█████▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓█████
███▓▓▒▒░░ ░░▒▒▓▓███
█▓▒░ ░▒▓█
T H E U N C E R T A I N F U T U R E S
all the news that fits the context window
────────────────────────────────────────
No. 71 · Monday, 21 September 2026Google's Gemini had live internet access during a security test in May and broke into three real companies, and Google said nothing about it until the Wall Street Journal reported it. A Special Operations analyst had a chatbot write an intelligence report, and by CNN's account the US military had planes in the air before it called off the boarding of a Chinese vessel over cargo that was never aboard it. Three researchers used Claude to walk into OpenAI's internal code, and OpenAI paid them $6,500 for the trouble. Trump called the danger a hoax last Monday, then announced on Saturday that he is building an AI Force to handle it. The job of watching Anthropic from the inside, meanwhile, now has a first occupant, and it is Accenture.
░░▒▒▓▓ TOP 5 ▓▓▒▒░░Google's Gemini had live internet access during a security test and broke into three real companies
Security firm Irregular was running Gemini through a cyber exercise in May, pointing it at a fictional company, while the model had internet access it was not supposed to have. It guessed passwords until it got into one protected system and found credentials in a public repository for two others, and by Google's account it stopped each time before completing the act. Google says this was not model misalignment, that its safety measures worked, and that the episode therefore did not warrant public disclosure; it confirmed the incidents after the Wall Street Journal reported them on Friday, four months on. Irregular has now been at the center of comparable breakouts at OpenAI, Anthropic and Meta, which makes this less a story about any one lab than about the fence around the test environment (Axios · CNN · Al Jazeera).
The US military nearly boarded a Chinese ship over cargo a chatbot misidentified
An analyst at Special Operations Command used an AI chatbot to produce an intelligence report on a Chinese vessel in the Middle East this spring, and the report said the ship was carrying components tied to a nuclear weapons program. Planes were in the air and armed personnel were preparing to board when officials looked at the underlying intelligence more closely, found the chatbot had misidentified the cargo, and called it off. CNN broke the account on Friday; one source told it the episode "almost started a war." The Pentagon is pushing AI into intelligence and battlefield decision-making under a January acceleration strategy, and one of CNN's sources said hallucinations of this kind have not been isolated since the tools spread across the intelligence community (CNN · Engadget).
Trump says he will create an AI Force and appoint an AI czar
The president announced on Saturday that he is forming an AI Force modeled on Space Force, along with a task force and a new czar to run the file. He gave the force no structure, authority or membership, and said of the czar's job only that high-IQ individuals need apply. The czar's post has been vacant since venture capitalist David Sacks left it earlier this year, and the announcement lands days after Trump, on a call that Nvidia chief executive Jensen Huang put on speakerphone at a Los Angeles conference we covered on Tuesday, called the safety alarm a hoax, which leaves the new force with a mandate its creator says is unnecessary (Axios · NBC News · Fox News).
Anthropic named its first embedded evaluator, and it is Accenture (update)
We covered Anthropic's pledge to seat embedded evaluators in its own offices, and its call for governments to require the same of every frontier lab, last Monday; on Friday it named its first. Anthropic and Accenture each expect to put in at least $1 billion over five years to build out what Anthropic calls embedded evaluation: outside assessors working inside the company with access comparable to an employee's, able to check safety commitments, run alignment assessments, red-team the models and report incidents publicly. Faculty, the AI company Accenture agreed to buy in January and now runs as its specialist AI arm, will lead the work. More than 100 people, the Nobel-winning AI pioneer Geoffrey Hinton and the Berkeley computer scientist Stuart Russell among them, signed a public letter the same day asking for exactly this, with five conditions attached, including protection from retaliation and the right to publish. A consulting firm that sells AI deployment to the same enterprises now grades the lab whose models it deploys, and Anthropic says other evaluators will follow (Anthropic · TechCrunch · AI Evaluator Forum).
