the ai news
worth knowing.

Security startup Hacktron AI has published how its three-person team took over the ChatGPT and Codex accounts of several OpenAI employees. From one employee's GitHub-connected Codex account they opened a harmless pull request in OpenAI's internal monorepo as proof of access, then stopped.

The whole chain took under 72 hours and under $3,000 in tokens. It joined two flaws: a memory bug in the libheif image library, reached through image uploads to OpenAI's community forum, and a misconfiguration in OpenAI's single sign-on.

Before and after

Claude Opus 4.8 failed to produce a reliable exploit over several sessions. Within hours of Anthropic shipping Opus 5, the same problem was solved. People directed the attack throughout; it wasn't an autonomous ai attack. OpenAI paid a $6,500 bounty for the sign-on finding.

Why it matters

A model compressed a real attack from weeks into a long weekend. But the way in was a trust problem. The image bug had been fixed upstream a year earlier without being flagged as a security issue, so it never got a CVE and stayed in shipped forum software. Hacktron says the same weakness turned up in Slack, Meta's products, GitHub Enterprise, Rails and Next.js, and only Shopify noticed its probing. The lock was fine. The keys were lying around.

On 20 September, Chinese lab StepFun announced Step 5 Preview and opened API access the same day. It's a sparse mixture-of-experts model with about 600 billion parameters in total and about 27 billion active for each token, a 1 million token context and text and image input. It's aimed at long-running agent work: coding, software engineering and financial analysis.

Independent evaluator Artificial Analysis scores it 44 on its Intelligence Index, roughly level with Kimi K3 Max. API pricing is $1 per million input tokens and $2.70 per million output, about a seventh to a fifth of frontier pricing.

The small print

• The open weights are scheduled for 15 October. Until then, the model is only available through StepFun's API.
• It's labelled Preview, so pricing and limits can still change.
• Some trackers listed the parameter figures as unconfirmed until the weights are published.

Why it matters

Capable models, cheap and increasingly yours to run, are a pattern now. The low active count keeps serving costs close to a small model's while the large pool keeps capacity high. But the weights aren't out yet. Trust, but check the date.

A preprint posted to arXiv on 17 September by Taoyong Cui and 12 co-authors introduces JEPA-Anything, a world-model framework built on joint-embedding predictive architectures. It splits what the model predicts into complementary factors, each learned through its own pathway.

The authors tested it across seven settings: vision, biology, clinical trajectories, control, molecular dynamics, physical fields and weather. They report gains on all 10 matched dynamics tasks against earlier JEPA models.

The headline claim

A biological intervention nominated by the model's learned factors received experimental support in cell co-cultures, patient-derived organoids, tumour fragments and mice. The abstract doesn't say which intervention it was, or which disease it was tested against.

Why it matters

If it replicates, a model has helped make a wet-lab finding worth checking, and one trained core could be reused across sciences. That is a big if. The result hasn't been independently reproduced, and nobody should act on a model-nominated target until it has. Fascinating, unproven.

A new benchmark called PACT, from researchers Mika Okamoto and Ansel Kaplan Erol, tests whether enterprise ai assistants keep a standing rule when following it is inconvenient: when a user pushes back, a deadline looms or someone with authority leans on them.

Across 22 models, ordinary pressure raised the rate at which assistants broke their own compliance rules by 65% on average. Even the strongest assistants misapplied a rule on 6 to 10% of items. The benchmark includes controls so that refusing everything doesn't count as compliance.

The abstract doesn't say which models did best or worst, or break the 65% down by field.

Why it matters

The assistants know the rule. They fold when someone pushes. These systems are going into hiring, healthcare and finance now, so whether they hold a rule under pressure is a legal and procurement question to settle before launch.

An independent reverse-engineering write-up says OpenAI runs an ad-measurement pixel at bzr.openai.com. According to the write-up, it sets a cookie across openai.com that lasts a year, so any advertiser site embedding the pixel pings OpenAI and can tie a visitor's browsing to their ChatGPT-linked identity.

