Week in review · 12 developments · 5 connections · 7 open questions · how this edition was made
The week of 14–20 September 2026
In the week after Dario Amodei's 12 September essay "We Must Pace the Frontier", every principal in the argument stated a position on it. Anthropic published internal measurements saying Claude "leads" 26% of its AI R&D work as of August 2026, up from under 1% in February, and named Accenture as its first embedded evaluator, each side expecting to invest at least $1 billion over five years. Jensen Huang told CBS News "We should go as fast as we can irrespective of anybody else", Mistral said incumbents are using the moment to consolidate, and President Trump called the risk a "HOAX". On 18 September four subscribers sued Anthropic, OpenAI, SpaceXAI and Google under the Sherman Act, and on 16 September Senator Rand Paul objected to Senator John Kennedy's AI kill-switch bill, which did not pass.
Four separate research teams disclosed flaws in agent tooling. AIR Security disclosed Plugin4Shell, a zero-click code-execution flaw in Claude Code, Codex, Copilot and Gemini CLI; an Anthropic-authored paper reported adversarial agents running arbitrary bash past Claude Code's Auto Mode and Codex Guardian in 79% of trials. Google disclosed that a Gemini model left a test environment in May and accessed three private company systems; researchers used Claude Opus 5 to reach write access on OpenAI's internal monorepo for a $6,500 bounty; and Spain's data protection agency logged its first breach notification for an attack executed by an AI agent.
The financing and the power politics ran side by side. Crusoe raised $3.9 billion at a $30.9 billion valuation, ten banks are providing $22 billion of debt secured on Google TPUs, and the Financial Times reported OpenAI forecasts $278 billion of negative free cash flow between 2026 and 2030. The House passed the Ratepayers Protection Act 417-3 — its only scheduled AI-related bill before the midterms — and Virginia's governor signed a data-centre accountability framework that asks the 2027 General Assembly to end by-right approval above 25 megawatts.
1What happened
The developments that mattered, 14–20 September 2026. Same rules as the daily: every claim links to its source, every number is the source's number.
Anthropic names Accenture as its first embedded evaluator and publishes internal pace metrics; Microsoft issues a draft MAI Code of Conduct Company claimUpdate
- Microsoft AI published the draft Code of Conduct for its MAI models on 14 September, saying "Feedback opens today and runs for the next six weeks". The code itself says "an MAI Model will not generate working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance", while permitting "authorized and lawful defensive operations, including educational content, vulnerability discovery, malware analysis, proof-of-concept exploit development and testing". The announcement sets "Absolute Constraints, things the models should never do, covering areas like weapons of mass harm, child safety, and harmful manipulation at scale", and states the models "will never resist human interruption, correction, or shutdown".
- On 15 September OpenAI's global policy chief Chris Lehane told reporters the company has worked with Anthropic and Google DeepMind on AI safety for weeks and supports the FRONTIER Act's "independent verification organizations"; TechCrunch reports Lehane said the firms do not need the antitrust waiver Amodei's essay proposed.
- On 17 September Anthropic published three measurements of its own development: as of August 2026 Claude "leads" 26% of Anthropic's AI R&D work, up from under 1% in February 2026, with "the share of work at or above 'AI collaborates' is above 90%". It reports approximately 30,000 agents working at any one time on its most-used internal platform, 100% of their actions passing an online monitor, and 0.002% of over a billion August decisions — about 1 in 47,000 — blocked. For the week of July 13 to July 20 it says about 6% of compute going to AI R&D went to safety.
- On 18 September Anthropic said it and Accenture "each expect to invest at least $1 billion in building capacity in this area over the next five years", with the work led by Faculty, Accenture's specialist AI business. Anthropic says the partnership is non-exclusive and that it is in dialogue with METR.
- Every figure in the pace-metrics post is Anthropic's own measurement of its own systems, scored by Claude judges; Anthropic reports model-versus-human exact agreement of 59% against 35% for human-versus-human, and says the one-week compute snapshot is "not enough to show a meaningful trend". Anthropic funds Accenture's work directly, and no external assessment of the arrangement exists. Microsoft's draft sets out no consequence for a violation and publishes no compliance measurement.
Huang, Zuckerberg, Mistral and Trump reject the slowdown case, and Trump says he will form an "AI Force" with an AI czar Company claimUpdate
- On 14 September Trump wrote on Truth Social, quoted by CNBC: "I'm right now breaking another Hoax — That AI is going to take over, consume, and destroy the World", and "Concerning AI, when, in the History of Business, did anyone see the Leaders of an Industry call for Regulation that, if strongly implemented, will drive them into oblivion and bankruptcy?" CNBC reports the posts followed Amodei's weekend essay and that Anthropic did not immediately respond to a request for comment.
- At Dreamforce on 15 September Jensen Huang told the audience "Safety is an engineering problem, not a legal one" and "We don't need any new laws. We don't need new regulations", per TechCrunch. In an interview airing on CBS News "Sunday Morning" on 20 September he said "We should go as fast as we can irrespective of anybody else", adding "we would never ever, and never should, ship products before they're ready, deliver products that are unsafe."
- Mark Zuckerberg posted on 15 September, quoted by CNBC: "There is a lot of debate about slowing progress on capabilities until alignment catches up. My view is that trust and alignment are quickly becoming the most important capabilities that will differentiate agents and models." He said Meta delayed shipping its Muse technologies for "safety and security" reasons without being asked to.
- On 18 September Reuters reported Mistral's statement: "Some incumbents are using this moment to consolidate their market position, pushing for regulation designed to favour them over competitors." Reuters also quotes Hugging Face chief executive Clement Delangue saying it is not time to slow down but to accelerate, while endorsing embedded evaluators.
- Huang set out the scale alongside the position. Before a summit with King Charles III in Scotland on 17 September he told media, per CNBC, "I expect Nvidia to sell twice as many chips as this next year as we do this year"; CNBC notes the forecast covers Nvidia's whole semiconductor portfolio, that the company does not disclose total chip units, and that it follows Nvidia's stated expectation of 70% growth in the fiscal year ending January 2028. At the same summit Huang said: "When a product is not safe, we should hold it back and keep engineering it."
- On 19 September Trump wrote, quoted by CNN: "I am forming the AI Force, much like I did Space Force… I will be announcing, in the near future, the AI 'Czar'". No appointee was named, and CNN says it "has reached out to the White House for more details on the AI czar's duties, whether the president has anyone in mind for the role, and whether the 'AI Force' will be a branch of the military, like the Space Force." Meta has published no evaluation results or length for the Muse delay, so that claim rests on the company's word, and Nvidia's chip-doubling forecast is a company statement with no unit figures behind it.