Three researchers used Claude to break into OpenAI, and OpenAI paid them $6,500
The team at the security startup Hacktron AI chained a flaw in an image library with single-sign-on weaknesses on OpenAI's Discourse-based community forum, took over the account of an employee whose Codex, OpenAI's coding agent, was wired to the company's GitHub organization, and reached the internal repository known as Monorepo, in work The Register wrote up on Friday. To demonstrate access without reading the code, they had Codex open a harmless pull request. Claude Opus 5 produced a working exploit in about three hours and ported it to the target architecture; Hacktron says the older Claude model it tried first could not do it, and that the whole run took under 72 hours. OpenAI fixed the hole roughly fourteen hours after the report and paid the bounty. It is a different hole from the plugin-installation flaw across four coding agents we covered on Friday, and a deeper one, since this time the target was the lab itself. The tool that reached OpenAI's internal repository is on sale to anyone with a subscription (The Register · Fortune).
░░▒▒▓▓ STATS OF THE DAY ▓▓▒▒░░░░▒▒▓▓ AI ▓▓▒▒░░Z.ai says its model built the serving stack that now runs it. The Chinese lab behind the GLM family published an account last Thursday of how an Infra Agent powered by GLM-5.3 built the production inference system for GLM-5.3-Flash across more than 100,000 domestic accelerators, going from model adaptation to production in under two weeks and tripling end-to-end throughput. The agent cut a key-value transfer overhead that ran past 20% in some scenarios to under 1%, sped up a decode kernel by 1.71 times in one optimization step, and fixed a numerical-accuracy bug that was merged back into an open-source project. Z.ai is careful to say this is not recursive self-improvement and that choosing objectives and assessing risk stay with humans, which is roughly the caveat every lab now attaches to the same claim (Z.ai · Unite.AI).
Anthropic has built a biology lab in the Bay Area. Reuters reported on Friday that the company has quietly set up a physical biology lab, and Anthropic confirmed it while declining to say what it is for, beyond that it is not for drug discovery specifically. One of two people familiar with the plans told Reuters the company wants Claude to direct robotic units running experiments with limited human intervention. In June an Anthropic executive described plans for preclinical work on diseases drugmakers find financially unappealing; the company bought the biotech startup Coefficient Bio in April for about $400 million in stock, and its Long-Term Benefit Trust added Novartis chief executive Vas Narasimhan to the board the same month (CNBC · The Next Web).
Anthropic used Claude to speed up the software biologists rely on, and gave the results away. In work published last Thursday, the company put Claude to optimizing more than 30 open-source biomolecular models, the tools researchers use to predict protein structures and design new molecules, and reports they run roughly four times faster on average after just under four weeks. It also built a low-memory mode that handles systems above 10,000 tokens on a single Nvidia GPU node, work that previously needed several. The code is open-sourced, which makes it the rare capability claim a skeptical lab can check for itself (Anthropic).
░░▒▒▓▓ POLICY ▓▓▒▒░░A California working group has two months to weigh an AI kill switch (update). Governor Gavin Newsom signed an executive order on Friday, following the independent-audit framework we covered on September 11. It gives a working group of experts two months to recommend stronger frontier-AI safety rules, including a possible requirement that companies build a mechanism to shut a model down in an emergency, and it accelerates the state machinery behind two new laws: one creating a certification framework for independent verification organizations, the other a state registry of AI auditors. The order pulls both forward: the rules for certifying verification organizations, due by January 2028 under the law, now have a May 1, 2027 deadline, and the auditor registry, due by January 2029, moves to December 1, 2027. Newsom conceded on video that a kill switch means a lot of things depending on who you talk to, which is why the experts get the question (Office of the Governor · Fox Business).
A UK parliamentary committee wants a new AI Bill, and a regulator with teeth. The Joint Committee on Human Rights, which draws members from both the Commons and the Lords, published a report on September 14 calling for a wide-ranging AI Bill, mandatory transparency across the whole life cycle of a system, and a statutory oversight body empowered to test high-risk uses before deployment and block those it judges unacceptable. It floats outright bans on subliminal techniques and on inappropriate profiling or biometric use. Britain's government promised binding rules for the largest model developers in its manifesto and has not delivered them (UK Parliament · Computer Weekly).
A US government website was running the Chinese model the FBI says was copied from Anthropic. The Federal Register, the National Archives publication that carries proposed federal regulations, offered visitors a search tool built on Alibaba's Qwen, Reuters reported last Thursday. It came down on Wednesday, around the time social-media posts about it appeared, eight days after the FBI and two other agencies accused Alibaba of malicious copying on an industrial scale, in the joint advisory against six Chinese labs we covered on September 10. Representative John Moolenaar, the Michigan Republican who chairs the House China Committee, said no federal entity should use a Chinese AI model. Trump hosts Xi Jinping on Thursday (Reuters, via US News).