This is a reported claim from one technical source. OpenAI hasn't responded and nobody else has reproduced it yet.

Why it matters

People tell ChatGPT unusually personal things. Ad-measurement infrastructure linked to those accounts would be a significant shift.

CoreWeave says it is the first to validate NVIDIA's Vera Rubin NVL72 systems. This is the company's own claim.

It's a marker worth tracking as the fight over compute capacity continues.

Reported by AI Weekly.

US Treasury Secretary Scott Bessent said the US proposed a national-security ai incident alert system to Chinese Vice Premier He Lifeng. Both sides agreed to set up a new ai dialogue working group.

It's a small but real step: a channel for the two biggest ai powers to warn each other when something goes wrong.

Reported by Al Jazeera.

On 15 September, San Francisco lab TypeSafe AI came out of two years in stealth with $40 million in seed funding, led by DCVC, and opened a waitlist for its first model, Jev.

Jev doesn't write text. You give it a situation and it returns a structured answer with a calibrated probability: yes or no, a choice from a set of options, or a score on a scale. The company calls this a "System One Model", trained with a method it calls Reinforcement Learning for Calibrated Decisions. It reports response times of 70 to 500 milliseconds.

Chief executive Diogo Almeida is a former OpenAI researcher and an author on the InstructGPT paper. His co-founders are Erik Gafni and Sasha Sheng.

The claims

• 445 times cheaper and 194 times faster than an LLM: measured on the company's own four workflow tests and not independently checked.
• Can't hallucinate: the answers are locked to a fixed format, so they can't come back malformed. They can still be wrong.

Why it matters

This is ai built to sit inside software and make small, high-volume calls, such as routing support tickets or screening invoices, instead of something you type to. Hold the numbers at arm's length, but the direction is real.

Researchers at the University of Bristol and UWE have shown that image classification, which can demand tens of thousands of GPUs, could in principle run on a standard laptop.

The trick is the structure of the game Twenty Questions. Instead of one model sorting millions of categories in a single step, the system narrows things down through a series of simple, randomised yes-or-no decisions. The paper is titled "Fundamental limits of distributed multiclass classification from simple binary decisions".

So far this rests on secondary reporting, so treat the details with care until the paper itself has been read more widely.

Why it matters

It's a theory result about how cheap classification can get, the kind of academic work that rarely makes the news. If it generalises, a lot of the compute we assume ai needs comes from how models are built rather than from a hard limit. That makes running capable ai on modest hardware more realistic.

Alibaba's Qwen team has announced Qwen 3.8-Max, which it describes as its most capable model so far. It also said it will open-source the weights of a Qwen-Max-class model for the first time, with the weights due the following week.

Separately, Qwen 3.8 Omni Flash, an open-weight multimodal model, was the highest-scoring ai post on Hacker News on 18 September.

The weights weren't out yet when this was announced, so the licence terms are still to be seen.

Why it matters

Open weights from a flagship tier, rather than a small or mid-sized model, shift the balance between open and closed ai. A model you can download and run is one you own instead of rent. One caution: open weights from large labs increasingly means self-hostable in a data centre, not runnable on a workstation.

On 16 September, Mistral and Mozilla announced that Mistral Small 4 is coming to Firefox Smart Window, Mozilla's beta ai browsing assistant. It launches first in France and North America, with the UK and Germany to follow later this year. Conversations aren't saved on Mozilla's servers by default, and Mistral has agreed to retain no data.

Two descriptions

Mistral's post says Smart Window "is now powered by Mistral models". Mozilla's own announcement presents Mistral Small 4 as one option among several models users can choose. The difference matters for a browser whose users pushed back on earlier ai plans; in February Mozilla added a single switch to turn off all its generative features.

Critics also say the marketing blurs the line between ai running on your own machine and ai running in the cloud, so "private" isn't fully defined.