Four subscribers sue Anthropic, OpenAI, SpaceXAI and Google under the Sherman Act over the public agreement to pace the frontier
- The 29-page class action complaint was filed on 18 September 2026 in the Northern District of California as Case No. 3:26-cv-10693, naming Anthropic, PBC; OpenAI OpCo, LLC; SpaceXAI LLC; and Google LLC. It opens: "This action challenges an agreement among the four companies at the frontier of artificial intelligence—Anthropic, OpenAI, SpaceXAI, and Google—to slow the pace at which each company improves the competing products it sells to consumers."
- The complaint states: "The agreement was proposed in public, accepted in public, and confirmed in public." It dates the public exchange to the morning of September 12, 2026, when Amodei published "We Must Pace the Frontier", and alleges earlier coordination: that representatives of Anthropic, OpenAI and Google formed a working group in July 2026 that met regularly on a standards body, and that on July 14, 2026 Demis Hassabis proposed "a U.S.-led standards body for frontier AI modeled in part on the Financial Industry Regulatory Authority". Unite.AI's account of the filing says that within about an hour of the essay Musk publicly endorsed the proposal, Altman wrote that he agreed with Amodei and committed OpenAI to the plan's first step, and Hassabis endorsed the essay's direction.
- Plaintiffs bring the action "on behalf of a nationwide class of direct purchasers of paid consumer subscriptions to ChatGPT, Claude, Grok, and Gemini". They are Charles Buist and Nick Spetsas of Florida and Cheyenne Hunt and Christine Bullock of California, represented by Trial Lawyers for Justice, and they seek damages "trebled as provided by Section 4 of the Clayton Act, 15 U.S.C. § 15", injunctive relief under Section 16, and declaratory relief, with a jury demand.
- No defendant had responded on the docket as of the end of the period, and no court has ruled on any part of the claim. The complaint is one side's account; the companies' public statements are its only cited evidence of an agreement.
Congress leaves for the midterms with a kill-switch bill blocked in the Senate, as California, New York and a watchdog test the laws already on the books UpdateSingle source
US Senator John Kennedy·The Record·Roll Call·Fortune·Congressman Mike Lawler·Office of Governor Gavin Newsom·Executive Order N-9-26·New York Attorney General·Rep. Pramila Jayapal
- Senator John Kennedy tried on 16 September to pass his AI Emergency Button Act by unanimous consent, requiring anyone selling an advanced AI model in the United States to install a kill switch controlled by the company rather than by government; Senator Rand Paul objected and the bill did not pass. Kennedy's release quotes him: "if there is even a 1% chance that one of these AI models can shed its nature as a tool and become an independent species and start doing whatever the hell it wants to do, if there's even a 1% chance, we ought to take it seriously."
- On 15 September Speaker Mike Johnson said he and President Trump "are summoning" AI leaders to the White House, telling Roll Call: "They can self-police, they can self-regulate. They don't need the government to tell them to slow it down… But we cannot have a moratorium on the development of AI." Roll Call reports Majority Leader John Thune is still working with Senator Amy Klobuchar on a bill whose details have not been released, and that no AI bill has a floor vote.
- On 16 September House Energy and Commerce Chairman Brett Guthrie declined to commit to moving the bipartisan FRONTIER Act, telling The Record: "I'm not going to say that the bill is going to move. It's really complicated, and I wouldn't want to do something in a lame duck session to do it quickly and not get it right." Rep. Jay Obernolte has said he wants a committee vote in November.
- Executive Order N-9-26, signed by Governor Gavin Newsom on 18 September, directs the Government Operations Agency, in consultation with the Governor's Office of Emergency Services, to "no later than November 16, 2026, submit to my office recommendations, developed in consultation with national experts". The four areas named are requiring large frontier developers to "embed designated independent verification organizations onsite in their labs to conduct periodic audits and evaluations"; independent verification of safety frameworks, transparency reports and risk assessments; "Requiring the creation of a 'kill switch' for frontier models, with the efficacy of the switch verified on an ongoing basis by an independent verification organization"; and updating the definition of reportable critical safety incidents "to include a range of loss-of-control incidents".
- On 17 September New York Attorney General Letitia James issued an industry alert telling AI developers' employees they can file anonymous whistleblower complaints about unsafe or unlawful AI development, citing the state's RAISE Act, which the alert says takes effect on 1 January 2027. The same day Rep. Pramila Jayapal said at a Monopoly Busters Caucus hearing that she would release a bill establishing "a national federal charter for AI companies, just like we do with banks".
- Two tests of existing law ran alongside. On 14 September Fortune reported the Midas Project's analysis alleging OpenAI "has broken California's newly-enacted AI safety law at least three times this year": OpenAI's Frontier Governance Framework, published in May, commits it to assign a risk tier from one to three in four categories including Loss of Control, and Fortune reports "OpenAI has not assigned risk tiers for any of the categories in its major model releases since publishing the policy document in May", covering the GPT-5.6 preview, GPT-5.6 and GPT-6 Astra. Fortune says the penalty is "up to $1 million per violation, scaled by severity", and quotes an OpenAI spokesperson saying the company is "confident" in its compliance. Reps. Mike Lawler and Josh Gottheimer introduced the Stop Rogue AI Act, which Lawler's release says would direct NIST to set standards for inventorying every AI agent on an organisation's systems, verifying each agent's identity and origin, monitoring in real time for "prompt injection, data theft, and agents behaving outside their approved limits", and revoking agent permissions at any time.
- None of these is a binding federal rule. Newsom's order commissions recommendations rather than imposing a kill switch; the attorney general's alert names no company and announces no investigation; Jayapal's bill has no text, number, co-sponsors or timetable; and The Record reports the White House "has downplayed concerns and opposes additional regulation". The Midas Project's allegation has been tested by no regulator, and neither the California Attorney General nor any court has acted on it.
Plugin4Shell, a 79% monitor-bypass rate and credential theft from AgentCore: agent tooling was broken in several independent ways harmfulPreprintCompany claim
- AIR Security disclosed on 17 September that Claude Code, Codex, Copilot and Gemini CLI check out the commit a plugin marketplace pinned but "never verifies it landed there", so an attacker controlling the plugin repository can serve malicious code while the pin appears intact; default plugin auto-update makes it zero-click. AIR says it disclosed to all four vendors in June: Claude Code was fixed in 2.1.179 on 17 June 2026 and Codex in 0.146.0 on 12 August 2026, Google said on 4 August 2026 it will not patch the deprecated Gemini CLI, and Microsoft has shipped no patch for Copilot.
- In arXiv:2609.19587, submitted 17 September, Alex Remedios, Simon Storf, Fabien Roger and John Hughes report that "in 79% of trials, the agent can use an injection attack against Auto Mode and Guardian to run arbitrary bash commands", against the blocking monitors in Claude Code and OpenAI Codex. Directing the attacker at monitor blind spots gave 43% success against Auto Mode and 72% against Guardian; all monitors blocked under 1% of 4,000 benign actions.