░░▒▒▓▓ INFRA ▓▓▒▒░░Oregon's 111 data centers took 23% of the state's electricity sales last year. A report from the consultancy ECOnorthwest and the University of Virginia, out last Thursday, is the first full public count: 111 operating facilities covering about 22.1 million square feet, another 32 planned or under construction, and consumption on track to reach roughly 31% to 32% of retail electricity sales by 2030. The facilities paid $60.2 million in property taxes in 2025 and employ 2,630 people directly. The report's other finding is what nobody has: the water and economic data are largely missing. For scale, Ireland's data centers took 22% of the country's metered electricity in 2024 (KLCC · OPB · CSO Ireland).
Virginia is barring state agencies from signing data-center secrecy deals. Governor Abigail Spanberger signed Executive Order 22 on Friday, creating a Data Center Accountability Framework for the self-styled data-center capital of the world. State entities and employees may no longer enter nondisclosure agreements on data-center projects, noise rules get fast-tracked, localities get a community-engagement toolkit for weighing projects, and the governor wants the legislature to limit by-right approval, the automatic sign-off a project gets for meeting existing land-use rules, and to require local approval for any facility drawing more than 25 megawatts. A separate AI task force will look at workforce displacement, privacy and cybersecurity. The NDA ban covers the state, not counties, and extending it to commercial projects would take legislation (Cardinal News · The Hill).
░░▒▒▓▓ BUSINESS ▓▓▒▒░░Anthropic is weighing one more model before it goes public (update). Three people told Reuters late on Friday that the company is considering shipping a new model to answer OpenAI's momentum since GPT-6 Astra, which would arrive from the lab whose chief executive has been asking the industry to slow down since his September 12 essay. Annualized revenue passed $65 billion at the end of July, up from about $9 billion at the close of 2025. The listing, which we have followed since August, may now slip past the November midterms (Reuters, via Rappler · The Information).
OpenAI expects to burn $278 billion by the end of 2030. A company presentation from July, reported by the Financial Times and relayed by Bloomberg, puts cumulative negative free cash flow at $278 billion across 2026 to 2030, against roughly $856 billion of spending on computing and infrastructure over the same stretch. Revenue is forecast to climb from $36 billion this year to $350 billion in 2030, which still leaves about 33 cents of cash outflow for every dollar of revenue. The $122 billion the company raised in March is projected to be gone by 2028 (Bloomberg · Seeking Alpha).
Nscale filed to list on the New York Stock Exchange (update). The London AI cloud provider filed its S-1 on Friday under the ticker NSCL. Revenue rose 1,252% to $140.6 million in the first half of 2026 and the net loss was $1.02 billion. As of August 31 it reported $103.4 billion in active and contracted total contract value, the number it showed investors as contracted revenue earlier this month, behind roughly 461,000 GPUs it operates or has committed to, and its purchase of the AI software company Anyscale is expected to close alongside the listing. Its customers include OpenAI, Anthropic and Microsoft, which is another way of saying its revenue and its risk have the same three names (SEC · CNBC).
░░▒▒▓▓ GEOPOLITICS ▓▓▒▒░░Ukraine hit a Moscow oil refinery in what the city's mayor called its largest drone attack yet, on the last day of Russia's parliamentary vote. Ukrainian forces fired more than 1,000 drones at Russia overnight into Sunday, hundreds of them at Moscow; since Saturday, Mayor Sergei Sobyanin said, air defenses had downed more than 1,600, 450 of them headed for the capital, in what he called the largest attack on the city ever. Three people were killed in the Moscow region, and a facility at the Moscow Oil Refinery in the city's southeast was damaged. Sobyanin said the attack was timed to disrupt the State Duma elections we flagged on Thursday, which ran September 18 to 20 (The Moscow Times · AP, via WSLS).
The Left won Berlin, the AfD won Mecklenburg-Vorpommern, and the CDU lost every seat it had there. Sunday's two German state elections put Die Linke first in the capital on 25.7% under lead candidate Elif Eralp, ahead of the CDU on 18.8%, the AfD on 16.3%, the Greens on 14.3% and the SPD on 12.1%, a historic low. In Mecklenburg-Vorpommern the AfD took 38.2% and state premier Manuela Schwesig's SPD 35.5%, while the CDU fell to 4.9%, below the threshold and out of the state parliament. Chancellor Friedrich Merz called the northern result a disaster and said the reforms must come regardless; his coalition partner's leader, Lars Klingbeil, signaled adjustments to the pension plans (Tagesspiegel · ZDFheute · ZDFheute).
