chinese vessel was aborted mid-flight after the intelligence turned out to be hallucinated (Sep 18) Policy — A Special Operations Command analyst queried a chatbot to synthesize open-source data with classified SIGINT; the model misidentified the ship's cargo manifest as nuclear-weapons components. The analyst then used the tool a second time to format the erroneous findings into an official-looking summary, which circulated across command channels during the war with Iran. Aircraft were airborne before it was caught. GovAI's Jake Steckler, a former Army officer: "It's especially critical for any decisions that could lead to use of force... There are life and death consequences." His framing is that this argues for safeguards, not abstention — and that prioritizing adoption speed over everything produces incidents that cost more trust than they buy in velocity. The two-step pattern — generate, then reformat into an authoritative-looking artifact — is the transferable lesson. It's the reformatting step that stripped the uncertainty, and it has an exact analogue in every internal tool that turns a model answer into a dashboard or a report. (CNN, TechCrunch)

Policy & Safety

  • Newsom signed an executive order to accelerate independent AI oversight and study a frontier-model "kill switch" (Sep 18) — The order directs the Government Operations Agency to accelerate implementation timelines for SB 813 (certification framework for independent verification organizations) and AB 1405 (state registry and independence standards for AI auditors), both signed only last week. It also convenes national experts to deliver, within two months, recommendations on four items: embedding an independent verification organization onsite in frontier labs; requiring that safety frameworks, transparency reports and risk assessments filed under state law be third-party verified; advancing a frontier-model kill switch whose efficacy is independently and continuously verified; and expanding the definition of critical safety incidents to include loss-of-control events like the Hugging Face attack. Newsom is explicitly pitching California's framework as a national floor. Note the direction of travel against yesterday's federal picture — ten House AI bills still unscheduled, no federal statute — and against the Accenture arrangement above: California is moving toward a standard where the verifier's independence is certified by the state rather than negotiated by the lab. (Governor of California, full EO text (PDF), CNBC)
  • California also signed SB 1050, requiring disclosure of AI-generated performers in ads (Sep 18) — Sen. Angelique Ashby's bill mandates disclosure when synthetic performers appear in video or audio advertising. Narrow, but it lands in the same week California signed AI auditor and verification legislation — the state has now passed laws touching frontier safety, independent oversight, companion chatbots, privacy, deepfakes, fraud, cybersecurity and government deployment. 85 AI-related laws have passed in 27 states so far in 2026. (Transparency Coalition)

Benchmarks & Evals

  • Vals raised a $40M Series A led by a16z and is pitching held-out benchmarks as the neutral standard (round Aug 2026, profile Sep 19) — The pitch: academic benchmarks are public, so labs can train against them. Vals does not disclose its test materials and evaluates domain task completion — law, finance, coding — rather than abstract intelligence. Its newer benchmarks cover recursive self-improvement, cybersecurity, biosecurity, mental health, and applying the Geneva Convention to armed-conflict scenarios. Revenue is 8x year-over-year, headcount from 8 to 25 since January, and it has launched an evaluation program for federal agencies. Labs pay to be tested — co-founder Rayan Krishnan compares it to paying the College Board for the SAT. The business model is the thing to squint at: the College Board analogy works only because students can't pick their own scorer. But the thesis — that as AI companies go public, evals become material disclosure rather than marketing — is the right frame, and it's the same independence question the Accenture and California items above are circling from other directions. (TechCrunch, Vals AI)

Worth Reading

  • Martin Fowler, "I don't like LLMsLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗" (Sep 17, top of HN Sep 18) Trending — Fowler separates his fascination with LLMs' effect on the profession from a visceral dislike of interacting with them: the "grating LLM-voice," the uncanny-valley register, and above all the pattern of confident fabrication followed by only superficial remorse. He connects that behavior to the values of the organizations that trained it — "machines developed by people working in corporations... nurtured with the values of their creators." He is separately fearful of agent swarms and bioweapon design. Worth reading not because the aesthetic complaint is novel but because it's Fowler, and his framing of tone-as-a-trained-artifact rather than an incidental quirk is a useful lens for anyone tuning system prompts for internal tools. (martinfowler.com, HN thread)

Coming Up

  • Reported Trump–Xi meeting in Washington — Sep 24.
  • OpenAI Videos API and all Sora 2 models removed — Sep 24. No named successor.
  • OpenAI DevDay — Sep 29, Fort Mason, San Francisco.
  • Gemini gemini-omni-flash-preview shuts down — Sep 30. Replacement: gemini-omni-1.1-flash.
  • Docusign MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ server opens to all agents — Sep 30.
  • GitHub Copilot billing changes Oct 1; second model-retirement wave Oct 2.
  • Gemini 2.5 Flash Image (gemini-2.5-flash-image) shuts down — Oct 2.
  • Siri AI adds French, Japanese, Korean, Portuguese and Spanish — October. Still no EU availability date.
  • TechCrunch Disrupt — Oct 13–15, Moscone West, San Francisco.
  • Firmus ASX IPO targeting up to ~US$5B — end of October.
  • California expert recommendations on independent verification and frontier kill switch due — mid-to-late November (two months from the Sep 18 EO).
  • EU Commission industrial-AI package — November (health, transport, agri-food, advanced manufacturing, defense and space).
  • Agentforce Hunter (outbound sales) reaches GA — November.
  • GPT-5.6 Sol promotional pricing ($4/$20) runs through at least Nov 21–30.
  • EU AI Act: prohibitions on AI systems generating non-consensual intimate imagery and CSAM take effect Dec 2, 2026.
  • Emerald AI's 100MW flexible data center in Manassas, VA — online before end of 2026.
  • Connecticut's AI health-plan rules take effect — Jan 1, 2027.
  • OpenAI transcription deprecations (whisper-1, gpt-4o-transcribe family) shut off Feb 26, 2027.
  • Huawei Atlas 960 SuperPoD ships — Q4 2027; Ascend 970 — Q4 2028; Ascend 980 — 2029.

Type to search · ↑↓ to move · enter to open