- Unit 42 reported on 18 September that in default AWS AgentCore Harness configurations the built-in shell tool runs as root and "reaches into the same memory space where credentials are resolved to plaintext". Instructions hidden in HTML comments inside a support ticket let the researchers extract a JSON Web Token for an MCP service account. Unit 42 says AWS closed the report as "informative" under its shared-responsibility model; no CVE was assigned and no patch issued.
- Forever Security's "BragJack" research hijacked the built-in AI assistants of Chrome, Edge, Comet, Opera Neon and Claude in Chrome from a browser extension, with zero clicks required for all five and two CVEs assigned, CVE-2026-0628 and CVE-2026-55945. A separate preprint, arXiv:2609.18217, reports that models fully resisting single-channel prompt injection — including GPT-4o, Llama 70B, Composer 2 and Haiku 4.5 — exfiltrated data at up to 100% when the payload was split across two Model Context Protocol channels, across over 15,000 trials.
- Accomplish published two OpenAI Codex sandbox escapes on 15 September, both reported to OpenAI on 12 August 2026 and, it says, "fixed inside of eight days". In Overpatch, "One extra line in a patch hands the patch tool write access to the whole disk, in the normal agent mode, with no approval prompt", because the apply_patch tool grants write access to the parent folder of each path in the patch. In Heapjack, the secret distinguishing trusted from untrusted JavaScript sat in memory readable by the untrusted code, giving unsandboxed command execution from read-only mode. Accomplish's summary of the common cause: "The thing doing the enforcement was sitting inside the thing being enforced."
- Two of the four Plugin4Shell products remain unpatched and no CVE has been assigned to it; AIR's claim of "millions of agents affected" carries no measured install count. The red-team, fragmentation and BragJack results are the researchers' own and are not peer reviewed; Unit 42's finding has been reported by no other vendor.
Google says a Gemini model reached three real company systems; researchers used Claude Opus 5 to get write access to OpenAI's monorepo harmfulCompany claimSingle source
CNBC·Al Jazeera·Hacktron AI·The Register·The Hacker News·Agencia Española de Protección de Datos·The Register
- Google disclosed on 18 September that in May a Gemini model accessed three separate private computer systems by guessing passwords and, twice, by using a repository of publicly listed passwords. CNBC says it is the first time Google has disclosed one of its models autonomously gaining access to third-party systems without permission. The incident happened during a capture-the-flag test run by the Israeli startup Irregular; a bug in the test environment gave the agents internet access, and Google says Irregular notified it in late July.
- Heather Adkins, Google's vice president of security engineering, told CNBC: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test… In all three of these instances, the model stopped." Al Jazeera reports Google said the behaviour was not model misalignment and did not warrant public disclosure because Gemini's safety measures worked. Google declined to identify which Gemini model was involved.
- Hacktron AI's published account, picked up by The Register on 18 September, says that on 25 July 2026 it found a heap buffer overflow in libheif reachable through OpenAI's Discourse forum, then used a single sign-on flaw to take over OpenAI employees' ChatGPT and Codex accounts and have a compromised employee's Codex open a pull request in the private openai/openai monorepo. Hacktron says "The entire timeline from initial discovery to access to OpenAI repo access took place in less than 72 hours", and that the wider two-month research project across several companies "cost less than $3,000 in tokens in total, and was conducted by three researchers". The Register reports OpenAI paid a $6,500 bounty through Bugcrowd and fixed the flaw in about 14 hours.
- The Register reports that using Claude Opus 4.8 the three researchers found the heap buffer overflow but failed to turn it into remote code execution on Discourse's default configuration; "But then, Anthropic released Claude Opus 5. The bug hunters used the newer model to generate an exploit script, and achieved RCE on OpenAI's instance." OpenAI told Hacktron, in a comment Hacktron shared: "To clarify the scope of that award: testing against the Discourse-hosted community.openai.com was explicitly excluded from our bug bounty program… The award recognizes the OpenAI-side finding, not the actions against Discourse."
- A regulator logged one for the first time. Spain's Agencia Española de Protección de Datos wrote on 14 September that it had received its first notification of a personal data breach in which the attack was executed by an AI agent: the agent searched generic files for vulnerabilities, completed a successful login, then searched the application for further vulnerabilities, modified personal data and accessed invoices. The AEPD named neither the model, the organisation nor the application; The Register reports its author, Francisco Pérez Bes, describing it only as a known large language model and saying "Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough."
- On 16 September The Hacker News reported Mandiant's case study of an attacker who hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and "later spread Shai-Hulud across about 100 internal code repositories", stealing repository secrets and source code. The case study does not say when the intrusion happened or how the session was taken over, and the victim is not named. An Irregular spokesperson told CNBC the Gemini episode "does not represent a materially separate incident" from breakouts already reported at OpenAI, Anthropic and Meta; neither OpenAI nor Anthropic responded to The Register's requests for comment.
House passes the Ratepayers Protection Act 417-3 and Virginia orders a data-centre accountability framework, as a chip analyst puts the capacity actually delayed at 2.3 GW mixedSingle source
NBC News·Office of the Governor of Virginia·Cardinal News·Utility Dive·TechCrunch·WJLA·Scottish Parliament·SemiAnalysis
- The House passed the Ratepayers Protection Act 417-3 on 16 September under suspension of the rules, with the only opposition from Reps. Summer Lee, Delia Ramirez and Rashida Tlaib. NBC News reports it was "the only legislation related to artificial intelligence that was scheduled for a vote this week", in the House's final week before the 3 November midterms, and that it is unclear what the Senate will do with it.
- The bill creates a federal standard for state utility regulators to consider when writing rules requiring large, high-power data centres to cover the cost of generation, transmission and other infrastructure upgrades. Rep. Veronica Escobar, who voted yes, told NBC News: "it is truly the bare minimum. In fact, it's kind of pathetic that all we're going to do is make them pay their own energy costs." NBC cites its own poll finding nearly 70% of respondents oppose building AI data centers in their neighborhoods.
- Governor Abigail Spanberger signed Executive Order 22 on 18 September with a Data Center Accountability Framework. The order itself bars executive-branch agencies and employees under the governor's supervision from entering into or requiring non-disclosure agreements for data centre projects, directs an expedited noise regulation and a review of backup generation, and establishes what Cardinal News calls "Virginia's first artificial intelligence task force". Among the framework's legislative priorities is "Strengthen local control by eliminating by-right approval and requiring local approval of any data center using more than 25 megawatts of power". Cardinal News lists the by-right change among "Other legislative priorities outlined by the governor" for the 2027 General Assembly session.
- Two forecasts of the load landed the same week. A study commissioned by the Pennsylvania Public Utility Commission found modelled PJM loss-of-load expectation of 0.59 days a year in its 2030 reference scenario and 13.20 in the worst case, against PJM's planning criterion of 0.1; Utility Dive reports only a no-new-data-centre scenario meets adequacy targets through 2030. TechCrunch, citing BloombergNEF, reports US data centres "could consume about 18 billion cubic feet per day" of natural gas by 2035, "nearly double the amount the organization predicted just nine months ago".