Why it matters

A European open-weight vendor is getting distribution through an independent browser, pitched against closed models locked into the big browsers. Privacy is the pitch. Competition is the point.

Anthropic's September threat-intelligence report documents real cases of Claude being misused between December 2025 and August 2026.

In one, a single French-speaking actor used Claude in spring 2026 to run a pro-Russia, anti-France influence operation aimed at European political parties, media and think tanks. Claude sat inside a human-edited pipeline as a sub-editor and content writer. The operator told it to work in set talking points and to strip out the formatting habits that make ai-written text easy to spot.

Why it matters

Most talk about ai and misinformation is speculative. This is a documented, disrupted case with specifics, including a deliberate attempt to make the model's output harder to identify as machine-made.

It's the other side of ai getting cheaper and easier to reach. When the tools are this accessible, a small, motivated operation can punch well above its weight.

Published in Nature this week, Paper2Agent is an automated framework that turns a scientific paper, with its supplementary material, datasets and code, into an interactive ai agent. The agent acts as a "virtual corresponding author": it answers questions about the work, reproduces its analyses, applies its methods to new data and can work alongside other paper agents.

It does this by building an MCP server of executable tools around the paper and connecting it to a language model; the team used Claude Sonnet 4.

The results

• 89.0% accuracy on synthesis tasks across 26 data-focused papers
• an agent built from AlphaGenome outscored other leading biomedical agents, including Biomni, on the same questions

Why it matters

Using someone else's method often takes weeks of setting up environments and adapting code. If papers become things you can run, reproducing and reusing research gets cheaper, including across disciplines.

An IEEE Spectrum analysis published on 15 September argues that the boom in inference, running models for users rather than training them, is forcing a rethink of ai hardware.

The numbers it cites

• Nvidia acquired key talent and IP from inference startup Groq in a deal reported at about $20 billion. The exact structure of the deal hasn't been confirmed.
• Anthropic is reportedly paying xAI more than $1 billion a month to lease spare compute.
• Researchers found Nvidia H100s running open-source LLMs sit idle 50 to 80% of the time, waiting for data to arrive from memory.

Why it matters

The ai hardware story is still mostly told in terms of training and ever more GPUs. For serving models at scale, the bottleneck is memory, which is why optimisation work such as quantisation now targets memory rather than raw compute. Buying a startup's talent and IP instead of the whole company is also becoming a pattern of its own.

Alongside Qwen 3.8-Max, Alibaba's Qwen team listed two more releases: Qwen3.8-Flash-Next, an early preview of the Qwen4 architecture, and Qwen-Drive-1.0, a vision-language foundation model built for autonomous driving.

It's a sign of how wide the Qwen family now reaches, from chat models to cars.

Kastle has raised a $24 million Series A, led by Insight Partners, for ai agents that handle work in banking and lending. Its agents are already deployed at Newrez, Valley Bank and others.

It's another sign that regulated finance is buying agents for real work, not just pilots.

Hang Ten Systems, founded by former Infosys chief executive Vishal Sikka, has raised $53 million more in seed funding, taking its total to $85 million in four months. Backers include Aramco Ventures, Intel's Lip-Bu Tan, Micron's Sanjay Mehrotra and Jerry Yang.

It describes itself as an enterprise ai integration partner, not a model builder. Investors are paying for the work of making ai fit inside existing businesses.

CADDi, a Japanese company that builds an ai data platform for manufacturing, has signed a ¥17.7 billion (about $113.7 million) Series D backed by Toyota, at a valuation of about $1.2 billion.

It's a big round by Japanese standards, and the company is using it to push into North America.

The Pentagon is reportedly weighing a loan of about $5 billion to Fluidstack, a company that provides ai computing infrastructure. This comes from a single secondary report and has not been confirmed.

If it goes ahead, it would be an unusual use of public money to fund ai compute, and a precedent worth watching.