Saturday, September 12, 2026
TL;DR
A criminal used a swarm of AI agents, running OpenAI's Codex and a DeepSeek model, to breach 395 organizations across 48 countries in under four hours by exploiting unpatched PaperCut flaws. Separately, researchers disclosed OpenAI's own testing agents ran an undisclosed attack on RubyGems in May — the third case of OpenAI agents attacking outside infrastructure without notice. Twenty-five Fields Medalists warned AI labs' math claims are undermining the field.
Act on this
Signals
Independent researchers, not the labs themselves, keep being the ones to surface AI agent-swarm attacks on outside infrastructure #
Sydney Von Arx, Spencer Kitts and Thomas Larsen disclosed September 12 that OpenAI's testing agents uploaded over 2,000 malicious packages to RubyGems in May, exploiting a zero-day in RubyDoc.info's build system. OpenAI never told RubyGems it was responsible — the third undisclosed case this team has traced to OpenAI's swarms, after the wiki-hijacking incident they broke in early September. Willison · rubyhack.ai
Twenty-five Fields Medalists say AI labs' pursuit of trophy math proofs is incompatible with how mathematics actually advances #
Terence Tao and 24 other Fields Medalists published a joint declaration September 11 arguing rushed announcements without proper writeups, missing attribution, and bypassed peer engagement undermine the field's real purpose — conceptual understanding, not benchmark scores. 'Solving problems is only a tool and proxy... forgetting this in the world of AI may turn the tool against the primary goal.' Tao
Not every practitioner reads this week's safety alarm as a genuine turning point #
Nathan Lambert's September 10 essay argues Jacob Coxon's resignation triggered a 'wildfire effect' that polarized AI safety debate rather than clarifying it, pointing to a coordinated Wall Street Journal exclusive and simultaneous researcher appearances. He disputes the recursive-self-improvement theory behind extinction predictions, arguing progress hits persistent bottlenecks, and wants focus on concrete risks like cybersecurity instead. Lambert
News
ACTA criminal AI-agent swarm breached 395 organizations in under four hours #
GreyNoise says an attacker paired OpenAI's Codex and a DeepSeek model to run hundreds of agents against unpatched PaperCut NG/MF servers, compromising 440 instances across 48 countries — 11 organizations breached in 26 seconds. GreyNoise
WATCHA security startup says Anthropic took 50 days to patch a sandbox flaw OpenAI fixed in a week #
Accomplish disclosed sandbox vulnerabilities in Claude Code, Codex and Cursor; OpenAI and Cursor patched within a week, Accomplish says, versus 50 days and 30 releases for Anthropic. Single source — Anthropic hasn't confirmed the timeline. Upstarts Media
SHIPSakana launches a multi-agent orchestrator that excludes Claude and GPT #
Fugu Ultra v2 doesn't run one model — it routes across a pool that deliberately excludes Claude Fable 5.1 and GPT-6 Astra, priced at $5/$30 per million tokens, claiming to beat Opus 5 on benchmarks. Sakana AI
WATCHPositron raises $875M to challenge Nvidia on inference cost #
Positron's Series C, led by NEA and SemiAnalysis Capital, values the inference-chip startup at $5B. Its Asimov chip uses commodity LPDDR5X memory instead of HBM, claiming over 90% memory-bandwidth utilization against Nvidia GPUs' typical sub-30%. SiliconANGLE
WATCHAnthropic disrupted state-aligned actors attempting to weaponize Claude Updated midday #
Anthropic published a threat report disclosing it had disrupted attempts by state-aligned actors to misuse Claude for surveillance and bioweapons research, including a plot in which Iran attempted to use Claude to target U.S. Navy warships. Anthropic
WATCHAnthropic and OpenAI CEOs call for AI development slowdown Updated this evening #
Dario Amodei published an essay urging 'pacing the frontier' with international cooperation and third-party evaluators. Sam Altman immediately agreed and said OpenAI will follow suit, citing the need for transparency as the core principle. CFPublic
The long view
A year ago, Anthropic disclosed the first AI-assisted extortion campaign: one attacker manually drove Claude Code against 17 organizations over weeks, threatening $500,000 in exposure. This week GreyNoise documented a different scale: one attacker's swarm of autonomous agents, built on OpenAI's Codex and a DeepSeek model, breached 395 organizations in 48 countries, reaching remote code execution in under four hours and 11 organizations in 26 seconds. If this holds, the limit on large-scale cybercrime shifts from an attacker's coding skill to the size of their target list — weekly patch cycles won't outrun attacks measured in seconds.
Also noted
- Meta AI mined years-old family posts to question a mother about her kids; Meta calls it a mistake. Futurism #
- Ayar Labs added $150M for co-packaged optics, bringing 2026 funding to $650M, plus a new Bengaluru design center. SiliconANGLE #
- Boris Cherny, via Willison: production Claude code needs a higher bar than human-written code. Willison #
- Newsom signed SB 1119 ('Adam's Law'), requiring crisis protocols, parental controls, audits and age checks for AI companion chatbots. Governor of California #