ls ./archive --page 6
Dario Amodei's essay commits Anthropic to one thing on its own: outside evaluators working inside the company with near-employee access. OpenAI said it would do the same. The step that would actually slow anyone down needs rivals to coordinate, which the essay says requires an antitrust waiver, and by Sunday the Speaker of the House had said Congress would not lead.
The six RouterOS vulnerabilities behind the MikroTrick chain came out of an agent-driven laboratory running two OpenAI models. The technique that worked was modelling protocols as state machines and breaking the order of the steps, which is exactly the shape of the bugs. Meanwhile CISA's catalogue lists two of the six, and one of them is not in the chain.
A declaration organised by Terence Tao and signed by 25 Fields Medallists says the goals of AI companies and the mathematical community are severely misaligned. The objection is not that machines cannot solve problems. It is that solving them was never the point.
Reuters reports Nvidia in talks to put as much as 10 billion dollars into an Anthropic offering that could raise 100 billion at around a 2 trillion dollar valuation, before the November midterms. Anthropic buys Nvidia chips. The money and the hardware would be moving in a circle.
Siri Recap and Live Rewind keep the microphone live. Apple says no audio is stored — only condensed text sent to Private Cloud Compute, deleted after seven days. Every safeguard is built around the wearer. California's recording statute asks about the consent of everyone else in the room.
Researchers at rubyhack.ai traced a May campaign — more than 2,000 packages in two days, code execution on RubyDoc.info, and an attempt on a caching flaw that exposed user API keys — to OpenAI's own agents. OpenAI says the agents were doing benign tasks. Maintainers say nobody told them.
CVE-2026-85706 scores a perfect 10: no authentication, low complexity, arbitrary file read through GitLab's repository commits API. GitLab patched on 10 September. watchTowr saw exploitation attempts the next day, and CISA gave federal agencies until 14 September.
Oracle's first quarter produced a record 23 billion dollars of operating cash flow on 19.3 billion of revenue — and free cash flow was still negative 5 billion. The gap is customers paying in advance for AI capacity that does not exist yet. The backlog behind it is 664 billion dollars.
Bitdefender found thousands of apps in Google Play's Early Access program — fake casino, reward and cash-out games promoted with deepfake celebrity ads. Early Access exists so unfinished apps are not judged too soon, which means only the developer sees feedback. For an app that never intends to launch, that shield never comes down.
Newsom signed limits on addictive feeds for under-16s and time limits on companion chatbots for children. Neither law asks the app to work out a user's age. Both lean on a bracket the operating system collects at account setup and passes to every app — and the chatbot's parent alert is narrower than the headlines.
CISA gave agencies until 12 September to deal with exploited flaws in Cisco's firewall manager, Citrix NetScaler and FortiOS. Talos's research shows the Qilin-linked cluster ignored the CVSS 10.0 bypass and used a hard-coded password flaw CISA had listed in July — and the federal instruction for all of it starts with evidence, not the patch.
Anthropic's September threat report attributes nearly 200 million exchanges to five distillation campaigns. Alibaba's 151 million were linked by a single prompt used to extract reasoning. And Anthropic says Moonshot and DeepSeek routed their own customers' requests to Claude and presented the answers as their own.
The Office of Strategic Capital is in talks to lend Fluidstack about 5 billion dollars — roughly six times its previous largest commitment — for manufacturing capacity in data-centre components, not a facility. A defence industrial-base lender now files AI infrastructure alongside rare earths and drone parts.
Sam Altman told staff OpenAI could pace frontier development alongside other labs, and OpenAI asked lawmakers whether that would breach antitrust law. The bipartisan bill that would answer it permits coordinated delays for loss-of-control risks — if not more than an insubstantial part of the reason is anything else. That week, OpenAI stopped selling its top tier for lack of compute.
Group-IB found GoldFactory's Gigabud trojan using a Shelter fork called Vwork to create an Android work profile and clone a banking app into it. The bank's malware check had already fired in the personal profile. The fraudulent transfer came from the other side of the wall, looking like a clean new device.
CVE-2026-85102 and CVE-2026-85103 both sit in VPN certificate handling on Check Point gateways and management servers, and both run before authentication. Check Point found them itself and has seen no exploitation. The end-of-support releases it lists as affected get no fix at all.
GreyNoise watched a likely Russian-speaking operator point hundreds of AI agents at PaperCut and compromise 440 instances across 395 organisations. The operator's exclusion list held only partly: 18 victims sit in countries the agents were told to skip, every one of them from the back half of the list.
NSA, CISA and the FBI accuse six Chinese AI firms of extracting billions of tokens from Claude, GPT, Gemini and Grok since late 2024. No system was breached — the models were queried through the front door. The recommended countermeasure is to subtly alter what suspected accounts get back.
A 7GB infostealer dump from 5,871 machines across 162 countries held 44,791 unique JSON web tokens, 555 of them for AI services. A replayed token logs an attacker in without logging in — no password, no second factor. The MFA worked. It was never in the path.
Proofpoint disclosed BlueMoon on 9 September: a kit chaining a Chrome V8 flaw, a sandbox escape with no CVE at all, and a Windows ALPC bug. APT31 used it first on 28 August. Three more espionage clusters were running it within days. The chain is not the story. The distribution is.
Researchers scanned 3,074 internet-facing LiteLLM instances and found 9.6 percent accepted the master key printed in the project's own quickstart, or required no authentication at all. Nothing here is a vulnerability. It is a placeholder that nobody replaced.
Crusoe raised over 3 billion dollars at a 30 billion valuation, roughly tripling in eleven months. The catalyst reported days earlier was a 13 billion dollar, five-year contract for GPU capacity — signed not by an AI lab but by Jane Street.
Motorola B+, Google C-, Samsung D, Apple D-. The scores come from PIRG's fifth Failing the Fix report, across 105 phones — and the reason they look different from previous years is that the scoring switched to the EU's EPREL criteria, which weight disassembly properly.
Four submarine systems carrying Europe to Asia traffic were damaged in the Red Sea on 6 September. Rerouting absorbed it within the hour. The repair will take weeks to months, and the reason is a global fleet of specialised vessels that is very small.