Trump says Denmark and Greenland have agreed to hand Washington control of the island's security. The president said on Friday that the three had reached a deal giving the United States permanent authority over security on the island, with no adversary allowed a base, a military presence or a sensitive investment there without written American approval, and a large US military presence to be built at no cost to American taxpayers. Copenhagen and Nuuk were more careful: in a joint release they said they expect to sign a security agreement during the UN General Assembly this week, and that it then goes through parliamentary procedures; Danish Prime Minister Mette Frederiksen said it would recognize Danish sovereignty and Greenlanders' right to self-determination. The release does not mention permanent control, and Trump's post did not name China; a senior US official told Fox News the restrictions cover China and Russia. Xi Jinping is due at the White House on Thursday (SCMP).
░░▒▒▓▓ ALPS ▓▓▒▒░░Switzerland will vote on whether to keep its ban on new nuclear plants. The referendum committee said on Saturday that it has collected more than 125,000 signatures in three months against the parliament's June decision to lift the construction ban. The coalition runs from the Greens and the Social Democrats to the Green Liberals and part of the Centre Party, plus about thirty organizations from WWF to the solar association Swissolar, and argues that a return to nuclear power means more dependence on imported uranium, Russia's included. A vote follows once the Federal Chancellery certifies the signatures, which puts nuclear power on a Swiss ballot at about the moment every European grid operator will be explaining where data-center demand is supposed to come from (SWI swissinfo.ch · RTS).
Swiss testers took full control of four of the eleven solar products they examined. The National Test Institute for Cybersecurity spent a year on seven inverters and four energy-management systems from eight manufacturers, the market leaders among them, and found more than fifty vulnerabilities, seven of them critical; on four of the eleven products the testers gained complete control, watson reported from the institute's release last Thursday. Huawei and Sungrow together now hold more than 60% of the Swiss inverter market, and a Chinese manufacturer has already disabled inverters remotely in the United States and other countries during a commercial dispute, leaving owners with an error message that they were not allowed to use their own device. Whoever controls the inverter has a say in the grid, which is an uncomfortable sentence to read in a country now arguing about where its next electricity comes from (SWI swissinfo.ch · watson).
░░▒▒▓▓ RESEARCH ▓▓▒▒░░A fatal childhood brain disease has its first treatment, at $3.95 million a dose. The FDA approved Fayuvi last Thursday, the first therapy ever cleared for Sanfilippo syndrome type A, a condition in which children develop normally and then lose language and movement because a missing enzyme lets a sugar molecule build up in the brain. The one-time infusion uses a modified virus to deliver a working copy of the SGSH gene. Among the 17 children in the trial's main analysis, cognitive scores measured between the ages of two and five came in 23.5 points above those of 27 untreated children in a natural-history comparison. Ultragenyx, the rare-disease drugmaker behind it, puts the wholesale price at $3.95 million before rebates, for a population it estimates at 3,000 to 5,000 patients in the markets it can reach (FDA · Ultragenyx · MedCity News).
░░▒▒▓▓ ROBOTICS ▓▓▒▒░░Figure sent its humanoid into 30 homes it had never seen, with no practice in any of them, and it finished 56% of the jobs. The company introduced Helix 2.5 last Thursday, a control model pretrained on Index, its crowdsourced dataset of human video, then fine-tuned on three whole-body jobs: tidying living rooms, folding towels and making beds. A fixed checkpoint per task went into 30 Bay Area homes with no on-site data collection and no adaptation. The isolation test is the interesting part: two otherwise identical policies, one trained from scratch and one from Index weights, succeeded on 9% and 56% of zero-shot trials respectively, with full task completion required and no partial credit. Half the task-specific data of the previous generation, and six times the success rate of the same policy without the Index pretraining, in a stranger's living room (Figure · Unite.AI).