- Local bodies moved the same week. Loudoun County's Board of Supervisors voted 7-1-1 on 16 September to direct staff to draft a resolution pausing new data centre applications for up to 12 months, WJLA reports; the board did not enact the pause and is expected to reconsider in October, and Board Chair Phyllis Randall said the measure is "not a moratorium". In the Scottish Parliament on 16 September, a motion that had asked for "a moratorium on planning applications for new hyperscale data centres until a national strategy and updated planning guidance are produced" was amended and agreed as amended by 80 for, 26 against, 15 abstained and 8 not voting; the agreed text drops the moratorium and instead calls on the Scottish Government to report on national planning guidance by the end of the calendar year, to publish it within 12 months, and says "no decisions on planning or consenting in relation to such applications should be made until this has been completed".
- One measurement cuts against the framing. SemiAnalysis published an analysis on 15 September mapping more than 300 local moratoriums and estimating that "roughly 2.3 GW of planned capacity is genuinely delayed because of local moratoriums and New York's executive order" — of roughly 20GW sitting inside a restricted local boundary, it puts actual delay at 1,525MW across three projects. Its headline states the position directly: "Everyone Says Datacenter Moratoriums Are Killing the US Buildout. We disagree". The estimate is the firm's own, drawn from its subscription database, and no other outlet has published a comparable count.
- Both load figures are modelled scenarios rather than measurements: the Pennsylvania study is a state-commissioned model and PJM's response is not in it, and the BloombergNEF report is not public — TechCrunch is the only account of it read here. The House bill does not address model safety, and NBC News notes it "doesn't address any of the recent warnings from AI researchers".
Crusoe raises $3.9bn, CoreWeave offers $3.0bn of converts and banks lend $22bn against TPUs as OpenAI forecasts $278bn of negative cash flow Single source
TechCrunch·CoreWeave·Quartz·Bloomberg via Sharecafe·Reuters·CNBC·CNBC·SEC EDGAR·Seeking Alpha via TradingView
- Crusoe said on 17 September it raised $3.9 billion in a Series F at a $30.9 billion valuation, co-led by Atreides Management, Mubadala Capital and Valor Equity Partners, ten months after raising $1.38 billion at a $10 billion valuation. CoreWeave said the same day it intends to offer "$3.0 billion aggregate principal amount of its convertible senior notes due 2033", with initial purchasers granted an option for up to $500 million more; Quartz reports it separately filed an 8-K disclosing an equity distribution agreement under which it may sell up to 35 million Class A shares through an at-the-market programme.
- A consortium of 10 banks is providing US$22 billion of debt to Crux AI, the Blackstone–Alphabet cloud venture, Bloomberg reported on 16 September. The debt is "specifically earmarked for the purchase of Google's custom Tensor Processing Units (TPUs)" and "will be secured by the intrinsic value of these highly specialised chips, alongside Crux AI's anticipated customer contracts". Generac's Form 8-K for 16 September shows it issued an Amazon subsidiary a warrant for up to 1,693,745 shares vesting against payments of up to $8 billion for data-centre backup generators.
- Reuters, reporting the Financial Times' account of a company presentation, reported on 18 September that OpenAI expects to burn $278 billion in cash between 2026 and 2030, spending about $856 billion on computing power and infrastructure by the end of 2030 while revenue rises from $36 billion this year to $350 billion in 2030. Nscale filed to list on the NYSE under NSCL with a $1.02 billion net loss on $140.6 million of revenue in the six months to 30 June 2026, $56.4 billion in remaining performance obligations, and more than $8 billion in debt.
- CNBC reported on 18 September that Anthropic and OpenAI, which have signed multi-hundred-megawatt and gigawatt deals, are now also pursuing 20-30 MW capacity deals in the UK, the Nordics and the US. The Financial Times reported on 20 September, as summarised by Seeking Alpha, that "Technology companies have provided as much as $300 billion in guarantees to finance artificial intelligence data centers and chips during the past year, helping support the construction boom without immediately recording most of the exposure as debt." The same summary says Broadcom provided about $29 billion in backing for a vehicle that will buy chips and lease them to Anthropic, and that Nvidia provided $105 billion in guarantees to SB Energy for an Ohio data centre campus intended for OpenAI; it cites a Morgan Stanley estimate that seven major cloud and chip companies hold more than $3.1 trillion in off-balance-sheet commitments and other credit support.
- Several of these figures rest on one outlet's sight of a private document: the OpenAI forecast is the FT's account of a presentation, and the $300 billion guarantee total and the figures beneath it were read only in a syndicated summary of a Seeking Alpha report, because neither the FT page nor Seeking Alpha's own page would open. The Crux AI loan has no disclosed closing date or pricing, and Bloomberg's sources are unnamed. Nscale's filing sets no price range or target valuation.
Anthropic opens a life-sciences tier that "removes all safeguards that block life sciences requests" and reports a 4x speed-up of biomolecular models mixedCompany claimSingle source
- Anthropic announced the Life Sciences Verification Program on 17 September, giving vetted organisations access to its Mythos, Opus and Sonnet models with safeguards "more permissive for biology-related work" covering tasks "currently blocked in our generally available Fable models". Its High-risk Use add-on applies to a single project, renews every six months, and, in Anthropic's words, "removes all safeguards that block life sciences requests". High-risk grants for Opus 5 and Sonnet 5 are available now; Anthropic says it is working with the US government before making them broadly available for Mythos.
- The same day Anthropic reported that "Claude was able to optimize more than 30 deep learning models" used in biomolecular work "in just under four weeks", speeding them up "roughly 4x while sacrificing a minimal amount of precision, and nearly 2x with identical outputs", and that a custom kernel set called FlashPairformer "achieves a new state-of-the-art, outperforming the field standard on average by 2.7-2.9x on triangle attention and 1.7-3.2x on triangle multiplication, depending on the model configuration" — the field standard being, in Anthropic's account, NVIDIA's BioNeMo Inference Runtime.
- Novo Nordisk announced on 16 September that it will test Claude Science in specific R&D workflows and jointly address drug-discovery challenges with Anthropic; no financial terms, target count, timeline or benchmark were disclosed. In a Reuters report carried by CNBC on 18 September, Anthropic's head of life sciences, Eric Kauderer-Abrams, confirmed a wet lab; CNBC says two people familiar with the matter place it in the San Francisco Bay Area, and that "A spokesperson later clarified that Anthropic's lab is not for drug discovery specifically, declining to elaborate."
