Trump Announces Plan to Create an 'AI Force' Modeled on Space Force

AI Daily Digest — September 21, 2026 Top story: the week's fight over who controls the frontier moved out of the labs and into the White House — and the day's most-read technical story was OpenAI quietly shipping a cross-site tracking cookie. Over the weekend President Trump announced on Truth Social that he will stand up an "AI Force" modeled on the Space Force and name an AI czar, while explicitly rejecting the pacing proposal that Dario Amodei, Sam Altman and Elon Musk converged on nine days ago. Separately, an independent researcher published a teardown of __obi, an OpenAI cookie that binds a signed-in ChatGPT account to browsing activity on third-party sites — it became the most-discussed AI item on Hacker News today. Add Plugin4Shell, the zero-click RCE disclosed Friday against all four major coding agents (two of which are still unpatched), and the through-line of the last 72 hours is governance: not of model capability, but of the ordinary plumbing shipped around it. * * Notable Papers & Research How Do Agent Harnesses Create Value? Planning Information and Release Control in Stateful LLM Agents (arXiv 2609.20474) Decomposes what an agent harness actually buys you by pitting prewritten task-specific plans (Fixed) against word-count-matched shuffled policy text (Sham). Across 265 matched cells, Fixed improves oracle-verified success by 7.17 points, with gains concentrated in higher-complexity tasks — so the planning text is doing real work, not just occupying context. The second half is the more useful finding for anyone shipping agents: a read-only terminal verifier rejects 61% of oracle-invalid episodes while withholding 17% of correct ones, for under a cent per episode. Which component dominates depends entirely on what you think a wrong-but-accepted answer costs: at low liability the planning gain wins, at high liability the verifier does. That is a design knob, stated as one, which is rare. (arXiv) The More It Says, the More You Pay: A Black-Box Audit of Provider-Side Token Inflation in LLM Services (arXiv 2609.20370) Formalizes the Provider-Side Token Inflation Attack (PTIA) — a dishonest pay-per-token provider covertly lengthening output while preserving task utility — and demonstrates five variants at the query, prompt, representation and model levels. Each pushes mean output length to more than 10.2× the clean baseline. The defense turns on an observed saturation effect: the first intervention sharply suppresses the end-of-sequence probability and further stacking does little, so applying a second similar intervention and measuring the (non-)response yields a single-probe black-box audit a customer can run against an opaque API. Verifiable billing has been an assumption rather than a property; this is the first practical test. (arXiv) SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes Mengxiao Wang, Nitesh Saxena (arXiv 2609.19705) Introduces FARSIGHT, a scheme-level evaluation framework testing financial LLM agents on robustness under market turbulence (including flash-crash scenarios) and on three attack classes: attacks on information sources, attacks on the agent, and agent-as-attacker. Applied to 15 representative academic trading schemes: 80% fail at least one core robustness metric and 100% exhibit security vulnerabilities. These are agents with direct execution authority over real capital in a reflexive market, and the literature proposing them has been evaluating for returns rather than for adversarial conditions. (arXiv) Also in the window What Do We Expect from LLMs? Mapping the Design of LLM Benchmarks (2609.19182) — systematically codes 14,767 papers introducing or updating evaluation resources from January 2022 to August 2026, and finds LLM-based scoring growing inside both agent and non-agent benchmarks. Its closing question is the sharp one: does more evaluation produce more independent evidence, or reproduce the blind spots of the models doing the evaluating? (arXiv) No significant new world-model or spatial-intelligence paper landed in this window; the September cluster (Programmable World Model 2609.10540, WorldSculpt 2609.05416) remains the recent reference set. * * Model & Product Launches TypeSafe AI — Jev, and the "System One" model class (reserved slot: lab not covered elsewhere in this digest) TypeSafe AI, founded by Diego Almeida — who says he co-created ChatGPT and worked on RLHF at OpenAI — released Jev, a foundation model that does not generate text at all. Instead of autoregressive decoding it emits decisions directly, as probabilities with confidence scores, trained via what the company calls reinforcement learning from calibrated decisions (RLCD): the target is not a correct answer but an epistemically honest one. TypeSafe claims up to 100× faster and 100× cheaper than conventional LLMs on classification and routing-shaped tasks while staying competitive on intelligence, aimed at real-time loops — games, robots, simulations — where latency and calibration matter more than prose. Announced September 18; it has been the week's most enthusiastic developer reaction. Worth watching alongside Cua's CUA-S1 (yesterday's digest): two independent groups arriving at "not every step needs a frontier model" within 48 hours of each other. (TechCrunch, TypeSafe blog, AI News) Alibaba — Qwen-Image-2.1 Released September 20 to Hugging Face and ModelScope: a 7B, 32-layer single-stream DiT paired with a Qwen3-VL 8B text encoder and a 64-channel RGBA VAE, producing native 2048×2048 output at 40 steps. Two things distinguish it. First, native transparent (RGBA) generation and editing without a separate matting step, plus up to ten reference images at once for group portraits, try-on and room design. Second, the license: Alibaba dropped Apache for research-only weights, with commercial use requiring a separate grant. A 7B open-weight model claiming to beat closed competitors on Qwen's own benchmark is the headline; the license change is the part the ecosystem will actually feel. (the-decoder, AlphaSignal) Google — AX v0.3.0, the agent orchestrator AX (Agent Executor), Google's Apache-2.0 open orchestrator for running agent workloads on top of Agent Substrate, reached v0.3.0 and took the top AI slot on Hacker News today (214 points). The release splits AX into three services — API front end, reconciler, sandboxed task runner — and, most consequentially, moves task state out of Kubernetes custom resources into Redis Streams, because etcd was never built for the churn of millions of short-lived agent tasks. Repo is at ~3.7k stars. The framing being made explicit here — that agent execution needs a scheduler-and-runtime layer rather than a library — is the "Kubernetes moment for agents" pitch, and Google is the one making it in the open. (GitHub, The Stack, Google Cloud blog) Claude Mythos — Watchlist Update No update.Mythos 5.1 (September 1) remains current — 1M-token context, 128k max output, always-on adaptive thinking — still gated to vetted cyberdefenders and life scientists through Project Glasswing, at $10/M input and $50/M output. Nothing new in this window. The adjacent item is Anthropic's patch cadence rather than the model: Claude Code shipped the Plugin4Shell fix in 2.1.179 (see below). (Anthropic) World Labs — Watchlist Update No update.Atlas (September 1) remains the last announcement: an omni world model pretrained natively on text, images, video and 3D, generating up to one minute of 1440p video from one or more reference images with camera path supplied as geometric input. Enterprise early access, no GA date, ~$1.2B raised. No new blog post, model or public statement from Fei-Fei Li in this window — the most recent is the September 4 a16z conversation with Justin Johnson, Ben Mildenhall and Martin Casado, a post-launch technical deep-dive on Atlas. (World Labs) * * Key Opinions & Statements Donald Trump — "AI Force," an AI czar, and no