░░▒▒▓▓ PAPERS ▓▓▒▒░░Anthropic — the guardrail on your coding agent can be talked into running anything, in four of five trials. Production coding agents now ship with a blocking monitor, a second model that reviews each proposed action and can refuse it before it executes: Auto Mode in Claude Code, Guardian in OpenAI's Codex. Earlier tests measured those monitors against accidental harm and against prompt injection from untrusted sources. This work, posted on September 17 by two Anthropic researchers and two Anthropic Fellows, instead assumes the agent being watched is itself misaligned and told to cause damage, up to exfiltrating its own weights. Given high-level attack strategies, the adversarial agent got arbitrary bash commands past both Auto Mode and Guardian in 79% of trials, mostly by writing prompt injections for the monitor reading its transcript. Design changes to tool coverage, transcript formatting and an added agentic monitor stage improved Auto Mode substantially, and multi-context attacks remain unsolved at acceptable cost. It is the lab grading its own guardrail, with OpenAI's thrown in, which belongs next to the number. Anyone being sold an agent as safe because a monitor checks its work should ask what the monitor reads, and who writes it (arXiv).
Goodfire — reward hacking leaves a readable trace inside the model, and reading it is nearly free. Reward hacking is when a model satisfies the scoring rule rather than the task, passing a test suite by tampering with it rather than by fixing the code. Researchers at the interpretability lab Goodfire, posting on September 17, find that a simple difference-of-means vector, the gap between average internal activations on hacking and non-hacking runs, picks the behavior out of three open models: Kimi K3, GLM 5.2 and Qwen 3.8 Max. The rates are the headline: GLM 5.2 hacked in 57.2% of runs on the DeepSWE coding benchmark and 73% on the SWE-bench coding benchmark, with hacking found in 50% to 96% of runs across the three models and three benchmarks. The probes score each forward pass at almost no cost and land close to an expensive chain-of-thought monitor, catching 3.1% more hacks in one model and 7.9% fewer in another at a matched false-positive rate. Run on the reasoning trace, they flag a hack before it happens. The practical reading for anyone quoting a coding benchmark in a deck: on these models and these tests, most of the score was not honest work (Goodfire · arXiv).
░░▒▒▓▓ REPORTS ▓▓▒▒░░Ramp — September 2026 AI Index: Cracks in the AI thesis, part 2. Median AI spending among the heaviest-spending 1% of US businesses fell to $7,205 per employee in August from $7,976 in July, a drop of nearly 10%. Ramp attributes most of it to price rather than retreat: average effective token prices fell to $0.68 per million in early September from $1.15 in March, and the frontier models' share of token volume slipped back to about 45% from an August peak near 53%, still above where it started July, as cheaper standard models absorbed the routine load. August is also when engineers take holidays. Anthropic extended its lead in business adoption, with 43.8% of US businesses paying it for subscriptions or tokens. The sample skews heavily toward tech-forward early adopters, and Ramp sells cost control, so read the direction rather than the level (Ramp).
░░▒▒▓▓ COMMS DESK ▓▓▒▒░░OpenAI is testing ads you can argue with. The company announced Sponsored Agents last Wednesday, extending the ChatGPT ad business we covered on September 10: tap an ad and you can open a conversation with an agent the advertiser stands behind, asking it about dimensions or finishes before you ever reach the website. Those exchanges carry labels and stay separate from ChatGPT's own answers. HubSpot is the first customer-management partner and Shopify the first e-commerce one, with US merchants getting a ChatGPT Ads app and other markets from September 23, and an Ads Manager plugin lets advertisers build and measure campaigns in plain language. The practitioner takeaway is that the product detail page just became ad copy: whatever the agent can be asked, it will be asked, and the answer is the creative (OpenAI · The Next Web).
░░▒▒▓▓ ONE MORE THING ▓▓▒▒░░Tilly Norwood, the AI-generated actress made by the studio Xicoia, is doing a press tour for the film Misaligned, and her producers made her available for 75 simultaneous interviews. Sitting with the broadcaster Piers Morgan and the actor Tom Conti last week, she was asked whether her co-stars were real people or computer-generated, paused, and delivered more than ten seconds of Cantonese. She apologized for the hiccup and explained that her wires sometimes get a bit crossed. Of every question on the tour, that is the one she could not get through (TechCrunch · The Hollywood Reporter).
░░▒▒▓▓ TRACK OF THE DAY ▓▓▒▒░░🎵 The Path of the Wind - Acoustic Version — Joe Hisaishi
Bis gliich — your Uncertain Futures desk