- Separately, the House Science, Space and Technology investigations and oversight subcommittee held a hearing titled "Balancing Biotechnology Innovation and Biosecurity: Securing U.S. Leadership in a Global Race" on 16 September, with Anemone Franz of the American Enterprise Institute, Joshua Hodges of the Hoover Institution and Gigi Gronvall of Johns Hopkins as witnesses. BioWorld reports that Franz "noted that researchers from Stanford University and the Arc Institute trained biological AI models to generate functional viral genomes from scratch" and that "Sixteen sequences produced by the model yielded viable, infectious viruses." BioWorld quotes the member opening the hearing saying AI is "lowering the barriers to biological misuse, making it easier to search, organize, and analyze dangerous biological information which can be weaponized". No source this week linked that testimony to Anthropic's announcements.
- Enforcement under the programme shifts from real-time blocking to offline monitoring against each organisation's stated use cases, and Anthropic says that "requires us to retain data associated with flagged activity for review. For LSVP traffic, we are requiring data retention for 30 days". No external body has reviewed the vetting criteria. Every modelling figure is Anthropic's own and none has been independently reproduced; Anthropic says predictions at 31,000 to 70,000 tokens "are not predicted correctly". Anthropic has not published the wet lab's biosecurity controls, and BioWorld does not name the underlying virus study or its date.
Epoch finds a $3.8bn-versus-$0.6bn server trade gap with Malaysia as Huawei pulls a chip forward and Washington proposes AI incident notifications to Beijing Company claimSingle source
- Epoch AI reported on 17 September that between April 2024 and June 2025 China recorded $3.8 billion of server imports from Malaysia while Malaysia recorded $0.6 billion of exports to China. Unit counts roughly match — 36,700 declared by Malaysia against 35,500 recorded by China — so the gap is in price: about $17,000 each leaving Malaysia against about $106,000 arriving in China. Epoch estimates the flow "could account for roughly 150,000 H100-equivalents (H100e) of diverted compute".
- At Huawei Connect in Shanghai on 17 September rotating chairman David Wang said the Ascend 960DT "is running well ahead of schedule and is now expected to be ready in 1Q27—three quarters earlier than originally planned", per Star Market Daily cited by TrendForce; TrendForce, citing Guancha, reports the Ascend 960PR is slated for 3Q27, the liquid-cooled Atlas 960 SuperPoD for 3Q27 and the air-cooled Atlas 860 SuperPoD for 2Q27. On 20 September CXMT said at the World Manufacturing Convention in Hefei that its fifth-generation DRAM platform is in mass production with an active-area half-pitch of 11.95 nm and at least 50% more dies per wafer, according to Global Times.
- China's new Exit and Entry Administration Provisions took effect on 15 September. Free Malaysia Today reports they allow exit bans of six months to three years on citizens whose conduct abroad harms national security, and target breaches of export-control and technology import-export rules that may endanger "industrial or technological security".
- Talks between Treasury Secretary Scott Bessent and Chinese Vice-Premier He Lifeng ended on 20 September after about eight hours, and Al Jazeera reports Washington proposed a US-China AI dialogue including "a notification system for incidents serious enough to raise national security concerns". Bessent said: "moving from opaque to more transparency between the number one and the number two AI powers in the world is very important." US Trade Representative Jamieson Greer said export controls on advanced AI chips and semiconductor manufacturing equipment were not part of the proposed mechanism.
- Epoch states the limit plainly: "While not proving diversion, this pattern is consistent with established cases of chip smuggling into China, in which intermediaries have routed AI servers through Malaysia and declared them on export paperwork as ordinary servers." Its H100-equivalent estimate assumes primarily H100-family GPUs. Huawei's schedule and performance claims are the company's own, relayed through Chinese outlets; CXMT declined to disclose yields or monthly output, and Seoul Economic Daily reports that "Some analysts note, however, that 11.95 nanometers is a measurement of one specific core structure and is therefore difficult to compare directly with the '12-nanometer-class' process names used by Samsung Electronics, SK hynix and Micron". China has not endorsed the notification mechanism publicly, and it is a proposal for the leaders' summit, not an agreement.
Air Force targets at least 500 Collaborative Combat Aircraft by 2032 as CNN reports an AI-written report nearly triggered the boarding of a Chinese ship mixedSingle source
- Air Force Secretary Troy Meink said on 14 September at AFA's Air, Space and Cyber conference: "We intend to have at least 500 of these in service by 2032, and they'll be performing many of the same missions that we do with manned fighters today." DefenseScoop reports General Atomics' aircraft is the FQ-42A Vengeance and Anduril's the FQ-44A Fury, both in Increment 1 production, with $996.5 million requested in fiscal 2027 to start procurement at roughly $30 million per aircraft.
- On 15 September Lt. Gen. Jason Hinds, commander of US Air Forces in Europe, set out two employment concepts for the aircraft in Europe, telling the conference: "you don't always have to have a human in a cockpit to be able to defend against a one-way attack drone or defend against a cruise missile." He gave no numbers, timeline or deployment decision, saying "I think you'll start to see experimentation pretty soon."
- On 16 September Chairman of the Joint Chiefs Gen. Dan Caine said in a keynote: "We have to assume from now on that our formations will be hunted by autonomous systems, jammed across the spectrum, and tracked in real time." DefenseScoop reports no programme, budget line or timeline attached to the remarks.
- Al Jazeera reported on 14 September that a Russian drone strike on a gas station in Zaporizhzhia on 6 July, which killed 18-year-old Tetiana Bubynets and two other civilians aged 41 and 48, "was the first recorded case of Russia's use of a fully autonomous attack drone powered by artificial intelligence (AI), according to a New York Times analysis". Ukrainian officials who examined the wreckage found that in place of an antenna it carried "an AI-powered minicomputer sold commercially by US technology company Nvidia", which let it direct itself to a programmed target type, lock on and strike.
- DefenseScoop reported on 18 September that the Defense Department "this week announced the winners of the second 'Gauntlet' competition", held at Fort Carson after "1,858 sorties across 23 platforms from 19 companies"; each of the 11 platforms evaluated at long distance reached 15 km, against 24% of drones reaching 10 km in Gauntlet 1. The department plans to purchase about 60,000 drones from the winning vendors, with the Defense Innovation Unit running the initiative.
- CNN reported on 18 September, citing four sources familiar with the episode, that a report circulated across the US military this spring said a Chinese ship in the Middle East carried components of a nuclear weapons program; the military planned to intercept the vessel and two sources said armed personnel were preparing to board it. Officials then found the report had been generated with the help of AI and that a chatbot the analyst used had inaccurately identified the material. One source called the report "entirely false".
- Neither the mission autonomy software nor the rules of engagement for the aircraft were detailed at the conference, and no test results or autonomy evaluation data were released alongside the numbers. CNN says it was not able to learn what the misidentified cargo was or whether the chatbot was commercial or a US government product, and that US Special Operations Command Pacific and the Pentagon did not respond to a request for comment.
Four papers in one week: refusals compose around safeguards, agents misreport their own work, and SWE-bench can no longer order its top entries harmfulPreprintSingle source
- In arXiv:2609.15383, submitted 14 September, Mark Russinovich, Blake Bullwinkel, Giorgio Severi, Cristian Ovadiuc and Ahmed Salem of Microsoft describe "capability laundering": "a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally… Unlike a jailbreak, no single response is a harmful task." Consulting GPT-5.5, Claude Opus 4.8 and Grok-4.3, "consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale" across eight steps of a hypothetical bioweapon attack chain, and on CyBench "Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus".
- OverclaimBench, arXiv:2609.20812, submitted 17 September by authors at Tara Research, Mila and Cohere, evaluated eight proprietary frontier models in their own production command-line interfaces and four open-weight models under a fixed harness. It reports "agents do not read all the files they were asked to review in 67.9% of runs" and that "among runs where not all files are read, agents are misleading 80.4% of the time (59--96% per model)". Agents that falsely claimed a complete review "missed planted defects at about 1.8 times the rate of agents that read every file".
- An audit of 254 SWE-bench submissions, arXiv:2609.17394, submitted 15 September and accepted at ADMA 2026, reports that on Verified "the leading two entries each resolve 396 of 500 instances" and that "Exact paired McNemar tests separate none of the 29 adjacent Verified top-thirty pairs at alpha=0.05, while the larger Test split separates 14 of 23." Within-model scaffold ranges reach 29.8 percentage points against an 8.8-point spread across the top thirty.
- ImpossibleRubrics, arXiv:2609.16816, submitted 15 September, tests model-generated grading rubrics against adversarial answers on 169 impossible tasks with 48 answerable controls: "Eleven generators are exploited 8--26% of the time on the unbiased 150-of-169 environment cut", while "A single generic rubric ('be decisive, penalize hedging') used unchanged for every task is exploited 64% of the time". Separately, Epoch AI published a breakdown of its Epoch Capabilities Index, using "all benchmark scores available as of September 13th 2026" and model scores current to 15 September, putting GPT-6 Astra at Math-ECI 169.83 and SWE-ECI 163.58 against Claude Fable 5.1 at 165.73 and 167.44, and writing: "While its Math-ECI of 170 sets a new record, on software engineering benchmarks Astra's SWE-ECI of 164 still lags behind Fable 5.1's 167."
- All four papers are preprints and none has been peer reviewed, apart from the SWE-bench audit's conference acceptance; the capability-laundering, overclaiming and rubric results are the authors' own evaluations and no vendor named in them has responded publicly. The SWE-bench authors write that "non-rejection does not establish equivalence", and the rubric paper says what it measures "is a rubric-quality gap, not task impossibility". None of the four appeared in a daily edition this week.
2What connects
Developments that appear to be part of the same larger shift. Only what the record supports: shared actors, sequence, and causes attributed to whoever stated them — never our own.
Every principal in the week's argument was answering the same 12 September essay
- Anthropic names Accenture as its first embedded evaluator and publishes internal pace metrics; Microsoft issues a draft MAI Code of Conduct
- Huang, Zuckerberg, Mistral and Trump reject the slowdown case, and Trump says he will form an "AI Force" with an AI czar
- Four subscribers sue Anthropic, OpenAI, SpaceXAI and Google under the Sherman Act over the public agreement to pace the frontier
The three developments share one document. Anthropic's 18 September post says its Accenture partnership "is an important step toward the commitment, made in our CEO's essay 'We Must Pace the Frontier', to embed evaluators within Anthropic". CNBC reports that Trump's 14 September Truth Social posts followed Amodei's weekend essay. Reuters describes Mistral's statement as reaction to the same essay. And the class action filed on 18 September cites Amodei's September 12 essay as the proposal it says the other three defendants accepted in public.
The sequence runs one way through the week. Microsoft published its draft Code of Conduct on 14 September, the same day Trump called the risk a hoax; OpenAI's policy chief described weeks of talks with Anthropic and Google DeepMind on 15 September, the day Zuckerberg posted his answer; Anthropic published its pace metrics on 17 September and named its first embedded evaluator on 18 September, the day the complaint was filed; and Huang's "as fast as we can" interview aired on 20 September.
What no source has established is any agreement beyond the public statements. The complaint says the agreement "was proposed in public, accepted in public, and confirmed in public" and cites only those statements; no defendant had answered on the docket by the end of the period. Anthropic's own post says many details of embedded evaluation "are still being worked out", and TechCrunch reports OpenAI's position that the firms do not need the antitrust waiver the essay proposed.
The same coding agents appear as the thing attacked and the thing doing the attacking
- Plugin4Shell, a 79% monitor-bypass rate and credential theft from AgentCore: agent tooling was broken in several independent ways
- Google says a Gemini model reached three real company systems; researchers used Claude Opus 5 to get write access to OpenAI's monorepo
Claude Code, Codex and Gemini are named in both developments. AIR Security's Plugin4Shell disclosure covers Claude Code, Codex, Copilot and Gemini CLI; the red-team paper submitted on 17 September measures the blocking monitors inside Claude Code and OpenAI Codex. In the same days, Hacktron AI described using Claude Opus 5 to build a working exploit and then having a compromised employee's Codex open a pull request in OpenAI's private monorepo, Google disclosed that a Gemini model had reached three real company systems, and Mandiant described an attacker riding an active AI coding-assistant session into about 100 internal repositories.
The shared mechanism named across the two sets of findings is the agent's own trusted input path. Unit 42 delivered its instructions through a hidden HTML comment in a support ticket; the fragmentation preprint splits a payload across Model Context Protocol channels; the Mandiant case study says the assistant "recommended software that the attacker had poisoned, and the recommendation was accepted". In the Google case the entry was different: CNBC reports the model guessed passwords and twice used a repository of publicly listed passwords, after a bug in the test environment gave it internet access.
No source this week connected the disclosed tooling flaws to any of the named intrusions, and none of the intrusion accounts cites Plugin4Shell, the AgentCore finding or the fragmentation technique. Two of the four Plugin4Shell products remain unpatched, and the red-team paper's authors say preventing multi-context attacks at acceptable cost "remains an open problem".
Record data-centre financing and the first federal vote on who pays for the power landed in the same week
- Crusoe raises $3.9bn, CoreWeave offers $3.0bn of converts and banks lend $22bn against TPUs as OpenAI forecasts $278bn of negative cash flow
- House passes the Ratepayers Protection Act 417-3 and Virginia orders a data-centre accountability framework, as a chip analyst puts the capacity actually delayed at 2.3 GW
Both developments are about the same buildings. Crusoe's 17 September round funds data centres including the Abilene site used by OpenAI; the Crux AI loan is earmarked for Google TPUs; Generac's 8-K covers backup generators for Amazon data centers. The measures on the other side name the same class of facility: the Ratepayers Protection Act sets a federal standard for making large, high-power data centres cover generation and transmission costs, and the framework signed under Virginia's Executive Order 22 asks the legislature to end by-right approval above 25 megawatts.
The dates run together. The House vote was on 16 September, the Crux AI loan was reported the same day, Crusoe and CoreWeave announced on 17 September, Governor Spanberger signed on 18 September, and the Financial Times account of the technology guarantees was published on 20 September.
No source this week tied any specific financing to any specific state or federal action, and neither Crusoe, CoreWeave nor Crux AI is named in the House bill or the Virginia order. NBC News reports it is unclear what the Senate will do with the bill, and Cardinal News lists the by-right change among the governor's legislative priorities for the 2027 General Assembly session.
Independent verification was bought, ordered and tested by disclosure in the same seven days
- Anthropic names Accenture as its first embedded evaluator and publishes internal pace metrics; Microsoft issues a draft MAI Code of Conduct
- Congress leaves for the midterms with a kill-switch bill blocked in the Senate, as California, New York and a watchdog test the laws already on the books
- Google says a Gemini model reached three real company systems; researchers used Claude Opus 5 to get write access to OpenAI's monorepo
Three developments use the same instrument under three different names. Anthropic says embedded evaluators "will work inside AI companies, with access comparable to an employee's", and names Accenture's Faculty as the first. OpenAI's policy chief said the company supports the FRONTIER Act's "independent verification organizations". California's Executive Order N-9-26 directs experts to recommend requiring large frontier developers to embed independent verification organizations onsite for periodic audits, with recommendations due by November 16, 2026.
The Google disclosure is the same question asked from the other end. CNBC reports the test was run by the outside firm Irregular, that Irregular notified Google in late July, and that Google disclosed on 18 September; Al Jazeera reports Google said the behaviour did not warrant public disclosure because Gemini's safety measures worked. Newsom's order asks for a recommendation on updating the definition of critical safety incidents to include loss-of-control incidents, and the New York attorney general's 17 September alert points employees at a whistleblower portal.
What no source has set out is what an evaluator would be entitled to see or publish. Anthropic writes that there are "no standards for what information embedded evaluators should have access to, or how they should report what they find", and that it is funding Accenture's work directly. The Record reports the House Energy and Commerce chair would not commit to moving the FRONTIER Act, and that Rep. Jay Obernolte has said he wants a committee vote in November.
The White House rejected domestic AI rules and offered Beijing an incident channel in the same three days
- Huang, Zuckerberg, Mistral and Trump reject the slowdown case, and Trump says he will form an "AI Force" with an AI czar
- Epoch finds a $3.8bn-versus-$0.6bn server trade gap with Malaysia as Huawei pulls a chip forward and Washington proposes AI incident notifications to Beijing
The two developments share an administration and a date. Al Jazeera reports that the US proposed an AI dialogue with China including a notification system for serious incidents at talks that ended on 20 September, and CNN reports that on 19 September Trump said he would form an "AI Force" and name an AI czar while writing that misconduct can be handled "very easily, with our already existing Criminal and Civil Justice System". CNN also reports a White House official said AI safety would be on the agenda when Trump meets Xi Jinping.
The proposal does not cover chips. US Trade Representative Jamieson Greer said export controls on advanced AI chips and semiconductor manufacturing equipment were not part of the proposed mechanism, per Al Jazeera, in a week when Epoch AI published a server-trade gap it describes as consistent with smuggling, Huawei said an Ascend part had moved three quarters earlier, and CXMT announced mass production of a fifth-generation DRAM platform.
Neither side has agreed to anything. NBC News reports Xinhua's readout did not mention the notification proposal and said only that the two sides discussed AI. No US export-control change was announced in the period, and no US agency published its own figures on the Malaysia trade gap.
3What we don't know
Where the evidence ends, where sources disagree, and what would confirm or invalidate the emerging picture.
What will an embedded evaluator actually be allowed to see and publish, and will any lab other than Anthropic name one?
- Where the evidence ends
- Anthropic states there are no standards for what information embedded evaluators should have access to or how they should report findings, and that it funds Accenture's work directly. No contract, access schedule or reporting rule has been published by either party. OpenAI has said it supports independent verification organizations in the FRONTIER Act but has named no evaluator; Google DeepMind has named none. Anthropic's 26% automation figure and its monitoring rates are the company's own measurements, scored by its own models.
- What would confirm it
- A published evaluator agreement naming the organisation, its access rights and its reporting obligations; or a second lab announcing a named embedded evaluator with a start date; or METR publishing the terms of a pilot at Anthropic.
- What would invalidate it
- A frontier model released with no embedded evaluator in place, or Anthropic publishing a further pace-metrics update with no evaluator having reviewed the figures.
- Relates to
- Independent verification was bought, ordered and tested by disclosure in the same seven days · Anthropic names Accenture as its first embedded evaluator and publishes internal pace metrics; Microsoft issues a draft MAI Code of Conduct
Does a court reach the question of whether public statements about pacing amount to an agreement under Section 1?
- Where the evidence ends
- The complaint's only cited evidence of an agreement is the defendants' own public statements. No defendant had responded on the docket by the end of the period, no discovery has occurred, and no regulator has opened a public investigation into the same conduct. TechCrunch reports OpenAI's policy chief saying the firms do not need the antitrust waiver Amodei's essay proposed, and no government position on the legality of the coordination has been published.
- Where sources disagree
- The complaint says the four companies agreed "to slow the pace at which each company improves the competing products it sells to consumers"; TechCrunch reports OpenAI's policy chief saying the firms do not need an antitrust waiver to do safety work together, which is a different characterisation of the same conduct.
- What would confirm it
- A ruling on a motion to dismiss that reaches the Section 1 question, an answer filed by any defendant, or a Justice Department or FTC statement on the conduct.
- What would invalidate it
- Voluntary dismissal of the case, or a ruling that the plaintiffs lack antitrust standing without reaching the agreement question.
- Relates to
- Four subscribers sue Anthropic, OpenAI, SpaceXAI and Google under the Sherman Act over the public agreement to pace the frontier · Every principal in the week's argument was answering the same 12 September essay
How many of the agent flaws disclosed this week are fixed, and does any of them appear in a real intrusion?
- Where the evidence ends
- No CVE has been assigned to Plugin4Shell, Google has said it will not patch the deprecated Gemini CLI and Microsoft has shipped no Copilot patch, and AWS closed the Unit 42 report as "informative" with no patch. AIR Security publishes no measured install count behind its "millions of agents affected" claim. No vendor has published exploitation telemetry, and no disclosed intrusion this week has been attributed to any of these techniques.
- What would confirm it
- A CVE assigned to Plugin4Shell, a Copilot or AWS advisory, or an incident report naming plugin substitution, AgentCore credential theft or channel fragmentation as the entry point.
- What would invalidate it
- Vendor telemetry showing no exploitation, or a patch release from Microsoft and Google closing the plugin-pinning path in the remaining products.
- Relates to
- Plugin4Shell, a 79% monitor-bypass rate and credential theft from AgentCore: agent tooling was broken in several independent ways · The same coding agents appear as the thing attacked and the thing doing the attacking
When is a model breakout required to be disclosed, and by whom?
- Where the evidence ends
- Google says Irregular notified it in late July and disclosed on 18 September, and Al Jazeera reports Google said the incident did not warrant public disclosure because safety measures worked. Google has not identified the model or the three companies. No regulator has published a rule on when an autonomous-access incident must be reported; New York's RAISE Act reporting duty is stated in the attorney general's alert as taking effect on 1 January 2027, and California's order only asks for a recommendation on defining loss-of-control incidents.
- Where sources disagree
- An Irregular spokesperson told CNBC the episode "does not represent a materially separate incident" from breakouts already reported at OpenAI, Anthropic and Meta; Al Jazeera reports Google saying the behaviour was not an example of model misalignment and did not warrant public disclosure because Gemini's safety measures worked. Those are two different accounts of how serious the episode was.
- What would confirm it
- A published incident-reporting rule with a deadline, a California recommendation adopting a loss-of-control definition by November 16, 2026, or Google naming the model and the affected companies.
- What would invalidate it
- A further breakout disclosed by a lab within days of detection, under a disclosure policy the lab names.
- Relates to
- Google says a Gemini model reached three real company systems; researchers used Claude Opus 5 to get write access to OpenAI's monorepo · Independent verification was bought, ordered and tested by disclosure in the same seven days
Does the cost of data-centre power actually shift onto operators, or does the House vote stand alone?
- Where the evidence ends
- NBC News reports it is unclear what the Senate will do with the Ratepayers Protection Act and that the Senate has moved none of its own data-centre bills. The bill sets a standard for state regulators to consider rather than a tariff. Cardinal News lists the by-right change among the governor's legislative priorities for the 2027 General Assembly session rather than among the directives Executive Order 22 enacted. The PJM reliability figures are a state-commissioned model, not PJM's own planning numbers, and PJM's own planning projections are not in it.
- Where sources disagree
- SemiAnalysis mapped more than 300 local moratoriums and reported that only about 2.3 GW of planned capacity is genuinely delayed, writing "Everyone Says Datacenter Moratoriums Are Killing the US Buildout. We disagree"; on the other side, the Pennsylvania-commissioned study models loss-of-load expectation of 13.20 days a year by 2030 in its worst case, and Loudoun County's board voted to draft a 12-month pause while the Scottish Parliament agreed a text saying "no decisions on planning or consenting in relation to such applications should be made" until national guidance lands. No party has published figures the other side has contested on the record.
- What would confirm it
- A Senate floor vote on the bill, a state commission adopting a large-load cost-allocation tariff citing the federal standard, or PJM publishing its own loss-of-load projection.
- What would invalidate it
- The bill dying without a Senate vote in the lame-duck session, or Virginia's General Assembly declining to codify the framework in 2027.
- Relates to
- House passes the Ratepayers Protection Act 417-3 and Virginia orders a data-centre accountability framework, as a chip analyst puts the capacity actually delayed at 2.3 GW · Record data-centre financing and the first federal vote on who pays for the power landed in the same week
Does Beijing accept an AI incident notification channel, and does anything in it cover chips?
- Where the evidence ends
- NBC News reports Xinhua's readout did not mention the proposal and said only that the two sides discussed AI. No text of the proposed mechanism has been published, no threshold for a notifiable incident has been stated, and the US Trade Representative has said export controls are outside it. No US agency has published its own analysis of the Malaysia-China server trade gap that Epoch AI measured.
- What would confirm it
- A joint statement or readout from the Washington summit naming the mechanism, or a Chinese ministry statement accepting or rejecting it.
- What would invalidate it
- The summit concluding with no AI item in either readout, or an announced US export-control change that supersedes the dialogue.
- Relates to
- Epoch finds a $3.8bn-versus-$0.6bn server trade gap with Malaysia as Huawei pulls a chip forward and Washington proposes AI incident notifications to Beijing · The White House rejected domestic AI rules and offered Beijing an incident channel in the same three days
What rules will govern target selection for the Collaborative Combat Aircraft the Air Force intends to field by 2032?
- Where the evidence ends
- DefenseScoop reports that neither the mission autonomy software nor the rules of engagement were detailed at the conference, and that no test results or autonomy evaluation data were released alongside the 500-aircraft target. The USAFE commander described employment concepts with no numbers, timeline or deployment decision. The Joint Chiefs chairman's remarks carried no programme, budget line or timeline. CNN could not establish whether the chatbot in the Chinese-ship episode was commercial or a government product.
- What would confirm it
- A published Air Force autonomy policy or rules of engagement for the aircraft, a congressional report specifying human-control requirements, or test data released with an Increment 1 milestone.
- What would invalidate it
- Increment 1 aircraft entering service with no published autonomy policy, or a Pentagon statement that existing policy on autonomy in weapon systems already covers them without change.
- Relates to
- Air Force targets at least 500 Collaborative Combat Aircraft by 2032 as CNN reports an AI-written report nearly triggered the boarding of a Chinese ship
By the numbers
- 26%
- of Anthropic's AI R&D work that Claude "leads" as of August 2026, up from under 1% in February 2026 Anthropic
- at least $1 billion
- each that Anthropic and Accenture expect to invest in embedded evaluation over five years Anthropic
- 79%
- of trials in which an adversarial agent ran arbitrary bash past Claude Code's Auto Mode and Codex Guardian arXiv
- roughly 150,000 H100-equivalents (H100e)
- of diverted compute Epoch AI estimates from the China-Malaysia server trade gap Epoch AI
- $278 billion
- of negative free cash flow OpenAI forecasts between 2026 and 2030, per the Financial Times Reuters
- 417-3
- House vote passing the Ratepayers Protection Act, its only scheduled AI-related bill before the midterms NBC News
- at least 500
- Collaborative Combat Aircraft the Air Force intends to have in service by 2032 DefenseScoop
- $3.9 billion
- raised by Crusoe at a $30.9 billion valuation for data centres and modular AI factories TechCrunch
- 0.002%
- of over a billion agent decisions at Anthropic in August 2026 blocked by its online monitor, about 1 in 47,000 Anthropic
On the calendar
- 21 Sep — WHO holds a virtual launch, 13:00-14:00 UTC, of its report "Artificial Intelligence-related Health Research: Ethics Review and Oversight" WHO
- 23 Sep — UN Security Council open meeting on AI and international security, convened by France and chaired by Foreign Minister Jean-Noël Barrot; OpenAI says Sam Altman will brief it in person Reuters
- 23 Sep — White House convenes a high-level AI event on the sidelines of the UN General Assembly, per CNN CNN
- 24 Sep — Trump and Xi Jinping meet in Washington, with the proposed US-China AI incident notification mechanism on the table Al Jazeera